관리-도구

편집 파일: strace

Process 25389 attached
10:12:33.486987 futex(0x7ff3d3bc1a00, FUTEX_WAKE_PRIVATE, 2147483647) = 0
10:12:33.487125 sendto(4, "\260\0\0\1\205\242>\0\0\0\0@\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0finest09_contact\0\24\344\337\227\2442Y\20==#\f*\225\224\246\210\371\301\360Pmysql_native_password\0S\3_os\5Linux\f_client_name\10libmysql\4_pid\00525389\17_client_version\0065.6.27\t_platform\6x86_64", 180, 0, NULL, 0) = 180
10:12:33.487236 recvfrom(4, "\7\0\0\2\0\0\0\2\0\0\0", 16384, 0, NULL, NULL) = 11
10:12:33.487293 sendto(4, "\20\0\0\0\2finest09_brides", 20, 0, NULL, 0) = 20
10:12:33.487370 recvfrom(4, "\7\0\0\1\0\0\0\2\0\0\0", 16384, 0, NULL, NULL) = 11
10:12:33.487556 sendto(4, "a\1\0\0\3insert into contactform (firstlastname, emailaddr, phonenumber, weddingdate, guestcount, requestoption, preferredtimeforcall, question, requestsubmittedfrompage, registerdate) values ('Tyler rutt', 'Tylerrutt9@yahoo.com', '480-586-0868', 'March 13 201"..., 357, 0, NULL, 0) = 357
10:12:33.487795 recvfrom(4, "\t\0\0\1\0\1\374\3331\2\0\0\0", 16384, 0, NULL, NULL) = 13
10:12:33.487861 read(3, "anthem.php = anthemvenues@finestweddingsites.com\nanthem.php = kathy.cuaderno@clubcorp.com, anthem@finestweddingsites.com\n\napache_junction.php = apache_junctionvenues@finestweddingsites.com\napache_junction.php = info@thepaseovenue.com, paseo@finestweddingsi"..., 8192) = 8192
10:12:33.488295 read(3, "net, evrc@finestweddingsites.com\nwest-valley_teri.php = thawthorne@glendaleaz.com, glendaleciviccenter@finestweddingsites.com\nwest-valley_teri.php = weddings@hillcrestgolfclub.com, kcarter@scottsdalegolfgroup.com, hillcrestgolfclub@finestweddingsites.com\nw"..., 8192) = 8192
10:12:33.488715 read(3, "@finestweddingsites.com\neast-valley-north_teri.php = ellen.haboush@theboulders.com, boulders@finestweddingsites.com\neast-valley-north_teri.php = kgallagher@mcdowellmountaingc.com, mcdowell-mountain@finestweddingsites.com\n\neast-valley-south.php = ashley@fin"..., 8192) = 8192
10:12:33.489058 read(3, "rdan.Nimura@hotelpalomar.com, palomar@finestweddingsites.com\n\nphoenix-wedding-venues.php = googleadwords@finestweddingsites.com\nphoenix-wedding-venues.php = info@aldeaweddings.com, aldea@finestweddingsites.com \nphoenix-wedding-venues.php = tmueller@arizona"..., 8192) = 8192
10:12:33.489465 read(3, "om\nstyle_historical_teri.php = bnaughton@flagstaff.littleamerica.com, littleamerica@finestweddingsites.com\nstyle_historical_teri.php = sales@landmarkweddingsaz.com, aldea-landmark@finestweddingsites.com\n\nstyle_mountain.php = ashley@finestweddingsites.com, "..., 8192) = 8192
10:12:33.489838 read(3, "sheratonmesa@finestweddingsites.com\nstyle_luxury_teri.php = amy.redl@waldorfastoria.com, ashley.abbey@waldorfastoria.com, biltmore@finestweddingsites.com\nstyle_luxury_teri.php = rachelle@chateauluxeaz.com, info@chateauluxeaz.com, chateauluxe@finestweddings"..., 8192) = 8192
10:12:33.490189 read(3, "rdens@finestweddingsites.com\nstyle_outside_catering.php = wendydlippman@gmail.com, liztlaq@gmail.com, tlaq@finestweddingsites.com\nstyle_outside_catering.php = KelliW@foothillsgg.com, fhfb@ahwatukeegc.com, foothillsgolfclub@finestweddingsites.com\nstyle_outs"..., 8192) = 8192
10:12:33.490320 pipe2([5, 6], O_CLOEXEC) = 0
10:12:33.490365 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25397
10:12:33.490849 close(5)                = 0
10:12:33.490891 fcntl(6, F_SETFD, 0)    = 0
10:12:33.490941 fstat(6, {st_dev=makedev(0, 8), st_ino=2130165299, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
10:12:33.490995 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
10:12:33.491045 write(6, "To:  info@evrc.net, evrc@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"text/css\">.style3 {f"..., 2069) = 2069
10:12:33.491090 close(6)                = 0
10:12:33.491120 wait4(25397, Process 25397 attached
 <unfinished ...>
[pid 25397] 10:12:33.491168 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25397] 10:12:33.491218 close(6)    = 0
[pid 25397] 10:12:33.491251 dup2(5, 0)  = 0
[pid 25397] 10:12:33.491282 close(5)    = 0
[pid 25397] 10:12:33.491316 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25397] 10:12:33.491808 brk(0)      = 0x2064000
[pid 25397] 10:12:33.491860 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b625b000
[pid 25397] 10:12:33.491905 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.491963 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25397] 10:12:33.492004 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.492056 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fc0b6251000
[pid 25397] 10:12:33.492091 close(5)    = 0
[pid 25397] 10:12:33.492130 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25397] 10:12:33.492168 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.492207 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.492252 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fc0b5e1c000
[pid 25397] 10:12:33.492286 mprotect(0x7fc0b5e39000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.492332 mmap(0x7fc0b6038000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7fc0b6038000
[pid 25397] 10:12:33.492374 mmap(0x7fc0b603c000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0b603c000
[pid 25397] 10:12:33.492482 close(5)    = 0
[pid 25397] 10:12:33.492525 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25397] 10:12:33.492566 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.492603 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.492652 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fc0b5c18000
[pid 25397] 10:12:33.492689 mprotect(0x7fc0b5c1a000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.492721 mmap(0x7fc0b5e1a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7fc0b5e1a000
[pid 25397] 10:12:33.492764 close(5)    = 0
[pid 25397] 10:12:33.492801 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25397] 10:12:33.492839 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.492876 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.492919 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b6250000
[pid 25397] 10:12:33.492955 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fc0b5884000
[pid 25397] 10:12:33.492988 mprotect(0x7fc0b5a0e000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.493020 mmap(0x7fc0b5c0e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7fc0b5c0e000
[pid 25397] 10:12:33.493059 mmap(0x7fc0b5c13000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0b5c13000
[pid 25397] 10:12:33.493098 close(5)    = 0
[pid 25397] 10:12:33.493149 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b624f000
[pid 25397] 10:12:33.493186 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b624e000
[pid 25397] 10:12:33.493219 arch_prctl(ARCH_SET_FS, 0x7fc0b624f700) = 0
[pid 25397] 10:12:33.493348 mprotect(0x7fc0b5c0e000, 16384, PROT_READ) = 0
[pid 25397] 10:12:33.493391 mprotect(0x7fc0b5e1a000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.493555 mprotect(0x7fc0b625c000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.493591 munmap(0x7fc0b6251000, 39387) = 0
[pid 25397] 10:12:33.493657 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.493707 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25397] 10:12:33.493757 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd032e8bd0) = -1 EINVAL (Invalid argument)
[pid 25397] 10:12:33.493831 brk(0)      = 0x2064000
[pid 25397] 10:12:33.493905 brk(0x2085000) = 0x2085000
[pid 25397] 10:12:33.493959 getuid()    = 503
[pid 25397] 10:12:33.493994 getgid()    = 500
[pid 25397] 10:12:33.494024 geteuid()   = 503
[pid 25397] 10:12:33.494054 getegid()   = 500
[pid 25397] 10:12:33.494091 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.494159 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
[pid 25397] 10:12:33.494212 fstat(5, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.494258 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b625a000
[pid 25397] 10:12:33.494292 read(5, "MemTotal:        1048576 kB\nMemFree:          278544 kB\nCached:           325804 kB\nBuffers:               0 kB\nActive:           275060 kB\nInactive:         466908 kB\nActive(anon):     146364 kB\nInactive(anon):   277604 kB\nActive(file):     128696 kB\nInac"..., 1024) = 588
[pid 25397] 10:12:33.494378 close(5)    = 0
[pid 25397] 10:12:33.494452 munmap(0x7fc0b625a000, 4096) = 0
[pid 25397] 10:12:33.494524 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.494576 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.494612 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.494646 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.494679 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.494713 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.494748 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.494782 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.494819 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25397] 10:12:33.494897 getcwd("/home/finest09/public_html/includes", 4096) = 36
[pid 25397] 10:12:33.494944 getpid()    = 25397
[pid 25397] 10:12:33.494984 getppid()   = 25389
[pid 25397] 10:12:33.495023 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25397] 10:12:33.495075 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495124 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495168 geteuid()   = 503
[pid 25397] 10:12:33.495197 getegid()   = 500
[pid 25397] 10:12:33.495225 getuid()    = 503
[pid 25397] 10:12:33.495253 getgid()    = 500
[pid 25397] 10:12:33.495281 access("/bin/sh", X_OK) = 0
[pid 25397] 10:12:33.495314 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495377 geteuid()   = 503
[pid 25397] 10:12:33.495454 getegid()   = 500
[pid 25397] 10:12:33.495485 getuid()    = 503
[pid 25397] 10:12:33.495514 getgid()    = 500
[pid 25397] 10:12:33.495542 access("/bin/sh", R_OK) = 0
[pid 25397] 10:12:33.495577 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495622 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495664 geteuid()   = 503
[pid 25397] 10:12:33.495693 getegid()   = 500
[pid 25397] 10:12:33.495724 getuid()    = 503
[pid 25397] 10:12:33.495752 getgid()    = 500
[pid 25397] 10:12:33.495781 access("/bin/sh", X_OK) = 0
[pid 25397] 10:12:33.495814 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25397] 10:12:33.495857 geteuid()   = 503
[pid 25397] 10:12:33.495885 getegid()   = 500
[pid 25397] 10:12:33.495914 getuid()    = 503
[pid 25397] 10:12:33.495942 getgid()    = 500
[pid 25397] 10:12:33.495970 access("/bin/sh", R_OK) = 0
[pid 25397] 10:12:33.496015 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.496054 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.496098 close(5)    = 0
[pid 25397] 10:12:33.496132 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.496165 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.496203 close(5)    = 0
[pid 25397] 10:12:33.496242 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25397] 10:12:33.496282 fstat(5, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25397] 10:12:33.496327 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b625a000
[pid 25397] 10:12:33.496367 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25397] 10:12:33.496461 read(5, "", 4096) = 0
[pid 25397] 10:12:33.496495 close(5)    = 0
[pid 25397] 10:12:33.496526 munmap(0x7fc0b625a000, 4096) = 0
[pid 25397] 10:12:33.496568 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25397] 10:12:33.496605 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.496648 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fc0b6251000
[pid 25397] 10:12:33.496681 close(5)    = 0
[pid 25397] 10:12:33.496718 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25397] 10:12:33.496756 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.496798 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.496848 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fc0b5676000
[pid 25397] 10:12:33.496884 mprotect(0x7fc0b5682000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.496918 mmap(0x7fc0b5882000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7fc0b5882000
[pid 25397] 10:12:33.496962 close(5)    = 0
[pid 25397] 10:12:33.497008 mprotect(0x7fc0b5882000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.497046 munmap(0x7fc0b6251000, 39387) = 0
[pid 25397] 10:12:33.497088 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25397] 10:12:33.497127 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25397] 10:12:33.497162 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.497204 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0b625a000
[pid 25397] 10:12:33.497237 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.497289 close(5)    = 0
[pid 25397] 10:12:33.497324 munmap(0x7fc0b625a000, 4096) = 0
[pid 25397] 10:12:33.497441 getpgrp()   = 29163
[pid 25397] 10:12:33.497479 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.497521 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25397] 10:12:33.497609 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.497653 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.497695 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25397] 10:12:33.497784 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.497894 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fc0b58b66a0}, {SIG_IGN, [], SA_RESTORER, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.497932 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fc0b58b66a0}, 8) = 0
[pid 25397] 10:12:33.497970 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"]) = 0
[pid 25397] 10:12:33.498208 brk(0)      = 0x20dd000
[pid 25397] 10:12:33.498244 fcntl(0, F_GETFD) = 0
[pid 25397] 10:12:33.498274 fcntl(1, F_GETFD) = 0
[pid 25397] 10:12:33.498303 fcntl(2, F_GETFD) = 0
[pid 25397] 10:12:33.498343 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.498440 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953c000
[pid 25397] 10:12:33.498488 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.498532 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25397] 10:12:33.498568 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.498612 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fe149532000
[pid 25397] 10:12:33.498645 close(5)    = 0
[pid 25397] 10:12:33.498683 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25397] 10:12:33.498720 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.498759 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.498803 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fe148f8a000
[pid 25397] 10:12:33.498837 mprotect(0x7fe149114000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.498871 mmap(0x7fe149314000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7fe149314000
[pid 25397] 10:12:33.498909 mmap(0x7fe149319000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe149319000
[pid 25397] 10:12:33.498949 close(5)    = 0
[pid 25397] 10:12:33.498992 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe149531000
[pid 25397] 10:12:33.499030 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe149530000
[pid 25397] 10:12:33.499064 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14952f000
[pid 25397] 10:12:33.499098 arch_prctl(ARCH_SET_FS, 0x7fe149530700) = 0
[pid 25397] 10:12:33.499189 mprotect(0x7fe149314000, 16384, PROT_READ) = 0
[pid 25397] 10:12:33.499235 mprotect(0x7fe14953d000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.499268 munmap(0x7fe149532000, 39387) = 0
[pid 25397] 10:12:33.499327 getuid()    = 503
[pid 25397] 10:12:33.499360 getgid()    = 500
[pid 25397] 10:12:33.499390 getegid()   = 499
[pid 25397] 10:12:33.499488 getppid()   = 25389
[pid 25397] 10:12:33.499522 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25397] 10:12:33.499612 brk(0)      = 0x20dd000
[pid 25397] 10:12:33.499650 brk(0x20fe000) = 0x20fe000
[pid 25397] 10:12:33.499696 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.499731 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.499773 close(5)    = 0
[pid 25397] 10:12:33.499806 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.499839 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.499877 close(5)    = 0
[pid 25397] 10:12:33.499917 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25397] 10:12:33.499961 fstat(5, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25397] 10:12:33.500006 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953b000
[pid 25397] 10:12:33.500039 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25397] 10:12:33.500093 read(5, "", 4096) = 0
[pid 25397] 10:12:33.500128 close(5)    = 0
[pid 25397] 10:12:33.500159 munmap(0x7fe14953b000, 4096) = 0
[pid 25397] 10:12:33.500202 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25397] 10:12:33.500240 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.500283 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fe149532000
[pid 25397] 10:12:33.500318 close(5)    = 0
[pid 25397] 10:12:33.500356 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25397] 10:12:33.500394 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.500497 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.500550 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fe148d7c000
[pid 25397] 10:12:33.500586 mprotect(0x7fe148d88000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.500624 mmap(0x7fe148f88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7fe148f88000
[pid 25397] 10:12:33.500673 close(5)    = 0
[pid 25397] 10:12:33.500716 mprotect(0x7fe148f88000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.500762 munmap(0x7fe149532000, 39387) = 0
[pid 25397] 10:12:33.500811 open("/etc/group", O_RDONLY|O_CLOEXEC) = 5
[pid 25397] 10:12:33.500861 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25397] 10:12:33.500896 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.500939 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953b000
[pid 25397] 10:12:33.500972 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.501026 close(5)    = 0
[pid 25397] 10:12:33.501059 munmap(0x7fe14953b000, 4096) = 0
[pid 25397] 10:12:33.501098 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.501133 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.501174 close(5)    = 0
[pid 25397] 10:12:33.501206 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25397] 10:12:33.501238 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.501275 close(5)    = 0
[pid 25397] 10:12:33.501311 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25397] 10:12:33.501352 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.501395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953b000
[pid 25397] 10:12:33.501514 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.501568 close(5)    = 0
[pid 25397] 10:12:33.501601 munmap(0x7fe14953b000, 4096) = 0
[pid 25397] 10:12:33.501640 open("/etc/group", O_RDONLY|O_CLOEXEC) = 5
[pid 25397] 10:12:33.501679 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.501721 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953b000
[pid 25397] 10:12:33.501754 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.501801 close(5)    = 0
[pid 25397] 10:12:33.501833 munmap(0x7fe14953b000, 4096) = 0
[pid 25397] 10:12:33.501880 readlink("/proc/25389/exe", "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25397] 10:12:33.501934 readlink("/opt/php52/bin/php-cgi", 0x7fff046b8d50, 4095) = -1 EINVAL (Invalid argument)
[pid 25397] 10:12:33.501979 getcwd("/home/finest09/public_html/includes", 4095) = 36
[pid 25397] 10:12:33.502028 stat("/proc/25389/cmdline", {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.502083 open("/proc/25389/cmdline", O_RDONLY) = 5
[pid 25397] 10:12:33.502121 fstat(5, {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.502169 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14953b000
[pid 25397] 10:12:33.502203 read(5, "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25397] 10:12:33.502242 read(5, "", 1024) = 0
[pid 25397] 10:12:33.502279 setregid(499, 499) = 0
[pid 25397] 10:12:33.502311 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25397] 10:12:33.502654 brk(0)      = 0xac4000
[pid 25397] 10:12:33.502690 fcntl(0, F_GETFD) = 0
[pid 25397] 10:12:33.502720 fcntl(1, F_GETFD) = 0
[pid 25397] 10:12:33.502749 fcntl(2, F_GETFD) = 0
[pid 25397] 10:12:33.502783 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.502832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f89000
[pid 25397] 10:12:33.502879 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.502924 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.502965 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503001 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503036 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503070 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503106 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503144 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503181 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25397] 10:12:33.503230 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503273 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503309 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503353 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503478 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503529 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503566 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503604 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.503652 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503688 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503723 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503758 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503792 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503835 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffc146be490) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503871 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.503907 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.503954 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25397] 10:12:33.503988 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.504030 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f8054f7f000
[pid 25397] 10:12:33.504063 close(6)    = 0
[pid 25397] 10:12:33.504099 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.504137 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.504181 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.504225 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8054b51000
[pid 25397] 10:12:33.504260 mprotect(0x7f8054b67000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.504294 mmap(0x7f8054d67000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f8054d67000
[pid 25397] 10:12:33.504336 mmap(0x7f8054d69000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8054d69000
[pid 25397] 10:12:33.504385 close(6)    = 0
[pid 25397] 10:12:33.504538 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.504581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.504621 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.504661 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.504698 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.504736 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.504779 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f7e000
[pid 25397] 10:12:33.504816 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8054938000
[pid 25397] 10:12:33.504849 mprotect(0x7f805494e000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.504882 mmap(0x7f8054b4d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f8054b4d000
[pid 25397] 10:12:33.504921 mmap(0x7f8054b4f000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8054b4f000
[pid 25397] 10:12:33.504960 close(6)    = 0
[pid 25397] 10:12:33.505002 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505043 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505122 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.505161 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.505203 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.505247 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8054701000
[pid 25397] 10:12:33.505281 mprotect(0x7f8054708000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.505313 mmap(0x7f8054908000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f8054908000
[pid 25397] 10:12:33.505360 mmap(0x7f805490a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f805490a000
[pid 25397] 10:12:33.505489 close(6)    = 0
[pid 25397] 10:12:33.505531 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505572 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505616 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505655 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25397] 10:12:33.505692 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.505730 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.505776 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805447d000
[pid 25397] 10:12:33.505812 mprotect(0x7f8054500000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.505845 mmap(0x7f80546ff000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f80546ff000
[pid 25397] 10:12:33.505888 close(6)    = 0
[pid 25397] 10:12:33.505925 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.505964 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.506002 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.506040 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25397] 10:12:33.506077 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.506115 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25397] 10:12:33.506163 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f7d000
[pid 25397] 10:12:33.506199 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805426f000
[pid 25397] 10:12:33.506233 mprotect(0x7f805427b000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.506265 mmap(0x7f805447b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f805447b000
[pid 25397] 10:12:33.506307 close(6)    = 0
[pid 25397] 10:12:33.506350 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.506396 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.506523 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25397] 10:12:33.506567 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805404c000
[pid 25397] 10:12:33.506602 mprotect(0x7f805406d000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.506635 mmap(0x7f805426d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f805426d000
[pid 25397] 10:12:33.506673 close(6)    = 0
[pid 25397] 10:12:33.506709 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.506748 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.506786 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.506824 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25397] 10:12:33.506860 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.506897 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.506940 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8053e2f000
[pid 25397] 10:12:33.506973 mprotect(0x7f8053e46000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.507005 mmap(0x7f8054046000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f8054046000
[pid 25397] 10:12:33.507044 mmap(0x7f8054048000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8054048000
[pid 25397] 10:12:33.507083 close(6)    = 0
[pid 25397] 10:12:33.507120 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507158 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507240 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25397] 10:12:33.507275 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.507312 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.507360 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f7c000
[pid 25397] 10:12:33.507510 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8053abb000
[pid 25397] 10:12:33.507552 mprotect(0x7f8053c2a000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.507586 mmap(0x7f8053e29000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f8053e29000
[pid 25397] 10:12:33.507628 close(6)    = 0
[pid 25397] 10:12:33.507666 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507707 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507746 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.507784 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25397] 10:12:33.507822 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.507859 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25397] 10:12:33.507901 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805382c000
[pid 25397] 10:12:33.507935 mprotect(0x7f80538b7000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.507968 mmap(0x7f8053ab7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f8053ab7000
[pid 25397] 10:12:33.508007 mmap(0x7f8053aba000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8053aba000
[pid 25397] 10:12:33.508046 close(6)    = 0
[pid 25397] 10:12:33.508083 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.508122 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.508160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.508197 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.508239 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.508276 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25397] 10:12:33.508319 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8053626000
[pid 25397] 10:12:33.508669 mprotect(0x7f805362c000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.508707 mmap(0x7f805382b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f805382b000
[pid 25397] 10:12:33.508748 close(6)    = 0
[pid 25397] 10:12:33.508785 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.508826 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25397] 10:12:33.508865 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.508903 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.508947 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f7b000
[pid 25397] 10:12:33.508983 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f80532f0000
[pid 25397] 10:12:33.509017 mprotect(0x7f805341c000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.509049 mmap(0x7f805361c000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f805361c000
[pid 25397] 10:12:33.509090 mmap(0x7f8053625000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8053625000
[pid 25397] 10:12:33.509130 close(6)    = 0
[pid 25397] 10:12:33.509167 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509282 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.509319 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.509366 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.509508 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f80530ec000
[pid 25397] 10:12:33.509545 mprotect(0x7f80530ee000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.509578 mmap(0x7f80532ee000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f80532ee000
[pid 25397] 10:12:33.509621 close(6)    = 0
[pid 25397] 10:12:33.509659 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509706 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.509783 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.509820 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.509857 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.509903 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8052ee9000
[pid 25397] 10:12:33.509938 mprotect(0x7f8052eeb000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.509971 mmap(0x7f80530ea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f80530ea000
[pid 25397] 10:12:33.510013 close(6)    = 0
[pid 25397] 10:12:33.510049 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510088 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510163 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25397] 10:12:33.510199 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.510236 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.510284 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f7a000
[pid 25397] 10:12:33.510322 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8052b55000
[pid 25397] 10:12:33.510363 mprotect(0x7f8052cdf000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.510497 mmap(0x7f8052edf000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f8052edf000
[pid 25397] 10:12:33.510548 mmap(0x7f8052ee4000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8052ee4000
[pid 25397] 10:12:33.510589 close(6)    = 0
[pid 25397] 10:12:33.510628 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510667 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510706 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.510743 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25397] 10:12:33.510781 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.510821 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25397] 10:12:33.510875 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f80528e9000
[pid 25397] 10:12:33.510910 mprotect(0x7f805294b000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.510944 mmap(0x7f8052b4a000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f8052b4a000
[pid 25397] 10:12:33.510987 close(6)    = 0
[pid 25397] 10:12:33.511027 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511067 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511105 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511142 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25397] 10:12:33.511179 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.511217 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25397] 10:12:33.511260 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8052506000
[pid 25397] 10:12:33.511294 mprotect(0x7f80526bf000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.511327 mmap(0x7f80528be000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f80528be000
[pid 25397] 10:12:33.511376 mmap(0x7f80528e5000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f80528e5000
[pid 25397] 10:12:33.511531 close(6)    = 0
[pid 25397] 10:12:33.511578 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511619 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.511695 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25397] 10:12:33.511732 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.511769 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25397] 10:12:33.511812 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f79000
[pid 25397] 10:12:33.511849 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f80522d9000
[pid 25397] 10:12:33.511884 mprotect(0x7f8052305000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.511917 mmap(0x7f8052505000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f8052505000
[pid 25397] 10:12:33.511956 close(6)    = 0
[pid 25397] 10:12:33.511992 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.512032 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.512070 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25397] 10:12:33.512113 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f80520d4000
[pid 25397] 10:12:33.512148 mprotect(0x7f80520d9000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.512181 mmap(0x7f80522d8000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f80522d8000
[pid 25397] 10:12:33.512219 close(6)    = 0
[pid 25397] 10:12:33.512257 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512296 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512336 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512382 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25397] 10:12:33.512511 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.512557 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25397] 10:12:33.512602 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8051ed1000
[pid 25397] 10:12:33.512638 mprotect(0x7f8051ed3000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.512673 mmap(0x7f80520d2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f80520d2000
[pid 25397] 10:12:33.512721 close(6)    = 0
[pid 25397] 10:12:33.512761 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512800 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512839 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.512876 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.512914 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.512950 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25397] 10:12:33.512994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f78000
[pid 25397] 10:12:33.513030 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8051cae000
[pid 25397] 10:12:33.513064 mprotect(0x7f8051cc5000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.513098 mmap(0x7f8051ec5000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f8051ec5000
[pid 25397] 10:12:33.513141 close(6)    = 0
[pid 25397] 10:12:33.513191 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513230 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513268 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513306 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.513345 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.513392 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.513564 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8051a6a000
[pid 25397] 10:12:33.513603 mprotect(0x7f8051aab000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.513637 mmap(0x7f8051cab000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f8051cab000
[pid 25397] 10:12:33.513681 close(6)    = 0
[pid 25397] 10:12:33.513721 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513760 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513799 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.513837 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25397] 10:12:33.513875 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.513913 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.513955 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f77000
[pid 25397] 10:12:33.513991 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8051783000
[pid 25397] 10:12:33.514098 mprotect(0x7f805185e000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.514133 mmap(0x7f8051a5e000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f8051a5e000
[pid 25397] 10:12:33.514178 close(6)    = 0
[pid 25397] 10:12:33.514218 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514258 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514297 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514337 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25397] 10:12:33.514384 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.514483 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.514531 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805157f000
[pid 25397] 10:12:33.514568 mprotect(0x7f8051582000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.514602 mmap(0x7f8051781000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f8051781000
[pid 25397] 10:12:33.514651 close(6)    = 0
[pid 25397] 10:12:33.514690 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514730 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514769 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.514806 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25397] 10:12:33.514843 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.514880 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.514924 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8051353000
[pid 25397] 10:12:33.514959 mprotect(0x7f805137c000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.514993 mmap(0x7f805157c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f805157c000
[pid 25397] 10:12:33.515033 mmap(0x7f805157e000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f805157e000
[pid 25397] 10:12:33.515080 close(6)    = 0
[pid 25397] 10:12:33.515120 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515159 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515197 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515235 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.515271 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.515307 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25397] 10:12:33.515355 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f76000
[pid 25397] 10:12:33.515514 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f805113d000
[pid 25397] 10:12:33.515560 mprotect(0x7f8051152000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.515594 mmap(0x7f8051351000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f8051351000
[pid 25397] 10:12:33.515638 close(6)    = 0
[pid 25397] 10:12:33.515688 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515729 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515774 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.515812 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25397] 10:12:33.515851 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.515888 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25397] 10:12:33.515932 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8050f32000
[pid 25397] 10:12:33.515968 mprotect(0x7f8050f3c000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.516001 mmap(0x7f805113b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f805113b000
[pid 25397] 10:12:33.516044 close(6)    = 0
[pid 25397] 10:12:33.516083 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516122 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516197 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.516234 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.516271 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25397] 10:12:33.516314 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8050d2f000
[pid 25397] 10:12:33.516360 mprotect(0x7f8050d31000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.516478 mmap(0x7f8050f30000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f8050f30000
[pid 25397] 10:12:33.516531 close(6)    = 0
[pid 25397] 10:12:33.516570 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f75000
[pid 25397] 10:12:33.516618 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516662 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516701 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.516738 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25397] 10:12:33.516774 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.516817 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25397] 10:12:33.516863 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8050b10000
[pid 25397] 10:12:33.516899 mprotect(0x7f8050b2d000, 2093056, PROT_NONE) = 0
[pid 25397] 10:12:33.516932 mmap(0x7f8050d2c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f8050d2c000
[pid 25397] 10:12:33.516973 mmap(0x7f8050d2e000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8050d2e000
[pid 25397] 10:12:33.517013 close(6)    = 0
[pid 25397] 10:12:33.517077 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f74000
[pid 25397] 10:12:33.517147 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f73000
[pid 25397] 10:12:33.517188 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f71000
[pid 25397] 10:12:33.517229 arch_prctl(ARCH_SET_FS, 0x7f8054f717c0) = 0
[pid 25397] 10:12:33.517301 mprotect(0x7f8050d2c000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517341 mprotect(0x7f8050f30000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517391 mprotect(0x7f805113b000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517542 mprotect(0x7f8051351000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517597 mprotect(0x7f805157c000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517641 mprotect(0x7f8051781000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517792 mprotect(0x7f8051a5e000, 40960, PROT_READ) = 0
[pid 25397] 10:12:33.517915 mprotect(0x7f8051cab000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517960 mprotect(0x7f8051ec5000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.517997 mprotect(0x7f80520d2000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.518235 mprotect(0x7f80528be000, 110592, PROT_READ) = 0
[pid 25397] 10:12:33.518343 mprotect(0x7f8052b4a000, 16384, PROT_READ) = 0
[pid 25397] 10:12:33.518518 mprotect(0x7f8052edf000, 16384, PROT_READ) = 0
[pid 25397] 10:12:33.518562 mprotect(0x7f80530ea000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.518603 mprotect(0x7f80532ee000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519369 mprotect(0x7f8054046000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519492 mprotect(0x7f805447b000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519535 mprotect(0x7f80546ff000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519573 mprotect(0x7f8054908000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519621 mprotect(0x7f8054b4d000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519661 mprotect(0x7f8054d67000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519721 mprotect(0x7f8054f8a000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.519755 munmap(0x7f8054f7f000, 39387) = 0
[pid 25397] 10:12:33.519792 set_tid_address(0x7f8054f71a90) = 25397
[pid 25397] 10:12:33.519822 set_robust_list(0x7f8054f71aa0, 24) = 0
[pid 25397] 10:12:33.519857 futex(0x7ffc146bed8c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25397] 10:12:33.519888 futex(0x7ffc146bed8c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f8054f717c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25397] 10:12:33.519930 rt_sigaction(SIGRTMIN, {0x7f8053e34c60, [], SA_RESTORER|SA_SIGINFO, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.519967 rt_sigaction(SIGRT_1, {0x7f8053e34cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.520001 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25397] 10:12:33.520050 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25397] 10:12:33.520120 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350373, f_bavail=6350373, f_files=1000000, f_ffree=691141, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25397] 10:12:33.520214 brk(0)      = 0xac4000
[pid 25397] 10:12:33.520247 brk(0xae5000) = 0xae5000
[pid 25397] 10:12:33.520288 open("/proc/filesystems", O_RDONLY) = 6
[pid 25397] 10:12:33.520346 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.520393 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f88000
[pid 25397] 10:12:33.520513 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25397] 10:12:33.520622 read(6, "", 1024) = 0
[pid 25397] 10:12:33.520660 close(6)    = 0
[pid 25397] 10:12:33.520696 munmap(0x7f8054f88000, 4096) = 0
[pid 25397] 10:12:33.520780 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.520895 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.520946 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.521024 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.521066 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.521102 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25397] 10:12:33.521136 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.521177 umask(0)    = 022
[pid 25397] 10:12:33.521247 geteuid()   = 0
[pid 25397] 10:12:33.521287 getuid()    = 503
[pid 25397] 10:12:33.521323 getgid()    = 499
[pid 25397] 10:12:33.521369 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25397] 10:12:33.521471 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25397] 10:12:33.521510 getgroups(65536, [500]) = 1
[pid 25397] 10:12:33.521547 setgroups(0, []) = 0
[pid 25397] 10:12:33.521581 getegid()   = 499
[pid 25397] 10:12:33.521610 geteuid()   = 0
[pid 25397] 10:12:33.521649 geteuid()   = 0
[pid 25397] 10:12:33.521679 getegid()   = 499
[pid 25397] 10:12:33.521710 setgid(499) = 0
[pid 25397] 10:12:33.521742 setuid(0)   = 0
[pid 25397] 10:12:33.521808 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25397] 10:12:33.521867 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25397] 10:12:33.521918 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25397] 10:12:33.521960 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f88000
[pid 25397] 10:12:33.521994 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25397] 10:12:33.522142 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25397] 10:12:33.522185 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.522233 close(7)    = 0
[pid 25397] 10:12:33.522267 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25397] 10:12:33.522299 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.522340 close(7)    = 0
[pid 25397] 10:12:33.522378 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25397] 10:12:33.522492 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25397] 10:12:33.522541 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.522574 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25397] 10:12:33.522629 read(7, "", 4096) = 0
[pid 25397] 10:12:33.522661 close(7)    = 0
[pid 25397] 10:12:33.522692 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.522738 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.522779 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.522825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.522865 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25397] 10:12:33.522899 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25397] 10:12:33.522942 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f8054f67000
[pid 25397] 10:12:33.522976 close(7)    = 0
[pid 25397] 10:12:33.523013 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25397] 10:12:33.523051 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25397] 10:12:33.523089 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25397] 10:12:33.523134 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f8050902000
[pid 25397] 10:12:33.523172 mprotect(0x7f805090e000, 2097152, PROT_NONE) = 0
[pid 25397] 10:12:33.523206 mmap(0x7f8050b0e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f8050b0e000
[pid 25397] 10:12:33.523250 close(7)    = 0
[pid 25397] 10:12:33.523299 mprotect(0x7f8050b0e000, 4096, PROT_READ) = 0
[pid 25397] 10:12:33.523338 munmap(0x7f8054f67000, 39387) = 0
[pid 25397] 10:12:33.523381 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25397] 10:12:33.523522 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25397] 10:12:33.523559 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.523615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.523651 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.523707 close(7)    = 0
[pid 25397] 10:12:33.523740 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.523793 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25397] 10:12:33.523830 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.523874 close(7)    = 0
[pid 25397] 10:12:33.523907 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25397] 10:12:33.523939 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.523976 close(7)    = 0
[pid 25397] 10:12:33.524019 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25397] 10:12:33.524059 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.524102 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.524135 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.524184 close(7)    = 0
[pid 25397] 10:12:33.524222 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.524272 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25397] 10:12:33.524343 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25397] 10:12:33.524392 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.524518 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.524552 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.524593 close(7)    = 0
[pid 25397] 10:12:33.524631 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.524672 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25397] 10:12:33.524727 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25397] 10:12:33.524786 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, 8) = 0
[pid 25397] 10:12:33.524842 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f8054f71a90) = 25398
[pid 25397] 10:12:33.525090 wait4(25398, Process 25398 attached
 <unfinished ...>
[pid 25398] 10:12:33.525143 set_robust_list(0x7f8054f71aa0, 24) = 0
[pid 25398] 10:12:33.525197 geteuid()   = 0
[pid 25398] 10:12:33.525234 geteuid()   = 0
[pid 25398] 10:12:33.525264 getegid()   = 499
[pid 25398] 10:12:33.525296 setgid(12)  = 0
[pid 25398] 10:12:33.525327 setuid(47)  = 0
[pid 25398] 10:12:33.526979 brk(0xb06000) = 0xb06000
[pid 25398] 10:12:33.527463 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25398] 10:12:33.527525 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25398] 10:12:33.527579 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25398] 10:12:33.527622 read(7, "\313v6\271\304gm\226P\216W\257x\373R\336I\274N\247T:\177CEf\27_\23368K]!:\346Y\300\273.\326\333y\36\204\350\223e", 48) = 48
[pid 25398] 10:12:33.527662 close(7)    = 0
[pid 25398] 10:12:33.527711 getuid()    = 47
[pid 25398] 10:12:33.527880 exit_group(0) = ?
[pid 25398] 10:12:33.528066 +++ exited with 0 +++
[pid 25397] 10:12:33.528104 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25398
[pid 25397] 10:12:33.528128 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, 8) = 0
[pid 25397] 10:12:33.528189 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25397] 10:12:33.528263 open("/etc/localtime", O_RDONLY) = 7
[pid 25397] 10:12:33.528304 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.528350 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.528393 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.528508 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25397] 10:12:33.528559 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25397] 10:12:33.528590 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25397] 10:12:33.528643 close(7)    = 0
[pid 25397] 10:12:33.528682 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.528732 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25397] 10:12:33.528778 fcntl(7, F_GETFD) = 0
[pid 25397] 10:12:33.528815 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25397] 10:12:33.528846 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10480, st_size=5361380, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:28, st_ctime=2015/12/30-10:12:28}) = 0
[pid 25397] 10:12:33.528891 write(7, "2015-12-30 10:12:33 [25397] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25397] 10:12:33.528934 chdir("/var/spool/exim") = 0
[pid 25397] 10:12:33.528975 geteuid()   = 0
[pid 25397] 10:12:33.529005 getegid()   = 499
[pid 25397] 10:12:33.529047 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.529088 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.529130 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.529164 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.529209 close(8)    = 0
[pid 25397] 10:12:33.529242 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.529280 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25397] 10:12:33.529324 read(8, "65536\n", 31) = 6
[pid 25397] 10:12:33.529358 close(8)    = 0
[pid 25397] 10:12:33.529394 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.529437 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.529480 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.529513 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.529546 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.529594 read(8, "", 4096) = 0
[pid 25397] 10:12:33.529628 close(8)    = 0
[pid 25397] 10:12:33.529773 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.529813 setgroups(1, [12]) = 0
[pid 25397] 10:12:33.529849 setgid(12)  = 0
[pid 25397] 10:12:33.529880 setuid(47)  = 0
[pid 25397] 10:12:33.529938 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25397] 10:12:33.530025 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25397] 10:12:33.530107 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25397] 10:12:33.530186 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25397] 10:12:33.530261 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25397] 10:12:33.530351 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25397] 10:12:33.530496 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25397] 10:12:33.530589 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.530642 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.530791 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.530901 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.530969 close(8)    = 0
[pid 25397] 10:12:33.531004 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.531100 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25397] 10:12:33.531201 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25397] 10:12:33.531319 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25397] 10:12:33.531445 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25397] 10:12:33.531556 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25397] 10:12:33.531611 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.531717 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.531776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.531818 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.531867 close(8)    = 0
[pid 25397] 10:12:33.531899 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.531944 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.531984 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.532028 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.532061 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.532107 close(8)    = 0
[pid 25397] 10:12:33.532138 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.532194 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.532235 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25397] 10:12:33.532278 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.532311 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25397] 10:12:33.532362 close(8)    = 0
[pid 25397] 10:12:33.532410 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.532517 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25397] 10:12:33.532644 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25397] 10:12:33.532829 read(6, "", 4096) = 0
[pid 25397] 10:12:33.532867 read(6, "", 4096) = 0
[pid 25397] 10:12:33.532901 close(6)    = 0
[pid 25397] 10:12:33.532933 munmap(0x7f8054f88000, 4096) = 0
[pid 25397] 10:12:33.532977 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25397] 10:12:33.533017 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.533061 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f88000
[pid 25397] 10:12:33.533095 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.533143 close(6)    = 0
[pid 25397] 10:12:33.533180 munmap(0x7f8054f88000, 4096) = 0
[pid 25397] 10:12:33.533228 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.533287 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.533338 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.533378 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25397] 10:12:33.533420 fstat(0, {st_dev=makedev(0, 8), st_ino=2130165299, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.533464 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f88000
[pid 25397] 10:12:33.533497 read(0, "To:  info@evrc.net, evrc@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"text/css\">.style3 {f"..., 4096) = 2069
[pid 25397] 10:12:33.533603 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.533755 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25397] 10:12:33.533839 fchown(6, 47, 12) = 0
[pid 25397] 10:12:33.533878 fchmod(6, 0640) = 0
[pid 25397] 10:12:33.533914 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25397] 10:12:33.533946 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.533989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f87000
[pid 25397] 10:12:33.534023 lseek(6, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.534053 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25397] 10:12:33.534144 read(0, "", 4096) = 0
[pid 25397] 10:12:33.534178 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.534213 write(6, "1aEJMX-0006bd-HC-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25397] 10:12:33.534258 fsync(6)    = 0
[pid 25397] 10:12:33.542118 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.542259 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.542460 brk(0xb06000) = 0xb06000
[pid 25397] 10:12:33.542555 getuid()    = 47
[pid 25397] 10:12:33.542610 geteuid()   = 47
[pid 25397] 10:12:33.542754 getgid()    = 12
[pid 25397] 10:12:33.542809 getegid()   = 12
[pid 25397] 10:12:33.542955 open("/dev/urandom", O_RDONLY) = 8
[pid 25397] 10:12:33.543023 read(8, "\305oy\303", 4) = 4
[pid 25397] 10:12:33.543078 close(8)    = 0
[pid 25397] 10:12:33.543248 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25397] 10:12:33.543423 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc1467a020) = -1 EINVAL (Invalid argument)
[pid 25397] 10:12:33.543489 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25397] 10:12:33.543541 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc1467a020) = -1 EINVAL (Invalid argument)
[pid 25397] 10:12:33.543592 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25397] 10:12:33.543640 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc1467a030) = -1 EINVAL (Invalid argument)
[pid 25397] 10:12:33.543768 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25397] 10:12:33.543823 open("/dev/null", O_RDONLY) = 8
[pid 25397] 10:12:33.543881 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc1467a100) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.543931 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.543979 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25397] 10:12:33.544029 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f8053e3e790}, 8) = 0
[pid 25397] 10:12:33.544087 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f8053e3e790}, 8) = 0
[pid 25397] 10:12:33.544522 read(8, "", 8192) = 0
[pid 25397] 10:12:33.544591 close(8)    = 0
[pid 25397] 10:12:33.544980 brk(0xb27000) = 0xb27000
[pid 25397] 10:12:33.545185 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25397] 10:12:33.545273 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25397] 10:12:33.545329 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679f30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.545390 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.545471 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25397] 10:12:33.547072 brk(0xb48000) = 0xb48000
[pid 25397] 10:12:33.547433 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25397] 10:12:33.548985 brk(0xb69000) = 0xb69000
[pid 25397] 10:12:33.549520 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25397] 10:12:33.550900 brk(0xb8a000) = 0xb8a000
[pid 25397] 10:12:33.551334 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25397] 10:12:33.551894 read(8, "", 8192) = 0
[pid 25397] 10:12:33.551962 close(8)    = 0
[pid 25397] 10:12:33.552036 stat("/usr/share/amavis/amavis-filter", 0x7f8053625880) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.552108 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25397] 10:12:33.552191 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25397] 10:12:33.552272 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25397] 10:12:33.552330 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679f30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.552392 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.552469 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25397] 10:12:33.553240 stat("/etc/exim/perl/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553314 stat("/etc/exim/perl/warnings.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553374 stat("/usr/local/cpanel/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553434 stat("/usr/local/cpanel/warnings.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553492 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553555 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553616 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553746 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553877 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553938 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.553997 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.554080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25397] 10:12:33.554148 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.554202 lseek(9, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.554265 brk(0xbab000) = 0xbab000
[pid 25397] 10:12:33.554331 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25397] 10:12:33.554972 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25397] 10:12:33.556399 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25397] 10:12:33.556591 brk(0xbcc000) = 0xbcc000
[pid 25397] 10:12:33.557117 read(9, "", 8192) = 0
[pid 25397] 10:12:33.557184 close(9)    = 0
[pid 25397] 10:12:33.558277 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25397] 10:12:33.559497 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25397] 10:12:33.560625 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25397] 10:12:33.561716 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25397] 10:12:33.562035 brk(0xbed000) = 0xbed000
[pid 25397] 10:12:33.562848 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25397] 10:12:33.564171 brk(0xc0e000) = 0xc0e000
[pid 25397] 10:12:33.564453 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25397] 10:12:33.565416 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25397] 10:12:33.566200 brk(0xc2f000) = 0xc2f000
[pid 25397] 10:12:33.566452 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25397] 10:12:33.567501 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25397] 10:12:33.568227 brk(0xc50000) = 0xc50000
[pid 25397] 10:12:33.568834 stat("/usr/local/cpanel/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.568918 stat("/usr/local/cpanel/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.568984 stat("/etc/exim/perl/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569043 stat("/etc/exim/perl/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569103 stat("/usr/local/cpanel/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569160 stat("/usr/local/cpanel/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569229 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569295 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569359 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569420 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569481 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569543 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569612 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.569764 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.569849 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25397] 10:12:33.569911 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.569963 lseek(9, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.570037 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25397] 10:12:33.570354 lseek(9, 878, SEEK_SET) = 878
[pid 25397] 10:12:33.570417 lseek(9, 0, SEEK_CUR) = 878
[pid 25397] 10:12:33.570466 close(9)    = 0
[pid 25397] 10:12:33.570921 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25397] 10:12:33.571893 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25397] 10:12:33.572165 brk(0xc71000) = 0xc71000
[pid 25397] 10:12:33.573833 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25397] 10:12:33.574178 brk(0xc92000) = 0xc92000
[pid 25397] 10:12:33.575987 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25397] 10:12:33.576179 brk(0xcb3000) = 0xcb3000
[pid 25397] 10:12:33.577472 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577551 stat("/usr/local/cpanel/Errno.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577621 stat("/etc/exim/perl/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577688 stat("/etc/exim/perl/Errno.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577747 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577806 stat("/usr/local/cpanel/Errno.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577866 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577930 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.577996 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.578058 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.578123 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.578187 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25397] 10:12:33.578274 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25397] 10:12:33.578345 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.578401 lseek(9, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.578481 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25397] 10:12:33.578903 brk(0xcd4000) = 0xcd4000
[pid 25397] 10:12:33.579612 lseek(9, 4868, SEEK_SET) = 4868
[pid 25397] 10:12:33.579750 lseek(9, 0, SEEK_CUR) = 4868
[pid 25397] 10:12:33.579802 close(9)    = 0
[pid 25397] 10:12:33.579873 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.579934 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.579995 stat("/etc/exim/perl/Exporter.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580046 stat("/etc/exim/perl/Exporter.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580101 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580159 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580218 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580282 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffc14679b50) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580346 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffc14679bf0) = -1 ENOENT (No such file or directory)
[pid 25397] 10:12:33.580410 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25397] 10:12:33.580505 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25397] 10:12:33.580571 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc14679940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25397] 10:12:33.580626 lseek(9, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.580789 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25397] 10:12:33.581511 lseek(9, 2366, SEEK_SET) = 2366
[pid 25397] 10:12:33.581582 lseek(9, 0, SEEK_CUR) = 2366
[pid 25397] 10:12:33.581636 close(9)    = 0
[pid 25397] 10:12:33.582199 read(8, "", 8192) = 0
[pid 25397] 10:12:33.582266 close(8)    = 0
[pid 25397] 10:12:33.582587 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25397] 10:12:33.582724 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25397] 10:12:33.582801 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f86000
[pid 25397] 10:12:33.582855 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25397] 10:12:33.582924 close(8)    = 0
[pid 25397] 10:12:33.582974 munmap(0x7f8054f86000, 4096) = 0
[pid 25397] 10:12:33.583087 lseek(6, 19, SEEK_SET) = 19
[pid 25397] 10:12:33.583141 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583197 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583248 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583298 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583350 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583405 alarm(300)  = 0
[pid 25397] 10:12:33.583454 alarm(0)    = 300
[pid 25397] 10:12:33.583500 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583550 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583600 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583728 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583789 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f8053e3e790}, NULL, 8) = 0
[pid 25397] 10:12:33.583843 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, 8) = 0
[pid 25397] 10:12:33.583900 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, 8) = 0
[pid 25397] 10:12:33.583962 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.584048 open("/var/spool/exim/input/X/hdr.25397", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25397] 10:12:33.584154 fchown(8, 47, 12) = 0
[pid 25397] 10:12:33.584206 fchmod(8, 0640) = 0
[pid 25397] 10:12:33.584255 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25397] 10:12:33.584306 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.584382 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f86000
[pid 25397] 10:12:33.584435 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.584502 write(8, "1aEJMX-0006bd-HC-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 406) = 406
[pid 25397] 10:12:33.584567 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=406, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.584640 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bd-HC; Wed, 30 Dec 2015 10:12:33 -0600\n048T To:  info@evrc.net, evrc@finestweddingsites.com\n051  Subject"..., 531) = 531
[pid 25397] 10:12:33.584782 fsync(8)    = 0
[pid 25397] 10:12:33.585227 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=937, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.585299 close(8)    = 0
[pid 25397] 10:12:33.585349 munmap(0x7f8054f86000, 4096) = 0
[pid 25397] 10:12:33.585414 rename("/var/spool/exim/input/X/hdr.25397", "/var/spool/exim/input/X/1aEJMX-0006bd-HC-H") = 0
[pid 25397] 10:12:33.585508 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25397] 10:12:33.585565 fsync(8)    = 0
[pid 25397] 10:12:33.585613 close(8)    = 0
[pid 25397] 10:12:33.585728 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.585816 open("/var/spool/exim/msglog/X/1aEJMX-0006bd-HC", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25397] 10:12:33.585909 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25397] 10:12:33.585959 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.586025 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8054f86000
[pid 25397] 10:12:33.586076 lseek(8, 0, SEEK_CUR) = 0
[pid 25397] 10:12:33.586124 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.586202 write(8, "2015-12-30 10:12:33 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2350 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25397] 10:12:33.586268 close(8)    = 0
[pid 25397] 10:12:33.586316 munmap(0x7f8054f86000, 4096) = 0
[pid 25397] 10:12:33.586373 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.586456 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25397] 10:12:33.586537 close(7)    = 0
[pid 25397] 10:12:33.586590 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25397] 10:12:33.586730 fcntl(7, F_GETFD) = 0
[pid 25397] 10:12:33.586785 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25397] 10:12:33.586831 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10480, st_size=5361481, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25397] 10:12:33.586897 write(7, "2015-12-30 10:12:33 [25397] 1aEJMX-0006bd-HC <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2350 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for info@evrc.net evrc@finestweddingsites.com Bride"..., 285) = 285
[pid 25397] 10:12:33.586970 close(6)    = 0
[pid 25397] 10:12:33.587020 munmap(0x7f8054f87000, 4096) = 0
[pid 25397] 10:12:33.587072 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, 8) = 0
[pid 25397] 10:12:33.587129 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f8052b876a0}, 8) = 0
[pid 25397] 10:12:33.587184 open("/proc/loadavg", O_RDONLY) = 6
[pid 25397] 10:12:33.587246 read(6, "0.02 0.05 0.00 1/240 25398\n", 40) = 27
[pid 25397] 10:12:33.587302 close(6)    = 0
[pid 25397] 10:12:33.587368 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f8054f71a90) = 25399
[pid 25397] 10:12:33.588104 exit_group(0) = ?
[pid 25397] 10:12:33.588511 +++ exited with 0 +++
10:12:33.588558 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25397
10:12:33.588591 munmap(0x7ff3d4f3d000, 4096) = 0
10:12:33.588808 pipe2([5, 6], O_CLOEXEC) = 0
10:12:33.588875 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25400
10:12:33.589395 close(5)                = 0
10:12:33.589447 fcntl(6, F_SETFD, 0)    = 0
10:12:33.589496 fstat(6, {st_dev=makedev(0, 8), st_ino=2130165423, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
10:12:33.589563 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
10:12:33.589624 write(6, "To:  kay.olesen2@hilton.com, embassyphxnorth@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\""..., 2089) = 2089
10:12:33.589749 close(6)                = 0
10:12:33.589797 wait4(25400, Process 25400 attached
 <unfinished ...>
[pid 25400] 10:12:33.589867 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25400] 10:12:33.589934 close(6)    = 0
[pid 25400] 10:12:33.589983 dup2(5, 0)  = 0
[pid 25400] 10:12:33.590028 close(5)    = 0
[pid 25400] 10:12:33.590078 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25400] 10:12:33.590620 brk(0)      = 0x1f9b000
[pid 25400] 10:12:33.590826 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468b3000
[pid 25400] 10:12:33.590908 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.590980 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25400] 10:12:33.591037 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25400] 10:12:33.591104 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fdd468a9000
[pid 25400] 10:12:33.591154 close(5)    = 0
[pid 25400] 10:12:33.591210 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25400] 10:12:33.591266 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.591343 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.591413 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fdd46474000
[pid 25400] 10:12:33.591465 mprotect(0x7fdd46491000, 2093056, PROT_NONE) = 0
[pid 25400] 10:12:33.591516 mmap(0x7fdd46690000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7fdd46690000
[pid 25400] 10:12:33.591584 mmap(0x7fdd46694000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdd46694000
[pid 25400] 10:12:33.591645 close(5)    = 0
[pid 25400] 10:12:33.591796 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25400] 10:12:33.591859 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.591922 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.592004 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fdd46270000
[pid 25400] 10:12:33.592061 mprotect(0x7fdd46272000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.592115 mmap(0x7fdd46472000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7fdd46472000
[pid 25400] 10:12:33.592184 close(5)    = 0
[pid 25400] 10:12:33.592243 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25400] 10:12:33.592302 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.592364 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.592439 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468a8000
[pid 25400] 10:12:33.592495 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fdd45edc000
[pid 25400] 10:12:33.592549 mprotect(0x7fdd46066000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.592601 mmap(0x7fdd46266000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7fdd46266000
[pid 25400] 10:12:33.592755 mmap(0x7fdd4626b000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdd4626b000
[pid 25400] 10:12:33.592824 close(5)    = 0
[pid 25400] 10:12:33.592902 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468a7000
[pid 25400] 10:12:33.592961 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468a6000
[pid 25400] 10:12:33.593017 arch_prctl(ARCH_SET_FS, 0x7fdd468a7700) = 0
[pid 25400] 10:12:33.593190 mprotect(0x7fdd46266000, 16384, PROT_READ) = 0
[pid 25400] 10:12:33.593256 mprotect(0x7fdd46472000, 4096, PROT_READ) = 0
[pid 25400] 10:12:33.593370 mprotect(0x7fdd468b4000, 4096, PROT_READ) = 0
[pid 25400] 10:12:33.593426 munmap(0x7fdd468a9000, 39387) = 0
[pid 25400] 10:12:33.593522 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.593593 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25400] 10:12:33.593743 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0f79d960) = -1 EINVAL (Invalid argument)
[pid 25400] 10:12:33.593836 brk(0)      = 0x1f9b000
[pid 25400] 10:12:33.593937 brk(0x1fbc000) = 0x1fbc000
[pid 25400] 10:12:33.594016 getuid()    = 503
[pid 25400] 10:12:33.594071 getgid()    = 500
[pid 25400] 10:12:33.594199 geteuid()   = 503
[pid 25400] 10:12:33.594253 getegid()   = 500
[pid 25400] 10:12:33.594315 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.594422 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
[pid 25400] 10:12:33.594495 fstat(5, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.594571 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468b2000
[pid 25400] 10:12:33.594627 read(5, "MemTotal:        1048576 kB\nMemFree:          275304 kB\nCached:           325980 kB\nBuffers:               0 kB\nActive:           278060 kB\nInactive:         466904 kB\nActive(anon):     149184 kB\nInactive(anon):   277604 kB\nActive(file):     128876 kB\nInac"..., 1024) = 588
[pid 25400] 10:12:33.594814 close(5)    = 0
[pid 25400] 10:12:33.594871 munmap(0x7fdd468b2000, 4096) = 0
[pid 25400] 10:12:33.594972 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25400] 10:12:33.595034 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.595091 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25400] 10:12:33.595145 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.595199 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25400] 10:12:33.595252 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.595308 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.595364 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.595427 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25400] 10:12:33.595543 getcwd("/home/finest09/public_html/includes", 4096) = 36
[pid 25400] 10:12:33.595617 getpid()    = 25400
[pid 25400] 10:12:33.595768 getppid()   = 25389
[pid 25400] 10:12:33.595829 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25400] 10:12:33.595911 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.595986 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.596056 geteuid()   = 503
[pid 25400] 10:12:33.596101 getegid()   = 500
[pid 25400] 10:12:33.596146 getuid()    = 503
[pid 25400] 10:12:33.596190 getgid()    = 500
[pid 25400] 10:12:33.596235 access("/bin/sh", X_OK) = 0
[pid 25400] 10:12:33.596287 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.596358 geteuid()   = 503
[pid 25400] 10:12:33.596407 getegid()   = 500
[pid 25400] 10:12:33.596452 getuid()    = 503
[pid 25400] 10:12:33.596497 getgid()    = 500
[pid 25400] 10:12:33.596541 access("/bin/sh", R_OK) = 0
[pid 25400] 10:12:33.596594 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.596754 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.596828 geteuid()   = 503
[pid 25400] 10:12:33.596873 getegid()   = 500
[pid 25400] 10:12:33.596917 getuid()    = 503
[pid 25400] 10:12:33.596962 getgid()    = 500
[pid 25400] 10:12:33.597006 access("/bin/sh", X_OK) = 0
[pid 25400] 10:12:33.597065 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25400] 10:12:33.597134 geteuid()   = 503
[pid 25400] 10:12:33.597179 getegid()   = 500
[pid 25400] 10:12:33.597223 getuid()    = 503
[pid 25400] 10:12:33.597268 getgid()    = 500
[pid 25400] 10:12:33.597312 access("/bin/sh", R_OK) = 0
[pid 25400] 10:12:33.597377 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25400] 10:12:33.597436 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.597503 close(5)    = 0
[pid 25400] 10:12:33.597554 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25400] 10:12:33.597603 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.597757 close(5)    = 0
[pid 25400] 10:12:33.597823 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25400] 10:12:33.597887 fstat(5, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25400] 10:12:33.597959 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468b2000
[pid 25400] 10:12:33.598014 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25400] 10:12:33.598094 read(5, "", 4096) = 0
[pid 25400] 10:12:33.598145 close(5)    = 0
[pid 25400] 10:12:33.598196 munmap(0x7fdd468b2000, 4096) = 0
[pid 25400] 10:12:33.598268 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25400] 10:12:33.598327 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25400] 10:12:33.598402 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fdd468a9000
[pid 25400] 10:12:33.598458 close(5)    = 0
[pid 25400] 10:12:33.598518 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25400] 10:12:33.598580 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.598643 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.598815 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fdd45cce000
[pid 25400] 10:12:33.598869 mprotect(0x7fdd45cda000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.598922 mmap(0x7fdd45eda000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7fdd45eda000
[pid 25400] 10:12:33.598987 close(5)    = 0
[pid 25400] 10:12:33.599050 mprotect(0x7fdd45eda000, 4096, PROT_READ) = 0
[pid 25400] 10:12:33.599104 munmap(0x7fdd468a9000, 39387) = 0
[pid 25400] 10:12:33.599163 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25400] 10:12:33.599221 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25400] 10:12:33.599280 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.599348 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdd468b2000
[pid 25400] 10:12:33.599399 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.599478 close(5)    = 0
[pid 25400] 10:12:33.599526 munmap(0x7fdd468b2000, 4096) = 0
[pid 25400] 10:12:33.599623 getpgrp()   = 29163
[pid 25400] 10:12:33.599757 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.599823 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25400] 10:12:33.599951 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.600015 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.600076 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25400] 10:12:33.600199 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.600259 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fdd45f0e6a0}, {SIG_IGN, [], SA_RESTORER, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.600312 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fdd45f0e6a0}, 8) = 0
[pid 25400] 10:12:33.600371 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"]Process 25399 attached
 <unfinished ...>
[pid 25399] 10:12:33.600823 set_robust_list(0x7f8054f71aa0, 24) = 0
[pid 25399] 10:12:33.600928 close(0 <unfinished ...>
[pid 25400] 10:12:33.600974 <... execve resumed> ) = 0
[pid 25400] 10:12:33.601026 brk(0 <unfinished ...>
[pid 25399] 10:12:33.601071 <... close resumed> ) = 0
[pid 25399] 10:12:33.601105 close(1 <unfinished ...>
[pid 25400] 10:12:33.601138 <... brk resumed> ) = 0x22d0000
[pid 25399] 10:12:33.601170 <... close resumed> ) = 0
[pid 25400] 10:12:33.601204 fcntl(0, F_GETFD <unfinished ...>
[pid 25399] 10:12:33.601238 close(2)    = 0
[pid 25400] 10:12:33.601293 <... fcntl resumed> ) = 0
[pid 25400] 10:12:33.601394 fcntl(1, F_GETFD) = 0
[pid 25400] 10:12:33.601456 fcntl(2, F_GETFD) = 0
[pid 25400] 10:12:33.601517 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.601599 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fba9000
[pid 25400] 10:12:33.601748 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25399] 10:12:33.601798 setsid( <unfinished ...>
[pid 25400] 10:12:33.601836 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.601874 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.601910 <... setsid resumed> ) = 25399
[pid 25399] 10:12:33.601945 fstat(0,  <unfinished ...>
[pid 25400] 10:12:33.601977 <... open resumed> ) = 5
[pid 25399] 10:12:33.602008 <... fstat resumed> 0x7ffc1467e470) = -1 EBADF (Bad file descriptor)
[pid 25399] 10:12:33.602044 open("/dev/null", O_RDWR <unfinished ...>
[pid 25400] 10:12:33.602075 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25399] 10:12:33.602160 <... open resumed> ) = 0
[pid 25400] 10:12:33.602190 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f8f3fb9f000
[pid 25400] 10:12:33.602246 close(5 <unfinished ...>
[pid 25399] 10:12:33.602278 fstat(1,  <unfinished ...>
[pid 25400] 10:12:33.602305 <... close resumed> ) = 0
[pid 25400] 10:12:33.602338 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.602369 <... fstat resumed> 0x7ffc1467e470) = -1 EBADF (Bad file descriptor)
[pid 25399] 10:12:33.602404 dup2(0, 1 <unfinished ...>
[pid 25400] 10:12:33.602444 <... open resumed> ) = 5
[pid 25399] 10:12:33.602471 <... dup2 resumed> ) = 1
[pid 25399] 10:12:33.602497 fstat(2, 0x7ffc1467e470) = -1 EBADF (Bad file descriptor)
[pid 25399] 10:12:33.602544 dup2(0, 2 <unfinished ...>
[pid 25400] 10:12:33.602571 read(5,  <unfinished ...>
[pid 25399] 10:12:33.602596 <... dup2 resumed> ) = 2
[pid 25400] 10:12:33.602627 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.602752 geteuid()   = 47
[pid 25400] 10:12:33.602811 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.602847 fstat(0,  <unfinished ...>
[pid 25400] 10:12:33.602877 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.602926 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f8f3f5f7000
[pid 25399] 10:12:33.602980 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25400] 10:12:33.603033 mprotect(0x7f8f3f781000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.603062 fstat(1,  <unfinished ...>
[pid 25400] 10:12:33.603095 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.603122 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25399] 10:12:33.603167 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25400] 10:12:33.603230 mmap(0x7f8f3f981000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25399] 10:12:33.603268 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMX-0006bd-HC"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25400] 10:12:33.603420 <... mmap resumed> ) = 0x7f8f3f981000
[pid 25400] 10:12:33.604062 mmap(0x7f8f3f986000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8f3f986000
[pid 25400] 10:12:33.604134 close(5)    = 0
[pid 25400] 10:12:33.604197 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fb9e000
[pid 25400] 10:12:33.604254 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fb9d000
[pid 25400] 10:12:33.604306 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fb9c000
[pid 25400] 10:12:33.604358 arch_prctl(ARCH_SET_FS, 0x7f8f3fb9d700) = 0
[pid 25400] 10:12:33.604477 mprotect(0x7f8f3f981000, 16384, PROT_READ) = 0
[pid 25400] 10:12:33.604537 mprotect(0x7f8f3fbaa000, 4096, PROT_READ) = 0
[pid 25400] 10:12:33.604586 munmap(0x7f8f3fb9f000, 39387) = 0
[pid 25400] 10:12:33.604729 getuid( <unfinished ...>
[pid 25399] 10:12:33.604901 <... execve resumed> ) = 0
[pid 25400] 10:12:33.604934 <... getuid resumed> ) = 503
[pid 25400] 10:12:33.604962 getgid()    = 500
[pid 25400] 10:12:33.605008 getegid()   = 499
[pid 25400] 10:12:33.605053 getppid()   = 25389
[pid 25400] 10:12:33.605101 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25400] 10:12:33.605226 brk(0)      = 0x22d0000
[pid 25400] 10:12:33.605274 brk(0x22f1000) = 0x22f1000
[pid 25400] 10:12:33.605338 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25400] 10:12:33.605395 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.605476 brk(0 <unfinished ...>
[pid 25400] 10:12:33.605505 close(5)    = 0
[pid 25400] 10:12:33.605554 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25399] 10:12:33.605604 <... brk resumed> ) = 0x149c000
[pid 25399] 10:12:33.605632 fcntl(0, F_GETFD <unfinished ...>
[pid 25400] 10:12:33.605726 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.605763 <... fcntl resumed> ) = 0
[pid 25400] 10:12:33.605797 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.605826 fcntl(1, F_GETFD) = 0
[pid 25399] 10:12:33.605872 fcntl(2, F_GETFD) = 0
[pid 25400] 10:12:33.605927 close(5 <unfinished ...>
[pid 25399] 10:12:33.605972 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25400] 10:12:33.606018 <... close resumed> ) = 0
[pid 25400] 10:12:33.606068 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.606114 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.606161 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.606199 <... open resumed> ) = 5
[pid 25400] 10:12:33.606233 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.606262 <... mmap resumed> ) = 0x7f54cb357000
[pid 25399] 10:12:33.606305 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25400] 10:12:33.606338 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25400] 10:12:33.606394 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fba8000
[pid 25400] 10:12:33.606446 read(5,  <unfinished ...>
[pid 25399] 10:12:33.606477 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.606509 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25399] 10:12:33.606553 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.606606 read(5,  <unfinished ...>
[pid 25399] 10:12:33.606643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.606765 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.606828 <... read resumed> "", 4096) = 0
[pid 25400] 10:12:33.606860 close(5 <unfinished ...>
[pid 25399] 10:12:33.606888 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.606946 <... close resumed> ) = 0
[pid 25400] 10:12:33.606971 munmap(0x7f8f3fba8000, 4096 <unfinished ...>
[pid 25399] 10:12:33.606999 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25400] 10:12:33.607032 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.607069 <... stat resumed> 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.607111 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.607142 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.607197 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.607255 <... open resumed> ) = 5
[pid 25399] 10:12:33.607280 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.607334 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25400] 10:12:33.607403 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25399] 10:12:33.607434 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25400] 10:12:33.607465 <... mmap resumed> ) = 0x7f8f3fb9f000
[pid 25399] 10:12:33.607493 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25400] 10:12:33.607538 close(5)    = 0
[pid 25399] 10:12:33.607584 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.607631 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.607799 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.607838 <... open resumed> ) = 5
[pid 25399] 10:12:33.607867 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.607927 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.607986 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.608015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.608046 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.608102 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.608141 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25399] 10:12:33.608174 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25400] 10:12:33.608209 <... mmap resumed> ) = 0x7f8f3f3e9000
[pid 25399] 10:12:33.608245 <... stat resumed> 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.608275 mprotect(0x7f8f3f3f5000, 2097152, PROT_NONE) = 0
[pid 25399] 10:12:33.608331 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.608399 mmap(0x7f8f3f5f5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7f8f3f5f5000
[pid 25399] 10:12:33.608465 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25400] 10:12:33.608508 close(5 <unfinished ...>
[pid 25399] 10:12:33.608546 <... stat resumed> 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.608576 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.608609 <... close resumed> ) = 0
[pid 25399] 10:12:33.608645 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.608791 mprotect(0x7f8f3f5f5000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.608822 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.608902 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.608929 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.608963 munmap(0x7f8f3fb9f000, 39387 <unfinished ...>
[pid 25399] 10:12:33.608998 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609030 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.609056 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609118 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.609149 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.609184 <... open resumed> ) = 5
[pid 25399] 10:12:33.609216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.609242 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25400] 10:12:33.609272 fcntl(5, F_GETFD <unfinished ...>
[pid 25399] 10:12:33.609305 <... stat resumed> 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609335 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25400] 10:12:33.609365 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.609392 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609448 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.609493 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fba8000
[pid 25399] 10:12:33.609542 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffed9b4fc90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609598 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.609756 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.609841 close(5 <unfinished ...>
[pid 25399] 10:12:33.609869 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.609947 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.609981 <... close resumed> ) = 0
[pid 25399] 10:12:33.610017 <... open resumed> ) = 6
[pid 25400] 10:12:33.610047 munmap(0x7f8f3fba8000, 4096) = 0
[pid 25399] 10:12:33.610112 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25399] 10:12:33.610187 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.610224 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.610257 <... mmap resumed> ) = 0x7f54cb34d000
[pid 25399] 10:12:33.610283 close(6 <unfinished ...>
[pid 25400] 10:12:33.610314 <... socket resumed> ) = 5
[pid 25399] 10:12:33.610340 <... close resumed> ) = 0
[pid 25399] 10:12:33.610376 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.610407 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.610476 <... open resumed> ) = 6
[pid 25400] 10:12:33.610502 close(5)    = 0
[pid 25399] 10:12:33.610551 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.610615 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.610739 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.610775 <... socket resumed> ) = 5
[pid 25399] 10:12:33.610802 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.610849 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.610881 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.610919 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.610950 <... mmap resumed> ) = 0x7f54caf1f000
[pid 25399] 10:12:33.610977 mprotect(0x7f54caf35000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.611004 close(5 <unfinished ...>
[pid 25399] 10:12:33.611035 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.611065 <... close resumed> ) = 0
[pid 25400] 10:12:33.611096 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.611126 mmap(0x7f54cb135000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f54cb135000
[pid 25400] 10:12:33.611186 <... open resumed> ) = 5
[pid 25399] 10:12:33.611217 mmap(0x7f54cb137000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.611251 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.611282 <... mmap resumed> ) = 0x7f54cb137000
[pid 25400] 10:12:33.611308 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.611354 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.611392 close(6 <unfinished ...>
[pid 25400] 10:12:33.611424 <... mmap resumed> ) = 0x7f8f3fba8000
[pid 25400] 10:12:33.611473 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.611538 <... close resumed> ) = 0
[pid 25399] 10:12:33.611574 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.611742 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.611791 close(5 <unfinished ...>
[pid 25399] 10:12:33.611829 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.611858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.611889 <... close resumed> ) = 0
[pid 25399] 10:12:33.611922 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.611949 munmap(0x7f8f3fba8000, 4096) = 0
[pid 25399] 10:12:33.612003 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.612040 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.612078 <... open resumed> ) = 6
[pid 25400] 10:12:33.612108 <... open resumed> ) = 5
[pid 25399] 10:12:33.612133 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.612190 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.612217 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.612243 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.612289 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.612333 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8f3fba8000
[pid 25399] 10:12:33.612385 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34c000
[pid 25400] 10:12:33.612436 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.612498 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.612546 close(5 <unfinished ...>
[pid 25399] 10:12:33.612577 <... mmap resumed> ) = 0x7f54cad06000
[pid 25399] 10:12:33.612610 mprotect(0x7f54cad1c000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.612791 mmap(0x7f54caf1b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25400] 10:12:33.612829 <... close resumed> ) = 0
[pid 25399] 10:12:33.612861 <... mmap resumed> ) = 0x7f54caf1b000
[pid 25400] 10:12:33.612888 munmap(0x7f8f3fba8000, 4096) = 0
[pid 25399] 10:12:33.612942 mmap(0x7f54caf1d000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.612990 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25399] 10:12:33.613026 <... mmap resumed> ) = 0x7f54caf1d000
[pid 25399] 10:12:33.613060 close(6 <unfinished ...>
[pid 25400] 10:12:33.613106 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25399] 10:12:33.613137 <... close resumed> ) = 0
[pid 25399] 10:12:33.613171 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.613240 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25399] 10:12:33.613271 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.613338 <... readlink resumed> 0x7ffda0384670, 4095) = -1 EINVAL (Invalid argument)
[pid 25399] 10:12:33.613366 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.613405 getcwd( <unfinished ...>
[pid 25399] 10:12:33.613441 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.613473 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.613507 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25400] 10:12:33.613544 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25399] 10:12:33.613582 <... open resumed> ) = 6
[pid 25400] 10:12:33.613618 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.613760 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.613830 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.613862 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.613894 <... open resumed> ) = 5
[pid 25399] 10:12:33.613920 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.613967 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.614008 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.614040 <... mmap resumed> ) = 0x7f54caacf000
[pid 25400] 10:12:33.614067 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.614113 mprotect(0x7f54caad6000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.614150 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.614194 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.614223 <... mmap resumed> ) = 0x7f8f3fba8000
[pid 25400] 10:12:33.614252 read(5,  <unfinished ...>
[pid 25399] 10:12:33.614289 mmap(0x7f54cacd6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25400] 10:12:33.614336 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25399] 10:12:33.614378 <... mmap resumed> ) = 0x7f54cacd6000
[pid 25400] 10:12:33.614426 read(5,  <unfinished ...>
[pid 25399] 10:12:33.614469 mmap(0x7f54cacd8000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.614511 <... read resumed> "", 1024) = 0
[pid 25399] 10:12:33.614542 <... mmap resumed> ) = 0x7f54cacd8000
[pid 25400] 10:12:33.614577 setregid(499, 499 <unfinished ...>
[pid 25399] 10:12:33.614636 close(6 <unfinished ...>
[pid 25400] 10:12:33.614777 <... setregid resumed> ) = 0
[pid 25399] 10:12:33.614814 <... close resumed> ) = 0
[pid 25400] 10:12:33.614846 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25399] 10:12:33.615005 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.615193 <... execve resumed> ) = 0
[pid 25399] 10:12:33.615231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.615261 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.615345 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.615426 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25399] 10:12:33.615487 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.615548 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.615626 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f54ca84b000
[pid 25399] 10:12:33.615832 mprotect(0x7f54ca8ce000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.615891 mmap(0x7f54caacd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f54caacd000
[pid 25399] 10:12:33.615965 close(6)    = 0
[pid 25399] 10:12:33.616024 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.616086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.616144 brk(0 <unfinished ...>
[pid 25399] 10:12:33.616190 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.616219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.616276 <... brk resumed> ) = 0x223e000
[pid 25400] 10:12:33.616306 fcntl(0, F_GETFD <unfinished ...>
[pid 25399] 10:12:33.616347 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.616386 <... fcntl resumed> ) = 0
[pid 25400] 10:12:33.616414 fcntl(1, F_GETFD <unfinished ...>
[pid 25399] 10:12:33.616469 <... open resumed> ) = 6
[pid 25400] 10:12:33.616496 <... fcntl resumed> ) = 0
[pid 25400] 10:12:33.616523 fcntl(2, F_GETFD) = 0
[pid 25400] 10:12:33.616576 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25399] 10:12:33.616616 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.616760 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.616804 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.616833 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25400] 10:12:33.616898 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.616941 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34b000
[pid 25399] 10:12:33.616997 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f54ca63d000
[pid 25400] 10:12:33.617060 <... mmap resumed> ) = 0x7fe14f5dc000
[pid 25399] 10:12:33.617088 mprotect(0x7f54ca649000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.617143 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25399] 10:12:33.617189 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.617216 mmap(0x7f54ca849000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f54ca849000
[pid 25400] 10:12:33.617277 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.617315 close(6 <unfinished ...>
[pid 25400] 10:12:33.617368 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.617409 <... close resumed> ) = 0
[pid 25399] 10:12:33.617445 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.617492 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.617521 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25399] 10:12:33.617569 <... open resumed> ) = 6
[pid 25400] 10:12:33.617599 <... stat resumed> 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.617629 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.617756 read(6,  <unfinished ...>
[pid 25400] 10:12:33.617800 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.617830 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.617877 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.617914 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.617971 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:33.618020 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.618060 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.618103 <... mmap resumed> ) = 0x7f54ca41a000
[pid 25400] 10:12:33.618136 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618164 mprotect(0x7f54ca43b000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.618216 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618272 mmap(0x7f54ca63b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f54ca63b000
[pid 25400] 10:12:33.618329 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618398 close(6 <unfinished ...>
[pid 25400] 10:12:33.618438 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25399] 10:12:33.618519 <... close resumed> ) = 0
[pid 25399] 10:12:33.618555 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.618596 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618745 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.618780 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618842 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.618902 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.618962 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.619019 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.619080 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25400] 10:12:33.619209 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.619274 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.619342 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.619383 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25399] 10:12:33.619424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.619479 <... stat resumed> 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.619510 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f54ca1fd000
[pid 25400] 10:12:33.619566 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.619627 mprotect(0x7f54ca214000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.619781 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.619863 mmap(0x7f54ca414000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f54ca414000
[pid 25400] 10:12:33.619922 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.619988 mmap(0x7f54ca416000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.620030 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.620090 <... mmap resumed> ) = 0x7f54ca416000
[pid 25399] 10:12:33.620125 close(6 <unfinished ...>
[pid 25400] 10:12:33.620164 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.620222 <... close resumed> ) = 0
[pid 25400] 10:12:33.620249 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25399] 10:12:33.620298 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.620342 <... stat resumed> 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.620372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.620418 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.620452 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.620480 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.620519 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25399] 10:12:33.620566 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.620598 <... stat resumed> 0x7fff06820f90) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.620627 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.620765 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.620815 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.620850 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.620878 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25399] 10:12:33.620919 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.620969 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.621023 <... open resumed> ) = 6
[pid 25400] 10:12:33.621052 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25399] 10:12:33.621106 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.621165 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.621202 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.621239 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25399] 10:12:33.621286 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.621331 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.621373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.621415 <... mmap resumed> ) = 0x7fe14f5d2000
[pid 25399] 10:12:33.621444 <... mmap resumed> ) = 0x7f54cb34a000
[pid 25400] 10:12:33.621474 close(6 <unfinished ...>
[pid 25399] 10:12:33.621528 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.621568 <... close resumed> ) = 0
[pid 25400] 10:12:33.621603 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.621795 <... mmap resumed> ) = 0x7f54c9e89000
[pid 25399] 10:12:33.621837 mprotect(0x7f54c9ff8000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.621887 <... open resumed> ) = 6
[pid 25399] 10:12:33.621921 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.621948 read(6,  <unfinished ...>
[pid 25399] 10:12:33.621984 mmap(0x7f54ca1f7000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25400] 10:12:33.622025 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.622067 <... mmap resumed> ) = 0x7f54ca1f7000
[pid 25400] 10:12:33.622098 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.622179 close(6 <unfinished ...>
[pid 25400] 10:12:33.622218 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe14f1a4000
[pid 25400] 10:12:33.622271 mprotect(0x7fe14f1ba000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.622308 <... close resumed> ) = 0
[pid 25400] 10:12:33.622339 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.622385 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.622428 mmap(0x7fe14f3ba000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fe14f3ba000
[pid 25399] 10:12:33.622492 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.622527 mmap(0x7fe14f3bc000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.622568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.622631 <... mmap resumed> ) = 0x7fe14f3bc000
[pid 25400] 10:12:33.622747 close(6 <unfinished ...>
[pid 25399] 10:12:33.622791 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.622851 <... close resumed> ) = 0
[pid 25400] 10:12:33.622885 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.622928 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25400] 10:12:33.622992 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.623021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.623060 read(6,  <unfinished ...>
[pid 25400] 10:12:33.623105 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.623134 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.623171 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25400] 10:12:33.623240 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.623280 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.623326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.623357 <... mmap resumed> ) = 0x7f54c9bfa000
[pid 25400] 10:12:33.623390 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.623431 mprotect(0x7f54c9c85000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.623490 <... open resumed> ) = 6
[pid 25399] 10:12:33.623518 mmap(0x7f54c9e85000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25400] 10:12:33.623558 read(6,  <unfinished ...>
[pid 25399] 10:12:33.623600 <... mmap resumed> ) = 0x7f54c9e85000
[pid 25400] 10:12:33.623629 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.623763 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.623811 mmap(0x7f54c9e88000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.623859 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.623908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5d1000
[pid 25399] 10:12:33.623966 <... mmap resumed> ) = 0x7f54c9e88000
[pid 25400] 10:12:33.624000 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.624048 close(6 <unfinished ...>
[pid 25400] 10:12:33.624088 <... mmap resumed> ) = 0x7fe14ef8b000
[pid 25399] 10:12:33.624116 <... close resumed> ) = 0
[pid 25400] 10:12:33.624144 mprotect(0x7fe14efa1000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.624190 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.624236 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.624263 mmap(0x7fe14f1a0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25399] 10:12:33.624309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.624343 <... mmap resumed> ) = 0x7fe14f1a0000
[pid 25399] 10:12:33.624372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.624419 mmap(0x7fe14f1a2000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.624468 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.624558 <... mmap resumed> ) = 0x7fe14f1a2000
[pid 25399] 10:12:33.624591 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.624638 close(6 <unfinished ...>
[pid 25399] 10:12:33.624772 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.624802 <... close resumed> ) = 0
[pid 25400] 10:12:33.624838 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.624882 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25400] 10:12:33.624946 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.624974 read(6,  <unfinished ...>
[pid 25400] 10:12:33.625011 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.625051 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.625097 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.625126 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25399] 10:12:33.625195 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.625235 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.625278 <... mmap resumed> ) = 0x7f54c99f4000
[pid 25400] 10:12:33.625312 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.625341 mprotect(0x7f54c99fa000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.625386 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.625433 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.625473 <... open resumed> ) = 6
[pid 25399] 10:12:33.625501 mmap(0x7f54c9bf9000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f54c9bf9000
[pid 25400] 10:12:33.625557 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.625621 close(6 <unfinished ...>
[pid 25400] 10:12:33.625755 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.625828 <... close resumed> ) = 0
[pid 25400] 10:12:33.625857 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.625905 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.625948 <... mmap resumed> ) = 0x7fe14ed54000
[pid 25400] 10:12:33.625975 mprotect(0x7fe14ed5b000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.626019 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.626052 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.626080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.626120 mmap(0x7fe14ef5b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25399] 10:12:33.626169 <... open resumed> ) = 6
[pid 25400] 10:12:33.626202 <... mmap resumed> ) = 0x7fe14ef5b000
[pid 25400] 10:12:33.626235 mmap(0x7fe14ef5d000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.626276 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.626340 <... mmap resumed> ) = 0x7fe14ef5d000
[pid 25399] 10:12:33.626375 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.626451 close(6 <unfinished ...>
[pid 25399] 10:12:33.626491 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb349000
[pid 25400] 10:12:33.626546 <... close resumed> ) = 0
[pid 25399] 10:12:33.626577 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.626624 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.626774 <... mmap resumed> ) = 0x7f54c96be000
[pid 25399] 10:12:33.626804 mprotect(0x7f54c97ea000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.626859 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.626921 mmap(0x7f54c99ea000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f54c99ea000
[pid 25400] 10:12:33.626987 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.627034 mmap(0x7f54c99f3000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.627081 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.627112 <... mmap resumed> ) = 0x7f54c99f3000
[pid 25400] 10:12:33.627142 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25399] 10:12:33.627206 close(6)    = 0
[pid 25400] 10:12:33.627256 read(6,  <unfinished ...>
[pid 25399] 10:12:33.627300 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.627341 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.627381 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.627457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.627487 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe14ead0000
[pid 25399] 10:12:33.627542 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.627588 mprotect(0x7fe14eb53000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.627756 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.627809 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.627844 mmap(0x7fe14ed52000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25399] 10:12:33.627885 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.627929 <... mmap resumed> ) = 0x7fe14ed52000
[pid 25399] 10:12:33.627963 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.628003 close(6 <unfinished ...>
[pid 25399] 10:12:33.628043 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25400] 10:12:33.628101 <... close resumed> ) = 0
[pid 25400] 10:12:33.628136 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.628177 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.628235 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.628278 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.628306 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.628355 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.628399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.628452 <... mmap resumed> ) = 0x7f54c94ba000
[pid 25400] 10:12:33.628490 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.628520 mprotect(0x7f54c94bc000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.628574 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.628633 mmap(0x7f54c96bc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f54c96bc000
[pid 25400] 10:12:33.628780 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.628836 close(6 <unfinished ...>
[pid 25400] 10:12:33.628883 <... open resumed> ) = 6
[pid 25400] 10:12:33.628911 read(6,  <unfinished ...>
[pid 25399] 10:12:33.628948 <... close resumed> ) = 0
[pid 25400] 10:12:33.628976 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.629026 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.629067 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25400] 10:12:33.629136 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5d0000
[pid 25399] 10:12:33.629193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.629224 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.629267 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.629313 <... mmap resumed> ) = 0x7fe14e8c2000
[pid 25399] 10:12:33.629337 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.629364 mprotect(0x7fe14e8ce000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.629406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.629451 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.629473 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.629499 mmap(0x7fe14eace000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25399] 10:12:33.629544 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.629591 <... mmap resumed> ) = 0x7fe14eace000
[pid 25399] 10:12:33.629614 <... open resumed> ) = 6
[pid 25400] 10:12:33.629739 close(6 <unfinished ...>
[pid 25399] 10:12:33.629778 read(6,  <unfinished ...>
[pid 25400] 10:12:33.629817 <... close resumed> ) = 0
[pid 25399] 10:12:33.629844 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.629889 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.629939 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.629981 <... open resumed> ) = 6
[pid 25399] 10:12:33.630003 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.630048 read(6,  <unfinished ...>
[pid 25399] 10:12:33.630086 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.630128 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.630161 <... mmap resumed> ) = 0x7f54c92b7000
[pid 25400] 10:12:33.630187 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.630224 mprotect(0x7f54c92b9000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.630263 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:33.630305 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.630330 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.630417 mmap(0x7f54c94b8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25400] 10:12:33.630477 <... mmap resumed> ) = 0x7fe14e69f000
[pid 25399] 10:12:33.630496 <... mmap resumed> ) = 0x7f54c94b8000
[pid 25400] 10:12:33.630515 mprotect(0x7fe14e6c0000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.630560 close(6 <unfinished ...>
[pid 25400] 10:12:33.630585 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.630600 <... close resumed> ) = 0
[pid 25400] 10:12:33.630616 mmap(0x7fe14e8c0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25399] 10:12:33.630656 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.630786 <... mmap resumed> ) = 0x7fe14e8c0000
[pid 25399] 10:12:33.630803 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.630828 close(6 <unfinished ...>
[pid 25399] 10:12:33.630855 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.630888 <... close resumed> ) = 0
[pid 25399] 10:12:33.630903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.630928 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.630961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.630990 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.631006 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.631028 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.631065 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.631096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.631113 <... open resumed> ) = 6
[pid 25400] 10:12:33.631129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.631160 read(6,  <unfinished ...>
[pid 25400] 10:12:33.631184 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.631207 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.631234 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.631267 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.631292 <... open resumed> ) = 6
[pid 25399] 10:12:33.631307 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.631337 read(6,  <unfinished ...>
[pid 25399] 10:12:33.631369 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.631399 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.631429 <... mmap resumed> ) = 0x7f54cb348000
[pid 25400] 10:12:33.631453 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.631487 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.631516 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.631546 <... mmap resumed> ) = 0x7f54c8f23000
[pid 25400] 10:12:33.631564 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.631592 mprotect(0x7f54c90ad000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.631620 <... mmap resumed> ) = 0x7fe14e482000
[pid 25399] 10:12:33.631636 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.631652 mprotect(0x7fe14e499000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.631679 mmap(0x7f54c92ad000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25400] 10:12:33.631709 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.631725 <... mmap resumed> ) = 0x7f54c92ad000
[pid 25400] 10:12:33.631742 mmap(0x7fe14e699000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25399] 10:12:33.631777 mmap(0x7f54c92b2000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.631806 <... mmap resumed> ) = 0x7fe14e699000
[pid 25399] 10:12:33.631821 <... mmap resumed> ) = 0x7f54c92b2000
[pid 25400] 10:12:33.631843 mmap(0x7fe14e69b000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.631879 close(6 <unfinished ...>
[pid 25400] 10:12:33.631904 <... mmap resumed> ) = 0x7fe14e69b000
[pid 25399] 10:12:33.631919 <... close resumed> ) = 0
[pid 25400] 10:12:33.631940 close(6 <unfinished ...>
[pid 25399] 10:12:33.631976 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632007 <... close resumed> ) = 0
[pid 25399] 10:12:33.632022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632053 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632118 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.632134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632151 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632181 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632190 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632209 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632236 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.632241 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632265 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632271 <... open resumed> ) = 6
[pid 25400] 10:12:33.632287 <... open resumed> ) = 6
[pid 25399] 10:12:33.632293 read(6,  <unfinished ...>
[pid 25400] 10:12:33.632307 read(6,  <unfinished ...>
[pid 25399] 10:12:33.632312 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.632330 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.632338 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.632353 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.632359 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25400] 10:12:33.632383 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.632398 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.632420 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.632428 <... mmap resumed> ) = 0x7f54c8cb7000
[pid 25400] 10:12:33.632442 <... mmap resumed> ) = 0x7fe14f5cf000
[pid 25399] 10:12:33.632448 mprotect(0x7f54c8d19000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.632468 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.632475 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.632490 <... mmap resumed> ) = 0x7fe14e10e000
[pid 25399] 10:12:33.632495 mmap(0x7f54c8f18000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25400] 10:12:33.632513 mprotect(0x7fe14e27d000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.632519 <... mmap resumed> ) = 0x7f54c8f18000
[pid 25400] 10:12:33.632543 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.632548 close(6 <unfinished ...>
[pid 25400] 10:12:33.632562 mmap(0x7fe14e47c000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25399] 10:12:33.632569 <... close resumed> ) = 0
[pid 25400] 10:12:33.632594 <... mmap resumed> ) = 0x7fe14e47c000
[pid 25399] 10:12:33.632601 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632632 close(6 <unfinished ...>
[pid 25399] 10:12:33.632638 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632652 <... close resumed> ) = 0
[pid 25399] 10:12:33.632657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632685 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.632715 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632734 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632740 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.632760 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.632766 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.632787 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632794 <... open resumed> ) = 6
[pid 25400] 10:12:33.632810 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.632816 read(6,  <unfinished ...>
[pid 25400] 10:12:33.632832 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.632839 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.632861 <... open resumed> ) = 6
[pid 25399] 10:12:33.632866 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.632879 read(6,  <unfinished ...>
[pid 25399] 10:12:33.632885 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25400] 10:12:33.632909 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.632918 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.632936 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.632942 <... mmap resumed> ) = 0x7f54c88d4000
[pid 25400] 10:12:33.632955 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25399] 10:12:33.632969 mprotect(0x7f54c8a8d000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.632986 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.632995 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.633009 <... mmap resumed> ) = 0x7fe14de7f000
[pid 25399] 10:12:33.633014 mmap(0x7f54c8c8c000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25400] 10:12:33.633032 mprotect(0x7fe14df0a000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.633038 <... mmap resumed> ) = 0x7f54c8c8c000
[pid 25400] 10:12:33.633060 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.633065 mmap(0x7f54c8cb3000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.633082 mmap(0x7fe14e10a000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25399] 10:12:33.633088 <... mmap resumed> ) = 0x7f54c8cb3000
[pid 25400] 10:12:33.633109 <... mmap resumed> ) = 0x7fe14e10a000
[pid 25399] 10:12:33.633115 close(6 <unfinished ...>
[pid 25400] 10:12:33.633132 mmap(0x7fe14e10d000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.633139 <... close resumed> ) = 0
[pid 25400] 10:12:33.633161 <... mmap resumed> ) = 0x7fe14e10d000
[pid 25399] 10:12:33.633166 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.633191 close(6 <unfinished ...>
[pid 25399] 10:12:33.633197 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.633211 <... close resumed> ) = 0
[pid 25399] 10:12:33.633216 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.633242 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633249 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.633266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.633272 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.633290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.633317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.633323 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.633343 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633350 <... open resumed> ) = 6
[pid 25400] 10:12:33.633367 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.633372 read(6,  <unfinished ...>
[pid 25400] 10:12:33.633390 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633397 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.633422 <... open resumed> ) = 6
[pid 25399] 10:12:33.633427 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.633441 read(6,  <unfinished ...>
[pid 25399] 10:12:33.633446 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25400] 10:12:33.633470 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.633480 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.633496 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.633502 <... mmap resumed> ) = 0x7f54cb347000
[pid 25400] 10:12:33.633518 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25399] 10:12:33.633532 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.633551 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.633558 <... mmap resumed> ) = 0x7f54c86a7000
[pid 25400] 10:12:33.633573 <... mmap resumed> ) = 0x7fe14dc79000
[pid 25399] 10:12:33.633578 mprotect(0x7f54c86d3000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.633594 mprotect(0x7fe14dc7f000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.633600 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.633614 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.633619 mmap(0x7f54c88d3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25400] 10:12:33.633636 mmap(0x7fe14de7e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25399] 10:12:33.633643 <... mmap resumed> ) = 0x7f54c88d3000
[pid 25400] 10:12:33.633661 <... mmap resumed> ) = 0x7fe14de7e000
[pid 25399] 10:12:33.633667 close(6 <unfinished ...>
[pid 25400] 10:12:33.633684 close(6 <unfinished ...>
[pid 25399] 10:12:33.633690 <... close resumed> ) = 0
[pid 25400] 10:12:33.633708 <... close resumed> ) = 0
[pid 25399] 10:12:33.633713 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.633740 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633747 <... open resumed> ) = 6
[pid 25400] 10:12:33.633764 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.633770 read(6,  <unfinished ...>
[pid 25400] 10:12:33.633784 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.633791 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.633814 <... open resumed> ) = 6
[pid 25399] 10:12:33.633819 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.633832 read(6,  <unfinished ...>
[pid 25399] 10:12:33.633837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25400] 10:12:33.633861 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.633871 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.633890 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.633895 <... mmap resumed> ) = 0x7f54c84a2000
[pid 25400] 10:12:33.633908 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.633922 mprotect(0x7f54c84a7000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.633939 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.633945 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.633959 <... mmap resumed> ) = 0x7fe14f5ce000
[pid 25399] 10:12:33.633964 mmap(0x7f54c86a6000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25400] 10:12:33.633985 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.633991 <... mmap resumed> ) = 0x7f54c86a6000
[pid 25400] 10:12:33.634010 <... mmap resumed> ) = 0x7fe14d943000
[pid 25399] 10:12:33.634015 close(6 <unfinished ...>
[pid 25400] 10:12:33.634028 mprotect(0x7fe14da6f000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.634034 <... close resumed> ) = 0
[pid 25400] 10:12:33.634056 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.634062 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634081 mmap(0x7fe14dc6f000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25399] 10:12:33.634088 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634105 <... mmap resumed> ) = 0x7fe14dc6f000
[pid 25399] 10:12:33.634110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634134 mmap(0x7fe14dc78000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.634142 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634157 <... mmap resumed> ) = 0x7fe14dc78000
[pid 25399] 10:12:33.634162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634187 close(6 <unfinished ...>
[pid 25399] 10:12:33.634193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634207 <... close resumed> ) = 0
[pid 25399] 10:12:33.634213 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634236 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634243 <... open resumed> ) = 6
[pid 25400] 10:12:33.634260 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634265 read(6,  <unfinished ...>
[pid 25400] 10:12:33.634280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634286 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.634309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634314 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.634328 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25400] 10:12:33.634364 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634370 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.634389 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634396 <... mmap resumed> ) = 0x7f54c829f000
[pid 25400] 10:12:33.634416 <... open resumed> ) = 6
[pid 25399] 10:12:33.634422 mprotect(0x7f54c82a1000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.634438 read(6,  <unfinished ...>
[pid 25399] 10:12:33.634444 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.634457 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.634466 mmap(0x7f54c84a0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25400] 10:12:33.634484 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.634489 <... mmap resumed> ) = 0x7f54c84a0000
[pid 25400] 10:12:33.634511 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.634526 close(6 <unfinished ...>
[pid 25400] 10:12:33.634541 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.634547 <... close resumed> ) = 0
[pid 25400] 10:12:33.634570 <... mmap resumed> ) = 0x7fe14d73f000
[pid 25399] 10:12:33.634576 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634594 mprotect(0x7fe14d741000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.634600 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634617 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.634623 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634646 mmap(0x7fe14d941000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25399] 10:12:33.634653 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634669 <... mmap resumed> ) = 0x7fe14d941000
[pid 25399] 10:12:33.634675 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634703 close(6 <unfinished ...>
[pid 25399] 10:12:33.634709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.634724 <... close resumed> ) = 0
[pid 25399] 10:12:33.634730 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.634756 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634764 <... open resumed> ) = 6
[pid 25400] 10:12:33.634780 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634786 read(6,  <unfinished ...>
[pid 25400] 10:12:33.634809 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634820 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.634851 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634860 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.634881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25400] 10:12:33.634934 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.634946 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.634974 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.634987 <... mmap resumed> ) = 0x7f54cb346000
[pid 25400] 10:12:33.635019 <... open resumed> ) = 6
[pid 25399] 10:12:33.635029 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.635059 read(6,  <unfinished ...>
[pid 25399] 10:12:33.635070 <... mmap resumed> ) = 0x7f54c807c000
[pid 25400] 10:12:33.635092 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.635108 mprotect(0x7f54c8093000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.635135 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.635143 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.635156 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.635172 mmap(0x7f54c8293000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25400] 10:12:33.635193 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.635200 <... mmap resumed> ) = 0x7f54c8293000
[pid 25400] 10:12:33.635225 <... mmap resumed> ) = 0x7fe14d53c000
[pid 25399] 10:12:33.635232 close(6 <unfinished ...>
[pid 25400] 10:12:33.635245 mprotect(0x7fe14d53e000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.635252 <... close resumed> ) = 0
[pid 25400] 10:12:33.635289 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.635295 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.635316 mmap(0x7fe14d73d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25399] 10:12:33.635324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.635341 <... mmap resumed> ) = 0x7fe14d73d000
[pid 25399] 10:12:33.635346 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.635375 close(6 <unfinished ...>
[pid 25399] 10:12:33.635381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.635395 <... close resumed> ) = 0
[pid 25399] 10:12:33.635400 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.635429 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.635437 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.635456 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.635462 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.635482 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.635489 <... open resumed> ) = 6
[pid 25400] 10:12:33.635507 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.635513 read(6,  <unfinished ...>
[pid 25400] 10:12:33.635527 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.635534 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.635555 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.635560 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.635575 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.635582 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.635610 <... open resumed> ) = 6
[pid 25399] 10:12:33.635615 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.635634 read(6,  <unfinished ...>
[pid 25399] 10:12:33.635639 <... mmap resumed> ) = 0x7f54c7e38000
[pid 25400] 10:12:33.635652 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.635661 mprotect(0x7f54c7e79000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.635907 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.635917 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.635933 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.635950 mmap(0x7f54c8079000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25400] 10:12:33.635970 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.635977 <... mmap resumed> ) = 0x7f54c8079000
[pid 25400] 10:12:33.636002 <... mmap resumed> ) = 0x7fe14f5cd000
[pid 25399] 10:12:33.636008 close(6 <unfinished ...>
[pid 25400] 10:12:33.636024 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.636031 <... close resumed> ) = 0
[pid 25400] 10:12:33.636054 <... mmap resumed> ) = 0x7fe14d1a8000
[pid 25399] 10:12:33.636060 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636080 mprotect(0x7fe14d332000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.636086 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.636103 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.636109 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636129 mmap(0x7fe14d532000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25399] 10:12:33.636137 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.636154 <... mmap resumed> ) = 0x7fe14d532000
[pid 25399] 10:12:33.636159 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636182 mmap(0x7fe14d537000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.636189 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.636206 <... mmap resumed> ) = 0x7fe14d537000
[pid 25399] 10:12:33.636211 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636236 close(6 <unfinished ...>
[pid 25399] 10:12:33.636243 <... open resumed> ) = 6
[pid 25400] 10:12:33.636255 <... close resumed> ) = 0
[pid 25399] 10:12:33.636260 read(6,  <unfinished ...>
[pid 25400] 10:12:33.636281 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.636289 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.636339 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.636350 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.636365 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.636375 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.636409 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.636603 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.636626 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.636634 <... mmap resumed> ) = 0x7f54cb345000
[pid 25400] 10:12:33.636655 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.636661 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.636684 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.636692 <... mmap resumed> ) = 0x7f54c7b51000
[pid 25400] 10:12:33.636710 <... open resumed> ) = 6
[pid 25399] 10:12:33.636715 mprotect(0x7f54c7c2c000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.636732 read(6,  <unfinished ...>
[pid 25399] 10:12:33.636738 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.636751 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.636760 mmap(0x7f54c7e2c000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25400] 10:12:33.636779 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.636784 <... mmap resumed> ) = 0x7f54c7e2c000
[pid 25400] 10:12:33.636807 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25399] 10:12:33.636823 close(6 <unfinished ...>
[pid 25400] 10:12:33.636838 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.636845 <... close resumed> ) = 0
[pid 25400] 10:12:33.636867 <... mmap resumed> ) = 0x7fe14cf3c000
[pid 25399] 10:12:33.636873 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636893 mprotect(0x7fe14cf9e000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.636899 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.636916 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.636921 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636942 mmap(0x7fe14d19d000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25399] 10:12:33.636949 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.636965 <... mmap resumed> ) = 0x7fe14d19d000
[pid 25399] 10:12:33.636970 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.636998 close(6 <unfinished ...>
[pid 25399] 10:12:33.637004 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.637019 <... close resumed> ) = 0
[pid 25399] 10:12:33.637024 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.637052 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637059 <... open resumed> ) = 6
[pid 25400] 10:12:33.637076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637082 read(6,  <unfinished ...>
[pid 25400] 10:12:33.637096 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637103 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.637125 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637131 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.637145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637152 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.637180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637186 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.637207 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637214 <... mmap resumed> ) = 0x7f54c794d000
[pid 25400] 10:12:33.637231 <... open resumed> ) = 6
[pid 25399] 10:12:33.637236 mprotect(0x7f54c7950000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.637253 read(6,  <unfinished ...>
[pid 25399] 10:12:33.637259 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.637273 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.637281 mmap(0x7f54c7b4f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25400] 10:12:33.637299 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.637304 <... mmap resumed> ) = 0x7f54c7b4f000
[pid 25400] 10:12:33.637326 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25399] 10:12:33.637341 close(6 <unfinished ...>
[pid 25400] 10:12:33.637356 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.637363 <... close resumed> ) = 0
[pid 25400] 10:12:33.637385 <... mmap resumed> ) = 0x7fe14cb59000
[pid 25399] 10:12:33.637391 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.637410 mprotect(0x7fe14cd12000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.637605 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.637627 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.637632 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.637655 mmap(0x7fe14cf11000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25399] 10:12:33.637663 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.637684 <... mmap resumed> ) = 0x7fe14cf11000
[pid 25399] 10:12:33.637690 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.637714 mmap(0x7fe14cf38000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.637721 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.637738 <... mmap resumed> ) = 0x7fe14cf38000
[pid 25399] 10:12:33.637744 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.637769 close(6 <unfinished ...>
[pid 25399] 10:12:33.637776 <... open resumed> ) = 6
[pid 25400] 10:12:33.637788 <... close resumed> ) = 0
[pid 25399] 10:12:33.637793 read(6,  <unfinished ...>
[pid 25400] 10:12:33.637815 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637822 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.637843 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637848 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.637862 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.637899 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637905 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.637924 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637931 <... mmap resumed> ) = 0x7f54c7721000
[pid 25400] 10:12:33.637948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.637953 mprotect(0x7f54c774a000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.637972 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.637979 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.637995 <... open resumed> ) = 6
[pid 25399] 10:12:33.638001 mmap(0x7f54c794a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25400] 10:12:33.638019 read(6,  <unfinished ...>
[pid 25399] 10:12:33.638025 <... mmap resumed> ) = 0x7f54c794a000
[pid 25400] 10:12:33.638042 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.638051 mmap(0x7f54c794c000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.638068 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.638074 <... mmap resumed> ) = 0x7f54c794c000
[pid 25400] 10:12:33.638092 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25399] 10:12:33.638108 close(6 <unfinished ...>
[pid 25400] 10:12:33.638122 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.638129 <... close resumed> ) = 0
[pid 25400] 10:12:33.638152 <... mmap resumed> ) = 0x7fe14f5cc000
[pid 25399] 10:12:33.638157 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.638180 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.638187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.638203 <... mmap resumed> ) = 0x7fe14c92c000
[pid 25399] 10:12:33.638208 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.638228 mprotect(0x7fe14c958000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.638234 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.638250 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.638255 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.638274 mmap(0x7fe14cb58000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25399] 10:12:33.638281 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.638298 <... mmap resumed> ) = 0x7fe14cb58000
[pid 25399] 10:12:33.638303 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.638329 close(6 <unfinished ...>
[pid 25399] 10:12:33.638339 <... open resumed> ) = 6
[pid 25400] 10:12:33.638352 <... close resumed> ) = 0
[pid 25399] 10:12:33.638358 read(6,  <unfinished ...>
[pid 25400] 10:12:33.638382 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.638390 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.639159 <... open resumed> ) = 6
[pid 25399] 10:12:33.639179 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.639207 read(6,  <unfinished ...>
[pid 25399] 10:12:33.639231 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25400] 10:12:33.639261 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.639285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.639315 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.639339 <... mmap resumed> ) = 0x7f54cb344000
[pid 25400] 10:12:33.639355 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:33.639388 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.639456 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.639488 <... mmap resumed> ) = 0x7f54c750b000
[pid 25400] 10:12:33.639509 <... mmap resumed> ) = 0x7fe14c727000
[pid 25399] 10:12:33.639526 mprotect(0x7f54c7520000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.639555 mprotect(0x7fe14c72c000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.639582 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.639597 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.639613 mmap(0x7f54c771f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25400] 10:12:33.639644 mmap(0x7fe14c92b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25399] 10:12:33.639674 <... mmap resumed> ) = 0x7f54c771f000
[pid 25400] 10:12:33.639691 <... mmap resumed> ) = 0x7fe14c92b000
[pid 25399] 10:12:33.639718 close(6 <unfinished ...>
[pid 25400] 10:12:33.639750 close(6 <unfinished ...>
[pid 25399] 10:12:33.639773 <... close resumed> ) = 0
[pid 25400] 10:12:33.639787 <... close resumed> ) = 0
[pid 25399] 10:12:33.639820 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.639865 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.639894 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.639911 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.639928 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.639961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.639992 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.640007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.640024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.640055 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.640084 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.640099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.640118 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.640152 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.640179 <... open resumed> ) = 6
[pid 25400] 10:12:33.640194 <... open resumed> ) = 6
[pid 25399] 10:12:33.640211 read(6,  <unfinished ...>
[pid 25400] 10:12:33.640236 read(6,  <unfinished ...>
[pid 25399] 10:12:33.640259 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.640280 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.640302 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.640328 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.640353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25400] 10:12:33.640386 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25399] 10:12:33.640476 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.640513 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.640543 <... mmap resumed> ) = 0x7f54c7300000
[pid 25400] 10:12:33.640558 <... mmap resumed> ) = 0x7fe14c524000
[pid 25399] 10:12:33.640575 mprotect(0x7f54c730a000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.640603 mprotect(0x7fe14c526000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.640630 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.640645 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.640662 mmap(0x7f54c7509000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25400] 10:12:33.640697 mmap(0x7fe14c725000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25399] 10:12:33.640725 <... mmap resumed> ) = 0x7f54c7509000
[pid 25400] 10:12:33.640741 <... mmap resumed> ) = 0x7fe14c725000
[pid 25399] 10:12:33.640766 close(6 <unfinished ...>
[pid 25400] 10:12:33.640803 close(6 <unfinished ...>
[pid 25399] 10:12:33.640827 <... close resumed> ) = 0
[pid 25400] 10:12:33.640842 <... close resumed> ) = 0
[pid 25399] 10:12:33.640867 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.640909 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.640939 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.640955 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.640972 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.641005 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.641036 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.641052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.641069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.641099 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.641128 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.641144 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.641162 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.641196 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.641226 <... open resumed> ) = 6
[pid 25400] 10:12:33.641241 <... open resumed> ) = 6
[pid 25399] 10:12:33.641257 read(6,  <unfinished ...>
[pid 25400] 10:12:33.641282 read(6,  <unfinished ...>
[pid 25399] 10:12:33.641306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.641327 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.641355 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.641382 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.641406 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25400] 10:12:33.641497 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25399] 10:12:33.641528 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.641563 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.641590 <... mmap resumed> ) = 0x7f54c70fd000
[pid 25400] 10:12:33.641606 <... mmap resumed> ) = 0x7fe14f5cb000
[pid 25399] 10:12:33.641623 mprotect(0x7f54c70ff000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.641656 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.641688 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.641703 <... mmap resumed> ) = 0x7fe14c301000
[pid 25399] 10:12:33.641720 mmap(0x7f54c72fe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25400] 10:12:33.641750 mprotect(0x7fe14c318000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.641777 <... mmap resumed> ) = 0x7f54c72fe000
[pid 25400] 10:12:33.641793 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.641818 close(6 <unfinished ...>
[pid 25400] 10:12:33.641844 mmap(0x7fe14c518000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25399] 10:12:33.641872 <... close resumed> ) = 0
[pid 25400] 10:12:33.641887 <... mmap resumed> ) = 0x7fe14c518000
[pid 25399] 10:12:33.641910 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.641948 close(6 <unfinished ...>
[pid 25399] 10:12:33.641972 <... mmap resumed> ) = 0x7f54cb343000
[pid 25400] 10:12:33.641987 <... close resumed> ) = 0
[pid 25399] 10:12:33.642021 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.642077 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.642107 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.642124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.642141 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.642173 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.642204 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.642220 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.642237 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.642267 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.642296 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.642317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.642336 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.642370 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.642401 <... open resumed> ) = 6
[pid 25400] 10:12:33.642460 <... open resumed> ) = 6
[pid 25399] 10:12:33.642481 read(6,  <unfinished ...>
[pid 25400] 10:12:33.642506 read(6,  <unfinished ...>
[pid 25399] 10:12:33.642530 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.642552 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.642574 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.642599 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.642622 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25400] 10:12:33.642649 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.642682 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25400] 10:12:33.642716 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.642744 <... mmap resumed> ) = 0x7f54c6ede000
[pid 25400] 10:12:33.642759 <... mmap resumed> ) = 0x7fe14c0bd000
[pid 25399] 10:12:33.642776 mprotect(0x7f54c6efb000, 2093056, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.642804 mprotect(0x7fe14c0fe000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.642831 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.642846 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.642862 mmap(0x7f54c70fa000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25400] 10:12:33.642892 mmap(0x7fe14c2fe000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25399] 10:12:33.642920 <... mmap resumed> ) = 0x7f54c70fa000
[pid 25400] 10:12:33.642935 <... mmap resumed> ) = 0x7fe14c2fe000
[pid 25399] 10:12:33.642957 mmap(0x7f54c70fc000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.642997 close(6 <unfinished ...>
[pid 25399] 10:12:33.643021 <... mmap resumed> ) = 0x7f54c70fc000
[pid 25400] 10:12:33.643037 <... close resumed> ) = 0
[pid 25399] 10:12:33.643059 close(6 <unfinished ...>
[pid 25400] 10:12:33.643095 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.643125 <... close resumed> ) = 0
[pid 25400] 10:12:33.643141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.643252 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.643287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.643320 <... mmap resumed> ) = 0x7f54cb342000
[pid 25400] 10:12:33.643336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.643392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.643452 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.643483 <... mmap resumed> ) = 0x7f54cb341000
[pid 25400] 10:12:33.643500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.643528 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.643558 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.643589 <... mmap resumed> ) = 0x7f54cb33f000
[pid 25400] 10:12:33.643605 <... open resumed> ) = 6
[pid 25399] 10:12:33.643627 arch_prctl(ARCH_SET_FS, 0x7f54cb33f7c0 <unfinished ...>
[pid 25400] 10:12:33.643653 read(6,  <unfinished ...>
[pid 25399] 10:12:33.643680 <... arch_prctl resumed> ) = 0
[pid 25400] 10:12:33.643696 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.643767 mprotect(0x7f54c70fa000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.643798 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.643822 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.643837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.643871 mprotect(0x7f54c72fe000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.643900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.643927 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.643942 <... mmap resumed> ) = 0x7fe14f5ca000
[pid 25399] 10:12:33.643977 mprotect(0x7f54c7509000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644009 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.644039 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644054 <... mmap resumed> ) = 0x7fe14bdd6000
[pid 25399] 10:12:33.644080 mprotect(0x7f54c771f000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644109 mprotect(0x7fe14beb1000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.644136 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644151 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.644183 mprotect(0x7f54c794a000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644211 mmap(0x7fe14c0b1000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25399] 10:12:33.644241 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644257 <... mmap resumed> ) = 0x7fe14c0b1000
[pid 25399] 10:12:33.644283 mprotect(0x7f54c7b4f000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644322 close(6 <unfinished ...>
[pid 25399] 10:12:33.644347 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644364 <... close resumed> ) = 0
[pid 25399] 10:12:33.644545 mprotect(0x7f54c7e2c000, 40960, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644588 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.644626 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.644752 mprotect(0x7f54c8079000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.644816 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644831 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.644861 mprotect(0x7f54c8293000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644891 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.644921 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.644936 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.644957 mprotect(0x7f54c84a0000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.644987 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.645018 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.645033 <... open resumed> ) = 6
[pid 25399] 10:12:33.645255 mprotect(0x7f54c8c8c000, 110592, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.645286 read(6,  <unfinished ...>
[pid 25399] 10:12:33.645311 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.645325 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.645503 mprotect(0x7f54c8f18000, 16384, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.645541 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.645565 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.645580 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.645719 mprotect(0x7f54c92ad000, 16384, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.645756 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.645787 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.645803 <... mmap resumed> ) = 0x7fe14bbd2000
[pid 25399] 10:12:33.645824 mprotect(0x7f54c94b8000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.645853 mprotect(0x7fe14bbd5000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.645888 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.645905 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.645931 mprotect(0x7f54c96bc000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.645960 mmap(0x7fe14bdd4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25399] 10:12:33.645989 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.646005 <... mmap resumed> ) = 0x7fe14bdd4000
[pid 25399] 10:12:33.646779 mprotect(0x7f54ca414000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.646829 close(6 <unfinished ...>
[pid 25399] 10:12:33.646855 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.646871 <... close resumed> ) = 0
[pid 25399] 10:12:33.646907 mprotect(0x7f54ca849000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.646946 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.646978 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.646994 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.647023 mprotect(0x7f54caacd000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.647053 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.647086 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.647108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.647131 mprotect(0x7f54cacd6000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.647161 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.647191 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.647206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.647241 mprotect(0x7f54caf1b000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.647271 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.647303 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.647318 <... open resumed> ) = 6
[pid 25399] 10:12:33.647345 mprotect(0x7f54cb135000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.647375 read(6,  <unfinished ...>
[pid 25399] 10:12:33.647400 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.647502 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.647529 mprotect(0x7f54cb358000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.647559 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.647584 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.647603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.647641 munmap(0x7f54cb34d000, 39387 <unfinished ...>
[pid 25400] 10:12:33.647676 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.647714 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.647731 <... mmap resumed> ) = 0x7fe14b9a6000
[pid 25399] 10:12:33.647750 set_tid_address(0x7f54cb33fa90 <unfinished ...>
[pid 25400] 10:12:33.647779 mprotect(0x7fe14b9cf000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.647810 <... set_tid_address resumed> ) = 25399
[pid 25400] 10:12:33.647827 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.647844 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25400] 10:12:33.647869 mmap(0x7fe14bbcf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25399] 10:12:33.647899 <... set_robust_list resumed> ) = 0
[pid 25400] 10:12:33.647914 <... mmap resumed> ) = 0x7fe14bbcf000
[pid 25399] 10:12:33.647931 futex(0x7ffed9b5058c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25400] 10:12:33.647963 mmap(0x7fe14bbd1000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.647991 <... futex resumed> ) = 0
[pid 25400] 10:12:33.648006 <... mmap resumed> ) = 0x7fe14bbd1000
[pid 25399] 10:12:33.648023 futex(0x7ffed9b5058c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f54cb33f7c0 <unfinished ...>
[pid 25400] 10:12:33.648056 close(6 <unfinished ...>
[pid 25399] 10:12:33.648080 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25400] 10:12:33.648096 <... close resumed> ) = 0
[pid 25399] 10:12:33.648118 rt_sigaction(SIGRTMIN, {0x7f54ca202c60, [], SA_RESTORER|SA_SIGINFO, 0x7f54ca20c790},  <unfinished ...>
[pid 25400] 10:12:33.648160 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.648197 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25400] 10:12:33.648213 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.648231 rt_sigaction(SIGRT_1, {0x7f54ca202cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f54ca20c790},  <unfinished ...>
[pid 25400] 10:12:33.648261 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.648292 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25400] 10:12:33.648308 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.648327 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25400] 10:12:33.648355 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.648386 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25400] 10:12:33.648402 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.648509 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25400] 10:12:33.648542 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.648574 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25400] 10:12:33.648593 <... open resumed> ) = 6
[pid 25399] 10:12:33.648648 statfs("/selinux",  <unfinished ...>
[pid 25400] 10:12:33.648686 read(6,  <unfinished ...>
[pid 25399] 10:12:33.648711 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350371, f_bavail=6350371, f_files=1000000, f_ffree=691138, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25400] 10:12:33.648731 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.648803 brk(0 <unfinished ...>
[pid 25400] 10:12:33.648832 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.648856 <... brk resumed> ) = 0x149c000
[pid 25400] 10:12:33.648871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25399] 10:12:33.648901 brk(0x14bd000 <unfinished ...>
[pid 25400] 10:12:33.648935 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.648963 <... brk resumed> ) = 0x14bd000
[pid 25400] 10:12:33.648979 <... mmap resumed> ) = 0x7fe14f5c9000
[pid 25399] 10:12:33.649007 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.649050 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.649081 <... open resumed> ) = 6
[pid 25400] 10:12:33.649096 <... mmap resumed> ) = 0x7fe14b790000
[pid 25399] 10:12:33.649126 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.649153 mprotect(0x7fe14b7a5000, 2093056, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.649181 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.649209 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.649227 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.649255 mmap(0x7fe14b9a4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25399] 10:12:33.649294 <... mmap resumed> ) = 0x7f54cb356000
[pid 25400] 10:12:33.649311 <... mmap resumed> ) = 0x7fe14b9a4000
[pid 25399] 10:12:33.649328 read(6,  <unfinished ...>
[pid 25400] 10:12:33.649529 close(6 <unfinished ...>
[pid 25399] 10:12:33.649560 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25400] 10:12:33.649580 <... close resumed> ) = 0
[pid 25399] 10:12:33.649608 read(6,  <unfinished ...>
[pid 25400] 10:12:33.649656 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.649688 <... read resumed> "", 1024) = 0
[pid 25400] 10:12:33.649704 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.649730 close(6 <unfinished ...>
[pid 25400] 10:12:33.649760 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.649792 <... close resumed> ) = 0
[pid 25400] 10:12:33.649808 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.649826 munmap(0x7f54cb356000, 4096 <unfinished ...>
[pid 25400] 10:12:33.649855 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.649886 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.649901 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.649971 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25400] 10:12:33.650011 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.650042 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.650059 <... open resumed> ) = 6
[pid 25399] 10:12:33.650145 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f54ca20c790},  <unfinished ...>
[pid 25400] 10:12:33.650179 read(6,  <unfinished ...>
[pid 25399] 10:12:33.650203 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25400] 10:12:33.650219 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.650251 fstat(2,  <unfinished ...>
[pid 25400] 10:12:33.650279 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.650325 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25400] 10:12:33.650353 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe14b585000
[pid 25399] 10:12:33.650502 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f54ca20c790},  <unfinished ...>
[pid 25400] 10:12:33.650534 mprotect(0x7fe14b58f000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.650569 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25400] 10:12:33.650585 mmap(0x7fe14b78e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fe14b78e000
[pid 25399] 10:12:33.650638 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25400] 10:12:33.650668 close(6)    = 0
[pid 25399] 10:12:33.650708 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25400] 10:12:33.650733 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.650782 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25400] 10:12:33.650810 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.650850 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25400] 10:12:33.650867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.650907 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f54ca20c790},  <unfinished ...>
[pid 25400] 10:12:33.650934 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25399] 10:12:33.650972 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25400] 10:12:33.650987 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.651038 umask(0 <unfinished ...>
[pid 25400] 10:12:33.651062 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25399] 10:12:33.651107 <... umask resumed> ) = 0
[pid 25400] 10:12:33.651123 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe14b382000
[pid 25399] 10:12:33.651202 geteuid( <unfinished ...>
[pid 25400] 10:12:33.651227 mprotect(0x7fe14b384000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.651262 <... geteuid resumed> ) = 0
[pid 25400] 10:12:33.651277 mmap(0x7fe14b583000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fe14b583000
[pid 25399] 10:12:33.651327 getuid( <unfinished ...>
[pid 25400] 10:12:33.651357 close(6)    = 0
[pid 25399] 10:12:33.651401 <... getuid resumed> ) = 47
[pid 25400] 10:12:33.651493 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5c8000
[pid 25399] 10:12:33.651555 getgid( <unfinished ...>
[pid 25400] 10:12:33.651581 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.651622 <... getgid resumed> ) = 12
[pid 25400] 10:12:33.651638 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.651708 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25400] 10:12:33.651735 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.651776 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25400] 10:12:33.651794 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25399] 10:12:33.651831 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25400] 10:12:33.651854 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.651902 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25400] 10:12:33.651921 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25399] 10:12:33.651984 getgroups(65536,  <unfinished ...>
[pid 25400] 10:12:33.652010 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe14b163000
[pid 25399] 10:12:33.652048 <... getgroups resumed> [12]) = 1
[pid 25400] 10:12:33.652065 mprotect(0x7fe14b180000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.652109 setgroups(0, [] <unfinished ...>
[pid 25400] 10:12:33.652135 mmap(0x7fe14b37f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fe14b37f000
[pid 25399] 10:12:33.652177 <... setgroups resumed> ) = 0
[pid 25400] 10:12:33.652194 mmap(0x7fe14b381000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe14b381000
[pid 25399] 10:12:33.652240 getegid( <unfinished ...>
[pid 25400] 10:12:33.652266 close(6)    = 0
[pid 25399] 10:12:33.652333 <... getegid resumed> ) = 12
[pid 25400] 10:12:33.652351 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5c7000
[pid 25399] 10:12:33.652499 geteuid( <unfinished ...>
[pid 25400] 10:12:33.652531 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5c6000
[pid 25399] 10:12:33.652576 <... geteuid resumed> ) = 0
[pid 25400] 10:12:33.652600 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5c4000
[pid 25399] 10:12:33.652647 geteuid( <unfinished ...>
[pid 25400] 10:12:33.652671 arch_prctl(ARCH_SET_FS, 0x7fe14f5c47c0) = 0
[pid 25399] 10:12:33.652740 <... geteuid resumed> ) = 0
[pid 25400] 10:12:33.652757 mprotect(0x7fe14b37f000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.652797 getegid( <unfinished ...>
[pid 25400] 10:12:33.652821 mprotect(0x7fe14b583000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.652871 <... getegid resumed> ) = 12
[pid 25400] 10:12:33.652888 mprotect(0x7fe14b78e000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.652934 setgid(12 <unfinished ...>
[pid 25400] 10:12:33.652959 mprotect(0x7fe14b9a4000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653006 <... setgid resumed> ) = 0
[pid 25400] 10:12:33.653023 mprotect(0x7fe14bbcf000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653069 setuid(0 <unfinished ...>
[pid 25400] 10:12:33.653096 mprotect(0x7fe14bdd4000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653250 <... setuid resumed> ) = 0
[pid 25400] 10:12:33.653269 mprotect(0x7fe14c0b1000, 40960, PROT_READ) = 0
[pid 25399] 10:12:33.653485 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.653525 mprotect(0x7fe14c2fe000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653571 <... open resumed> ) = 6
[pid 25400] 10:12:33.653588 mprotect(0x7fe14c518000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653648 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.653674 mprotect(0x7fe14c725000, 4096, PROT_READ) = 0
[pid 25399] 10:12:33.653919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.653952 mprotect(0x7fe14cf11000, 110592, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.653989 fstat(6,  <unfinished ...>
[pid 25400] 10:12:33.654014 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.654029 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.654128 mprotect(0x7fe14d19d000, 16384, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.654159 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.654192 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.654208 <... mmap resumed> ) = 0x7f54cb356000
[pid 25400] 10:12:33.654313 mprotect(0x7fe14d532000, 16384, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.654347 read(6,  <unfinished ...>
[pid 25400] 10:12:33.654375 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.654391 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25400] 10:12:33.654489 mprotect(0x7fe14d73d000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.654690 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25400] 10:12:33.654724 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.654741 <... socket resumed> ) = 7
[pid 25400] 10:12:33.654767 mprotect(0x7fe14d941000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.654796 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25400] 10:12:33.654835 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.654851 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.655579 mprotect(0x7fe14e699000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.655618 close(7 <unfinished ...>
[pid 25400] 10:12:33.655654 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.655670 <... close resumed> ) = 0
[pid 25400] 10:12:33.655707 mprotect(0x7fe14eace000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.655737 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25400] 10:12:33.655764 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.655780 <... socket resumed> ) = 7
[pid 25400] 10:12:33.655801 mprotect(0x7fe14ed52000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.655829 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25400] 10:12:33.655862 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.655878 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.655901 mprotect(0x7fe14ef5b000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.655930 close(7 <unfinished ...>
[pid 25400] 10:12:33.655962 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.655978 <... close resumed> ) = 0
[pid 25400] 10:12:33.656011 mprotect(0x7fe14f1a0000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.656049 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.656080 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.656096 <... open resumed> ) = 7
[pid 25400] 10:12:33.656121 mprotect(0x7fe14f3ba000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.656154 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.656179 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.656194 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25400] 10:12:33.656250 mprotect(0x7fe14f5dd000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.656279 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.656306 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.656322 <... mmap resumed> ) = 0x7f54cb355000
[pid 25400] 10:12:33.656341 munmap(0x7fe14f5d2000, 39387 <unfinished ...>
[pid 25399] 10:12:33.656377 read(7,  <unfinished ...>
[pid 25400] 10:12:33.656411 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.656502 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25400] 10:12:33.656533 set_tid_address(0x7fe14f5c4a90 <unfinished ...>
[pid 25399] 10:12:33.656583 read(7,  <unfinished ...>
[pid 25400] 10:12:33.656607 <... set_tid_address resumed> ) = 25400
[pid 25399] 10:12:33.656623 <... read resumed> "", 4096) = 0
[pid 25400] 10:12:33.656640 set_robust_list(0x7fe14f5c4aa0, 24 <unfinished ...>
[pid 25399] 10:12:33.656666 close(7 <unfinished ...>
[pid 25400] 10:12:33.656691 <... set_robust_list resumed> ) = 0
[pid 25399] 10:12:33.656706 <... close resumed> ) = 0
[pid 25400] 10:12:33.656722 futex(0x7fff0682188c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25399] 10:12:33.656748 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25400] 10:12:33.656776 <... futex resumed> ) = 0
[pid 25399] 10:12:33.656792 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.656808 futex(0x7fff0682188c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fe14f5c47c0 <unfinished ...>
[pid 25399] 10:12:33.656851 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.656888 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25399] 10:12:33.656906 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.656928 rt_sigaction(SIGRTMIN, {0x7fe14e487c60, [], SA_RESTORER|SA_SIGINFO, 0x7fe14e491790},  <unfinished ...>
[pid 25399] 10:12:33.656959 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.656992 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:33.657008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.657025 rt_sigaction(SIGRT_1, {0x7fe14e487cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fe14e491790},  <unfinished ...>
[pid 25399] 10:12:33.657054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.657084 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:33.657099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.657116 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25399] 10:12:33.657144 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.657173 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25399] 10:12:33.657189 <... open resumed> ) = 7
[pid 25400] 10:12:33.657214 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25399] 10:12:33.657240 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.657264 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25399] 10:12:33.657281 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25400] 10:12:33.657346 statfs("/selinux",  <unfinished ...>
[pid 25399] 10:12:33.657382 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25400] 10:12:33.657410 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350371, f_bavail=6350371, f_files=1000000, f_ffree=691138, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25399] 10:12:33.657517 <... mmap resumed> ) = 0x7f54cb335000
[pid 25400] 10:12:33.657585 brk(0 <unfinished ...>
[pid 25399] 10:12:33.657614 close(7 <unfinished ...>
[pid 25400] 10:12:33.657638 <... brk resumed> ) = 0x223e000
[pid 25399] 10:12:33.657653 <... close resumed> ) = 0
[pid 25400] 10:12:33.657669 brk(0x225f000 <unfinished ...>
[pid 25399] 10:12:33.657704 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25400] 10:12:33.657737 <... brk resumed> ) = 0x225f000
[pid 25399] 10:12:33.657753 <... open resumed> ) = 7
[pid 25400] 10:12:33.657779 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.657814 read(7,  <unfinished ...>
[pid 25400] 10:12:33.657839 <... open resumed> ) = 6
[pid 25399] 10:12:33.657853 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.657894 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.657922 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.657945 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.657973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.658002 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.658037 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25400] 10:12:33.658069 <... mmap resumed> ) = 0x7fe14f5db000
[pid 25399] 10:12:33.658085 <... mmap resumed> ) = 0x7f54c6cd0000
[pid 25400] 10:12:33.658109 read(6,  <unfinished ...>
[pid 25399] 10:12:33.658162 mprotect(0x7f54c6cdc000, 2097152, PROT_NONE <unfinished ...>
[pid 25400] 10:12:33.658192 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25399] 10:12:33.658211 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.658237 read(6,  <unfinished ...>
[pid 25399] 10:12:33.658263 mmap(0x7f54c6edc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25400] 10:12:33.658293 <... read resumed> "", 1024) = 0
[pid 25399] 10:12:33.658310 <... mmap resumed> ) = 0x7f54c6edc000
[pid 25400] 10:12:33.658333 close(6 <unfinished ...>
[pid 25399] 10:12:33.658378 close(7 <unfinished ...>
[pid 25400] 10:12:33.658409 <... close resumed> ) = 0
[pid 25399] 10:12:33.658506 <... close resumed> ) = 0
[pid 25400] 10:12:33.658529 munmap(0x7fe14f5db000, 4096 <unfinished ...>
[pid 25399] 10:12:33.658581 mprotect(0x7f54c6edc000, 4096, PROT_READ <unfinished ...>
[pid 25400] 10:12:33.658609 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.658625 <... mprotect resumed> ) = 0
[pid 25400] 10:12:33.658692 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25399] 10:12:33.658741 munmap(0x7f54cb335000, 39387 <unfinished ...>
[pid 25400] 10:12:33.658770 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.658787 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.658872 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe14e491790},  <unfinished ...>
[pid 25399] 10:12:33.658916 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25400] 10:12:33.658947 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:33.658963 <... open resumed> ) = 7
[pid 25400] 10:12:33.658988 fstat(2,  <unfinished ...>
[pid 25399] 10:12:33.659020 fcntl(7, F_GETFD <unfinished ...>
[pid 25400] 10:12:33.659044 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.659072 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25400] 10:12:33.659119 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fe14e491790},  <unfinished ...>
[pid 25399] 10:12:33.659155 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.659185 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:33.659201 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.659233 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0},  <unfinished ...>
[pid 25399] 10:12:33.659262 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.659289 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25399] 10:12:33.659307 <... mmap resumed> ) = 0x7f54cb355000
[pid 25400] 10:12:33.659330 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0},  <unfinished ...>
[pid 25399] 10:12:33.659364 read(7,  <unfinished ...>
[pid 25400] 10:12:33.659392 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25399] 10:12:33.659410 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.659501 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790},  <unfinished ...>
[pid 25399] 10:12:33.659551 close(7 <unfinished ...>
[pid 25400] 10:12:33.659577 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:33.659593 <... close resumed> ) = 0
[pid 25400] 10:12:33.659619 umask(0 <unfinished ...>
[pid 25399] 10:12:33.659646 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25400] 10:12:33.659673 <... umask resumed> ) = 022
[pid 25399] 10:12:33.659690 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.659741 geteuid( <unfinished ...>
[pid 25399] 10:12:33.659794 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25400] 10:12:33.659829 <... geteuid resumed> ) = 0
[pid 25399] 10:12:33.659846 <... socket resumed> ) = 7
[pid 25400] 10:12:33.659865 getuid( <unfinished ...>
[pid 25399] 10:12:33.659889 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25400] 10:12:33.659922 <... getuid resumed> ) = 503
[pid 25399] 10:12:33.659938 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.659958 getgid( <unfinished ...>
[pid 25399] 10:12:33.659983 close(7 <unfinished ...>
[pid 25400] 10:12:33.660010 <... getgid resumed> ) = 499
[pid 25399] 10:12:33.660026 <... close resumed> ) = 0
[pid 25400] 10:12:33.660058 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25399] 10:12:33.660086 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25400] 10:12:33.660112 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25399] 10:12:33.660130 <... socket resumed> ) = 7
[pid 25400] 10:12:33.660147 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25399] 10:12:33.660171 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25400] 10:12:33.660201 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25399] 10:12:33.660219 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.660238 getgroups(65536,  <unfinished ...>
[pid 25399] 10:12:33.660263 close(7 <unfinished ...>
[pid 25400] 10:12:33.660289 <... getgroups resumed> [500]) = 1
[pid 25399] 10:12:33.660306 <... close resumed> ) = 0
[pid 25400] 10:12:33.660329 setgroups(0, [] <unfinished ...>
[pid 25399] 10:12:33.660365 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25400] 10:12:33.660402 <... setgroups resumed> ) = 0
[pid 25399] 10:12:33.660493 <... open resumed> ) = 7
[pid 25400] 10:12:33.660519 getegid( <unfinished ...>
[pid 25399] 10:12:33.660546 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.660569 <... getegid resumed> ) = 499
[pid 25399] 10:12:33.660584 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.660621 geteuid( <unfinished ...>
[pid 25399] 10:12:33.660646 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.660673 <... geteuid resumed> ) = 0
[pid 25399] 10:12:33.660688 <... mmap resumed> ) = 0x7f54cb355000
[pid 25400] 10:12:33.660710 geteuid( <unfinished ...>
[pid 25399] 10:12:33.660736 read(7,  <unfinished ...>
[pid 25400] 10:12:33.660762 <... geteuid resumed> ) = 0
[pid 25399] 10:12:33.660778 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25400] 10:12:33.660799 getegid( <unfinished ...>
[pid 25399] 10:12:33.660837 close(7 <unfinished ...>
[pid 25400] 10:12:33.660862 <... getegid resumed> ) = 499
[pid 25399] 10:12:33.660878 <... close resumed> ) = 0
[pid 25400] 10:12:33.660897 setgid(499 <unfinished ...>
[pid 25399] 10:12:33.660923 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25400] 10:12:33.660950 <... setgid resumed> ) = 0
[pid 25399] 10:12:33.660966 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.660985 setuid(0 <unfinished ...>
[pid 25399] 10:12:33.661037 read(6,  <unfinished ...>
[pid 25400] 10:12:33.661063 <... setuid resumed> ) = 0
[pid 25399] 10:12:33.661078 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25400] 10:12:33.661130 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.661204 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25400] 10:12:33.661240 <... open resumed> ) = 6
[pid 25399] 10:12:33.661255 <... open resumed> ) = 7
[pid 25400] 10:12:33.661289 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.661318 fstat(7,  <unfinished ...>
[pid 25400] 10:12:33.661342 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.661371 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.661403 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.661516 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25400] 10:12:33.661545 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.661573 <... mmap resumed> ) = 0x7f54cb355000
[pid 25400] 10:12:33.661590 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.661618 read(7,  <unfinished ...>
[pid 25400] 10:12:33.661645 <... mmap resumed> ) = 0x7fe14f5db000
[pid 25399] 10:12:33.661661 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.661683 read(6,  <unfinished ...>
[pid 25399] 10:12:33.661714 close(7 <unfinished ...>
[pid 25400] 10:12:33.661745 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25400] 10:12:33.661869 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.661902 <... close resumed> ) = 0
[pid 25400] 10:12:33.661919 <... socket resumed> ) = 7
[pid 25399] 10:12:33.661936 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25400] 10:12:33.661965 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.661999 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.662014 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.662041 read(6,  <unfinished ...>
[pid 25400] 10:12:33.662068 close(7 <unfinished ...>
[pid 25399] 10:12:33.662095 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25400] 10:12:33.662115 <... close resumed> ) = 0
[pid 25399] 10:12:33.662150 uname( <unfinished ...>
[pid 25400] 10:12:33.662177 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.662203 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25400] 10:12:33.662223 <... socket resumed> ) = 7
[pid 25399] 10:12:33.662266 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25400] 10:12:33.662300 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.662343 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f54ca20c790}, 8) = 0
[pid 25400] 10:12:33.662365 close(7)    = 0
[pid 25399] 10:12:33.662507 clone( <unfinished ...>
[pid 25400] 10:12:33.662742 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25400] 10:12:33.662792 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.662816 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25401
[pid 25400] 10:12:33.662834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25400] 10:12:33.662895 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.662925 wait4(25401,  <unfinished ...>
[pid 25400] 10:12:33.662948 <... mmap resumed> ) = 0x7fe14f5da000
[pid 25400] 10:12:33.662966 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25400] 10:12:33.663021 read(7, "", 4096) = 0
[pid 25400] 10:12:33.663055 close(7)    = 0
[pid 25400] 10:12:33.663088 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.663135 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.663178 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.663219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.663264 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25400] 10:12:33.663307 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25400] 10:12:33.663354 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fe14f5ba000
[pid 25400] 10:12:33.663390 close(7)    = 0
[pid 25400] 10:12:33.663526 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25400] 10:12:33.663570 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25400] 10:12:33.663609 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25400] 10:12:33.663658 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fe14af55000
[pid 25400] 10:12:33.663699 mprotect(0x7fe14af61000, 2097152, PROT_NONE) = 0
[pid 25400] 10:12:33.663735 mmap(0x7fe14b161000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fe14b161000
[pid 25400] 10:12:33.663781 close(7)    = 0
[pid 25400] 10:12:33.663830 mprotect(0x7fe14b161000, 4096, PROT_READ) = 0
[pid 25400] 10:12:33.663879 munmap(0x7fe14f5ba000, 39387) = 0
[pid 25400] 10:12:33.663924 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25400] 10:12:33.663966 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25400] 10:12:33.664002 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.664046 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.664081 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.664137 close(7)    = 0
[pid 25400] 10:12:33.664171 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.664223 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25400] 10:12:33.664263 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.664306 close(7)    = 0
[pid 25400] 10:12:33.664341 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25400] 10:12:33.664385 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.664516 close(7)    = 0
[pid 25400] 10:12:33.664559 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25400] 10:12:33.664600 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.664645 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.664681 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25400] 10:12:33.664738 close(7)    = 0
[pid 25400] 10:12:33.664773 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.664825 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25400] 10:12:33.664898 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25400] 10:12:33.664941 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.664986 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.665021 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.665062 close(7)    = 0
[pid 25400] 10:12:33.665102 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.665145 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25400] 10:12:33.665205 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25400] 10:12:33.665262 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, 8) = 0
[pid 25400] 10:12:33.665312 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe14f5c4a90) = 25402
[pid 25400] 10:12:33.665663 wait4(25402, Process 25402 attached
 <unfinished ...>
[pid 25402] 10:12:33.665720 set_robust_list(0x7fe14f5c4aa0, 24) = 0
[pid 25402] 10:12:33.665780 geteuid()   = 0
[pid 25402] 10:12:33.665819 geteuid()   = 0
[pid 25402] 10:12:33.665850 getegid()   = 499
[pid 25402] 10:12:33.665882 setgid(12)  = 0
[pid 25402] 10:12:33.665913 setuid(47)  = 0
Process 25401 attached
[pid 25401] 10:12:33.666506 set_robust_list(0x7f54cb33faa0, 24) = 0
[pid 25401] 10:12:33.666563 geteuid()   = 0
[pid 25401] 10:12:33.667486 geteuid()   = 0
[pid 25401] 10:12:33.667521 getegid()   = 12
[pid 25401] 10:12:33.667554 setgid(12)  = 0
[pid 25401] 10:12:33.667586 setuid(47)  = 0
[pid 25401] 10:12:33.669198 brk(0x14de000 <unfinished ...>
[pid 25402] 10:12:33.669529 brk(0x2280000) = 0x2280000
[pid 25402] 10:12:33.669967 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25402] 10:12:33.670025 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25402] 10:12:33.670079 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25402] 10:12:33.670121 read(7, "*K\360J\214\327\177_I8\312\r\211jYpaL\350\21\217`\222a\264\25\v_&\377\316j#r;W\204p\230\33\303\30\241au\374\347\245", 48) = 48
[pid 25402] 10:12:33.670163 close(7)    = 0
[pid 25402] 10:12:33.670212 getuid( <unfinished ...>
[pid 25401] 10:12:33.670233 <... brk resumed> ) = 0x14de000
[pid 25402] 10:12:33.670251 <... getuid resumed> ) = 47
[pid 25401] 10:12:33.670739 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25402] 10:12:33.670831 exit_group(0) = ?
[pid 25402] 10:12:33.671020 +++ exited with 0 +++
[pid 25400] 10:12:33.671055 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25402
[pid 25400] 10:12:33.671079 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, 8) = 0
[pid 25400] 10:12:33.671143 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25400] 10:12:33.671214 open("/etc/localtime", O_RDONLY) = 7
[pid 25400] 10:12:33.671254 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.671300 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.671343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.671380 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25400] 10:12:33.671495 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25400] 10:12:33.671531 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25400] 10:12:33.671580 close(7)    = 0
[pid 25400] 10:12:33.671613 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.671694 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25400] 10:12:33.671763 fcntl(7, F_GETFD) = 0
[pid 25400] 10:12:33.671797 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25400] 10:12:33.671828 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5361766, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.671874 write(7, "2015-12-30 10:12:33 [25400] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25400] 10:12:33.671918 chdir("/var/spool/exim") = 0
[pid 25400] 10:12:33.671959 geteuid()   = 0
[pid 25400] 10:12:33.671991 getegid()   = 499
[pid 25400] 10:12:33.672031 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.672071 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.672114 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.672154 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.672199 close(8)    = 0
[pid 25400] 10:12:33.672238 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.672278 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25400] 10:12:33.672319 read(8, "65536\n", 31) = 6
[pid 25400] 10:12:33.672354 close(8)    = 0
[pid 25400] 10:12:33.672391 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.672517 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.672563 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.672598 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.672631 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25400] 10:12:33.672681 read(8, "", 4096) = 0
[pid 25400] 10:12:33.672715 close(8)    = 0
[pid 25400] 10:12:33.672747 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.672783 setgroups(1, [12]) = 0
[pid 25400] 10:12:33.672818 setgid(12)  = 0
[pid 25400] 10:12:33.672857 setuid(47)  = 0
[pid 25400] 10:12:33.672916 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25400] 10:12:33.672998 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25400] 10:12:33.673080 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25400] 10:12:33.673153 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25400] 10:12:33.673228 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25400] 10:12:33.673318 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25400] 10:12:33.673517 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25400] 10:12:33.673592 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.673640 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.673686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.673720 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.673765 close(8)    = 0
[pid 25400] 10:12:33.673798 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.673893 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25400] 10:12:33.673987 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25400] 10:12:33.674112 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25400] 10:12:33.674233 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25400] 10:12:33.674345 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25400] 10:12:33.674403 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.674521 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.674569 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.674605 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.674660 close(8)    = 0
[pid 25400] 10:12:33.674694 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.674739 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.674778 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.674820 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.674854 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25400] 10:12:33.674905 close(8)    = 0
[pid 25400] 10:12:33.674938 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.674995 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25400] 10:12:33.675035 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25400] 10:12:33.675078 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.675111 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25400] 10:12:33.675156 close(8)    = 0
[pid 25400] 10:12:33.675187 munmap(0x7fe14f5da000, 4096) = 0
[pid 25400] 10:12:33.675294 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25400] 10:12:33.675499 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25400] 10:12:33.675611 read(6, "", 4096) = 0
[pid 25400] 10:12:33.675657 read(6, "", 4096) = 0
[pid 25400] 10:12:33.675692 close(6)    = 0
[pid 25400] 10:12:33.675724 munmap(0x7fe14f5db000, 4096) = 0
[pid 25400] 10:12:33.675763 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25400] 10:12:33.675802 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.675846 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5db000
[pid 25400] 10:12:33.675887 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.675937 close(6)    = 0
[pid 25400] 10:12:33.675969 munmap(0x7fe14f5db000, 4096) = 0
[pid 25400] 10:12:33.676017 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.676076 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.676134 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25400] 10:12:33.676175 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25400] 10:12:33.676213 fstat(0, {st_dev=makedev(0, 8), st_ino=2130165423, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.676257 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5db000
[pid 25400] 10:12:33.676290 read(0, "To:  kay.olesen2@hilton.com, embassyphxnorth@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\""..., 4096) = 2089
[pid 25400] 10:12:33.676393 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.676536 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25400] 10:12:33.676619 fchown(6, 47, 12) = 0
[pid 25400] 10:12:33.676659 fchmod(6, 0640) = 0
[pid 25400] 10:12:33.676695 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25400] 10:12:33.676728 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.676780 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5da000
[pid 25400] 10:12:33.676814 lseek(6, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.676845 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25400] 10:12:33.676935 read(0, "", 4096) = 0
[pid 25400] 10:12:33.676970 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.677006 write(6, "1aEJMX-0006bg-Lo-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25400] 10:12:33.677052 fsync(6 <unfinished ...>
[pid 25401] 10:12:33.677194 <... open resumed> ) = 7
[pid 25401] 10:12:33.677286 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25401] 10:12:33.677341 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25401] 10:12:33.677386 read(7, "\"A\310k\337)3\231\236\2214\305_\370x\346\221Z\17\366\266\237\227\34\240\320\v\232[\0360\345n3\203\246\3667\27\2518\377H)+1\210:", 48) = 48
[pid 25400] 10:12:33.677473 <... fsync resumed> ) = 0
[pid 25400] 10:12:33.677512 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.677600 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.677760 brk(0x2280000) = 0x2280000
[pid 25400] 10:12:33.677831 getuid()    = 47
[pid 25400] 10:12:33.677867 geteuid()   = 47
[pid 25400] 10:12:33.677899 getgid()    = 12
[pid 25400] 10:12:33.677932 getegid()   = 12
[pid 25400] 10:12:33.678035 open("/dev/urandom", O_RDONLY) = 8
[pid 25400] 10:12:33.678078 read(8, "+\320\245p", 4) = 4
[pid 25400] 10:12:33.678114 close(8)    = 0
[pid 25400] 10:12:33.678240 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25400] 10:12:33.678365 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dcb20) = -1 EINVAL (Invalid argument)
[pid 25400] 10:12:33.678471 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25400] 10:12:33.678517 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dcb20) = -1 EINVAL (Invalid argument)
[pid 25400] 10:12:33.678552 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25400] 10:12:33.678584 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dcb30) = -1 EINVAL (Invalid argument)
[pid 25400] 10:12:33.678617 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25400] 10:12:33.678659 open("/dev/null", O_RDONLY) = 8
[pid 25400] 10:12:33.678701 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dcc00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.678734 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.678767 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25400] 10:12:33.678800 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe14e491790}, 8) = 0
[pid 25400] 10:12:33.678839 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe14e491790}, 8) = 0
[pid 25400] 10:12:33.679140 read(8, "", 8192) = 0
[pid 25400] 10:12:33.679186 close(8)    = 0
[pid 25400] 10:12:33.679483 brk(0x22a1000) = 0x22a1000
[pid 25400] 10:12:33.679645 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.679704 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25400] 10:12:33.679744 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dca30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.679779 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.679837 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25400] 10:12:33.680894 brk(0x22c2000) = 0x22c2000
[pid 25400] 10:12:33.681128 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25400] 10:12:33.682092 brk(0x22e3000) = 0x22e3000
[pid 25400] 10:12:33.682476 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25400] 10:12:33.683337 brk(0x2304000 <unfinished ...>
[pid 25401] 10:12:33.683374 close(7)    = 0
[pid 25400] 10:12:33.683469 <... brk resumed> ) = 0x2304000
[pid 25400] 10:12:33.683724 read(8,  <unfinished ...>
[pid 25401] 10:12:33.683771 getuid()    = 47
[pid 25401] 10:12:33.683970 exit_group(0) = ?
[pid 25401] 10:12:33.684226 +++ exited with 0 +++
[pid 25399] 10:12:33.684255 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25401
[pid 25399] 10:12:33.684280 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:33.684347 getcwd("/var/spool/exim", 16380) = 16
[pid 25399] 10:12:33.684476 open("/etc/localtime", O_RDONLY) = 7
[pid 25399] 10:12:33.684519 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:33.684573 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:33.684616 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.684653 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25399] 10:12:33.684706 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25399] 10:12:33.684739 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25399] 10:12:33.684787 close(7)    = 0
[pid 25399] 10:12:33.684820 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:33.684874 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:33.684922 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:33.684953 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.684983 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5361867, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.685030 write(7, "2015-12-30 10:12:33 [25399] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMX-0006bd-HC\n", 92) = 92
[pid 25399] 10:12:33.685072 chdir("/var/spool/exim") = 0
[pid 25399] 10:12:33.685114 setgid(12)  = 0
[pid 25399] 10:12:33.685182 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25399] 10:12:33.685265 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25399] 10:12:33.685346 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25399] 10:12:33.685530 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25399] 10:12:33.685612 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25399] 10:12:33.685706 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25399] 10:12:33.685824 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25399] 10:12:33.685897 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25399] 10:12:33.685939 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.685984 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.686020 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.686066 close(8)    = 0
[pid 25399] 10:12:33.686099 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:33.686195 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25399] 10:12:33.686290 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25399] 10:12:33.686408 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25399] 10:12:33.686608 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25399] 10:12:33.686722 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25399] 10:12:33.686774 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25399] 10:12:33.686813 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.686859 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.686894 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.686943 close(8)    = 0
[pid 25399] 10:12:33.686976 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:33.687031 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25399] 10:12:33.687070 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.687120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.687155 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.687203 close(8)    = 0
[pid 25399] 10:12:33.687235 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:33.687294 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25399] 10:12:33.687333 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.687378 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.687411 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.687540 close(8)    = 0
[pid 25399] 10:12:33.687572 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:33.687685 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25399] 10:12:33.687812 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25399] 10:12:33.687911 read(6, "", 4096) = 0
[pid 25399] 10:12:33.687948 read(6, "", 4096) = 0
[pid 25399] 10:12:33.687981 close(6)    = 0
[pid 25399] 10:12:33.688014 munmap(0x7f54cb356000, 4096) = 0
[pid 25399] 10:12:33.688065 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f54ca20c790}, NULL, 8) = 0
[pid 25399] 10:12:33.688114 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-D", O_RDWR|O_APPEND) = 6
[pid 25399] 10:12:33.688160 fcntl(6, F_GETFD) = 0
[pid 25399] 10:12:33.688191 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.688223 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25399] 10:12:33.688263 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.688321 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-H", O_RDONLY) = 8
[pid 25399] 10:12:33.688365 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=937, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.688408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb356000
[pid 25399] 10:12:33.688513 read(8, "1aEJMX-0006bd-HC-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 937
[pid 25399] 10:12:33.688595 read(8, "", 4096) = 0
[pid 25399] 10:12:33.688631 close(8)    = 0
[pid 25399] 10:12:33.688664 munmap(0x7f54cb356000, 4096) = 0
[pid 25399] 10:12:33.688707 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.688759 open("/var/spool/exim/msglog/X/1aEJMX-0006bd-HC", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25399] 10:12:33.688804 fcntl(8, F_GETFD) = 0
[pid 25399] 10:12:33.688835 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.688869 fchown(8, 47, 12) = 0
[pid 25399] 10:12:33.688908 fchmod(8, 0640) = 0
[pid 25399] 10:12:33.688945 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25399] 10:12:33.688979 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.689023 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb356000
[pid 25399] 10:12:33.689057 lseek(8, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.689095 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.689147 pipe([9, 10]) = 0
[pid 25399] 10:12:33.689191 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [], SA_RESTORER, 0x7f54ca20c790}, 8) = 0
[pid 25399] 10:12:33.689232 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25403
[pid 25399] 10:12:33.689519 close(10)   = 0
[pid 25399] 10:12:33.689557 read(9,  <unfinished ...>
[pid 25400] 10:12:33.689578 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25400] 10:12:33.689895 read(8, "", 8192) = 0
[pid 25400] 10:12:33.689940 close(8)    = 0
[pid 25400] 10:12:33.689993 stat("/usr/share/amavis/amavis-filter", 0x7fe14dc78880) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.690040 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.690091 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.690138 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25400] 10:12:33.690184 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dca30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.690220 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.690270 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25400] 10:12:33.690793 stat("/etc/exim/perl/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.690846 stat("/etc/exim/perl/warnings.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.690887 stat("/usr/local/cpanel/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.690925 stat("/usr/local/cpanel/warnings.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.690962 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691012 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691053 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691131 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691170 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691210 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.691248 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.691300 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25400] 10:12:33.691344 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dc440) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.691385 lseek(9, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.691502 brk(0x2325000) = 0x2325000
[pid 25400] 10:12:33.691553 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25400] 10:12:33.691875 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25400] 10:12:33.692675 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25400] 10:12:33.692804 brk(0x2346000) = 0x2346000
[pid 25400] 10:12:33.693144 read(9, "", 8192) = 0
[pid 25400] 10:12:33.693190 close(9)    = 0
[pid 25400] 10:12:33.693945 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25400] 10:12:33.694755 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25400] 10:12:33.695507 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25400] 10:12:33.696102 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25400] 10:12:33.696308 brk(0x2367000) = 0x2367000
[pid 25400] 10:12:33.696822 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25400] 10:12:33.697656 brk(0x2388000) = 0x2388000
[pid 25400] 10:12:33.697835 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25400] 10:12:33.698361 read(8, Process 25403 attached
 <unfinished ...>
[pid 25403] 10:12:33.698488 set_robust_list(0x7f54cb33faa0, 24) = 0
[pid 25403] 10:12:33.698584 close(9)    = 0
[pid 25403] 10:12:33.698626 geteuid()   = 0
[pid 25403] 10:12:33.698658 getegid()   = 12
[pid 25403] 10:12:33.698691 setgid(494) = 0
[pid 25403] 10:12:33.698722 setuid(495) = 0
[pid 25403] 10:12:33.698782 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25403] 10:12:33.698833 fstat(9,  <unfinished ...>
[pid 25400] 10:12:33.698855 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25403] 10:12:33.698878 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25400] 10:12:33.699372 brk(0x23a9000 <unfinished ...>
[pid 25403] 10:12:33.699500 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25403] 10:12:33.699570 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25403] 10:12:33.699609 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25403] 10:12:33.699653 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25403] 10:12:33.699695 close(9)    = 0
[pid 25403] 10:12:33.699729 munmap(0x7f54cb355000, 4096) = 0
[pid 25403] 10:12:33.699810 brk(0x14df000) = 0x14df000
[pid 25403] 10:12:33.699998 lseek(6, 19, SEEK_SET) = 19
[pid 25403] 10:12:33.700041 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2350) = 1858
[pid 25403] 10:12:33.700295 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25400] 10:12:33.700321 <... brk resumed> ) = 0x23a9000
[pid 25399] 10:12:33.700507 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25399] 10:12:33.700538 read(9,  <unfinished ...>
[pid 25403] 10:12:33.700559 <... write resumed> ) = 4
[pid 25403] 10:12:33.700577 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.700599 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25399] 10:12:33.700624 read(9,  <unfinished ...>
[pid 25403] 10:12:33.700644 <... write resumed> ) = 4
[pid 25403] 10:12:33.700661 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.700682 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.700701 read(9,  <unfinished ...>
[pid 25403] 10:12:33.700723 <... write resumed> ) = 4
[pid 25403] 10:12:33.700746 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25399] 10:12:33.700771 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25399] 10:12:33.700790 read(9,  <unfinished ...>
[pid 25403] 10:12:33.700809 <... write resumed> ) = 4
[pid 25400] 10:12:33.700896 read(8,  <unfinished ...>
[pid 25403] 10:12:33.700920 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.700944 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.700963 read(9,  <unfinished ...>
[pid 25403] 10:12:33.700982 <... write resumed> ) = 4
[pid 25403] 10:12:33.700999 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25399] 10:12:33.701024 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25399] 10:12:33.701045 read(9,  <unfinished ...>
[pid 25403] 10:12:33.701064 <... write resumed> ) = 40
[pid 25403] 10:12:33.701081 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.701103 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.701125 wait4(-1,  <unfinished ...>
[pid 25403] 10:12:33.701144 <... write resumed> ) = 4
[pid 25403] 10:12:33.701161 close(10)   = 0
[pid 25403] 10:12:33.701202 exit_group(0) = ?
[pid 25403] 10:12:33.701400 +++ exited with 0 +++
[pid 25399] 10:12:33.701493 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25403
[pid 25399] 10:12:33.701519 close(9)    = 0
[pid 25399] 10:12:33.701554 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:33.701613 brk(0x14de000) = 0x14de000
[pid 25399] 10:12:33.701657 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25399] 10:12:33.701707 alarm(60)   = 0
[pid 25399] 10:12:33.701741 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25399] 10:12:33.701777 alarm(0)    = 60
[pid 25399] 10:12:33.701858 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.701906 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25399] 10:12:33.701950 read(10, "cpu  123036 1342351 395047 67343094 2509 0 0 0\ncpu0 123036 1342351 395047 67343094 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58172939\nbtime 1450798266\nprocesses 892881\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25399] 10:12:33.702008 close(10)   = 0
[pid 25399] 10:12:33.702098 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:33.702159 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25399] 10:12:33.702199 fcntl(10, F_GETFD) = 0
[pid 25399] 10:12:33.702230 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.702266 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25399] 10:12:33.702319 close(10)   = 0
[pid 25399] 10:12:33.702370 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.702485 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25399] 10:12:33.702600 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb30e000
[pid 25399] 10:12:33.702743 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25399] 10:12:33.702786 fcntl(10, F_GETFD) = 0
[pid 25399] 10:12:33.702817 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.702851 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:33.702928 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25399] 10:12:33.703015 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25399] 10:12:33.703075 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25399] 10:12:33.703140 close(10)   = 0
[pid 25399] 10:12:33.703199 munmap(0x7f54cb30e000, 200704) = 0
[pid 25399] 10:12:33.703266 close(9)    = 0
[pid 25399] 10:12:33.703321 open("/etc/localdomains", O_RDONLY) = 9
[pid 25399] 10:12:33.703373 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.703515 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.703564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.703600 lseek(9, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.703632 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25399] 10:12:33.703697 stat("/jail_owner", 0x7ffed9b0c3b0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.703749 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25399] 10:12:33.703821 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.703869 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25399] 10:12:33.703923 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.703965 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.704029 open("/etc/demouids", O_RDONLY) = 10
[pid 25399] 10:12:33.704069 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.704115 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.704158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb354000
[pid 25399] 10:12:33.704192 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.704224 read(10, "", 4096) = 0
[pid 25399] 10:12:33.704262 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:33.704501 getuid()    = 0
[pid 25399] 10:12:33.704544 geteuid()   = 0
[pid 25399] 10:12:33.704578 getgid()    = 12
[pid 25399] 10:12:33.704610 getegid()   = 12
[pid 25399] 10:12:33.704714 open("/dev/urandom", O_RDONLY) = 11
[pid 25399] 10:12:33.704760 read(11, "\271\202\234\355", 4) = 4
[pid 25399] 10:12:33.704796 close(11)   = 0
[pid 25399] 10:12:33.704912 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25399] 10:12:33.705019 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.705062 lseek(0, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.705097 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.705131 lseek(1, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.705163 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06950) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.705196 lseek(2, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.705229 open("/dev/null", O_RDONLY) = 11
[pid 25399] 10:12:33.705269 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.705302 lseek(11, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.705334 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.705368 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:33.705698 brk(0x14ff000) = 0x14ff000
[pid 25399] 10:12:33.705751 read(11, "", 8192) = 0
[pid 25399] 10:12:33.705790 close(11)   = 0
[pid 25399] 10:12:33.706086 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.706154 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25399] 10:12:33.706195 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06850) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.706231 lseek(11, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.706282 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25399] 10:12:33.707176 brk(0x1520000) = 0x1520000
[pid 25399] 10:12:33.707621 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25399] 10:12:33.708470 brk(0x1541000) = 0x1541000
[pid 25399] 10:12:33.708933 read(11, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25399] 10:12:33.709654 brk(0x1562000) = 0x1562000
[pid 25399] 10:12:33.710128 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25399] 10:12:33.710518 read(11, "", 8192) = 0
[pid 25399] 10:12:33.710568 close(11)   = 0
[pid 25399] 10:12:33.710621 stat("/usr/share/amavis/amavis-filter", 0x7f54c99f3880) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.710668 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.710719 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.710767 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25399] 10:12:33.710807 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06850) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.710842 lseek(11, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.710891 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25399] 10:12:33.711186 brk(0x1583000) = 0x1583000
[pid 25399] 10:12:33.711401 stat("/etc/exim/perl/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711524 stat("/etc/exim/perl/warnings.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711566 stat("/usr/local/cpanel/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711604 stat("/usr/local/cpanel/warnings.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711642 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711692 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711733 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711772 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711851 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711891 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.711929 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.711982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25399] 10:12:33.712025 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.712060 lseek(12, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.712114 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25400] 10:12:33.712492 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25400] 10:12:33.713166 read(8,  <unfinished ...>
[pid 25399] 10:12:33.713234 read(12, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25399] 10:12:33.713923 brk(0x15a4000 <unfinished ...>
[pid 25400] 10:12:33.713959 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25399] 10:12:33.714477 <... brk resumed> ) = 0x15a4000
[pid 25399] 10:12:33.714702 read(12, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25399] 10:12:33.715110 read(12,  <unfinished ...>
[pid 25400] 10:12:33.715140 brk(0x23ca000) = 0x23ca000
[pid 25400] 10:12:33.715559 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25399] 10:12:33.715594 <... read resumed> "", 8192) = 0
[pid 25399] 10:12:33.715618 close(12)   = 0
[pid 25399] 10:12:33.716299 read(11,  <unfinished ...>
[pid 25400] 10:12:33.716337 <... stat resumed> 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716360 stat("/usr/local/cpanel/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716410 stat("/etc/exim/perl/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716506 stat("/etc/exim/perl/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716545 stat("/usr/local/cpanel/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716581 stat("/usr/local/cpanel/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716618 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716658 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716697 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716735 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716774 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716851 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.716889 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.716941 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25400] 10:12:33.716983 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dc440) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.717018 lseek(9, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.717070 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25400] 10:12:33.717292 lseek(9, 878, SEEK_SET) = 878
[pid 25400] 10:12:33.717333 lseek(9, 0, SEEK_CUR) = 878
[pid 25400] 10:12:33.717366 close(9)    = 0
[pid 25400] 10:12:33.717684 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25400] 10:12:33.718252 read(8,  <unfinished ...>
[pid 25399] 10:12:33.718286 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25399] 10:12:33.719096 read(11,  <unfinished ...>
[pid 25400] 10:12:33.719134 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25400] 10:12:33.719280 brk(0x23eb000) = 0x23eb000
[pid 25400] 10:12:33.720391 read(8,  <unfinished ...>
[pid 25399] 10:12:33.720442 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25399] 10:12:33.721148 read(11, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25400] 10:12:33.721485 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25400] 10:12:33.721725 brk(0x240c000 <unfinished ...>
[pid 25399] 10:12:33.722067 brk(0x15c5000 <unfinished ...>
[pid 25400] 10:12:33.722098 <... brk resumed> ) = 0x240c000
[pid 25399] 10:12:33.722482 <... brk resumed> ) = 0x15c5000
[pid 25399] 10:12:33.722589 read(11, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25399] 10:12:33.723199 read(11,  <unfinished ...>
[pid 25400] 10:12:33.724118 read(8,  <unfinished ...>
[pid 25399] 10:12:33.724153 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25399] 10:12:33.724725 brk(0x15e6000 <unfinished ...>
[pid 25400] 10:12:33.724761 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25400] 10:12:33.724879 brk(0x242d000) = 0x242d000
[pid 25399] 10:12:33.725379 <... brk resumed> ) = 0x15e6000
[pid 25399] 10:12:33.725903 read(11,  <unfinished ...>
[pid 25400] 10:12:33.726266 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25399] 10:12:33.726314 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25399] 10:12:33.726940 read(11,  <unfinished ...>
[pid 25400] 10:12:33.726977 <... stat resumed> 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727000 stat("/usr/local/cpanel/Errno.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727042 stat("/etc/exim/perl/Errno.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727078 stat("/etc/exim/perl/Errno.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727113 stat("/usr/local/cpanel/Errno.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727148 stat("/usr/local/cpanel/Errno.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727185 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727225 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727271 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727310 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727352 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.727391 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.727515 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25400] 10:12:33.727572 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dc440) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.727610 lseek(9, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.727664 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25400] 10:12:33.727873 brk(0x244e000 <unfinished ...>
[pid 25399] 10:12:33.727902 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25399] 10:12:33.728270 brk(0x1607000 <unfinished ...>
[pid 25400] 10:12:33.728302 <... brk resumed> ) = 0x244e000
[pid 25400] 10:12:33.728796 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25399] 10:12:33.728830 <... brk resumed> ) = 0x1607000
[pid 25399] 10:12:33.729131 read(11,  <unfinished ...>
[pid 25400] 10:12:33.729161 <... lseek resumed> ) = 4868
[pid 25400] 10:12:33.729181 lseek(9, 0, SEEK_CUR) = 4868
[pid 25400] 10:12:33.729213 close(9)    = 0
[pid 25400] 10:12:33.729260 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729303 stat("/usr/local/cpanel/Exporter.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729344 stat("/etc/exim/perl/Exporter.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729385 stat("/etc/exim/perl/Exporter.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729488 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729534 stat("/usr/local/cpanel/Exporter.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729572 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729611 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff067dc650) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729651 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fff067dc6f0) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.729688 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25400] 10:12:33.729742 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25400] 10:12:33.729790 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff067dc440) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25400] 10:12:33.729825 lseek(9, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.729870 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25400] 10:12:33.730304 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25399] 10:12:33.730337 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25399] 10:12:33.731057 read(11,  <unfinished ...>
[pid 25400] 10:12:33.731090 <... lseek resumed> ) = 2366
[pid 25400] 10:12:33.731111 lseek(9, 0, SEEK_CUR) = 2366
[pid 25400] 10:12:33.731144 close(9)    = 0
[pid 25400] 10:12:33.731551 read(8,  <unfinished ...>
[pid 25399] 10:12:33.731586 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25399] 10:12:33.731835 brk(0x1628000 <unfinished ...>
[pid 25400] 10:12:33.731865 <... read resumed> "", 8192) = 0
[pid 25400] 10:12:33.731888 close(8)    = 0
[pid 25400] 10:12:33.732112 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.732144 <... brk resumed> ) = 0x1628000
[pid 25400] 10:12:33.732497 <... open resumed> ) = 8
[pid 25400] 10:12:33.732528 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25400] 10:12:33.732578 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5d9000
[pid 25400] 10:12:33.732615 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25400] 10:12:33.732662 close(8)    = 0
[pid 25400] 10:12:33.732696 munmap(0x7fe14f5d9000, 4096) = 0
[pid 25400] 10:12:33.732842 lseek(6, 19, SEEK_SET) = 19
[pid 25400] 10:12:33.732881 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.732919 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.732953 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.732986 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733018 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733054 alarm(300)  = 0
[pid 25400] 10:12:33.733086 alarm(0)    = 300
[pid 25400] 10:12:33.733116 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733149 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733182 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733214 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733246 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fe14e491790}, NULL, 8) = 0
[pid 25400] 10:12:33.733281 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, 8) = 0
[pid 25400] 10:12:33.733325 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, 8) = 0
[pid 25400] 10:12:33.733374 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.733517 open("/var/spool/exim/input/X/hdr.25400", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25400] 10:12:33.733593 fchown(8, 47, 12) = 0
[pid 25400] 10:12:33.733630 fchmod(8, 0640) = 0
[pid 25399] 10:12:33.733978 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25400] 10:12:33.734009 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25400] 10:12:33.734048 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.734094 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5d9000
[pid 25400] 10:12:33.734129 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.734177 write(8, "1aEJMX-0006bg-Lo-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 426) = 426
[pid 25400] 10:12:33.734223 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=426, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.734271 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bg-Lo; Wed, 30 Dec 2015 10:12:33 -0600\n068T To:  kay.olesen2@hilton.com, embassyphxnorth@finestweddingsi"..., 551) = 551
[pid 25400] 10:12:33.734308 fsync(8 <unfinished ...>
[pid 25399] 10:12:33.734371 <... stat resumed> 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734396 stat("/usr/local/cpanel/strict.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734577 stat("/etc/exim/perl/strict.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734616 stat("/etc/exim/perl/strict.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734652 stat("/usr/local/cpanel/strict.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734688 stat("/usr/local/cpanel/strict.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.734726 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25400] 10:12:33.734748 <... fsync resumed> ) = 0
[pid 25400] 10:12:33.734766 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=977, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.734810 close(8)    = 0
[pid 25400] 10:12:33.734842 munmap(0x7fe14f5d9000, 4096) = 0
[pid 25400] 10:12:33.734883 rename("/var/spool/exim/input/X/hdr.25400", "/var/spool/exim/input/X/1aEJMX-0006bg-Lo-H") = 0
[pid 25400] 10:12:33.734945 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25400] 10:12:33.734984 fsync(8)    = 0
[pid 25400] 10:12:33.735016 close(8)    = 0
[pid 25400] 10:12:33.735049 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.735110 open("/var/spool/exim/msglog/X/1aEJMX-0006bg-Lo", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25400] 10:12:33.735177 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25400] 10:12:33.735211 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064856, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.735255 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe14f5d9000
[pid 25400] 10:12:33.735290 lseek(8, 0, SEEK_CUR) = 0
[pid 25400] 10:12:33.735323 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.735384 write(8, "2015-12-30 10:12:33 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2370 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25400] 10:12:33.735516 close(8)    = 0
[pid 25400] 10:12:33.735552 munmap(0x7fe14f5d9000, 4096) = 0
[pid 25400] 10:12:33.735590 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.735647 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25400] 10:12:33.735694 close(7)    = 0
[pid 25400] 10:12:33.735729 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25400] 10:12:33.735770 fcntl(7, F_GETFD) = 0
[pid 25400] 10:12:33.735800 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25400] 10:12:33.735830 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5361959, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25400] 10:12:33.735873 write(7, "2015-12-30 10:12:33 [25400] 1aEJMX-0006bg-Lo <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2370 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for kay.olesen2@hilton.com embassyphxnorth@finestwe"..., 305) = 305
[pid 25400] 10:12:33.735914 close(6)    = 0
[pid 25400] 10:12:33.735947 munmap(0x7fe14f5da000, 4096 <unfinished ...>
[pid 25399] 10:12:33.735972 <... stat resumed> 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.735994 <... munmap resumed> ) = 0
[pid 25400] 10:12:33.736012 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0},  <unfinished ...>
[pid 25399] 10:12:33.736036 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25400] 10:12:33.736056 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, 8) = 0
[pid 25399] 10:12:33.736082 <... stat resumed> 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.736101 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fe14d1da6a0}, 8) = 0
[pid 25400] 10:12:33.736137 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.736161 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25400] 10:12:33.736192 <... open resumed> ) = 6
[pid 25399] 10:12:33.736215 <... stat resumed> 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.736234 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25400] 10:12:33.736261 read(6,  <unfinished ...>
[pid 25399] 10:12:33.736285 <... stat resumed> 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.736324 <... read resumed> "0.02 0.05 0.00 2/241 25403\n", 40) = 27
[pid 25399] 10:12:33.736360 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.736408 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25400] 10:12:33.736535 close(6)    = 0
[pid 25399] 10:12:33.736574 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25400] 10:12:33.736610 clone( <unfinished ...>
[pid 25399] 10:12:33.736633 <... stat resumed> 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.736652 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25400] 10:12:33.736957 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe14f5c4a90) = 25404
[pid 25399] 10:12:33.736984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25399] 10:12:33.737027 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.737063 lseek(12, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.737115 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25399] 10:12:33.737340 lseek(12, 878, SEEK_SET) = 878
[pid 25399] 10:12:33.737383 lseek(12, 0, SEEK_CUR) = 878
[pid 25399] 10:12:33.737426 close(12)   = 0
[pid 25399] 10:12:33.737735 read(11,  <unfinished ...>
[pid 25400] 10:12:33.738021 exit_group(0) = ?
[pid 25399] 10:12:33.738048 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25400] 10:12:33.738709 +++ exited with 0 +++
[pid 25389] 10:12:33.738752 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25400
[pid 25389] 10:12:33.738779 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:33.738902 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:33.738947 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25405
[pid 25389] 10:12:33.739357 close(5)    = 0
[pid 25389] 10:12:33.739393 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:33.739481 fstat(6, {st_dev=makedev(0, 8), st_ino=2130165679, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25389] 10:12:33.739531 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:33.739575 write(6, "To:  salesadmin@phoenixmarriottmesa.com, rivankovich@phoenixmarriottmesa.com, phoenixmarriottmesa@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\n"..., 2142) = 2142
[pid 25389] 10:12:33.739616 close(6)    = 0
[pid 25389] 10:12:33.739647 wait4(25405,  <unfinished ...>
[pid 25399] 10:12:33.739856 brk(0x1649000) = 0x1649000
[pid 25399] 10:12:33.740002 read(11, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25399] 10:12:33.741122 brk(0x166a000) = 0x166a000
[pid 25399] 10:12:33.741274 read(11, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25399] 10:12:33.742427 brk(0x168b000) = 0x168b000
[pid 25399] 10:12:33.742696 read(11, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25399] 10:12:33.743613 stat("/usr/local/cpanel/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743680 stat("/usr/local/cpanel/Errno.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743727 stat("/etc/exim/perl/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743763 stat("/etc/exim/perl/Errno.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743800 stat("/usr/local/cpanel/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743835 stat("/usr/local/cpanel/Errno.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743871 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743912 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743952 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.743991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.744030 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.744069 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25399] 10:12:33.744121 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25399] 10:12:33.744164 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.744200 lseek(12, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.744253 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25399] 10:12:33.744371 brk(0x16ac000) = 0x16ac000
[pid 25399] 10:12:33.744980 lseek(12, 4868, SEEK_SET) = 4868
[pid 25399] 10:12:33.745027 lseek(12, 0, SEEK_CUR) = 4868
[pid 25399] 10:12:33.745060 close(12)   = 0
[pid 25399] 10:12:33.745106 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745149 stat("/usr/local/cpanel/Exporter.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745195 stat("/etc/exim/perl/Exporter.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745231 stat("/etc/exim/perl/Exporter.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745267 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745303 stat("/usr/local/cpanel/Exporter.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745340 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745383 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffed9b06470) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745483 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffed9b06510) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.745527 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25399] 10:12:33.745581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25399] 10:12:33.745632 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b06260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.745675 lseek(12, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.745727 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25399] 10:12:33.746164 lseek(12, 2366, SEEK_SET) = 2366
[pid 25399] 10:12:33.746208 lseek(12, 0, SEEK_CUR) = 2366
[pid 25399] 10:12:33.746240 close(12)   = 0
Process 25405 attached
[pid 25405] 10:12:33.746655 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25405] 10:12:33.746716 close(6)    = 0
[pid 25405] 10:12:33.746751 dup2(5, 0 <unfinished ...>
[pid 25399] 10:12:33.746817 read(11,  <unfinished ...>
[pid 25405] 10:12:33.746842 <... dup2 resumed> ) = 0
[pid 25405] 10:12:33.746860 close(5)    = 0
[pid 25405] 10:12:33.746896 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25399] 10:12:33.747373 <... read resumed> "", 8192) = 0
[pid 25399] 10:12:33.747399 close(11)   = 0
[pid 25399] 10:12:33.747697 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.747769 open("/etc/userdomains", O_RDONLY) = 11
[pid 25399] 10:12:33.747809 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.747858 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.747900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb353000
[pid 25399] 10:12:33.747936 lseek(11, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.747969 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:33.748037 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25399] 10:12:33.748083 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.748127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb352000
[pid 25399] 10:12:33.748161 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.748212 close(12)   = 0
[pid 25399] 10:12:33.748245 munmap(0x7f54cb352000, 4096) = 0
[pid 25399] 10:12:33.748301 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.748342 brk(0)      = 0xa4f000
[pid 25399] 10:12:33.748382 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.748497 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25405] 10:12:33.748540 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.748567 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.748607 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.748631 <... mmap resumed> ) = 0x7fbcbb59f000
[pid 25405] 10:12:33.748659 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25399] 10:12:33.748688 <... open resumed> ) = 12
[pid 25405] 10:12:33.748709 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.748734 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.748787 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.748811 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.748854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb352000
[pid 25405] 10:12:33.748892 <... open resumed> ) = 5
[pid 25399] 10:12:33.748910 lseek(12, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.748941 read(12,  <unfinished ...>
[pid 25405] 10:12:33.748959 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.748980 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25405] 10:12:33.749003 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.749035 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fbcbb595000
[pid 25399] 10:12:33.749080 read(12,  <unfinished ...>
[pid 25405] 10:12:33.749105 close(5)    = 0
[pid 25399] 10:12:33.749137 <... read resumed> "", 4096) = 0
[pid 25405] 10:12:33.749165 open("/lib64/libtinfo.so.5", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.749222 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25405] 10:12:33.749254 <... open resumed> ) = 5
[pid 25405] 10:12:33.749272 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.749312 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.749357 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fbcbb160000
[pid 25399] 10:12:33.749401 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2901, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25405] 10:12:33.749519 mprotect(0x7fbcbb17d000, 2093056, PROT_NONE) = 0
[pid 25399] 10:12:33.749579 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.749604 mmap(0x7fbcbb37c000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7fbcbb37c000
[pid 25405] 10:12:33.749649 mmap(0x7fbcbb380000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb380000
[pid 25405] 10:12:33.749685 close(5)    = 0
[pid 25399] 10:12:33.749721 <... open resumed> ) = 13
[pid 25405] 10:12:33.749750 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.749773 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b09350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.749819 <... open resumed> ) = 5
[pid 25399] 10:12:33.749838 lseek(13, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.749873 fstat(13,  <unfinished ...>
[pid 25405] 10:12:33.749891 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.749930 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2901, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25405] 10:12:33.749961 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.749979 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25405] 10:12:33.749999 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.750028 <... fcntl resumed> ) = 0
[pid 25405] 10:12:33.750046 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25399] 10:12:33.750099 read(13,  <unfinished ...>
[pid 25405] 10:12:33.750123 <... mmap resumed> ) = 0x7fbcbaf5c000
[pid 25405] 10:12:33.750141 mprotect(0x7fbcbaf5e000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.750174 mmap(0x7fbcbb15e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7fbcbb15e000
[pid 25405] 10:12:33.750219 close(5)    = 0
[pid 25405] 10:12:33.750257 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.750280 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2901
[pid 25405] 10:12:33.750503 <... open resumed> ) = 5
[pid 25405] 10:12:33.750528 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.750569 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.750613 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb594000
[pid 25405] 10:12:33.750657 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7fbcbabc8000
[pid 25405] 10:12:33.750692 mprotect(0x7fbcbad52000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.750726 mmap(0x7fbcbaf52000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7fbcbaf52000
[pid 25405] 10:12:33.750766 mmap(0x7fbcbaf57000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbcbaf57000
[pid 25405] 10:12:33.750813 close(5)    = 0
[pid 25405] 10:12:33.750867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb593000
[pid 25405] 10:12:33.750905 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb592000
[pid 25405] 10:12:33.750940 arch_prctl(ARCH_SET_FS, 0x7fbcbb593700) = 0
[pid 25405] 10:12:33.751073 mprotect(0x7fbcbaf52000, 16384, PROT_READ) = 0
[pid 25405] 10:12:33.751508 mprotect(0x7fbcbb15e000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.751595 mprotect(0x7fbcbb5a0000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.751630 munmap(0x7fbcbb595000, 39387) = 0
[pid 25405] 10:12:33.751697 rt_sigprocmask(SIG_BLOCK, NULL, Process 25404 attached
 <unfinished ...>
[pid 25404] 10:12:33.751751 set_robust_list(0x7fe14f5c4aa0, 24) = 0
[pid 25404] 10:12:33.751805 close(0 <unfinished ...>
[pid 25405] 10:12:33.751825 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25405] 10:12:33.751856 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25404] 10:12:33.751905 <... close resumed> ) = 0
[pid 25405] 10:12:33.751930 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:33.751950 close(1)    = 0
[pid 25404] 10:12:33.751980 close(2)    = 0
[pid 25405] 10:12:33.752009 <... ioctl resumed> , 0x7fff6d64dbc0) = -1 EINVAL (Invalid argument)
[pid 25404] 10:12:33.752083 setsid( <unfinished ...>
[pid 25405] 10:12:33.752131 brk(0)      = 0xa4f000
[pid 25405] 10:12:33.752208 brk(0xa70000 <unfinished ...>
[pid 25404] 10:12:33.752231 <... setsid resumed> ) = 25404
[pid 25404] 10:12:33.752253 fstat(0, 0x7fff067e0f70) = -1 EBADF (Bad file descriptor)
[pid 25404] 10:12:33.752288 open("/dev/null", O_RDWR) = 0
[pid 25405] 10:12:33.752329 <... brk resumed> ) = 0xa70000
[pid 25404] 10:12:33.752349 fstat(1,  <unfinished ...>
[pid 25405] 10:12:33.752394 getuid( <unfinished ...>
[pid 25404] 10:12:33.752473 <... fstat resumed> 0x7fff067e0f70) = -1 EBADF (Bad file descriptor)
[pid 25404] 10:12:33.752506 dup2(0, 1)  = 1
[pid 25404] 10:12:33.752539 fstat(2,  <unfinished ...>
[pid 25399] 10:12:33.752595 read(13,  <unfinished ...>
[pid 25404] 10:12:33.752616 <... fstat resumed> 0x7fff067e0f70) = -1 EBADF (Bad file descriptor)
[pid 25404] 10:12:33.752635 dup2(0, 2)  = 2
[pid 25404] 10:12:33.752666 geteuid()   = 47
[pid 25404] 10:12:33.752706 fstat(0,  <unfinished ...>
[pid 25405] 10:12:33.752727 <... getuid resumed> ) = 503
[pid 25405] 10:12:33.752747 getgid()    = 500
[pid 25405] 10:12:33.752778 geteuid( <unfinished ...>
[pid 25404] 10:12:33.752796 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25405] 10:12:33.752828 <... geteuid resumed> ) = 503
[pid 25404] 10:12:33.752846 fstat(1,  <unfinished ...>
[pid 25405] 10:12:33.752865 getegid( <unfinished ...>
[pid 25404] 10:12:33.752883 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25404] 10:12:33.752912 fstat(2,  <unfinished ...>
[pid 25405] 10:12:33.752930 <... getegid resumed> ) = 500
[pid 25404] 10:12:33.752947 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25405] 10:12:33.752985 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25404] 10:12:33.753010 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMX-0006bg-Lo"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25399] 10:12:33.753600 <... read resumed> "", 8192) = 0
[pid 25405] 10:12:33.753629 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25405] 10:12:33.753690 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.753723 close(13)   = 0
[pid 25399] 10:12:33.753794 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.753831 <... open resumed> ) = 5
[pid 25405] 10:12:33.753857 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.753878 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.753928 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.753951 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.753982 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb59e000
[pid 25405] 10:12:33.754018 read(5, "MemTotal:        1048576 kB\nMemFree:          274800 kB\nCached:           326332 kB\nBuffers:               0 kB\nActive:           278424 kB\nInactive:         466960 kB\nActive(anon):     149252 kB\nInactive(anon):   277604 kB\nActive(file):     129172 kB\nInac"..., 1024) = 588
[pid 25399] 10:12:33.754087 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25399] 10:12:33.754127 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25399] 10:12:33.754208 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25405] 10:12:33.754249 close(5)    = 0
[pid 25405] 10:12:33.754285 munmap(0x7fbcbb59e000, 4096 <unfinished ...>
[pid 25399] 10:12:33.754308 <... open resumed> ) = 13
[pid 25405] 10:12:33.754330 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.754353 fstat(13,  <unfinished ...>
[pid 25405] 10:12:33.754408 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25399] 10:12:33.754523 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.754555 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb351000
[pid 25399] 10:12:33.754590 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.754641 close(13)   = 0
[pid 25399] 10:12:33.754674 munmap(0x7f54cb351000, 4096 <unfinished ...>
[pid 25405] 10:12:33.754693 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25399] 10:12:33.754717 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.754736 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.754771 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25399] 10:12:33.754801 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.754823 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25405] 10:12:33.754843 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.754879 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25405] 10:12:33.754913 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25399] 10:12:33.754935 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25405] 10:12:33.754964 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.754986 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25399] 10:12:33.755005 pipe([13, 14]) = 0
[pid 25405] 10:12:33.755040 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25405] 10:12:33.755063 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25399] 10:12:33.755084 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25405] 10:12:33.755105 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, 8) = 0
[pid 25399] 10:12:33.755125 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25405] 10:12:33.755148 uname( <unfinished ...>
[pid 25399] 10:12:33.755168 close(10)   = 0
[pid 25405] 10:12:33.755201 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25405] 10:12:33.755265 getcwd( <unfinished ...>
[pid 25399] 10:12:33.755286 munmap(0x7f54cb354000, 4096) = 0
[pid 25399] 10:12:33.755325 close(11)   = 0
[pid 25399] 10:12:33.755358 munmap(0x7f54cb353000, 4096) = 0
[pid 25399] 10:12:33.755399 close(12)   = 0
[pid 25399] 10:12:33.755526 munmap(0x7f54cb352000, 4096) = 0
[pid 25399] 10:12:33.755564 close(9 <unfinished ...>
[pid 25405] 10:12:33.755586 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25399] 10:12:33.755609 <... close resumed> ) = 0
[pid 25399] 10:12:33.755626 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25405] 10:12:33.755655 getpid( <unfinished ...>
[pid 25399] 10:12:33.755677 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.755697 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25406
[pid 25405] 10:12:33.755947 <... getpid resumed> ) = 25405
[pid 25405] 10:12:33.755977 getppid()   = 25389
[pid 25405] 10:12:33.756017 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25405] 10:12:33.756072 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756122 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756167 geteuid()   = 503
[pid 25405] 10:12:33.756196 getegid()   = 500
[pid 25404] 10:12:33.756335 <... execve resumed> ) = 0
[pid 25405] 10:12:33.756358 getuid()    = 503
[pid 25405] 10:12:33.756388 getgid()    = 500
[pid 25405] 10:12:33.756479 access("/bin/sh", X_OK) = 0
[pid 25405] 10:12:33.756523 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756569 geteuid()   = 503
[pid 25405] 10:12:33.756598 getegid()   = 500
[pid 25405] 10:12:33.756627 getuid()    = 503
[pid 25405] 10:12:33.756655 getgid()    = 500
[pid 25405] 10:12:33.756684 access("/bin/sh", R_OK) = 0
[pid 25405] 10:12:33.756719 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756763 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756807 geteuid()   = 503
[pid 25405] 10:12:33.756836 getegid()   = 500
[pid 25405] 10:12:33.756864 getuid()    = 503
[pid 25405] 10:12:33.756893 getgid()    = 500
[pid 25405] 10:12:33.756922 access("/bin/sh", X_OK) = 0
[pid 25405] 10:12:33.756955 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25405] 10:12:33.756999 geteuid()   = 503
[pid 25405] 10:12:33.757028 getegid()   = 500
[pid 25405] 10:12:33.757057 getuid()    = 503
[pid 25405] 10:12:33.757085 getgid()    = 500
[pid 25405] 10:12:33.757114 access("/bin/sh", R_OK) = 0
[pid 25405] 10:12:33.757161 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.757198 brk(0 <unfinished ...>
[pid 25405] 10:12:33.757224 <... socket resumed> ) = 5
[pid 25405] 10:12:33.757243 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.757295 <... brk resumed> ) = 0x19ad000
[pid 25404] 10:12:33.757316 fcntl(0, F_GETFD <unfinished ...>
[pid 25405] 10:12:33.757335 close(5 <unfinished ...>
[pid 25404] 10:12:33.757355 <... fcntl resumed> ) = 0
[pid 25405] 10:12:33.757377 <... close resumed> ) = 0
[pid 25404] 10:12:33.757395 fcntl(1, F_GETFD) = 0
[pid 25404] 10:12:33.757509 fcntl(2, F_GETFD <unfinished ...>
[pid 25405] 10:12:33.757531 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.757550 <... fcntl resumed> ) = 0
[pid 25405] 10:12:33.757570 <... socket resumed> ) = 5
[pid 25404] 10:12:33.757593 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25405] 10:12:33.757619 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.757670 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.757702 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.757725 close(5)    = 0
[pid 25399] 10:12:33.757776 close(14 <unfinished ...>
[pid 25405] 10:12:33.757803 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.757827 <... mmap resumed> ) = 0x7fb3682bb000
[pid 25405] 10:12:33.757849 <... open resumed> ) = 5
[pid 25404] 10:12:33.757881 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25405] 10:12:33.757907 fstat(5,  <unfinished ...>
[pid 25399] 10:12:33.757926 <... close resumed> ) = 0
[pid 25399] 10:12:33.757944 read(13,  <unfinished ...>
[pid 25405] 10:12:33.757962 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25405] 10:12:33.757993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb59e000
[pid 25405] 10:12:33.758027 read(5,  <unfinished ...>
[pid 25404] 10:12:33.758048 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758070 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25404] 10:12:33.758102 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.758136 read(5,  <unfinished ...>
[pid 25404] 10:12:33.758162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758180 <... read resumed> "", 4096) = 0
[pid 25405] 10:12:33.758199 close(5 <unfinished ...>
[pid 25404] 10:12:33.758217 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25405] 10:12:33.758238 <... close resumed> ) = 0
[pid 25404] 10:12:33.758258 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758276 munmap(0x7fbcbb59e000, 4096 <unfinished ...>
[pid 25404] 10:12:33.758294 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.758319 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.758342 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758371 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.758392 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.758515 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758560 <... open resumed> ) = 5
[pid 25405] 10:12:33.758577 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.758596 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25405] 10:12:33.758619 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.758668 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25404] 10:12:33.758693 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758717 <... mmap resumed> ) = 0x7fbcbb595000
[pid 25404] 10:12:33.758735 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.758755 close(5 <unfinished ...>
[pid 25404] 10:12:33.758778 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758796 <... close resumed> ) = 0
[pid 25405] 10:12:33.758822 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.758842 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25404] 10:12:33.758889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.758915 <... open resumed> ) = 5
[pid 25404] 10:12:33.758942 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.758960 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.758998 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25405] 10:12:33.759018 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.759041 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759059 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.759096 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25404] 10:12:33.759117 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759161 <... mmap resumed> ) = 0x7fbcba9ba000
[pid 25404] 10:12:33.759179 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25405] 10:12:33.759199 mprotect(0x7fbcba9c6000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.759222 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759245 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.759262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.759282 mmap(0x7fbcbabc6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25404] 10:12:33.759309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759331 <... mmap resumed> ) = 0x7fbcbabc6000
[pid 25405] 10:12:33.759358 close(5 <unfinished ...>
[pid 25404] 10:12:33.759379 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.759523 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.759555 <... close resumed> ) = 0
[pid 25404] 10:12:33.759581 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759617 mprotect(0x7fbcbabc6000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.759642 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.759699 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.759717 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759759 munmap(0x7fbcbb595000, 39387 <unfinished ...>
[pid 25404] 10:12:33.759778 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25405] 10:12:33.759802 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.759823 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759851 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.759877 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759920 <... open resumed> ) = 5
[pid 25404] 10:12:33.759938 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.759976 fcntl(5, F_GETFD <unfinished ...>
[pid 25404] 10:12:33.759995 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.760033 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25405] 10:12:33.760054 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.760073 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25405] 10:12:33.760093 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.760125 <... stat resumed> 0x7ffeeb7c5e30) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.760144 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcbb59e000
[pid 25404] 10:12:33.760177 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.760216 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.760255 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25405] 10:12:33.760288 close(5 <unfinished ...>
[pid 25404] 10:12:33.760310 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.760341 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25404] 10:12:33.760379 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.760503 <... close resumed> ) = 0
[pid 25404] 10:12:33.760524 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fb3682b1000
[pid 25405] 10:12:33.760559 munmap(0x7fbcbb59e000, 4096) = 0
[pid 25404] 10:12:33.760603 close(6)    = 0
[pid 25404] 10:12:33.760647 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.760706 getpgrp( <unfinished ...>
[pid 25404] 10:12:33.760734 <... open resumed> ) = 6
[pid 25404] 10:12:33.760752 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.760792 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.760836 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb367e83000
[pid 25404] 10:12:33.760872 mprotect(0x7fb367e99000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.760906 <... getpgrp resumed> ) = 29163
[pid 25404] 10:12:33.760923 mmap(0x7fb368099000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25405] 10:12:33.760944 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25404] 10:12:33.760971 <... mmap resumed> ) = 0x7fb368099000
[pid 25405] 10:12:33.760990 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.761014 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25404] 10:12:33.761037 mmap(0x7fb36809b000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.761059 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25405] 10:12:33.761136 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25404] 10:12:33.761161 <... mmap resumed> ) = 0x7fb36809b000
[pid 25404] 10:12:33.761185 close(6)    = 0
[pid 25404] 10:12:33.761223 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.761264 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.761304 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.761347 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25405] 10:12:33.761386 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25404] 10:12:33.761407 read(6,  <unfinished ...>
[pid 25405] 10:12:33.761512 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25404] 10:12:33.761535 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.761561 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.761606 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.761627 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25404] 10:12:33.761656 <... mmap resumed> ) = 0x7fb3682b0000
[pid 25405] 10:12:33.761684 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25404] 10:12:33.761707 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb367c6a000
[pid 25405] 10:12:33.761743 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25405] 10:12:33.761822 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25404] 10:12:33.761848 mprotect(0x7fb367c80000, 2093056, PROT_NONE) = 0
[pid 25404] 10:12:33.761883 mmap(0x7fb367e7f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fb367e7f000
[pid 25404] 10:12:33.761998 mmap(0x7fb367e81000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb367e81000
[pid 25404] 10:12:33.762042 close(6)    = 0
[pid 25404] 10:12:33.762081 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.762123 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.762164 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0}, 8) = 0
[pid 25404] 10:12:33.762185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.762205 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbcbabfa6a0},  <unfinished ...>
[pid 25404] 10:12:33.762232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.762250 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.762270 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fbcbabfa6a0}, 8) = 0
[pid 25405] 10:12:33.762309 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25404] 10:12:33.762394 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25405] 10:12:33.762653 <... execve resumed> ) = 0
[pid 25404] 10:12:33.762682 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.762723 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.762769 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb367a33000
[pid 25404] 10:12:33.762804 mprotect(0x7fb367a3a000, 2097152, PROT_NONE) = 0
[pid 25404] 10:12:33.762838 mmap(0x7fb367c3a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fb367c3a000
[pid 25404] 10:12:33.762879 mmap(0x7fb367c3c000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb367c3c000
[pid 25404] 10:12:33.762920 close(6)    = 0
[pid 25404] 10:12:33.762957 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.762998 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.763038 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.763076 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25404] 10:12:33.763114 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.763152 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.763196 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb3677af000
[pid 25404] 10:12:33.763231 mprotect(0x7fb367832000, 2093056, PROT_NONE) = 0
[pid 25404] 10:12:33.763264 mmap(0x7fb367a31000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fb367a31000
[pid 25404] 10:12:33.763307 close(6)    = 0
[pid 25404] 10:12:33.763346 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.763381 brk(0 <unfinished ...>
[pid 25404] 10:12:33.763406 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.763504 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.763550 <... brk resumed> ) = 0x2245000
[pid 25405] 10:12:33.763569 fcntl(0, F_GETFD) = 0
[pid 25405] 10:12:33.763600 fcntl(1, F_GETFD <unfinished ...>
[pid 25404] 10:12:33.763618 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.763638 <... fcntl resumed> ) = 0
[pid 25404] 10:12:33.763660 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.763678 fcntl(2, F_GETFD) = 0
[pid 25405] 10:12:33.763713 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25404] 10:12:33.763740 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25405] 10:12:33.763783 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.763813 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.763835 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.763874 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25404] 10:12:33.763918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.763939 <... mmap resumed> ) = 0x7fdf81e16000
[pid 25404] 10:12:33.763959 <... mmap resumed> ) = 0x7fb3682af000
[pid 25405] 10:12:33.763982 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25404] 10:12:33.764006 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb3675a1000
[pid 25405] 10:12:33.764044 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.764062 mprotect(0x7fb3675ad000, 2097152, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.764088 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.764113 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.764131 mmap(0x7fb3677ad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fb3677ad000
[pid 25405] 10:12:33.764171 <... open resumed> ) = 5
[pid 25404] 10:12:33.764197 close(6 <unfinished ...>
[pid 25405] 10:12:33.764217 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.764260 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fdf81e0c000
[pid 25405] 10:12:33.764293 close(5 <unfinished ...>
[pid 25404] 10:12:33.764311 <... close resumed> ) = 0
[pid 25405] 10:12:33.764327 <... close resumed> ) = 0
[pid 25404] 10:12:33.764350 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.764381 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.764409 <... open resumed> ) = 6
[pid 25405] 10:12:33.764529 <... open resumed> ) = 5
[pid 25404] 10:12:33.764548 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.764587 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.764630 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.764652 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.764671 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:33.764702 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.764722 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.764751 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25404] 10:12:33.764774 <... mmap resumed> ) = 0x7fb36737e000
[pid 25405] 10:12:33.764794 <... mmap resumed> ) = 0x7fdf81864000
[pid 25404] 10:12:33.764811 mprotect(0x7fb36739f000, 2097152, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.764829 mprotect(0x7fdf819ee000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.764851 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.764871 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.764910 mmap(0x7fb36759f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25405] 10:12:33.764930 mmap(0x7fdf81bee000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7fdf81bee000
[pid 25404] 10:12:33.764968 <... mmap resumed> ) = 0x7fb36759f000
[pid 25404] 10:12:33.764990 close(6 <unfinished ...>
[pid 25405] 10:12:33.765012 mmap(0x7fdf81bf3000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.765033 <... close resumed> ) = 0
[pid 25405] 10:12:33.765053 <... mmap resumed> ) = 0x7fdf81bf3000
[pid 25404] 10:12:33.765077 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.765104 close(5 <unfinished ...>
[pid 25404] 10:12:33.765129 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.765148 <... close resumed> ) = 0
[pid 25405] 10:12:33.765178 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.765199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.765240 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.765262 <... mmap resumed> ) = 0x7fdf81e0b000
[pid 25404] 10:12:33.765284 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.765307 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.765328 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.765350 <... mmap resumed> ) = 0x7fdf81e0a000
[pid 25404] 10:12:33.765375 <... open resumed> ) = 6
[pid 25405] 10:12:33.765395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf81e09000
[pid 25404] 10:12:33.765543 read(6,  <unfinished ...>
[pid 25405] 10:12:33.765568 arch_prctl(ARCH_SET_FS, 0x7fdf81e0a700 <unfinished ...>
[pid 25404] 10:12:33.765589 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.765620 <... arch_prctl resumed> ) = 0
[pid 25404] 10:12:33.765639 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.765741 mprotect(0x7fdf81bee000, 16384, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.765764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.765796 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb367161000
[pid 25404] 10:12:33.765832 mprotect(0x7fb367178000, 2097152, PROT_NONE) = 0
[pid 25404] 10:12:33.765867 mmap(0x7fb367378000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fb367378000
[pid 25404] 10:12:33.765909 mmap(0x7fb36737a000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb36737a000
[pid 25404] 10:12:33.765950 close(6)    = 0
[pid 25404] 10:12:33.765989 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.766029 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.766068 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.766107 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25404] 10:12:33.766144 read(6,  <unfinished ...>
[pid 25405] 10:12:33.766165 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.766183 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.766207 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.766230 mprotect(0x7fdf81e17000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.766250 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25404] 10:12:33.766280 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682ae000
[pid 25405] 10:12:33.766320 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.766339 munmap(0x7fdf81e0c000, 39387 <unfinished ...>
[pid 25404] 10:12:33.766360 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.766385 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.766405 <... mmap resumed> ) = 0x7fb366ded000
[pid 25405] 10:12:33.766530 getuid( <unfinished ...>
[pid 25404] 10:12:33.766553 mprotect(0x7fb366f5c000, 2093056, PROT_NONE) = 0
[pid 25404] 10:12:33.766589 mmap(0x7fb36715b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fb36715b000
[pid 25404] 10:12:33.766634 close(6)    = 0
[pid 25404] 10:12:33.766675 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.766697 <... getuid resumed> ) = 503
[pid 25405] 10:12:33.766715 getgid()    = 500
[pid 25405] 10:12:33.766746 getegid( <unfinished ...>
[pid 25404] 10:12:33.766768 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.766787 <... getegid resumed> ) = 499
[pid 25405] 10:12:33.766805 getppid()   = 25389
[pid 25405] 10:12:33.766836 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25404] 10:12:33.766856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.766907 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25405] 10:12:33.766978 brk(0 <unfinished ...>
[pid 25404] 10:12:33.766999 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.767040 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25404] 10:12:33.767080 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.767118 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25404] 10:12:33.767162 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb366b5e000
[pid 25404] 10:12:33.767197 mprotect(0x7fb366be9000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.767232 <... brk resumed> ) = 0x2245000
[pid 25404] 10:12:33.767250 mmap(0x7fb366de9000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25405] 10:12:33.767269 brk(0x2266000 <unfinished ...>
[pid 25404] 10:12:33.767292 <... mmap resumed> ) = 0x7fb366de9000
[pid 25405] 10:12:33.767313 <... brk resumed> ) = 0x2266000
[pid 25405] 10:12:33.767347 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.767372 mmap(0x7fb366dec000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb366dec000
[pid 25404] 10:12:33.767494 close(6 <unfinished ...>
[pid 25405] 10:12:33.767526 <... socket resumed> ) = 5
[pid 25404] 10:12:33.767545 <... close resumed> ) = 0
[pid 25404] 10:12:33.767569 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.767592 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.767642 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.767661 close(5 <unfinished ...>
[pid 25404] 10:12:33.767679 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.767702 <... close resumed> ) = 0
[pid 25404] 10:12:33.767726 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.767745 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25404] 10:12:33.767778 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.767816 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.767856 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.767878 close(5)    = 0
[pid 25404] 10:12:33.767916 <... open resumed> ) = 6
[pid 25405] 10:12:33.767944 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.767964 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.768007 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25405] 10:12:33.768056 <... open resumed> ) = 5
[pid 25404] 10:12:33.768075 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb366958000
[pid 25405] 10:12:33.768119 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.768138 mprotect(0x7fb36695e000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.768173 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25404] 10:12:33.768202 mmap(0x7fb366b5d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25405] 10:12:33.768223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.768247 <... mmap resumed> ) = 0x7fb366b5d000
[pid 25405] 10:12:33.768266 <... mmap resumed> ) = 0x7fdf81e15000
[pid 25404] 10:12:33.768288 close(6 <unfinished ...>
[pid 25405] 10:12:33.768307 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25404] 10:12:33.768346 <... close resumed> ) = 0
[pid 25405] 10:12:33.768382 read(5,  <unfinished ...>
[pid 25404] 10:12:33.768407 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.768532 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25405] 10:12:33.768574 <... read resumed> "", 4096) = 0
[pid 25405] 10:12:33.768596 close(5 <unfinished ...>
[pid 25404] 10:12:33.768614 read(6,  <unfinished ...>
[pid 25405] 10:12:33.768633 <... close resumed> ) = 0
[pid 25404] 10:12:33.768652 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.768676 munmap(0x7fdf81e15000, 4096 <unfinished ...>
[pid 25404] 10:12:33.768695 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.768717 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.768735 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.768765 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682ad000
[pid 25405] 10:12:33.768812 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.768837 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb366622000
[pid 25404] 10:12:33.768873 mprotect(0x7fb36674e000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.768917 <... open resumed> ) = 5
[pid 25405] 10:12:33.768934 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.768952 mmap(0x7fb36694e000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25405] 10:12:33.768973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25404] 10:12:33.769007 <... mmap resumed> ) = 0x7fb36694e000
[pid 25405] 10:12:33.769027 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7fdf81e0c000
[pid 25405] 10:12:33.769061 close(5 <unfinished ...>
[pid 25404] 10:12:33.769092 mmap(0x7fb366957000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.769119 <... close resumed> ) = 0
[pid 25405] 10:12:33.769145 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.769176 <... mmap resumed> ) = 0x7fb366957000
[pid 25404] 10:12:33.769200 close(6 <unfinished ...>
[pid 25405] 10:12:33.769233 <... open resumed> ) = 5
[pid 25404] 10:12:33.769251 <... close resumed> ) = 0
[pid 25404] 10:12:33.769275 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.769303 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.769343 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.769376 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.769396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.769546 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25404] 10:12:33.769576 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.769624 <... mmap resumed> ) = 0x7fdf81656000
[pid 25405] 10:12:33.769643 mprotect(0x7fdf81662000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.769669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.769698 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.769722 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.769741 mmap(0x7fdf81862000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7fdf81862000
[pid 25404] 10:12:33.769780 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25405] 10:12:33.769831 close(5 <unfinished ...>
[pid 25404] 10:12:33.769858 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.769897 <... close resumed> ) = 0
[pid 25404] 10:12:33.769916 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.769955 mprotect(0x7fdf81862000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.769987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.770019 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb36641e000
[pid 25404] 10:12:33.770057 mprotect(0x7fb366420000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.770094 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.770113 mmap(0x7fb366620000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25405] 10:12:33.770143 munmap(0x7fdf81e0c000, 39387 <unfinished ...>
[pid 25404] 10:12:33.770171 <... mmap resumed> ) = 0x7fb366620000
[pid 25405] 10:12:33.770193 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.770221 close(6 <unfinished ...>
[pid 25405] 10:12:33.770256 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.770284 <... close resumed> ) = 0
[pid 25405] 10:12:33.770307 <... open resumed> ) = 5
[pid 25404] 10:12:33.770332 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.770365 fcntl(5, F_GETFD <unfinished ...>
[pid 25404] 10:12:33.770396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.770488 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25405] 10:12:33.770518 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.770545 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.770589 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.770620 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf81e15000
[pid 25404] 10:12:33.770656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.770683 read(5,  <unfinished ...>
[pid 25404] 10:12:33.770713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.770736 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.770776 close(5 <unfinished ...>
[pid 25404] 10:12:33.770802 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25404] 10:12:33.770843 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.770883 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.770928 <... close resumed> ) = 0
[pid 25404] 10:12:33.770948 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.770975 munmap(0x7fdf81e15000, 4096 <unfinished ...>
[pid 25404] 10:12:33.771004 <... mmap resumed> ) = 0x7fb36621b000
[pid 25405] 10:12:33.771026 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.771044 mprotect(0x7fb36621d000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.771081 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.771111 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.771129 mmap(0x7fb36641c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25405] 10:12:33.771160 <... socket resumed> ) = 5
[pid 25404] 10:12:33.771181 <... mmap resumed> ) = 0x7fb36641c000
[pid 25405] 10:12:33.771201 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25404] 10:12:33.771239 close(6 <unfinished ...>
[pid 25405] 10:12:33.771271 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.771291 close(5 <unfinished ...>
[pid 25404] 10:12:33.771316 <... close resumed> ) = 0
[pid 25405] 10:12:33.771336 <... close resumed> ) = 0
[pid 25404] 10:12:33.771362 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.771392 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25404] 10:12:33.771552 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.771574 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.771617 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.771660 close(5)    = 0
[pid 25405] 10:12:33.771700 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.771728 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.771772 <... open resumed> ) = 5
[pid 25404] 10:12:33.771792 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.771821 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.771852 <... open resumed> ) = 6
[pid 25405] 10:12:33.771871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.771901 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf81e15000
[pid 25404] 10:12:33.771939 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.771979 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.772020 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.772066 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.772117 close(5 <unfinished ...>
[pid 25404] 10:12:33.772145 <... mmap resumed> ) = 0x7fb3682ac000
[pid 25404] 10:12:33.772167 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb365e87000
[pid 25404] 10:12:33.772205 mprotect(0x7fb366011000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.772243 <... close resumed> ) = 0
[pid 25404] 10:12:33.772262 mmap(0x7fb366211000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25405] 10:12:33.772294 munmap(0x7fdf81e15000, 4096 <unfinished ...>
[pid 25404] 10:12:33.772324 <... mmap resumed> ) = 0x7fb366211000
[pid 25405] 10:12:33.772349 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.772374 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.772407 mmap(0x7fb366216000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb366216000
[pid 25405] 10:12:33.772529 <... open resumed> ) = 5
[pid 25405] 10:12:33.772550 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.772583 close(6 <unfinished ...>
[pid 25405] 10:12:33.772609 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.772639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf81e15000
[pid 25404] 10:12:33.772675 <... close resumed> ) = 0
[pid 25404] 10:12:33.772701 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.772730 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.772782 close(5 <unfinished ...>
[pid 25404] 10:12:33.772813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.772833 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.772877 <... close resumed> ) = 0
[pid 25405] 10:12:33.772895 munmap(0x7fdf81e15000, 4096) = 0
[pid 25404] 10:12:33.772932 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.772986 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25404] 10:12:33.773016 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25405] 10:12:33.773071 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25404] 10:12:33.773093 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.773132 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25404] 10:12:33.773178 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb365c1b000
[pid 25405] 10:12:33.773222 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25404] 10:12:33.773249 mprotect(0x7fb365c7d000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.773279 <... readlink resumed> 0x7ffdb73997a0, 4095) = -1 EINVAL (Invalid argument)
[pid 25404] 10:12:33.773303 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.773330 getcwd( <unfinished ...>
[pid 25404] 10:12:33.773356 mmap(0x7fb365e7c000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fb365e7c000
[pid 25404] 10:12:33.773488 close(6 <unfinished ...>
[pid 25405] 10:12:33.773524 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25405] 10:12:33.773560 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25404] 10:12:33.773588 <... close resumed> ) = 0
[pid 25404] 10:12:33.773616 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.773648 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.773681 open("/proc/25389/cmdline", O_RDONLY) = 5
[pid 25404] 10:12:33.773723 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.773745 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.773770 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.773803 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.773845 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.773865 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf81e15000
[pid 25405] 10:12:33.773901 read(5,  <unfinished ...>
[pid 25404] 10:12:33.773926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.773958 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25404] 10:12:33.773984 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.774006 read(5,  <unfinished ...>
[pid 25404] 10:12:33.774033 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25405] 10:12:33.774075 <... read resumed> "", 1024) = 0
[pid 25405] 10:12:33.774100 setregid(499, 499 <unfinished ...>
[pid 25404] 10:12:33.774126 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.774166 <... setregid resumed> ) = 0
[pid 25405] 10:12:33.774187 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25404] 10:12:33.774287 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25404] 10:12:33.774524 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb365838000
[pid 25404] 10:12:33.774573 mprotect(0x7fb3659f1000, 2093056, PROT_NONE) = 0
[pid 25404] 10:12:33.774610 mmap(0x7fb365bf0000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fb365bf0000
[pid 25404] 10:12:33.774654 mmap(0x7fb365c17000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb365c17000
[pid 25404] 10:12:33.774698 close(6)    = 0
[pid 25404] 10:12:33.774741 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.774785 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.774832 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.774878 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25404] 10:12:33.774944 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.774988 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.775044 <... execve resumed> ) = 0
[pid 25404] 10:12:33.775065 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25404] 10:12:33.775098 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682ab000
[pid 25404] 10:12:33.775137 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb36560b000
[pid 25404] 10:12:33.775175 mprotect(0x7fb365637000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.775226 brk(0 <unfinished ...>
[pid 25404] 10:12:33.775253 mmap(0x7fb365837000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fb365837000
[pid 25404] 10:12:33.775295 close(6)    = 0
[pid 25405] 10:12:33.775328 <... brk resumed> ) = 0x246b000
[pid 25404] 10:12:33.775355 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.775385 fcntl(0, F_GETFD) = 0
[pid 25405] 10:12:33.775484 fcntl(1, F_GETFD <unfinished ...>
[pid 25404] 10:12:33.775524 <... open resumed> ) = 6
[pid 25405] 10:12:33.775543 <... fcntl resumed> ) = 0
[pid 25405] 10:12:33.775561 fcntl(2, F_GETFD) = 0
[pid 25405] 10:12:33.775605 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25404] 10:12:33.775633 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.775673 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.775702 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.775722 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:33.775754 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.775795 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.775827 <... mmap resumed> ) = 0x7fb365406000
[pid 25404] 10:12:33.775846 mprotect(0x7fb36540b000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.775882 <... mmap resumed> ) = 0x7ff345e8f000
[pid 25404] 10:12:33.775901 mmap(0x7fb36560a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25405] 10:12:33.775943 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25404] 10:12:33.775976 <... mmap resumed> ) = 0x7fb36560a000
[pid 25404] 10:12:33.775998 close(6)    = 0
[pid 25405] 10:12:33.776108 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776140 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.776176 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.776209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.776232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776251 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.776294 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776332 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.776365 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.776403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.776479 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.776503 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25404] 10:12:33.776533 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.776562 <... stat resumed> 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776586 <... open resumed> ) = 6
[pid 25405] 10:12:33.776604 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776644 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.776691 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25404] 10:12:33.776719 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.776748 <... stat resumed> 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776768 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25404] 10:12:33.776801 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.776828 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.776871 <... mmap resumed> ) = 0x7fb365203000
[pid 25405] 10:12:33.776891 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25404] 10:12:33.776917 mprotect(0x7fb365205000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.776945 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25404] 10:12:33.776978 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.776998 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777039 mmap(0x7fb365404000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fb365404000
[pid 25404] 10:12:33.777088 close(6 <unfinished ...>
[pid 25405] 10:12:33.777115 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.777155 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.777182 <... close resumed> ) = 0
[pid 25405] 10:12:33.777205 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777233 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.777260 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777304 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.777323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777366 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.777408 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777567 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.777610 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.777638 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.777670 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777696 <... open resumed> ) = 6
[pid 25405] 10:12:33.777715 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.777766 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.777812 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.777840 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.777870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.777890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25404] 10:12:33.777922 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.777949 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25404] 10:12:33.777977 <... mmap resumed> ) = 0x7fb3682aa000
[pid 25405] 10:12:33.777999 <... stat resumed> 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.778022 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.778049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.778093 <... mmap resumed> ) = 0x7fb364fe0000
[pid 25405] 10:12:33.778112 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25404] 10:12:33.778138 mprotect(0x7fb364ff7000, 2097152, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.778167 <... stat resumed> 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.778189 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.778208 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.778234 mmap(0x7fb3651f7000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25405] 10:12:33.778266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.778289 <... mmap resumed> ) = 0x7fb3651f7000
[pid 25405] 10:12:33.778309 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25404] 10:12:33.778349 close(6 <unfinished ...>
[pid 25405] 10:12:33.778379 <... stat resumed> 0x7ffdf76764e0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.778399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.778520 <... close resumed> ) = 0
[pid 25404] 10:12:33.778564 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.778593 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.778645 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25405] 10:12:33.778683 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.778727 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.778758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.778780 <... mmap resumed> ) = 0x7ff345e85000
[pid 25405] 10:12:33.778804 close(6 <unfinished ...>
[pid 25404] 10:12:33.778829 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.778856 <... close resumed> ) = 0
[pid 25404] 10:12:33.778881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.778908 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.778935 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.778967 <... open resumed> ) = 6
[pid 25404] 10:12:33.778990 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.779011 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.779038 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.779082 <... open resumed> ) = 6
[pid 25405] 10:12:33.779103 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.779148 read(6,  <unfinished ...>
[pid 25405] 10:12:33.779173 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.779200 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.779227 <... mmap resumed> ) = 0x7ff345a57000
[pid 25404] 10:12:33.779246 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.779271 mprotect(0x7ff345a6d000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.779297 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.779329 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.779350 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb364d9c000
[pid 25405] 10:12:33.779390 mmap(0x7ff345c6d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7ff345c6d000
[pid 25404] 10:12:33.779540 mprotect(0x7fb364ddd000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.779589 mmap(0x7ff345c6f000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.779625 mmap(0x7fb364fdd000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25405] 10:12:33.779657 <... mmap resumed> ) = 0x7ff345c6f000
[pid 25404] 10:12:33.779678 <... mmap resumed> ) = 0x7fb364fdd000
[pid 25405] 10:12:33.779704 close(6 <unfinished ...>
[pid 25404] 10:12:33.779741 close(6 <unfinished ...>
[pid 25405] 10:12:33.779767 <... close resumed> ) = 0
[pid 25405] 10:12:33.779792 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.779821 <... close resumed> ) = 0
[pid 25404] 10:12:33.779852 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.779887 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.779911 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.779931 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.779974 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.780015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.780055 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.780097 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.780126 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.780158 <... open resumed> ) = 6
[pid 25404] 10:12:33.780181 <... open resumed> ) = 6
[pid 25405] 10:12:33.780199 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.780238 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.780277 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.780324 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.780349 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.780376 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.780407 <... mmap resumed> ) = 0x7ff345e84000
[pid 25404] 10:12:33.780507 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.780545 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.780573 <... mmap resumed> ) = 0x7fb3682a9000
[pid 25404] 10:12:33.780595 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.780624 <... mmap resumed> ) = 0x7ff34583e000
[pid 25404] 10:12:33.780646 <... mmap resumed> ) = 0x7fb364ab5000
[pid 25405] 10:12:33.780665 mprotect(0x7ff345854000, 2093056, PROT_NONE) = 0
[pid 25404] 10:12:33.780701 mprotect(0x7fb364b90000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.780737 mmap(0x7ff345a53000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7ff345a53000
[pid 25404] 10:12:33.780776 mmap(0x7fb364d90000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fb364d90000
[pid 25405] 10:12:33.780824 mmap(0x7ff345a55000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.780863 close(6 <unfinished ...>
[pid 25405] 10:12:33.780891 <... mmap resumed> ) = 0x7ff345a55000
[pid 25405] 10:12:33.780914 close(6 <unfinished ...>
[pid 25404] 10:12:33.780940 <... close resumed> ) = 0
[pid 25405] 10:12:33.780958 <... close resumed> ) = 0
[pid 25404] 10:12:33.780985 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.781020 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.781064 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.781083 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.781110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.781143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.781167 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.781186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.781213 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.781244 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.781267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.781291 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.781323 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25405] 10:12:33.781373 <... open resumed> ) = 6
[pid 25404] 10:12:33.781398 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.781516 read(6,  <unfinished ...>
[pid 25404] 10:12:33.781544 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.781569 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.781594 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.781625 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.781652 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.781679 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.781709 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.781742 <... mmap resumed> ) = 0x7fb3648b1000
[pid 25405] 10:12:33.781768 <... mmap resumed> ) = 0x7ff345607000
[pid 25405] 10:12:33.781788 mprotect(0x7ff34560e000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.781813 mprotect(0x7fb3648b4000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.781840 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.781862 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.781880 mmap(0x7ff34580e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25404] 10:12:33.781907 mmap(0x7fb364ab3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25405] 10:12:33.781937 <... mmap resumed> ) = 0x7ff34580e000
[pid 25404] 10:12:33.781958 <... mmap resumed> ) = 0x7fb364ab3000
[pid 25404] 10:12:33.781986 close(6 <unfinished ...>
[pid 25405] 10:12:33.782018 mmap(0x7ff345810000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff345810000
[pid 25405] 10:12:33.782060 close(6 <unfinished ...>
[pid 25404] 10:12:33.782086 <... close resumed> ) = 0
[pid 25404] 10:12:33.782112 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.782141 <... close resumed> ) = 0
[pid 25405] 10:12:33.782163 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.782196 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.782220 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.782239 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.782281 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.782323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.782364 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.782405 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.782541 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.782578 <... open resumed> ) = 6
[pid 25405] 10:12:33.782602 <... open resumed> ) = 6
[pid 25404] 10:12:33.782620 read(6,  <unfinished ...>
[pid 25405] 10:12:33.782645 read(6,  <unfinished ...>
[pid 25404] 10:12:33.782670 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.782696 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.782721 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.782747 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.782771 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.782808 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.782841 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.782869 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff345383000
[pid 25404] 10:12:33.782911 <... mmap resumed> ) = 0x7fb364685000
[pid 25405] 10:12:33.782931 mprotect(0x7ff345406000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.782957 mprotect(0x7fb3646ae000, 2097152, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.782985 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.783007 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.783026 mmap(0x7ff345605000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25404] 10:12:33.783053 mmap(0x7fb3648ae000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25405] 10:12:33.783083 <... mmap resumed> ) = 0x7ff345605000
[pid 25404] 10:12:33.783105 <... mmap resumed> ) = 0x7fb3648ae000
[pid 25405] 10:12:33.783134 close(6 <unfinished ...>
[pid 25404] 10:12:33.783166 mmap(0x7fb3648b0000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb3648b0000
[pid 25405] 10:12:33.783203 <... close resumed> ) = 0
[pid 25404] 10:12:33.783227 close(6 <unfinished ...>
[pid 25405] 10:12:33.783260 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.783287 <... close resumed> ) = 0
[pid 25405] 10:12:33.783310 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.783338 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.783368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.783521 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.783549 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.783578 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.783610 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.783634 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.783655 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.783682 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.783714 <... open resumed> ) = 6
[pid 25404] 10:12:33.783737 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.783755 read(6,  <unfinished ...>
[pid 25404] 10:12:33.783782 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.783809 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.783839 <... open resumed> ) = 6
[pid 25405] 10:12:33.783858 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25405] 10:12:33.783909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.783937 read(6,  <unfinished ...>
[pid 25405] 10:12:33.783963 <... mmap resumed> ) = 0x7ff345e83000
[pid 25404] 10:12:33.783983 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.784010 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.784038 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25405] 10:12:33.784085 <... mmap resumed> ) = 0x7ff345175000
[pid 25404] 10:12:33.784105 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682a8000
[pid 25405] 10:12:33.784141 mprotect(0x7ff345181000, 2097152, PROT_NONE) = 0
[pid 25404] 10:12:33.784181 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb36446f000
[pid 25405] 10:12:33.784221 mmap(0x7ff345381000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7ff345381000
[pid 25404] 10:12:33.784259 mprotect(0x7fb364484000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.784295 close(6 <unfinished ...>
[pid 25404] 10:12:33.784324 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.784342 mmap(0x7fb364683000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25405] 10:12:33.784378 <... close resumed> ) = 0
[pid 25404] 10:12:33.784392 <... mmap resumed> ) = 0x7fb364683000
[pid 25405] 10:12:33.784525 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.784565 close(6 <unfinished ...>
[pid 25405] 10:12:33.784590 <... open resumed> ) = 6
[pid 25404] 10:12:33.784605 <... close resumed> ) = 0
[pid 25405] 10:12:33.784621 read(6,  <unfinished ...>
[pid 25404] 10:12:33.784665 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.784696 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.784717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.784736 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.784761 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.784793 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:33.784821 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.784839 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.784868 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.784904 <... mmap resumed> ) = 0x7ff344f52000
[pid 25404] 10:12:33.784920 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.784938 mprotect(0x7ff344f73000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.784968 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.784998 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.785014 <... open resumed> ) = 6
[pid 25405] 10:12:33.785030 mmap(0x7ff345173000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25404] 10:12:33.785060 read(6,  <unfinished ...>
[pid 25405] 10:12:33.785085 <... mmap resumed> ) = 0x7ff345173000
[pid 25404] 10:12:33.785100 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.785127 close(6 <unfinished ...>
[pid 25404] 10:12:33.785153 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.785176 <... close resumed> ) = 0
[pid 25404] 10:12:33.785191 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.785226 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.785259 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.785289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.785306 <... mmap resumed> ) = 0x7fb364264000
[pid 25405] 10:12:33.785323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.785362 mprotect(0x7fb36426e000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.785395 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.785516 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.785538 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.785572 mmap(0x7fb36446d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25405] 10:12:33.785601 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.785618 <... mmap resumed> ) = 0x7fb36446d000
[pid 25405] 10:12:33.785636 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.785680 close(6 <unfinished ...>
[pid 25405] 10:12:33.785704 <... open resumed> ) = 6
[pid 25404] 10:12:33.785719 <... close resumed> ) = 0
[pid 25405] 10:12:33.785735 read(6,  <unfinished ...>
[pid 25404] 10:12:33.785770 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.785800 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.785822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.785845 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.785871 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.785903 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.785931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.785949 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.785979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.786009 <... mmap resumed> ) = 0x7ff344d35000
[pid 25404] 10:12:33.786024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.786041 mprotect(0x7ff344d4c000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.786072 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.786103 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.786118 <... open resumed> ) = 6
[pid 25405] 10:12:33.786135 mmap(0x7ff344f4c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25404] 10:12:33.786165 read(6,  <unfinished ...>
[pid 25405] 10:12:33.786190 <... mmap resumed> ) = 0x7ff344f4c000
[pid 25404] 10:12:33.786205 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.786232 mmap(0x7ff344f4e000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.786263 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.786287 <... mmap resumed> ) = 0x7ff344f4e000
[pid 25404] 10:12:33.786302 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25405] 10:12:33.786337 close(6 <unfinished ...>
[pid 25404] 10:12:33.786367 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.786397 <... close resumed> ) = 0
[pid 25405] 10:12:33.786526 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.786563 <... mmap resumed> ) = 0x7fb364061000
[pid 25405] 10:12:33.786579 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.786597 mprotect(0x7fb364063000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.786627 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.786659 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.786674 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.786692 mmap(0x7fb364262000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25405] 10:12:33.786722 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.786753 <... mmap resumed> ) = 0x7fb364262000
[pid 25405] 10:12:33.786768 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.786793 close(6 <unfinished ...>
[pid 25405] 10:12:33.786822 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.786857 <... close resumed> ) = 0
[pid 25405] 10:12:33.786873 <... open resumed> ) = 6
[pid 25404] 10:12:33.786897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.786927 read(6,  <unfinished ...>
[pid 25404] 10:12:33.786952 <... mmap resumed> ) = 0x7fb3682a7000
[pid 25405] 10:12:33.786967 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.787008 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.787042 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.787065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.787081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25404] 10:12:33.787111 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.787144 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.787171 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.787187 <... mmap resumed> ) = 0x7ff345e82000
[pid 25404] 10:12:33.787204 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.787239 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.787266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.787282 <... mmap resumed> ) = 0x7ff3449c1000
[pid 25404] 10:12:33.787300 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.787330 mprotect(0x7ff344b30000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.787359 <... open resumed> ) = 6
[pid 25405] 10:12:33.787375 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.787392 read(6,  <unfinished ...>
[pid 25405] 10:12:33.787518 mmap(0x7ff344d2f000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25404] 10:12:33.787554 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.787578 <... mmap resumed> ) = 0x7ff344d2f000
[pid 25404] 10:12:33.787598 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.787641 close(6 <unfinished ...>
[pid 25404] 10:12:33.787665 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25405] 10:12:33.787693 <... close resumed> ) = 0
[pid 25404] 10:12:33.787711 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25405] 10:12:33.787751 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.787788 <... mmap resumed> ) = 0x7fb363e42000
[pid 25405] 10:12:33.787804 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.787821 mprotect(0x7fb363e5f000, 2093056, PROT_NONE <unfinished ...>
[pid 25405] 10:12:33.787850 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.787882 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.787897 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.787914 mmap(0x7fb36405e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25405] 10:12:33.787946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.787976 <... mmap resumed> ) = 0x7fb36405e000
[pid 25405] 10:12:33.787992 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.788014 mmap(0x7fb364060000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.788046 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.788079 <... mmap resumed> ) = 0x7fb364060000
[pid 25405] 10:12:33.788095 <... open resumed> ) = 6
[pid 25404] 10:12:33.788117 close(6 <unfinished ...>
[pid 25405] 10:12:33.788144 read(6,  <unfinished ...>
[pid 25404] 10:12:33.788169 <... close resumed> ) = 0
[pid 25405] 10:12:33.788183 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.788243 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.788274 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.788297 <... mmap resumed> ) = 0x7fb3682a6000
[pid 25405] 10:12:33.788313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25404] 10:12:33.788381 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.788508 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.788544 <... mmap resumed> ) = 0x7fb3682a5000
[pid 25405] 10:12:33.788561 <... mmap resumed> ) = 0x7ff344732000
[pid 25404] 10:12:33.788588 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.788616 mprotect(0x7ff3447bd000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.788644 <... mmap resumed> ) = 0x7fb3682a3000
[pid 25405] 10:12:33.788659 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.788681 arch_prctl(ARCH_SET_FS, 0x7fb3682a37c0 <unfinished ...>
[pid 25405] 10:12:33.788706 mmap(0x7ff3449bd000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25404] 10:12:33.788735 <... arch_prctl resumed> ) = 0
[pid 25405] 10:12:33.788751 <... mmap resumed> ) = 0x7ff3449bd000
[pid 25404] 10:12:33.788812 mprotect(0x7fb36405e000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.788846 mmap(0x7ff3449c0000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.788875 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.788890 <... mmap resumed> ) = 0x7ff3449c0000
[pid 25404] 10:12:33.788917 mprotect(0x7fb364262000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.788952 close(6 <unfinished ...>
[pid 25404] 10:12:33.788976 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.788991 <... close resumed> ) = 0
[pid 25404] 10:12:33.789089 mprotect(0x7fb36446d000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789132 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.789164 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.789207 mprotect(0x7fb364683000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789237 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.789269 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789284 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.789318 mprotect(0x7fb3648ae000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789348 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.789378 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789393 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.789467 mprotect(0x7fb364ab3000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789503 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.789536 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789552 <... open resumed> ) = 6
[pid 25404] 10:12:33.789696 mprotect(0x7fb364d90000, 40960, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789727 read(6,  <unfinished ...>
[pid 25404] 10:12:33.789752 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789767 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.789880 mprotect(0x7fb364fdd000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.789910 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.789934 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.789949 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25404] 10:12:33.789990 mprotect(0x7fb3651f7000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790020 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.790049 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.790065 <... mmap resumed> ) = 0x7ff34452c000
[pid 25404] 10:12:33.790085 mprotect(0x7fb365404000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790114 mprotect(0x7ff344532000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.790140 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.790156 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.790392 mprotect(0x7fb365bf0000, 110592, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790488 mmap(0x7ff344731000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25404] 10:12:33.790521 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.790538 <... mmap resumed> ) = 0x7ff344731000
[pid 25404] 10:12:33.790629 mprotect(0x7fb365e7c000, 16384, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790666 close(6 <unfinished ...>
[pid 25404] 10:12:33.790690 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.790705 <... close resumed> ) = 0
[pid 25404] 10:12:33.790830 mprotect(0x7fb366211000, 16384, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790869 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.790901 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.790916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.790939 mprotect(0x7fb36641c000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.790967 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.791000 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.791016 <... open resumed> ) = 6
[pid 25404] 10:12:33.791041 mprotect(0x7fb366620000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.791069 read(6,  <unfinished ...>
[pid 25404] 10:12:33.791094 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.791108 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.791884 mprotect(0x7fb367378000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.791919 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.791969 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e81000
[pid 25405] 10:12:33.792009 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff3441f6000
[pid 25405] 10:12:33.792047 mprotect(0x7ff344322000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.792083 mmap(0x7ff344522000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7ff344522000
[pid 25405] 10:12:33.792127 mmap(0x7ff34452b000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff34452b000
[pid 25405] 10:12:33.792180 close(6)    = 0
[pid 25405] 10:12:33.792222 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792307 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792347 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25405] 10:12:33.792390 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.792510 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.792582 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff343ff2000
[pid 25405] 10:12:33.792623 mprotect(0x7ff343ff4000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.792660 mmap(0x7ff3441f4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7ff3441f4000
[pid 25405] 10:12:33.792715 close(6)    = 0
[pid 25405] 10:12:33.792760 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792805 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792847 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.792888 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25405] 10:12:33.792929 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.792969 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.793017 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff343def000
[pid 25405] 10:12:33.793055 mprotect(0x7ff343df1000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.793089 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793106 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.793143 mprotect(0x7fb3677ad000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793174 mmap(0x7ff343ff0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25404] 10:12:33.793203 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793218 <... mmap resumed> ) = 0x7ff343ff0000
[pid 25404] 10:12:33.793240 mprotect(0x7fb367a31000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793279 close(6 <unfinished ...>
[pid 25404] 10:12:33.793303 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793318 <... close resumed> ) = 0
[pid 25404] 10:12:33.793339 mprotect(0x7fb367c3a000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793375 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.793410 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793515 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.793558 mprotect(0x7fb367e7f000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793590 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.793624 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793639 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.793666 mprotect(0x7fb368099000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793695 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.793725 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793740 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.793784 mprotect(0x7fb3682bc000, 4096, PROT_READ <unfinished ...>
[pid 25405] 10:12:33.793815 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.793847 <... mprotect resumed> ) = 0
[pid 25405] 10:12:33.793862 <... open resumed> ) = 6
[pid 25404] 10:12:33.793879 munmap(0x7fb3682b1000, 39387 <unfinished ...>
[pid 25405] 10:12:33.793910 read(6,  <unfinished ...>
[pid 25404] 10:12:33.793934 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.793949 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.793980 set_tid_address(0x7fb3682a3a90 <unfinished ...>
[pid 25405] 10:12:33.794006 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.794030 <... set_tid_address resumed> ) = 25404
[pid 25405] 10:12:33.794045 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.794075 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25405] 10:12:33.794101 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.794128 <... set_robust_list resumed> ) = 0
[pid 25405] 10:12:33.794143 <... mmap resumed> ) = 0x7ff345e80000
[pid 25404] 10:12:33.794160 futex(0x7ffeeb7c672c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25405] 10:12:33.794200 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0Process 25406 attached
) = 0x7ff343a5b000
[pid 25404] 10:12:33.794263 <... futex resumed> ) = 0
[pid 25406] 10:12:33.794283 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25405] 10:12:33.794306 mprotect(0x7ff343be5000, 2097152, PROT_NONE <unfinished ...>
[pid 25406] 10:12:33.794334 <... set_robust_list resumed> ) = 0
[pid 25404] 10:12:33.794350 futex(0x7ffeeb7c672c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fb3682a37c0 <unfinished ...>
[pid 25406] 10:12:33.794403 close(13 <unfinished ...>
[pid 25405] 10:12:33.794515 <... mprotect resumed> ) = 0
[pid 25406] 10:12:33.794538 <... close resumed> ) = 0
[pid 25404] 10:12:33.794557 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25406] 10:12:33.794590 geteuid( <unfinished ...>
[pid 25405] 10:12:33.794620 mmap(0x7ff343de5000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25406] 10:12:33.794652 <... geteuid resumed> ) = 0
[pid 25404] 10:12:33.794666 rt_sigaction(SIGRTMIN, {0x7fb367166c60, [], SA_RESTORER|SA_SIGINFO, 0x7fb367170790},  <unfinished ...>
[pid 25406] 10:12:33.794699 getegid( <unfinished ...>
[pid 25405] 10:12:33.794719 <... mmap resumed> ) = 0x7ff343de5000
[pid 25406] 10:12:33.794736 <... getegid resumed> ) = 12
[pid 25404] 10:12:33.794754 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25406] 10:12:33.794777 setgid(500 <unfinished ...>
[pid 25405] 10:12:33.794801 mmap(0x7ff343dea000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25406] 10:12:33.794830 <... setgid resumed> ) = 0
[pid 25404] 10:12:33.794844 rt_sigaction(SIGRT_1, {0x7fb367166cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fb367170790},  <unfinished ...>
[pid 25406] 10:12:33.794874 setuid(503 <unfinished ...>
[pid 25405] 10:12:33.794896 <... mmap resumed> ) = 0x7ff343dea000
[pid 25406] 10:12:33.794913 <... setuid resumed> ) = 0
[pid 25404] 10:12:33.794933 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25406] 10:12:33.794987 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.795020 close(6 <unfinished ...>
[pid 25406] 10:12:33.795045 <... open resumed> ) = 9
[pid 25404] 10:12:33.795058 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25406] 10:12:33.795096 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.795118 <... close resumed> ) = 0
[pid 25406] 10:12:33.795134 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.795174 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25406] 10:12:33.795235 brk(0x16cd000 <unfinished ...>
[pid 25405] 10:12:33.795273 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25406] 10:12:33.795305 <... brk resumed> ) = 0x16cd000
[pid 25404] 10:12:33.795319 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25406] 10:12:33.795495 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.795527 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25406] 10:12:33.795546 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.795574 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25406] 10:12:33.795597 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.795666 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25406] 10:12:33.795701 <... mmap resumed> ) = 0x7f54cb355000
[pid 25404] 10:12:33.795715 statfs("/selinux",  <unfinished ...>
[pid 25406] 10:12:33.795752 read(9,  <unfinished ...>
[pid 25405] 10:12:33.795787 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25406] 10:12:33.795805 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25404] 10:12:33.795825 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350369, f_bavail=6350369, f_files=1000000, f_ffree=691135, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25406] 10:12:33.795849 read(9,  <unfinished ...>
[pid 25405] 10:12:33.795925 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25406] 10:12:33.795958 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25404] 10:12:33.795977 brk(0 <unfinished ...>
[pid 25406] 10:12:33.796006 close(9 <unfinished ...>
[pid 25405] 10:12:33.796029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25406] 10:12:33.796046 <... close resumed> ) = 0
[pid 25404] 10:12:33.796062 <... brk resumed> ) = 0x19ad000
[pid 25406] 10:12:33.796081 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25405] 10:12:33.796108 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25406] 10:12:33.796142 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.796155 brk(0x19ce000 <unfinished ...>
[pid 25405] 10:12:33.796506 <... open resumed> ) = 6
[pid 25404] 10:12:33.796530 <... brk resumed> ) = 0x19ce000
[pid 25405] 10:12:33.796549 read(6,  <unfinished ...>
[pid 25404] 10:12:33.796587 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.796623 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.796647 <... open resumed> ) = 6
[pid 25405] 10:12:33.796669 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.796708 fstat(6,  <unfinished ...>
[pid 25405] 10:12:33.796732 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25406] 10:12:33.796914 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25404] 10:12:33.796943 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.796971 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.797004 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.797031 <... mmap resumed> ) = 0x7ff3437ef000
[pid 25404] 10:12:33.797047 <... mmap resumed> ) = 0x7fb3682ba000
[pid 25405] 10:12:33.797064 mprotect(0x7ff343851000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.797094 read(6,  <unfinished ...>
[pid 25405] 10:12:33.797185 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.797203 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25405] 10:12:33.797223 mmap(0x7ff343a50000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25404] 10:12:33.797265 read(6,  <unfinished ...>
[pid 25405] 10:12:33.797290 <... mmap resumed> ) = 0x7ff343a50000
[pid 25404] 10:12:33.797305 <... read resumed> "", 1024) = 0
[pid 25405] 10:12:33.797332 close(6 <unfinished ...>
[pid 25404] 10:12:33.797367 close(6 <unfinished ...>
[pid 25405] 10:12:33.797394 <... close resumed> ) = 0
[pid 25404] 10:12:33.797504 <... close resumed> ) = 0
[pid 25405] 10:12:33.797530 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25406] 10:12:33.797570 <... lseek resumed> ) = 19
[pid 25404] 10:12:33.797585 munmap(0x7fb3682ba000, 4096 <unfinished ...>
[pid 25406] 10:12:33.797616 read(6,  <unfinished ...>
[pid 25405] 10:12:33.797639 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25406] 10:12:33.797657 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2350) = 1858
[pid 25404] 10:12:33.797677 <... munmap resumed> ) = 0
[pid 25406] 10:12:33.798136 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25405] 10:12:33.798221 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.798256 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25405] 10:12:33.798289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.798306 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.798324 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.798500 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb367170790},  <unfinished ...>
[pid 25405] 10:12:33.798535 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.798552 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25405] 10:12:33.798571 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.798618 fstat(2,  <unfinished ...>
[pid 25405] 10:12:33.798643 <... open resumed> ) = 6
[pid 25404] 10:12:33.798658 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25405] 10:12:33.798694 read(6,  <unfinished ...>
[pid 25404] 10:12:33.798754 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fb367170790},  <unfinished ...>
[pid 25405] 10:12:33.798783 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.798805 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25405] 10:12:33.798823 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.798852 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25405] 10:12:33.798880 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25404] 10:12:33.798907 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25405] 10:12:33.798927 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.798958 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25405] 10:12:33.798986 <... mmap resumed> ) = 0x7ff34340c000
[pid 25404] 10:12:33.799001 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25405] 10:12:33.799020 mprotect(0x7ff3435c5000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.799052 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb367170790},  <unfinished ...>
[pid 25405] 10:12:33.799079 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.799094 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25405] 10:12:33.799111 mmap(0x7ff3437c4000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25404] 10:12:33.799156 umask(0 <unfinished ...>
[pid 25405] 10:12:33.799182 <... mmap resumed> ) = 0x7ff3437c4000
[pid 25404] 10:12:33.799197 <... umask resumed> ) = 0
[pid 25405] 10:12:33.799219 mmap(0x7ff3437eb000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.799289 geteuid( <unfinished ...>
[pid 25405] 10:12:33.799314 <... mmap resumed> ) = 0x7ff3437eb000
[pid 25404] 10:12:33.799329 <... geteuid resumed> ) = 0
[pid 25405] 10:12:33.799353 close(6 <unfinished ...>
[pid 25404] 10:12:33.799384 getuid( <unfinished ...>
[pid 25405] 10:12:33.799410 <... close resumed> ) = 0
[pid 25404] 10:12:33.799516 <... getuid resumed> ) = 47
[pid 25405] 10:12:33.799544 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.799582 getgid( <unfinished ...>
[pid 25405] 10:12:33.799606 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.799622 <... getgid resumed> ) = 12
[pid 25405] 10:12:33.799639 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.799699 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25405] 10:12:33.799723 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.799739 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25405] 10:12:33.799759 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.799802 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25399] 10:12:33.799823 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25406] 10:12:33.799848 <... write resumed> ) = 4
[pid 25405] 10:12:33.799866 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.799882 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25399] 10:12:33.799901 read(13,  <unfinished ...>
[pid 25406] 10:12:33.799932 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25405] 10:12:33.799958 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.799986 getgroups(65536,  <unfinished ...>
[pid 25406] 10:12:33.800012 <... write resumed> ) = 4
[pid 25405] 10:12:33.800025 <... open resumed> ) = 6
[pid 25399] 10:12:33.800039 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25406] 10:12:33.800063 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25405] 10:12:33.800085 read(6,  <unfinished ...>
[pid 25404] 10:12:33.800106 <... getgroups resumed> [12]) = 1
[pid 25399] 10:12:33.800121 read(13,  <unfinished ...>
[pid 25406] 10:12:33.800155 <... write resumed> ) = 4
[pid 25405] 10:12:33.800169 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.800190 setgroups(0, [] <unfinished ...>
[pid 25399] 10:12:33.800214 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25406] 10:12:33.800239 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25405] 10:12:33.800268 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.800294 <... setgroups resumed> ) = 0
[pid 25399] 10:12:33.800308 read(13,  <unfinished ...>
[pid 25406] 10:12:33.800343 <... write resumed> ) = 40
[pid 25405] 10:12:33.800358 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25404] 10:12:33.800387 getegid( <unfinished ...>
[pid 25399] 10:12:33.800410 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25406] 10:12:33.800516 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25405] 10:12:33.800541 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.800567 <... getegid resumed> ) = 12
[pid 25399] 10:12:33.800581 read(13,  <unfinished ...>
[pid 25406] 10:12:33.800611 <... write resumed> ) = 4
[pid 25405] 10:12:33.800623 <... mmap resumed> ) = 0x7ff345e7f000
[pid 25404] 10:12:33.800638 geteuid( <unfinished ...>
[pid 25399] 10:12:33.800665 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25406] 10:12:33.800688 close(14 <unfinished ...>
[pid 25405] 10:12:33.800710 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.800737 <... geteuid resumed> ) = 0
[pid 25399] 10:12:33.800751 wait4(-1,  <unfinished ...>
[pid 25406] 10:12:33.800784 <... close resumed> ) = 0
[pid 25405] 10:12:33.800797 <... mmap resumed> ) = 0x7ff3431df000
[pid 25404] 10:12:33.800823 geteuid( <unfinished ...>
[pid 25406] 10:12:33.800849 exit_group(0) = ?
[pid 25405] 10:12:33.800863 mprotect(0x7ff34320b000, 2097152, PROT_NONE <unfinished ...>
[pid 25406] 10:12:33.801150 +++ exited with 0 +++
[pid 25405] 10:12:33.801163 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.801176 <... geteuid resumed> ) = 0
[pid 25399] 10:12:33.801191 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25406
[pid 25405] 10:12:33.801216 mmap(0x7ff34340b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25404] 10:12:33.801243 getegid( <unfinished ...>
[pid 25399] 10:12:33.801270 close(13 <unfinished ...>
[pid 25405] 10:12:33.801301 <... mmap resumed> ) = 0x7ff34340b000
[pid 25404] 10:12:33.801314 <... getegid resumed> ) = 12
[pid 25399] 10:12:33.801334 <... close resumed> ) = 0
[pid 25405] 10:12:33.801362 close(6 <unfinished ...>
[pid 25404] 10:12:33.801385 setgid(12 <unfinished ...>
[pid 25399] 10:12:33.801406 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25405] 10:12:33.801503 <... close resumed> ) = 0
[pid 25404] 10:12:33.801518 <... setgid resumed> ) = 0
[pid 25399] 10:12:33.801540 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25405] 10:12:33.801594 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.801629 setuid(0 <unfinished ...>
[pid 25399] 10:12:33.801651 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.801682 <... open resumed> ) = 6
[pid 25404] 10:12:33.801695 <... setuid resumed> ) = 0
[pid 25399] 10:12:33.801709 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.801793 read(6,  <unfinished ...>
[pid 25404] 10:12:33.801820 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.801848 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.801879 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.801898 <... open resumed> ) = 6
[pid 25399] 10:12:33.801914 <... open resumed> ) = 9
[pid 25405] 10:12:33.801954 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.801978 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.801999 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.802025 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:33.802051 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.802077 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.802120 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.802151 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.802173 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.802199 <... mmap resumed> ) = 0x7ff342fda000
[pid 25404] 10:12:33.802213 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:33.802239 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.802276 mprotect(0x7ff342fdf000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.802303 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.802328 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.802359 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.802372 <... mmap resumed> ) = 0x7fb3682ba000
[pid 25399] 10:12:33.802386 <... mmap resumed> ) = 0x7f54cb355000
[pid 25405] 10:12:33.802409 mmap(0x7ff3431de000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25404] 10:12:33.802545 read(6,  <unfinished ...>
[pid 25399] 10:12:33.802582 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.802613 <... mmap resumed> ) = 0x7ff3431de000
[pid 25404] 10:12:33.802626 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25399] 10:12:33.802651 <... lseek resumed> ) = 0
[pid 25405] 10:12:33.802784 close(6 <unfinished ...>
[pid 25404] 10:12:33.802812 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.802840 read(9,  <unfinished ...>
[pid 25405] 10:12:33.802871 <... close resumed> ) = 0
[pid 25404] 10:12:33.802884 <... socket resumed> ) = 7
[pid 25399] 10:12:33.802908 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25405] 10:12:33.802954 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.802987 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.803021 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.803052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.803066 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.803082 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.803127 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.803160 close(7 <unfinished ...>
[pid 25399] 10:12:33.803184 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.803214 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.803228 <... close resumed> ) = 0
[pid 25399] 10:12:33.803243 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.803309 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.803343 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.803371 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25405] 10:12:33.803407 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.803506 <... socket resumed> ) = 7
[pid 25399] 10:12:33.803526 <... stat resumed> 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.803556 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.803586 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.803624 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.803657 <... open resumed> ) = 6
[pid 25404] 10:12:33.803670 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.803686 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.803730 read(6,  <unfinished ...>
[pid 25404] 10:12:33.803760 close(7 <unfinished ...>
[pid 25399] 10:12:33.803789 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.803825 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.803845 <... close resumed> ) = 0
[pid 25399] 10:12:33.803860 <... open resumed> ) = 10
[pid 25405] 10:12:33.803890 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.803913 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.803939 fstat(10,  <unfinished ...>
[pid 25405] 10:12:33.804036 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25404] 10:12:33.804064 <... open resumed> ) = 7
[pid 25399] 10:12:33.804081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.804121 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.804152 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.804174 fstat(10,  <unfinished ...>
[pid 25405] 10:12:33.804200 <... mmap resumed> ) = 0x7ff342dd7000
[pid 25404] 10:12:33.804214 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25399] 10:12:33.804240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.804272 mprotect(0x7ff342dd9000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.804298 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.804322 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.804350 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.804365 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25399] 10:12:33.804379 <... mmap resumed> ) = 0x7f54cb354000
[pid 25405] 10:12:33.804401 mmap(0x7ff342fd8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25404] 10:12:33.804501 read(7,  <unfinished ...>
[pid 25399] 10:12:33.804533 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.804562 <... mmap resumed> ) = 0x7ff342fd8000
[pid 25404] 10:12:33.804576 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25399] 10:12:33.804610 <... lseek resumed> ) = 0
[pid 25405] 10:12:33.804650 close(6 <unfinished ...>
[pid 25404] 10:12:33.804673 read(7,  <unfinished ...>
[pid 25399] 10:12:33.804694 read(10,  <unfinished ...>
[pid 25405] 10:12:33.804723 <... close resumed> ) = 0
[pid 25404] 10:12:33.804736 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:33.804760 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25405] 10:12:33.804813 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.804847 close(7 <unfinished ...>
[pid 25399] 10:12:33.804870 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25405] 10:12:33.804903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.804917 <... close resumed> ) = 0
[pid 25399] 10:12:33.804932 <... open resumed> ) = 11
[pid 25405] 10:12:33.804955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.804987 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25399] 10:12:33.805013 fstat(11,  <unfinished ...>
[pid 25405] 10:12:33.805041 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.805054 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.805069 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.805118 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.805147 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.805174 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.805204 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.805217 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.805234 <... mmap resumed> ) = 0x7f54cb353000
[pid 25405] 10:12:33.805257 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.805286 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.805316 read(11,  <unfinished ...>
[pid 25405] 10:12:33.805346 <... open resumed> ) = 6
[pid 25404] 10:12:33.805361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.805376 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.805500 read(6,  <unfinished ...>
[pid 25404] 10:12:33.805533 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.805564 close(11 <unfinished ...>
[pid 25405] 10:12:33.805592 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.805618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.805634 <... close resumed> ) = 0
[pid 25405] 10:12:33.805657 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.805679 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.805706 munmap(0x7f54cb353000, 4096 <unfinished ...>
[pid 25405] 10:12:33.805737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25404] 10:12:33.805763 <... open resumed> ) = 7
[pid 25399] 10:12:33.805779 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.805833 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.805863 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.805885 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.805918 <... mmap resumed> ) = 0x7ff345e7e000
[pid 25404] 10:12:33.805932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25399] 10:12:33.805962 <... open resumed> ) = 11
[pid 25405] 10:12:33.805985 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.806013 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25399] 10:12:33.806036 fstat(11,  <unfinished ...>
[pid 25405] 10:12:33.806063 <... mmap resumed> ) = 0x7ff342bb4000
[pid 25404] 10:12:33.806076 <... mmap resumed> ) = 0x7fb368299000
[pid 25399] 10:12:33.806090 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.806125 mprotect(0x7ff342bcb000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.806152 close(7 <unfinished ...>
[pid 25399] 10:12:33.806173 fstat(11,  <unfinished ...>
[pid 25405] 10:12:33.806199 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.806211 <... close resumed> ) = 0
[pid 25399] 10:12:33.806225 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.806266 mmap(0x7ff342dcb000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25404] 10:12:33.806294 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.806324 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.806353 <... mmap resumed> ) = 0x7ff342dcb000
[pid 25404] 10:12:33.806368 <... open resumed> ) = 7
[pid 25399] 10:12:33.806392 <... mmap resumed> ) = 0x7f54cb353000
[pid 25405] 10:12:33.806500 close(6 <unfinished ...>
[pid 25404] 10:12:33.806529 read(7,  <unfinished ...>
[pid 25399] 10:12:33.806552 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.806579 <... close resumed> ) = 0
[pid 25404] 10:12:33.806592 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.806643 <... lseek resumed> ) = 0
[pid 25405] 10:12:33.806668 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.806697 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.806721 read(11,  <unfinished ...>
[pid 25405] 10:12:33.806756 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.806771 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:33.806799 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25405] 10:12:33.806843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.806878 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25399] 10:12:33.806909 stat("/jail_owner",  <unfinished ...>
[pid 25405] 10:12:33.806939 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.806953 <... mmap resumed> ) = 0x7fb363c34000
[pid 25399] 10:12:33.806968 <... stat resumed> 0x7ffed9b0c3b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.806997 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.807026 mprotect(0x7fb363c40000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.807051 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25405] 10:12:33.807086 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.807099 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.807115 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25405] 10:12:33.807156 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.807187 mmap(0x7fb363e40000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25399] 10:12:33.807215 stat("/usr/local/cpanel/3rdparty/mailman/lists/evrc_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25405] 10:12:33.807251 <... open resumed> ) = 6
[pid 25404] 10:12:33.807264 <... mmap resumed> ) = 0x7fb363e40000
[pid 25399] 10:12:33.807279 <... stat resumed> 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.807318 read(6,  <unfinished ...>
[pid 25404] 10:12:33.807343 close(7 <unfinished ...>
[pid 25399] 10:12:33.807367 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25405] 10:12:33.807399 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.807509 <... close resumed> ) = 0
[pid 25399] 10:12:33.807531 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25405] 10:12:33.807602 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.807628 mprotect(0x7fb363e40000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.807654 stat("/usr/local/cpanel/3rdparty/mailman/lists/evrc/config.pck",  <unfinished ...>
[pid 25405] 10:12:33.807690 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25404] 10:12:33.807715 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.807732 <... stat resumed> 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.807763 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.807794 munmap(0x7fb368299000, 39387 <unfinished ...>
[pid 25399] 10:12:33.807820 stat("/etc/demouids",  <unfinished ...>
[pid 25405] 10:12:33.807852 <... mmap resumed> ) = 0x7ff342970000
[pid 25404] 10:12:33.807868 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.807881 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.807937 mprotect(0x7ff3429b1000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.807969 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.807998 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.808029 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.808044 <... open resumed> ) = 7
[pid 25399] 10:12:33.808057 <... open resumed> ) = 12
[pid 25405] 10:12:33.808085 mmap(0x7ff342bb1000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25404] 10:12:33.808115 fcntl(7, F_GETFD <unfinished ...>
[pid 25399] 10:12:33.808137 fstat(12,  <unfinished ...>
[pid 25405] 10:12:33.808163 <... mmap resumed> ) = 0x7ff342bb1000
[pid 25404] 10:12:33.808188 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25399] 10:12:33.808204 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.808245 close(6 <unfinished ...>
[pid 25404] 10:12:33.808268 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.808289 fstat(12,  <unfinished ...>
[pid 25405] 10:12:33.808317 <... close resumed> ) = 0
[pid 25404] 10:12:33.808341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.808366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.808398 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.808548 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.808575 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.808604 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.808622 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25399] 10:12:33.808635 <... mmap resumed> ) = 0x7f54cb352000
[pid 25405] 10:12:33.808657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.808689 read(7,  <unfinished ...>
[pid 25399] 10:12:33.808718 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.808746 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.808763 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.808780 <... lseek resumed> ) = 0
[pid 25405] 10:12:33.808823 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.808855 close(7 <unfinished ...>
[pid 25399] 10:12:33.808877 read(12,  <unfinished ...>
[pid 25405] 10:12:33.808904 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.808922 <... close resumed> ) = 0
[pid 25399] 10:12:33.808935 <... read resumed> "", 4096) = 0
[pid 25405] 10:12:33.808965 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.808998 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25399] 10:12:33.809024 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25405] 10:12:33.809057 <... open resumed> ) = 6
[pid 25404] 10:12:33.809072 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.809085 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25405] 10:12:33.809250 read(6,  <unfinished ...>
[pid 25404] 10:12:33.809283 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.809309 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.809340 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.809365 <... socket resumed> ) = 7
[pid 25399] 10:12:33.809379 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.809529 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.809561 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.809594 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.809627 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25404] 10:12:33.809656 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.809671 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.809711 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.809739 close(7 <unfinished ...>
[pid 25399] 10:12:33.809764 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25405] 10:12:33.809797 <... mmap resumed> ) = 0x7ff345e7d000
[pid 25404] 10:12:33.809823 <... close resumed> ) = 0
[pid 25399] 10:12:33.809838 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.809883 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.809914 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:33.809940 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.809975 <... mmap resumed> ) = 0x7ff342689000
[pid 25404] 10:12:33.809991 <... socket resumed> ) = 7
[pid 25399] 10:12:33.810004 <... open resumed> ) = 13
[pid 25405] 10:12:33.810026 mprotect(0x7ff342764000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.810053 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:33.810083 fstat(13,  <unfinished ...>
[pid 25405] 10:12:33.810110 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.810125 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.810139 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.810175 mmap(0x7ff342964000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25404] 10:12:33.810205 close(7 <unfinished ...>
[pid 25399] 10:12:33.810229 fstat(13,  <unfinished ...>
[pid 25405] 10:12:33.810256 <... mmap resumed> ) = 0x7ff342964000
[pid 25404] 10:12:33.810282 <... close resumed> ) = 0
[pid 25399] 10:12:33.810297 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25405] 10:12:33.810335 close(6 <unfinished ...>
[pid 25404] 10:12:33.810361 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.810388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.810497 <... close resumed> ) = 0
[pid 25404] 10:12:33.810526 <... open resumed> ) = 7
[pid 25399] 10:12:33.810541 <... mmap resumed> ) = 0x7f54cb351000
[pid 25405] 10:12:33.810565 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.810596 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.810617 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.810644 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.810661 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.810686 <... lseek resumed> ) = 0
[pid 25405] 10:12:33.810708 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.810740 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.810763 read(13,  <unfinished ...>
[pid 25405] 10:12:33.810794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.810811 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25399] 10:12:33.810824 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25405] 10:12:33.810862 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.810892 read(7,  <unfinished ...>
[pid 25399] 10:12:33.810916 read(13,  <unfinished ...>
[pid 25405] 10:12:33.810943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.810962 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.810979 <... read resumed> "", 4096) = 0
[pid 25405] 10:12:33.811033 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.811067 close(7 <unfinished ...>
[pid 25399] 10:12:33.811090 stat("/etc/userdomains",  <unfinished ...>
[pid 25405] 10:12:33.811119 <... open resumed> ) = 6
[pid 25404] 10:12:33.811139 <... close resumed> ) = 0
[pid 25399] 10:12:33.811154 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.811209 read(6,  <unfinished ...>
[pid 25404] 10:12:33.811236 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25399] 10:12:33.811262 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.811296 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.811319 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.811333 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25405] 10:12:33.811396 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.811530 read(6,  <unfinished ...>
[pid 25399] 10:12:33.811555 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.811587 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25404] 10:12:33.811617 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25399] 10:12:33.811635 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25405] 10:12:33.811734 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.811772 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:33.811799 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25405] 10:12:33.811831 <... mmap resumed> ) = 0x7ff342485000
[pid 25404] 10:12:33.811847 <... open resumed> ) = 7
[pid 25399] 10:12:33.811860 <... open resumed> ) = 14
[pid 25405] 10:12:33.811883 mprotect(0x7ff342488000, 2093056, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.811916 fstat(7,  <unfinished ...>
[pid 25399] 10:12:33.811938 fstat(14,  <unfinished ...>
[pid 25405] 10:12:33.811964 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.811979 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.812004 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.812036 mmap(0x7ff342687000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25404] 10:12:33.812065 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.812089 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25405] 10:12:33.812118 <... mmap resumed> ) = 0x7ff342687000
[pid 25404] 10:12:33.812143 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25399] 10:12:33.812158 <... mmap resumed> ) = 0x7f54cb350000
[pid 25405] 10:12:33.812180 close(6 <unfinished ...>
[pid 25404] 10:12:33.812202 read(7,  <unfinished ...>
[pid 25399] 10:12:33.812227 read(14,  <unfinished ...>
[pid 25405] 10:12:33.812257 <... close resumed> ) = 0
[pid 25404] 10:12:33.812280 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.812299 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.812337 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.812369 close(7 <unfinished ...>
[pid 25399] 10:12:33.812392 close(14 <unfinished ...>
[pid 25405] 10:12:33.812502 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.812523 <... close resumed> ) = 0
[pid 25399] 10:12:33.812536 <... close resumed> ) = 0
[pid 25405] 10:12:33.812558 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.812590 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25399] 10:12:33.812616 munmap(0x7f54cb350000, 4096 <unfinished ...>
[pid 25405] 10:12:33.812658 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.812676 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.812689 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.812726 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.812759 read(6,  <unfinished ...>
[pid 25399] 10:12:33.812781 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25405] 10:12:33.812812 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.812830 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25399] 10:12:33.812848 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25405] 10:12:33.812908 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.812942 uname( <unfinished ...>
[pid 25399] 10:12:33.812963 pipe( <unfinished ...>
[pid 25405] 10:12:33.812993 <... open resumed> ) = 6
[pid 25404] 10:12:33.813008 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25399] 10:12:33.813025 <... pipe resumed> [14, 15]) = 0
[pid 25405] 10:12:33.813078 read(6,  <unfinished ...>
[pid 25404] 10:12:33.813105 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25399] 10:12:33.813132 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25405] 10:12:33.813162 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.813185 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fb367170790}, 8) = 0
[pid 25399] 10:12:33.813201 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25405] 10:12:33.813236 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.813260 clone( <unfinished ...>
[pid 25399] 10:12:33.813557 close(12 <unfinished ...>
[pid 25405] 10:12:33.813596 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.813629 <... close resumed> ) = 0
[pid 25405] 10:12:33.813650 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25404] 10:12:33.813680 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25407
[pid 25399] 10:12:33.813696 munmap(0x7f54cb352000, 4096 <unfinished ...>
[pid 25405] 10:12:33.813756 <... mmap resumed> ) = 0x7ff342259000
[pid 25404] 10:12:33.813773 wait4(25407,  <unfinished ...>
[pid 25399] 10:12:33.813794 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.813814 mprotect(0x7ff342282000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:33.813841 close(9 <unfinished ...>
[pid 25405] 10:12:33.813868 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.813883 <... close resumed> ) = 0
[pid 25405] 10:12:33.813901 mmap(0x7ff342482000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25399] 10:12:33.813930 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25405] 10:12:33.813959 <... mmap resumed> ) = 0x7ff342482000
[pid 25399] 10:12:33.813980 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.814001 mmap(0x7ff342484000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.814028 close(11 <unfinished ...>
[pid 25405] 10:12:33.814056 <... mmap resumed> ) = 0x7ff342484000
[pid 25399] 10:12:33.814077 <... close resumed> ) = 0
[pid 25405] 10:12:33.814097 close(6 <unfinished ...>
[pid 25399] 10:12:33.814119 munmap(0x7f54cb353000, 4096 <unfinished ...>
[pid 25405] 10:12:33.814147 <... close resumed> ) = 0
[pid 25399] 10:12:33.814172 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.814194 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.814225 close(13 <unfinished ...>
[pid 25405] 10:12:33.814251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.814274 <... close resumed> ) = 0
[pid 25405] 10:12:33.814293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.814325 munmap(0x7f54cb351000, 4096 <unfinished ...>
[pid 25405] 10:12:33.814354 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.814370 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.814390 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.814489 close(10 <unfinished ...>
[pid 25405] 10:12:33.814520 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.814539 <... close resumed> ) = 0
[pid 25405] 10:12:33.814559 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.814590 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25405] 10:12:33.814619 <... open resumed> ) = 6
[pid 25399] 10:12:33.814635 <... munmap resumed> ) = 0
[pid 25405] 10:12:33.814655 read(6,  <unfinished ...>
[pid 25399] 10:12:33.814679 clone( <unfinished ...>
[pid 25405] 10:12:33.814956 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.814985 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.815008 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25408
[pid 25405] 10:12:33.815046 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25399] 10:12:33.815079 close(15 <unfinished ...>
[pid 25405] 10:12:33.815105 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:33.815132 <... close resumed> ) = 0
[pid 25405] 10:12:33.815151 <... mmap resumed> ) = 0x7ff345e7c000
[pid 25399] 10:12:33.815170 read(14,  <unfinished ...>
[pid 25405] 10:12:33.815194 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff342043000
[pid 25405] 10:12:33.815231 mprotect(0x7ff342058000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.815266 mmap(0x7ff342257000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7ff342257000
[pid 25405] 10:12:33.815312 close(6)    = 0
[pid 25405] 10:12:33.815364 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.815494 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.815544 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.815584 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25405] 10:12:33.815623 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.815668 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25405] 10:12:33.815715 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff341e38000
[pid 25405] 10:12:33.815754 mprotect(0x7ff341e42000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.815788 mmap(0x7ff342041000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7ff342041000
[pid 25405] 10:12:33.815832 close(6)    = 0
[pid 25405] 10:12:33.815874 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.815924 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.815982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.816023 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25405] 10:12:33.816062 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.816100 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25405] 10:12:33.816146 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff341c35000
[pid 25405] 10:12:33.816184 mprotect(0x7ff341c37000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.816218 mmap(0x7ff341e36000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7ff341e36000
[pid 25405] 10:12:33.816263 close(6)    = 0
[pid 25405] 10:12:33.816302 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e7b000
[pid 25405] 10:12:33.816354 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.816396 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.816548 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.816591 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25405] 10:12:33.816628 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.816666 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25405] 10:12:33.816712 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7ff341a16000
[pid 25405] 10:12:33.816758 mprotect(0x7ff341a33000, 2093056, PROT_NONE) = 0
[pid 25405] 10:12:33.816799 mmap(0x7ff341c32000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7ff341c32000
[pid 25405] 10:12:33.816843 mmap(0x7ff341c34000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff341c34000
[pid 25405] 10:12:33.816885 close(6)    = 0
[pid 25405] 10:12:33.816958 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e7a000
[pid 25405] 10:12:33.817035 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e79000
[pid 25405] 10:12:33.817079 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e77000
[pid 25405] 10:12:33.817117 arch_prctl(ARCH_SET_FS, 0x7ff345e777c0) = 0
[pid 25405] 10:12:33.817193 mprotect(0x7ff341c32000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817233 mprotect(0x7ff341e36000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817285 mprotect(0x7ff342041000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817327 mprotect(0x7ff342257000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817383 mprotect(0x7ff342482000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817514 mprotect(0x7ff342687000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817680 mprotect(0x7ff342964000, 40960, PROT_READ) = 0
[pid 25405] 10:12:33.817808 mprotect(0x7ff342bb1000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817854 mprotect(0x7ff342dcb000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.817950 mprotect(0x7ff342fd8000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.818200 mprotect(0x7ff3437c4000, 110592, PROT_READ) = 0
[pid 25405] 10:12:33.818311 mprotect(0x7ff343a50000, 16384, PROT_READ) = 0
[pid 25405] 10:12:33.818494 mprotect(0x7ff343de5000, 16384, PROT_READ) = 0
[pid 25405] 10:12:33.818541 mprotect(0x7ff343ff0000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.818589 mprotect(0x7ff3441f4000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819325 mprotect(0x7ff344f4c000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819385 mprotect(0x7ff345381000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819495 mprotect(0x7ff345605000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819543 mprotect(0x7ff34580e000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819594 mprotect(0x7ff345a53000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819637 mprotect(0x7ff345c6d000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819697 mprotect(0x7ff345e90000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.819736 munmap(0x7ff345e85000, 39387) = 0
[pid 25405] 10:12:33.819775 set_tid_address(0x7ff345e77a90) = 25405
[pid 25405] 10:12:33.819814 set_robust_list(0x7ff345e77aa0, 24) = 0
[pid 25405] 10:12:33.819845 futex(0x7ffdf7676ddc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25405] 10:12:33.819878 futex(0x7ffdf7676ddc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7ff345e777c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25405] 10:12:33.819918 rt_sigaction(SIGRTMIN, {0x7ff344d3ac60, [], SA_RESTORER|SA_SIGINFO, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.819957 rt_sigaction(SIGRT_1, {0x7ff344d3acf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.819993 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25405] 10:12:33.820036 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25405] 10:12:33.820107 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350369, f_bavail=6350369, f_files=1000000, f_ffree=691135, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25405] 10:12:33.820205 brk(0)      = 0x246b000
[pid 25405] 10:12:33.820240 brk(0x248c000) = 0x248c000
[pid 25405] 10:12:33.820286 open("/proc/filesystems", O_RDONLY) = 6
[pid 25405] 10:12:33.820344 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.820400 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8e000
[pid 25405] 10:12:33.820544 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25405] 10:12:33.820657 read(6, "", 1024) = 0
[pid 25405] 10:12:33.820697 close(6)    = 0
[pid 25405] 10:12:33.820734 munmap(0x7ff345e8e000, 4096) = 0
[pid 25405] 10:12:33.820816 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.820927 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.820981 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.821071 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.821115 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25405] 10:12:33.821154 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25405] 10:12:33.821192 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.821237 umask(0)    = 022
[pid 25405] 10:12:33.821307 geteuid()   = 0
[pid 25405] 10:12:33.821344 getuid()    = 503
[pid 25405] 10:12:33.821381 getgid()    = 499
[pid 25405] 10:12:33.821502 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25405] 10:12:33.821551 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25405] 10:12:33.821589 getgroups(65536, [500]) = 1
[pid 25405] 10:12:33.821637 setgroups(0, []) = 0
[pid 25405] 10:12:33.821675 getegid()   = 499
[pid 25405] 10:12:33.821708 geteuid()   = 0
[pid 25405] 10:12:33.821746 geteuid()   = 0
[pid 25405] 10:12:33.821778 getegid()   = 499
[pid 25405] 10:12:33.821810 setgid(499) = 0
[pid 25405] 10:12:33.821844 setuid(0)   = 0
[pid 25405] 10:12:33.821910 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25405] 10:12:33.821972 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.822026 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.822072 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8e000
[pid 25405] 10:12:33.822108 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25405] 10:12:33.822256 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25405] 10:12:33.822303 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.822355 close(7)    = 0
[pid 25405] 10:12:33.822392 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25405] 10:12:33.822511 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.822562 close(7)    = 0
[pid 25405] 10:12:33.822607 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25405] 10:12:33.822651 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25405] 10:12:33.822714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.822754 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25405] 10:12:33.822812 read(7, "", 4096) = 0
[pid 25405] 10:12:33.822850 close(7)    = 0
[pid 25405] 10:12:33.822885 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.822935 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.822979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.823022 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.823062 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25405] 10:12:33.823100 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25405] 10:12:33.823146 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7ff345e6d000
[pid 25405] 10:12:33.823182 close(7)    = 0
[pid 25405] 10:12:33.823221 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25405] 10:12:33.823261 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25405] 10:12:33.823301 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25405] 10:12:33.823348 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7ff341808000
[pid 25405] 10:12:33.823389 mprotect(0x7ff341814000, 2097152, PROT_NONE) = 0
[pid 25405] 10:12:33.823521 mmap(0x7ff341a14000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7ff341a14000
[pid 25405] 10:12:33.823573 close(7)    = 0
[pid 25405] 10:12:33.823625 mprotect(0x7ff341a14000, 4096, PROT_READ) = 0
[pid 25405] 10:12:33.823666 munmap(0x7ff345e6d000, 39387) = 0
[pid 25405] 10:12:33.823711 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25405] 10:12:33.823757 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25405] 10:12:33.823793 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.823838 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.823874 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.823931 close(7)    = 0
[pid 25405] 10:12:33.823965 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.824018 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25405] 10:12:33.824065 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.824115 close(7)    = 0
[pid 25405] 10:12:33.824150 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25405] 10:12:33.824184 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.824224 close(7)    = 0
[pid 25405] 10:12:33.824261 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25405] 10:12:33.824301 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.824346 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.824383 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.824522 close(7)    = 0
[pid 25405] 10:12:33.824564 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.824616 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25405] 10:12:33.824696 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25405] 10:12:33.824741 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.824786 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.824821 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.824864 close(7)    = 0
[pid 25405] 10:12:33.824898 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.824939 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25405] 10:12:33.824994 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25405] 10:12:33.825055 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790}, 8) = 0
[pid 25405] 10:12:33.825104 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff345e77a90) = 25409
[pid 25405] 10:12:33.825355 wait4(25409, Process 25408 attached
 <unfinished ...>
[pid 25408] 10:12:33.825510 set_robust_list(0x7f54cb33faa0, 24) = 0
[pid 25408] 10:12:33.825575 close(14)   = 0
[pid 25408] 10:12:33.825618 geteuid()   = 0
[pid 25408] 10:12:33.825654 getegid()   = 12
[pid 25408] 10:12:33.825688 setgid(500) = 0
[pid 25408] 10:12:33.825722 setuid(503) = 0
[pid 25408] 10:12:33.825785 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25408] 10:12:33.825836 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25408] 10:12:33.825915 brk(0x16cd000) = 0x16cd000
[pid 25408] 10:12:33.826018 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25408] 10:12:33.826069 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25408] 10:12:33.826108 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25408] 10:12:33.826157 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25408] 10:12:33.826201 close(9)    = 0
[pid 25408] 10:12:33.826236 munmap(0x7f54cb355000, 4096) = 0
[pid 25408] 10:12:33.826749 lseek(6, 19, SEEK_SET) = 19
[pid 25408] 10:12:33.826797 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2350) = 1858
[pid 25408] 10:12:33.827280 write(15, "\2\0\0\0", 4Process 25407 attached
 <unfinished ...>
[pid 25407] 10:12:33.827348 set_robust_list(0x7fb3682a3aa0, 24) = 0
[pid 25407] 10:12:33.827409 geteuid()   = 0
[pid 25407] 10:12:33.827520 geteuid()   = 0
[pid 25407] 10:12:33.827558 getegid()   = 12
[pid 25407] 10:12:33.827593 setgid(12)  = 0
[pid 25407] 10:12:33.827627 setuid(47)  = 0
[pid 25399] 10:12:33.828477 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25399] 10:12:33.828512 read(14,  <unfinished ...>
[pid 25408] 10:12:33.828542 <... write resumed> ) = 4
[pid 25408] 10:12:33.828561 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.828591 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25399] 10:12:33.828611 read(14,  <unfinished ...>
[pid 25408] 10:12:33.828638 <... write resumed> ) = 4
[pid 25408] 10:12:33.828656 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.828685 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.828707 read(14,  <unfinished ...>
[pid 25408] 10:12:33.828735 <... write resumed> ) = 4
[pid 25408] 10:12:33.828754 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25399] 10:12:33.828786 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25399] 10:12:33.828807 read(14,  <unfinished ...>
[pid 25408] 10:12:33.828834 <... write resumed> ) = 40
[pid 25408] 10:12:33.828852 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:33.828881 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.828902 wait4(-1,  <unfinished ...>
[pid 25408] 10:12:33.828930 <... write resumed> ) = 4
[pid 25408] 10:12:33.828948 close(15)   = 0
[pid 25408] 10:12:33.828992 exit_group(0) = ?
[pid 25408] 10:12:33.829248 +++ exited with 0 +++
[pid 25399] 10:12:33.829277 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25408
[pid 25399] 10:12:33.829301 close(14)   = 0
[pid 25399] 10:12:33.829339 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:33.829406 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.829551 open("/etc/userdomains", O_RDONLY) = 9
[pid 25399] 10:12:33.829603 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.829656 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.829704 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:33.829742 lseek(9, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.829777 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:33.829835 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.829897 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.829976 stat("/home/finest09/etc/finestweddingsites.com/evrc/filter", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.830030 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.830092 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25399] 10:12:33.830136 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.830187 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.830232 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb354000
[pid 25399] 10:12:33.830270 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.830305 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25399] 10:12:33.830351 read(10, "", 4096) = 0
[pid 25399] 10:12:33.830402 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25399] 10:12:33.830535 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.830585 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb353000
[pid 25399] 10:12:33.830622 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.830675 close(11)   = 0
[pid 25399] 10:12:33.830719 munmap(0x7f54cb353000, 4096) = 0
[pid 25399] 10:12:33.830778 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.830847 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25399] 10:12:33.830909 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.830980 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25399] 10:12:33.831025 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.831074 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.831119 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb353000
[pid 25399] 10:12:33.831156 lseek(11, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.831191 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25399] 10:12:33.831239 read(11, "", 4096) = 0
[pid 25399] 10:12:33.831284 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.831344 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:33.831497 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.831581 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.831645 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.831711 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.831768 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.831893 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.831934 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25399] 10:12:33.831985 read(10, "", 4096) = 0
[pid 25399] 10:12:33.832047 stat("/etc/vdomainaliases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25399] 10:12:33.832112 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY) = 12
[pid 25399] 10:12:33.832155 fstat(12, {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25399] 10:12:33.832202 fstat(12, {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25399] 10:12:33.832247 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb352000
[pid 25399] 10:12:33.832286 lseek(12, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.832320 read(12, "", 4096) = 0
[pid 25399] 10:12:33.832362 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.832511 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25399] 10:12:33.832560 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.832614 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb351000
[pid 25399] 10:12:33.832652 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.832704 close(13)   = 0
[pid 25399] 10:12:33.832741 munmap(0x7f54cb351000, 4096) = 0
[pid 25399] 10:12:33.832809 open("/etc/localdomains", O_RDONLY) = 13
[pid 25399] 10:12:33.832855 fstat(13, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.832904 fstat(13, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.832950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb351000
[pid 25399] 10:12:33.832987 lseek(13, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.833022 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25399] 10:12:33.833072 read(13, "", 4096) = 0
[pid 25399] 10:12:33.833116 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25399] 10:12:33.833180 stat("/usr/local/cpanel/3rdparty/mailman/lists/info_evrc.net/config.pck", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.833247 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.833310 open("/etc/demouids", O_RDONLY) = 14
[pid 25399] 10:12:33.833353 fstat(14, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.833401 fstat(14, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.833544 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb350000
[pid 25399] 10:12:33.833583 lseek(14, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.833617 read(14, "", 4096) = 0
[pid 25399] 10:12:33.833660 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:33.833827 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25399] 10:12:33.833879 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:33.833927 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:33.833965 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:33.834013 close(15)   = 0
[pid 25399] 10:12:33.834049 munmap(0x7f54cb34f000, 4096) = 0
[pid 25399] 10:12:33.834133 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25399] 10:12:33.834204 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25399] 10:12:33.834247 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.834293 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:33.834330 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.834385 close(15)   = 0
[pid 25399] 10:12:33.834518 munmap(0x7f54cb34f000, 4096) = 0
[pid 25399] 10:12:33.834570 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25399] 10:12:33.834615 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:33.834662 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:33.834699 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.834745 close(15)   = 0
[pid 25399] 10:12:33.834780 munmap(0x7f54cb34f000, 4096) = 0
[pid 25399] 10:12:33.834906 open("/etc/domainusers", O_RDONLY) = 15
[pid 25399] 10:12:33.834955 fstat(15, {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.835005 fstat(15, {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.835059 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:33.835097 lseek(15, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.835132 read(15, "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25399] 10:12:33.835174 read(15, "", 4096) = 0
[pid 25399] 10:12:33.835266 lseek(9, 353, SEEK_SET) = 353
[pid 25399] 10:12:33.835311 read(9, "", 4096) = 0
[pid 25399] 10:12:33.835365 lseek(9, 0, SEEK_SET) = 0
[pid 25399] 10:12:33.835405 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:33.835566 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com", 0x7f54c99f3880) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.835632 stat("/etc/email_send_limits", {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.835707 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY) = 16
[pid 25399] 10:12:33.835763 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b0beb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.835804 lseek(16, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.835840 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25399] 10:12:33.835887 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.835923 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25399] 10:12:33.835984 read(16, "0", 8192) = 1
[pid 25399] 10:12:33.836024 read(16, "", 8192) = 0
[pid 25399] 10:12:33.836061 close(16)   = 0
[pid 25399] 10:12:33.836148 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-09:23:11, st_ctime=2015/12/30-09:23:11}) = 0
[pid 25399] 10:12:33.836233 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:33.836297 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:33.836367 close(7)    = 0
[pid 25399] 10:12:33.836485 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:33.836542 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:33.836576 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.836610 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5362264, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.836657 write(7, "2015-12-30 10:12:33 [25399] 1aEJMX-0006bd-HC SMTP connection outbound 1451491953 1aEJMX-0006bd-HC finestweddingsites.com info@evrc.net\n", 135) = 135
[pid 25399] 10:12:33.836742 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666) = 16
[pid 25399] 10:12:33.836841 lseek(16, 0, SEEK_END) = 0
[pid 25399] 10:12:33.836886 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffed9b0beb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:33.836925 lseek(16, 0, SEEK_CUR) = 0
[pid 25399] 10:12:33.836960 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.837007 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:33.837051 write(16, "1", 1) = 1
[pid 25399] 10:12:33.837099 close(16)   = 0
[pid 25399] 10:12:33.837153 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.837206 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.837271 open("/etc/resolv.conf", O_RDONLY) = 16
[pid 25399] 10:12:33.837318 fstat(16, {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25399] 10:12:33.837373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34e000
[pid 25399] 10:12:33.837492 read(16, "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25399] 10:12:33.837550 read(16, "", 4096) = 0
[pid 25399] 10:12:33.837586 close(16)   = 0
[pid 25399] 10:12:33.837622 munmap(0x7f54cb34e000, 4096) = 0
[pid 25399] 10:12:33.837661 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25399] 10:12:33.837758 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25399] 10:12:33.837813 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16) = 0
[pid 25399] 10:12:33.837868 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25399] 10:12:33.837911 sendto(16, "\203\344\1\0\0\1\0\0\0\0\0\0\4evrc\3net\0\0\17\0\1", 26, MSG_NOSIGNAL, NULL, 0) = 26
[pid 25399] 10:12:33.837995 poll([{fd=16, events=POLLIN}], 1, 1000Process 25409 attached
 <unfinished ...>
[pid 25409] 10:12:33.838060 set_robust_list(0x7ff345e77aa0, 24) = 0
[pid 25409] 10:12:33.838121 geteuid()   = 0
[pid 25409] 10:12:33.838161 geteuid()   = 0
[pid 25409] 10:12:33.838195 getegid()   = 499
[pid 25409] 10:12:33.838230 setgid(12)  = 0
[pid 25409] 10:12:33.838264 setuid(47)  = 0
[pid 25407] 10:12:33.839851 brk(0x19ef000) = 0x19ef000
[pid 25407] 10:12:33.840887 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25409] 10:12:33.841299 brk(0x24ad000 <unfinished ...>
[pid 25407] 10:12:33.841337 <... open resumed> ) = 7
[pid 25407] 10:12:33.841364 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25407] 10:12:33.841478 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25407] 10:12:33.841537 read(7, "\"\367\17J\251@\5\336m\315gZr\354\304\r\317\3669LVn\277\207\325z\275\201\342\262p.\376]\26\257\256\2240\nn\204RCA\203\2\355", 48) = 48
[pid 25407] 10:12:33.841584 close(7)    = 0
[pid 25407] 10:12:33.841636 getuid()    = 47
[pid 25407] 10:12:33.841807 exit_group(0) = ?
[pid 25409] 10:12:33.841833 <... brk resumed> ) = 0x24ad000
[pid 25409] 10:12:33.842172 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25407] 10:12:33.842502 +++ exited with 0 +++
[pid 25404] 10:12:33.842522 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25407
[pid 25404] 10:12:33.842547 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.842613 getcwd("/var/spool/exim", 16380) = 16
[pid 25404] 10:12:33.842687 open("/etc/localtime", O_RDONLY) = 7
[pid 25404] 10:12:33.842729 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:33.842776 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:33.842827 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.842866 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25404] 10:12:33.842914 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25404] 10:12:33.842946 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25404] 10:12:33.842999 close(7)    = 0
[pid 25404] 10:12:33.843035 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.843084 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25404] 10:12:33.843129 fcntl(7, F_GETFD) = 0
[pid 25404] 10:12:33.843161 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.843192 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5362399, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.843238 write(7, "2015-12-30 10:12:33 [25404] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMX-0006bg-Lo\n", 92) = 92
[pid 25404] 10:12:33.843277 chdir("/var/spool/exim") = 0
[pid 25404] 10:12:33.843319 setgid(12)  = 0
[pid 25404] 10:12:33.843380 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25404] 10:12:33.843559 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25404] 10:12:33.843657 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25404] 10:12:33.843733 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25404] 10:12:33.843807 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25404] 10:12:33.843899 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25404] 10:12:33.844010 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25404] 10:12:33.844085 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25404] 10:12:33.844130 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.844176 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.844212 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.844264 close(8)    = 0
[pid 25404] 10:12:33.844298 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.844394 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25404] 10:12:33.844605 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25404] 10:12:33.844731 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25404] 10:12:33.844854 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25404] 10:12:33.844968 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25404] 10:12:33.845024 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25404] 10:12:33.845066 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.845114 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.845151 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.845201 close(8)    = 0
[pid 25404] 10:12:33.845236 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.845283 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25404] 10:12:33.845324 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.845372 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.845411 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.845554 close(8)    = 0
[pid 25404] 10:12:33.845590 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.845651 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25404] 10:12:33.845694 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.845740 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.845776 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.845829 close(8)    = 0
[pid 25404] 10:12:33.845864 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.845971 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25404] 10:12:33.846099 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25404] 10:12:33.846201 read(6, "", 4096) = 0
[pid 25404] 10:12:33.846241 read(6, "", 4096) = 0
[pid 25404] 10:12:33.846277 close(6)    = 0
[pid 25404] 10:12:33.846312 munmap(0x7fb3682ba000, 4096) = 0
[pid 25404] 10:12:33.846367 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb367170790}, NULL, 8) = 0
[pid 25404] 10:12:33.846509 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-D", O_RDWR|O_APPEND) = 6
[pid 25404] 10:12:33.846569 fcntl(6, F_GETFD) = 0
[pid 25404] 10:12:33.846604 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.846637 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25404] 10:12:33.846676 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.846731 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-H", O_RDONLY) = 8
[pid 25404] 10:12:33.846777 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=977, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.846823 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682ba000
[pid 25404] 10:12:33.846861 read(8, "1aEJMX-0006bg-Lo-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 977
[pid 25404] 10:12:33.846936 read(8, "", 4096) = 0
[pid 25404] 10:12:33.846976 close(8)    = 0
[pid 25404] 10:12:33.847011 munmap(0x7fb3682ba000, 4096) = 0
[pid 25404] 10:12:33.847052 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.847106 open("/var/spool/exim/msglog/X/1aEJMX-0006bg-Lo", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25404] 10:12:33.847153 fcntl(8, F_GETFD) = 0
[pid 25404] 10:12:33.847187 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.847224 fchown(8, 47, 12) = 0
[pid 25404] 10:12:33.847267 fchmod(8, 0640) = 0
[pid 25404] 10:12:33.847307 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25404] 10:12:33.847344 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064856, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.847392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682ba000
[pid 25404] 10:12:33.847511 lseek(8, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.847558 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.847620 pipe([9, 10]) = 0
[pid 25404] 10:12:33.847660 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [], SA_RESTORER, 0x7fb367170790}, 8) = 0
[pid 25404] 10:12:33.847704 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25410
[pid 25404] 10:12:33.847918 close(10)   = 0
[pid 25404] 10:12:33.847957 read(9,  <unfinished ...>
[pid 25409] 10:12:33.847991 <... open resumed> ) = 7
[pid 25409] 10:12:33.848017 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25409] 10:12:33.848070 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25409] 10:12:33.848114 read(7, "@\342\\\267\271\311=\315n\5fmq\357\361\246\322}\352\311c\246\304\316\344\200\333\214\t\317 \207\371\247=\231\261\237ey_j\3571*\336\324\215", 48) = 48
[pid 25409] 10:12:33.848158 close(7)    = 0
[pid 25409] 10:12:33.848208 getuid()    = 47
[pid 25409] 10:12:33.848374 exit_group(0) = ?
[pid 25409] 10:12:33.848672 +++ exited with 0 +++
[pid 25405] 10:12:33.848692 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25409
[pid 25405] 10:12:33.848717 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, 8) = 0
[pid 25405] 10:12:33.848779 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25405] 10:12:33.848853 open("/etc/localtime", O_RDONLY) = 7
[pid 25405] 10:12:33.848895 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.848941 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.848985 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.849021 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25405] 10:12:33.849117 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25405] 10:12:33.849151 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25405] 10:12:33.849204 close(7)    = 0
[pid 25405] 10:12:33.849239 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.849288 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25405] 10:12:33.849333 fcntl(7, F_GETFD) = 0
[pid 25405] 10:12:33.849367 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25405] 10:12:33.849399 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5362491, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.849535 write(7, "2015-12-30 10:12:33 [25405] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25405] 10:12:33.849586 chdir("/var/spool/exim") = 0
[pid 25405] 10:12:33.849627 geteuid()   = 0
[pid 25405] 10:12:33.849659 getegid()   = 499
[pid 25405] 10:12:33.849703 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.849746 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.849792 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.849828 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.849874 close(8)    = 0
[pid 25405] 10:12:33.849908 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.849948 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25405] 10:12:33.849991 read(8, "65536\n", 31) = 6
[pid 25405] 10:12:33.850027 close(8)    = 0
[pid 25405] 10:12:33.850064 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.850105 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.850150 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.850185 lseek(8, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.850219 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.850268 read(8, "", 4096) = 0
[pid 25405] 10:12:33.850305 close(8)    = 0
[pid 25405] 10:12:33.850338 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.850378 setgroups(1, [12]) = 0
[pid 25405] 10:12:33.850494 setgid(12)  = 0
[pid 25405] 10:12:33.850538 setuid(47)  = 0
[pid 25405] 10:12:33.850597 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25405] 10:12:33.850683 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25405] 10:12:33.850767 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25405] 10:12:33.850847 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25405] 10:12:33.850925 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25405] 10:12:33.851015 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25405] 10:12:33.851127 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25405] 10:12:33.851198 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.851241 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.851288 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.851324 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.851371 close(8)    = 0
[pid 25405] 10:12:33.851406 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.851589 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25405] 10:12:33.851687 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25405] 10:12:33.851808 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25405] 10:12:33.851930 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25405] 10:12:33.852044 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25405] 10:12:33.852100 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.852142 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.852194 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.852231 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.852280 close(8)    = 0
[pid 25405] 10:12:33.852314 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.852359 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.852400 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.852520 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.852556 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.852605 close(8)    = 0
[pid 25405] 10:12:33.852639 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.852697 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.852740 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25405] 10:12:33.852792 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.852829 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25405] 10:12:33.852883 close(8)    = 0
[pid 25405] 10:12:33.852922 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.853026 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25405] 10:12:33.853155 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25405] 10:12:33.853253 read(6, "", 4096) = 0
[pid 25405] 10:12:33.853292 read(6, "", 4096) = 0
[pid 25405] 10:12:33.853327 close(6)    = 0
[pid 25405] 10:12:33.853363 munmap(0x7ff345e8e000, 4096) = 0
[pid 25405] 10:12:33.853403 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25405] 10:12:33.853519 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.853567 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8e000
[pid 25405] 10:12:33.853604 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.853654 close(6)    = 0
[pid 25405] 10:12:33.853692 munmap(0x7ff345e8e000, 4096) = 0
[pid 25405] 10:12:33.853753 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.853815 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.853867 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25405] 10:12:33.853908 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25405] 10:12:33.853947 fstat(0, {st_dev=makedev(0, 8), st_ino=2130165679, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.853992 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8e000
[pid 25405] 10:12:33.854027 read(0, "To:  salesadmin@phoenixmarriottmesa.com, rivankovich@phoenixmarriottmesa.com, phoenixmarriottmesa@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\n"..., 4096) = 2142
[pid 25405] 10:12:33.854128 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.854197 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25405] 10:12:33.854274 fchown(6, 47, 12) = 0
[pid 25405] 10:12:33.854314 fchmod(6, 0640) = 0
[pid 25405] 10:12:33.854351 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25405] 10:12:33.854387 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.854521 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8d000
[pid 25405] 10:12:33.854561 lseek(6, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.854593 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25405] 10:12:33.854686 read(0, "", 4096) = 0
[pid 25405] 10:12:33.854721 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.854758 write(6, "1aEJMX-0006bl-RX-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25405] 10:12:33.854805 fsync(6Process 25410 attached
 <unfinished ...>
[pid 25410] 10:12:33.854890 set_robust_list(0x7fb3682a3aa0, 24) = 0
[pid 25410] 10:12:33.854993 close(9)    = 0
[pid 25410] 10:12:33.855033 geteuid()   = 0
[pid 25410] 10:12:33.855065 getegid( <unfinished ...>
[pid 25405] 10:12:33.855085 <... fsync resumed> ) = 0
[pid 25405] 10:12:33.855120 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.855204 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.855342 brk(0x24ad000) = 0x24ad000
[pid 25405] 10:12:33.855411 getuid()    = 47
[pid 25405] 10:12:33.855527 geteuid()   = 47
[pid 25405] 10:12:33.855561 getgid()    = 12
[pid 25405] 10:12:33.855593 getegid()   = 12
[pid 25405] 10:12:33.855702 open("/dev/urandom", O_RDONLY) = 8
[pid 25405] 10:12:33.855747 read(8, "b#\347\201", 4) = 4
[pid 25405] 10:12:33.855783 close(8)    = 0
[pid 25405] 10:12:33.855907 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25405] 10:12:33.856021 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7632070) = -1 EINVAL (Invalid argument)
[pid 25405] 10:12:33.856065 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25405] 10:12:33.856101 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7632070) = -1 EINVAL (Invalid argument)
[pid 25405] 10:12:33.856134 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25405] 10:12:33.856166 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7632080) = -1 EINVAL (Invalid argument)
[pid 25405] 10:12:33.856199 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25405] 10:12:33.856233 open("/dev/null", O_RDONLY) = 8
[pid 25405] 10:12:33.856273 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7632150) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.856306 lseek(8, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.856338 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25405] 10:12:33.856374 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff344d44790}, 8) = 0
[pid 25405] 10:12:33.856483 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff344d44790}, 8) = 0
[pid 25405] 10:12:33.856782 read(8, "", 8192) = 0
[pid 25405] 10:12:33.856828 close(8)    = 0
[pid 25405] 10:12:33.857069 brk(0x24ce000) = 0x24ce000
[pid 25405] 10:12:33.857220 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.857279 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25405] 10:12:33.857318 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631f80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.857354 lseek(8, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.857407 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25405] 10:12:33.858498 brk(0x24ef000) = 0x24ef000
[pid 25405] 10:12:33.858746 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25405] 10:12:33.859732 brk(0x2510000) = 0x2510000
[pid 25405] 10:12:33.860070 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25405] 10:12:33.861029 brk(0x2531000) = 0x2531000
[pid 25405] 10:12:33.861306 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25405] 10:12:33.861692 read(8, "", 8192) = 0
[pid 25405] 10:12:33.861741 close(8)    = 0
[pid 25405] 10:12:33.861793 stat("/usr/share/amavis/amavis-filter", 0x7ff34452b880) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.861840 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.861898 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.861946 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25405] 10:12:33.861985 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631f80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.862020 lseek(8, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.862068 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25405] 10:12:33.862604 stat("/etc/exim/perl/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862659 stat("/etc/exim/perl/warnings.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862698 stat("/usr/local/cpanel/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862736 stat("/usr/local/cpanel/warnings.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862774 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862818 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862859 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862897 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862940 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.862988 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.863028 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.863067 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.863120 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25405] 10:12:33.863162 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.863197 lseek(9, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.863238 brk(0x2552000) = 0x2552000
[pid 25405] 10:12:33.863283 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25405] 10:12:33.863700 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25410] 10:12:33.864428 <... getegid resumed> ) = 12
[pid 25410] 10:12:33.864511 setgid(494) = 0
[pid 25410] 10:12:33.864549 setuid(495) = 0
[pid 25410] 10:12:33.864606 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25410] 10:12:33.864660 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.864681 read(9,  <unfinished ...>
[pid 25410] 10:12:33.864701 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25405] 10:12:33.864734 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25410] 10:12:33.864798 fstat(9,  <unfinished ...>
[pid 25405] 10:12:33.864897 brk(0x2573000 <unfinished ...>
[pid 25410] 10:12:33.864923 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25410] 10:12:33.864957 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25410] 10:12:33.864995 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25410] 10:12:33.865037 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25410] 10:12:33.865078 close(9)    = 0
[pid 25405] 10:12:33.865113 <... brk resumed> ) = 0x2573000
[pid 25410] 10:12:33.865131 munmap(0x7fb3682b9000, 4096) = 0
[pid 25410] 10:12:33.865538 brk(0x19f0000) = 0x19f0000
[pid 25410] 10:12:33.865741 lseek(6, 19, SEEK_SET) = 19
[pid 25410] 10:12:33.865785 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2370) = 1858
[pid 25410] 10:12:33.866043 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25405] 10:12:33.866154 read(9, "", 8192) = 0
[pid 25405] 10:12:33.866196 close(9)    = 0
[pid 25404] 10:12:33.866475 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25404] 10:12:33.866516 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866539 <... write resumed> ) = 4
[pid 25410] 10:12:33.866557 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:33.866580 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25404] 10:12:33.866636 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866655 <... write resumed> ) = 4
[pid 25410] 10:12:33.866672 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:33.866693 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:33.866712 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866730 <... write resumed> ) = 4
[pid 25410] 10:12:33.866747 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25404] 10:12:33.866768 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25404] 10:12:33.866786 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866805 <... write resumed> ) = 4
[pid 25410] 10:12:33.866822 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:33.866842 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:33.866860 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866879 <... write resumed> ) = 4
[pid 25410] 10:12:33.866901 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25404] 10:12:33.866926 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25404] 10:12:33.866947 read(9,  <unfinished ...>
[pid 25410] 10:12:33.866966 <... write resumed> ) = 40
[pid 25410] 10:12:33.866983 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:33.867004 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:33.867025 wait4(-1,  <unfinished ...>
[pid 25410] 10:12:33.867045 <... write resumed> ) = 4
[pid 25410] 10:12:33.867061 close(10)   = 0
[pid 25410] 10:12:33.867101 exit_group(0) = ?
[pid 25410] 10:12:33.867304 +++ exited with 0 +++
[pid 25404] 10:12:33.867331 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25410
[pid 25404] 10:12:33.867353 close(9)    = 0
[pid 25404] 10:12:33.867389 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.867528 brk(0x19ef000) = 0x19ef000
[pid 25404] 10:12:33.867580 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25404] 10:12:33.867630 alarm(60)   = 0
[pid 25404] 10:12:33.867663 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25404] 10:12:33.867700 alarm(0)    = 60
[pid 25404] 10:12:33.867779 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.867826 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25404] 10:12:33.867870 read(10, "cpu  123038 1342355 395056 67343094 2509 0 0 0\ncpu0 123038 1342355 395056 67343094 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58189612\nbtime 1450798266\nprocesses 892888\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25404] 10:12:33.867928 close(10)   = 0
[pid 25404] 10:12:33.868021 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:33.868081 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25404] 10:12:33.868121 fcntl(10, F_GETFD) = 0
[pid 25404] 10:12:33.868152 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.868188 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25404] 10:12:33.868241 close(10)   = 0
[pid 25404] 10:12:33.868289 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.868329 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25404] 10:12:33.868505 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb368272000
[pid 25404] 10:12:33.868662 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25404] 10:12:33.868705 fcntl(10, F_GETFD) = 0
[pid 25404] 10:12:33.868736 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.868771 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:33.868852 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25404] 10:12:33.868947 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25404] 10:12:33.869005 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25404] 10:12:33.869071 close(10)   = 0
[pid 25404] 10:12:33.869131 munmap(0x7fb368272000, 200704) = 0
[pid 25404] 10:12:33.869195 close(9)    = 0
[pid 25404] 10:12:33.869250 open("/etc/localdomains", O_RDONLY) = 9
[pid 25404] 10:12:33.869295 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.869349 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.869395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.869521 lseek(9, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.869557 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25404] 10:12:33.869630 stat("/jail_owner", 0x7ffeeb782550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.869679 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:33.869744 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.869790 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:33.869845 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.869892 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.869955 open("/etc/demouids", O_RDONLY) = 10
[pid 25404] 10:12:33.869996 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.870041 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.870083 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b8000
[pid 25404] 10:12:33.870118 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.870149 read(10, "", 4096) = 0
[pid 25404] 10:12:33.870187 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:33.870335 getuid()    = 0
[pid 25404] 10:12:33.870376 geteuid()   = 0
[pid 25404] 10:12:33.870501 getgid()    = 12
[pid 25404] 10:12:33.870546 getegid()   = 12
[pid 25404] 10:12:33.870650 open("/dev/urandom", O_RDONLY) = 11
[pid 25404] 10:12:33.870695 read(11, "\343\364\273\362", 4) = 4
[pid 25404] 10:12:33.870733 close(11)   = 0
[pid 25404] 10:12:33.870849 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25404] 10:12:33.870954 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77cae0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.870996 lseek(0, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.871031 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77cae0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.871065 lseek(1, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.871097 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77caf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.871130 lseek(2, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.871163 open("/dev/null", O_RDONLY) = 11
[pid 25404] 10:12:33.871204 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77cbc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.871237 lseek(11, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.871269 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.871304 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.871649 brk(0x1a10000) = 0x1a10000
[pid 25404] 10:12:33.871705 read(11, "", 8192) = 0
[pid 25404] 10:12:33.871745 close(11)   = 0
[pid 25404] 10:12:33.872041 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.872104 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25404] 10:12:33.872143 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77c9f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.872179 lseek(11, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.872229 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25404] 10:12:33.873138 brk(0x1a31000) = 0x1a31000
[pid 25404] 10:12:33.873612 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25404] 10:12:33.874383 brk(0x1a52000) = 0x1a52000
[pid 25404] 10:12:33.874904 read(11, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25404] 10:12:33.875622 brk(0x1a73000) = 0x1a73000
[pid 25404] 10:12:33.876105 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25404] 10:12:33.876469 read(11, "", 8192) = 0
[pid 25404] 10:12:33.876526 close(11)   = 0
[pid 25404] 10:12:33.876582 stat("/usr/share/amavis/amavis-filter", 0x7fb366957880) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.876631 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.876683 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.876730 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25404] 10:12:33.876769 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77c9f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.876805 lseek(11, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.876854 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25404] 10:12:33.877154 brk(0x1a94000) = 0x1a94000
[pid 25404] 10:12:33.877360 stat("/etc/exim/perl/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877494 stat("/etc/exim/perl/warnings.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877544 stat("/usr/local/cpanel/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877584 stat("/usr/local/cpanel/warnings.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877623 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877669 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877713 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877752 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877791 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877831 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877878 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.877919 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.877974 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25404] 10:12:33.878018 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77c400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.878054 lseek(12, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.878107 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25405] 10:12:33.879037 read(8,  <unfinished ...>
[pid 25404] 10:12:33.879094 read(12, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25404] 10:12:33.879762 brk(0x1ab5000 <unfinished ...>
[pid 25405] 10:12:33.879800 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25404] 10:12:33.880430 <... brk resumed> ) = 0x1ab5000
[pid 25404] 10:12:33.880692 read(12, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25404] 10:12:33.881093 read(12,  <unfinished ...>
[pid 25405] 10:12:33.881295 read(8,  <unfinished ...>
[pid 25404] 10:12:33.881324 <... read resumed> "", 8192) = 0
[pid 25404] 10:12:33.881348 close(12)   = 0
[pid 25405] 10:12:33.881475 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25405] 10:12:33.882255 read(8,  <unfinished ...>
[pid 25404] 10:12:33.882952 read(11, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25405] 10:12:33.883471 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25405] 10:12:33.884089 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25405] 10:12:33.884682 brk(0x2594000 <unfinished ...>
[pid 25404] 10:12:33.884761 read(11, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25405] 10:12:33.885431 <... brk resumed> ) = 0x2594000
[pid 25405] 10:12:33.885980 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25404] 10:12:33.886565 read(11, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25404] 10:12:33.887115 brk(0x1ad6000 <unfinished ...>
[pid 25405] 10:12:33.887611 brk(0x25b5000 <unfinished ...>
[pid 25404] 10:12:33.887645 <... brk resumed> ) = 0x1ad6000
[pid 25404] 10:12:33.887742 read(11,  <unfinished ...>
[pid 25405] 10:12:33.887769 <... brk resumed> ) = 0x25b5000
[pid 25405] 10:12:33.887928 read(8,  <unfinished ...>
[pid 25404] 10:12:33.887957 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25405] 10:12:33.888430 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25405] 10:12:33.889050 read(8,  <unfinished ...>
[pid 25404] 10:12:33.889250 read(11, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25405] 10:12:33.889427 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25405] 10:12:33.890007 brk(0x25d6000 <unfinished ...>
[pid 25404] 10:12:33.890470 brk(0x1af7000) = 0x1af7000
[pid 25404] 10:12:33.890938 read(11,  <unfinished ...>
[pid 25405] 10:12:33.890970 <... brk resumed> ) = 0x25d6000
[pid 25405] 10:12:33.891127 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25404] 10:12:33.891428 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25405] 10:12:33.891921 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25405] 10:12:33.892951 brk(0x25f7000 <unfinished ...>
[pid 25404] 10:12:33.893046 read(11, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25405] 10:12:33.893476 <... brk resumed> ) = 0x25f7000
[pid 25405] 10:12:33.893832 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25404] 10:12:33.893902 brk(0x1b18000) = 0x1b18000
[pid 25404] 10:12:33.894203 read(11, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25405] 10:12:33.894477 <... stat resumed> 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894516 stat("/usr/local/cpanel/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894563 stat("/etc/exim/perl/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894600 stat("/etc/exim/perl/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894636 stat("/usr/local/cpanel/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894671 stat("/usr/local/cpanel/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894709 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894752 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894792 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894831 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894872 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894912 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894952 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.894990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.895047 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25405] 10:12:33.895091 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.895127 lseek(9, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.895551 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25405] 10:12:33.895786 lseek(9, 878, SEEK_SET) = 878
[pid 25405] 10:12:33.895829 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:33.896080 read(11,  <unfinished ...>
[pid 25405] 10:12:33.896108 <... lseek resumed> ) = 878
[pid 25405] 10:12:33.896129 close(9)    = 0
[pid 25405] 10:12:33.896382 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25404] 10:12:33.896504 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25404] 10:12:33.896886 brk(0x1b39000 <unfinished ...>
[pid 25405] 10:12:33.897341 read(8,  <unfinished ...>
[pid 25404] 10:12:33.897374 <... brk resumed> ) = 0x1b39000
[pid 25404] 10:12:33.897993 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25405] 10:12:33.898031 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25405] 10:12:33.898177 brk(0x2618000) = 0x2618000
[pid 25404] 10:12:33.898431 <... stat resumed> 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898544 stat("/usr/local/cpanel/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898595 stat("/etc/exim/perl/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898631 stat("/etc/exim/perl/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898684 stat("/usr/local/cpanel/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898721 stat("/usr/local/cpanel/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898758 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898798 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898837 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898875 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898914 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898952 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.898991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.899524 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.899586 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25404] 10:12:33.899629 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77c400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.899665 lseek(12, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.899718 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25404] 10:12:33.899942 lseek(12, 878, SEEK_SET) = 878
[pid 25404] 10:12:33.899983 lseek(12, 0, SEEK_CUR) = 878
[pid 25404] 10:12:33.900022 close(12)   = 0
[pid 25404] 10:12:33.900288 read(11, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25404] 10:12:33.900981 brk(0x1b5a000 <unfinished ...>
[pid 25405] 10:12:33.901411 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25405] 10:12:33.901728 brk(0x2639000 <unfinished ...>
[pid 25404] 10:12:33.901760 <... brk resumed> ) = 0x1b5a000
[pid 25404] 10:12:33.901885 read(11, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25405] 10:12:33.902430 <... brk resumed> ) = 0x2639000
[pid 25404] 10:12:33.904011 brk(0x1b7b000 <unfinished ...>
[pid 25405] 10:12:33.904256 read(8,  <unfinished ...>
[pid 25404] 10:12:33.904288 <... brk resumed> ) = 0x1b7b000
[pid 25404] 10:12:33.904472 read(11, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25405] 10:12:33.905481 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25405] 10:12:33.905612 brk(0x265a000) = 0x265a000
[pid 25405] 10:12:33.906392 stat("/usr/local/cpanel/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906537 stat("/usr/local/cpanel/Errno.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906582 stat("/etc/exim/perl/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906619 stat("/etc/exim/perl/Errno.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.906827 brk(0x1b9c000 <unfinished ...>
[pid 25405] 10:12:33.906858 stat("/usr/local/cpanel/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906898 stat("/usr/local/cpanel/Errno.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906936 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.906976 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.907016 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.907054 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.907094 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.907132 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25405] 10:12:33.907191 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25405] 10:12:33.907234 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.907269 lseek(9, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.907325 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25404] 10:12:33.907529 <... brk resumed> ) = 0x1b9c000
[pid 25404] 10:12:33.907779 read(11,  <unfinished ...>
[pid 25405] 10:12:33.907911 brk(0x267b000) = 0x267b000
[pid 25405] 10:12:33.908349 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25404] 10:12:33.908384 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25404] 10:12:33.909278 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25405] 10:12:33.909315 <... lseek resumed> ) = 4868
[pid 25405] 10:12:33.909337 lseek(9, 0, SEEK_CUR) = 4868
[pid 25405] 10:12:33.909372 close(9)    = 0
[pid 25405] 10:12:33.909488 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909542 stat("/usr/local/cpanel/Exporter.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909584 stat("/etc/exim/perl/Exporter.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909620 stat("/etc/exim/perl/Exporter.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909655 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909695 stat("/usr/local/cpanel/Exporter.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909733 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909772 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffdf7631ba0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffdf7631c40) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.909850 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25405] 10:12:33.909903 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25405] 10:12:33.909946 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf7631990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.909980 lseek(9, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.910026 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25404] 10:12:33.910501 <... stat resumed> 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.910596 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25404] 10:12:33.910624 stat("/usr/local/cpanel/Errno.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910668 stat("/etc/exim/perl/Errno.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910712 stat("/etc/exim/perl/Errno.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910749 stat("/usr/local/cpanel/Errno.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910784 stat("/usr/local/cpanel/Errno.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910821 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910860 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.910899 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.910937 <... lseek resumed> ) = 2366
[pid 25405] 10:12:33.910954 lseek(9, 0, SEEK_CUR) = 2366
[pid 25404] 10:12:33.910985 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25405] 10:12:33.911005 close(9 <unfinished ...>
[pid 25404] 10:12:33.911027 <... stat resumed> 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.911047 <... close resumed> ) = 0
[pid 25405] 10:12:33.911352 read(8,  <unfinished ...>
[pid 25404] 10:12:33.911386 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.911505 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:33.911563 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25404] 10:12:33.911605 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77c400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.911693 lseek(12, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.911755 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25404] 10:12:33.911876 brk(0x1bbd000) = 0x1bbd000
[pid 25404] 10:12:33.912382 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.912465 <... read resumed> "", 8192) = 0
[pid 25405] 10:12:33.912495 close(8)    = 0
[pid 25405] 10:12:33.912713 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25405] 10:12:33.912765 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25405] 10:12:33.912811 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8c000
[pid 25405] 10:12:33.912848 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25405] 10:12:33.912896 close(8)    = 0
[pid 25405] 10:12:33.912929 munmap(0x7ff345e8c000, 4096) = 0
[pid 25405] 10:12:33.913015 lseek(6, 19, SEEK_SET) = 19
[pid 25405] 10:12:33.913052 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913090 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913129 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913163 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913196 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913231 alarm(300)  = 0
[pid 25405] 10:12:33.913275 alarm(0)    = 300
[pid 25405] 10:12:33.913307 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913341 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790}, NULL, 8) = 0
[pid 25405] 10:12:33.913376 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790},  <unfinished ...>
[pid 25404] 10:12:33.913397 <... lseek resumed> ) = 4868
[pid 25405] 10:12:33.913480 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25405] 10:12:33.913506 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790},  <unfinished ...>
[pid 25404] 10:12:33.913530 lseek(12, 0, SEEK_CUR) = 4868
[pid 25405] 10:12:33.913563 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25405] 10:12:33.913580 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7ff344d44790},  <unfinished ...>
[pid 25404] 10:12:33.913602 close(12 <unfinished ...>
[pid 25405] 10:12:33.913620 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.913639 <... close resumed> ) = 0
[pid 25405] 10:12:33.913659 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0},  <unfinished ...>
[pid 25404] 10:12:33.913697 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25405] 10:12:33.913720 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, 8) = 0
[pid 25405] 10:12:33.913741 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, 8) = 0
[pid 25405] 10:12:33.913783 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:33.913835 <... stat resumed> 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.913866 open("/var/spool/exim/input/X/hdr.25405", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25404] 10:12:33.913889 stat("/usr/local/cpanel/Exporter.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.913928 stat("/etc/exim/perl/Exporter.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.914000 <... open resumed> ) = 8
[pid 25404] 10:12:33.914021 stat("/etc/exim/perl/Exporter.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.914059 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.914095 stat("/usr/local/cpanel/Exporter.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.914132 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.914171 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffeeb77c610) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.914208 fchown(8, 47, 12 <unfinished ...>
[pid 25404] 10:12:33.914229 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25405] 10:12:33.914254 <... fchown resumed> ) = 0
[pid 25404] 10:12:33.914276 <... stat resumed> 0x7ffeeb77c6b0) = -1 ENOENT (No such file or directory)
[pid 25405] 10:12:33.914295 fchmod(8, 0640 <unfinished ...>
[pid 25404] 10:12:33.914313 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25405] 10:12:33.914338 <... fchmod resumed> ) = 0
[pid 25404] 10:12:33.914360 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25405] 10:12:33.914397 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25404] 10:12:33.914514 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25405] 10:12:33.914542 fstat(8,  <unfinished ...>
[pid 25404] 10:12:33.914567 <... open resumed> ) = 12
[pid 25405] 10:12:33.914585 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.914615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8c000
[pid 25404] 10:12:33.914652 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25405] 10:12:33.914673 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:33.914691 <... ioctl resumed> , 0x7ffeeb77c400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25405] 10:12:33.914710 <... lseek resumed> ) = 0
[pid 25404] 10:12:33.914728 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25405] 10:12:33.914766 write(8, "1aEJMX-0006bl-RX-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 478 <unfinished ...>
[pid 25404] 10:12:33.914791 <... lseek resumed> ) = 0
[pid 25404] 10:12:33.914824 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25405] 10:12:33.914873 <... write resumed> ) = 478
[pid 25404] 10:12:33.915283 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25405] 10:12:33.915315 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=478, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.915379 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bl-RX; Wed, 30 Dec 2015 10:12:33 -0600\n121T To:  salesadmin@phoenixmarriottmesa.com, rivankovich@phoenix"..., 604) = 604
[pid 25405] 10:12:33.915501 fsync(8 <unfinished ...>
[pid 25404] 10:12:33.915565 <... lseek resumed> ) = 2366
[pid 25404] 10:12:33.915588 lseek(12, 0, SEEK_CUR) = 2366
[pid 25404] 10:12:33.915683 close(12)   = 0
[pid 25404] 10:12:33.915984 read(11,  <unfinished ...>
[pid 25405] 10:12:33.916013 <... fsync resumed> ) = 0
[pid 25405] 10:12:33.916033 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1082, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.916081 close(8)    = 0
[pid 25405] 10:12:33.916114 munmap(0x7ff345e8c000, 4096) = 0
[pid 25405] 10:12:33.916156 rename("/var/spool/exim/input/X/hdr.25405", "/var/spool/exim/input/X/1aEJMX-0006bl-RX-H") = 0
[pid 25405] 10:12:33.916219 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25405] 10:12:33.916259 fsync(8)    = 0
[pid 25405] 10:12:33.916292 close(8)    = 0
[pid 25405] 10:12:33.916325 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.916383 open("/var/spool/exim/msglog/X/1aEJMX-0006bl-RX", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25405] 10:12:33.916539 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25405] 10:12:33.916575 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.916619 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff345e8c000
[pid 25405] 10:12:33.916654 lseek(8, 0, SEEK_CUR) = 0
[pid 25405] 10:12:33.916687 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.916742 write(8, "2015-12-30 10:12:33 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2423 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25405] 10:12:33.916784 close(8)    = 0
[pid 25405] 10:12:33.916817 munmap(0x7ff345e8c000, 4096) = 0
[pid 25405] 10:12:33.916855 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.916910 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25405] 10:12:33.916959 close(7)    = 0
[pid 25405] 10:12:33.916995 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25405] 10:12:33.917036 fcntl(7, F_GETFD) = 0
[pid 25405] 10:12:33.917066 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25405] 10:12:33.917096 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5362592, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25405] 10:12:33.917138 write(7, "2015-12-30 10:12:33 [25405] 1aEJMX-0006bl-RX <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2423 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for salesadmin@phoenixmarriottmesa.com rivankovich@"..., 357) = 357
[pid 25405] 10:12:33.917179 close(6)    = 0
[pid 25405] 10:12:33.917213 munmap(0x7ff345e8d000, 4096) = 0
[pid 25405] 10:12:33.917247 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, 8) = 0
[pid 25405] 10:12:33.917286 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff343a8d6a0}, 8) = 0
[pid 25405] 10:12:33.917323 open("/proc/loadavg", O_RDONLY) = 6
[pid 25405] 10:12:33.917371 read(6, "0.02 0.05 0.00 2/242 25410\n", 40) = 27
[pid 25405] 10:12:33.917411 close(6)    = 0
[pid 25405] 10:12:33.917546 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff345e77a90) = 25411
[pid 25405] 10:12:33.918078 exit_group(0) = ?
[pid 25404] 10:12:33.918104 <... read resumed> "", 8192) = 0
[pid 25404] 10:12:33.918125 close(11)   = 0
[pid 25404] 10:12:33.918330 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.918400 open("/etc/userdomains", O_RDONLY) = 11
[pid 25404] 10:12:33.918498 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.918555 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25405] 10:12:33.918861 +++ exited with 0 +++
[pid 25389] 10:12:33.918896 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25405
[pid 25389] 10:12:33.918919 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:33.919041 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:33.919082 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25412
[pid 25389] 10:12:33.919555 close(5)    = 0
[pid 25389] 10:12:33.919591 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:33.919624 fstat(6, {st_dev=makedev(0, 8), st_ino=2130166173, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25389] 10:12:33.919669 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:33.919712 write(6, "To:  tracy.thompson@hilton.com, hiltongardeninn@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style typ"..., 2092) = 2092
[pid 25389] 10:12:33.919752 close(6)    = 0
[pid 25389] 10:12:33.919782 wait4(25412,  <unfinished ...>
[pid 25404] 10:12:33.919802 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b7000
[pid 25404] 10:12:33.919836 lseek(11, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.919868 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:33.919933 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25404] 10:12:33.919978 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.920023 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b6000
[pid 25404] 10:12:33.920057 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.920107 close(12)   = 0
[pid 25404] 10:12:33.920139 munmap(0x7fb3682b6000, 4096) = 0
[pid 25404] 10:12:33.920194 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.920256 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.920313 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25404] 10:12:33.920355 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.920408 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.920539 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b6000
[pid 25404] 10:12:33.920574 lseek(12, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.920606 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25404] 10:12:33.920651 read(12, "", 4096) = 0
[pid 25404] 10:12:33.920717 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2901, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25404] 10:12:33.920794 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY) = 13
[pid 25404] 10:12:33.920838 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffeeb77f4f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:33.920874 lseek(13, 0, SEEK_CUR) = 0
[pid 25404] 10:12:33.920909 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2901, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25404] 10:12:33.920953 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:33.921015 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2901
[pid 25404] 10:12:33.921553 read(13, "", 8192) = 0
[pid 25404] 10:12:33.921606 close(13)   = 0
[pid 25404] 10:12:33.921673 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.921745 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.921806 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.921880 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25404] 10:12:33.921924 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.921970 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b5000
[pid 25404] 10:12:33.922005 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.922055 close(13)   = 0
[pid 25404] 10:12:33.922088 munmap(0x7fb3682b5000, 4096) = 0
[pid 25404] 10:12:33.922138 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.922187 pipe([13, 14]) = 0
[pid 25404] 10:12:33.922223 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.922263 close(10)   = 0
[pid 25404] 10:12:33.922294 munmap(0x7fb3682b8000, 4096) = 0
[pid 25404] 10:12:33.922329 close(11)   = 0
[pid 25404] 10:12:33.922364 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:33.922398 close(12)   = 0
[pid 25404] 10:12:33.922517 munmap(0x7fb3682b6000, 4096) = 0
[pid 25404] 10:12:33.922557 close(9)    = 0
[pid 25404] 10:12:33.922610 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.922645 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25413
[pid 25404] 10:12:33.922953 close(14)   = 0
[pid 25404] 10:12:33.922987 read(13, Process 25412 attached
 <unfinished ...>
[pid 25412] 10:12:33.923037 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25412] 10:12:33.923086 close(6)    = 0
[pid 25412] 10:12:33.923119 dup2(5, 0)  = 0
[pid 25412] 10:12:33.923150 close(5)    = 0
[pid 25412] 10:12:33.923184 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25412] 10:12:33.923657 brk(0)      = 0x20b7000
[pid 25412] 10:12:33.923712 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dbb5000
[pid 25412] 10:12:33.923758 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.923809 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25412] 10:12:33.923847 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25412] 10:12:33.923894 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f851dbab000
[pid 25412] 10:12:33.923928 close(5)    = 0
[pid 25412] 10:12:33.923973 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25412] 10:12:33.924012 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.924052 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.924098 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f851d776000
[pid 25412] 10:12:33.924133 mprotect(0x7f851d793000, 2093056, PROT_NONE) = 0
[pid 25412] 10:12:33.924169 mmap(0x7f851d992000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f851d992000
[pid 25412] 10:12:33.924211 mmap(0x7f851d996000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f851d996000
[pid 25412] 10:12:33.924247 close(5)    = 0
[pid 25412] 10:12:33.924288 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25412] 10:12:33.924328 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.924367 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.924497 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f851d572000
[pid 25412] 10:12:33.924546 mprotect(0x7f851d574000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.924582 mmap(0x7f851d774000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f851d774000
[pid 25412] 10:12:33.924626 close(5)    = 0
[pid 25412] 10:12:33.924666 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25412] 10:12:33.924708 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.924746 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.924790 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dbaa000
[pid 25412] 10:12:33.924830 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f851d1de000
[pid 25412] 10:12:33.924865 mprotect(0x7f851d368000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.924900 mmap(0x7f851d568000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f851d568000
[pid 25412] 10:12:33.924946 mmap(0x7f851d56d000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f851d56d000
[pid 25412] 10:12:33.924988 close(5)    = 0
[pid 25412] 10:12:33.925041 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dba9000
[pid 25412] 10:12:33.925079 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dba8000
[pid 25412] 10:12:33.925114 arch_prctl(ARCH_SET_FS, 0x7f851dba9700) = 0
[pid 25412] 10:12:33.925244 mprotect(0x7f851d568000, 16384, PROT_READ) = 0
[pid 25412] 10:12:33.925287 mprotect(0x7f851d774000, 4096, PROT_READ) = 0
[pid 25412] 10:12:33.925370 mprotect(0x7f851dbb6000, 4096, PROT_READ) = 0
[pid 25412] 10:12:33.925411 munmap(0x7f851dbab000, 39387) = 0
[pid 25412] 10:12:33.925562 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.925608 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25412] 10:12:33.925659 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffd30048f0) = -1 EINVAL (Invalid argument)
[pid 25412] 10:12:33.925721 brk(0)      = 0x20b7000
[pid 25412] 10:12:33.925795 brk(0x20d8000) = 0x20d8000
[pid 25412] 10:12:33.925850 getuid()    = 503
[pid 25412] 10:12:33.925884 getgid()    = 500
[pid 25412] 10:12:33.925915 geteuid()   = 503
[pid 25412] 10:12:33.925945 getegid()   = 500
[pid 25412] 10:12:33.925983 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.926052 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
Process 25413 attached
[pid 25412] 10:12:33.926123 fstat(5,  <unfinished ...>
[pid 25413] 10:12:33.926154 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25412] 10:12:33.926176 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25412] 10:12:33.926208 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dbb4000
[pid 25413] 10:12:33.926243 <... set_robust_list resumed> ) = 0
[pid 25413] 10:12:33.926280 close(13 <unfinished ...>
[pid 25412] 10:12:33.926301 read(5, "MemTotal:        1048576 kB\nMemFree:          268024 kB\nCached:           326732 kB\nBuffers:               0 kB\nActive:           284500 kB\nInactive:         466968 kB\nActive(anon):     154936 kB\nInactive(anon):   277604 kB\nActive(file):     129564 kB\nInac"..., 1024) = 588
[pid 25413] 10:12:33.926369 <... close resumed> ) = 0
[pid 25413] 10:12:33.926394 geteuid()   = 0
[pid 25412] 10:12:33.926516 close(5 <unfinished ...>
[pid 25413] 10:12:33.926538 getegid()   = 12
[pid 25413] 10:12:33.926571 setgid(500) = 0
[pid 25413] 10:12:33.926608 setuid(503) = 0
[pid 25412] 10:12:33.926649 <... close resumed> ) = 0
[pid 25413] 10:12:33.926696 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.926720 munmap(0x7f851dbb4000, 4096) = 0
[pid 25412] 10:12:33.926791 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0},  <unfinished ...>
[pid 25413] 10:12:33.926823 <... open resumed> ) = 9
[pid 25413] 10:12:33.926847 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25413] 10:12:33.926924 brk(0x1bde000 <unfinished ...>
[pid 25412] 10:12:33.926946 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:33.926966 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.927002 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:33.927043 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.927079 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:33.927113 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.927149 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.927184 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.927223 uname( <unfinished ...>
[pid 25413] 10:12:33.927243 <... brk resumed> ) = 0x1bde000
[pid 25412] 10:12:33.927261 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25413] 10:12:33.927347 fstat(9,  <unfinished ...>
[pid 25412] 10:12:33.927496 getcwd("/home/finest09/public_html/includes", 4096) = 36
[pid 25412] 10:12:33.927550 getpid( <unfinished ...>
[pid 25413] 10:12:33.927571 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25413] 10:12:33.927603 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25412] 10:12:33.927639 <... getpid resumed> ) = 25412
[pid 25412] 10:12:33.927668 getppid( <unfinished ...>
[pid 25413] 10:12:33.927688 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25412] 10:12:33.927733 <... getppid resumed> ) = 25389
[pid 25412] 10:12:33.927762 stat(".",  <unfinished ...>
[pid 25413] 10:12:33.927782 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25413] 10:12:33.927824 close(9 <unfinished ...>
[pid 25412] 10:12:33.927845 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25413] 10:12:33.927876 <... close resumed> ) = 0
[pid 25412] 10:12:33.927902 stat("/bin/sh",  <unfinished ...>
[pid 25413] 10:12:33.927922 munmap(0x7fb3682b9000, 4096) = 0
[pid 25413] 10:12:33.928348 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.928382 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.928426 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.928536 geteuid()   = 503
[pid 25412] 10:12:33.928566 getegid()   = 500
[pid 25412] 10:12:33.928596 getuid()    = 503
[pid 25412] 10:12:33.928625 getgid()    = 500
[pid 25412] 10:12:33.928654 access("/bin/sh", X_OK) = 0
[pid 25412] 10:12:33.928689 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.928742 geteuid()   = 503
[pid 25412] 10:12:33.928773 getegid()   = 500
[pid 25412] 10:12:33.928802 getuid()    = 503
[pid 25412] 10:12:33.928831 getgid()    = 500
[pid 25412] 10:12:33.928859 access("/bin/sh", R_OK) = 0
[pid 25412] 10:12:33.928895 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.928940 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.928984 geteuid()   = 503
[pid 25412] 10:12:33.929013 getegid()   = 500
[pid 25412] 10:12:33.929042 getuid()    = 503
[pid 25412] 10:12:33.929071 getgid()    = 500
[pid 25412] 10:12:33.929099 access("/bin/sh", X_OK) = 0
[pid 25412] 10:12:33.929133 stat("/bin/sh", Process 25411 attached
{st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25412] 10:12:33.929199 geteuid( <unfinished ...>
[pid 25411] 10:12:33.929226 set_robust_list(0x7ff345e77aa0, 24 <unfinished ...>
[pid 25412] 10:12:33.929246 <... geteuid resumed> ) = 503
[pid 25412] 10:12:33.929263 getegid()   = 500
[pid 25412] 10:12:33.929292 getuid()    = 503
[pid 25412] 10:12:33.929322 getgid( <unfinished ...>
[pid 25411] 10:12:33.929340 <... set_robust_list resumed> ) = 0
[pid 25412] 10:12:33.929357 <... getgid resumed> ) = 500
[pid 25411] 10:12:33.929392 close(0 <unfinished ...>
[pid 25412] 10:12:33.929411 access("/bin/sh", R_OK) = 0
[pid 25412] 10:12:33.929536 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25411] 10:12:33.929563 <... close resumed> ) = 0
[pid 25412] 10:12:33.929586 <... socket resumed> ) = 5
[pid 25411] 10:12:33.929604 close(1)    = 0
[pid 25412] 10:12:33.929636 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25411] 10:12:33.929658 close(2 <unfinished ...>
[pid 25412] 10:12:33.929685 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.929706 <... close resumed> ) = 0
[pid 25411] 10:12:33.929769 setsid( <unfinished ...>
[pid 25412] 10:12:33.929794 close(5)    = 0
[pid 25412] 10:12:33.929835 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25412] 10:12:33.929869 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.929909 close(5)    = 0
[pid 25412] 10:12:33.929948 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25412] 10:12:33.929988 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.930008 <... setsid resumed> ) = 25411
[pid 25411] 10:12:33.930029 fstat(0,  <unfinished ...>
[pid 25412] 10:12:33.930048 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25412] 10:12:33.930078 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.930099 <... fstat resumed> 0x7ffdf76364c0) = -1 EBADF (Bad file descriptor)
[pid 25412] 10:12:33.930119 <... mmap resumed> ) = 0x7f851dbb4000
[pid 25411] 10:12:33.930140 open("/dev/null", O_RDWR <unfinished ...>
[pid 25412] 10:12:33.930161 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25411] 10:12:33.930212 <... open resumed> ) = 0
[pid 25412] 10:12:33.930244 read(5,  <unfinished ...>
[pid 25411] 10:12:33.930264 fstat(1, 0x7ffdf76364c0) = -1 EBADF (Bad file descriptor)
[pid 25411] 10:12:33.930303 dup2(0, 1 <unfinished ...>
[pid 25412] 10:12:33.930323 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.930342 close(5 <unfinished ...>
[pid 25411] 10:12:33.930360 <... dup2 resumed> ) = 1
[pid 25412] 10:12:33.930380 <... close resumed> ) = 0
[pid 25411] 10:12:33.930398 fstat(2, 0x7ffdf76364c0) = -1 EBADF (Bad file descriptor)
[pid 25412] 10:12:33.930516 munmap(0x7f851dbb4000, 4096 <unfinished ...>
[pid 25411] 10:12:33.930539 dup2(0, 2 <unfinished ...>
[pid 25412] 10:12:33.930562 <... munmap resumed> ) = 0
[pid 25411] 10:12:33.930580 <... dup2 resumed> ) = 2
[pid 25411] 10:12:33.930597 geteuid()   = 47
[pid 25412] 10:12:33.930636 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.930666 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25412] 10:12:33.930717 <... open resumed> ) = 5
[pid 25411] 10:12:33.930735 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25411] 10:12:33.930777 fstat(2,  <unfinished ...>
[pid 25412] 10:12:33.930795 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.930813 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25412] 10:12:33.930841 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25411] 10:12:33.930875 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMX-0006bl-RX"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25412] 10:12:33.930966 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f851dbab000
[pid 25412] 10:12:33.931002 close(5)    = 0
[pid 25412] 10:12:33.931548 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25412] 10:12:33.931593 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.931633 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.931683 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f851cfd0000
[pid 25412] 10:12:33.931721 mprotect(0x7f851cfdc000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.931757 mmap(0x7f851d1dc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7f851d1dc000
[pid 25412] 10:12:33.931804 close(5)    = 0
[pid 25412] 10:12:33.931851 mprotect(0x7f851d1dc000, 4096, PROT_READ) = 0
[pid 25412] 10:12:33.931890 munmap(0x7f851dbab000, 39387) = 0
[pid 25412] 10:12:33.931932 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25412] 10:12:33.931972 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25412] 10:12:33.932007 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:33.932051 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f851dbb4000
[pid 25412] 10:12:33.932085 read(5,  <unfinished ...>
[pid 25413] 10:12:33.932104 <... lseek resumed> ) = 19
[pid 25412] 10:12:33.932126 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25413] 10:12:33.932149 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2370) = 1858
[pid 25412] 10:12:33.932198 close(5)    = 0
[pid 25412] 10:12:33.932511 munmap(0x7f851dbb4000, 4096) = 0
[pid 25412] 10:12:33.932587 getpgrp()   = 29163
[pid 25412] 10:12:33.932621 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.932664 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25412] 10:12:33.932754 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.932798 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.932842 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25412] 10:12:33.932944 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0},  <unfinished ...>
[pid 25413] 10:12:33.933227 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.933252 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.933274 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f851d2106a0}, {SIG_IGN, [], SA_RESTORER, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.933309 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f851d2106a0}, 8) = 0
[pid 25412] 10:12:33.933347 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"]) = 0
[pid 25411] 10:12:33.933710 <... execve resumed> ) = 0
[pid 25411] 10:12:33.933747 brk(0)      = 0x19b7000
[pid 25411] 10:12:33.933782 fcntl(0, F_GETFD) = 0
[pid 25411] 10:12:33.933813 fcntl(1, F_GETFD) = 0
[pid 25411] 10:12:33.933842 fcntl(2, F_GETFD) = 0
[pid 25411] 10:12:33.933876 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.933928 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a2000
[pid 25412] 10:12:33.933977 brk(0 <unfinished ...>
[pid 25411] 10:12:33.934010 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25412] 10:12:33.934033 <... brk resumed> ) = 0x12d8000
[pid 25412] 10:12:33.934053 fcntl(0, F_GETFD <unfinished ...>
[pid 25411] 10:12:33.934074 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934092 <... fcntl resumed> ) = 0
[pid 25412] 10:12:33.934109 fcntl(1, F_GETFD <unfinished ...>
[pid 25411] 10:12:33.934135 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.934157 <... fcntl resumed> ) = 0
[pid 25412] 10:12:33.934174 fcntl(2, F_GETFD) = 0
[pid 25412] 10:12:33.934208 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25411] 10:12:33.934235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934255 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934289 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.934311 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.934348 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934388 <... mmap resumed> ) = 0x7f49e76b9000
[pid 25411] 10:12:33.934491 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25412] 10:12:33.934527 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25411] 10:12:33.934552 <... stat resumed> 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.934572 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.934594 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.934627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934657 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.934678 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.934714 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.934737 <... open resumed> ) = 5
[pid 25411] 10:12:33.934759 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934776 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.934794 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25412] 10:12:33.934814 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25411] 10:12:33.934847 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25412] 10:12:33.934876 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f49e76af000
[pid 25411] 10:12:33.934911 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.934954 close(5)    = 0
[pid 25412] 10:12:33.934993 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.935013 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25404] 10:12:33.935039 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25404] 10:12:33.935059 read(13,  <unfinished ...>
[pid 25411] 10:12:33.935083 <... stat resumed> 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25413] 10:12:33.935101 <... write resumed> ) = 4
[pid 25412] 10:12:33.935124 <... open resumed> ) = 5
[pid 25413] 10:12:33.935146 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:33.935166 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.935207 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25404] 10:12:33.935226 read(13,  <unfinished ...>
[pid 25412] 10:12:33.935245 read(5,  <unfinished ...>
[pid 25413] 10:12:33.935262 <... write resumed> ) = 4
[pid 25412] 10:12:33.935280 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25413] 10:12:33.935309 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.935331 fstat(5,  <unfinished ...>
[pid 25404] 10:12:33.935355 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:33.935377 read(13,  <unfinished ...>
[pid 25411] 10:12:33.935399 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25413] 10:12:33.935510 <... write resumed> ) = 4
[pid 25411] 10:12:33.935536 <... stat resumed> 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.935556 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25413] 10:12:33.935588 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25412] 10:12:33.935614 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25404] 10:12:33.935643 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25404] 10:12:33.935667 read(13,  <unfinished ...>
[pid 25413] 10:12:33.935686 <... write resumed> ) = 40
[pid 25412] 10:12:33.935706 <... mmap resumed> ) = 0x7f49e7107000
[pid 25411] 10:12:33.935725 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25413] 10:12:33.935745 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:33.935772 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.935793 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:33.935876 wait4(-1,  <unfinished ...>
[pid 25412] 10:12:33.935902 mprotect(0x7f49e7291000, 2097152, PROT_NONE <unfinished ...>
[pid 25413] 10:12:33.935922 <... write resumed> ) = 4
[pid 25412] 10:12:33.935942 <... mprotect resumed> ) = 0
[pid 25413] 10:12:33.935961 close(14)   = 0
[pid 25413] 10:12:33.936002 exit_group(0) = ?
[pid 25412] 10:12:33.936021 mmap(0x7f49e7491000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25411] 10:12:33.936042 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25412] 10:12:33.936067 <... mmap resumed> ) = 0x7f49e7491000
[pid 25411] 10:12:33.936090 <... stat resumed> 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936114 mmap(0x7f49e7496000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.936136 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936387 <... mmap resumed> ) = 0x7f49e7496000
[pid 25411] 10:12:33.936466 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25412] 10:12:33.936503 close(5 <unfinished ...>
[pid 25411] 10:12:33.936531 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.936562 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.936583 <... close resumed> ) = 0
[pid 25411] 10:12:33.936605 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936636 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.936657 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.936694 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.936721 <... mmap resumed> ) = 0x7f49e76ae000
[pid 25411] 10:12:33.936744 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936766 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.936787 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936825 <... mmap resumed> ) = 0x7f49e76ad000
[pid 25412] 10:12:33.936844 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.936864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.936903 <... mmap resumed> ) = 0x7f49e76ac000
[pid 25412] 10:12:33.936923 arch_prctl(ARCH_SET_FS, 0x7f49e76ad700 <unfinished ...>
[pid 25411] 10:12:33.936942 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25412] 10:12:33.936961 <... arch_prctl resumed> ) = 0
[pid 25411] 10:12:33.937113 <... stat resumed> 0x7ffdf4a94cd0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.937197 mprotect(0x7f49e7491000, 16384, PROT_READ <unfinished ...>
[pid 25411] 10:12:33.937220 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.937261 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.937312 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25411] 10:12:33.937348 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25411] 10:12:33.937393 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f8169298000
[pid 25411] 10:12:33.937511 close(6)    = 0
[pid 25411] 10:12:33.937551 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25411] 10:12:33.937591 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.937630 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.937652 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.937670 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.937701 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.937726 mprotect(0x7f49e76ba000, 4096, PROT_READ <unfinished ...>
[pid 25411] 10:12:33.937748 <... mmap resumed> ) = 0x7f8168e6a000
[pid 25411] 10:12:33.937765 mprotect(0x7f8168e80000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.937786 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.937805 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.937823 munmap(0x7f49e76af000, 39387 <unfinished ...>
[pid 25411] 10:12:33.937841 mmap(0x7f8169080000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25412] 10:12:33.937867 <... munmap resumed> ) = 0
[pid 25411] 10:12:33.937888 <... mmap resumed> ) = 0x7f8169080000
[pid 25411] 10:12:33.937916 mmap(0x7f8169082000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.937965 getuid( <unfinished ...>
[pid 25411] 10:12:33.937987 <... mmap resumed> ) = 0x7f8169082000
[pid 25411] 10:12:33.938011 close(6)    = 0
[pid 25411] 10:12:33.938049 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.938089 <... getuid resumed> ) = 503
[pid 25412] 10:12:33.938108 getgid( <unfinished ...>
[pid 25411] 10:12:33.938126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.938146 <... getgid resumed> ) = 500
[pid 25411] 10:12:33.938169 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.938188 getegid()   = 499
[pid 25412] 10:12:33.938218 getppid()   = 25389
[pid 25411] 10:12:33.938249 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.938270 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25411] 10:12:33.938295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.938320 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:33.938354 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.938492 brk(0 <unfinished ...>
[pid 25411] 10:12:33.938524 <... open resumed> ) = 6
[pid 25411] 10:12:33.938543 read(6,  <unfinished ...>
[pid 25413] 10:12:33.938600 +++ exited with 0 +++
[pid 25404] 10:12:33.938625 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25413
[pid 25404] 10:12:33.938646 close(13)   = 0
[pid 25404] 10:12:33.938681 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.938742 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.938805 open("/etc/userdomains", O_RDONLY) = 9
[pid 25404] 10:12:33.938845 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.938892 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.938935 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:33.938970 lseek(9, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.939002 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:33.939057 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.939115 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.939198 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.939249 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.939308 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25404] 10:12:33.939350 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.939395 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.939539 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b8000
[pid 25404] 10:12:33.939574 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.939606 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25404] 10:12:33.939669 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25404] 10:12:33.939713 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.939767 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b7000
[pid 25404] 10:12:33.939803 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.939852 close(11)   = 0
[pid 25404] 10:12:33.939886 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:33.939952 open("/etc/localdomains", O_RDONLY) = 11
[pid 25404] 10:12:33.939995 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.940041 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.940084 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b7000
[pid 25404] 10:12:33.940118 lseek(11, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.940149 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25404] 10:12:33.940200 stat("/jail_owner", 0x7ffeeb782550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.940244 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:33.940302 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassyphxnorth_finestweddingsites.com/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.940354 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:33.940410 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassyphxnorth/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.940546 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.940616 open("/etc/demouids", O_RDONLY) = 12
[pid 25404] 10:12:33.940657 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.940703 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.940745 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b6000
[pid 25404] 10:12:33.940779 lseek(12, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.940810 read(12, "", 4096) = 0
[pid 25404] 10:12:33.940849 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:33.940986 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.941055 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.941112 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.941171 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25404] 10:12:33.941212 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.941259 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:33.941302 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b5000
[pid 25404] 10:12:33.941337 lseek(13, 0, SEEK_SET) = 0
[pid 25404] 10:12:33.941372 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25404] 10:12:33.941516 read(13, "", 4096) = 0
[pid 25404] 10:12:33.941574 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:33.941639 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.941695 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.941766 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25404] 10:12:33.941809 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.941852 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b4000
[pid 25404] 10:12:33.941886 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.941935 close(14)   = 0
[pid 25404] 10:12:33.941968 munmap(0x7fb3682b4000, 4096) = 0
[pid 25404] 10:12:33.942010 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:33.942059 pipe([14, 15]) = 0
[pid 25404] 10:12:33.942093 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:33.942132 close(12)   = 0
[pid 25404] 10:12:33.942164 munmap(0x7fb3682b6000, 4096) = 0
[pid 25404] 10:12:33.942198 close(9)    = 0
[pid 25404] 10:12:33.942229 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:33.942263 close(11)   = 0
[pid 25404] 10:12:33.942295 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:33.942328 close(13)   = 0
[pid 25404] 10:12:33.942362 munmap(0x7fb3682b5000, 4096) = 0
[pid 25404] 10:12:33.942394 close(10)   = 0
[pid 25404] 10:12:33.942510 munmap(0x7fb3682b8000, 4096) = 0
[pid 25404] 10:12:33.942549 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25414
[pid 25404] 10:12:33.942774 close(15)   = 0
[pid 25404] 10:12:33.942808 read(14,  <unfinished ...>
[pid 25411] 10:12:33.942829 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.942855 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.942906 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8169297000
[pid 25411] 10:12:33.942945 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8168c51000
[pid 25411] 10:12:33.942980 mprotect(0x7f8168c67000, 2093056, PROT_NONE) = 0
[pid 25411] 10:12:33.943014 mmap(0x7f8168e66000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25412] 10:12:33.943035 <... brk resumed> ) = 0x12d8000
[pid 25411] 10:12:33.943057 <... mmap resumed> ) = 0x7f8168e66000
[pid 25412] 10:12:33.943076 brk(0x12f9000) = 0x12f9000
[pid 25412] 10:12:33.943122 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25411] 10:12:33.943147 mmap(0x7f8168e68000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8168e68000
[pid 25411] 10:12:33.943188 close(6 <unfinished ...>
[pid 25412] 10:12:33.943212 <... socket resumed> ) = 5
[pid 25411] 10:12:33.943230 <... close resumed> ) = 0
[pid 25411] 10:12:33.943253 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.943275 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.943324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.943344 close(5)    = 0
[pid 25411] 10:12:33.943383 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.943504 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25412] 10:12:33.943542 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25411] 10:12:33.943565 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.943591 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.943615 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.943633 close(5 <unfinished ...>
[pid 25411] 10:12:33.943656 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.943680 <... close resumed> ) = 0
[pid 25412] 10:12:33.943707 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.943733 <... open resumed> ) = 6
[pid 25411] 10:12:33.943750 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.943792 <... open resumed> ) = 5
[pid 25411] 10:12:33.943810 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.943861 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.943882 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8168a1a000
[pid 25411] 10:12:33.943918 mprotect(0x7f8168a21000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.943937 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25411] 10:12:33.943970 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.943989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f49e76b8000
[pid 25411] 10:12:33.944023 mmap(0x7f8168c21000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f8168c21000
[pid 25412] 10:12:33.944066 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25411] 10:12:33.944110 mmap(0x7f8168c23000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.944148 read(5,  <unfinished ...>
[pid 25411] 10:12:33.944170 <... mmap resumed> ) = 0x7f8168c23000
[pid 25411] 10:12:33.944193 close(6)    = 0
[pid 25411] 10:12:33.944230 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.944252 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.944273 close(5 <unfinished ...>
[pid 25411] 10:12:33.944296 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.944316 <... close resumed> ) = 0
[pid 25412] 10:12:33.944334 munmap(0x7f49e76b8000, 4096 <unfinished ...>
[pid 25411] 10:12:33.944353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.944391 <... munmap resumed> ) = 0
[pid 25412] 10:12:33.944522 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.944550 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.944570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.944612 <... open resumed> ) = 5
[pid 25411] 10:12:33.944631 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.944651 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25411] 10:12:33.944700 <... open resumed> ) = 6
[pid 25412] 10:12:33.944717 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f49e76af000
[pid 25411] 10:12:33.944752 read(6,  <unfinished ...>
[pid 25412] 10:12:33.944770 close(5 <unfinished ...>
[pid 25411] 10:12:33.944788 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.944813 <... close resumed> ) = 0
[pid 25411] 10:12:33.944831 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.944857 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.944878 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.944908 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8168796000
[pid 25412] 10:12:33.944948 <... open resumed> ) = 5
[pid 25411] 10:12:33.944966 mprotect(0x7f8168819000, 2093056, PROT_NONE) = 0
[pid 25412] 10:12:33.945000 read(5,  <unfinished ...>
[pid 25411] 10:12:33.945018 mmap(0x7f8168a18000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25412] 10:12:33.945038 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.945071 <... mmap resumed> ) = 0x7f8168a18000
[pid 25412] 10:12:33.945091 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.945144 close(6 <unfinished ...>
[pid 25412] 10:12:33.945171 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f49e6ef9000
[pid 25411] 10:12:33.945207 <... close resumed> ) = 0
[pid 25411] 10:12:33.945231 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.945252 mprotect(0x7f49e6f05000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.945287 mmap(0x7f49e7105000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25411] 10:12:33.945312 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.945334 <... mmap resumed> ) = 0x7f49e7105000
[pid 25412] 10:12:33.945360 close(5 <unfinished ...>
[pid 25411] 10:12:33.945381 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.945535 <... close resumed> ) = 0
[pid 25411] 10:12:33.945556 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.945590 mprotect(0x7f49e7105000, 4096, PROT_READ <unfinished ...>
[pid 25411] 10:12:33.945616 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.945636 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25412] 10:12:33.945686 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.945705 read(6,  <unfinished ...>
[pid 25412] 10:12:33.945727 munmap(0x7f49e76af000, 39387 <unfinished ...>
[pid 25411] 10:12:33.945747 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.945771 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.945794 <... munmap resumed> ) = 0
[pid 25411] 10:12:33.945812 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25411] 10:12:33.945843 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8169296000
[pid 25412] 10:12:33.945884 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:33.945908 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.945932 <... open resumed> ) = 5
[pid 25411] 10:12:33.945951 <... mmap resumed> ) = 0x7f8168588000
[pid 25411] 10:12:33.945969 mprotect(0x7f8168594000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.945991 fcntl(5, F_GETFD <unfinished ...>
[pid 25411] 10:12:33.946013 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.946031 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25411] 10:12:33.946049 mmap(0x7f8168794000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25412] 10:12:33.946077 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.946100 <... mmap resumed> ) = 0x7f8168794000
[pid 25412] 10:12:33.946119 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:33.946149 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.946177 close(6 <unfinished ...>
[pid 25412] 10:12:33.946199 <... mmap resumed> ) = 0x7f49e76b8000
[pid 25412] 10:12:33.946217 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:33.946255 <... close resumed> ) = 0
[pid 25412] 10:12:33.946287 close(5 <unfinished ...>
[pid 25411] 10:12:33.946312 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25412] 10:12:33.946354 <... close resumed> ) = 0
[pid 25411] 10:12:33.946373 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.946411 munmap(0x7f49e76b8000, 4096 <unfinished ...>
[pid 25411] 10:12:33.946537 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.946561 <... munmap resumed> ) = 0
[pid 25411] 10:12:33.946580 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25411] 10:12:33.946612 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.946637 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25411] 10:12:33.946661 <... mmap resumed> ) = 0x7f8168365000
[pid 25411] 10:12:33.946679 mprotect(0x7f8168386000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.946716 <... socket resumed> ) = 5
[pid 25412] 10:12:33.946733 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25411] 10:12:33.946755 mmap(0x7f8168586000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25412] 10:12:33.946781 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.946804 <... mmap resumed> ) = 0x7f8168586000
[pid 25411] 10:12:33.946826 close(6 <unfinished ...>
[pid 25412] 10:12:33.946845 close(5)    = 0
[pid 25411] 10:12:33.946878 <... close resumed> ) = 0
[pid 25411] 10:12:33.946901 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.946923 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25412] 10:12:33.946957 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25411] 10:12:33.946982 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.947005 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.947024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.947044 close(5 <unfinished ...>
[pid 25411] 10:12:33.947069 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.947094 <... close resumed> ) = 0
[pid 25412] 10:12:33.947117 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:33.947138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.947179 <... open resumed> ) = 5
[pid 25412] 10:12:33.947199 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.947227 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25412] 10:12:33.947267 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:33.947298 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f49e76b8000
[pid 25411] 10:12:33.947334 read(6,  <unfinished ...>
[pid 25412] 10:12:33.947362 read(5,  <unfinished ...>
[pid 25411] 10:12:33.947388 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.947490 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:33.947521 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.947569 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.947610 close(5 <unfinished ...>
[pid 25411] 10:12:33.947639 <... mmap resumed> ) = 0x7f8168148000
[pid 25411] 10:12:33.947657 mprotect(0x7f816815f000, 2097152, PROT_NONE) = 0
[pid 25411] 10:12:33.947693 mmap(0x7f816835f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25412] 10:12:33.947721 <... close resumed> ) = 0
[pid 25411] 10:12:33.947744 <... mmap resumed> ) = 0x7f816835f000
[pid 25412] 10:12:33.947764 munmap(0x7f49e76b8000, 4096) = 0
[pid 25411] 10:12:33.947804 mmap(0x7f8168361000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.947838 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:33.947869 <... mmap resumed> ) = 0x7f8168361000
[pid 25411] 10:12:33.947893 close(6 <unfinished ...>
[pid 25412] 10:12:33.947925 <... open resumed> ) = 5
[pid 25412] 10:12:33.947944 fstat(5,  <unfinished ...>
[pid 25411] 10:12:33.947969 <... close resumed> ) = 0
[pid 25412] 10:12:33.947987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:33.948024 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.948052 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f49e76b8000
[pid 25412] 10:12:33.948088 read(5,  <unfinished ...>
[pid 25411] 10:12:33.948118 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.948141 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:33.948181 close(5 <unfinished ...>
[pid 25411] 10:12:33.948208 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.948250 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.948278 <... close resumed> ) = 0
[pid 25411] 10:12:33.948301 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.948321 munmap(0x7f49e76b8000, 4096) = 0
[pid 25411] 10:12:33.948358 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25412] 10:12:33.948411 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25411] 10:12:33.948526 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.948569 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25412] 10:12:33.948630 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25411] 10:12:33.948653 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8169295000
[pid 25411] 10:12:33.948693 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8167dd4000
[pid 25412] 10:12:33.948736 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25411] 10:12:33.948764 mprotect(0x7f8167f43000, 2093056, PROT_NONE) = 0
[pid 25412] 10:12:33.948806 <... readlink resumed> 0x7ffe10c85320, 4095) = -1 EINVAL (Invalid argument)
[pid 25411] 10:12:33.948828 mmap(0x7f8168142000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f8168142000
[pid 25412] 10:12:33.948874 getcwd( <unfinished ...>
[pid 25411] 10:12:33.948911 close(6 <unfinished ...>
[pid 25412] 10:12:33.948939 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25412] 10:12:33.948967 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25411] 10:12:33.948995 <... close resumed> ) = 0
[pid 25411] 10:12:33.949020 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.949052 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:33.949088 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.949110 open("/proc/25389/cmdline", O_RDONLY) = 5
[pid 25411] 10:12:33.949148 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.949191 fstat(5, {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25412] 10:12:33.949236 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.949263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.949296 <... mmap resumed> ) = 0x7f49e76b8000
[pid 25411] 10:12:33.949320 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.949342 read(5, "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25411] 10:12:33.949386 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25412] 10:12:33.949518 read(5,  <unfinished ...>
[pid 25411] 10:12:33.949546 read(6,  <unfinished ...>
[pid 25412] 10:12:33.949572 <... read resumed> "", 1024) = 0
[pid 25411] 10:12:33.949593 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.949619 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.949650 setregid(499, 499 <unfinished ...>
[pid 25411] 10:12:33.949676 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25411] 10:12:33.949707 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.949735 <... setregid resumed> ) = 0
[pid 25411] 10:12:33.949756 <... mmap resumed> ) = 0x7f8167b45000
[pid 25412] 10:12:33.949778 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25411] 10:12:33.949875 mprotect(0x7f8167bd0000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.950012 <... execve resumed> ) = 0
[pid 25411] 10:12:33.950038 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.950057 mmap(0x7f8167dd0000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f8167dd0000
[pid 25411] 10:12:33.950101 mmap(0x7f8167dd3000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8167dd3000
[pid 25411] 10:12:33.950145 close(6)    = 0
[pid 25411] 10:12:33.950185 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.950228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.950270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.950310 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25411] 10:12:33.950349 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.950402 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25399] 10:12:33.950539 recvfrom(16, "\203\344\201\200\0\1\0\5\0\0\0\0\4evrc\3net\0\0\17\0\1\300\f\0\17\0\1\0\1Q\177\0\26\0\n\5ASPMX\1L\6GOOGLE\3COM\0\300\f\0\17\0\1\0\1Q\177\0\t\0\24\4ALT1\300(\300\f\0\17\0\1\0\1Q\177\0\t\0\36\4ALT2\300(\300\f\0\17\0\1\0\1Q\177\0\26\0(\6ASPMX2\nGOOGLEMAIL\3007\300\f\0\17\0\1\0\1Q\177\0\v\0002\6ASPMX3\300{", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 159
[pid 25399] 10:12:33.950605 close(16)   = 0
[pid 25399] 10:12:33.950682 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25399] 10:12:33.950724 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25399] 10:12:33.950763 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25399] 10:12:33.950801 sendto(16, ";J\1\0\0\1\0\0\0\0\0\0\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1", 36, MSG_NOSIGNAL, NULL, 0) = 36
[pid 25399] 10:12:33.950866 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25411] 10:12:33.950901 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25411] 10:12:33.950949 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f816793f000
[pid 25411] 10:12:33.950988 mprotect(0x7f8167945000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.951030 brk(0 <unfinished ...>
[pid 25411] 10:12:33.951060 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.951078 mmap(0x7f8167b44000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f8167b44000
[pid 25411] 10:12:33.951121 close(6 <unfinished ...>
[pid 25412] 10:12:33.951147 <... brk resumed> ) = 0x139b000
[pid 25412] 10:12:33.951167 fcntl(0, F_GETFD <unfinished ...>
[pid 25411] 10:12:33.951192 <... close resumed> ) = 0
[pid 25412] 10:12:33.951210 <... fcntl resumed> ) = 0
[pid 25411] 10:12:33.951234 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.951262 fcntl(1, F_GETFD) = 0
[pid 25412] 10:12:33.951294 fcntl(2, F_GETFD <unfinished ...>
[pid 25411] 10:12:33.951327 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.951347 <... fcntl resumed> ) = 0
[pid 25412] 10:12:33.951372 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25411] 10:12:33.951401 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.951536 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.951565 <... open resumed> ) = 6
[pid 25412] 10:12:33.951597 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.951627 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.951668 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.951715 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.951743 <... mmap resumed> ) = 0x7fa478220000
[pid 25411] 10:12:33.951763 <... mmap resumed> ) = 0x7f8169294000
[pid 25412] 10:12:33.951795 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25411] 10:12:33.951828 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8167609000
[pid 25411] 10:12:33.951866 mprotect(0x7f8167735000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.951904 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.951924 mmap(0x7f8167935000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25412] 10:12:33.951958 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.952063 <... mmap resumed> ) = 0x7f8167935000
[pid 25411] 10:12:33.952091 mmap(0x7f816793e000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.952125 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952145 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25411] 10:12:33.952175 <... mmap resumed> ) = 0x7f816793e000
[pid 25412] 10:12:33.952197 <... stat resumed> 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952222 close(6 <unfinished ...>
[pid 25412] 10:12:33.952249 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952288 <... close resumed> ) = 0
[pid 25412] 10:12:33.952306 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25411] 10:12:33.952338 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.952371 <... stat resumed> 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952390 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.952472 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952499 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952520 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.952548 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25411] 10:12:33.952580 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952601 <... stat resumed> 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952621 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.952652 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.952683 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952706 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.952725 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25411] 10:12:33.952776 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25412] 10:12:33.952816 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952858 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.952898 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.952938 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.952984 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.953012 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953055 <... mmap resumed> ) = 0x7f8167405000
[pid 25411] 10:12:33.953075 mprotect(0x7f8167407000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.953100 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25411] 10:12:33.953129 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.953152 <... stat resumed> 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953171 mmap(0x7f8167607000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25412] 10:12:33.953198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.953229 <... mmap resumed> ) = 0x7f8167607000
[pid 25412] 10:12:33.953253 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953282 close(6 <unfinished ...>
[pid 25412] 10:12:33.953309 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953351 <... close resumed> ) = 0
[pid 25412] 10:12:33.953370 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.953402 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.953554 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953580 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.953600 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25411] 10:12:33.953627 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.953664 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.953701 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.953721 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953760 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.953799 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953837 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25412] 10:12:33.953878 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.953916 read(6,  <unfinished ...>
[pid 25412] 10:12:33.953941 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25411] 10:12:33.953968 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.953995 <... stat resumed> 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.954015 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.954060 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.954088 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.954119 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.954142 <... mmap resumed> ) = 0x7f8167202000
[pid 25412] 10:12:33.954162 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffebbe41860) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.954200 mprotect(0x7f8167204000, 2093056, PROT_NONE) = 0
[pid 25412] 10:12:33.954235 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.954274 mmap(0x7f8167403000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f8167403000
[pid 25412] 10:12:33.954313 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.954373 close(6 <unfinished ...>
[pid 25412] 10:12:33.954402 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25411] 10:12:33.954541 <... close resumed> ) = 0
[pid 25411] 10:12:33.954567 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.954596 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25412] 10:12:33.954641 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.954672 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.954699 <... mmap resumed> ) = 0x7fa478216000
[pid 25412] 10:12:33.954719 close(6 <unfinished ...>
[pid 25411] 10:12:33.954744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.954771 <... close resumed> ) = 0
[pid 25411] 10:12:33.954795 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.954821 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.954848 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.954880 <... open resumed> ) = 6
[pid 25411] 10:12:33.954903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.954922 read(6,  <unfinished ...>
[pid 25411] 10:12:33.954948 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.954974 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.955002 <... open resumed> ) = 6
[pid 25412] 10:12:33.955023 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.955068 read(6,  <unfinished ...>
[pid 25412] 10:12:33.955094 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.955121 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.955147 <... mmap resumed> ) = 0x7fa477de8000
[pid 25411] 10:12:33.955167 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25412] 10:12:33.955211 mprotect(0x7fa477dfe000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.955237 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.955266 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.955286 <... mmap resumed> ) = 0x7f8169293000
[pid 25412] 10:12:33.955305 mmap(0x7fa477ffe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25411] 10:12:33.955335 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.955367 <... mmap resumed> ) = 0x7fa477ffe000
[pid 25411] 10:12:33.955390 <... mmap resumed> ) = 0x7f8166e6e000
[pid 25412] 10:12:33.955509 mmap(0x7fa478000000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.955544 mprotect(0x7f8166ff8000, 2097152, PROT_NONE) = 0
[pid 25412] 10:12:33.955584 <... mmap resumed> ) = 0x7fa478000000
[pid 25411] 10:12:33.955604 mmap(0x7f81671f8000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25412] 10:12:33.955643 close(6 <unfinished ...>
[pid 25411] 10:12:33.955673 <... mmap resumed> ) = 0x7f81671f8000
[pid 25412] 10:12:33.955693 <... close resumed> ) = 0
[pid 25411] 10:12:33.955717 mmap(0x7f81671fd000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.955751 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.955781 <... mmap resumed> ) = 0x7f81671fd000
[pid 25412] 10:12:33.955805 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.955829 close(6 <unfinished ...>
[pid 25412] 10:12:33.955856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.955898 <... close resumed> ) = 0
[pid 25411] 10:12:33.955923 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.955951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.955994 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.956016 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.956043 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.956088 <... open resumed> ) = 6
[pid 25411] 10:12:33.956107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.956133 read(6,  <unfinished ...>
[pid 25411] 10:12:33.956162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.956181 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.956206 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.956253 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.956280 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.956315 <... open resumed> ) = 6
[pid 25412] 10:12:33.956335 <... mmap resumed> ) = 0x7fa478215000
[pid 25412] 10:12:33.956359 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.956386 read(6,  <unfinished ...>
[pid 25412] 10:12:33.956842 <... mmap resumed> ) = 0x7fa477bcf000
[pid 25399] 10:12:33.956870 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25399] 10:12:33.956895 recvfrom(16, ";J\201\200\0\1\0\1\0\0\0\0\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1\300\f\0\1\0\1\0\0\0\237\0\4\255\302M\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 52
[pid 25399] 10:12:33.956940 close(16)   = 0
[pid 25399] 10:12:33.957003 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25399] 10:12:33.957046 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25399] 10:12:33.957097 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25399] 10:12:33.957138 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:33.957182 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:33.957220 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:33.957256 close(16)   = 0
[pid 25399] 10:12:33.957295 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25399] 10:12:33.957359 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:33.957407 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34e000
[pid 25399] 10:12:33.957513 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25399] 10:12:33.957578 read(16, "", 1024) = 0
[pid 25399] 10:12:33.957625 read(16, "", 1024) = 0
[pid 25399] 10:12:33.957668 close(16)   = 0
[pid 25399] 10:12:33.957709 munmap(0x7f54cb34e000, 4096) = 0
[pid 25399] 10:12:33.957774 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25399] 10:12:33.957816 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25399] 10:12:33.957855 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25399] 10:12:33.957892 sendto(16, "\243p\1\0\0\1\0\0\0\0\0\0\4ALT1\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0) = 41
[pid 25399] 10:12:33.957957 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25411] 10:12:33.957992 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.958019 mprotect(0x7fa477be5000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.958046 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.958076 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.958094 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25411] 10:12:33.958127 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f8166c02000
[pid 25412] 10:12:33.958173 mmap(0x7fa477de4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fa477de4000
[pid 25411] 10:12:33.958214 mprotect(0x7f8166c64000, 2093056, PROT_NONE) = 0
[pid 25412] 10:12:33.958255 mmap(0x7fa477de6000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.958284 mmap(0x7f8166e63000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25412] 10:12:33.958313 <... mmap resumed> ) = 0x7fa477de6000
[pid 25411] 10:12:33.958335 <... mmap resumed> ) = 0x7f8166e63000
[pid 25412] 10:12:33.958360 close(6 <unfinished ...>
[pid 25411] 10:12:33.958397 close(6 <unfinished ...>
[pid 25412] 10:12:33.958504 <... close resumed> ) = 0
[pid 25411] 10:12:33.958528 <... close resumed> ) = 0
[pid 25412] 10:12:33.958554 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.958594 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.958627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.958651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.958676 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.958704 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.958737 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.958768 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.958789 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.958816 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.958846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.958869 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.958893 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.958921 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25412] 10:12:33.958967 <... open resumed> ) = 6
[pid 25412] 10:12:33.958985 read(6,  <unfinished ...>
[pid 25411] 10:12:33.959010 read(6,  <unfinished ...>
[pid 25412] 10:12:33.959035 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.959061 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.959086 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.959113 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.959138 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.959169 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25412] 10:12:33.959200 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.959229 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.959258 <... mmap resumed> ) = 0x7fa477998000
[pid 25411] 10:12:33.959279 <... mmap resumed> ) = 0x7f816681f000
[pid 25412] 10:12:33.959298 mprotect(0x7fa47799f000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.959323 mprotect(0x7f81669d8000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.959354 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.959376 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.959395 mmap(0x7f8166bd7000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25412] 10:12:33.959540 mmap(0x7fa477b9f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25411] 10:12:33.959582 <... mmap resumed> ) = 0x7f8166bd7000
[pid 25412] 10:12:33.959605 <... mmap resumed> ) = 0x7fa477b9f000
[pid 25412] 10:12:33.959629 mmap(0x7fa477ba1000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.959664 mmap(0x7f8166bfe000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.959693 <... mmap resumed> ) = 0x7fa477ba1000
[pid 25411] 10:12:33.959714 <... mmap resumed> ) = 0x7f8166bfe000
[pid 25412] 10:12:33.959738 close(6 <unfinished ...>
[pid 25411] 10:12:33.959772 close(6 <unfinished ...>
[pid 25412] 10:12:33.959797 <... close resumed> ) = 0
[pid 25412] 10:12:33.959824 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.959922 <... close resumed> ) = 0
[pid 25412] 10:12:33.959938 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.959968 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.960001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.960033 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.960049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.960066 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.960098 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.960127 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.960143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.960160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.960192 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.960222 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.960238 <... open resumed> ) = 6
[pid 25411] 10:12:33.960257 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.960287 read(6,  <unfinished ...>
[pid 25411] 10:12:33.960312 <... open resumed> ) = 6
[pid 25412] 10:12:33.960327 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.960349 read(6,  <unfinished ...>
[pid 25412] 10:12:33.960377 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.960400 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.960498 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.960532 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.960560 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.960593 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25412] 10:12:33.960621 <... mmap resumed> ) = 0x7fa477714000
[pid 25411] 10:12:33.960640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.960668 mprotect(0x7fa477797000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.960696 <... mmap resumed> ) = 0x7f8169292000
[pid 25412] 10:12:33.960712 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.960732 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.960762 mmap(0x7fa477996000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25411] 10:12:33.960791 <... mmap resumed> ) = 0x7f81665f2000
[pid 25412] 10:12:33.960807 <... mmap resumed> ) = 0x7fa477996000
[pid 25411] 10:12:33.960823 mprotect(0x7f816661e000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.960862 close(6 <unfinished ...>
[pid 25411] 10:12:33.960886 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.960901 <... close resumed> ) = 0
[pid 25411] 10:12:33.960917 mmap(0x7f816681e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25412] 10:12:33.960954 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.960985 <... mmap resumed> ) = 0x7f816681e000
[pid 25412] 10:12:33.961001 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.961023 close(6 <unfinished ...>
[pid 25412] 10:12:33.961049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.961081 <... close resumed> ) = 0
[pid 25412] 10:12:33.961096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.961120 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.961154 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.961183 <... open resumed> ) = 6
[pid 25412] 10:12:33.961199 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.961216 read(6,  <unfinished ...>
[pid 25412] 10:12:33.961243 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.961272 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.961293 <... open resumed> ) = 6
[pid 25411] 10:12:33.961310 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.961337 read(6,  <unfinished ...>
[pid 25411] 10:12:33.961360 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25412] 10:12:33.961387 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.961523 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.961563 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.961588 <... mmap resumed> ) = 0x7f81663ed000
[pid 25412] 10:12:33.961604 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25411] 10:12:33.961633 mprotect(0x7f81663f2000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.961663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.961690 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.961706 <... mmap resumed> ) = 0x7fa478214000
[pid 25411] 10:12:33.961722 mmap(0x7f81665f1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25412] 10:12:33.961756 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.961784 <... mmap resumed> ) = 0x7f81665f1000
[pid 25412] 10:12:33.961799 <... mmap resumed> ) = 0x7fa477506000
[pid 25411] 10:12:33.961820 close(6 <unfinished ...>
[pid 25412] 10:12:33.961846 mprotect(0x7fa477512000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.961872 <... close resumed> ) = 0
[pid 25412] 10:12:33.961888 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.961913 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.961947 mmap(0x7fa477712000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25411] 10:12:33.961975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.961992 <... mmap resumed> ) = 0x7fa477712000
[pid 25411] 10:12:33.962009 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.962054 close(6 <unfinished ...>
[pid 25411] 10:12:33.962078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.962093 <... close resumed> ) = 0
[pid 25411] 10:12:33.962110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.962148 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.962180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.962196 <... open resumed> ) = 6
[pid 25411] 10:12:33.962214 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.962244 read(6,  <unfinished ...>
[pid 25411] 10:12:33.962268 <... open resumed> ) = 6
[pid 25412] 10:12:33.962283 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.962305 read(6,  <unfinished ...>
[pid 25412] 10:12:33.962334 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.962358 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.962384 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25411] 10:12:33.962519 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.962553 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.962581 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25412] 10:12:33.962609 <... mmap resumed> ) = 0x7fa4772e3000
[pid 25411] 10:12:33.962628 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.962658 mprotect(0x7fa477304000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.962686 <... mmap resumed> ) = 0x7f81661ea000
[pid 25412] 10:12:33.962701 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.962718 mprotect(0x7f81661ec000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.962746 mmap(0x7fa477504000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25411] 10:12:33.962774 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.962789 <... mmap resumed> ) = 0x7fa477504000
[pid 25411] 10:12:33.962806 mmap(0x7f81663eb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25412] 10:12:33.962841 close(6 <unfinished ...>
[pid 25411] 10:12:33.962865 <... mmap resumed> ) = 0x7f81663eb000
[pid 25412] 10:12:33.962880 <... close resumed> ) = 0
[pid 25411] 10:12:33.962905 close(6 <unfinished ...>
[pid 25412] 10:12:33.962939 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.962970 <... close resumed> ) = 0
[pid 25412] 10:12:33.962985 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.963011 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.963044 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.963075 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.963091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.963108 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.963141 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.963170 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.963185 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.963203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.963234 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.963265 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.963281 <... open resumed> ) = 6
[pid 25411] 10:12:33.963299 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.963331 read(6,  <unfinished ...>
[pid 25411] 10:12:33.963355 <... open resumed> ) = 6
[pid 25412] 10:12:33.963371 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.963401 read(6,  <unfinished ...>
[pid 25412] 10:12:33.963508 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.963533 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.963558 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.963598 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.963629 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.963662 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25412] 10:12:33.963692 <... mmap resumed> ) = 0x7fa4770c6000
[pid 25411] 10:12:33.963711 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.963739 mprotect(0x7fa4770dd000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.963767 <... mmap resumed> ) = 0x7f8169291000
[pid 25412] 10:12:33.963782 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.963803 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.963833 mmap(0x7fa4772dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25411] 10:12:33.963863 <... mmap resumed> ) = 0x7f8165fc7000
[pid 25412] 10:12:33.963879 <... mmap resumed> ) = 0x7fa4772dd000
[pid 25411] 10:12:33.963896 mprotect(0x7f8165fde000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.963929 mmap(0x7fa4772df000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.963958 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.963973 <... mmap resumed> ) = 0x7fa4772df000
[pid 25411] 10:12:33.963990 mmap(0x7f81661de000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25412] 10:12:33.964025 close(6 <unfinished ...>
[pid 25411] 10:12:33.964050 <... mmap resumed> ) = 0x7f81661de000
[pid 25412] 10:12:33.964065 <... close resumed> ) = 0
[pid 25411] 10:12:33.964091 close(6 <unfinished ...>
[pid 25412] 10:12:33.964125 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.964161 <... close resumed> ) = 0
[pid 25412] 10:12:33.964178 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.964216 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25412] 10:12:33.964243 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.964273 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.964300 recvfrom(16,  <unfinished ...>
[pid 25412] 10:12:33.964329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.964345 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.964360 <... recvfrom resumed> "\243p\201\200\0\1\0\1\0\0\0\0\4ALT1\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1\300\f\0\1\0\1\0\0\0\205\0\4\255\302\333\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 57
[pid 25412] 10:12:33.964399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.964531 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.964564 close(16 <unfinished ...>
[pid 25412] 10:12:33.964596 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.964610 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.964627 <... close resumed> ) = 0
[pid 25412] 10:12:33.964678 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.964711 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.964739 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25412] 10:12:33.964770 <... open resumed> ) = 6
[pid 25411] 10:12:33.964784 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:33.964799 <... socket resumed> ) = 16
[pid 25412] 10:12:33.964823 read(6,  <unfinished ...>
[pid 25411] 10:12:33.964845 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.964873 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25412] 10:12:33.964907 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.964927 <... open resumed> ) = 6
[pid 25399] 10:12:33.964942 <... connect resumed> ) = 0
[pid 25412] 10:12:33.964964 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.964986 read(6,  <unfinished ...>
[pid 25399] 10:12:33.965007 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25412] 10:12:33.965036 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.965063 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:33.965084 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25412] 10:12:33.965108 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.965134 fstat(6,  <unfinished ...>
[pid 25399] 10:12:33.965155 sendto(16, "\37X\1\0\0\1\0\0\0\0\0\0\4ALT2\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25412] 10:12:33.965211 <... mmap resumed> ) = 0x7fa478213000
[pid 25411] 10:12:33.965226 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25399] 10:12:33.965258 <... sendto resumed> ) = 41
[pid 25412] 10:12:33.965288 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.965317 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25399] 10:12:33.965344 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25412] 10:12:33.965375 <... mmap resumed> ) = 0x7fa476d52000
[pid 25411] 10:12:33.965390 <... mmap resumed> ) = 0x7f8165d83000
[pid 25412] 10:12:33.965407 mprotect(0x7fa476ec1000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.965544 mprotect(0x7f8165dc4000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.965581 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.965597 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.965614 mmap(0x7fa4770c0000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25411] 10:12:33.965644 mmap(0x7f8165fc4000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25412] 10:12:33.965673 <... mmap resumed> ) = 0x7fa4770c0000
[pid 25411] 10:12:33.965688 <... mmap resumed> ) = 0x7f8165fc4000
[pid 25412] 10:12:33.965715 close(6 <unfinished ...>
[pid 25411] 10:12:33.965752 close(6 <unfinished ...>
[pid 25412] 10:12:33.965775 <... close resumed> ) = 0
[pid 25411] 10:12:33.965790 <... close resumed> ) = 0
[pid 25412] 10:12:33.965813 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.965856 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.965943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.965961 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.965979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.966013 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.966044 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.966060 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.966077 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.966107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.966136 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.966152 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.966170 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.966205 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.966235 <... open resumed> ) = 6
[pid 25411] 10:12:33.966251 <... open resumed> ) = 6
[pid 25412] 10:12:33.966267 read(6,  <unfinished ...>
[pid 25411] 10:12:33.966292 read(6,  <unfinished ...>
[pid 25412] 10:12:33.966316 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.966337 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.966368 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.966394 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.966499 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25411] 10:12:33.966537 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25412] 10:12:33.966568 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.966599 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.966627 <... mmap resumed> ) = 0x7fa476ac3000
[pid 25411] 10:12:33.966643 <... mmap resumed> ) = 0x7f8169290000
[pid 25412] 10:12:33.966659 mprotect(0x7fa476b4e000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.966692 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.966721 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.966736 <... mmap resumed> ) = 0x7f8165a9c000
[pid 25412] 10:12:33.966753 mmap(0x7fa476d4e000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25411] 10:12:33.966783 mprotect(0x7f8165b77000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.966811 <... mmap resumed> ) = 0x7fa476d4e000
[pid 25411] 10:12:33.966827 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.966848 mmap(0x7fa476d51000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.966878 mmap(0x7f8165d77000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25412] 10:12:33.966905 <... mmap resumed> ) = 0x7fa476d51000
[pid 25411] 10:12:33.966921 <... mmap resumed> ) = 0x7f8165d77000
[pid 25412] 10:12:33.966942 close(6 <unfinished ...>
[pid 25411] 10:12:33.966979 close(6 <unfinished ...>
[pid 25412] 10:12:33.967002 <... close resumed> ) = 0
[pid 25411] 10:12:33.967017 <... close resumed> ) = 0
[pid 25412] 10:12:33.967041 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.967082 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.967111 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.967128 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.967145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.967178 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.967209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.967225 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.967241 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.967272 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.967301 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.967316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.967335 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.967369 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.967401 <... open resumed> ) = 6
[pid 25411] 10:12:33.967506 <... open resumed> ) = 6
[pid 25412] 10:12:33.967532 read(6,  <unfinished ...>
[pid 25411] 10:12:33.967560 read(6,  <unfinished ...>
[pid 25412] 10:12:33.967584 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.967606 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.967629 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.967654 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.967677 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25411] 10:12:33.967705 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25412] 10:12:33.967734 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.967766 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.967796 <... mmap resumed> ) = 0x7fa4768bd000
[pid 25411] 10:12:33.967812 <... mmap resumed> ) = 0x7f8165898000
[pid 25412] 10:12:33.967828 mprotect(0x7fa4768c3000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.967856 mprotect(0x7f816589b000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.967883 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.967897 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.967914 mmap(0x7fa476ac2000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25411] 10:12:33.967943 mmap(0x7f8165a9a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25412] 10:12:33.967970 <... mmap resumed> ) = 0x7fa476ac2000
[pid 25411] 10:12:33.967985 <... mmap resumed> ) = 0x7f8165a9a000
[pid 25412] 10:12:33.968007 close(6 <unfinished ...>
[pid 25411] 10:12:33.968042 close(6 <unfinished ...>
[pid 25412] 10:12:33.968066 <... close resumed> ) = 0
[pid 25411] 10:12:33.968081 <... close resumed> ) = 0
[pid 25412] 10:12:33.968104 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.968145 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.968175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.968192 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.968209 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.968243 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.968274 <... open resumed> ) = 6
[pid 25411] 10:12:33.968289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.968311 read(6,  <unfinished ...>
[pid 25411] 10:12:33.968338 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.968369 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.968390 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.968536 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.968571 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.968604 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:33.968633 <... open resumed> ) = 6
[pid 25412] 10:12:33.968650 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.968679 read(6,  <unfinished ...>
[pid 25412] 10:12:33.968703 <... mmap resumed> ) = 0x7fa478212000
[pid 25411] 10:12:33.968718 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.968745 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.968775 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.968799 <... mmap resumed> ) = 0x7fa476587000
[pid 25411] 10:12:33.968814 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25412] 10:12:33.968843 mprotect(0x7fa4766b3000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.968873 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.968902 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.968917 <... mmap resumed> ) = 0x7f816566c000
[pid 25412] 10:12:33.968934 mmap(0x7fa4768b3000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25411] 10:12:33.968964 mprotect(0x7f8165695000, 2097152, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.968992 <... mmap resumed> ) = 0x7fa4768b3000
[pid 25411] 10:12:33.969007 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.969028 mmap(0x7fa4768bc000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.969058 mmap(0x7f8165895000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25412] 10:12:33.969086 <... mmap resumed> ) = 0x7fa4768bc000
[pid 25411] 10:12:33.969102 <... mmap resumed> ) = 0x7f8165895000
[pid 25412] 10:12:33.969124 close(6 <unfinished ...>
[pid 25411] 10:12:33.969155 mmap(0x7f8165897000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.969182 <... close resumed> ) = 0
[pid 25411] 10:12:33.969203 <... mmap resumed> ) = 0x7f8165897000
[pid 25412] 10:12:33.969226 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.969266 close(6 <unfinished ...>
[pid 25412] 10:12:33.969290 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.969306 <... close resumed> ) = 0
[pid 25412] 10:12:33.969323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.969367 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.969398 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.969502 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.969530 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.969564 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.969594 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.969610 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.969629 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.969661 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.969690 <... open resumed> ) = 6
[pid 25411] 10:12:33.969705 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.969722 read(6,  <unfinished ...>
[pid 25411] 10:12:33.969749 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.969779 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.969800 <... open resumed> ) = 6
[pid 25412] 10:12:33.969817 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.969842 read(6,  <unfinished ...>
[pid 25412] 10:12:33.969865 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.969892 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.969915 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.969947 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.969970 <... mmap resumed> ) = 0x7fa476383000
[pid 25411] 10:12:33.969986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25412] 10:12:33.970014 mprotect(0x7fa476385000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.970044 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.970076 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.970093 <... mmap resumed> ) = 0x7f816928f000
[pid 25412] 10:12:33.970109 mmap(0x7fa476585000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25411] 10:12:33.970143 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.970173 <... mmap resumed> ) = 0x7fa476585000
[pid 25411] 10:12:33.970189 <... mmap resumed> ) = 0x7f8165456000
[pid 25412] 10:12:33.970214 close(6 <unfinished ...>
[pid 25411] 10:12:33.970241 mprotect(0x7f816546b000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.970267 <... close resumed> ) = 0
[pid 25411] 10:12:33.970282 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.970305 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.970338 mmap(0x7f816566a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25412] 10:12:33.970369 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.970385 <... mmap resumed> ) = 0x7f816566a000
[pid 25412] 10:12:33.970402 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.970565 close(6 <unfinished ...>
[pid 25412] 10:12:33.970590 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.970606 <... close resumed> ) = 0
[pid 25412] 10:12:33.970623 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.970672 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.970702 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.970718 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.970736 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.970768 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.970799 <... open resumed> ) = 6
[pid 25411] 10:12:33.970814 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.970831 read(6,  <unfinished ...>
[pid 25411] 10:12:33.970856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.970886 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.970907 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.970925 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.970952 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.970982 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.971010 <... open resumed> ) = 6
[pid 25412] 10:12:33.971028 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.971058 read(6,  <unfinished ...>
[pid 25412] 10:12:33.971083 <... mmap resumed> ) = 0x7fa476180000
[pid 25411] 10:12:33.971098 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.971127 mprotect(0x7fa476182000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.971157 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.971181 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.971196 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25412] 10:12:33.971224 mmap(0x7fa476381000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25411] 10:12:33.971257 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.971287 <... mmap resumed> ) = 0x7fa476381000
[pid 25411] 10:12:33.971302 <... mmap resumed> ) = 0x7f816524b000
[pid 25412] 10:12:33.971328 close(6 <unfinished ...>
[pid 25411] 10:12:33.971355 mprotect(0x7f8165255000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.971383 <... close resumed> ) = 0
[pid 25411] 10:12:33.971399 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.971542 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.971581 mmap(0x7f8165454000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25412] 10:12:33.971611 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.971628 <... mmap resumed> ) = 0x7f8165454000
[pid 25412] 10:12:33.971645 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.971689 close(6 <unfinished ...>
[pid 25412] 10:12:33.971713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.971729 <... close resumed> ) = 0
[pid 25412] 10:12:33.971745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.971787 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.971816 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.971832 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.971850 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.971882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.971912 <... open resumed> ) = 6
[pid 25411] 10:12:33.971928 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.971945 read(6,  <unfinished ...>
[pid 25411] 10:12:33.971970 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.971999 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.972021 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.972038 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.972065 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.972095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:33.972128 <... open resumed> ) = 6
[pid 25412] 10:12:33.972146 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.972175 read(6,  <unfinished ...>
[pid 25412] 10:12:33.972199 <... mmap resumed> ) = 0x7fa478211000
[pid 25411] 10:12:33.972214 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.972240 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.972271 fstat(6,  <unfinished ...>
[pid 25412] 10:12:33.972295 <... mmap resumed> ) = 0x7fa475dec000
[pid 25411] 10:12:33.972311 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25412] 10:12:33.972340 mprotect(0x7fa475f76000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.972371 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25412] 10:12:33.972401 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.972519 <... mmap resumed> ) = 0x7f8165048000
[pid 25412] 10:12:33.972543 mmap(0x7fa476176000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25411] 10:12:33.972576 mprotect(0x7f816504a000, 2093056, PROT_NONE <unfinished ...>
[pid 25412] 10:12:33.972603 <... mmap resumed> ) = 0x7fa476176000
[pid 25411] 10:12:33.972619 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.972640 mmap(0x7fa47617b000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.972670 mmap(0x7f8165249000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25412] 10:12:33.972698 <... mmap resumed> ) = 0x7fa47617b000
[pid 25411] 10:12:33.972713 <... mmap resumed> ) = 0x7f8165249000
[pid 25412] 10:12:33.972735 close(6 <unfinished ...>
[pid 25411] 10:12:33.972770 close(6 <unfinished ...>
[pid 25412] 10:12:33.972794 <... close resumed> ) = 0
[pid 25411] 10:12:33.972810 <... close resumed> ) = 0
[pid 25412] 10:12:33.972835 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.972876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.972903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.972919 <... mmap resumed> ) = 0x7f816928e000
[pid 25412] 10:12:33.972936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.972988 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.973017 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.973033 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.973051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.973081 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.973117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.973134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.973153 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.973185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.973215 <... open resumed> ) = 6
[pid 25411] 10:12:33.973230 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.973247 read(6,  <unfinished ...>
[pid 25411] 10:12:33.973274 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.973302 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.973338 <... open resumed> ) = 6
[pid 25412] 10:12:33.973368 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.973399 read(6,  <unfinished ...>
[pid 25412] 10:12:33.973506 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25411] 10:12:33.973535 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25412] 10:12:33.973561 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.973593 fstat(6, Process 25414 attached
 <unfinished ...>
[pid 25412] 10:12:33.973668 <... mmap resumed> ) = 0x7fa475b80000
[pid 25411] 10:12:33.973685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25414] 10:12:33.973716 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25412] 10:12:33.973742 mprotect(0x7fa475be2000, 2093056, PROT_NONE <unfinished ...>
[pid 25414] 10:12:33.973771 <... set_robust_list resumed> ) = 0
[pid 25411] 10:12:33.973785 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25414] 10:12:33.973843 close(14 <unfinished ...>
[pid 25412] 10:12:33.973866 <... mprotect resumed> ) = 0
[pid 25414] 10:12:33.973882 <... close resumed> ) = 0
[pid 25411] 10:12:33.973896 <... mmap resumed> ) = 0x7f8164e29000
[pid 25414] 10:12:33.973922 geteuid( <unfinished ...>
[pid 25412] 10:12:33.973946 mmap(0x7fa475de1000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25414] 10:12:33.973976 <... geteuid resumed> ) = 0
[pid 25411] 10:12:33.973990 mprotect(0x7f8164e46000, 2093056, PROT_NONE <unfinished ...>
[pid 25414] 10:12:33.974019 getegid( <unfinished ...>
[pid 25412] 10:12:33.974040 <... mmap resumed> ) = 0x7fa475de1000
[pid 25414] 10:12:33.974056 <... getegid resumed> ) = 12
[pid 25411] 10:12:33.974080 <... mprotect resumed> ) = 0
[pid 25414] 10:12:33.974103 setgid(500 <unfinished ...>
[pid 25412] 10:12:33.974132 close(6 <unfinished ...>
[pid 25414] 10:12:33.974157 <... setgid resumed> ) = 0
[pid 25411] 10:12:33.974170 mmap(0x7f8165045000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25414] 10:12:33.974203 setuid(503 <unfinished ...>
[pid 25412] 10:12:33.974225 <... close resumed> ) = 0
[pid 25414] 10:12:33.974242 <... setuid resumed> ) = 0
[pid 25411] 10:12:33.974267 <... mmap resumed> ) = 0x7f8165045000
[pid 25414] 10:12:33.974315 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.974353 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25414] 10:12:33.974385 <... open resumed> ) = 9
[pid 25411] 10:12:33.974398 mmap(0x7f8165047000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25414] 10:12:33.974517 fstat(9,  <unfinished ...>
[pid 25412] 10:12:33.974542 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25414] 10:12:33.974560 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:33.974588 <... mmap resumed> ) = 0x7f8165047000
[pid 25414] 10:12:33.974624 brk(0x1bde000 <unfinished ...>
[pid 25412] 10:12:33.974657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25414] 10:12:33.974692 <... brk resumed> ) = 0x1bde000
[pid 25411] 10:12:33.974706 close(6 <unfinished ...>
[pid 25414] 10:12:33.974800 fstat(9,  <unfinished ...>
[pid 25412] 10:12:33.974822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25414] 10:12:33.974839 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:33.974866 <... close resumed> ) = 0
[pid 25414] 10:12:33.974885 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.974950 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25414] 10:12:33.974983 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25411] 10:12:33.974996 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25414] 10:12:33.975026 read(9,  <unfinished ...>
[pid 25412] 10:12:33.975058 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25414] 10:12:33.975076 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25411] 10:12:33.975097 <... mmap resumed> ) = 0x7f816928d000
[pid 25414] 10:12:33.975115 read(9,  <unfinished ...>
[pid 25412] 10:12:33.975181 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25414] 10:12:33.975216 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25411] 10:12:33.975234 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25414] 10:12:33.975265 close(9 <unfinished ...>
[pid 25412] 10:12:33.975288 <... open resumed> ) = 6
[pid 25414] 10:12:33.975304 <... close resumed> ) = 0
[pid 25411] 10:12:33.975318 <... mmap resumed> ) = 0x7f816928c000
[pid 25414] 10:12:33.975336 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25412] 10:12:33.975372 read(6,  <unfinished ...>
[pid 25414] 10:12:33.975405 <... munmap resumed> ) = 0
[pid 25411] 10:12:33.975499 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25414] 10:12:33.975940 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.975964 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.975988 <... mmap resumed> ) = 0x7f816928a000
[pid 25412] 10:12:33.976006 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.976038 arch_prctl(ARCH_SET_FS, 0x7f816928a7c0 <unfinished ...>
[pid 25412] 10:12:33.976062 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25411] 10:12:33.976090 <... arch_prctl resumed> ) = 0
[pid 25412] 10:12:33.976109 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.976183 mprotect(0x7f8165045000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.976211 <... mmap resumed> ) = 0x7fa47579d000
[pid 25411] 10:12:33.976227 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.976244 mprotect(0x7fa475956000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.976277 mprotect(0x7f8165249000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.976303 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.976320 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.976337 mmap(0x7fa475b55000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25411] 10:12:33.976389 mprotect(0x7f8165454000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.976480 <... mmap resumed> ) = 0x7fa475b55000
[pid 25411] 10:12:33.976503 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.976529 mmap(0x7fa475b7c000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.976577 mprotect(0x7f816566a000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.976604 <... mmap resumed> ) = 0x7fa475b7c000
[pid 25411] 10:12:33.976620 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.976643 close(6 <unfinished ...>
[pid 25411] 10:12:33.976688 mprotect(0x7f8165895000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.976715 <... close resumed> ) = 0
[pid 25411] 10:12:33.976730 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.976755 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.976801 mprotect(0x7f8165a9a000, 4096, PROT_READ <unfinished ...>
[pid 25414] 10:12:33.976832 <... lseek resumed> ) = 19
[pid 25412] 10:12:33.976846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25414] 10:12:33.976865 read(6,  <unfinished ...>
[pid 25411] 10:12:33.976890 <... mprotect resumed> ) = 0
[pid 25414] 10:12:33.976906 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2370) = 1858
[pid 25412] 10:12:33.977050 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.977500 mprotect(0x7f8165d77000, 40960, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.977513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.977531 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.977540 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.977668 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.977686 mprotect(0x7f8165fc4000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.977717 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.977750 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.977766 <... open resumed> ) = 6
[pid 25411] 10:12:33.977795 mprotect(0x7f81661de000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.977824 read(6,  <unfinished ...>
[pid 25411] 10:12:33.977848 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.977863 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.977890 mprotect(0x7f81663eb000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.977919 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.977944 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.977959 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25411] 10:12:33.978197 mprotect(0x7f8166bd7000, 110592, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.978230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.978258 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.978273 <... mmap resumed> ) = 0x7fa478210000
[pid 25411] 10:12:33.978372 mprotect(0x7f8166e63000, 16384, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.978408 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.978505 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.978523 <... mmap resumed> ) = 0x7fa475570000
[pid 25411] 10:12:33.978688 mprotect(0x7f81671f8000, 16384, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.978724 mprotect(0x7fa47559c000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.978752 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.978768 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.978788 mprotect(0x7f8167403000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.978816 mmap(0x7fa47579c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25411] 10:12:33.978846 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.978863 <... mmap resumed> ) = 0x7fa47579c000
[pid 25411] 10:12:33.978888 mprotect(0x7f8167607000, 4096, PROT_READ <unfinished ...>
[pid 25412] 10:12:33.978924 close(6 <unfinished ...>
[pid 25411] 10:12:33.978948 <... mprotect resumed> ) = 0
[pid 25412] 10:12:33.978963 <... close resumed> ) = 0
[pid 25411] 10:12:33.979715 mprotect(0x7f816835f000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.979762 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25412] 10:12:33.979790 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.979823 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.979938 recvfrom(16,  <unfinished ...>
[pid 25414] 10:12:33.979996 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.980019 <... open resumed> ) = 6
[pid 25411] 10:12:33.980032 mprotect(0x7f8168794000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.980059 <... recvfrom resumed> "\37X\201\200\0\1\0\1\0\0\0\0\4ALT2\5ASPMX\1L\6GOOGLE\3COM\0\0\1\0\1\300\f\0\1\0\1\0\0\1\37\0\4\255\302\314\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 57
[pid 25412] 10:12:33.980100 read(6,  <unfinished ...>
[pid 25411] 10:12:33.980125 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.980138 close(16 <unfinished ...>
[pid 25412] 10:12:33.980177 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.980197 mprotect(0x7f8168a18000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:33.980225 <... close resumed> ) = 0
[pid 25412] 10:12:33.980285 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.980311 <... mprotect resumed> ) = 0
[pid 25399] 10:12:33.980324 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25414] 10:12:33.980376 <... write resumed> ) = 4
[pid 25412] 10:12:33.980390 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25411] 10:12:33.980486 mprotect(0x7f8168c21000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.980520 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25399] 10:12:33.980540 <... socket resumed> ) = 16
[pid 25414] 10:12:33.980568 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.980597 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.980626 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.980640 read(14,  <unfinished ...>
[pid 25399] 10:12:33.980683 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25414] 10:12:33.980720 <... write resumed> ) = 4
[pid 25412] 10:12:33.980733 <... mmap resumed> ) = 0x7fa47536b000
[pid 25411] 10:12:33.980748 mprotect(0x7f8168e66000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.980774 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25399] 10:12:33.980792 <... connect resumed> ) = 0
[pid 25414] 10:12:33.980815 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.980838 mprotect(0x7fa475370000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.980863 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.980876 read(14,  <unfinished ...>
[pid 25399] 10:12:33.980909 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25414] 10:12:33.980942 <... write resumed> ) = 4
[pid 25412] 10:12:33.980955 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.980969 mprotect(0x7f8169080000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.980996 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:33.981015 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25414] 10:12:33.981042 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25412] 10:12:33.981066 mmap(0x7fa47556f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25411] 10:12:33.981093 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.981107 read(14,  <unfinished ...>
[pid 25399] 10:12:33.981160 sendto(16, "S\275\1\0\0\1\0\0\0\0\0\0\6ASPMX2\nGOOGLEMAIL\3COM\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25414] 10:12:33.981225 <... write resumed> ) = 40
[pid 25412] 10:12:33.981239 <... mmap resumed> ) = 0x7fa47556f000
[pid 25411] 10:12:33.981255 mprotect(0x7f81692a3000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.981287 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25399] 10:12:33.981312 <... sendto resumed> ) = 39
[pid 25414] 10:12:33.981336 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:33.981360 close(6 <unfinished ...>
[pid 25411] 10:12:33.981381 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.981394 read(14,  <unfinished ...>
[pid 25399] 10:12:33.981511 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25414] 10:12:33.981546 <... write resumed> ) = 4
[pid 25412] 10:12:33.981560 <... close resumed> ) = 0
[pid 25411] 10:12:33.981575 munmap(0x7f8169298000, 39387 <unfinished ...>
[pid 25404] 10:12:33.981616 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25414] 10:12:33.981642 close(15 <unfinished ...>
[pid 25412] 10:12:33.981664 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.981692 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.981705 wait4(-1,  <unfinished ...>
[pid 25414] 10:12:33.981734 <... close resumed> ) = 0
[pid 25412] 10:12:33.981747 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.981774 set_tid_address(0x7f816928aa90 <unfinished ...>
[pid 25414] 10:12:33.981802 exit_group(0) = ?
[pid 25412] 10:12:33.981815 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25414] 10:12:33.982113 +++ exited with 0 +++
[pid 25412] 10:12:33.982126 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.982141 <... set_tid_address resumed> ) = 25411
[pid 25404] 10:12:33.982155 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25414
[pid 25412] 10:12:33.982180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.982208 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25404] 10:12:33.982230 close(14 <unfinished ...>
[pid 25412] 10:12:33.982260 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.982273 <... set_robust_list resumed> ) = 0
[pid 25404] 10:12:33.982291 <... close resumed> ) = 0
[pid 25412] 10:12:33.982313 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.982340 futex(0x7ffdf4a955cc, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25404] 10:12:33.982363 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25412] 10:12:33.982397 <... open resumed> ) = 6
[pid 25411] 10:12:33.982410 <... futex resumed> ) = 0
[pid 25404] 10:12:33.982492 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25412] 10:12:33.982543 read(6,  <unfinished ...>
[pid 25411] 10:12:33.982570 futex(0x7ffdf4a955cc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f816928a7c0 <unfinished ...>
[pid 25404] 10:12:33.982593 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.982624 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.982646 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25404] 10:12:33.982661 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.982715 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.982742 rt_sigaction(SIGRTMIN, {0x7f816814dc60, [], SA_RESTORER|SA_SIGINFO, 0x7f8168157790},  <unfinished ...>
[pid 25404] 10:12:33.982768 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.982805 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25411] 10:12:33.982835 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.982849 <... open resumed> ) = 9
[pid 25412] 10:12:33.982871 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.982901 rt_sigaction(SIGRT_1, {0x7f816814dcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f8168157790},  <unfinished ...>
[pid 25404] 10:12:33.982926 fstat(9,  <unfinished ...>
[pid 25412] 10:12:33.982953 <... mmap resumed> ) = 0x7fa475168000
[pid 25411] 10:12:33.982968 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.982981 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.983019 mprotect(0x7fa47516a000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.983048 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25404] 10:12:33.983072 fstat(9,  <unfinished ...>
[pid 25412] 10:12:33.983099 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.983114 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25404] 10:12:33.983127 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.983171 mmap(0x7fa475369000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25411] 10:12:33.983201 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25404] 10:12:33.983222 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.983253 <... mmap resumed> ) = 0x7fa475369000
[pid 25411] 10:12:33.983277 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25404] 10:12:33.983295 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25412] 10:12:33.983356 close(6 <unfinished ...>
[pid 25411] 10:12:33.983382 statfs("/selinux",  <unfinished ...>
[pid 25404] 10:12:33.983410 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.983544 <... close resumed> ) = 0
[pid 25411] 10:12:33.983572 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350367, f_bavail=6350367, f_files=1000000, f_ffree=691131, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25404] 10:12:33.983593 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.983664 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.983713 brk(0 <unfinished ...>
[pid 25404] 10:12:33.983736 read(9,  <unfinished ...>
[pid 25412] 10:12:33.983767 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.983785 <... brk resumed> ) = 0x19b7000
[pid 25404] 10:12:33.983798 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25412] 10:12:33.983843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.983879 brk(0x19d8000 <unfinished ...>
[pid 25404] 10:12:33.983902 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.983932 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.983948 <... brk resumed> ) = 0x19d8000
[pid 25404] 10:12:33.983961 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.984022 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.984055 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.984087 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.984118 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.984137 <... open resumed> ) = 6
[pid 25404] 10:12:33.984151 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.984231 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.984269 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.984290 stat("/home/finest09/etc/finestweddingsites.com/embassyphxnorth/filter",  <unfinished ...>
[pid 25412] 10:12:33.984327 <... open resumed> ) = 6
[pid 25411] 10:12:33.984343 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:33.984368 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.984397 read(6,  <unfinished ...>
[pid 25411] 10:12:33.984506 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.984534 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:33.984568 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.984591 <... mmap resumed> ) = 0x7f81692a1000
[pid 25404] 10:12:33.984605 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.984650 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.984677 read(6,  <unfinished ...>
[pid 25404] 10:12:33.984732 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.984769 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25411] 10:12:33.984798 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25404] 10:12:33.984815 <... open resumed> ) = 10
[pid 25412] 10:12:33.984846 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.984874 read(6,  <unfinished ...>
[pid 25404] 10:12:33.984895 fstat(10,  <unfinished ...>
[pid 25412] 10:12:33.984921 <... mmap resumed> ) = 0x7fa47820f000
[pid 25411] 10:12:33.984940 <... read resumed> "", 1024) = 0
[pid 25404] 10:12:33.984954 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.985002 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.985033 close(6 <unfinished ...>
[pid 25404] 10:12:33.985057 fstat(10,  <unfinished ...>
[pid 25412] 10:12:33.985085 <... mmap resumed> ) = 0x7fa474f45000
[pid 25411] 10:12:33.985100 <... close resumed> ) = 0
[pid 25404] 10:12:33.985113 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.985146 mprotect(0x7fa474f5c000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.985173 munmap(0x7f81692a1000, 4096 <unfinished ...>
[pid 25404] 10:12:33.985199 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.985229 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.985244 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.985257 <... mmap resumed> ) = 0x7fb3682b8000
[pid 25412] 10:12:33.985332 mmap(0x7fa47515c000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25411] 10:12:33.985365 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25404] 10:12:33.985397 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.985511 <... mmap resumed> ) = 0x7fa47515c000
[pid 25411] 10:12:33.985539 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.985556 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.985647 close(6 <unfinished ...>
[pid 25411] 10:12:33.985674 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f8168157790},  <unfinished ...>
[pid 25404] 10:12:33.985700 read(10,  <unfinished ...>
[pid 25412] 10:12:33.985731 <... close resumed> ) = 0
[pid 25411] 10:12:33.985767 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.985782 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25412] 10:12:33.985823 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.985854 fstat(2,  <unfinished ...>
[pid 25404] 10:12:33.985876 read(10,  <unfinished ...>
[pid 25412] 10:12:33.985902 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.985918 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25404] 10:12:33.985944 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.986015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.986053 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f8168157790},  <unfinished ...>
[pid 25404] 10:12:33.986084 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.986118 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.986135 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.986148 <... open resumed> ) = 11
[pid 25412] 10:12:33.986177 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.986208 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25404] 10:12:33.986233 fstat(11,  <unfinished ...>
[pid 25412] 10:12:33.986260 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.986283 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25404] 10:12:33.986300 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:33.986350 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.986388 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25404] 10:12:33.986500 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.986538 <... open resumed> ) = 6
[pid 25411] 10:12:33.986554 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25404] 10:12:33.986570 <... mmap resumed> ) = 0x7fb3682b7000
[pid 25399] 10:12:33.986589 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25412] 10:12:33.986613 read(6,  <unfinished ...>
[pid 25411] 10:12:33.986637 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f8168157790},  <unfinished ...>
[pid 25404] 10:12:33.986661 read(11,  <unfinished ...>
[pid 25399] 10:12:33.986687 recvfrom(16,  <unfinished ...>
[pid 25412] 10:12:33.986717 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.986740 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:33.986754 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:33.986797 <... recvfrom resumed> "S\275\201\200\0\1\0\1\0\0\0\0\6ASPMX2\nGOOGLEMAIL\3COM\0\0\1\0\1\300\f\0\1\0\1\0\0\0\267\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 55
[pid 25412] 10:12:33.986832 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.986855 umask(0 <unfinished ...>
[pid 25404] 10:12:33.986876 close(11 <unfinished ...>
[pid 25399] 10:12:33.986900 close(16 <unfinished ...>
[pid 25412] 10:12:33.986932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.986962 <... umask resumed> ) = 0
[pid 25404] 10:12:33.986976 <... close resumed> ) = 0
[pid 25399] 10:12:33.987032 <... close resumed> ) = 0
[pid 25412] 10:12:33.987093 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.987127 geteuid( <unfinished ...>
[pid 25404] 10:12:33.987148 munmap(0x7fb3682b7000, 4096 <unfinished ...>
[pid 25399] 10:12:33.987175 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25412] 10:12:33.987208 <... mmap resumed> ) = 0x7fa474d01000
[pid 25411] 10:12:33.987225 <... geteuid resumed> ) = 0
[pid 25404] 10:12:33.987238 <... munmap resumed> ) = 0
[pid 25399] 10:12:33.987271 <... socket resumed> ) = 16
[pid 25412] 10:12:33.987296 mprotect(0x7fa474d42000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.987324 getuid( <unfinished ...>
[pid 25404] 10:12:33.987346 stat("/etc/userdomains",  <unfinished ...>
[pid 25399] 10:12:33.987371 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25412] 10:12:33.987489 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.987512 <... getuid resumed> ) = 47
[pid 25404] 10:12:33.987526 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:33.987577 <... connect resumed> ) = 0
[pid 25412] 10:12:33.987602 mmap(0x7fa474f42000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25411] 10:12:33.987634 getgid( <unfinished ...>
[pid 25404] 10:12:33.987654 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25399] 10:12:33.987702 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25412] 10:12:33.987736 <... mmap resumed> ) = 0x7fa474f42000
[pid 25411] 10:12:33.987763 <... getgid resumed> ) = 12
[pid 25404] 10:12:33.987779 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25399] 10:12:33.987845 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25412] 10:12:33.987873 close(6 <unfinished ...>
[pid 25411] 10:12:33.987897 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25404] 10:12:33.987922 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25399] 10:12:33.987952 sendto(16, "\177k\1\0\0\1\0\0\0\0\0\0\6ASPMX3\nGOOGLEMAIL\3COM\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25412] 10:12:33.988013 <... close resumed> ) = 0
[pid 25411] 10:12:33.988040 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25404] 10:12:33.988058 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:33.988112 <... sendto resumed> ) = 39
[pid 25412] 10:12:33.988139 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.988170 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25404] 10:12:33.988191 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25399] 10:12:33.988221 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25412] 10:12:33.988251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.988269 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25404] 10:12:33.988284 <... open resumed> ) = 11
[pid 25412] 10:12:33.988311 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.988344 getgroups(65536,  <unfinished ...>
[pid 25404] 10:12:33.988494 fstat(11,  <unfinished ...>
[pid 25412] 10:12:33.988513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.988523 <... getgroups resumed> [12]) = 1
[pid 25404] 10:12:33.988530 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.988563 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.988579 setgroups(0, [] <unfinished ...>
[pid 25404] 10:12:33.988585 fstat(11,  <unfinished ...>
[pid 25412] 10:12:33.988600 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.988610 <... setgroups resumed> ) = 0
[pid 25404] 10:12:33.988616 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.988640 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.988656 getegid( <unfinished ...>
[pid 25404] 10:12:33.988662 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.988679 <... open resumed> ) = 6
[pid 25411] 10:12:33.988688 <... getegid resumed> ) = 12
[pid 25404] 10:12:33.988693 <... mmap resumed> ) = 0x7fb3682b7000
[pid 25412] 10:12:33.988709 read(6,  <unfinished ...>
[pid 25411] 10:12:33.988726 geteuid( <unfinished ...>
[pid 25404] 10:12:33.988736 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.988762 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.988778 <... geteuid resumed> ) = 0
[pid 25404] 10:12:33.988783 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.988803 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.988812 geteuid( <unfinished ...>
[pid 25404] 10:12:33.988817 read(11,  <unfinished ...>
[pid 25412] 10:12:33.988834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.988853 <... geteuid resumed> ) = 0
[pid 25404] 10:12:33.988858 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25412] 10:12:33.988880 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.988892 getegid( <unfinished ...>
[pid 25404] 10:12:33.988897 read(11,  <unfinished ...>
[pid 25412] 10:12:33.988911 <... mmap resumed> ) = 0x7fa47820e000
[pid 25411] 10:12:33.988922 <... getegid resumed> ) = 12
[pid 25404] 10:12:33.988927 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.988956 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.988971 setgid(12 <unfinished ...>
[pid 25404] 10:12:33.988977 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.988995 <... mmap resumed> ) = 0x7fa474a1a000
[pid 25411] 10:12:33.989002 <... setgid resumed> ) = 0
[pid 25404] 10:12:33.989008 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.989041 mprotect(0x7fa474af5000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.989056 setuid(0 <unfinished ...>
[pid 25404] 10:12:33.989061 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25412] 10:12:33.989081 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.989089 <... setuid resumed> ) = 0
[pid 25404] 10:12:33.989094 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25412] 10:12:33.989159 mmap(0x7fa474cf5000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25411] 10:12:33.989177 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.989184 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25412] 10:12:33.989207 <... mmap resumed> ) = 0x7fa474cf5000
[pid 25411] 10:12:33.989224 <... open resumed> ) = 6
[pid 25404] 10:12:33.989230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.989298 close(6 <unfinished ...>
[pid 25411] 10:12:33.989310 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.989316 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.989333 <... close resumed> ) = 0
[pid 25411] 10:12:33.989349 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.989364 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.989404 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.989432 fstat(6,  <unfinished ...>
[pid 25404] 10:12:33.989438 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25412] 10:12:33.989457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.989466 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:33.989481 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.989520 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.989538 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.989546 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:33.989564 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.989573 <... mmap resumed> ) = 0x7f81692a1000
[pid 25404] 10:12:33.989578 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.989609 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.989624 read(6,  <unfinished ...>
[pid 25404] 10:12:33.989630 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:33.989651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.989662 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25404] 10:12:33.989673 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.989896 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.989927 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.989939 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.989966 <... open resumed> ) = 6
[pid 25411] 10:12:33.989979 <... socket resumed> ) = 7
[pid 25404] 10:12:33.989987 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.990009 read(6,  <unfinished ...>
[pid 25411] 10:12:33.990025 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25404] 10:12:33.990035 read(10,  <unfinished ...>
[pid 25412] 10:12:33.990059 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.990071 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.990078 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25412] 10:12:33.990099 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.990108 close(7 <unfinished ...>
[pid 25404] 10:12:33.990113 read(10,  <unfinished ...>
[pid 25412] 10:12:33.990130 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.990151 <... close resumed> ) = 0
[pid 25404] 10:12:33.990156 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.990200 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.990219 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.990225 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:33.990248 <... mmap resumed> ) = 0x7fa474816000
[pid 25411] 10:12:33.990257 <... socket resumed> ) = 7
[pid 25404] 10:12:33.990261 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25412] 10:12:33.990295 mprotect(0x7fa474819000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.990310 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25404] 10:12:33.990318 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.990342 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.990350 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.990356 <... open resumed> ) = 12
[pid 25412] 10:12:33.990370 mmap(0x7fa474a18000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25411] 10:12:33.990386 close(7 <unfinished ...>
[pid 25404] 10:12:33.990391 fstat(12,  <unfinished ...>
[pid 25412] 10:12:33.990408 <... mmap resumed> ) = 0x7fa474a18000
[pid 25411] 10:12:33.990430 <... close resumed> ) = 0
[pid 25404] 10:12:33.990436 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25412] 10:12:33.990469 close(6 <unfinished ...>
[pid 25411] 10:12:33.990479 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.990485 fstat(12,  <unfinished ...>
[pid 25412] 10:12:33.990503 <... close resumed> ) = 0
[pid 25411] 10:12:33.990518 <... open resumed> ) = 7
[pid 25404] 10:12:33.990524 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25412] 10:12:33.990553 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.990569 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.990578 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.990596 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.990605 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25404] 10:12:33.990620 <... mmap resumed> ) = 0x7fb3682b6000
[pid 25412] 10:12:33.990634 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.990650 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.990657 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.990672 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.990680 <... mmap resumed> ) = 0x7f81692a0000
[pid 25404] 10:12:33.990685 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.990699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.990713 read(7,  <unfinished ...>
[pid 25404] 10:12:33.990718 read(12,  <unfinished ...>
[pid 25412] 10:12:33.990736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.990746 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25404] 10:12:33.990754 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.990790 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.990808 read(7,  <unfinished ...>
[pid 25404] 10:12:33.990814 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:33.990831 <... open resumed> ) = 6
[pid 25411] 10:12:33.990839 <... read resumed> "", 4096) = 0
[pid 25404] 10:12:33.990844 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:33.990882 read(6,  <unfinished ...>
[pid 25411] 10:12:33.990893 close(7 <unfinished ...>
[pid 25404] 10:12:33.990903 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.990921 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.990933 <... close resumed> ) = 0
[pid 25404] 10:12:33.990941 <... open resumed> ) = 13
[pid 25412] 10:12:33.990953 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.990962 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25404] 10:12:33.990975 fstat(13,  <unfinished ...>
[pid 25412] 10:12:33.990987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.991006 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.991028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:33.991050 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.991064 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.991078 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.991093 <... mmap resumed> ) = 0x7fa4745ea000
[pid 25411] 10:12:33.991101 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.991109 <... mmap resumed> ) = 0x7fb3682b5000
[pid 25412] 10:12:33.991121 mprotect(0x7fa474613000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.991133 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.991148 read(13,  <unfinished ...>
[pid 25412] 10:12:33.991164 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.991172 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.991180 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:33.991205 mmap(0x7fa474813000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25411] 10:12:33.991219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.991233 close(13 <unfinished ...>
[pid 25412] 10:12:33.991247 <... mmap resumed> ) = 0x7fa474813000
[pid 25411] 10:12:33.991259 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.991268 <... close resumed> ) = 0
[pid 25412] 10:12:33.991280 mmap(0x7fa474815000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.991292 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.991306 munmap(0x7fb3682b5000, 4096 <unfinished ...>
[pid 25412] 10:12:33.991322 <... mmap resumed> ) = 0x7fa474815000
[pid 25411] 10:12:33.991336 <... open resumed> ) = 7
[pid 25404] 10:12:33.991345 <... munmap resumed> ) = 0
[pid 25412] 10:12:33.991376 close(6 <unfinished ...>
[pid 25411] 10:12:33.991386 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.991395 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.991428 <... close resumed> ) = 0
[pid 25411] 10:12:33.991452 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25404] 10:12:33.991472 <... open resumed> ) = 13
[pid 25412] 10:12:33.991488 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.991503 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25404] 10:12:33.991517 fstat(13,  <unfinished ...>
[pid 25412] 10:12:33.991531 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.991540 <... mmap resumed> ) = 0x7f8169280000
[pid 25404] 10:12:33.991548 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.991573 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.991589 close(7 <unfinished ...>
[pid 25404] 10:12:33.991597 fstat(13,  <unfinished ...>
[pid 25412] 10:12:33.991609 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.991618 <... close resumed> ) = 0
[pid 25404] 10:12:33.991635 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.991656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.991672 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25404] 10:12:33.991687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.991702 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.991712 <... open resumed> ) = 7
[pid 25404] 10:12:33.991720 <... mmap resumed> ) = 0x7fb3682b5000
[pid 25412] 10:12:33.991732 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.991746 read(7,  <unfinished ...>
[pid 25404] 10:12:33.991756 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.991769 <... open resumed> ) = 6
[pid 25411] 10:12:33.991776 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25404] 10:12:33.991788 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.991801 read(6,  <unfinished ...>
[pid 25411] 10:12:33.991810 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.991819 read(13,  <unfinished ...>
[pid 25412] 10:12:33.991834 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.991846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25404] 10:12:33.991868 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25412] 10:12:33.991886 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.991895 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25404] 10:12:33.991911 read(13,  <unfinished ...>
[pid 25412] 10:12:33.991924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25411] 10:12:33.991942 <... mmap resumed> ) = 0x7f8164c1b000
[pid 25404] 10:12:33.991950 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.991972 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.991985 mprotect(0x7f8164c27000, 2097152, PROT_NONE <unfinished ...>
[pid 25404] 10:12:33.991997 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25412] 10:12:33.992017 <... mmap resumed> ) = 0x7fa47820d000
[pid 25411] 10:12:33.992028 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.992035 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25412] 10:12:33.992064 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.992079 mmap(0x7f8164e27000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25404] 10:12:33.992092 stat("/usr/local/cpanel/3rdparty/mailman/lists/kay.olesen2_hilton.com/config.pck",  <unfinished ...>
[pid 25412] 10:12:33.992111 <... mmap resumed> ) = 0x7fa4743d4000
[pid 25411] 10:12:33.992119 <... mmap resumed> ) = 0x7f8164e27000
[pid 25404] 10:12:33.992135 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.992159 mprotect(0x7fa4743e9000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.992173 close(7 <unfinished ...>
[pid 25404] 10:12:33.992181 stat("/etc/demouids",  <unfinished ...>
[pid 25412] 10:12:33.992197 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.992204 <... close resumed> ) = 0
[pid 25404] 10:12:33.992233 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.992267 mmap(0x7fa4745e8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25411] 10:12:33.992282 mprotect(0x7f8164e27000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.992293 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.992312 <... mmap resumed> ) = 0x7fa4745e8000
[pid 25411] 10:12:33.992329 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.992340 <... open resumed> ) = 14
[pid 25412] 10:12:33.992353 close(6 <unfinished ...>
[pid 25411] 10:12:33.992362 munmap(0x7f8169280000, 39387 <unfinished ...>
[pid 25404] 10:12:33.992374 fstat(14,  <unfinished ...>
[pid 25412] 10:12:33.992387 <... close resumed> ) = 0
[pid 25411] 10:12:33.992430 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.992457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.992498 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.992519 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.992534 fstat(14,  <unfinished ...>
[pid 25412] 10:12:33.992547 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.992556 <... open resumed> ) = 7
[pid 25404] 10:12:33.992569 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.992591 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.992607 fcntl(7, F_GETFD <unfinished ...>
[pid 25404] 10:12:33.992615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.992631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.992640 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25404] 10:12:33.992651 <... mmap resumed> ) = 0x7fb3682b4000
[pid 25412] 10:12:33.992664 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.992678 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.992686 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.992701 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.992711 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.992729 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.992741 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.992756 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.992767 read(14,  <unfinished ...>
[pid 25412] 10:12:33.992780 <... open resumed> ) = 6
[pid 25411] 10:12:33.992788 <... mmap resumed> ) = 0x7f81692a0000
[pid 25404] 10:12:33.992796 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.992816 read(6,  <unfinished ...>
[pid 25411] 10:12:33.992826 read(7,  <unfinished ...>
[pid 25404] 10:12:33.992838 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25412] 10:12:33.992855 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.992868 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.992896 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25412] 10:12:33.993028 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.993042 close(7 <unfinished ...>
[pid 25404] 10:12:33.993052 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.993071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:33.993091 <... close resumed> ) = 0
[pid 25404] 10:12:33.993099 <... open resumed> ) = 15
[pid 25412] 10:12:33.993113 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.993129 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25404] 10:12:33.993142 fstat(15,  <unfinished ...>
[pid 25412] 10:12:33.993155 <... mmap resumed> ) = 0x7fa4741c9000
[pid 25411] 10:12:33.993163 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.993190 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:33.993214 mprotect(0x7fa4741d3000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.993227 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.993239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.993255 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.993263 <... socket resumed> ) = 7
[pid 25404] 10:12:33.993270 <... mmap resumed> ) = 0x7fb3682b3000
[pid 25412] 10:12:33.993282 mmap(0x7fa4743d2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25411] 10:12:33.993295 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25404] 10:12:33.993312 read(15,  <unfinished ...>
[pid 25412] 10:12:33.993328 <... mmap resumed> ) = 0x7fa4743d2000
[pid 25411] 10:12:33.993346 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.993356 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:33.993449 close(6 <unfinished ...>
[pid 25411] 10:12:33.993463 close(7 <unfinished ...>
[pid 25404] 10:12:33.993474 close(15 <unfinished ...>
[pid 25412] 10:12:33.993492 <... close resumed> ) = 0
[pid 25411] 10:12:33.993511 <... close resumed> ) = 0
[pid 25404] 10:12:33.993519 <... close resumed> ) = 0
[pid 25412] 10:12:33.993531 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.993547 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25404] 10:12:33.993558 munmap(0x7fb3682b3000, 4096 <unfinished ...>
[pid 25412] 10:12:33.993575 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.993584 <... socket resumed> ) = 7
[pid 25404] 10:12:33.993592 <... munmap resumed> ) = 0
[pid 25412] 10:12:33.993650 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.993671 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25404] 10:12:33.993687 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25412] 10:12:33.993704 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.993713 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:33.993720 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25412] 10:12:33.993765 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.993787 close(7 <unfinished ...>
[pid 25404] 10:12:33.993802 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.993825 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.993838 <... close resumed> ) = 0
[pid 25404] 10:12:33.993855 <... open resumed> ) = 15
[pid 25412] 10:12:33.993872 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.993892 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.993908 fstat(15,  <unfinished ...>
[pid 25412] 10:12:33.993925 <... open resumed> ) = 6
[pid 25411] 10:12:33.993935 <... open resumed> ) = 7
[pid 25404] 10:12:33.993946 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:33.993976 read(6,  <unfinished ...>
[pid 25411] 10:12:33.993989 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.994000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.994021 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.994037 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:33.994061 <... mmap resumed> ) = 0x7fb3682b3000
[pid 25412] 10:12:33.994083 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.994095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.994109 read(15,  <unfinished ...>
[pid 25412] 10:12:33.994126 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25411] 10:12:33.994146 <... mmap resumed> ) = 0x7f81692a0000
[pid 25404] 10:12:33.994154 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:33.994176 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.994192 read(7,  <unfinished ...>
[pid 25404] 10:12:33.994204 close(15 <unfinished ...>
[pid 25412] 10:12:33.994218 <... mmap resumed> ) = 0x7fa473fc6000
[pid 25411] 10:12:33.994226 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:33.994248 <... close resumed> ) = 0
[pid 25412] 10:12:33.994261 mprotect(0x7fa473fc8000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.994274 close(7 <unfinished ...>
[pid 25404] 10:12:33.994283 munmap(0x7fb3682b3000, 4096 <unfinished ...>
[pid 25412] 10:12:33.994300 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.994308 <... close resumed> ) = 0
[pid 25404] 10:12:33.994315 <... munmap resumed> ) = 0
[pid 25412] 10:12:33.994337 mmap(0x7fa4741c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25411] 10:12:33.994354 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25404] 10:12:33.994364 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.994382 <... mmap resumed> ) = 0x7fa4741c7000
[pid 25411] 10:12:33.994398 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.995416 <... open resumed> ) = 15
[pid 25412] 10:12:33.995452 close(6 <unfinished ...>
[pid 25411] 10:12:33.995477 read(6,  <unfinished ...>
[pid 25404] 10:12:33.995501 fstat(15,  <unfinished ...>
[pid 25412] 10:12:33.995528 <... close resumed> ) = 0
[pid 25411] 10:12:33.995550 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25404] 10:12:33.995613 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:33.995652 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.995679 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:33.995708 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.995737 <... mmap resumed> ) = 0x7fa47820c000
[pid 25411] 10:12:33.995768 <... open resumed> ) = 7
[pid 25404] 10:12:33.995787 <... mmap resumed> ) = 0x7fb3682b3000
[pid 25412] 10:12:33.995808 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.995838 fstat(7,  <unfinished ...>
[pid 25404] 10:12:33.995860 read(15,  <unfinished ...>
[pid 25412] 10:12:33.995891 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.995908 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:33.995936 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:33.995966 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.995997 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.996022 close(15 <unfinished ...>
[pid 25412] 10:12:33.996050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.996066 <... mmap resumed> ) = 0x7f81692a0000
[pid 25404] 10:12:33.996083 <... close resumed> ) = 0
[pid 25412] 10:12:33.996103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.996132 read(7,  <unfinished ...>
[pid 25404] 10:12:33.996157 munmap(0x7fb3682b3000, 4096 <unfinished ...>
[pid 25412] 10:12:33.996189 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:33.996207 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:33.996231 <... munmap resumed> ) = 0
[pid 25412] 10:12:33.996345 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:33.996384 close(7 <unfinished ...>
[pid 25404] 10:12:33.996491 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.996533 <... open resumed> ) = 6
[pid 25411] 10:12:33.996549 <... close resumed> ) = 0
[pid 25404] 10:12:33.996565 <... open resumed> ) = 15
[pid 25412] 10:12:33.996585 read(6,  <unfinished ...>
[pid 25411] 10:12:33.996608 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25404] 10:12:33.996634 fstat(15,  <unfinished ...>
[pid 25412] 10:12:33.996661 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:33.996689 <... munmap resumed> ) = 0
[pid 25404] 10:12:33.996713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.996752 fstat(6,  <unfinished ...>
[pid 25411] 10:12:33.996775 read(6,  <unfinished ...>
[pid 25404] 10:12:33.996798 fstat(15,  <unfinished ...>
[pid 25412] 10:12:33.996824 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25411] 10:12:33.996853 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25404] 10:12:33.996891 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.996925 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:33.996956 uname( <unfinished ...>
[pid 25404] 10:12:33.996978 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:33.997007 <... mmap resumed> ) = 0x7fa473da7000
[pid 25411] 10:12:33.997023 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25404] 10:12:33.997069 <... mmap resumed> ) = 0x7fb3682b3000
[pid 25412] 10:12:33.997094 mprotect(0x7fa473dc4000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:33.997122 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25404] 10:12:33.997149 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.997176 <... mprotect resumed> ) = 0
[pid 25411] 10:12:33.997191 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f8168157790}, 8) = 0
[pid 25404] 10:12:33.997219 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.997241 mmap(0x7fa473fc3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25411] 10:12:33.997272 clone( <unfinished ...>
[pid 25404] 10:12:33.997567 read(15,  <unfinished ...>
[pid 25412] 10:12:33.997602 <... mmap resumed> ) = 0x7fa473fc3000
[pid 25404] 10:12:33.997625 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25412] 10:12:33.997653 mmap(0x7fa473fc5000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:33.997683 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25415
[pid 25404] 10:12:33.997724 read(15,  <unfinished ...>
[pid 25412] 10:12:33.997754 <... mmap resumed> ) = 0x7fa473fc5000
[pid 25411] 10:12:33.997777 wait4(25415,  <unfinished ...>
[pid 25404] 10:12:33.997800 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.997886 close(6 <unfinished ...>
[pid 25404] 10:12:33.997916 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.997943 <... close resumed> ) = 0
[pid 25404] 10:12:33.997996 <... lseek resumed> ) = 353
[pid 25412] 10:12:33.998022 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.998055 read(9,  <unfinished ...>
[pid 25412] 10:12:33.998081 <... mmap resumed> ) = 0x7fa47820b000
[pid 25404] 10:12:33.998136 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:33.998177 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.998208 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:33.998234 <... mmap resumed> ) = 0x7fa47820a000
[pid 25404] 10:12:33.998259 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.998280 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:33.998304 read(9,  <unfinished ...>
[pid 25412] 10:12:33.998330 <... mmap resumed> ) = 0x7fa478208000
[pid 25404] 10:12:33.998349 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25412] 10:12:33.998404 arch_prctl(ARCH_SET_FS, 0x7fa4782087c0 <unfinished ...>
[pid 25404] 10:12:33.998498 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:33.998537 <... arch_prctl resumed> ) = 0
[pid 25404] 10:12:33.998593 <... stat resumed> 0x7fb366957880) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:33.998629 mprotect(0x7fa473fc3000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.998659 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25412] 10:12:33.998689 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.998708 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:33.998765 mprotect(0x7fa4741c7000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.998796 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25412] 10:12:33.998832 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.998866 <... open resumed> ) = 16
[pid 25412] 10:12:33.998893 mprotect(0x7fa4743d2000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.998920 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25412] 10:12:33.998948 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.998972 <... ioctl resumed> , 0x7ffeeb782050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:33.998995 mprotect(0x7fa4745e8000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999019 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25412] 10:12:33.999045 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999074 <... lseek resumed> ) = 0
[pid 25412] 10:12:33.999096 mprotect(0x7fa474813000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999120 fstat(16,  <unfinished ...>
[pid 25412] 10:12:33.999146 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999171 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25412] 10:12:33.999204 mprotect(0x7fa474a18000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999229 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:33.999254 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999391 <... fcntl resumed> ) = 0
[pid 25412] 10:12:33.999482 mprotect(0x7fa474cf5000, 40960, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999515 fstat(16,  <unfinished ...>
[pid 25412] 10:12:33.999541 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999646 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25412] 10:12:33.999704 mprotect(0x7fa474f42000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999733 read(16,  <unfinished ...>
[pid 25412] 10:12:33.999760 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999786 <... read resumed> "0", 8192) = 1
[pid 25412] 10:12:33.999810 mprotect(0x7fa47515c000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999835 read(16,  <unfinished ...>
[pid 25412] 10:12:33.999861 <... mprotect resumed> ) = 0
[pid 25404] 10:12:33.999880 <... read resumed> "", 8192) = 0
[pid 25412] 10:12:33.999903 mprotect(0x7fa475369000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:33.999932 close(16 <unfinished ...>
[pid 25412] 10:12:33.999959 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.000183 <... close resumed> ) = 0
[pid 25412] 10:12:34.000258 mprotect(0x7fa475b55000, 110592, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.000292 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.000326 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.000489 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25412] 10:12:34.000551 mprotect(0x7fa475de1000, 16384, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.000582 stat("/etc/localtime",  <unfinished ...>
[pid 25412] 10:12:34.000610 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.000728 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.000778 mprotect(0x7fa476176000, 16384, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.000807 stat("/etc/localtime",  <unfinished ...>
[pid 25412] 10:12:34.000836 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.000855 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.000890 mprotect(0x7fa476381000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.000916 close(7 <unfinished ...>
[pid 25412] 10:12:34.000944 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.000968 <... close resumed> ) = 0
[pid 25412] 10:12:34.000991 mprotect(0x7fa476585000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.001017 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25412] 10:12:34.001054 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.001821 <... open resumed> ) = 7
[pid 25412] 10:12:34.001853 mprotect(0x7fa4772dd000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.001881 fcntl(7, F_GETFD <unfinished ...>
[pid 25399] 10:12:34.001904 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25412] 10:12:34.001928 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.001964 <... fcntl resumed> ) = 0
[pid 25399] 10:12:34.001981 recvfrom(16,  <unfinished ...>
[pid 25412] 10:12:34.002010 mprotect(0x7fa477712000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.002036 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.002058 <... recvfrom resumed> "\177k\201\200\0\1\0\1\0\0\0\0\6ASPMX3\nGOOGLEMAIL\3COM\0\0\1\0\1\300\f\0\1\0\1\0\0\0\35\0\4\255\302\314\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 55
[pid 25412] 10:12:34.002090 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.002112 <... fcntl resumed> ) = 0
[pid 25399] 10:12:34.002129 close(16 <unfinished ...>
[pid 25412] 10:12:34.002160 mprotect(0x7fa477996000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.002186 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.002208 <... close resumed> ) = 0
[pid 25412] 10:12:34.002318 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.002356 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5362949, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:34.002396 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25412] 10:12:34.002499 mprotect(0x7fa477b9f000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.002528 write(7, "2015-12-30 10:12:34 [25404] 1aEJMX-0006bg-Lo SMTP connection outbound 1451491954 1aEJMX-0006bg-Lo finestweddingsites.com kay.olesen2@hilton.com\n", 144 <unfinished ...>
[pid 25399] 10:12:34.002560 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25412] 10:12:34.002611 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.002649 <... write resumed> ) = 144
[pid 25399] 10:12:34.002710 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.002751 mprotect(0x7fa477de4000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.002778 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25399] 10:12:34.002812 <... open resumed> ) = 16
[pid 25412] 10:12:34.002837 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.002863 <... open resumed> ) = 16
[pid 25399] 10:12:34.002883 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25412] 10:12:34.002912 mprotect(0x7fa477ffe000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.002937 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25399] 10:12:34.002960 <... ioctl resumed> , 0x7ffed9b0d9d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.002983 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.003022 <... lseek resumed> ) = 1
[pid 25399] 10:12:34.003041 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25412] 10:12:34.003068 mprotect(0x7fa478221000, 4096, PROT_READ <unfinished ...>
[pid 25404] 10:12:34.003093 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25399] 10:12:34.003115 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.003137 <... mprotect resumed> ) = 0
[pid 25404] 10:12:34.003153 <... ioctl resumed> , 0x7ffeeb782050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25399] 10:12:34.003170 fstat(16,  <unfinished ...>
[pid 25412] 10:12:34.003197 munmap(0x7fa478216000, 39387 <unfinished ...>
[pid 25404] 10:12:34.003225 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25399] 10:12:34.003247 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.003281 <... munmap resumed> ) = 0
[pid 25404] 10:12:34.003297 <... lseek resumed> ) = 1
[pid 25399] 10:12:34.003314 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.003341 set_tid_address(0x7fa478208a90 <unfinished ...>
[pid 25404] 10:12:34.003364 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.003385 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.003490 <... set_tid_address resumed> ) = 25412
[pid 25404] 10:12:34.003515 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:34.003546 read(16,  <unfinished ...>
[pid 25412] 10:12:34.003574 set_robust_list(0x7fa478208aa0, 24 <unfinished ...>
[pid 25404] 10:12:34.003596 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.003618 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25412] 10:12:34.003865 <... set_robust_list resumed> ) = 0
[pid 25404] 10:12:34.003891 <... fcntl resumed> ) = 0
[pid 25399] 10:12:34.003918 close(16 <unfinished ...>
[pid 25412] 10:12:34.003949 futex(0x7ffebbe4215c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25404] 10:12:34.003973 write(16, "1", 1 <unfinished ...>
[pid 25399] 10:12:34.004004 <... close resumed> ) = 0
[pid 25412] 10:12:34.004047 <... futex resumed> ) = 0
[pid 25404] 10:12:34.004067 <... write resumed> ) = 1
[pid 25399] 10:12:34.004084 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25412] 10:12:34.004127 futex(0x7ffebbe4215c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fa4782087c0 <unfinished ...>
[pid 25404] 10:12:34.004152 close(16 <unfinished ...>
[pid 25399] 10:12:34.004175 <... open resumed> ) = 16
[pid 25412] 10:12:34.004196 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25404] 10:12:34.004290 <... close resumed> ) = 0
[pid 25399] 10:12:34.004337 alarm(60 <unfinished ...>
[pid 25412] 10:12:34.004381 rt_sigaction(SIGRTMIN, {0x7fa4770cbc60, [], SA_RESTORER|SA_SIGINFO, 0x7fa4770d5790},  <unfinished ...>
[pid 25404] 10:12:34.004470 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25399] 10:12:34.004504 <... alarm resumed> ) = 0
[pid 25412] 10:12:34.004525 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:34.004542 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.004566 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25412] 10:12:34.004601 rt_sigaction(SIGRT_1, {0x7fa4770cbcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fa4770d5790},  <unfinished ...>
[pid 25404] 10:12:34.004628 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25399] 10:12:34.004655 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.004675 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25404] 10:12:34.004691 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.004734 alarm(0 <unfinished ...>
[pid 25412] 10:12:34.004766 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25404] 10:12:34.004792 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.004820 <... alarm resumed> ) = 60
[pid 25412] 10:12:34.004853 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25404] 10:12:34.004879 <... open resumed> ) = 16
[pid 25399] 10:12:34.004897 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.004935 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25404] 10:12:34.004957 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.004980 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.005000 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25404] 10:12:34.005056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25399] 10:12:34.005087 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.005125 statfs("/selinux",  <unfinished ...>
[pid 25404] 10:12:34.005158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.005184 <... open resumed> ) = 17
[pid 25412] 10:12:34.005205 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350367, f_bavail=6350367, f_files=1000000, f_ffree=691131, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25404] 10:12:34.005274 <... mmap resumed> ) = 0x7fb3682b2000
[pid 25399] 10:12:34.005294 read(17,  <unfinished ...>
[pid 25412] 10:12:34.005345 brk(0 <unfinished ...>
[pid 25404] 10:12:34.005374 read(16,  <unfinished ...>
[pid 25399] 10:12:34.005401 <... read resumed> "cpu  123041 1342358 395065 67343094 2509 0 0 0\ncpu0 123041 1342358 395065 67343094 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58202650\nbtime 1450798266\nprocesses 892893\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25412] 10:12:34.005507 <... brk resumed> ) = 0x139b000
[pid 25404] 10:12:34.005527 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25399] 10:12:34.005553 close(17 <unfinished ...>
[pid 25412] 10:12:34.005585 brk(0x13bc000 <unfinished ...>
[pid 25404] 10:12:34.005609 read(16,  <unfinished ...>
[pid 25399] 10:12:34.005631 <... close resumed> ) = 0
[pid 25412] 10:12:34.005663 <... brk resumed> ) = 0x13bc000
[pid 25404] 10:12:34.005691 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.005710 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25412] 10:12:34.005743 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.005773 close(16 <unfinished ...>
[pid 25399] 10:12:34.005798 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25412] 10:12:34.005834 <... open resumed> ) = 6
[pid 25404] 10:12:34.005862 <... close resumed> ) = 0
[pid 25399] 10:12:34.005880 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.005913 fstat(6,  <unfinished ...>
[pid 25404] 10:12:34.005936 munmap(0x7fb3682b2000, 4096 <unfinished ...>
[pid 25399] 10:12:34.005964 <... open resumed> ) = 17
[pid 25412] 10:12:34.005984 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.006013 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.006030 fcntl(17, F_GETFD <unfinished ...>
[pid 25412] 10:12:34.006057 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:34.006082 uname( <unfinished ...>
[pid 25399] 10:12:34.006105 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.006125 <... mmap resumed> ) = 0x7fa47821f000
[pid 25404] 10:12:34.006142 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25399] 10:12:34.006218 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.006253 read(6,  <unfinished ...>
[pid 25404] 10:12:34.006346 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25399] 10:12:34.006380 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.006402 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25404] 10:12:34.006513 <... socket resumed> ) = 16
[pid 25399] 10:12:34.006541 read(17,  <unfinished ...>
[pid 25412] 10:12:34.006572 read(6,  <unfinished ...>
[pid 25404] 10:12:34.006594 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25399] 10:12:34.006624 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25412] 10:12:34.006661 <... read resumed> "", 1024) = 0
[pid 25404] 10:12:34.006686 <... connect resumed> ) = 0
[pid 25399] 10:12:34.006706 close(17 <unfinished ...>
[pid 25412] 10:12:34.006735 close(6 <unfinished ...>
[pid 25404] 10:12:34.006760 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25399] 10:12:34.006785 <... close resumed> ) = 0
[pid 25412] 10:12:34.006810 <... close resumed> ) = 0
[pid 25404] 10:12:34.006827 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25399] 10:12:34.006847 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.006880 munmap(0x7fa47821f000, 4096 <unfinished ...>
[pid 25404] 10:12:34.006907 sendto(16, "\0349\1\0\0\1\0\0\0\0\0\0\6hilton\3com\0\0\17\0\1", 28, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25399] 10:12:34.006961 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.006986 <... munmap resumed> ) = 0
[pid 25404] 10:12:34.007050 <... sendto resumed> ) = 28
[pid 25399] 10:12:34.007071 stat("/var/tmp",  <unfinished ...>
[pid 25412] 10:12:34.007105 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25404] 10:12:34.007137 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25399] 10:12:34.007163 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25412] 10:12:34.007214 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.007298 brk(0x16fa000 <unfinished ...>
[pid 25412] 10:12:34.007330 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25399] 10:12:34.007356 <... brk resumed> ) = 0x16fa000
[pid 25412] 10:12:34.007549 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:34.007584 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.007621 fstat(2,  <unfinished ...>
[pid 25399] 10:12:34.007644 <... open resumed> ) = 17
[pid 25412] 10:12:34.007663 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25399] 10:12:34.007725 fcntl(17, F_GETFD <unfinished ...>
[pid 25412] 10:12:34.007754 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fa4770d5790},  <unfinished ...>
[pid 25399] 10:12:34.007781 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.007800 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:34.007819 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.007846 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25399] 10:12:34.007871 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.007891 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25399] 10:12:34.007909 fstat(17,  <unfinished ...>
[pid 25412] 10:12:34.007935 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25399] 10:12:34.007960 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25412] 10:12:34.008003 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25399] 10:12:34.008025 pread(17,  <unfinished ...>
[pid 25412] 10:12:34.008052 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25399] 10:12:34.008077 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25412] 10:12:34.008129 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25399] 10:12:34.008160 pread(17,  <unfinished ...>
[pid 25412] 10:12:34.008189 umask(0 <unfinished ...>
[pid 25399] 10:12:34.008211 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25412] 10:12:34.008249 <... umask resumed> ) = 022
[pid 25399] 10:12:34.008298 pread(17,  <unfinished ...>
[pid 25412] 10:12:34.008328 geteuid( <unfinished ...>
[pid 25399] 10:12:34.008356 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25412] 10:12:34.008517 <... geteuid resumed> ) = 0
[pid 25399] 10:12:34.008545 close(17 <unfinished ...>
[pid 25412] 10:12:34.008577 getuid( <unfinished ...>
[pid 25399] 10:12:34.008599 <... close resumed> ) = 0
[pid 25412] 10:12:34.008631 <... getuid resumed> ) = 503
[pid 25399] 10:12:34.008652 close(16 <unfinished ...>
[pid 25412] 10:12:34.008682 getgid( <unfinished ...>
[pid 25399] 10:12:34.008703 <... close resumed> ) = 0
[pid 25412] 10:12:34.008730 <... getgid resumed> ) = 499
[pid 25399] 10:12:34.008763 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.008792 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25399] 10:12:34.008815 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.008836 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25399] 10:12:34.008855 read(13,  <unfinished ...>
[pid 25412] 10:12:34.008882 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25399] 10:12:34.008903 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25412] 10:12:34.008937 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25399] 10:12:34.008960 stat("/jail_owner",  <unfinished ...>
[pid 25412] 10:12:34.008989 getgroups(65536,  <unfinished ...>
[pid 25399] 10:12:34.009011 <... stat resumed> 0x7ffed9b0c3b0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.009037 <... getgroups resumed> [500]) = 1
[pid 25399] 10:12:34.009061 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25412] 10:12:34.009095 setgroups(0, [] <unfinished ...>
[pid 25399] 10:12:34.009118 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25412] 10:12:34.009157 <... setgroups resumed> ) = 0
[pid 25399] 10:12:34.009176 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25412] 10:12:34.009215 getegid( <unfinished ...>
[pid 25399] 10:12:34.009237 <... stat resumed> 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.009263 <... getegid resumed> ) = 499
[pid 25399] 10:12:34.009280 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25412] 10:12:34.009310 geteuid( <unfinished ...>
[pid 25399] 10:12:34.009331 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25412] 10:12:34.009366 <... geteuid resumed> ) = 0
[pid 25399] 10:12:34.009390 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25412] 10:12:34.009511 geteuid( <unfinished ...>
[pid 25399] 10:12:34.009534 <... stat resumed> 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.009560 <... geteuid resumed> ) = 0
[pid 25399] 10:12:34.009577 stat("/etc/demouids",  <unfinished ...>
[pid 25412] 10:12:34.009606 getegid( <unfinished ...>
[pid 25399] 10:12:34.009628 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:34.009676 <... getegid resumed> ) = 499
[pid 25399] 10:12:34.009699 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25412] 10:12:34.009731 setgid(499 <unfinished ...>
[pid 25399] 10:12:34.009754 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25412] 10:12:34.009841 <... setgid resumed> ) = 0
[pid 25399] 10:12:34.009866 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:34.009897 setuid(0 <unfinished ...>
[pid 25399] 10:12:34.009919 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:34.009968 <... setuid resumed> ) = 0
[pid 25399] 10:12:34.010015 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.010052 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.010080 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.010117 <... open resumed> ) = 6
[pid 25399] 10:12:34.010152 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25412] 10:12:34.010187 fstat(6,  <unfinished ...>
[pid 25399] 10:12:34.010209 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.010248 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:34.010281 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.010315 fstat(6,  <unfinished ...>
[pid 25399] 10:12:34.010344 <... open resumed> ) = 16
[pid 25412] 10:12:34.010366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25399] 10:12:34.010404 fstat(16,  <unfinished ...>
[pid 25412] 10:12:34.010522 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.010551 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.010586 <... mmap resumed> ) = 0x7fa47821f000
[pid 25399] 10:12:34.010604 fstat(16,  <unfinished ...>
[pid 25412] 10:12:34.010631 read(6,  <unfinished ...>
[pid 25399] 10:12:34.010658 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.010688 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25399] 10:12:34.010805 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.010842 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:34.010870 <... mmap resumed> ) = 0x7f54cb34e000
[pid 25412] 10:12:34.010890 <... socket resumed> ) = 7
[pid 25399] 10:12:34.010906 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.010932 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:34.010965 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.010985 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.011002 read(16,  <unfinished ...>
[pid 25412] 10:12:34.011032 close(7 <unfinished ...>
[pid 25399] 10:12:34.011058 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25412] 10:12:34.011118 <... close resumed> ) = 0
[pid 25399] 10:12:34.011140 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25412] 10:12:34.011175 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:34.011201 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4074, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25412] 10:12:34.011248 <... socket resumed> ) = 7
[pid 25399] 10:12:34.011268 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.011302 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:34.011332 <... open resumed> ) = 17
[pid 25412] 10:12:34.011354 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.011372 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25412] 10:12:34.011399 close(7 <unfinished ...>
[pid 25399] 10:12:34.011511 <... ioctl resumed> , 0x7ffed9b09350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.011536 <... close resumed> ) = 0
[pid 25399] 10:12:34.011560 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25412] 10:12:34.011587 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.011616 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.011645 <... open resumed> ) = 7
[pid 25399] 10:12:34.011665 fstat(17,  <unfinished ...>
[pid 25412] 10:12:34.011691 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.011713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4074, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25412] 10:12:34.011745 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25399] 10:12:34.011771 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.011804 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.011831 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.011856 <... mmap resumed> ) = 0x7fa47821e000
[pid 25399] 10:12:34.011875 read(17,  <unfinished ...>
[pid 25412] 10:12:34.011902 read(7,  <unfinished ...>
[pid 25399] 10:12:34.011928 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4074
[pid 25412] 10:12:34.012645 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25399] 10:12:34.012694 read(17,  <unfinished ...>
[pid 25412] 10:12:34.012724 read(7,  <unfinished ...>
[pid 25399] 10:12:34.012746 <... read resumed> "", 8192) = 0
[pid 25412] 10:12:34.012770 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.012789 close(17 <unfinished ...>
[pid 25412] 10:12:34.012816 close(7 <unfinished ...>
[pid 25399] 10:12:34.012838 <... close resumed> ) = 0
[pid 25412] 10:12:34.012877 <... close resumed> ) = 0
[pid 25399] 10:12:34.012898 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:34.012927 munmap(0x7fa47821e000, 4096 <unfinished ...>
[pid 25399] 10:12:34.012955 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:34.013008 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.013040 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.013073 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.013103 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25412] 10:12:34.013143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.013162 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.013192 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.013223 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25412] 10:12:34.013278 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.013299 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.013331 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.013367 <... open resumed> ) = 17
[pid 25412] 10:12:34.013388 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.013405 fstat(17,  <unfinished ...>
[pid 25412] 10:12:34.013528 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.013559 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.013598 <... open resumed> ) = 7
[pid 25399] 10:12:34.013614 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.013643 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.013666 <... mmap resumed> ) = 0x7f54cb34d000
[pid 25412] 10:12:34.013685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25399] 10:12:34.013712 read(17,  <unfinished ...>
[pid 25412] 10:12:34.013744 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25399] 10:12:34.013770 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.013806 <... mmap resumed> ) = 0x7fa4781fe000
[pid 25399] 10:12:34.013824 close(17 <unfinished ...>
[pid 25412] 10:12:34.013851 close(7 <unfinished ...>
[pid 25399] 10:12:34.013881 <... close resumed> ) = 0
[pid 25412] 10:12:34.013903 <... close resumed> ) = 0
[pid 25399] 10:12:34.013928 munmap(0x7f54cb34d000, 4096 <unfinished ...>
[pid 25412] 10:12:34.013960 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.013992 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.014023 <... open resumed> ) = 7
[pid 25399] 10:12:34.014042 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.014073 read(7,  <unfinished ...>
[pid 25399] 10:12:34.014096 <... open resumed> ) = 17
[pid 25412] 10:12:34.014116 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25399] 10:12:34.014139 fstat(17,  <unfinished ...>
[pid 25412] 10:12:34.014164 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.014193 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:34.014224 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25399] 10:12:34.014254 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.014284 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25399] 10:12:34.014315 <... mmap resumed> ) = 0x7f54cb34d000
[pid 25412] 10:12:34.014335 <... mmap resumed> ) = 0x7fa473b99000
[pid 25399] 10:12:34.014359 read(17,  <unfinished ...>
[pid 25412] 10:12:34.014396 mprotect(0x7fa473ba5000, 2097152, PROT_NONE <unfinished ...>
[pid 25399] 10:12:34.014523 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:34.014562 <... mprotect resumed> ) = 0
[pid 25399] 10:12:34.014579 close(17 <unfinished ...>
[pid 25412] 10:12:34.014606 mmap(0x7fa473da5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25399] 10:12:34.014635 <... close resumed> ) = 0
[pid 25412] 10:12:34.014654 <... mmap resumed> ) = 0x7fa473da5000
[pid 25399] 10:12:34.014680 munmap(0x7f54cb34d000, 4096 <unfinished ...>
[pid 25412] 10:12:34.014712 close(7 <unfinished ...>
[pid 25399] 10:12:34.014734 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.014766 <... close resumed> ) = 0
[pid 25399] 10:12:34.014805 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.014837 mprotect(0x7fa473da5000, 4096, PROT_READ <unfinished ...>
[pid 25399] 10:12:34.014863 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25412] 10:12:34.014896 <... mprotect resumed> ) = 0
[pid 25399] 10:12:34.014915 pipe( <unfinished ...>
[pid 25412] 10:12:34.014944 munmap(0x7fa4781fe000, 39387 <unfinished ...>
[pid 25399] 10:12:34.014971 <... pipe resumed> [17, 18]) = 0
[pid 25412] 10:12:34.014992 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.015015 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25412] 10:12:34.015047 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.015075 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25412] 10:12:34.015098 <... open resumed> ) = 7
[pid 25399] 10:12:34.015128 close(15 <unfinished ...>
[pid 25412] 10:12:34.015179 fcntl(7, F_GETFD <unfinished ...>
[pid 25399] 10:12:34.015202 <... close resumed> ) = 0
[pid 25412] 10:12:34.015221 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25399] 10:12:34.015241 munmap(0x7f54cb34f000, 4096 <unfinished ...>
[pid 25412] 10:12:34.015272 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.015294 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.015314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:34.015343 close(14 <unfinished ...>
[pid 25412] 10:12:34.015376 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.015403 <... close resumed> ) = 0
[pid 25412] 10:12:34.015500 <... mmap resumed> ) = 0x7fa47821e000
[pid 25399] 10:12:34.015522 munmap(0x7f54cb350000, 4096 <unfinished ...>
[pid 25412] 10:12:34.015550 read(7,  <unfinished ...>
[pid 25399] 10:12:34.015577 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.015598 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:34.015637 close(9 <unfinished ...>
[pid 25412] 10:12:34.015665 close(7 <unfinished ...>
[pid 25399] 10:12:34.015688 <... close resumed> ) = 0
[pid 25412] 10:12:34.015707 <... close resumed> ) = 0
[pid 25399] 10:12:34.015722 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25412] 10:12:34.015752 munmap(0x7fa47821e000, 4096 <unfinished ...>
[pid 25399] 10:12:34.015782 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.015803 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.015837 close(13 <unfinished ...>
[pid 25412] 10:12:34.015868 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:34.015895 <... close resumed> ) = 0
[pid 25412] 10:12:34.015914 <... socket resumed> ) = 7
[pid 25399] 10:12:34.015930 munmap(0x7f54cb351000, 4096 <unfinished ...>
[pid 25412] 10:12:34.015959 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:34.015992 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.016012 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.016030 close(12 <unfinished ...>
[pid 25412] 10:12:34.016056 close(7 <unfinished ...>
[pid 25399] 10:12:34.016081 <... close resumed> ) = 0
[pid 25412] 10:12:34.016099 <... close resumed> ) = 0
[pid 25399] 10:12:34.016115 munmap(0x7f54cb352000, 4096 <unfinished ...>
[pid 25412] 10:12:34.016142 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25399] 10:12:34.016167 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.016187 <... socket resumed> ) = 7
[pid 25399] 10:12:34.016203 close(16 <unfinished ...>
[pid 25412] 10:12:34.016229 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25399] 10:12:34.016259 <... close resumed> ) = 0
[pid 25412] 10:12:34.016278 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.016295 munmap(0x7f54cb34e000, 4096 <unfinished ...>
[pid 25412] 10:12:34.016323 close(7 <unfinished ...>
[pid 25399] 10:12:34.016356 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.016379 <... close resumed> ) = 0
[pid 25399] 10:12:34.016401 close(11 <unfinished ...>
[pid 25412] 10:12:34.016501 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.016532 <... close resumed> ) = 0
[pid 25412] 10:12:34.016558 <... open resumed> ) = 7
[pid 25399] 10:12:34.016575 munmap(0x7f54cb353000, 4096 <unfinished ...>
[pid 25412] 10:12:34.016605 fstat(7,  <unfinished ...>
[pid 25399] 10:12:34.016627 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.016648 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:34.016678 close(10 <unfinished ...>
[pid 25412] 10:12:34.016706 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.016731 <... close resumed> ) = 0
[pid 25412] 10:12:34.016750 <... mmap resumed> ) = 0x7fa47821e000
[pid 25399] 10:12:34.016767 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25412] 10:12:34.016795 read(7,  <unfinished ...>
[pid 25399] 10:12:34.016821 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.016842 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:34.016874 clone( <unfinished ...>
[pid 25412] 10:12:34.017164 close(7)    = 0
[pid 25399] 10:12:34.017199 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25416
[pid 25412] 10:12:34.017237 munmap(0x7fa47821e000, 4096 <unfinished ...>
[pid 25399] 10:12:34.017266 close(18 <unfinished ...>
[pid 25412] 10:12:34.017291 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.017322 <... close resumed> ) = 0
[pid 25412] 10:12:34.017344 read(6,  <unfinished ...>
[pid 25399] 10:12:34.017368 read(17,  <unfinished ...>
[pid 25412] 10:12:34.017391 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25412] 10:12:34.017525 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25412] 10:12:34.017572 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.017619 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.017654 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.017696 close(7)    = 0
[pid 25412] 10:12:34.017729 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.017771 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25412] 10:12:34.017825 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25412] 10:12:34.017887 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790}, 8) = 0
[pid 25412] 10:12:34.017936 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa478208a90) = 25417
[pid 25412] 10:12:34.018184 wait4(25417, Process 25415 attached
 <unfinished ...>
[pid 25415] 10:12:34.018251 set_robust_list(0x7f816928aaa0, 24) = 0
[pid 25415] 10:12:34.018308 geteuid()   = 0
[pid 25415] 10:12:34.018349 geteuid()   = 0
[pid 25415] 10:12:34.018382 getegid()   = 12
[pid 25415] 10:12:34.018525 setgid(12Process 25417 attached
Process 25416 attached
 <unfinished ...>
[pid 25416] 10:12:34.018624 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25417] 10:12:34.018658 set_robust_list(0x7fa478208aa0, 24 <unfinished ...>
[pid 25415] 10:12:34.018680 <... setgid resumed> ) = 0
[pid 25415] 10:12:34.018699 setuid(47)  = 0
[pid 25417] 10:12:34.019446 <... set_robust_list resumed> ) = 0
[pid 25416] 10:12:34.019495 <... set_robust_list resumed> ) = 0
[pid 25416] 10:12:34.019553 close(17 <unfinished ...>
[pid 25417] 10:12:34.019680 geteuid( <unfinished ...>
[pid 25416] 10:12:34.019717 <... close resumed> ) = 0
[pid 25416] 10:12:34.019753 geteuid( <unfinished ...>
[pid 25417] 10:12:34.019781 <... geteuid resumed> ) = 0
[pid 25417] 10:12:34.019813 geteuid( <unfinished ...>
[pid 25416] 10:12:34.019841 <... geteuid resumed> ) = 0
[pid 25417] 10:12:34.019866 <... geteuid resumed> ) = 0
[pid 25416] 10:12:34.019893 getegid( <unfinished ...>
[pid 25417] 10:12:34.019919 getegid( <unfinished ...>
[pid 25416] 10:12:34.019946 <... getegid resumed> ) = 12
[pid 25417] 10:12:34.019972 <... getegid resumed> ) = 499
[pid 25416] 10:12:34.020005 setgid(500 <unfinished ...>
[pid 25417] 10:12:34.020036 setgid(12 <unfinished ...>
[pid 25416] 10:12:34.020065 <... setgid resumed> ) = 0
[pid 25417] 10:12:34.020091 <... setgid resumed> ) = 0
[pid 25416] 10:12:34.020118 setuid(503 <unfinished ...>
[pid 25417] 10:12:34.020144 setuid(47 <unfinished ...>
[pid 25416] 10:12:34.020172 <... setuid resumed> ) = 0
[pid 25417] 10:12:34.020198 <... setuid resumed> ) = 0
[pid 25404] 10:12:34.020849 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25404] 10:12:34.020895 recvfrom(16, "\0349\201\200\0\1\0\2\0\0\0\0\6hilton\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\5\246\0\25\0\n\3mx2\6hilton\5iphmx\300\23\300\f\0\17\0\1\0\0\5\246\0\10\0\n\3mx1\300.", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 81
[pid 25404] 10:12:34.020983 close(16)   = 0
[pid 25404] 10:12:34.021078 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25404] 10:12:34.021133 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25404] 10:12:34.021190 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25404] 10:12:34.021244 sendto(16, "\340\17\1\0\0\1\0\0\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0) = 38
[pid 25404] 10:12:34.021333 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25416] 10:12:34.021423 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25416] 10:12:34.021497 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25416] 10:12:34.021663 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25416] 10:12:34.021737 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25416] 10:12:34.021795 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25416] 10:12:34.021877 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25416] 10:12:34.021943 close(9)    = 0
[pid 25416] 10:12:34.021994 munmap(0x7f54cb355000, 4096) = 0
[pid 25415] 10:12:34.023424 brk(0x19f9000 <unfinished ...>
[pid 25416] 10:12:34.023636 lseek(6, 19, SEEK_SET) = 19
[pid 25416] 10:12:34.024380 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2350) = 1858
[pid 25416] 10:12:34.024932 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:34.024966 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25399] 10:12:34.024988 read(17,  <unfinished ...>
[pid 25416] 10:12:34.025008 <... write resumed> ) = 4
[pid 25416] 10:12:34.025025 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:34.025047 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25399] 10:12:34.025066 read(17,  <unfinished ...>
[pid 25416] 10:12:34.025086 <... write resumed> ) = 4
[pid 25416] 10:12:34.025103 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:34.025124 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.025146 read(17,  <unfinished ...>
[pid 25416] 10:12:34.025166 <... write resumed> ) = 4
[pid 25416] 10:12:34.025183 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25399] 10:12:34.025208 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25399] 10:12:34.025228 read(17,  <unfinished ...>
[pid 25416] 10:12:34.025248 <... write resumed> ) = 40
[pid 25416] 10:12:34.025265 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25399] 10:12:34.025287 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.025306 wait4(-1,  <unfinished ...>
[pid 25416] 10:12:34.025325 <... write resumed> ) = 4
[pid 25416] 10:12:34.025342 close(18)   = 0
[pid 25416] 10:12:34.025384 exit_group(0) = ?
[pid 25416] 10:12:34.025589 +++ exited with 0 +++
[pid 25399] 10:12:34.025617 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25416
[pid 25399] 10:12:34.025644 close(17)   = 0
[pid 25399] 10:12:34.025680 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:34.025754 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.025816 open("/etc/userdomains", O_RDONLY) = 9
[pid 25399] 10:12:34.025855 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.025904 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.025948 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:34.025984 lseek(9, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.026016 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:34.026072 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.026131 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.026207 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.026258 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.026315 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25399] 10:12:34.026363 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.026536 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.026586 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb354000
[pid 25404] 10:12:34.026632 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25399] 10:12:34.026642 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25404] 10:12:34.026666 recvfrom(16,  <unfinished ...>
[pid 25399] 10:12:34.026672 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.026696 <... recvfrom resumed> "\340\17\201\200\0\1\0\10\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\2*\0\4D\350\214\344\300\f\0\1\0\1\0\0\2*\0\4D\350\214S\300\f\0\1\0\1\0\0\2*\0\4D\350\214v\300\f\0\1\0\1\0\0\2*\0\4D\350\211\266\300\f\0\1\0\1\0\0\2*\0\4D\350\207\324\300\f\0\1\0\1\0\0\2*\0\4D\350\216\t\300\f\0\1\0\1\0\0\2*\0\4D\350\217\276\300\f\0\1\0\1\0\0\2*\0\4D\350\211\\", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 166
[pid 25399] 10:12:34.026711 read(10,  <unfinished ...>
[pid 25404] 10:12:34.026748 close(16 <unfinished ...>
[pid 25399] 10:12:34.026755 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25404] 10:12:34.026791 <... close resumed> ) = 0
[pid 25399] 10:12:34.026798 read(10,  <unfinished ...>
[pid 25404] 10:12:34.026844 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25399] 10:12:34.026852 <... read resumed> "", 4096) = 0
[pid 25404] 10:12:34.026895 <... socket resumed> ) = 16
[pid 25399] 10:12:34.026904 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25404] 10:12:34.026936 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25399] 10:12:34.026945 <... open resumed> ) = 11
[pid 25404] 10:12:34.026972 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25399] 10:12:34.026985 fstat(11,  <unfinished ...>
[pid 25404] 10:12:34.027009 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25399] 10:12:34.027015 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:34.027049 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25399] 10:12:34.027058 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:34.027089 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25399] 10:12:34.027096 <... mmap resumed> ) = 0x7f54cb353000
[pid 25404] 10:12:34.027119 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:34.027128 read(11,  <unfinished ...>
[pid 25404] 10:12:34.027156 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25399] 10:12:34.027163 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:34.027199 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:34.027208 close(11 <unfinished ...>
[pid 25404] 10:12:34.027235 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25399] 10:12:34.027242 <... close resumed> ) = 0
[pid 25404] 10:12:34.027264 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25399] 10:12:34.027272 munmap(0x7f54cb353000, 4096 <unfinished ...>
[pid 25404] 10:12:34.027301 close(16 <unfinished ...>
[pid 25399] 10:12:34.027308 <... munmap resumed> ) = 0
[pid 25404] 10:12:34.027349 <... close resumed> ) = 0
[pid 25399] 10:12:34.027357 stat("/etc/userdomains",  <unfinished ...>
[pid 25404] 10:12:34.027386 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.027394 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.027574 <... open resumed> ) = 16
[pid 25399] 10:12:34.027584 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25404] 10:12:34.027618 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.027625 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25404] 10:12:34.027673 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.027692 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25404] 10:12:34.027723 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.027732 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.027785 <... mmap resumed> ) = 0x7fb3682b2000
[pid 25399] 10:12:34.027794 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.027826 read(16,  <unfinished ...>
[pid 25399] 10:12:34.027832 <... open resumed> ) = 11
[pid 25404] 10:12:34.027873 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25399] 10:12:34.027882 fstat(11,  <unfinished ...>
[pid 25404] 10:12:34.027907 read(16,  <unfinished ...>
[pid 25399] 10:12:34.027913 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.027952 <... read resumed> "", 1024) = 0
[pid 25399] 10:12:34.027959 fstat(11,  <unfinished ...>
[pid 25404] 10:12:34.027992 read(16,  <unfinished ...>
[pid 25399] 10:12:34.027998 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.028034 <... read resumed> "", 1024) = 0
[pid 25399] 10:12:34.028041 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:34.028066 close(16 <unfinished ...>
[pid 25399] 10:12:34.028073 <... mmap resumed> ) = 0x7f54cb353000
[pid 25404] 10:12:34.028098 <... close resumed> ) = 0
[pid 25399] 10:12:34.028104 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25404] 10:12:34.028126 munmap(0x7fb3682b2000, 4096 <unfinished ...>
[pid 25399] 10:12:34.028132 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.028158 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.028165 read(11,  <unfinished ...>
[pid 25404] 10:12:34.028265 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25399] 10:12:34.028274 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25404] 10:12:34.028327 <... socket resumed> ) = 16
[pid 25399] 10:12:34.028336 stat("/etc/userdomains",  <unfinished ...>
[pid 25404] 10:12:34.028370 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25399] 10:12:34.028380 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.028549 <... connect resumed> ) = 0
[pid 25399] 10:12:34.028559 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25404] 10:12:34.028599 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25399] 10:12:34.028609 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.028656 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25399] 10:12:34.028666 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25404] 10:12:34.028694 sendto(16, "(\372\1\0\0\1\0\0\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25399] 10:12:34.028702 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.028791 <... sendto resumed> ) = 38
[pid 25399] 10:12:34.028801 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25404] 10:12:34.028831 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25399] 10:12:34.028840 <... stat resumed> 0x7ffed9b0ae00) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.028871 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.028932 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.029012 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.029073 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25399] 10:12:34.029130 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.029191 lseek(11, 2781, SEEK_SET) = 2781
[pid 25399] 10:12:34.029239 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.029294 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:34.029351 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.029431 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable", 0x7ffed9b0ae00) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.029489 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.029548 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25399] 10:12:34.029617 open("/etc/localdomains", O_RDONLY) = 12
[pid 25399] 10:12:34.029660 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.029706 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.029747 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb352000
[pid 25399] 10:12:34.029770 lseek(12, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.029789 read(12, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25399] 10:12:34.029824 stat("/jail_owner", 0x7ffed9b0c3b0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.029852 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25399] 10:12:34.029893 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.029923 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25399] 10:12:34.029959 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.029986 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030025 open("/etc/demouids", O_RDONLY) = 13
[pid 25399] 10:12:34.030049 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030079 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb351000
[pid 25399] 10:12:34.030128 lseek(13, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.030147 read(13, "", 4096) = 0
[pid 25399] 10:12:34.030172 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:34.030234 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030270 lseek(9, 353, SEEK_SET) = 353
[pid 25399] 10:12:34.030302 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25399] 10:12:34.030334 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:34.030370 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb350000
[pid 25399] 10:12:34.030391 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:34.030584 close(14)   = 0
[pid 25399] 10:12:34.030625 munmap(0x7f54cb350000, 4096) = 0
[pid 25399] 10:12:34.030676 stat("//etc/fin.finestweddingsites.com", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.030728 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030800 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.030859 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.030925 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.030985 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.031041 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.031102 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.031128 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.031169 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25399] 10:12:34.031194 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.031225 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.031253 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb350000
[pid 25399] 10:12:34.031275 lseek(14, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.031294 read(14, "", 4096) = 0
[pid 25399] 10:12:34.031323 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25399] 10:12:34.031347 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:34.031375 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:34.031395 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:34.031585 close(15)   = 0
[pid 25399] 10:12:34.031624 munmap(0x7f54cb34f000, 4096) = 0
[pid 25399] 10:12:34.031674 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.031740 stat("//.spamassassinboxenable", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.031786 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.031839 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25399] 10:12:34.031898 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.031941 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.032000 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffed9b0f1a0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.032043 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.032097 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.032210 lseek(14, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.032251 read(14, "", 4096) = 0
[pid 25399] 10:12:34.032306 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.032387 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 15
[pid 25399] 10:12:34.032541 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.032594 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.032639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34f000
[pid 25399] 10:12:34.032676 lseek(15, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.032710 read(15, "", 4096) = 0
[pid 25399] 10:12:34.032751 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.032813 open("/etc/group", O_RDONLY|O_CLOEXEC) = 16
[pid 25399] 10:12:34.032856 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:34.032902 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34e000
[pid 25399] 10:12:34.032939 read(16, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:34.032987 close(16)   = 0
[pid 25399] 10:12:34.033023 munmap(0x7f54cb34e000, 4096) = 0
[pid 25399] 10:12:34.033074 open("/etc/aliases", O_RDONLY) = 16
[pid 25399] 10:12:34.033119 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25399] 10:12:34.033168 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25399] 10:12:34.033214 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34e000
[pid 25399] 10:12:34.033251 lseek(16, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.033285 read(16, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25399] 10:12:34.033340 read(16, "", 4096) = 0
[pid 25399] 10:12:34.033383 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25399] 10:12:34.033504 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:34.033555 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34d000
[pid 25399] 10:12:34.033592 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:34.033647 close(17)   = 0
[pid 25399] 10:12:34.033683 munmap(0x7f54cb34d000, 4096) = 0
[pid 25399] 10:12:34.033737 open("/etc/localaliases", O_RDONLY) = 17
[pid 25399] 10:12:34.033782 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:34.033832 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:34.033877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb34d000
[pid 25399] 10:12:34.033914 lseek(17, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.033949 read(17, "", 4096) = 0
[pid 25399] 10:12:34.033998 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.034066 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.034124 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.034181 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.034241 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.034312 write(8, "2015-12-30 10:12:34 routing failed for finest09@fin.finestweddingsites.com <evrc@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 166) = 166
[pid 25399] 10:12:34.034362 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.034515 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.034579 close(7)    = 0
[pid 25399] 10:12:34.034619 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:34.034666 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:34.034701 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.034735 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363093, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.034782 write(7, "2015-12-30 10:12:34 [25399] 1aEJMX-0006bd-HC ** finest09@fin.finestweddingsites.com <evrc@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 175) = 175
[pid 25399] 10:12:34.034825 close(16)   = 0
[pid 25399] 10:12:34.034862 munmap(0x7f54cb34e000, 4096) = 0
[pid 25399] 10:12:34.034901 close(17)   = 0
[pid 25399] 10:12:34.034937 munmap(0x7f54cb34d000, 4096) = 0
[pid 25399] 10:12:34.034980 close(13)   = 0
[pid 25399] 10:12:34.035015 munmap(0x7f54cb351000, 4096) = 0
[pid 25399] 10:12:34.035053 close(14)   = 0
[pid 25399] 10:12:34.035088 munmap(0x7f54cb350000, 4096) = 0
[pid 25399] 10:12:34.035124 close(9)    = 0
[pid 25399] 10:12:34.035159 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:34.035197 close(12)   = 0
[pid 25399] 10:12:34.035232 munmap(0x7f54cb352000, 4096) = 0
[pid 25399] 10:12:34.035268 close(15)   = 0
[pid 25399] 10:12:34.035303 munmap(0x7f54cb34f000, 4096) = 0
[pid 25399] 10:12:34.035339 close(11)   = 0
[pid 25399] 10:12:34.035374 munmap(0x7f54cb353000, 4096) = 0
[pid 25399] 10:12:34.035410 close(10)   = 0
[pid 25399] 10:12:34.035514 munmap(0x7f54cb354000, 4096) = 0
[pid 25399] 10:12:34.035558 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-J", O_WRONLY|O_CREAT|O_APPEND, 0640) = 9
[pid 25399] 10:12:34.035640 fcntl(9, F_GETFD) = 0
[pid 25399] 10:12:34.036374 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.036410 fchown(9, 47, 12) = 0
[pid 25399] 10:12:34.036510 fchmod(9, 0640) = 0
[pid 25399] 10:12:34.036568 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 10
[pid 25399] 10:12:34.036618 alarm(60)   = 0
[pid 25399] 10:12:34.036654 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25399] 10:12:34.036693 alarm(0)    = 60
[pid 25399] 10:12:34.036751 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:34.036820 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25399] 10:12:34.036865 fcntl(11, F_GETFD) = 0
[pid 25399] 10:12:34.036899 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.036933 read(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25399] 10:12:34.036978 close(11)   = 0
[pid 25399] 10:12:34.037020 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.037063 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25399] 10:12:34.037211 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25399] 10:12:34.037257 fcntl(11, F_GETFD) = 0
[pid 25399] 10:12:34.037290 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.037324 fstat(11, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:34.037386 pread(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25399] 10:12:34.037517 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25399] 10:12:34.037578 close(11)   = 0
[pid 25399] 10:12:34.037630 close(10)   = 0
[pid 25399] 10:12:34.037681 open("/etc/userdomains", O_RDONLY) = 10
[pid 25399] 10:12:34.037724 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.037774 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.037819 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:34.037858 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.037892 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:34.037953 pipe([11, 12]) = 0
[pid 25399] 10:12:34.037996 close(10)   = 0
[pid 25399] 10:12:34.038031 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:34.038072 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25418
[pid 25399] 10:12:34.038338 close(12)   = 0
[pid 25399] 10:12:34.038387 read(11,  <unfinished ...>
[pid 25417] 10:12:34.038901 brk(0x13dd000 <unfinished ...>
[pid 25415] 10:12:34.038933 <... brk resumed> ) = 0x19f9000
[pid 25415] 10:12:34.039384 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25417] 10:12:34.039479 <... brk resumed> ) = 0x13dd000
[pid 25417] 10:12:34.039823 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25415] 10:12:34.039869 <... open resumed> ) = 7
[pid 25415] 10:12:34.039896 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25415] 10:12:34.039952 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25415] 10:12:34.039997 read(7, "$\216K}I\355\0\353\231}~\317\257\177l\267\247\372\332dU,~x+\0\23\315\224\245xN\365t\266\232\263s5\352\200*f\224\6J\353w", 48) = 48
[pid 25415] 10:12:34.040041 close(7)    = 0
[pid 25415] 10:12:34.040093 getuid()    = 47
[pid 25415] 10:12:34.040267 exit_group(0) = ?
[pid 25417] 10:12:34.040295 <... open resumed> ) = 7
[pid 25417] 10:12:34.040321 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25417] 10:12:34.040373 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25417] 10:12:34.040474 read(7, "\2243\246u2K\3378\21b\234\r\310\2310\253\336\373R\271SQ\320\236>\230\221Y\17\216\346\335F\"\7y\365\364\352\366;q\17\344\214\354\321\244", 48) = 48
[pid 25417] 10:12:34.040527 close(7)    = 0
[pid 25417] 10:12:34.040576 getuid( <unfinished ...>
[pid 25415] 10:12:34.040835 +++ exited with 0 +++
[pid 25411] 10:12:34.040848 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25415
[pid 25411] 10:12:34.040926 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:34.041002 getcwd("/var/spool/exim", 16380) = 16
[pid 25411] 10:12:34.041076 open("/etc/localtime", O_RDONLY) = 7
[pid 25411] 10:12:34.041118 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.041164 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.041206 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.041242 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25411] 10:12:34.041289 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25411] 10:12:34.041321 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25411] 10:12:34.041368 close(7)    = 0
[pid 25411] 10:12:34.041402 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.041540 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25411] 10:12:34.041589 fcntl(7, F_GETFD) = 0
[pid 25411] 10:12:34.041621 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.041652 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363268, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.041698 write(7, "2015-12-30 10:12:34 [25411] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMX-0006bl-RX\n", 92) = 92
[pid 25411] 10:12:34.041737 chdir("/var/spool/exim") = 0
[pid 25411] 10:12:34.041776 setgid(12)  = 0
[pid 25411] 10:12:34.041837 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25411] 10:12:34.041921 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25411] 10:12:34.042003 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25411] 10:12:34.042082 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25411] 10:12:34.042156 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25411] 10:12:34.042249 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25411] 10:12:34.042361 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25411] 10:12:34.042525 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25411] 10:12:34.042575 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.042622 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.042658 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.042705 close(8)    = 0
[pid 25411] 10:12:34.042738 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.042833 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25411] 10:12:34.042929 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25411] 10:12:34.043047 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25411] 10:12:34.043167 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25411] 10:12:34.043279 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25411] 10:12:34.043333 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25411] 10:12:34.043384 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.043505 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.043543 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.043593 close(8)    = 0
[pid 25411] 10:12:34.043627 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.043673 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25411] 10:12:34.043714 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.043759 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.043794 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.043841 close(8)    = 0
[pid 25411] 10:12:34.043874 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.043931 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25411] 10:12:34.043972 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.044016 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.044053 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.044109 close(8)    = 0
[pid 25411] 10:12:34.044143 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.044247 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25411] 10:12:34.044375 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25411] 10:12:34.044594 read(6, "", 4096) = 0
[pid 25411] 10:12:34.044641 read(6, "", 4096) = 0
[pid 25411] 10:12:34.044677 close(6)    = 0
[pid 25411] 10:12:34.044711 munmap(0x7f81692a1000, 4096) = 0
[pid 25411] 10:12:34.044763 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f8168157790}, NULL, 8) = 0
[pid 25411] 10:12:34.044812 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-D", O_RDWR|O_APPEND) = 6
[pid 25411] 10:12:34.044858 fcntl(6, F_GETFD) = 0
[pid 25411] 10:12:34.044890 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.044922 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25411] 10:12:34.044958 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:34.045015 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-H", O_RDONLY) = 8
[pid 25411] 10:12:34.045059 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1082, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:34.045104 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a1000
[pid 25411] 10:12:34.045140 read(8, "1aEJMX-0006bl-RX-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1082
[pid 25411] 10:12:34.045213 read(8, "", 4096) = 0
[pid 25411] 10:12:34.045250 close(8)    = 0
[pid 25411] 10:12:34.045283 munmap(0x7f81692a1000, 4096) = 0
[pid 25411] 10:12:34.045322 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.045374 open("/var/spool/exim/msglog/X/1aEJMX-0006bl-RX", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25411] 10:12:34.045487 fcntl(8, F_GETFD) = 0
[pid 25411] 10:12:34.045527 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.045565 fchown(8, 47, 12) = 0
[pid 25411] 10:12:34.045605 fchmod(8, 0640) = 0
[pid 25411] 10:12:34.045644 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25411] 10:12:34.045679 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.045725 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a1000
[pid 25411] 10:12:34.045761 lseek(8, 0, SEEK_CUR) = 0
[pid 25411] 10:12:34.045800 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25411] 10:12:34.045853 pipe([9, 10]) = 0
[pid 25411] 10:12:34.045890 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [], SA_RESTORER, 0x7f8168157790}, 8) = 0
[pid 25411] 10:12:34.045932 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25419
[pid 25411] 10:12:34.046132 close(10)   = 0
[pid 25411] 10:12:34.046169 read(9,  <unfinished ...>
[pid 25417] 10:12:34.046198 <... getuid resumed> ) = 47
[pid 25417] 10:12:34.046348 exit_group(0) = ?
[pid 25417] 10:12:34.046638 +++ exited with 0 +++
[pid 25412] 10:12:34.046660 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25417
[pid 25412] 10:12:34.046684 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, 8) = 0
[pid 25412] 10:12:34.046747 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25412] 10:12:34.046823 open("/etc/localtime", O_RDONLY) = 7
[pid 25412] 10:12:34.046866 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.046913 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.046956 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.046993 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25412] 10:12:34.047046 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25412] 10:12:34.047079 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25412] 10:12:34.047127 close(7)    = 0
[pid 25412] 10:12:34.047162 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.047211 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25412] 10:12:34.047256 fcntl(7, F_GETFD) = 0
[pid 25412] 10:12:34.047288 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25412] 10:12:34.047320 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363360, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25412] 10:12:34.047367 write(7, "2015-12-30 10:12:34 [25412] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25412] 10:12:34.047406 chdir("/var/spool/exim") = 0
[pid 25412] 10:12:34.047531 geteuid()   = 0
[pid 25412] 10:12:34.047566 getegid()   = 499
[pid 25412] 10:12:34.047608 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.047651 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.047696 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.047733 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.047779 close(8)    = 0
[pid 25412] 10:12:34.047813 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.047853 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25412] 10:12:34.047896 read(8, "65536\n", 31) = 6
[pid 25412] 10:12:34.047931 close(8)    = 0
[pid 25412] 10:12:34.047969 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.048014 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:34.048060 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.048101 lseek(8, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.048137 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:34.048188 read(8, "", 4096) = 0
[pid 25412] 10:12:34.048226 close(8)    = 0
[pid 25412] 10:12:34.048260 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.048298 setgroups(1, [12]) = 0
[pid 25412] 10:12:34.048337 setgid(12)  = 0
[pid 25412] 10:12:34.048370 setuid(47)  = 0
[pid 25412] 10:12:34.048502 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25412] 10:12:34.048592 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25412] 10:12:34.048675 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25412] 10:12:34.048748 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25412] 10:12:34.048824 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25412] 10:12:34.048913 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25412] 10:12:34.049024 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25412] 10:12:34.049097 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.049141 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.049188 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.049224 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.049270 close(8)    = 0
[pid 25412] 10:12:34.049304 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.049399 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25412] 10:12:34.049588 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25412] 10:12:34.049710 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25412] 10:12:34.049831 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25412] 10:12:34.049943 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25412] 10:12:34.049999 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.050042 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.050089 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.050126 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.050175 close(8)    = 0
[pid 25412] 10:12:34.050209 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.050255 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.050296 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:34.050343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.050379 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:34.050500 close(8)    = 0
[pid 25412] 10:12:34.050541 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.050600 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25412] 10:12:34.050643 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:34.050688 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.050724 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:34.050771 close(8)    = 0
[pid 25412] 10:12:34.050805 munmap(0x7fa47821e000, 4096) = 0
[pid 25412] 10:12:34.050905 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25412] 10:12:34.051037 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25412] 10:12:34.051135 read(6, "", 4096) = 0
[pid 25412] 10:12:34.051174 read(6, "", 4096) = 0
[pid 25412] 10:12:34.051209 close(6)    = 0
[pid 25412] 10:12:34.051242 munmap(0x7fa47821f000, 4096) = 0
[pid 25412] 10:12:34.051282 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25412] 10:12:34.051322 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.051368 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821f000
[pid 25412] 10:12:34.051407 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.051538 close(6)    = 0
[pid 25412] 10:12:34.051577 munmap(0x7fa47821f000, 4096) = 0
[pid 25412] 10:12:34.051634 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25412] 10:12:34.051696 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa4770d5790}, NULL, 8) = 0
[pid 25412] 10:12:34.051748 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:34.051789 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:34.051829 fstat(0, {st_dev=makedev(0, 8), st_ino=2130166173, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25412] 10:12:34.051873 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821f000
[pid 25412] 10:12:34.051909 read(0, "To:  tracy.thompson@hilton.com, hiltongardeninn@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style typ"..., 4096) = 2092
[pid 25412] 10:12:34.052005 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.052075 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25412] 10:12:34.052155 fchown(6, 47, 12) = 0
[pid 25412] 10:12:34.052195 fchmod(6, 0640) = 0
[pid 25412] 10:12:34.052231 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25412] 10:12:34.052265 fstat(6, {st_dev=makedev(144, 4215), st_ino=124785512, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25412] 10:12:34.052310 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821e000
[pid 25412] 10:12:34.052346 lseek(6, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.052378 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25412] 10:12:34.052563 read(0, "", 4096) = 0
[pid 25412] 10:12:34.052615 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa4770d5790}, NULL, 8) = 0
[pid 25412] 10:12:34.052659 write(6, "1aEJMY-0006bs-1f-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25412] 10:12:34.052713 fsync(6Process 25419 attached
 <unfinished ...>
[pid 25419] 10:12:34.052823 set_robust_list(0x7f816928aaa0, 24) = 0
[pid 25419] 10:12:34.052973 close(9)    = 0
[pid 25419] 10:12:34.053015 geteuid()   = 0
[pid 25419] 10:12:34.053049 getegid()   = 12
[pid 25419] 10:12:34.053084 setgid(494) = 0
[pid 25419] 10:12:34.053118 setuid(495) = 0
[pid 25419] 10:12:34.053170 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.053202 <... fsync resumed> ) = 0
[pid 25412] 10:12:34.053237 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25412] 10:12:34.053323 fstat(6, {st_dev=makedev(144, 4215), st_ino=124785512, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25412] 10:12:34.053538 brk(0x13dd000) = 0x13dd000
[pid 25412] 10:12:34.053617 getuid()    = 47
[pid 25412] 10:12:34.053682 geteuid()   = 47
[pid 25412] 10:12:34.053720 getgid()    = 12
[pid 25412] 10:12:34.053754 getegid()   = 12
[pid 25412] 10:12:34.053859 open("/dev/urandom", O_RDONLY) = 8
[pid 25412] 10:12:34.053906 read(8, "\265M\377[", 4) = 4
[pid 25412] 10:12:34.053945 close(8)    = 0
[pid 25412] 10:12:34.054069 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25412] 10:12:34.054193 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd3f0) = -1 EINVAL (Invalid argument)
[pid 25412] 10:12:34.054241 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25412] 10:12:34.054279 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd3f0) = -1 EINVAL (Invalid argument)
[pid 25412] 10:12:34.054315 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25412] 10:12:34.054350 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd400) = -1 EINVAL (Invalid argument)
[pid 25412] 10:12:34.054385 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25412] 10:12:34.054477 open("/dev/null", O_RDONLY) = 8
[pid 25412] 10:12:34.054528 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd4d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.054565 lseek(8, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.054610 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25412] 10:12:34.054651 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa4770d5790}, 8) = 0
[pid 25412] 10:12:34.054698 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa4770d5790}, 8) = 0
[pid 25412] 10:12:34.054989 read(8, "", 8192) = 0
[pid 25412] 10:12:34.055038 close(8)    = 0
[pid 25412] 10:12:34.055275 brk(0x13fe000) = 0x13fe000
[pid 25412] 10:12:34.055485 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25412] 10:12:34.055551 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25412] 10:12:34.055601 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd300) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.055645 lseek(8, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.055712 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25412] 10:12:34.056789 brk(0x141f000) = 0x141f000
[pid 25412] 10:12:34.057024 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25412] 10:12:34.058005 brk(0x1440000) = 0x1440000
[pid 25412] 10:12:34.058343 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25412] 10:12:34.059276 brk(0x1461000) = 0x1461000
[pid 25412] 10:12:34.059624 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25412] 10:12:34.059945 read(8, "", 8192) = 0
[pid 25412] 10:12:34.059994 close(8)    = 0
[pid 25412] 10:12:34.060047 stat("/usr/share/amavis/amavis-filter", 0x7fa4768bc880) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.060097 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25412] 10:12:34.060151 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25412] 10:12:34.060200 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25412] 10:12:34.060241 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfd300) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.060279 lseek(8, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.060329 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25412] 10:12:34.060873 stat("/etc/exim/perl/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.060930 stat("/etc/exim/perl/warnings.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.060971 stat("/usr/local/cpanel/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061011 stat("/usr/local/cpanel/warnings.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061052 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061098 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061140 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061180 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061222 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061271 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061314 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.061356 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25412] 10:12:34.061411 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25412] 10:12:34.061532 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfcd10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.061575 lseek(9, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.061627 brk(0x1482000) = 0x1482000
[pid 25412] 10:12:34.061686 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25412] 10:12:34.062010 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25412] 10:12:34.062821 read(9,  <unfinished ...>
[pid 25419] 10:12:34.062870 <... open resumed> ) = 9
[pid 25419] 10:12:34.062898 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25419] 10:12:34.062986 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25419] 10:12:34.063037 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25419] 10:12:34.063077 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25419] 10:12:34.063123 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25419] 10:12:34.063169 close(9)    = 0
[pid 25419] 10:12:34.063205 munmap(0x7f81692a0000, 4096) = 0
[pid 25419] 10:12:34.063287 brk(0x19fa000 <unfinished ...>
[pid 25412] 10:12:34.063318 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25412] 10:12:34.063482 brk(0x14a3000 <unfinished ...>
[pid 25419] 10:12:34.063521 <... brk resumed> ) = 0x19fa000
[pid 25419] 10:12:34.063699 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.063735 <... brk resumed> ) = 0x14a3000
[pid 25412] 10:12:34.064083 read(9,  <unfinished ...>
[pid 25419] 10:12:34.064123 <... lseek resumed> ) = 19
[pid 25419] 10:12:34.064149 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2423) = 1858
Process 25418 attached
[pid 25418] 10:12:34.064516 set_robust_list(0x7f54cb33faa0, 24) = 0
[pid 25418] 10:12:34.064636 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25412] 10:12:34.064676 <... read resumed> "", 8192) = 0
[pid 25419] 10:12:34.064702 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:34.064733 close(9)    = 0
[pid 25411] 10:12:34.064773 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25411] 10:12:34.064795 read(9,  <unfinished ...>
[pid 25419] 10:12:34.064822 <... write resumed> ) = 4
[pid 25419] 10:12:34.065478 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.065525 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25411] 10:12:34.065548 read(9,  <unfinished ...>
[pid 25419] 10:12:34.065576 <... write resumed> ) = 4
[pid 25419] 10:12:34.065601 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.065636 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.065660 read(9,  <unfinished ...>
[pid 25419] 10:12:34.065694 <... write resumed> ) = 4
[pid 25419] 10:12:34.065714 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25411] 10:12:34.065743 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25411] 10:12:34.065763 read(9,  <unfinished ...>
[pid 25419] 10:12:34.065789 <... write resumed> ) = 4
[pid 25419] 10:12:34.065808 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.065836 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.065856 read(9,  <unfinished ...>
[pid 25419] 10:12:34.065882 <... write resumed> ) = 4
[pid 25419] 10:12:34.065900 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25418] 10:12:34.065929 <... setrlimit resumed> ) = 0
[pid 25411] 10:12:34.065952 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25411] 10:12:34.065974 read(9,  <unfinished ...>
[pid 25419] 10:12:34.066000 <... write resumed> ) = 40
[pid 25418] 10:12:34.066135 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25419] 10:12:34.066167 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.066196 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.066218 wait4(-1,  <unfinished ...>
[pid 25419] 10:12:34.066245 <... write resumed> ) = 4
[pid 25419] 10:12:34.066263 close(10)   = 0
[pid 25419] 10:12:34.066304 exit_group(0) = ?
[pid 25418] 10:12:34.066519 <... open resumed> ) = 10
[pid 25419] 10:12:34.066591 +++ exited with 0 +++
[pid 25411] 10:12:34.066613 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25419
[pid 25411] 10:12:34.066645 close(9)    = 0
[pid 25411] 10:12:34.066687 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:34.066744 brk(0x19f9000) = 0x19f9000
[pid 25411] 10:12:34.066789 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25411] 10:12:34.066836 alarm(60)   = 0
[pid 25411] 10:12:34.066934 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25411] 10:12:34.066972 alarm(0)    = 60
[pid 25411] 10:12:34.067046 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.067094 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25411] 10:12:34.067137 read(10, "cpu  123041 1342360 395068 67343095 2509 0 0 0\ncpu0 123041 1342360 395068 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58209154\nbtime 1450798266\nprocesses 892897\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25411] 10:12:34.067195 close(10)   = 0
[pid 25411] 10:12:34.067281 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.067350 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25411] 10:12:34.067391 fcntl(10, F_GETFD) = 0
[pid 25411] 10:12:34.067479 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.067520 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25411] 10:12:34.067577 close(10)   = 0
[pid 25411] 10:12:34.067636 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.067684 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25411] 10:12:34.067784 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8169259000
[pid 25411] 10:12:34.067926 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25411] 10:12:34.067969 fcntl(10, F_GETFD) = 0
[pid 25411] 10:12:34.068000 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.068034 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.068110 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25411] 10:12:34.068193 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25411] 10:12:34.068254 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25411] 10:12:34.068325 close(10)   = 0
[pid 25411] 10:12:34.068383 munmap(0x7f8169259000, 200704) = 0
[pid 25411] 10:12:34.068541 close(9)    = 0
[pid 25411] 10:12:34.068602 open("/etc/localdomains", O_RDONLY) = 9
[pid 25411] 10:12:34.068653 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.068721 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.068766 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.068802 lseek(9, 0, SEEK_SET) = 0
[pid 25411] 10:12:34.068835 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25411] 10:12:34.068897 stat("/jail_owner", 0x7ffdf4a513f0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.068944 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.069007 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.069054 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.069107 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.069156 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25411] 10:12:34.069181 stat("/etc/demouids",  <unfinished ...>
[pid 25404] 10:12:34.069210 recvfrom(16,  <unfinished ...>
[pid 25411] 10:12:34.069238 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.069282 <... recvfrom resumed> "(\372\201\200\0\1\0\10\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\10\265\0\4D\350\2159\300\f\0\1\0\1\0\0\10\265\0\4D\350\214v\300\f\0\1\0\1\0\0\10\265\0\4D\350\2167\300\f\0\1\0\1\0\0\10\265\0\4D\350\214\344\300\f\0\1\0\1\0\0\10\265\0\4D\350\211\\\300\f\0\1\0\1\0\0\10\265\0\4D\350\207\324\300\f\0\1\0\1\0\0\10\265\0\4D\350\217\276\300\f\0\1\0\1\0\0\10\265\0\4D\350\216\t", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 166
[pid 25411] 10:12:34.069320 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.069349 close(16 <unfinished ...>
[pid 25411] 10:12:34.069379 <... open resumed> ) = 10
[pid 25404] 10:12:34.069396 <... close resumed> ) = 0
[pid 25411] 10:12:34.069646 fstat(10,  <unfinished ...>
[pid 25404] 10:12:34.069687 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25411] 10:12:34.069722 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.069755 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:34.069804 fstat(10,  <unfinished ...>
[pid 25404] 10:12:34.069837 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.069869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.069896 <... open resumed> ) = 16
[pid 25411] 10:12:34.069918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:34.069945 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.069972 <... mmap resumed> ) = 0x7f816929f000
[pid 25404] 10:12:34.069988 <... ioctl resumed> , 0x7ffeeb783b70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.070010 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25404] 10:12:34.070034 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.070060 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.070077 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.070097 read(10,  <unfinished ...>
[pid 25404] 10:12:34.070120 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.070145 <... read resumed> "", 4096) = 0
[pid 25404] 10:12:34.070170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.070203 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25404] 10:12:34.070232 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.070258 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.070375 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.070481 getuid( <unfinished ...>
[pid 25404] 10:12:34.070512 read(16,  <unfinished ...>
[pid 25411] 10:12:34.070540 <... getuid resumed> ) = 0
[pid 25404] 10:12:34.070558 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25411] 10:12:34.070794 geteuid( <unfinished ...>
[pid 25404] 10:12:34.070826 close(16 <unfinished ...>
[pid 25411] 10:12:34.070854 <... geteuid resumed> ) = 0
[pid 25404] 10:12:34.070873 <... close resumed> ) = 0
[pid 25411] 10:12:34.070914 getgid( <unfinished ...>
[pid 25404] 10:12:34.070940 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25411] 10:12:34.070977 <... getgid resumed> ) = 12
[pid 25404] 10:12:34.070996 <... open resumed> ) = 16
[pid 25411] 10:12:34.071016 getegid( <unfinished ...>
[pid 25404] 10:12:34.071037 alarm(60 <unfinished ...>
[pid 25411] 10:12:34.071063 <... getegid resumed> ) = 12
[pid 25404] 10:12:34.071140 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.071164 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.071194 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25411] 10:12:34.071224 <... open resumed> ) = 11
[pid 25404] 10:12:34.071241 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.071261 read(11,  <unfinished ...>
[pid 25404] 10:12:34.071285 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.071311 <... read resumed> "N\360\240\244", 4) = 4
[pid 25404] 10:12:34.071329 <... alarm resumed> ) = 60
[pid 25411] 10:12:34.071357 close(11 <unfinished ...>
[pid 25404] 10:12:34.071382 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.071483 <... close resumed> ) = 0
[pid 25404] 10:12:34.071576 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.071610 readlink("/proc/self/exe",  <unfinished ...>
[pid 25404] 10:12:34.071665 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.071705 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25404] 10:12:34.071766 <... open resumed> ) = 17
[pid 25411] 10:12:34.071790 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.071814 read(17,  <unfinished ...>
[pid 25411] 10:12:34.071851 <... ioctl resumed> , 0x7ffdf4a4b980) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.071872 <... read resumed> "cpu  123041 1342360 395068 67343095 2509 0 0 0\ncpu0 123041 1342360 395068 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58209750\nbtime 1450798266\nprocesses 892897\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25411] 10:12:34.071898 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.071920 close(17 <unfinished ...>
[pid 25411] 10:12:34.071949 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.071968 <... close resumed> ) = 0
[pid 25411] 10:12:34.071997 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.072023 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25411] 10:12:34.072054 <... ioctl resumed> , 0x7ffdf4a4b980) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.072072 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.072107 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.072130 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.072162 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.072180 <... open resumed> ) = 17
[pid 25411] 10:12:34.072200 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.072223 fcntl(17, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.072248 <... ioctl resumed> , 0x7ffdf4a4b990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.072265 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.072284 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.072306 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.072332 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.072351 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.072371 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.072399 read(17,  <unfinished ...>
[pid 25411] 10:12:34.072505 <... open resumed> ) = 11
[pid 25404] 10:12:34.072526 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25411] 10:12:34.072556 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.072585 close(17 <unfinished ...>
[pid 25411] 10:12:34.072618 <... ioctl resumed> , 0x7ffdf4a4ba60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.072637 <... close resumed> ) = 0
[pid 25411] 10:12:34.072660 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.072683 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.072713 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.072731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.072753 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25404] 10:12:34.072777 stat("/var/tmp",  <unfinished ...>
[pid 25411] 10:12:34.072809 <... fcntl resumed> ) = 0
[pid 25404] 10:12:34.072832 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25411] 10:12:34.072887 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25404] 10:12:34.072914 brk(0x1c0b000 <unfinished ...>
[pid 25411] 10:12:34.072941 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25404] 10:12:34.073177 <... brk resumed> ) = 0x1c0b000
[pid 25411] 10:12:34.073300 brk(0x1a1a000 <unfinished ...>
[pid 25404] 10:12:34.073329 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.073364 <... brk resumed> ) = 0x1a1a000
[pid 25404] 10:12:34.073392 <... open resumed> ) = 17
[pid 25411] 10:12:34.073479 read(11,  <unfinished ...>
[pid 25404] 10:12:34.073510 fcntl(17, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.073536 <... read resumed> "", 8192) = 0
[pid 25404] 10:12:34.073558 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.073579 close(11 <unfinished ...>
[pid 25404] 10:12:34.073602 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.073627 <... close resumed> ) = 0
[pid 25404] 10:12:34.073899 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.073930 stat("/etc/exim.pl",  <unfinished ...>
[pid 25404] 10:12:34.073959 fstat(17,  <unfinished ...>
[pid 25411] 10:12:34.073984 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:34.074016 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.074058 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.074102 pread(17,  <unfinished ...>
[pid 25418] 10:12:34.074131 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.074154 <... open resumed> ) = 11
[pid 25404] 10:12:34.074173 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25418] 10:12:34.074219 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.074259 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.074301 pread(17,  <unfinished ...>
[pid 25418] 10:12:34.074330 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.074358 <... ioctl resumed> , 0x7ffdf4a4b890) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.074383 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25418] 10:12:34.074517 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.074552 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.074580 pread(17,  <unfinished ...>
[pid 25418] 10:12:34.074608 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.074635 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.074672 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25418] 10:12:34.074728 <... mmap resumed> ) = 0x7f54cb355000
[pid 25411] 10:12:34.074747 read(11,  <unfinished ...>
[pid 25404] 10:12:34.074775 close(17 <unfinished ...>
[pid 25418] 10:12:34.074804 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.074826 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25404] 10:12:34.075711 <... close resumed> ) = 0
[pid 25418] 10:12:34.075761 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.075780 brk(0x1a3b000 <unfinished ...>
[pid 25404] 10:12:34.075810 close(16 <unfinished ...>
[pid 25418] 10:12:34.075842 read(10,  <unfinished ...>
[pid 25411] 10:12:34.075870 <... brk resumed> ) = 0x1a3b000
[pid 25404] 10:12:34.075884 <... close resumed> ) = 0
[pid 25418] 10:12:34.076260 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.076290 read(11,  <unfinished ...>
[pid 25404] 10:12:34.076374 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25418] 10:12:34.076473 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25411] 10:12:34.076514 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25404] 10:12:34.076533 <... lseek resumed> ) = 0
[pid 25418] 10:12:34.077303 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.077345 brk(0x1a5c000 <unfinished ...>
[pid 25404] 10:12:34.077403 read(13,  <unfinished ...>
[pid 25418] 10:12:34.077496 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.077529 <... brk resumed> ) = 0x1a5c000
[pid 25404] 10:12:34.077543 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25418] 10:12:34.078023 <... open resumed> ) = 13
[pid 25411] 10:12:34.078047 read(11,  <unfinished ...>
[pid 25404] 10:12:34.078084 stat("/jail_owner",  <unfinished ...>
[pid 25418] 10:12:34.078117 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.078139 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25404] 10:12:34.078158 <... stat resumed> 0x7ffeeb782550) = -1 ENOENT (No such file or directory)
[pid 25418] 10:12:34.078989 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.079033 read(8,  <unfinished ...>
[pid 25411] 10:12:34.079062 brk(0x1a7d000 <unfinished ...>
[pid 25404] 10:12:34.079086 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25418] 10:12:34.079122 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.079144 <... brk resumed> ) = 0x1a7d000
[pid 25404] 10:12:34.079157 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25418] 10:12:34.079724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.079770 read(11,  <unfinished ...>
[pid 25404] 10:12:34.079797 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25418] 10:12:34.079833 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.079859 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25411] 10:12:34.079878 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25404] 10:12:34.080356 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25418] 10:12:34.080760 <... mmap resumed> ) = 0x7f54cb354000
[pid 25411] 10:12:34.080786 read(11,  <unfinished ...>
[pid 25404] 10:12:34.080814 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25418] 10:12:34.080850 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.080872 <... read resumed> "", 8192) = 0
[pid 25404] 10:12:34.080886 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25418] 10:12:34.080930 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.080945 close(11 <unfinished ...>
[pid 25404] 10:12:34.080972 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25418] 10:12:34.081005 read(13,  <unfinished ...>
[pid 25411] 10:12:34.081030 <... close resumed> ) = 0
[pid 25404] 10:12:34.081044 <... stat resumed> 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25418] 10:12:34.081090 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25411] 10:12:34.081118 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25404] 10:12:34.081154 stat("/etc/demouids",  <unfinished ...>
[pid 25418] 10:12:34.081184 read(13,  <unfinished ...>
[pid 25411] 10:12:34.081205 <... stat resumed> 0x7f816793e880) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.081219 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25418] 10:12:34.081276 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.081294 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25404] 10:12:34.081357 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25418] 10:12:34.081390 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.081486 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:34.081519 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25418] 10:12:34.081613 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25411] 10:12:34.081637 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25404] 10:12:34.081664 stat("/etc/userdomains",  <unfinished ...>
[pid 25418] 10:12:34.081694 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.081719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25404] 10:12:34.081744 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25418] 10:12:34.081795 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25411] 10:12:34.081814 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.081844 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25418] 10:12:34.081875 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.081900 <... open resumed> ) = 11
[pid 25404] 10:12:34.081913 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25418] 10:12:34.081956 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f54ca20c790}, 8) = 0
[pid 25411] 10:12:34.081975 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.082003 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25418] 10:12:34.082034 close(11 <unfinished ...>
[pid 25411] 10:12:34.082056 <... ioctl resumed> , 0x7ffdf4a4b890) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.082071 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25418] 10:12:34.082120 <... close resumed> ) = 0
[pid 25411] 10:12:34.082136 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.082160 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25418] 10:12:34.082333 fcntl(12, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.082373 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.082390 <... open resumed> ) = 16
[pid 25418] 10:12:34.082523 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.082544 read(11,  <unfinished ...>
[pid 25404] 10:12:34.082571 fstat(16,  <unfinished ...>
[pid 25418] 10:12:34.082598 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.082620 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25404] 10:12:34.082639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25418] 10:12:34.082940 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.082962 brk(0x1a9e000 <unfinished ...>
[pid 25404] 10:12:34.083007 fstat(16,  <unfinished ...>
[pid 25418] 10:12:34.083037 geteuid( <unfinished ...>
[pid 25411] 10:12:34.083058 <... brk resumed> ) = 0x1a9e000
[pid 25404] 10:12:34.083072 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25418] 10:12:34.083488 <... geteuid resumed> ) = 0
[pid 25411] 10:12:34.083515 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.083547 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25418] 10:12:34.083579 getegid( <unfinished ...>
[pid 25411] 10:12:34.083600 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.083616 <... mmap resumed> ) = 0x7fb3682b2000
[pid 25418] 10:12:34.083639 <... getegid resumed> ) = 12
[pid 25411] 10:12:34.083652 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.083680 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25418] 10:12:34.083708 setgid(500 <unfinished ...>
[pid 25411] 10:12:34.083729 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.083743 <... lseek resumed> ) = 0
[pid 25418] 10:12:34.083769 <... setgid resumed> ) = 0
[pid 25411] 10:12:34.083784 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.083812 read(16,  <unfinished ...>
[pid 25418] 10:12:34.083843 setuid(503 <unfinished ...>
[pid 25411] 10:12:34.083866 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.083881 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25418] 10:12:34.083947 <... setuid resumed> ) = 0
[pid 25411] 10:12:34.083968 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.084101 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25418] 10:12:34.084142 chdir("/" <unfinished ...>
[pid 25412] 10:12:34.084166 read(8,  <unfinished ...>
[pid 25411] 10:12:34.084186 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.084200 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4074, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25418] 10:12:34.084264 <... chdir resumed> ) = 0
[pid 25411] 10:12:34.084283 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.084338 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25418] 10:12:34.084387 geteuid( <unfinished ...>
[pid 25411] 10:12:34.084490 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.084518 <... open resumed> ) = 17
[pid 25418] 10:12:34.084545 <... geteuid resumed> ) = 503
[pid 25412] 10:12:34.084560 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25411] 10:12:34.084581 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.085291 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25418] 10:12:34.085328 getegid( <unfinished ...>
[pid 25412] 10:12:34.085350 read(8,  <unfinished ...>
[pid 25411] 10:12:34.085370 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.085385 <... ioctl resumed> , 0x7ffeeb77f4f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25418] 10:12:34.085470 <... getegid resumed> ) = 500
[pid 25411] 10:12:34.085492 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.085547 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25418] 10:12:34.085576 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25411] 10:12:34.085603 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.085619 <... lseek resumed> ) = 0
[pid 25418] 10:12:34.085643 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25411] 10:12:34.085671 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.085701 fstat(17,  <unfinished ...>
[pid 25418] 10:12:34.085728 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25411] 10:12:34.085754 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.085770 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4074, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25418] 10:12:34.085808 <... chdir resumed> ) = 0
[pid 25411] 10:12:34.085823 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.085853 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25418] 10:12:34.085881 stat("tmp",  <unfinished ...>
[pid 25411] 10:12:34.085907 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.085921 <... fcntl resumed> ) = 0
[pid 25418] 10:12:34.085950 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25411] 10:12:34.085977 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.086007 read(17,  <unfinished ...>
[pid 25418] 10:12:34.086042 stat("new",  <unfinished ...>
[pid 25411] 10:12:34.086067 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.086081 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4074
[pid 25418] 10:12:34.086758 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:15, st_ctime=2015/12/30-10:10:15}) = 0
[pid 25411] 10:12:34.086797 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25404] 10:12:34.086829 read(17,  <unfinished ...>
[pid 25418] 10:12:34.086857 stat("cur",  <unfinished ...>
[pid 25411] 10:12:34.086882 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.086897 <... read resumed> "", 8192) = 0
[pid 25418] 10:12:34.086923 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25411] 10:12:34.086950 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25404] 10:12:34.087036 close(17 <unfinished ...>
[pid 25418] 10:12:34.087066 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25411] 10:12:34.087098 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25404] 10:12:34.087125 <... close resumed> ) = 0
[pid 25418] 10:12:34.087168 <... open resumed> ) = 11
[pid 25411] 10:12:34.087187 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.087221 stat("/etc/userdomains",  <unfinished ...>
[pid 25418] 10:12:34.087253 read(11,  <unfinished ...>
[pid 25411] 10:12:34.087275 <... open resumed> ) = 12
[pid 25404] 10:12:34.087288 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25418] 10:12:34.087342 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2901
[pid 25411] 10:12:34.087365 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25404] 10:12:34.087521 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25418] 10:12:34.087557 stat("tmp/1451491954.H87494P25418.fin.finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.087588 <... ioctl resumed> , 0x7ffdf4a4b2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25404] 10:12:34.087604 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25418] 10:12:34.087648 <... stat resumed> 0x7ffed9b0f3a0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.087665 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25404] 10:12:34.087691 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25418] 10:12:34.087728 open("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25411] 10:12:34.087782 <... lseek resumed> ) = 0
[pid 25404] 10:12:34.087798 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25418] 10:12:34.087882 <... open resumed> ) = 14
[pid 25411] 10:12:34.087903 read(12,  <unfinished ...>
[pid 25404] 10:12:34.087935 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25418] 10:12:34.087970 chown("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25411] 10:12:34.087999 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25404] 10:12:34.088017 <... open resumed> ) = 17
[pid 25418] 10:12:34.088349 <... chown resumed> ) = 0
[pid 25411] 10:12:34.088372 read(12,  <unfinished ...>
[pid 25404] 10:12:34.088404 fstat(17,  <unfinished ...>
[pid 25418] 10:12:34.088511 chmod("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25411] 10:12:34.088542 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25404] 10:12:34.088561 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25418] 10:12:34.089174 <... chmod resumed> ) = 0
[pid 25411] 10:12:34.089196 brk(0x1abf000 <unfinished ...>
[pid 25404] 10:12:34.089223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25418] 10:12:34.089256 chown("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25412] 10:12:34.089286 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25411] 10:12:34.089306 <... brk resumed> ) = 0x1abf000
[pid 25404] 10:12:34.089483 <... mmap resumed> ) = 0x7fb3682b1000
[pid 25418] 10:12:34.089712 <... chown resumed> ) = 0
[pid 25411] 10:12:34.089734 read(12,  <unfinished ...>
[pid 25404] 10:12:34.089761 read(17,  <unfinished ...>
[pid 25418] 10:12:34.089792 chmod("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25411] 10:12:34.089821 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25404] 10:12:34.089840 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25418] 10:12:34.090512 <... chmod resumed> ) = 0
[pid 25411] 10:12:34.090539 read(12,  <unfinished ...>
[pid 25404] 10:12:34.090611 close(17 <unfinished ...>
[pid 25418] 10:12:34.090648 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.090686 <... read resumed> "", 8192) = 0
[pid 25404] 10:12:34.090701 <... close resumed> ) = 0
[pid 25418] 10:12:34.090726 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.090755 close(12 <unfinished ...>
[pid 25404] 10:12:34.090815 munmap(0x7fb3682b1000, 4096 <unfinished ...>
[pid 25418] 10:12:34.090850 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.090873 <... close resumed> ) = 0
[pid 25404] 10:12:34.090886 <... munmap resumed> ) = 0
[pid 25418] 10:12:34.091662 <... lseek resumed> ) = 19
[pid 25411] 10:12:34.091691 read(11,  <unfinished ...>
[pid 25404] 10:12:34.091721 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25418] 10:12:34.091757 read(6,  <unfinished ...>
[pid 25411] 10:12:34.091785 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25404] 10:12:34.091806 <... open resumed> ) = 17
[pid 25418] 10:12:34.092489 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25404] 10:12:34.092521 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:34.092572 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25418] 10:12:34.092627 read(6,  <unfinished ...>
[pid 25404] 10:12:34.092648 <... mmap resumed> ) = 0x7fb3682b1000
[pid 25418] 10:12:34.093032 <... read resumed> "", 8192) = 0
[pid 25412] 10:12:34.093052 read(8,  <unfinished ...>
[pid 25404] 10:12:34.093075 read(17,  <unfinished ...>
[pid 25418] 10:12:34.093174 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2495 <unfinished ...>
[pid 25404] 10:12:34.093203 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:34.093237 close(17)   = 0
[pid 25404] 10:12:34.093272 munmap(0x7fb3682b1000, 4096) = 0
[pid 25404] 10:12:34.093319 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25404] 10:12:34.093374 pipe([17, 18]) = 0
[pid 25404] 10:12:34.093411 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25418] 10:12:34.093511 <... write resumed> ) = 2495
[pid 25404] 10:12:34.093525 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:34.093549 close(15)   = 0
[pid 25418] 10:12:34.093599 fsync(14 <unfinished ...>
[pid 25404] 10:12:34.093623 munmap(0x7fb3682b3000, 4096) = 0
[pid 25404] 10:12:34.093713 close(14)   = 0
[pid 25404] 10:12:34.093749 munmap(0x7fb3682b4000, 4096) = 0
[pid 25404] 10:12:34.093790 close(9)    = 0
[pid 25404] 10:12:34.093823 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.093858 close(13)   = 0
[pid 25404] 10:12:34.093890 munmap(0x7fb3682b5000, 4096) = 0
[pid 25404] 10:12:34.093925 close(12)   = 0
[pid 25404] 10:12:34.093958 munmap(0x7fb3682b6000, 4096) = 0
[pid 25404] 10:12:34.093991 close(16)   = 0
[pid 25404] 10:12:34.094023 munmap(0x7fb3682b2000, 4096) = 0
[pid 25404] 10:12:34.094056 close(11)   = 0
[pid 25404] 10:12:34.094089 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:34.094123 close(10)   = 0
[pid 25404] 10:12:34.094155 munmap(0x7fb3682b8000, 4096) = 0
[pid 25404] 10:12:34.094190 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25420
[pid 25404] 10:12:34.094562 close(18)   = 0
[pid 25404] 10:12:34.094607 read(17,  <unfinished ...>
[pid 25412] 10:12:34.094767 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25411] 10:12:34.094780 read(11,  <unfinished ...>
[pid 25418] 10:12:34.095015 <... fsync resumed> ) = 0
[pid 25412] 10:12:34.095032 brk(0x14c4000 <unfinished ...>
[pid 25411] 10:12:34.095058 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25418] 10:12:34.095080 lseek(11, 0, SEEK_END) = 2901
[pid 25418] 10:12:34.095506 write(11, "2495 1\n", 7) = 7
[pid 25418] 10:12:34.095556 close(11)   = 0
[pid 25418] 10:12:34.095603 fstat(14, {st_dev=makedev(144, 4215), st_ino=122016382, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2495, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25418] 10:12:34.095662 close(14)   = 0
[pid 25418] 10:12:34.095712 rename("tmp/1451491954.H87494P25418.fin.finestweddingsites.com", "new/1451491954.H87494P25418.fin.finestweddingsites.com,S=2495") = 0
[pid 25418] 10:12:34.095780 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.095820 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.095845 read(11,  <unfinished ...>
[pid 25418] 10:12:34.095879 write(12, "\277\t\0\0", 4 <unfinished ...>
[pid 25412] 10:12:34.095901 <... brk resumed> ) = 0x14c4000
[pid 25418] 10:12:34.096363 <... write resumed> ) = 4
[pid 25412] 10:12:34.096390 read(8,  <unfinished ...>
[pid 25399] 10:12:34.096471 <... read resumed> "\277\t\0\0", 4) = 4
[pid 25399] 10:12:34.096501 read(11,  <unfinished ...>
[pid 25418] 10:12:34.096531 write(12, "\0\0\20\0", 4) = 4
[pid 25399] 10:12:34.096566 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25399] 10:12:34.096592 read(11,  <unfinished ...>
[pid 25418] 10:12:34.096620 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.096659 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.096683 read(11,  <unfinished ...>
[pid 25418] 10:12:34.096711 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.096744 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.096763 read(11,  <unfinished ...>
[pid 25418] 10:12:34.096790 write(12, "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.097229 read(11,  <unfinished ...>
[pid 25399] 10:12:34.097255 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.097277 read(11,  <unfinished ...>
[pid 25418] 10:12:34.097305 write(12, "\260SK\1\0\0\0\0", 8) = 8
[pid 25399] 10:12:34.097340 <... read resumed> "\260SK\1\0\0\0\0", 8) = 8
[pid 25399] 10:12:34.097360 read(11,  <unfinished ...>
[pid 25418] 10:12:34.097387 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.097480 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.097508 read(11,  <unfinished ...>
[pid 25418] 10:12:34.097537 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.097580 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.097606 close(11)   = 0
[pid 25418] 10:12:34.097659 close(12 <unfinished ...>
[pid 25399] 10:12:34.097686 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55) = 55
[pid 25399] 10:12:34.097737 fsync(9 <unfinished ...>
[pid 25418] 10:12:34.097797 <... close resumed> ) = 0
[pid 25418] 10:12:34.097824 close(10)   = 0
[pid 25418] 10:12:34.097875 munmap(0x7f54cb355000, 4096) = 0
[pid 25418] 10:12:34.097919 close(13)   = 0
[pid 25418] 10:12:34.097956 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25399] 10:12:34.097982 <... fsync resumed> ) = 0
[pid 25399] 10:12:34.097999 wait4(-1,  <unfinished ...>
[pid 25418] 10:12:34.098030 <... munmap resumed> ) = 0
[pid 25418] 10:12:34.098504 exit_group(0) = ?
[pid 25418] 10:12:34.098821 +++ exited with 0 +++
[pid 25399] 10:12:34.098839 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25418
[pid 25399] 10:12:34.098892 open("/etc/userdomains", O_RDONLY) = 10
[pid 25399] 10:12:34.098936 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.098987 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.099031 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:34.099068 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.099102 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:34.099165 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com", 0x7ffed9b0e0f0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.099219 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.099283 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25399] 10:12:34.099335 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.099395 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.099524 close(7)    = 0
[pid 25399] 10:12:34.099564 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:34.099609 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:34.099641 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.099674 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363461, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.099719 write(7, "2015-12-30 10:12:34 [25399] 1aEJMX-0006bd-HC => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2495 QT=1s DT=0s\n", 232) = 232
[pid 25399] 10:12:34.099771 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25399] 10:12:34.099814 alarm(60)   = 0
[pid 25399] 10:12:34.099848 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25399] 10:12:34.099885 alarm(0)    = 60
[pid 25399] 10:12:34.099965 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:34.100020 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25399] 10:12:34.100060 fcntl(12, F_GETFD) = 0
[pid 25399] 10:12:34.100092 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.100124 read(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25399] 10:12:34.100166 close(12)   = 0
[pid 25399] 10:12:34.100206 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.100247 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25399] 10:12:34.100383 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25412] 10:12:34.100516 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25411] 10:12:34.100538 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25412] 10:12:34.101300 brk(0x14e5000 <unfinished ...>
[pid 25399] 10:12:34.101930 fcntl(12, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.101965 brk(0x1ae0000 <unfinished ...>
[pid 25399] 10:12:34.101987 <... fcntl resumed> ) = 0
[pid 25399] 10:12:34.102005 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.102038 fstat(12, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25399] 10:12:34.102101 pread(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25399] 10:12:34.102158 pread(12, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25399] 10:12:34.102214 close(12)   = 0
[pid 25399] 10:12:34.102262 close(11)   = 0
[pid 25399] 10:12:34.102318 pipe([11, 12]) = 0
[pid 25399] 10:12:34.102360 close(10)   = 0
[pid 25399] 10:12:34.102394 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:34.102507 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25421
[pid 25399] 10:12:34.102731 close(12)   = 0
[pid 25399] 10:12:34.102766 read(11,  <unfinished ...>
[pid 25411] 10:12:34.102796 <... brk resumed> ) = 0x1ae0000
[pid 25411] 10:12:34.102889 read(11, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25412] 10:12:34.103480 <... brk resumed> ) = 0x14e5000
[pid 25412] 10:12:34.103668 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25412] 10:12:34.104199 read(8,  <unfinished ...>
[pid 25411] 10:12:34.104344 read(11, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25411] 10:12:34.104914 brk(0x1b01000 <unfinished ...>
[pid 25412] 10:12:34.104960 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25411] 10:12:34.105476 <... brk resumed> ) = 0x1b01000
[pid 25411] 10:12:34.105954 read(11,  <unfinished ...>
[pid 25412] 10:12:34.106099 brk(0x1506000) = 0x1506000
[pid 25412] 10:12:34.106275 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25412] 10:12:34.106977 read(8,  <unfinished ...>
[pid 25411] 10:12:34.107020 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25411] 10:12:34.107629 read(11,  <unfinished ...>
[pid 25412] 10:12:34.107673 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25412] 10:12:34.108138 brk(0x1527000 <unfinished ...>
[pid 25411] 10:12:34.108180 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
Process 25420 attached
[pid 25420] 10:12:34.108530 set_robust_list(0x7fb3682a3aa0, 24) = 0
[pid 25420] 10:12:34.108593 close(17)   = 0
[pid 25420] 10:12:34.108636 geteuid()   = 0
[pid 25420] 10:12:34.108670 getegid()   = 12
[pid 25420] 10:12:34.108705 setgid(500) = 0
[pid 25420] 10:12:34.108738 setuid(503) = 0
[pid 25420] 10:12:34.108807 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25420] 10:12:34.108857 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.109053 brk(0x1b22000 <unfinished ...>
[pid 25420] 10:12:34.109193 fstat(9,  <unfinished ...>
[pid 25412] 10:12:34.109222 <... brk resumed> ) = 0x1527000
[pid 25420] 10:12:34.109478 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25420] 10:12:34.109525 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25420] 10:12:34.109566 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25420] 10:12:34.109619 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25420] 10:12:34.109664 close(9 <unfinished ...>
[pid 25411] 10:12:34.109692 <... brk resumed> ) = 0x1b22000
[pid 25420] 10:12:34.109712 <... close resumed> ) = 0
[pid 25411] 10:12:34.110010 read(11,  <unfinished ...>
[pid 25420] 10:12:34.110045 munmap(0x7fb3682b9000, 4096) = 0
[pid 25412] 10:12:34.110639 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25411] 10:12:34.110685 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25411] 10:12:34.111324 read(11,  <unfinished ...>
[pid 25412] 10:12:34.111370 <... stat resumed> 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111393 stat("/usr/local/cpanel/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111508 stat("/etc/exim/perl/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111550 stat("/etc/exim/perl/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111589 stat("/usr/local/cpanel/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111627 stat("/usr/local/cpanel/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111667 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25420] 10:12:34.111783 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.111815 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111860 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111901 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111943 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.111984 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.112033 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.112073 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25420] 10:12:34.112128 <... lseek resumed> ) = 19
[pid 25412] 10:12:34.112149 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25420] 10:12:34.112177 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2370) = 1858
[pid 25412] 10:12:34.112224 <... open resumed> ) = 9
[pid 25412] 10:12:34.112491 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfcd10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.112542 lseek(9, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.112600 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25412] 10:12:34.112830 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25420] 10:12:34.113149 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25412] 10:12:34.113182 <... lseek resumed> ) = 878
[pid 25412] 10:12:34.113202 lseek(9, 0, SEEK_CUR) = 878
[pid 25412] 10:12:34.113236 close(9)    = 0
[pid 25412] 10:12:34.113556 read(8,  <unfinished ...>
[pid 25420] 10:12:34.113613 <... write resumed> ) = 4
[pid 25404] 10:12:34.113629 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25404] 10:12:34.113652 read(17,  <unfinished ...>
[pid 25411] 10:12:34.113682 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25420] 10:12:34.113706 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.113968 brk(0x1b43000 <unfinished ...>
[pid 25420] 10:12:34.114003 <... write resumed> ) = 4
[pid 25404] 10:12:34.114017 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25404] 10:12:34.114039 read(17,  <unfinished ...>
[pid 25420] 10:12:34.114067 write(18, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.114100 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.114122 read(17,  <unfinished ...>
[pid 25420] 10:12:34.114152 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25412] 10:12:34.114182 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25420] 10:12:34.114213 <... write resumed> ) = 40
[pid 25404] 10:12:34.114228 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25404] 10:12:34.114248 read(17,  <unfinished ...>
[pid 25420] 10:12:34.114275 write(18, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.114519 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.114544 wait4(-1,  <unfinished ...>
[pid 25420] 10:12:34.114573 close(18)   = 0
[pid 25420] 10:12:34.114626 exit_group(0) = ?
[pid 25420] 10:12:34.114882 +++ exited with 0 +++
[pid 25404] 10:12:34.114905 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25420
[pid 25404] 10:12:34.114928 close(17)   = 0
[pid 25404] 10:12:34.114963 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:34.115024 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.115090 open("/etc/userdomains", O_RDONLY) = 9
[pid 25404] 10:12:34.115132 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.115180 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.115224 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:34.115260 lseek(9, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.115293 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:34.115349 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.115408 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.115567 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.115638 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.115700 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25404] 10:12:34.115742 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.115788 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.115831 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b8000
[pid 25404] 10:12:34.115866 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.115899 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25404] 10:12:34.115943 read(10, "", 4096) = 0
[pid 25404] 10:12:34.115992 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25404] 10:12:34.116035 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:34.116086 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b7000
[pid 25404] 10:12:34.116121 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:34.116170 close(11)   = 0
[pid 25404] 10:12:34.116204 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:34.116254 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.116319 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25404] 10:12:34.116381 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.116563 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25404] 10:12:34.116609 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.116656 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.116699 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b7000
[pid 25404] 10:12:34.116734 lseek(11, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.116767 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25404] 10:12:34.116826 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.116882 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.116942 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.117014 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable", 0x7ffeeb780fa0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.117064 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.117128 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.117205 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.117267 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25404] 10:12:34.117326 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.117391 lseek(11, 2781, SEEK_SET) = 2781
[pid 25404] 10:12:34.117565 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.117625 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.117683 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.117751 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable", 0x7ffeeb780fa0) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.117800 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.117858 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25404] 10:12:34.117929 open("/etc/localdomains", O_RDONLY) = 12
[pid 25404] 10:12:34.117974 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118021 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118063 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b6000
[pid 25404] 10:12:34.118098 lseek(12, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.118132 read(12, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25404] 10:12:34.118188 stat("/jail_owner", 0x7ffeeb782550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.118233 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:34.118292 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.118342 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25404] 10:12:34.118396 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.118528 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118596 open("/etc/demouids", O_RDONLY) = 13
[pid 25404] 10:12:34.118638 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118684 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118728 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b5000
[pid 25404] 10:12:34.118764 lseek(13, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.118797 read(13, "", 4096) = 0
[pid 25404] 10:12:34.118836 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.118918 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.118974 lseek(9, 353, SEEK_SET) = 353
[pid 25404] 10:12:34.119023 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25404] 10:12:34.119068 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:34.119113 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b4000
[pid 25404] 10:12:34.119149 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:34.119196 close(14)   = 0
[pid 25404] 10:12:34.119230 munmap(0x7fb3682b4000, 4096) = 0
[pid 25404] 10:12:34.119279 stat("//etc/fin.finestweddingsites.com", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.119330 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.119393 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.119541 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.119608 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.119669 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.119725 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.119789 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.119833 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.119889 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25404] 10:12:34.119930 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.119976 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.120019 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b4000
[pid 25404] 10:12:34.120055 lseek(14, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.120089 read(14, "", 4096) = 0
[pid 25404] 10:12:34.120132 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25404] 10:12:34.120173 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:34.120217 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b3000
[pid 25404] 10:12:34.120252 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:34.120297 close(15)   = 0
[pid 25404] 10:12:34.120355 munmap(0x7fb3682b3000, 4096) = 0
[pid 25404] 10:12:34.120405 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.120562 stat("//.spamassassinboxenable", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.120609 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.120662 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25404] 10:12:34.120720 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.120762 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.120820 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffeeb785340) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.120862 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.120915 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.121019 lseek(14, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.121059 read(14, "", 4096) = 0
[pid 25404] 10:12:34.121111 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.121174 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 15
[pid 25404] 10:12:34.121216 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.121263 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.121316 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b3000
[pid 25404] 10:12:34.121354 lseek(15, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.121387 read(15, "", 4096) = 0
[pid 25404] 10:12:34.121507 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25404] 10:12:34.121579 open("/etc/group", O_RDONLY|O_CLOEXEC) = 16
[pid 25404] 10:12:34.121627 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25404] 10:12:34.121681 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b2000
[pid 25404] 10:12:34.121724 read(16, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25404] 10:12:34.121772 close(16)   = 0
[pid 25404] 10:12:34.121806 munmap(0x7fb3682b2000, 4096) = 0
[pid 25404] 10:12:34.121856 open("/etc/aliases", O_RDONLY) = 16
[pid 25404] 10:12:34.121900 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25404] 10:12:34.121947 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25404] 10:12:34.121992 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b2000
[pid 25404] 10:12:34.122027 lseek(16, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.122060 read(16, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25404] 10:12:34.122113 read(16, "", 4096) = 0
[pid 25404] 10:12:34.122157 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25404] 10:12:34.122199 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25404] 10:12:34.122243 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b1000
[pid 25404] 10:12:34.122279 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25404] 10:12:34.122329 close(17)   = 0
[pid 25404] 10:12:34.122363 munmap(0x7fb3682b1000, 4096) = 0
[pid 25404] 10:12:34.122409 open("/etc/localaliases", O_RDONLY) = 17
[pid 25404] 10:12:34.122535 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:34.122588 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25404] 10:12:34.122639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b1000
[pid 25404] 10:12:34.122675 lseek(17, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.122708 read(17, "", 4096) = 0
[pid 25404] 10:12:34.122753 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.122812 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.122869 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.122931 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.122991 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.123060 write(8, "2015-12-30 10:12:34 routing failed for finest09@fin.finestweddingsites.com <embassyphxnorth@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 177) = 177
[pid 25404] 10:12:34.123133 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.123202 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.123254 close(7)    = 0
[pid 25404] 10:12:34.123291 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25404] 10:12:34.123335 fcntl(7, F_GETFD) = 0
[pid 25404] 10:12:34.123368 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.123400 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363693, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.123542 write(7, "2015-12-30 10:12:34 [25404] 1aEJMX-0006bg-Lo ** finest09@fin.finestweddingsites.com <embassyphxnorth@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 186) = 186
[pid 25404] 10:12:34.123584 close(16)   = 0
[pid 25404] 10:12:34.123618 munmap(0x7fb3682b2000, 4096) = 0
[pid 25404] 10:12:34.123656 close(17)   = 0
[pid 25404] 10:12:34.123689 munmap(0x7fb3682b1000, 4096) = 0
[pid 25404] 10:12:34.123723 close(13)   = 0
[pid 25404] 10:12:34.123756 munmap(0x7fb3682b5000, 4096) = 0
[pid 25404] 10:12:34.123791 close(14)   = 0
[pid 25404] 10:12:34.123824 munmap(0x7fb3682b4000, 4096) = 0
[pid 25404] 10:12:34.123858 close(9)    = 0
[pid 25404] 10:12:34.123890 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.123925 close(12)   = 0
[pid 25404] 10:12:34.123957 munmap(0x7fb3682b6000, 4096) = 0
[pid 25404] 10:12:34.123992 close(15)   = 0
[pid 25404] 10:12:34.124025 munmap(0x7fb3682b3000, 4096) = 0
[pid 25404] 10:12:34.124058 close(11)   = 0
[pid 25404] 10:12:34.124091 munmap(0x7fb3682b7000, 4096) = 0
[pid 25404] 10:12:34.124125 close(10)   = 0
[pid 25404] 10:12:34.124157 munmap(0x7fb3682b8000, 4096) = 0
[pid 25404] 10:12:34.124197 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-J", O_WRONLY|O_CREAT|O_APPEND, 0640) = 9
[pid 25404] 10:12:34.124273 fcntl(9, F_GETFD) = 0
[pid 25404] 10:12:34.124306 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.124338 fchown(9, 47, 12) = 0
[pid 25404] 10:12:34.124377 fchmod(9, 0640) = 0
[pid 25404] 10:12:34.124505 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 10
[pid 25404] 10:12:34.124563 alarm(60)   = 0
[pid 25404] 10:12:34.124607 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}Process 25421 attached
) = 0
[pid 25412] 10:12:34.125199 read(8,  <unfinished ...>
[pid 25411] 10:12:34.125242 <... brk resumed> ) = 0x1b43000
[pid 25421] 10:12:34.125260 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25404] 10:12:34.125906 alarm(0 <unfinished ...>
[pid 25421] 10:12:34.125947 <... set_robust_list resumed> ) = 0
[pid 25411] 10:12:34.125962 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25404] 10:12:34.126062 <... alarm resumed> ) = 60
[pid 25421] 10:12:34.126110 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25412] 10:12:34.126140 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25404] 10:12:34.126159 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25421] 10:12:34.126317 <... setrlimit resumed> ) = 0
[pid 25412] 10:12:34.126332 brk(0x1548000 <unfinished ...>
[pid 25404] 10:12:34.126532 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25421] 10:12:34.126575 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25404] 10:12:34.126600 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25404] 10:12:34.126640 fcntl(11, F_GETFD) = 0
[pid 25404] 10:12:34.126671 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.126703 read(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25404] 10:12:34.126745 close(11)   = 0
[pid 25404] 10:12:34.126785 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.126826 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25404] 10:12:34.126971 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25404] 10:12:34.127016 fcntl(11, F_GETFD) = 0
[pid 25404] 10:12:34.127047 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.127079 fstat(11, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:34.127136 pread(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25404] 10:12:34.127189 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25404] 10:12:34.127237 close(11)   = 0
[pid 25404] 10:12:34.127290 close(10)   = 0
[pid 25404] 10:12:34.127357 open("/etc/userdomains", O_RDONLY) = 10
[pid 25404] 10:12:34.127400 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.127545 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.127590 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:34.127625 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.127658 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:34.127718 pipe([11, 12]) = 0
[pid 25404] 10:12:34.127758 close(10)   = 0
[pid 25404] 10:12:34.127791 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.127829 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25422
[pid 25404] 10:12:34.128057 close(12)   = 0
[pid 25404] 10:12:34.128092 read(11,  <unfinished ...>
[pid 25421] 10:12:34.128134 <... open resumed> ) = 10
[pid 25412] 10:12:34.128150 <... brk resumed> ) = 0x1548000
[pid 25411] 10:12:34.128174 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129271 fstat(10,  <unfinished ...>
[pid 25412] 10:12:34.129315 read(8,  <unfinished ...>
[pid 25421] 10:12:34.129341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.129370 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.129473 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.129501 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129531 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.129560 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.129594 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.129617 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129643 <... mmap resumed> ) = 0x7f54cb355000
[pid 25411] 10:12:34.129658 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.129690 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.129710 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129735 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.129749 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.129783 read(10,  <unfinished ...>
[pid 25411] 10:12:34.129802 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129829 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.129849 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.129929 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25411] 10:12:34.129958 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.129989 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.130017 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.130080 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.130102 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130130 <... open resumed> ) = 13
[pid 25411] 10:12:34.130145 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.130179 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.130199 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130223 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.130250 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.130290 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.130317 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.130372 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.130411 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.130519 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130549 <... mmap resumed> ) = 0x7f54cb354000
[pid 25411] 10:12:34.130564 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.130600 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.130620 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130642 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.130656 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.130690 read(13,  <unfinished ...>
[pid 25411] 10:12:34.130709 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130738 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25411] 10:12:34.130757 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25421] 10:12:34.130825 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.130851 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.130874 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25411] 10:12:34.130890 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25421] 10:12:34.130923 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.130946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25421] 10:12:34.130988 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25411] 10:12:34.131005 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25421] 10:12:34.131041 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25411] 10:12:34.131064 <... open resumed> ) = 12
[pid 25421] 10:12:34.131088 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f54ca20c790}, 8) = 0
[pid 25411] 10:12:34.131106 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25421] 10:12:34.131139 close(11 <unfinished ...>
[pid 25411] 10:12:34.131159 <... ioctl resumed> , 0x7ffdf4a4b2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25421] 10:12:34.131182 <... close resumed> ) = 0
[pid 25411] 10:12:34.131196 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25421] 10:12:34.131224 fcntl(12, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.131243 <... lseek resumed> ) = 0
[pid 25421] 10:12:34.131285 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.131303 read(12,  <unfinished ...>
[pid 25421] 10:12:34.131332 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.131352 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25421] 10:12:34.131669 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.131695 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25421] 10:12:34.131745 geteuid( <unfinished ...>
[pid 25411] 10:12:34.131766 <... lseek resumed> ) = 878
[pid 25421] 10:12:34.131787 <... geteuid resumed> ) = 0
[pid 25411] 10:12:34.131801 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25421] 10:12:34.131829 getegid( <unfinished ...>
[pid 25411] 10:12:34.131848 <... lseek resumed> ) = 878
[pid 25421] 10:12:34.131869 <... getegid resumed> ) = 12
[pid 25411] 10:12:34.131883 close(12 <unfinished ...>
[pid 25421] 10:12:34.131921 setgid(500 <unfinished ...>
[pid 25412] 10:12:34.131943 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25411] 10:12:34.131963 <... close resumed> ) = 0
[pid 25421] 10:12:34.132186 <... setgid resumed> ) = 0
[pid 25412] 10:12:34.132516 brk(0x1569000 <unfinished ...>
[pid 25421] 10:12:34.132555 setuid(503 <unfinished ...>
[pid 25411] 10:12:34.132576 read(11,  <unfinished ...>
[pid 25421] 10:12:34.132609 <... setuid resumed> ) = 0
[pid 25411] 10:12:34.132622 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25421] 10:12:34.133103 chdir("/" <unfinished ...>
[pid 25411] 10:12:34.133139 brk(0x1b64000 <unfinished ...>
[pid 25421] 10:12:34.133168 <... chdir resumed> ) = 0
[pid 25421] 10:12:34.133200 geteuid()   = 503
[pid 25421] 10:12:34.133234 getegid()   = 500
[pid 25421] 10:12:34.133289 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25411] 10:12:34.133315 <... brk resumed> ) = 0x1b64000
[pid 25421] 10:12:34.133472 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25421] 10:12:34.133523 chdir("/home/finest09/mail/finestweddingsites.com/lisa") = 0
[pid 25421] 10:12:34.133564 stat("tmp", {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25421] 10:12:34.133614 stat("new", {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:09:28, st_ctime=2015/12/30-10:09:28}) = 0
[pid 25412] 10:12:34.133693 <... brk resumed> ) = 0x1569000
[pid 25421] 10:12:34.133717 stat("cur",  <unfinished ...>
[pid 25411] 10:12:34.134378 read(11,  <unfinished ...>
[pid 25421] 10:12:34.134483 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25411] 10:12:34.134516 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25421] 10:12:34.135476 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25421] 10:12:34.135543 read(11, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4074
[pid 25421] 10:12:34.135656 stat("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", 0x7ffed9b0f3a0) = -1 ENOENT (No such file or directory)
[pid 25421] 10:12:34.135708 open("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25421] 10:12:34.135781 chown("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", 503, 500) = 0
[pid 25421] 10:12:34.135828 chmod("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", 0660) = 0
[pid 25421] 10:12:34.135867 chown("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", 503, 500) = 0
[pid 25421] 10:12:34.135905 chmod("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", 0660) = 0
[pid 25421] 10:12:34.135974 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25421] 10:12:34.136059 lseek(6, 19, SEEK_SET) = 19
[pid 25421] 10:12:34.136096 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25421] 10:12:34.136148 read(6, "", 8192) = 0
[pid 25421] 10:12:34.136182 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2495) = 2495
[pid 25421] 10:12:34.136228 fsync(14)   = 0
[pid 25412] 10:12:34.136963 read(8,  <unfinished ...>
[pid 25421] 10:12:34.137000 lseek(11, 0, SEEK_END) = 4074
[pid 25421] 10:12:34.137035 write(11, "2495 1\n", 7) = 7
[pid 25421] 10:12:34.137079 close(11)   = 0
[pid 25421] 10:12:34.137122 fstat(14, {st_dev=makedev(144, 4215), st_ino=122178994, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2495, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25421] 10:12:34.137179 close(14)   = 0
[pid 25421] 10:12:34.137226 rename("tmp/1451491954.H135645P25421.fin.finestweddingsites.com", "new/1451491954.H135645P25421.fin.finestweddingsites.com,S=2495") = 0
[pid 25421] 10:12:34.137292 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137332 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137356 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137386 write(12, "\277\t\0\0", 4) = 4
[pid 25399] 10:12:34.137484 <... read resumed> "\277\t\0\0", 4) = 4
[pid 25399] 10:12:34.137509 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137537 write(12, "\200\0\0\0", 4) = 4
[pid 25399] 10:12:34.137570 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25399] 10:12:34.137590 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137617 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137649 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137668 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137695 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137727 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137746 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137773 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137805 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137824 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137851 write(12, "\260SK\1\0\0\0\0", 8) = 8
[pid 25399] 10:12:34.137883 <... read resumed> "\260SK\1\0\0\0\0", 8) = 8
[pid 25399] 10:12:34.137902 read(11,  <unfinished ...>
[pid 25421] 10:12:34.137929 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137961 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.137981 read(11,  <unfinished ...>
[pid 25421] 10:12:34.138008 write(12, "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.138040 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25399] 10:12:34.138059 close(11)   = 0
[pid 25399] 10:12:34.138102 write(9, "lisa@finestweddingsites.com\n", 28) = 28
[pid 25399] 10:12:34.138145 fsync(9 <unfinished ...>
[pid 25421] 10:12:34.138191 close(12)   = 0
[pid 25421] 10:12:34.138240 close(10)   = 0
[pid 25421] 10:12:34.138290 munmap(0x7f54cb355000, 4096) = 0
[pid 25421] 10:12:34.138340 close(13)   = 0
[pid 25421] 10:12:34.138392 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25399] 10:12:34.138483 <... fsync resumed> ) = 0
[pid 25399] 10:12:34.138508 wait4(-1,  <unfinished ...>
[pid 25421] 10:12:34.138540 <... munmap resumed> ) = 0
[pid 25421] 10:12:34.138938 exit_group(0) = ?
[pid 25421] 10:12:34.139216 +++ exited with 0 +++
[pid 25399] 10:12:34.139233 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25421
[pid 25399] 10:12:34.139283 open("/etc/userdomains", O_RDONLY) = 10
[pid 25399] 10:12:34.139326 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.139379 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25399] 10:12:34.139496 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:34.139536 lseek(10, 0, SEEK_SET) = 0
[pid 25399] 10:12:34.139569 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25399] 10:12:34.139633 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com", 0x7ffed9b0e0f0) = -1 ENOENT (No such file or directory)
[pid 25399] 10:12:34.139685 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.139751 write(8, "2015-12-30 10:12:34 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126) = 126
[pid 25399] 10:12:34.139800 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com: children all complete\n", 77) = 77
[pid 25399] 10:12:34.139849 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.139906 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.139957 close(7)    = 0
[pid 25399] 10:12:34.139995 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:34.140037 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:34.140069 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.140100 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5363879, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.140144 write(7, "2015-12-30 10:12:34 [25399] 1aEJMX-0006bd-HC => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2495 QT=1s "..., 262) = 262
[pid 25399] 10:12:34.140214 pipe([11, 12]) = 0
[pid 25399] 10:12:34.140253 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25399] 10:12:34.140286 close(10)   = 0
[pid 25399] 10:12:34.140319 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:34.140367 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25423
[pid 25399] 10:12:34.140678 close(12)   = 0
[pid 25399] 10:12:34.140733 wait4(-1, 0x7ffed9b0f6a0, WNOHANG, NULL) = 0
[pid 25399] 10:12:34.140779 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25411] 10:12:34.141052 brk(0x1b85000) = 0x1b85000
[pid 25411] 10:12:34.141196 read(11,  <unfinished ...>
[pid 25412] 10:12:34.141233 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25412] 10:12:34.141353 brk(0x158a000 <unfinished ...>
[pid 25411] 10:12:34.141393 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25412] 10:12:34.142357 <... brk resumed> ) = 0x158a000
[pid 25412] 10:12:34.143155 stat("/usr/local/cpanel/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143215 stat("/usr/local/cpanel/Errno.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143259 stat("/etc/exim/perl/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143297 stat("/etc/exim/perl/Errno.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143476 stat("/usr/local/cpanel/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143528 stat("/usr/local/cpanel/Errno.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143576 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143621 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143663 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143704 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143746 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.143787 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25412] 10:12:34.143843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25411] 10:12:34.144043 brk(0x1ba6000 <unfinished ...>
[pid 25412] 10:12:34.144080 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffebbdfcd10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25412] 10:12:34.144118 lseek(9, 0, SEEK_CUR) = 0
[pid 25412] 10:12:34.144174 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25411] 10:12:34.144355 <... brk resumed> ) = 0x1ba6000
[pid 25412] 10:12:34.144526 brk(0x15ab000 <unfinished ...>
[pid 25411] 10:12:34.144772 read(11,  <unfinished ...>
[pid 25412] 10:12:34.144805 <... brk resumed> ) = 0x15ab000
[pid 25412] 10:12:34.145233 lseek(9, 4868, SEEK_SETProcess 25422 attached
 <unfinished ...>
[pid 25422] 10:12:34.145308 set_robust_list(0x7fb3682a3aa0, 24) = 0
[pid 25422] 10:12:34.145406 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0}) = 0
[pid 25422] 10:12:34.145690 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.145727 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25422] 10:12:34.146348 <... open resumed> ) = 10
[pid 25422] 10:12:34.146394 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25422] 10:12:34.146526 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25422] 10:12:34.146578 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25422] 10:12:34.146619 lseek(10, 0, SEEK_SET) = 0
[pid 25422] 10:12:34.146655 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25422] 10:12:34.146743 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.146808 <... lseek resumed> ) = 4868
[pid 25412] 10:12:34.146829 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25422] 10:12:34.146882 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.146912 <... lseek resumed> ) = 4868
[pid 25412] 10:12:34.146931 close(9)    = 0
[pid 25412] 10:12:34.146983 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25422] 10:12:34.147020 <... open resumed> ) = 13
[pid 25412] 10:12:34.147043 <... stat resumed> 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147065 fstat(13,  <unfinished ...>
[pid 25412] 10:12:34.147090 stat("/usr/local/cpanel/Exporter.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147128 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25422] 10:12:34.147162 fstat(13,  <unfinished ...>
[pid 25412] 10:12:34.147190 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25422] 10:12:34.147216 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25412] 10:12:34.147247 <... stat resumed> 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147267 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b8000
[pid 25412] 10:12:34.147304 stat("/etc/exim/perl/Exporter.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147341 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.147368 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25422] 10:12:34.147395 <... lseek resumed> ) = 0
[pid 25422] 10:12:34.147494 read(13,  <unfinished ...>
[pid 25412] 10:12:34.147531 <... stat resumed> 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147555 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25412] 10:12:34.147581 stat("/usr/local/cpanel/Exporter.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147625 read(13,  <unfinished ...>
[pid 25412] 10:12:34.147654 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25422] 10:12:34.147681 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:34.147705 <... stat resumed> 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.147752 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25412] 10:12:34.147786 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffebbdfcf20) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.147830 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffebbdfcfc0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.147870 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25422] 10:12:34.147897 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25412] 10:12:34.147922 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25422] 10:12:34.147960 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25422] 10:12:34.147999 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25412] 10:12:34.148029 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25422] 10:12:34.148056 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fb367170790}, 8) = 0
[pid 25422] 10:12:34.148079 close(11 <unfinished ...>
[pid 25412] 10:12:34.148111 <... open resumed> ) = 9
[pid 25422] 10:12:34.148130 <... close resumed> ) = 0
[pid 25422] 10:12:34.148148 fcntl(12, F_GETFD <unfinished ...>
[pid 25412] 10:12:34.148175 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25422] 10:12:34.148202 <... fcntl resumed> ) = 0
[pid 25422] 10:12:34.148220 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.148245 <... ioctl resumed> , 0x7ffebbdfcd10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25422] 10:12:34.148264 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.148283 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25422] 10:12:34.148325 geteuid( <unfinished ...>
[pid 25412] 10:12:34.148357 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.148396 read(9,  <unfinished ...>
[pid 25422] 10:12:34.148520 <... geteuid resumed> ) = 0
[pid 25422] 10:12:34.148542 getegid()   = 12
[pid 25412] 10:12:34.148576 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25422] 10:12:34.148603 setgid(500 <unfinished ...>
[pid 25412] 10:12:34.149039 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25422] 10:12:34.149072 <... setgid resumed> ) = 0
[pid 25422] 10:12:34.149092 setuid(503) = 0
[pid 25422] 10:12:34.149127 chdir("/")  = 0
[pid 25422] 10:12:34.149173 geteuid()   = 503
[pid 25422] 10:12:34.149206 getegid()   = 500
[pid 25422] 10:12:34.149262 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom", {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25422] 10:12:34.149321 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom") = 0
[pid 25422] 10:12:34.149358 stat("tmp", {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25422] 10:12:34.149406 stat("new", {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25422] 10:12:34.149533 stat("cur", {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25422] 10:12:34.149639 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25422] 10:12:34.149703 read(11, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2908
[pid 25422] 10:12:34.149797 stat("tmp/1451491954.H149787P25422.fin.finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.150133 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25422] 10:12:34.150175 <... stat resumed> 0x7ffeeb785540) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.150199 open("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25422] 10:12:34.150269 chown("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", 503, 500) = 0
[pid 25422] 10:12:34.150314 chmod("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", 0660) = 0
[pid 25422] 10:12:34.150354 chown("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", 503, 500) = 0
[pid 25422] 10:12:34.150392 chmod("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", 0660) = 0
[pid 25422] 10:12:34.150535 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25422] 10:12:34.150632 lseek(6, 19, SEEK_SET) = 19
[pid 25422] 10:12:34.150688 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25422] 10:12:34.150742 read(6, "", 8192) = 0
[pid 25422] 10:12:34.150777 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2515) = 2515
[pid 25412] 10:12:34.150885 <... lseek resumed> ) = 2366
[pid 25422] 10:12:34.150911 fsync(14 <unfinished ...>
[pid 25412] 10:12:34.150938 lseek(9, 0, SEEK_CUR) = 2366
[pid 25412] 10:12:34.150999 close(9)    = 0
[pid 25412] 10:12:34.151334 read(8,  <unfinished ...>
[pid 25411] 10:12:34.151400 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.151476 stat("/usr/local/cpanel/Errno.pm", 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.151526 stat("/etc/exim/perl/Errno.pmc", 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.151568 <... fsync resumed> ) = 0
[pid 25422] 10:12:34.151593 lseek(11, 0, SEEK_END) = 2908
[pid 25422] 10:12:34.151635 write(11, "2515 1\n", 7) = 7
[pid 25422] 10:12:34.151684 close(11)   = 0
[pid 25422] 10:12:34.151723 fstat(14, {st_dev=makedev(144, 4215), st_ino=122016384, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2515, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25422] 10:12:34.151771 close(14)   = 0
[pid 25422] 10:12:34.151817 rename("tmp/1451491954.H149787P25422.fin.finestweddingsites.com", "new/1451491954.H149787P25422.fin.finestweddingsites.com,S=2515") = 0
[pid 25411] 10:12:34.151880 stat("/etc/exim/perl/Errno.pm", 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.151923 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25422] 10:12:34.151952 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.151982 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.152009 <... write resumed> ) = 4
[pid 25404] 10:12:34.152023 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152046 read(11,  <unfinished ...>
[pid 25411] 10:12:34.152075 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25422] 10:12:34.152101 write(12, "\323\t\0\0", 4) = 4
[pid 25404] 10:12:34.152136 <... read resumed> "\323\t\0\0", 4) = 4
[pid 25404] 10:12:34.152155 read(11,  <unfinished ...>
[pid 25411] 10:12:34.152184 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.152203 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25411] 10:12:34.152233 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25422] 10:12:34.152271 <... write resumed> ) = 4
[pid 25404] 10:12:34.152284 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25404] 10:12:34.152303 read(11,  <unfinished ...>
[pid 25422] 10:12:34.152330 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.152361 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.152385 <... write resumed> ) = 4
[pid 25404] 10:12:34.152398 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152489 read(11,  <unfinished ...>
[pid 25422] 10:12:34.152524 write(12, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152558 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152577 read(11,  <unfinished ...>
[pid 25411] 10:12:34.152608 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25422] 10:12:34.152640 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.152676 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.152704 <... write resumed> ) = 4
[pid 25404] 10:12:34.152718 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152737 read(11,  <unfinished ...>
[pid 25422] 10:12:34.152763 write(12, "\260c\234\1\0\0\0\0", 8 <unfinished ...>
[pid 25411] 10:12:34.152793 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25422] 10:12:34.152824 <... write resumed> ) = 8
[pid 25404] 10:12:34.152837 <... read resumed> "\260c\234\1\0\0\0\0", 8) = 8
[pid 25404] 10:12:34.152855 read(11,  <unfinished ...>
[pid 25422] 10:12:34.152882 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25411] 10:12:34.152912 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.152936 <... write resumed> ) = 4
[pid 25404] 10:12:34.152949 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.152968 read(11,  <unfinished ...>
[pid 25422] 10:12:34.152994 write(12, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.153026 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.153044 close(11)   = 0
[pid 25404] 10:12:34.153085 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55) = 55
[pid 25404] 10:12:34.153135 fsync(9 <unfinished ...>
[pid 25411] 10:12:34.153190 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25422] 10:12:34.153220 close(12 <unfinished ...>
[pid 25411] 10:12:34.153279 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25422] 10:12:34.153304 <... close resumed> ) = 0
[pid 25411] 10:12:34.153326 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25422] 10:12:34.153356 close(10)   = 0
[pid 25411] 10:12:34.153394 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.153480 <... fsync resumed> ) = 0
[pid 25404] 10:12:34.153505 wait4(-1,  <unfinished ...>
[pid 25422] 10:12:34.153533 munmap(0x7fb3682b9000, 4096) = 0
[pid 25411] 10:12:34.153570 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25422] 10:12:34.153635 close(13)   = 0
[pid 25411] 10:12:34.153681 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25422] 10:12:34.153711 munmap(0x7fb3682b8000, 4096 <unfinished ...>
[pid 25411] 10:12:34.153743 <... open resumed> ) = 12
[pid 25422] 10:12:34.153765 <... munmap resumed> ) = 0
[pid 25422] 10:12:34.154124 exit_group(0) = ?
[pid 25411] 10:12:34.154151 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf4a4b2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.154189 lseek(12, 0, SEEK_CUR) = 0
[pid 25411] 10:12:34.154251 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25411] 10:12:34.154376 brk(0x1bc7000 <unfinished ...>
[pid 25412] 10:12:34.154410 <... read resumed> "", 8192) = 0
[pid 25412] 10:12:34.154504 close(8)    = 0
[pid 25411] 10:12:34.154542 <... brk resumed> ) = 0x1bc7000
[pid 25412] 10:12:34.154816 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.155299 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.155337 <... open resumed> ) = 8
[pid 25412] 10:12:34.155358 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.155408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa47821d000
[pid 25412] 10:12:34.155508 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.155561 close(8 <unfinished ...>
[pid 25422] 10:12:34.155845 +++ exited with 0 +++
[pid 25404] 10:12:34.155859 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25422
[pid 25404] 10:12:34.155935 open("/etc/userdomains", O_RDONLY) = 10
[pid 25404] 10:12:34.155978 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.156028 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.156072 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:34.156108 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.156140 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:34.156201 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com", 0x7ffeeb784290) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.156252 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.156314 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25404] 10:12:34.156363 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.156505 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.156566 close(7)    = 0
[pid 25404] 10:12:34.156604 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25404] 10:12:34.156653 fcntl(7, F_GETFD) = 0
[pid 25404] 10:12:34.156685 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.156717 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5364141, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.156762 write(7, "2015-12-30 10:12:34 [25404] 1aEJMX-0006bg-Lo => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2515 QT=1s DT=0s\n", 232) = 232
[pid 25404] 10:12:34.156810 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25404] 10:12:34.156854 alarm(60)   = 0
[pid 25404] 10:12:34.156888 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25404] 10:12:34.156924 alarm(0)    = 60
[pid 25404] 10:12:34.156976 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:34.157031 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25404] 10:12:34.157071 fcntl(12, F_GETFD) = 0
[pid 25404] 10:12:34.157102 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.157135 read(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25404] 10:12:34.157176 close(12)   = 0
[pid 25404] 10:12:34.157216 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.157257 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25404] 10:12:34.157391 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25404] 10:12:34.157520 fcntl(12, F_GETFD) = 0
[pid 25404] 10:12:34.157554 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.157587 fstat(12, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:34.157643 pread(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25404] 10:12:34.157697 pread(12, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25404] 10:12:34.157752 close(12)   = 0
[pid 25404] 10:12:34.157799 close(11)   = 0
[pid 25404] 10:12:34.157858 pipe([11, 12]) = 0
[pid 25404] 10:12:34.157900 close(10)   = 0
[pid 25404] 10:12:34.157934 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.157973 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25424
[pid 25404] 10:12:34.158201 close(12)   = 0
[pid 25404] 10:12:34.158237 read(11,  <unfinished ...>
[pid 25412] 10:12:34.158270 <... close resumed> ) = 0
[pid 25411] 10:12:34.158284 <... lseek resumed> ) = 4868
[pid 25412] 10:12:34.158306 munmap(0x7fa47821d000, 4096 <unfinished ...>
[pid 25411] 10:12:34.158327 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25412] 10:12:34.158360 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.158373 <... lseek resumed> ) = 4868
[pid 25412] 10:12:34.158513 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.158542 close(12 <unfinished ...>
[pid 25412] 10:12:34.158577 <... lseek resumed> ) = 19
[pid 25411] 10:12:34.158593 <... close resumed> ) = 0
[pid 25412] 10:12:34.158639 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.158674 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25412] 10:12:34.158709 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.158723 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.158746 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.158769 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25412] 10:12:34.158800 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.158814 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.158838 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.158862 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25412] 10:12:34.158892 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.158905 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.158927 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.158950 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25412] 10:12:34.158979 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.158992 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.159016 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.159039 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25412] 10:12:34.159069 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.159082 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.159107 alarm(300 <unfinished ...>
[pid 25411] 10:12:34.159128 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25412] 10:12:34.159160 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.159173 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.159197 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.159217 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25412] 10:12:34.159253 <... alarm resumed> ) = 300
[pid 25411] 10:12:34.159266 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.159288 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.159310 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25412] 10:12:34.159344 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.159357 <... stat resumed> 0x7ffdf4a4b4b0) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.159381 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.159410 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25412] 10:12:34.159521 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25412] 10:12:34.159548 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25411] 10:12:34.159575 <... stat resumed> 0x7ffdf4a4b550) = -1 ENOENT (No such file or directory)
Process 25423 attached
[pid 25412] 10:12:34.159625 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25411] 10:12:34.159661 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25423] 10:12:34.159698 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25412] 10:12:34.159719 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25423] 10:12:34.159746 <... set_robust_list resumed> ) = 0
[pid 25411] 10:12:34.159760 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25423] 10:12:34.159813 fcntl(12, F_GETFD <unfinished ...>
[pid 25412] 10:12:34.159840 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.159857 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.159872 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.159906 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.159929 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fa4770d5790},  <unfinished ...>
[pid 25423] 10:12:34.159956 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.159969 <... open resumed> ) = 12
[pid 25423] 10:12:34.159989 close(6 <unfinished ...>
[pid 25412] 10:12:34.160015 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.160032 <... close resumed> ) = 0
[pid 25411] 10:12:34.160049 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25423] 10:12:34.160101 open("/var/spool/exim/input/X/1aEJMX-0006bd-HC-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25412] 10:12:34.160134 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25423] 10:12:34.160163 <... open resumed> ) = 6
[pid 25411] 10:12:34.160177 <... ioctl resumed> , 0x7ffdf4a4b2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25423] 10:12:34.160200 fcntl(6, F_GETFD <unfinished ...>
[pid 25412] 10:12:34.160226 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, 8) = 0
[pid 25423] 10:12:34.160246 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.160261 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25423] 10:12:34.160288 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.160309 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25423] 10:12:34.160336 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.160349 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.160398 geteuid( <unfinished ...>
[pid 25412] 10:12:34.160520 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, 8) = 0
[pid 25423] 10:12:34.160545 <... geteuid resumed> ) = 0
[pid 25411] 10:12:34.160567 read(12,  <unfinished ...>
[pid 25423] 10:12:34.160604 getegid( <unfinished ...>
[pid 25412] 10:12:34.160631 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.160659 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25423] 10:12:34.160684 <... getegid resumed> ) = 12
[pid 25412] 10:12:34.161101 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25423] 10:12:34.161155 setgid(12 <unfinished ...>
[pid 25411] 10:12:34.161196 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.161223 <... setgid resumed> ) = 0
[pid 25412] 10:12:34.161236 open("/var/spool/exim/input/Y/hdr.25412", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25423] 10:12:34.161299 setuid(47 <unfinished ...>
[pid 25411] 10:12:34.161326 <... lseek resumed> ) = 2366
[pid 25423] 10:12:34.161343 <... setuid resumed> ) = 0
[pid 25412] 10:12:34.161358 <... open resumed> ) = 8
[pid 25423] 10:12:34.161377 close(11 <unfinished ...>
[pid 25411] 10:12:34.161400 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25423] 10:12:34.161500 <... close resumed> ) = 0
[pid 25412] 10:12:34.161516 fchown(8, 47, 12 <unfinished ...>
[pid 25411] 10:12:34.161709 <... lseek resumed> ) = 2366
[pid 25423] 10:12:34.161729 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25412] 10:12:34.161760 <... fchown resumed> ) = 0
[pid 25423] 10:12:34.161777 <... socket resumed> ) = 10
[pid 25411] 10:12:34.161792 close(12 <unfinished ...>
[pid 25423] 10:12:34.161819 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25412] 10:12:34.161855 fchmod(8, 0640 <unfinished ...>
[pid 25423] 10:12:34.161883 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.161898 <... close resumed> ) = 0
[pid 25423] 10:12:34.161916 close(10 <unfinished ...>
[pid 25412] 10:12:34.162224 <... fchmod resumed> ) = 0
[pid 25423] 10:12:34.162246 <... close resumed> ) = 0
[pid 25411] 10:12:34.162263 read(11,  <unfinished ...>
[pid 25423] 10:12:34.162295 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25412] 10:12:34.162321 fcntl(8, F_GETFL <unfinished ...>
[pid 25423] 10:12:34.162346 <... socket resumed> ) = 10
[pid 25411] 10:12:34.162359 <... read resumed> "", 8192) = 0
[pid 25423] 10:12:34.162378 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25412] 10:12:34.162477 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25423] 10:12:34.162504 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.162525 close(11 <unfinished ...>
[pid 25423] 10:12:34.162554 close(10 <unfinished ...>
[pid 25412] 10:12:34.162583 fstat(8,  <unfinished ...>
[pid 25423] 10:12:34.162616 <... close resumed> ) = 0
[pid 25411] 10:12:34.162673 <... close resumed> ) = 0
[pid 25423] 10:12:34.162695 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.162895 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.162929 <... open resumed> ) = 10
[pid 25411] 10:12:34.162945 stat("/etc/userdomains",  <unfinished ...>
[pid 25423] 10:12:34.162983 fstat(10,  <unfinished ...>
[pid 25412] 10:12:34.163005 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.163034 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.163060 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.163091 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.163127 <... mmap resumed> ) = 0x7fa47821d000
[pid 25423] 10:12:34.163145 <... mmap resumed> ) = 0x7f54cb355000
[pid 25411] 10:12:34.163166 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.163199 read(10,  <unfinished ...>
[pid 25412] 10:12:34.163225 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25423] 10:12:34.163251 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25411] 10:12:34.163269 <... open resumed> ) = 11
[pid 25423] 10:12:34.163314 close(10 <unfinished ...>
[pid 25412] 10:12:34.163342 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.163358 <... close resumed> ) = 0
[pid 25411] 10:12:34.163388 fstat(11,  <unfinished ...>
[pid 25423] 10:12:34.163489 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25412] 10:12:34.163523 write(8, "1aEJMY-0006bs-1f-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 429 <unfinished ...>
[pid 25423] 10:12:34.163562 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.163581 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.163665 stat("/etc/mailips",  <unfinished ...>
[pid 25412] 10:12:34.163704 <... write resumed> ) = 429
[pid 25423] 10:12:34.163721 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.163749 fstat(11,  <unfinished ...>
[pid 25423] 10:12:34.163800 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25412] 10:12:34.163829 fstat(8,  <unfinished ...>
[pid 25423] 10:12:34.163855 <... open resumed> ) = 10
[pid 25411] 10:12:34.163868 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.163901 fstat(10,  <unfinished ...>
[pid 25412] 10:12:34.163924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=429, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.163952 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.163983 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.164025 fstat(10,  <unfinished ...>
[pid 25412] 10:12:34.164048 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006bs-1f; Wed, 30 Dec 2015 10:12:34 -0600\n071T To:  tracy.thompson@hilton.com, hiltongardeninn@finestweddin"..., 554 <unfinished ...>
[pid 25423] 10:12:34.164081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.164107 <... mmap resumed> ) = 0x7f816929e000
[pid 25423] 10:12:34.164125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.164157 <... write resumed> ) = 554
[pid 25423] 10:12:34.164173 <... mmap resumed> ) = 0x7f54cb355000
[pid 25411] 10:12:34.164189 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.164218 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.164240 fsync(8 <unfinished ...>
[pid 25423] 10:12:34.164287 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.164305 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.164323 read(10,  <unfinished ...>
[pid 25411] 10:12:34.164353 read(11,  <unfinished ...>
[pid 25423] 10:12:34.164400 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.164517 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25423] 10:12:34.164602 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25412] 10:12:34.164637 <... fsync resumed> ) = 0
[pid 25411] 10:12:34.164654 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25423] 10:12:34.164689 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.164703 fstat(8,  <unfinished ...>
[pid 25423] 10:12:34.164730 read(10,  <unfinished ...>
[pid 25411] 10:12:34.164751 <... open resumed> ) = 12
[pid 25423] 10:12:34.164768 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:34.164786 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=983, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.164972 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.165008 fstat(12,  <unfinished ...>
[pid 25423] 10:12:34.165034 <... open resumed> ) = 11
[pid 25412] 10:12:34.165047 close(8 <unfinished ...>
[pid 25423] 10:12:34.165078 fstat(11,  <unfinished ...>
[pid 25411] 10:12:34.165099 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25423] 10:12:34.165128 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25412] 10:12:34.165153 <... close resumed> ) = 0
[pid 25423] 10:12:34.165171 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.165198 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.165225 <... mmap resumed> ) = 0x7f54cb354000
[pid 25412] 10:12:34.165238 munmap(0x7fa47821d000, 4096 <unfinished ...>
[pid 25423] 10:12:34.165269 read(11,  <unfinished ...>
[pid 25411] 10:12:34.165295 <... mmap resumed> ) = 0x7f816929d000
[pid 25423] 10:12:34.165313 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25412] 10:12:34.165333 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.165362 close(11 <unfinished ...>
[pid 25411] 10:12:34.165392 read(12,  <unfinished ...>
[pid 25423] 10:12:34.165499 <... close resumed> ) = 0
[pid 25412] 10:12:34.165518 rename("/var/spool/exim/input/Y/hdr.25412", "/var/spool/exim/input/Y/1aEJMY-0006bs-1f-H" <unfinished ...>
[pid 25423] 10:12:34.165570 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25411] 10:12:34.165604 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25423] 10:12:34.165635 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.165674 <... rename resumed> ) = 0
[pid 25423] 10:12:34.165717 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.165753 close(12 <unfinished ...>
[pid 25423] 10:12:34.165780 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25412] 10:12:34.165795 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25423] 10:12:34.165935 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.165959 <... close resumed> ) = 0
[pid 25423] 10:12:34.165976 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.165991 <... open resumed> ) = 8
[pid 25423] 10:12:34.166010 read(10,  <unfinished ...>
[pid 25411] 10:12:34.166033 munmap(0x7f816929d000, 4096 <unfinished ...>
[pid 25423] 10:12:34.166062 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:34.166076 fsync(8 <unfinished ...>
[pid 25423] 10:12:34.166106 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.166128 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.166144 <... lseek resumed> ) = 0
[pid 25412] 10:12:34.166177 <... fsync resumed> ) = 0
[pid 25423] 10:12:34.166198 read(10,  <unfinished ...>
[pid 25411] 10:12:34.166224 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25423] 10:12:34.166254 <... read resumed> "", 4096) = 0
[pid 25412] 10:12:34.166267 close(8 <unfinished ...>
[pid 25423] 10:12:34.166319 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25411] 10:12:34.166350 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25423] 10:12:34.166381 <... open resumed> ) = 11
[pid 25412] 10:12:34.166405 <... close resumed> ) = 0
[pid 25423] 10:12:34.166496 alarm(60 <unfinished ...>
[pid 25411] 10:12:34.166525 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25423] 10:12:34.166556 <... alarm resumed> ) = 0
[pid 25412] 10:12:34.166576 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.166608 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25411] 10:12:34.166638 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25423] 10:12:34.166673 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.166698 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124785512, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.166730 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.166768 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.166800 <... alarm resumed> ) = 60
[pid 25412] 10:12:34.166813 open("/var/spool/exim/msglog/Y/1aEJMY-0006bs-1f", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25423] 10:12:34.166939 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25411] 10:12:34.166971 <... open resumed> ) = 12
[pid 25423] 10:12:34.166988 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25412] 10:12:34.167016 <... open resumed> ) = 8
[pid 25423] 10:12:34.167046 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.167078 fstat(12,  <unfinished ...>
[pid 25423] 10:12:34.167103 <... open resumed> ) = 13
[pid 25412] 10:12:34.167117 fcntl(8, F_GETFL <unfinished ...>
[pid 25423] 10:12:34.167148 fcntl(13, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.167170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25423] 10:12:34.167198 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.167216 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25423] 10:12:34.167236 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.167261 fstat(12,  <unfinished ...>
[pid 25423] 10:12:34.167286 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.167298 fstat(8,  <unfinished ...>
[pid 25423] 10:12:34.167327 read(13,  <unfinished ...>
[pid 25411] 10:12:34.167349 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25423] 10:12:34.167376 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25412] 10:12:34.167398 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794958, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.167515 close(13 <unfinished ...>
[pid 25411] 10:12:34.167544 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.167577 <... close resumed> ) = 0
[pid 25412] 10:12:34.167592 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.167646 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.167678 <... mmap resumed> ) = 0x7f816929d000
[pid 25423] 10:12:34.167696 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25412] 10:12:34.167713 <... mmap resumed> ) = 0x7fa47821d000
[pid 25423] 10:12:34.167733 stat("/var/tmp",  <unfinished ...>
[pid 25411] 10:12:34.167763 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.167788 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25412] 10:12:34.167814 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25423] 10:12:34.168018 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.168049 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.168066 <... open resumed> ) = 13
[pid 25412] 10:12:34.168081 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.168100 fcntl(13, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.168126 read(12,  <unfinished ...>
[pid 25423] 10:12:34.168154 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.168168 stat("/etc/localtime",  <unfinished ...>
[pid 25423] 10:12:34.168196 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.168218 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25423] 10:12:34.168238 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.168259 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25423] 10:12:34.168296 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.168331 read(12,  <unfinished ...>
[pid 25423] 10:12:34.168357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25412] 10:12:34.168382 write(8, "2015-12-30 10:12:34 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2373 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148 <unfinished ...>
[pid 25423] 10:12:34.168527 pread(13,  <unfinished ...>
[pid 25411] 10:12:34.168553 <... read resumed> "", 4096) = 0
[pid 25423] 10:12:34.168617 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25412] 10:12:34.168647 <... write resumed> ) = 148
[pid 25411] 10:12:34.168691 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25423] 10:12:34.168730 pread(13,  <unfinished ...>
[pid 25412] 10:12:34.168753 close(8 <unfinished ...>
[pid 25423] 10:12:34.168779 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25411] 10:12:34.168799 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2915, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.168842 pread(13,  <unfinished ...>
[pid 25412] 10:12:34.168892 <... close resumed> ) = 0
[pid 25423] 10:12:34.168909 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25411] 10:12:34.168931 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.168972 close(13 <unfinished ...>
[pid 25412] 10:12:34.168996 munmap(0x7fa47821d000, 4096 <unfinished ...>
[pid 25423] 10:12:34.169025 <... close resumed> ) = 0
[pid 25411] 10:12:34.169039 <... open resumed> ) = 13
[pid 25423] 10:12:34.169079 close(11 <unfinished ...>
[pid 25412] 10:12:34.169111 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.169129 <... close resumed> ) = 0
[pid 25411] 10:12:34.169147 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25423] 10:12:34.169206 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25412] 10:12:34.169234 stat("/etc/localtime",  <unfinished ...>
[pid 25423] 10:12:34.169263 <... socket resumed> ) = 11
[pid 25411] 10:12:34.169277 <... ioctl resumed> , 0x7ffdf4a4e390) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25423] 10:12:34.169304 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25412] 10:12:34.169334 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25423] 10:12:34.169364 <... setsockopt resumed> ) = 0
[pid 25411] 10:12:34.169390 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25423] 10:12:34.169576 alarm(300 <unfinished ...>
[pid 25412] 10:12:34.169614 stat("/etc/localtime",  <unfinished ...>
[pid 25423] 10:12:34.169660 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.169681 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.169718 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("173.194.77.27")}, 16 <unfinished ...>
[pid 25412] 10:12:34.169820 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.169863 fstat(13,  <unfinished ...>
[pid 25412] 10:12:34.169895 close(7 <unfinished ...>
[pid 25411] 10:12:34.169921 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2915, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25412] 10:12:34.169949 <... close resumed> ) = 0
[pid 25411] 10:12:34.169966 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.169996 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25411] 10:12:34.170028 <... fcntl resumed> ) = 0
[pid 25412] 10:12:34.170044 <... open resumed> ) = 7
[pid 25411] 10:12:34.170094 read(13,  <unfinished ...>
[pid 25412] 10:12:34.170123 fcntl(7, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.170147 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2915
[pid 25412] 10:12:34.170167 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.170689 read(13,  <unfinished ...>
[pid 25412] 10:12:34.170726 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.170751 <... read resumed> "", 8192) = 0
[pid 25412] 10:12:34.170767 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.170792 close(13 <unfinished ...>
[pid 25412] 10:12:34.170820 fstat(7,  <unfinished ...>
[pid 25411] 10:12:34.170843 <... close resumed> ) = 0
[pid 25412] 10:12:34.170858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5364373, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.170923 stat("/etc/userdomains",  <unfinished ...>
[pid 25412] 10:12:34.170957 write(7, "2015-12-30 10:12:34 [25412] 1aEJMY-0006bs-1f <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2373 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for tracy.thompson@hilton.com hiltongardeninn@fines"..., 308 <unfinished ...>
[pid 25411] 10:12:34.170990 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25412] 10:12:34.171024 <... write resumed> ) = 308
[pid 25411] 10:12:34.171059 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.171093 close(6 <unfinished ...>
[pid 25411] 10:12:34.171120 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25412] 10:12:34.171147 <... close resumed> ) = 0
[pid 25411] 10:12:34.171174 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.171205 munmap(0x7fa47821e000, 4096 <unfinished ...>
[pid 25411] 10:12:34.171233 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25412] 10:12:34.171261 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.171304 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25412] 10:12:34.171341 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25411] 10:12:34.171370 <... open resumed> ) = 13
[pid 25412] 10:12:34.171386 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, 8) = 0
[pid 25411] 10:12:34.171409 fstat(13,  <unfinished ...>
[pid 25412] 10:12:34.171516 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0},  <unfinished ...>
[pid 25411] 10:12:34.171545 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25412] 10:12:34.171573 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa475e1e6a0}, 8) = 0
[pid 25411] 10:12:34.171593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25412] 10:12:34.171623 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.171660 <... mmap resumed> ) = 0x7f816929c000
[pid 25412] 10:12:34.171677 <... open resumed> ) = 6
[pid 25411] 10:12:34.171695 read(13,  <unfinished ...>
[pid 25412] 10:12:34.171726 read(6,  <unfinished ...>
[pid 25411] 10:12:34.171756 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25412] 10:12:34.171777 <... read resumed> "0.02 0.05 0.00 3/245 25424\n", 40) = 27
[pid 25411] 10:12:34.171806 close(13 <unfinished ...>
[pid 25412] 10:12:34.171833 close(6 <unfinished ...>
[pid 25411] 10:12:34.171860 <... close resumed> ) = 0
[pid 25412] 10:12:34.171875 <... close resumed> ) = 0
[pid 25411] 10:12:34.171892 munmap(0x7f816929c000, 4096 <unfinished ...>
[pid 25412] 10:12:34.171932 clone( <unfinished ...>
[pid 25411] 10:12:34.172192 <... munmap resumed> ) = 0
[pid 25412] 10:12:34.172214 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa478208a90) = 25425
[pid 25412] 10:12:34.172549 exit_group(0) = ?
[pid 25411] 10:12:34.172573 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25412] 10:12:34.172912 +++ exited with 0 +++
[pid 25411] 10:12:34.172926 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25389] 10:12:34.172954 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25412
[pid 25389] 10:12:34.172976 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:34.173104 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:34.173148 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25426
[pid 25389] 10:12:34.173624 close(5)    = 0
[pid 25389] 10:12:34.173660 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:34.173694 fstat(6, {st_dev=makedev(0, 8), st_ino=2130166360, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25389] 10:12:34.173741 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:34.173784 write(6, "To:  weddings@hillcrestgolfclub.com, kcarter@scottsdalegolfgroup.com, hillcrestgolfclub@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tyle"..., 2132) = 2132
[pid 25389] 10:12:34.173824 close(6)    = 0
[pid 25389] 10:12:34.173856 wait4(25426,  <unfinished ...>
[pid 25411] 10:12:34.173884 pipe([13, 14]) = 0
[pid 25411] 10:12:34.173922 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:34.173963 close(10)   = 0
[pid 25411] 10:12:34.173998 munmap(0x7f816929f000, 4096) = 0
[pid 25411] 10:12:34.174036 close(11)   = 0
[pid 25411] 10:12:34.174069 munmap(0x7f816929e000, 4096) = 0
[pid 25411] 10:12:34.174105 close(12)   = 0
[pid 25411] 10:12:34.174138 munmap(0x7f816929d000, 4096) = 0
[pid 25411] 10:12:34.174173 close(9)    = 0
[pid 25411] 10:12:34.174207 munmap(0x7f81692a0000, 4096) = 0
Process 25424 attached
[pid 25411] 10:12:34.174262 clone( <unfinished ...>
[pid 25424] 10:12:34.174612 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25411] 10:12:34.174639 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25427
[pid 25424] 10:12:34.174677 <... set_robust_list resumed> ) = 0
[pid 25411] 10:12:34.174693 close(14 <unfinished ...>
[pid 25424] 10:12:34.174784 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25411] 10:12:34.174809 <... close resumed> ) = 0
[pid 25411] 10:12:34.174828 read(13,  <unfinished ...>
[pid 25424] 10:12:34.174855 <... setrlimit resumed> ) = 0
[pid 25424] 10:12:34.174984 open("/etc/userdomains", O_RDONLY) = 10
[pid 25424] 10:12:34.175035 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25424] 10:12:34.175095 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25424] 10:12:34.175156 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25424] 10:12:34.175196 lseek(10, 0, SEEK_SET) = 0
[pid 25424] 10:12:34.175231 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25424] 10:12:34.175311 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25424] 10:12:34.175388 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25424] 10:12:34.175505 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25424] 10:12:34.175563 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25424] 10:12:34.175621 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b8000
[pid 25424] 10:12:34.175659 lseek(13, 0, SEEK_SET) = 0
[pid 25424] 10:12:34.175694 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25424] 10:12:34.175766 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25424] 10:12:34.175811 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25424] 10:12:34.175850 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fb367170790}, 8) = 0
[pid 25424] 10:12:34.175890 close(11)   = 0
[pid 25424] 10:12:34.175924 fcntl(12, F_GETFD) = 0
[pid 25424] 10:12:34.175957 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25424] 10:12:34.176004 geteuid()   = 0
[pid 25424] 10:12:34.176039 getegid()   = 12
[pid 25424] 10:12:34.176073 setgid(500) = 0
[pid 25424] 10:12:34.176107 setuid(503) = 0
[pid 25424] 10:12:34.176141 chdir("/")  = 0
[pid 25424] 10:12:34.176186 geteuid()   = 503
[pid 25424] 10:12:34.176220 getegid()   = 500
[pid 25424] 10:12:34.176273 stat("/home/finest09/mail/finestweddingsites.com/lisa", {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25424] 10:12:34.176330 chdir("/home/finest09/mail/finestweddingsites.com/lisa") = 0
[pid 25424] 10:12:34.176367 stat("tmp", {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25424] 10:12:34.176483 stat("new", {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25424] 10:12:34.176541 stat("cur", {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25424] 10:12:34.176638 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25424] 10:12:34.176691 read(11, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4081
[pid 25424] 10:12:34.176798 stat("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", 0x7ffeeb785540) = -1 ENOENT (No such file or directory)
[pid 25424] 10:12:34.176849 open("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25424] 10:12:34.176916 chown("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", 503, 500) = 0
[pid 25424] 10:12:34.176963 chmod("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", 0660) = 0
[pid 25424] 10:12:34.177003 chown("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", 503, 500) = 0
[pid 25424] 10:12:34.177047 chmod("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", 0660) = 0
[pid 25424] 10:12:34.177110 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25424] 10:12:34.177190 lseek(6, 19, SEEK_SET) = 19
[pid 25424] 10:12:34.177228 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25424] 10:12:34.177279 read(6, "", 8192) = 0
[pid 25424] 10:12:34.177315 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2515) = 2515
[pid 25424] 10:12:34.177362 fsync(14Process 25426 attached
 <unfinished ...>
[pid 25426] 10:12:34.177555 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25426] 10:12:34.177607 close(6)    = 0
[pid 25426] 10:12:34.177644 dup2(5, 0)  = 0
[pid 25426] 10:12:34.177678 close(5)    = 0
[pid 25424] 10:12:34.177714 <... fsync resumed> ) = 0
[pid 25424] 10:12:34.177739 lseek(11, 0, SEEK_END) = 4081
[pid 25424] 10:12:34.177778 write(11, "2515 1\n", 7) = 7
[pid 25424] 10:12:34.177830 close(11)   = 0
[pid 25424] 10:12:34.177873 fstat(14, {st_dev=makedev(144, 4215), st_ino=122179002, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2515, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25424] 10:12:34.177923 close(14)   = 0
[pid 25424] 10:12:34.177968 rename("tmp/1451491954.H176788P25424.fin.finestweddingsites.com", "new/1451491954.H176788P25424.fin.finestweddingsites.com,S=2515") = 0
[pid 25424] 10:12:34.178032 write(12, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178070 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178093 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178122 write(12, "\323\t\0\0", 4) = 4
[pid 25404] 10:12:34.178158 <... read resumed> "\323\t\0\0", 4) = 4
[pid 25424] 10:12:34.178181 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:34.178203 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178233 <... write resumed> ) = 4
[pid 25404] 10:12:34.178245 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25424] 10:12:34.178268 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:34.178288 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178317 <... write resumed> ) = 4
[pid 25404] 10:12:34.178330 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25424] 10:12:34.178352 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:34.178372 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178404 <... write resumed> ) = 4
[pid 25404] 10:12:34.178483 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25424] 10:12:34.178512 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25404] 10:12:34.178534 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178563 <... write resumed> ) = 4
[pid 25404] 10:12:34.178576 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25424] 10:12:34.178598 write(12, "\260c\234\1\0\0\0\0", 8 <unfinished ...>
[pid 25404] 10:12:34.178623 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178659 <... write resumed> ) = 8
[pid 25404] 10:12:34.178673 <... read resumed> "\260c\234\1\0\0\0\0", 8) = 8
[pid 25404] 10:12:34.178692 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178719 write(12, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178750 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178769 read(11,  <unfinished ...>
[pid 25424] 10:12:34.178796 write(12, "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178827 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25404] 10:12:34.178852 close(11)   = 0
[pid 25404] 10:12:34.178893 write(9, "lisa@finestweddingsites.com\n", 28) = 28
[pid 25404] 10:12:34.178935 fsync(9 <unfinished ...>
[pid 25424] 10:12:34.178980 close(12)   = 0
[pid 25424] 10:12:34.179018 close(10)   = 0
[pid 25424] 10:12:34.179058 munmap(0x7fb3682b9000, 4096) = 0
[pid 25424] 10:12:34.179113 close(13)   = 0
[pid 25424] 10:12:34.179147 munmap(0x7fb3682b8000, 4096) = 0
[pid 25404] 10:12:34.179472 <... fsync resumed> ) = 0
[pid 25404] 10:12:34.179500 wait4(-1,  <unfinished ...>
[pid 25424] 10:12:34.179634 exit_group(0) = ?
[pid 25424] 10:12:34.179890 +++ exited with 0 +++
[pid 25404] 10:12:34.179906 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25424
[pid 25404] 10:12:34.179959 open("/etc/userdomains", O_RDONLY) = 10
[pid 25404] 10:12:34.180003 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.180053 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:34.180097 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:34.180134 lseek(10, 0, SEEK_SET) = 0
[pid 25404] 10:12:34.180166 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:34.180228 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com", 0x7ffeeb784290) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:34.180280 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.180340 write(8, "2015-12-30 10:12:34 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126) = 126
[pid 25404] 10:12:34.180389 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com: children all complete\n", 77) = 77
[pid 25404] 10:12:34.180511 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.180573 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.180624 close(7)    = 0
[pid 25404] 10:12:34.180660 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25404] 10:12:34.180702 fcntl(7, F_GETFD) = 0
[pid 25404] 10:12:34.180733 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.180764 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5364681, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.180807 write(7, "2015-12-30 10:12:34 [25404] 1aEJMX-0006bg-Lo => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2515 QT=1s "..., 262) = 262
[pid 25404] 10:12:34.180879 pipe([11, 12]) = 0
[pid 25404] 10:12:34.180919 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25404] 10:12:34.180959 close(10)   = 0
[pid 25404] 10:12:34.180992 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.181030 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25428
[pid 25404] 10:12:34.181251 close(12)   = 0
[pid 25404] 10:12:34.181304 wait4(-1, 0x7ffeeb785840, WNOHANG, NULL) = 0
[pid 25404] 10:12:34.181350 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25426] 10:12:34.181393 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25426] 10:12:34.181891 brk(0)      = 0x1fa1000
[pid 25426] 10:12:34.181948 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f574371e000
[pid 25426] 10:12:34.181997 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.182049 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25426] 10:12:34.182089 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25426] 10:12:34.182136 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f5743714000
[pid 25426] 10:12:34.182172 close(5)    = 0
[pid 25426] 10:12:34.182214 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25426] 10:12:34.182255 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.182298 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25426] 10:12:34.182348 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f57432df000
[pid 25426] 10:12:34.182392 mprotect(0x7f57432fc000, 2093056, PROT_NONE) = 0
[pid 25426] 10:12:34.182515 mmap(0x7f57434fb000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f57434fb000
[pid 25426] 10:12:34.182565 mmap(0x7f57434ff000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f57434ff000
[pid 25426] 10:12:34.182605 close(5)    = 0
[pid 25426] 10:12:34.182649 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25426] 10:12:34.182692 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.182734 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25423] 10:12:34.182789 <... connect resumed> ) = 0
[pid 25423] 10:12:34.182809 alarm(0)    = 300
[pid 25423] 10:12:34.182850 getsockname(11, {sa_family=AF_INET, sin_port=htons(37775), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25423] 10:12:34.182898 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25423] 10:12:34.182940 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.183004 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25423] 10:12:34.183045 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.183094 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.183140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb354000
[pid 25423] 10:12:34.183178 lseek(13, 0, SEEK_SET) = 0
[pid 25423] 10:12:34.183213 read(13, "", 4096) = 0
[pid 25423] 10:12:34.183260 lseek(13, 0, SEEK_SET) = 0
[pid 25423] 10:12:34.183297 read(13, "", 4096) = 0
[pid 25423] 10:12:34.183384 lseek(13, 0, SEEK_SET) = 0
[pid 25423] 10:12:34.183556 read(13, "", 4096) = 0
[pid 25423] 10:12:34.183607 lseek(13, 0, SEEK_SET) = 0
[pid 25423] 10:12:34.183644 read(13, "", 4096) = 0
[pid 25423] 10:12:34.183696 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25426] 10:12:34.183737 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0Process 25427 attached
Process 25425 attached
) = 0x7f57430db000
[pid 25425] 10:12:34.183828 set_robust_list(0x7fa478208aa0, 24 <unfinished ...>
[pid 25427] 10:12:34.183870 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25426] 10:12:34.183897 mprotect(0x7f57430dd000, 2097152, PROT_NONE) = 0
[pid 25425] 10:12:34.183936 <... set_robust_list resumed> ) = 0
[pid 25426] 10:12:34.183956 mmap(0x7f57432dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000 <unfinished ...>
[pid 25425] 10:12:34.184004 close(0 <unfinished ...>
[pid 25427] 10:12:34.184030 <... set_robust_list resumed> ) = 0
[pid 25426] 10:12:34.184054 <... mmap resumed> ) = 0x7f57432dd000
[pid 25427] 10:12:34.184095 close(13 <unfinished ...>
[pid 25426] 10:12:34.184140 close(5)    = 0
[pid 25425] 10:12:34.184179 <... close resumed> ) = 0
[pid 25426] 10:12:34.184206 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25427] 10:12:34.184236 <... close resumed> ) = 0
[pid 25425] 10:12:34.184254 close(1 <unfinished ...>
[pid 25427] 10:12:34.184287 geteuid( <unfinished ...>
[pid 25425] 10:12:34.184312 <... close resumed> ) = 0
[pid 25426] 10:12:34.184340 <... open resumed> ) = 5
[pid 25425] 10:12:34.184369 close(2)    = 0
[pid 25425] 10:12:34.184459 setsid( <unfinished ...>
[pid 25427] 10:12:34.184487 <... geteuid resumed> ) = 0
[pid 25427] 10:12:34.184506 getegid( <unfinished ...>
[pid 25426] 10:12:34.184531 read(5,  <unfinished ...>
[pid 25427] 10:12:34.184555 <... getegid resumed> ) = 12
[pid 25426] 10:12:34.184574 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25427] 10:12:34.184605 setgid(500 <unfinished ...>
[pid 25426] 10:12:34.184631 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25427] 10:12:34.184679 <... setgid resumed> ) = 0
[pid 25426] 10:12:34.184699 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25427] 10:12:34.184727 setuid(503 <unfinished ...>
[pid 25426] 10:12:34.184753 <... mmap resumed> ) = 0x7f5743713000
[pid 25427] 10:12:34.184773 <... setuid resumed> ) = 0
[pid 25426] 10:12:34.184796 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25427] 10:12:34.184857 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.184888 <... mmap resumed> ) = 0x7f5742d47000
[pid 25426] 10:12:34.184907 mprotect(0x7f5742ed1000, 2097152, PROT_NONE) = 0
[pid 25426] 10:12:34.184944 mmap(0x7f57430d1000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f57430d1000
[pid 25426] 10:12:34.184989 mmap(0x7f57430d6000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.185019 <... setsid resumed> ) = 25425
[pid 25425] 10:12:34.185041 fstat(0,  <unfinished ...>
[pid 25427] 10:12:34.185072 <... open resumed> ) = 9
[pid 25426] 10:12:34.185093 <... mmap resumed> ) = 0x7f57430d6000
[pid 25426] 10:12:34.185118 close(5 <unfinished ...>
[pid 25425] 10:12:34.185145 <... fstat resumed> 0x7ffebbe01840) = -1 EBADF (Bad file descriptor)
[pid 25427] 10:12:34.185171 fstat(9,  <unfinished ...>
[pid 25425] 10:12:34.185200 open("/dev/null", O_RDWR <unfinished ...>
[pid 25426] 10:12:34.185228 <... close resumed> ) = 0
[pid 25425] 10:12:34.185254 <... open resumed> ) = 0
[pid 25426] 10:12:34.185294 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25427] 10:12:34.185323 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25427] 10:12:34.185397 brk(0x1be8000 <unfinished ...>
[pid 25425] 10:12:34.185427 fstat(1, 0x7ffebbe01840) = -1 EBADF (Bad file descriptor)
[pid 25425] 10:12:34.185468 dup2(0, 1)  = 1
[pid 25426] 10:12:34.185504 <... mmap resumed> ) = 0x7f5743712000
[pid 25425] 10:12:34.185523 fstat(2, 0x7ffebbe01840) = -1 EBADF (Bad file descriptor)
[pid 25426] 10:12:34.185560 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.185594 dup2(0, 2)  = 2
[pid 25426] 10:12:34.185627 <... mmap resumed> ) = 0x7f5743711000
[pid 25425] 10:12:34.185646 geteuid( <unfinished ...>
[pid 25426] 10:12:34.185673 arch_prctl(ARCH_SET_FS, 0x7f5743712700 <unfinished ...>
[pid 25425] 10:12:34.185699 <... geteuid resumed> ) = 47
[pid 25425] 10:12:34.185725 fstat(0,  <unfinished ...>
[pid 25426] 10:12:34.185752 <... arch_prctl resumed> ) = 0
[pid 25427] 10:12:34.185772 <... brk resumed> ) = 0x1be8000
[pid 25426] 10:12:34.186012 mprotect(0x7f57430d1000, 16384, PROT_READ <unfinished ...>
[pid 25427] 10:12:34.186113 fstat(9,  <unfinished ...>
[pid 25425] 10:12:34.186140 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25425] 10:12:34.186174 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25425] 10:12:34.186219 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25425] 10:12:34.186268 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMY-0006bs-1f"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25427] 10:12:34.186811 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25427] 10:12:34.186848 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25427] 10:12:34.186893 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25427] 10:12:34.186941 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25426] 10:12:34.186985 <... mprotect resumed> ) = 0
[pid 25427] 10:12:34.187007 close(9 <unfinished ...>
[pid 25426] 10:12:34.187038 mprotect(0x7f57432dd000, 4096, PROT_READ <unfinished ...>
[pid 25427] 10:12:34.187065 <... close resumed> ) = 0
[pid 25427] 10:12:34.187084 munmap(0x7f81692a0000, 4096) = 0
[pid 25426] 10:12:34.187122 <... mprotect resumed> ) = 0
[pid 25426] 10:12:34.187190 mprotect(0x7f574371f000, 4096, PROT_READ) = 0
[pid 25426] 10:12:34.187487 munmap(0x7f5743714000, 39387) = 0
[pid 25426] 10:12:34.187562 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25426] 10:12:34.187610 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25426] 10:12:34.187661 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffa9f3c780) = -1 EINVAL (Invalid argument)
[pid 25426] 10:12:34.187726 brk(0 <unfinished ...>
[pid 25427] 10:12:34.187995 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.188025 <... brk resumed> ) = 0x1fa1000
[pid 25426] 10:12:34.188086 brk(0x1fc2000) = 0x1fc2000
[pid 25426] 10:12:34.188143 getuid()    = 503
[pid 25426] 10:12:34.188180 getgid()    = 500
[pid 25426] 10:12:34.188213 geteuid()   = 503
[pid 25426] 10:12:34.188245 getegid()   = 500
[pid 25426] 10:12:34.188286 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25426] 10:12:34.188412 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
[pid 25426] 10:12:34.188475 fstat(5, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.188525 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f574371d000
[pid 25426] 10:12:34.188564 read(5, "MemTotal:        1048576 kB\nMemFree:          265372 kB\nCached:           327420 kB\nBuffers:               0 kB\nActive:           286536 kB\nInactive:         467056 kB\nActive(anon):     156372 kB\nInactive(anon):   277604 kB\nActive(file):     130164 kB\nInac"..., 1024) = 588
[pid 25425] 10:12:34.188648 brk(0)      = 0x2378000
[pid 25425] 10:12:34.188685 fcntl(0, F_GETFD <unfinished ...>
[pid 25426] 10:12:34.188727 close(5 <unfinished ...>
[pid 25425] 10:12:34.188752 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.188771 fcntl(1, F_GETFD) = 0
[pid 25425] 10:12:34.188803 fcntl(2, F_GETFD) = 0
[pid 25425] 10:12:34.188840 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25426] 10:12:34.188873 <... close resumed> ) = 0
[pid 25425] 10:12:34.188895 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.188927 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.188956 munmap(0x7f574371d000, 4096) = 0
[pid 25427] 10:12:34.188995 <... lseek resumed> ) = 19
[pid 25427] 10:12:34.189014 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2423) = 1858
[pid 25426] 10:12:34.189086 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0},  <unfinished ...>
[pid 25427] 10:12:34.189571 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.189604 <... mmap resumed> ) = 0x7f380d426000
[pid 25425] 10:12:34.189637 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.189686 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.189715 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25426] 10:12:34.189737 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.189773 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.189792 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0}, 8) = 0
[pid 25426] 10:12:34.189814 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25426] 10:12:34.189851 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.189879 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25426] 10:12:34.189905 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.189928 <... stat resumed> 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.189948 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25425] 10:12:34.189985 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.190011 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.190042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190061 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, 8) = 0
[pid 25426] 10:12:34.190084 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25425] 10:12:34.190109 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25426] 10:12:34.190134 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25425] 10:12:34.190159 <... stat resumed> 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190180 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.190208 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.190234 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.190259 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190281 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25425] 10:12:34.190317 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.190490 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.190538 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25426] 10:12:34.190627 getcwd( <unfinished ...>
[pid 25425] 10:12:34.190655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.190701 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.190741 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190790 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25425] 10:12:34.190812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190862 getpid( <unfinished ...>
[pid 25425] 10:12:34.190889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.190931 <... getpid resumed> ) = 25426
[pid 25426] 10:12:34.190962 getppid( <unfinished ...>
[pid 25425] 10:12:34.190988 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.191028 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191069 <... getppid resumed> ) = 25389
[pid 25426] 10:12:34.191098 stat(".",  <unfinished ...>
[pid 25425] 10:12:34.191126 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.191178 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25425] 10:12:34.191208 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191255 stat("/bin/sh",  <unfinished ...>
[pid 25425] 10:12:34.191282 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25426] 10:12:34.191313 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25425] 10:12:34.191345 <... stat resumed> 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.191370 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.191398 stat("/bin/sh",  <unfinished ...>
[pid 25425] 10:12:34.191431 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191452 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25426] 10:12:34.191482 geteuid( <unfinished ...>
[pid 25425] 10:12:34.191506 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25426] 10:12:34.191532 <... geteuid resumed> ) = 503
[pid 25425] 10:12:34.191553 <... stat resumed> 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191573 getegid()   = 500
[pid 25425] 10:12:34.191605 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.191631 getuid( <unfinished ...>
[pid 25425] 10:12:34.191660 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191679 <... getuid resumed> ) = 503
[pid 25426] 10:12:34.191696 getgid()    = 500
[pid 25425] 10:12:34.191728 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25426] 10:12:34.191753 access("/bin/sh", X_OK <unfinished ...>
[pid 25425] 10:12:34.191783 <... stat resumed> 0x7fffbdaed6b0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191810 <... access resumed> ) = 0
[pid 25425] 10:12:34.191830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.191857 stat("/bin/sh",  <unfinished ...>
[pid 25425] 10:12:34.191887 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.191909 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25426] 10:12:34.191938 geteuid( <unfinished ...>
[pid 25425] 10:12:34.191962 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25426] 10:12:34.191988 <... geteuid resumed> ) = 503
[pid 25425] 10:12:34.192009 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.192040 getegid()   = 500
[pid 25426] 10:12:34.192059 getuid( <unfinished ...>
[pid 25425] 10:12:34.192075 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.192089 <... getuid resumed> ) = 503
[pid 25426] 10:12:34.192099 getgid( <unfinished ...>
[pid 25425] 10:12:34.192114 <... open resumed> ) = 6
[pid 25426] 10:12:34.192124 <... getgid resumed> ) = 500
[pid 25426] 10:12:34.192134 access("/bin/sh", R_OK <unfinished ...>
[pid 25425] 10:12:34.192146 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.192160 <... access resumed> ) = 0
[pid 25425] 10:12:34.192170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25425] 10:12:34.192190 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.192203 stat("/bin/sh",  <unfinished ...>
[pid 25425] 10:12:34.192217 <... mmap resumed> ) = 0x7f380d41c000
[pid 25426] 10:12:34.192230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25425] 10:12:34.192250 close(6 <unfinished ...>
[pid 25426] 10:12:34.192261 stat("/bin/sh",  <unfinished ...>
[pid 25425] 10:12:34.192273 <... close resumed> ) = 0
[pid 25426] 10:12:34.192285 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25425] 10:12:34.192311 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.192323 geteuid()   = 503
[pid 25426] 10:12:34.192341 getegid()   = 500
[pid 25425] 10:12:34.192525 <... open resumed> ) = 6
[pid 25426] 10:12:34.192545 getuid()    = 503
[pid 25426] 10:12:34.192578 getgid()    = 500
[pid 25426] 10:12:34.192609 access("/bin/sh", X_OK <unfinished ...>
[pid 25425] 10:12:34.192636 read(6,  <unfinished ...>
[pid 25426] 10:12:34.192664 <... access resumed> ) = 0
[pid 25425] 10:12:34.192684 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.192711 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.192742 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25425] 10:12:34.192792 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.192823 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.192851 geteuid( <unfinished ...>
[pid 25425] 10:12:34.192878 <... mmap resumed> ) = 0x7f380cfee000
[pid 25426] 10:12:34.192897 <... geteuid resumed> ) = 503
[pid 25426] 10:12:34.192915 getegid()   = 500
[pid 25425] 10:12:34.192946 mprotect(0x7f380d004000, 2097152, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.192972 getuid( <unfinished ...>
[pid 25425] 10:12:34.192999 <... mprotect resumed> ) = 0
[pid 25426] 10:12:34.193017 <... getuid resumed> ) = 503
[pid 25426] 10:12:34.193035 getgid( <unfinished ...>
[pid 25425] 10:12:34.193059 mmap(0x7f380d204000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25426] 10:12:34.193086 <... getgid resumed> ) = 500
[pid 25425] 10:12:34.193108 <... mmap resumed> ) = 0x7f380d204000
[pid 25426] 10:12:34.193127 access("/bin/sh", R_OK) = 0
[pid 25425] 10:12:34.193169 mmap(0x7f380d206000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.193212 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.193243 <... mmap resumed> ) = 0x7f380d206000
[pid 25425] 10:12:34.193267 close(6 <unfinished ...>
[pid 25426] 10:12:34.193300 <... socket resumed> ) = 5
[pid 25425] 10:12:34.193323 <... close resumed> ) = 0
[pid 25425] 10:12:34.193347 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.193483 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.193537 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.193557 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.193599 close(5)    = 0
[pid 25426] 10:12:34.193636 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.193662 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.193691 <... socket resumed> ) = 5
[pid 25425] 10:12:34.193714 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.193734 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.193778 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25426] 10:12:34.193820 close(5)    = 0
[pid 25426] 10:12:34.193861 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.193889 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.193929 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.193959 <... open resumed> ) = 5
[pid 25425] 10:12:34.193977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.194015 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d41b000
[pid 25426] 10:12:34.194055 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.194085 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.194112 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25426] 10:12:34.194141 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.194170 <... mmap resumed> ) = 0x7f380cdd5000
[pid 25426] 10:12:34.194190 <... mmap resumed> ) = 0x7f574371d000
[pid 25426] 10:12:34.194209 read(5,  <unfinished ...>
[pid 25425] 10:12:34.194233 mprotect(0x7f380cdeb000, 2093056, PROT_NONE) = 0
[pid 25426] 10:12:34.194273 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25426] 10:12:34.194310 read(5,  <unfinished ...>
[pid 25425] 10:12:34.194419 mmap(0x7f380cfea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f380cfea000
[pid 25425] 10:12:34.194474 mmap(0x7f380cfec000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.194504 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.194526 <... mmap resumed> ) = 0x7f380cfec000
[pid 25426] 10:12:34.194546 close(5)    = 0
[pid 25425] 10:12:34.194587 close(6 <unfinished ...>
[pid 25427] 10:12:34.194623 <... write resumed> ) = 4
[pid 25411] 10:12:34.194636 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25411] 10:12:34.194657 read(13,  <unfinished ...>
[pid 25426] 10:12:34.194685 munmap(0x7f574371d000, 4096) = 0
[pid 25427] 10:12:34.194722 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.194749 <... close resumed> ) = 0
[pid 25427] 10:12:34.194771 <... write resumed> ) = 4
[pid 25411] 10:12:34.194784 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25411] 10:12:34.194803 read(13,  <unfinished ...>
[pid 25425] 10:12:34.194836 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.194873 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25427] 10:12:34.194899 write(14, "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.194932 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.194953 read(13,  <unfinished ...>
[pid 25427] 10:12:34.194981 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25425] 10:12:34.195014 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25427] 10:12:34.195040 <... write resumed> ) = 40
[pid 25411] 10:12:34.195055 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25411] 10:12:34.195074 read(13,  <unfinished ...>
[pid 25427] 10:12:34.195112 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25426] 10:12:34.195139 <... open resumed> ) = 5
[pid 25425] 10:12:34.195152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25427] 10:12:34.195188 <... write resumed> ) = 4
[pid 25426] 10:12:34.195202 fstat(5,  <unfinished ...>
[pid 25411] 10:12:34.195224 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25427] 10:12:34.195248 close(14 <unfinished ...>
[pid 25426] 10:12:34.195271 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25425] 10:12:34.195303 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.195320 wait4(-1,  <unfinished ...>
[pid 25427] 10:12:34.195348 <... close resumed> ) = 0
[pid 25426] 10:12:34.195365 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25425] 10:12:34.195403 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25427] 10:12:34.195436 exit_group(0) = ?
[pid 25426] 10:12:34.195451 <... mmap resumed> ) = 0x7f5743714000
[pid 25425] 10:12:34.195658 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25427] 10:12:34.195736 +++ exited with 0 +++
[pid 25426] 10:12:34.195751 close(5 <unfinished ...>
[pid 25425] 10:12:34.195773 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.195803 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25427
[pid 25426] 10:12:34.195826 <... close resumed> ) = 0
[pid 25425] 10:12:34.195840 <... open resumed> ) = 6
[pid 25411] 10:12:34.195862 close(13 <unfinished ...>
[pid 25426] 10:12:34.195894 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.195922 read(6,  <unfinished ...>
[pid 25411] 10:12:34.195945 <... close resumed> ) = 0
[pid 25426] 10:12:34.195965 <... open resumed> ) = 5
[pid 25425] 10:12:34.195978 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.195999 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25426] 10:12:34.196033 read(5,  <unfinished ...>
[pid 25425] 10:12:34.196055 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.196076 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25426] 10:12:34.196121 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.196144 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25411] 10:12:34.196172 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.196206 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.196227 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.196253 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.196301 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.196324 <... mmap resumed> ) = 0x7f380cb9e000
[pid 25411] 10:12:34.196330 open("/etc/userdomains", O_RDONLY) = 9
[pid 25426] 10:12:34.196504 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25425] 10:12:34.196536 mprotect(0x7f380cba5000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.196562 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.196595 <... mmap resumed> ) = 0x7f5742b39000
[pid 25425] 10:12:34.196613 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.196628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.196668 mprotect(0x7f5742b45000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.196695 mmap(0x7f380cda5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25411] 10:12:34.196724 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.196751 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.196764 <... mmap resumed> ) = 0x7f380cda5000
[pid 25411] 10:12:34.196779 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.196817 mmap(0x7f5742d45000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25425] 10:12:34.196844 mmap(0x7f380cda7000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.196870 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.196900 <... mmap resumed> ) = 0x7f5742d45000
[pid 25425] 10:12:34.196913 <... mmap resumed> ) = 0x7f380cda7000
[pid 25411] 10:12:34.196936 <... mmap resumed> ) = 0x7f81692a0000
[pid 25426] 10:12:34.196964 close(5 <unfinished ...>
[pid 25425] 10:12:34.196987 close(6 <unfinished ...>
[pid 25411] 10:12:34.197008 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.197035 <... close resumed> ) = 0
[pid 25425] 10:12:34.197048 <... close resumed> ) = 0
[pid 25411] 10:12:34.197076 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.197105 mprotect(0x7f5742d45000, 4096, PROT_READ <unfinished ...>
[pid 25425] 10:12:34.197131 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.197160 read(9,  <unfinished ...>
[pid 25426] 10:12:34.197191 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.197204 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.197224 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25426] 10:12:34.197268 munmap(0x7f5743714000, 39387 <unfinished ...>
[pid 25425] 10:12:34.197299 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.197330 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.197404 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.197418 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.197443 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.197492 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.197523 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.197551 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.197581 <... open resumed> ) = 5
[pid 25425] 10:12:34.197599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.197617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.197683 fcntl(5, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.197711 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.197740 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25426] 10:12:34.197775 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25425] 10:12:34.197790 <... open resumed> ) = 6
[pid 25411] 10:12:34.197808 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.197836 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.197859 read(6,  <unfinished ...>
[pid 25411] 10:12:34.197881 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.197913 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.197938 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.197960 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.197998 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.198008 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.198013 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25411] 10:12:34.198036 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.198066 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.198092 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929f000
[pid 25411] 10:12:34.198111 lseek(10, 0, SEEK_SET) = 0
[pid 25411] 10:12:34.198128 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25411] 10:12:34.198172 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25411] 10:12:34.198198 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.198225 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929e000
[pid 25411] 10:12:34.198243 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.198276 close(11)   = 0
[pid 25411] 10:12:34.198294 munmap(0x7f816929e000, 4096) = 0
[pid 25411] 10:12:34.198517 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.198552 <... mmap resumed> ) = 0x7f574371d000
[pid 25425] 10:12:34.198567 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25426] 10:12:34.198598 read(5,  <unfinished ...>
[pid 25411] 10:12:34.198627 <... open resumed> ) = 11
[pid 25426] 10:12:34.198649 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.198667 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.198710 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.198738 close(5 <unfinished ...>
[pid 25425] 10:12:34.198761 <... mmap resumed> ) = 0x7f380c91a000
[pid 25411] 10:12:34.198775 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.198811 <... close resumed> ) = 0
[pid 25425] 10:12:34.198825 mprotect(0x7f380c99d000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.198853 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.198880 munmap(0x7f574371d000, 4096 <unfinished ...>
[pid 25425] 10:12:34.198905 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.198919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.198952 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.198966 mmap(0x7f380cb9c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25411] 10:12:34.199033 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.199064 getpgrp( <unfinished ...>
[pid 25425] 10:12:34.199086 <... mmap resumed> ) = 0x7f380cb9c000
[pid 25411] 10:12:34.199099 <... mmap resumed> ) = 0x7f816929e000
[pid 25426] 10:12:34.199130 <... getpgrp resumed> ) = 29163
[pid 25425] 10:12:34.199146 close(6 <unfinished ...>
[pid 25411] 10:12:34.199169 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.199196 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.199223 <... close resumed> ) = 0
[pid 25411] 10:12:34.199236 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.199264 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.199282 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.199317 read(11,  <unfinished ...>
[pid 25426] 10:12:34.199347 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25425] 10:12:34.199374 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.199389 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25426] 10:12:34.199435 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25425] 10:12:34.199456 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.199544 stat("/jail_owner",  <unfinished ...>
[pid 25426] 10:12:34.199561 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25425] 10:12:34.199567 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.199573 <... stat resumed> 0x7ffdf4a513f0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.199589 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.199632 stat("/usr/local/cpanel/3rdparty/mailman/lists/phoenixmarriottmesa_finestweddingsites.com/config.pck", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.199664 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.199700 stat("/usr/local/cpanel/3rdparty/mailman/lists/phoenixmarriottmesa/config.pck", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.199726 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.199769 open("/etc/demouids", O_RDONLY) = 12
[pid 25411] 10:12:34.199792 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.199821 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.199847 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929d000
[pid 25411] 10:12:34.199866 lseek(12, 0, SEEK_SET) = 0
[pid 25411] 10:12:34.199883 read(12, "", 4096) = 0
[pid 25411] 10:12:34.199907 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.200026 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.200072 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.200109 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.200147 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25411] 10:12:34.200170 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.200200 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.200227 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929c000
[pid 25411] 10:12:34.200246 lseek(13, 0, SEEK_SET) = 0
[pid 25411] 10:12:34.200263 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25411] 10:12:34.200290 read(13, "", 4096) = 0
[pid 25411] 10:12:34.200322 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.200556 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.200620 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.200686 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25423] 10:12:34.200714 <... select resumed> ) = 1 (in [11], left {299, 983010})
[pid 25411] 10:12:34.200732 <... open resumed> ) = 14
[pid 25423] 10:12:34.200745 recvfrom(11,  <unfinished ...>
[pid 25411] 10:12:34.200757 fstat(14,  <unfinished ...>
[pid 25423] 10:12:34.200769 <... recvfrom resumed> "220 mx.google.com ESMTP s75si9042420ois.137 - gsmtp\r\n", 4096, 0, NULL, NULL) = 53
[pid 25411] 10:12:34.200793 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25423] 10:12:34.200816 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25411] 10:12:34.200846 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.200863 <... sendto resumed> ) = 33
[pid 25411] 10:12:34.200873 <... mmap resumed> ) = 0x7f816929b000
[pid 25423] 10:12:34.200884 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25411] 10:12:34.200898 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.200931 close(14)   = 0
[pid 25411] 10:12:34.200949 munmap(0x7f816929b000, 4096) = 0
[pid 25411] 10:12:34.200977 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.201009 pipe([14, 15]) = 0
[pid 25411] 10:12:34.201028 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:34.201052 close(12)   = 0
[pid 25411] 10:12:34.201069 munmap(0x7f816929d000, 4096) = 0
[pid 25411] 10:12:34.201088 close(9)    = 0
[pid 25411] 10:12:34.201105 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.201124 close(11)   = 0
[pid 25411] 10:12:34.201141 munmap(0x7f816929e000, 4096) = 0
[pid 25411] 10:12:34.201159 close(13)   = 0
[pid 25411] 10:12:34.201176 munmap(0x7f816929c000, 4096) = 0
[pid 25411] 10:12:34.201194 close(10)   = 0
[pid 25411] 10:12:34.201211 munmap(0x7f816929f000, 4096) = 0
[pid 25411] 10:12:34.201229 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25429
[pid 25411] 10:12:34.201421 close(15)   = 0
[pid 25411] 10:12:34.201441 read(14,  <unfinished ...>
[pid 25426] 10:12:34.201459 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25425] 10:12:34.201468 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.201496 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25425] 10:12:34.201503 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.201518 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25425] 10:12:34.201526 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.201556 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25425] 10:12:34.201562 <... open resumed> ) = 6
[pid 25426] 10:12:34.201575 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25425] 10:12:34.201583 read(6,  <unfinished ...>
[pid 25426] 10:12:34.201654 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.201665 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.201683 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.201692 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.201706 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.201713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25426] 10:12:34.201737 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.201745 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.201762 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0},  <unfinished ...>
[pid 25425] 10:12:34.201769 <... mmap resumed> ) = 0x7f380d41a000
[pid 25426] 10:12:34.201790 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f5742d796a0}, 8) = 0
[pid 25425] 10:12:34.201799 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.201824 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25425] 10:12:34.201881 <... mmap resumed> ) = 0x7f380c70c000
Process 25428 attached
[pid 25425] 10:12:34.202032 mprotect(0x7f380c718000, 2097152, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.202043 <... execve resumed> ) = 0
[pid 25428] 10:12:34.202086 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25426] 10:12:34.202094 brk(0 <unfinished ...>
[pid 25425] 10:12:34.202099 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.202114 <... set_robust_list resumed> ) = 0
[pid 25426] 10:12:34.202119 <... brk resumed> ) = 0x1626000
[pid 25425] 10:12:34.202124 mmap(0x7f380c918000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25428] 10:12:34.202168 fcntl(12, F_GETFD <unfinished ...>
[pid 25426] 10:12:34.202174 fcntl(0, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.202179 <... mmap resumed> ) = 0x7f380c918000
[pid 25428] 10:12:34.202203 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.202208 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.202213 close(6 <unfinished ...>
[pid 25428] 10:12:34.202229 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.202235 fcntl(1, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.202240 <... close resumed> ) = 0
[pid 25428] 10:12:34.202261 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.202266 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.202270 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.202298 close(6 <unfinished ...>
[pid 25426] 10:12:34.202303 fcntl(2, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.202308 <... open resumed> ) = 6
[pid 25428] 10:12:34.202324 <... close resumed> ) = 0
[pid 25426] 10:12:34.202329 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.202333 read(6,  <unfinished ...>
[pid 25428] 10:12:34.202776 open("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25426] 10:12:34.202819 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25425] 10:12:34.202848 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.202876 <... open resumed> ) = 6
[pid 25426] 10:12:34.202893 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.202918 fcntl(6, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.202955 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.202980 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.202993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.203023 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.203045 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25428] 10:12:34.203076 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.203092 <... mmap resumed> ) = 0x7fc4db3bb000
[pid 25428] 10:12:34.203145 geteuid( <unfinished ...>
[pid 25425] 10:12:34.203177 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.203207 <... geteuid resumed> ) = 0
[pid 25426] 10:12:34.203221 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25428] 10:12:34.203252 getegid( <unfinished ...>
[pid 25425] 10:12:34.203273 <... mmap resumed> ) = 0x7f380c4e9000
[pid 25428] 10:12:34.203289 <... getegid resumed> ) = 12
[pid 25426] 10:12:34.203304 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.203325 setgid(12 <unfinished ...>
[pid 25425] 10:12:34.203362 mprotect(0x7f380c50a000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.203391 <... setgid resumed> ) = 0
[pid 25426] 10:12:34.203405 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.203439 setuid(47 <unfinished ...>
[pid 25425] 10:12:34.203462 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.203479 <... setuid resumed> ) = 0
[pid 25426] 10:12:34.203493 <... open resumed> ) = 5
[pid 25428] 10:12:34.203511 close(11 <unfinished ...>
[pid 25425] 10:12:34.203534 mmap(0x7f380c70a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25428] 10:12:34.203565 <... close resumed> ) = 0
[pid 25426] 10:12:34.203583 fstat(5,  <unfinished ...>
[pid 25428] 10:12:34.203709 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.203736 <... mmap resumed> ) = 0x7f380c70a000
[pid 25428] 10:12:34.203754 <... socket resumed> ) = 10
[pid 25426] 10:12:34.203773 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25428] 10:12:34.203805 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25425] 10:12:34.203838 close(6 <unfinished ...>
[pid 25428] 10:12:34.203863 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.203878 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25428] 10:12:34.203907 close(10 <unfinished ...>
[pid 25425] 10:12:34.203931 <... close resumed> ) = 0
[pid 25428] 10:12:34.203948 <... close resumed> ) = 0
[pid 25426] 10:12:34.203969 <... mmap resumed> ) = 0x7fc4db3b1000
[pid 25428] 10:12:34.203991 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.204018 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.204050 <... socket resumed> ) = 10
[pid 25426] 10:12:34.204063 close(5 <unfinished ...>
[pid 25428] 10:12:34.204089 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25425] 10:12:34.204117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.204135 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.204156 <... close resumed> ) = 0
[pid 25428] 10:12:34.204174 close(10 <unfinished ...>
[pid 25425] 10:12:34.204208 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.204241 <... close resumed> ) = 0
[pid 25426] 10:12:34.204255 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.204338 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.204482 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.204502 <... open resumed> ) = 10
[pid 25426] 10:12:34.204518 <... open resumed> ) = 5
[pid 25428] 10:12:34.204543 fstat(10,  <unfinished ...>
[pid 25425] 10:12:34.204568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.204600 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.204627 read(5,  <unfinished ...>
[pid 25428] 10:12:34.204655 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.204681 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.204699 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25426] 10:12:34.204716 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.204741 read(10,  <unfinished ...>
[pid 25425] 10:12:34.204771 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.204804 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25426] 10:12:34.204822 fstat(5,  <unfinished ...>
[pid 25428] 10:12:34.204875 close(10 <unfinished ...>
[pid 25425] 10:12:34.204899 <... open resumed> ) = 6
[pid 25428] 10:12:34.204915 <... close resumed> ) = 0
[pid 25426] 10:12:34.204930 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25428] 10:12:34.204961 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25425] 10:12:34.204989 read(6,  <unfinished ...>
[pid 25428] 10:12:34.205015 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.205028 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25428] 10:12:34.205097 stat("/etc/mailips",  <unfinished ...>
[pid 25425] 10:12:34.205124 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.205146 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.205179 <... mmap resumed> ) = 0x7fc4dae09000
[pid 25428] 10:12:34.205223 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.205256 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.205282 <... open resumed> ) = 10
[pid 25426] 10:12:34.205296 mprotect(0x7fc4daf93000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.205330 fstat(10,  <unfinished ...>
[pid 25425] 10:12:34.205358 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25428] 10:12:34.205387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.205415 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.205444 fstat(10,  <unfinished ...>
[pid 25425] 10:12:34.205471 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.205500 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.205525 mmap(0x7fc4db193000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25428] 10:12:34.205558 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.205583 <... mmap resumed> ) = 0x7f380c2cc000
[pid 25428] 10:12:34.205599 <... mmap resumed> ) = 0x7fb3682b9000
[pid 25426] 10:12:34.205614 <... mmap resumed> ) = 0x7fc4db193000
[pid 25428] 10:12:34.205634 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.205662 mprotect(0x7f380c2e3000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.205690 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.205704 mmap(0x7fc4db198000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.205736 read(10,  <unfinished ...>
[pid 25425] 10:12:34.205758 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.205772 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.205778 <... mmap resumed> ) = 0x7fc4db198000
[pid 25428] 10:12:34.205812 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.205820 close(5 <unfinished ...>
[pid 25425] 10:12:34.205825 mmap(0x7f380c4e3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25428] 10:12:34.205848 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.205853 <... close resumed> ) = 0
[pid 25425] 10:12:34.205858 <... mmap resumed> ) = 0x7f380c4e3000
[pid 25428] 10:12:34.205888 read(10,  <unfinished ...>
[pid 25426] 10:12:34.205895 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.205901 mmap(0x7f380c4e5000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.205922 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.205928 <... mmap resumed> ) = 0x7fc4db3b0000
[pid 25425] 10:12:34.205933 <... mmap resumed> ) = 0x7f380c4e5000
[pid 25428] 10:12:34.206119 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.206130 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.206137 close(6 <unfinished ...>
[pid 25428] 10:12:34.206158 <... open resumed> ) = 11
[pid 25426] 10:12:34.206164 <... mmap resumed> ) = 0x7fc4db3af000
[pid 25425] 10:12:34.206168 <... close resumed> ) = 0
[pid 25428] 10:12:34.206194 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.206200 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.206206 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.206230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.206245 <... mmap resumed> ) = 0x7fc4db3ae000
[pid 25425] 10:12:34.206250 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.206268 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.206275 arch_prctl(ARCH_SET_FS, 0x7fc4db3af700 <unfinished ...>
[pid 25425] 10:12:34.206281 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.206307 <... mmap resumed> ) = 0x7fb3682b8000
[pid 25426] 10:12:34.206312 <... arch_prctl resumed> ) = 0
[pid 25425] 10:12:34.206317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.206605 read(11,  <unfinished ...>
[pid 25426] 10:12:34.206641 mprotect(0x7fc4db193000, 16384, PROT_READ <unfinished ...>
[pid 25425] 10:12:34.206668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.206702 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.206720 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.206750 close(11 <unfinished ...>
[pid 25425] 10:12:34.206780 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.206798 <... close resumed> ) = 0
[pid 25426] 10:12:34.206814 mprotect(0x7fc4db3bc000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.206843 munmap(0x7fb3682b8000, 4096 <unfinished ...>
[pid 25425] 10:12:34.206869 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.206901 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.206915 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.206958 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.206990 <... open resumed> ) = 6
[pid 25428] 10:12:34.207007 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25426] 10:12:34.207023 munmap(0x7fc4db3b1000, 39387 <unfinished ...>
[pid 25428] 10:12:34.207167 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.207192 read(6,  <unfinished ...>
[pid 25428] 10:12:34.207217 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.207231 <... munmap resumed> ) = 0
[pid 25428] 10:12:34.207249 read(10,  <unfinished ...>
[pid 25425] 10:12:34.207301 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.207329 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.207346 getuid( <unfinished ...>
[pid 25428] 10:12:34.207459 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.207484 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.207513 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.207533 <... getuid resumed> ) = 503
[pid 25428] 10:12:34.207553 read(10,  <unfinished ...>
[pid 25425] 10:12:34.207578 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.207615 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.207631 getgid( <unfinished ...>
[pid 25428] 10:12:34.207682 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25425] 10:12:34.207715 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.207744 <... open resumed> ) = 11
[pid 25426] 10:12:34.207758 <... getgid resumed> ) = 500
[pid 25428] 10:12:34.207776 alarm(60 <unfinished ...>
[pid 25425] 10:12:34.207803 <... mmap resumed> ) = 0x7f380d419000
[pid 25428] 10:12:34.207820 <... alarm resumed> ) = 0
[pid 25426] 10:12:34.207838 getegid( <unfinished ...>
[pid 25428] 10:12:34.207865 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25425] 10:12:34.207892 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.207922 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.207935 <... getegid resumed> ) = 499
[pid 25428] 10:12:34.207953 alarm(0 <unfinished ...>
[pid 25425] 10:12:34.207978 <... mmap resumed> ) = 0x7f380bf58000
[pid 25428] 10:12:34.207994 <... alarm resumed> ) = 60
[pid 25426] 10:12:34.208009 getppid( <unfinished ...>
[pid 25428] 10:12:34.208110 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25425] 10:12:34.208140 mprotect(0x7f380c0c7000, 2093056, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.208169 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25426] 10:12:34.208196 <... getppid resumed> ) = 25389
[pid 25428] 10:12:34.208228 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.208265 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.208282 <... open resumed> ) = 13
[pid 25426] 10:12:34.208297 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25428] 10:12:34.208330 fcntl(13, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.208356 mmap(0x7f380c2c6000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25428] 10:12:34.208389 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.208404 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25428] 10:12:34.208435 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.208502 <... mmap resumed> ) = 0x7f380c2c6000
[pid 25428] 10:12:34.208520 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.208544 brk(0 <unfinished ...>
[pid 25428] 10:12:34.208578 read(13,  <unfinished ...>
[pid 25425] 10:12:34.208606 close(6 <unfinished ...>
[pid 25428] 10:12:34.208632 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25426] 10:12:34.208652 <... brk resumed> ) = 0x1626000
[pid 25428] 10:12:34.208675 close(13 <unfinished ...>
[pid 25425] 10:12:34.208701 <... close resumed> ) = 0
[pid 25428] 10:12:34.208717 <... close resumed> ) = 0
[pid 25426] 10:12:34.208739 brk(0x1647000 <unfinished ...>
[pid 25428] 10:12:34.208778 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.208811 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.208843 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.208857 <... brk resumed> ) = 0x1647000
[pid 25428] 10:12:34.208877 stat("/var/tmp",  <unfinished ...>
[pid 25425] 10:12:34.208924 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.208942 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25426] 10:12:34.208976 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25428] 10:12:34.209209 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.209241 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.209275 <... open resumed> ) = 13
[pid 25426] 10:12:34.209288 <... socket resumed> ) = 5
[pid 25428] 10:12:34.209306 fcntl(13, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.209329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.209347 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.209494 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25428] 10:12:34.209534 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.209557 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.209596 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.209612 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.209632 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.209656 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.209672 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25426] 10:12:34.209709 close(5 <unfinished ...>
[pid 25428] 10:12:34.209776 pread(13,  <unfinished ...>
[pid 25425] 10:12:34.209800 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.209834 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25426] 10:12:34.209855 <... close resumed> ) = 0
[pid 25428] 10:12:34.209897 pread(13,  <unfinished ...>
[pid 25425] 10:12:34.209925 <... open resumed> ) = 6
[pid 25428] 10:12:34.209941 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25426] 10:12:34.209963 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25428] 10:12:34.210008 close(13 <unfinished ...>
[pid 25425] 10:12:34.210032 read(6,  <unfinished ...>
[pid 25428] 10:12:34.210057 <... close resumed> ) = 0
[pid 25426] 10:12:34.210076 <... socket resumed> ) = 5
[pid 25428] 10:12:34.210118 close(11 <unfinished ...>
[pid 25425] 10:12:34.210148 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.210172 <... close resumed> ) = 0
[pid 25426] 10:12:34.210188 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25428] 10:12:34.210251 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25425] 10:12:34.210279 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.210305 <... socket resumed> ) = 11
[pid 25426] 10:12:34.210318 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.210343 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25425] 10:12:34.210376 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25428] 10:12:34.210406 <... setsockopt resumed> ) = 0
[pid 25426] 10:12:34.210423 close(5 <unfinished ...>
[pid 25428] 10:12:34.210468 alarm(300 <unfinished ...>
[pid 25425] 10:12:34.210491 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.210522 <... alarm resumed> ) = 0
[pid 25426] 10:12:34.210536 <... close resumed> ) = 0
[pid 25428] 10:12:34.210559 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("68.232.137.182")}, 16 <unfinished ...>
[pid 25425] 10:12:34.210650 <... mmap resumed> ) = 0x7f380bcc9000
[pid 25426] 10:12:34.210674 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.210706 mprotect(0x7f380bd54000, 2097152, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.210742 <... open resumed> ) = 5
[pid 25425] 10:12:34.210760 <... mprotect resumed> ) = 0
[pid 25426] 10:12:34.210785 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.210811 mmap(0x7f380bf54000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25426] 10:12:34.210843 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25425] 10:12:34.210872 <... mmap resumed> ) = 0x7f380bf54000
[pid 25426] 10:12:34.210891 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.210924 mmap(0x7f380bf57000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.210953 <... mmap resumed> ) = 0x7fc4db3ba000
[pid 25425] 10:12:34.210969 <... mmap resumed> ) = 0x7f380bf57000
[pid 25426] 10:12:34.210986 read(5,  <unfinished ...>
[pid 25425] 10:12:34.211026 close(6 <unfinished ...>
[pid 25426] 10:12:34.211051 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25425] 10:12:34.211071 <... close resumed> ) = 0
[pid 25426] 10:12:34.211104 read(5,  <unfinished ...>
[pid 25425] 10:12:34.211138 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.211165 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.211173 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.211192 close(5 <unfinished ...>
[pid 25425] 10:12:34.211198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.211221 <... close resumed> ) = 0
[pid 25425] 10:12:34.211226 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.211239 munmap(0x7fc4db3ba000, 4096 <unfinished ...>
[pid 25425] 10:12:34.211245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.211267 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.211273 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.211298 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.211305 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.211328 <... open resumed> ) = 5
[pid 25425] 10:12:34.211333 <... open resumed> ) = 6
[pid 25426] 10:12:34.211347 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.211550 read(6,  <unfinished ...>
[pid 25426] 10:12:34.211582 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25425] 10:12:34.211618 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.211645 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25425] 10:12:34.211679 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.211703 <... mmap resumed> ) = 0x7fc4db3b1000
[pid 25425] 10:12:34.211719 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25426] 10:12:34.211748 close(5 <unfinished ...>
[pid 25425] 10:12:34.211774 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.211803 <... close resumed> ) = 0
[pid 25425] 10:12:34.211819 <... mmap resumed> ) = 0x7f380bac3000
[pid 25426] 10:12:34.211844 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.211877 mprotect(0x7f380bac9000, 2093056, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.211905 <... open resumed> ) = 5
[pid 25425] 10:12:34.211921 <... mprotect resumed> ) = 0
[pid 25426] 10:12:34.211937 read(5,  <unfinished ...>
[pid 25425] 10:12:34.211962 mmap(0x7f380bcc8000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25426] 10:12:34.211990 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.212013 <... mmap resumed> ) = 0x7f380bcc8000
[pid 25426] 10:12:34.212031 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.212062 close(6 <unfinished ...>
[pid 25426] 10:12:34.212090 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.212117 <... close resumed> ) = 0
[pid 25426] 10:12:34.212141 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25425] 10:12:34.212177 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.212208 <... mmap resumed> ) = 0x7fc4dabfb000
[pid 25425] 10:12:34.212224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.212242 mprotect(0x7fc4dac07000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.212270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.212302 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.212318 <... open resumed> ) = 6
[pid 25426] 10:12:34.212334 mmap(0x7fc4dae07000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7fc4dae07000
[pid 25425] 10:12:34.212473 read(6,  <unfinished ...>
[pid 25426] 10:12:34.212512 close(5 <unfinished ...>
[pid 25425] 10:12:34.212536 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.212559 <... close resumed> ) = 0
[pid 25425] 10:12:34.212581 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.212624 mprotect(0x7fc4dae07000, 4096, PROT_READ <unfinished ...>
[pid 25425] 10:12:34.212659 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.212690 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.212708 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.212741 munmap(0x7fc4db3b1000, 39387 <unfinished ...>
[pid 25425] 10:12:34.212770 <... mmap resumed> ) = 0x7f380d418000
[pid 25426] 10:12:34.212786 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.212806 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25426] 10:12:34.212842 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.212872 <... mmap resumed> ) = 0x7f380b78d000
[pid 25426] 10:12:34.212888 <... open resumed> ) = 5
[pid 25425] 10:12:34.212904 mprotect(0x7f380b8b9000, 2097152, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.212937 fcntl(5, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.212962 <... mprotect resumed> ) = 0
[pid 25426] 10:12:34.212977 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25425] 10:12:34.212994 mmap(0x7f380bab9000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25426] 10:12:34.213028 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.213053 <... mmap resumed> ) = 0x7f380bab9000
[pid 25426] 10:12:34.213068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.213102 mmap(0x7f380bac2000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.213132 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.213164 <... mmap resumed> ) = 0x7f380bac2000
[pid 25426] 10:12:34.213180 <... mmap resumed> ) = 0x7fc4db3ba000
[pid 25425] 10:12:34.213202 close(6 <unfinished ...>
[pid 25426] 10:12:34.213230 read(5,  <unfinished ...>
[pid 25425] 10:12:34.213256 <... close resumed> ) = 0
[pid 25426] 10:12:34.213281 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.213300 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.213355 close(5 <unfinished ...>
[pid 25425] 10:12:34.213379 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.213399 <... close resumed> ) = 0
[pid 25425] 10:12:34.213413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.213451 munmap(0x7fc4db3ba000, 4096 <unfinished ...>
[pid 25425] 10:12:34.213477 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.213498 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.213511 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.213551 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.213583 <... open resumed> ) = -1 ENOENT (No such file or directory)
Process 25429 attached
[pid 25426] 10:12:34.213617 <... socket resumed> ) = 5
[pid 25425] 10:12:34.213643 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.213681 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25426] 10:12:34.213703 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25425] 10:12:34.213733 <... open resumed> ) = 6
[pid 25429] 10:12:34.213753 <... set_robust_list resumed> ) = 0
[pid 25426] 10:12:34.213766 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.213801 read(6,  <unfinished ...>
[pid 25429] 10:12:34.213832 close(14 <unfinished ...>
[pid 25426] 10:12:34.213853 close(5 <unfinished ...>
[pid 25425] 10:12:34.213876 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25429] 10:12:34.213903 <... close resumed> ) = 0
[pid 25426] 10:12:34.213916 <... close resumed> ) = 0
[pid 25425] 10:12:34.213937 fstat(6,  <unfinished ...>
[pid 25429] 10:12:34.213967 geteuid( <unfinished ...>
[pid 25426] 10:12:34.213985 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25425] 10:12:34.213992 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25429] 10:12:34.214020 <... geteuid resumed> ) = 0
[pid 25426] 10:12:34.214026 <... socket resumed> ) = 5
[pid 25425] 10:12:34.214030 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25429] 10:12:34.214051 getegid( <unfinished ...>
[pid 25426] 10:12:34.214056 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25425] 10:12:34.214064 <... mmap resumed> ) = 0x7f380b589000
[pid 25429] 10:12:34.214083 <... getegid resumed> ) = 12
[pid 25426] 10:12:34.214088 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.214094 mprotect(0x7f380b58b000, 2097152, PROT_NONE <unfinished ...>
[pid 25429] 10:12:34.214115 setgid(500 <unfinished ...>
[pid 25426] 10:12:34.214121 close(5 <unfinished ...>
[pid 25425] 10:12:34.214126 <... mprotect resumed> ) = 0
[pid 25429] 10:12:34.214143 <... setgid resumed> ) = 0
[pid 25426] 10:12:34.214149 <... close resumed> ) = 0
[pid 25425] 10:12:34.214153 mmap(0x7f380b78b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25429] 10:12:34.214178 setuid(503 <unfinished ...>
[pid 25426] 10:12:34.214184 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.214191 <... mmap resumed> ) = 0x7f380b78b000
[pid 25429] 10:12:34.214219 <... setuid resumed> ) = 0
[pid 25426] 10:12:34.214225 <... open resumed> ) = 5
[pid 25425] 10:12:34.214230 close(6 <unfinished ...>
[pid 25429] 10:12:34.214271 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.214278 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.214284 <... close resumed> ) = 0
[pid 25429] 10:12:34.214310 <... open resumed> ) = 9
[pid 25426] 10:12:34.214316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.214331 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.214567 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.214592 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.214618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25429] 10:12:34.214640 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25426] 10:12:34.214666 <... mmap resumed> ) = 0x7fc4db3ba000
[pid 25425] 10:12:34.214709 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.214750 brk(0x1be8000 <unfinished ...>
[pid 25426] 10:12:34.214773 read(5,  <unfinished ...>
[pid 25425] 10:12:34.214798 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25429] 10:12:34.214820 <... brk resumed> ) = 0x1be8000
[pid 25426] 10:12:34.214834 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.214910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.214964 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.214985 close(5 <unfinished ...>
[pid 25425] 10:12:34.215008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25429] 10:12:34.215030 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25426] 10:12:34.215055 <... close resumed> ) = 0
[pid 25425] 10:12:34.215071 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.215107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.215132 munmap(0x7fc4db3ba000, 4096 <unfinished ...>
[pid 25425] 10:12:34.215159 <... open resumed> ) = 6
[pid 25429] 10:12:34.215179 <... mmap resumed> ) = 0x7f81692a0000
[pid 25426] 10:12:34.215198 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.215213 read(6,  <unfinished ...>
[pid 25429] 10:12:34.215249 read(9,  <unfinished ...>
[pid 25426] 10:12:34.215279 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.215307 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25429] 10:12:34.215334 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25426] 10:12:34.215356 <... open resumed> ) = 5
[pid 25425] 10:12:34.215375 fstat(6,  <unfinished ...>
[pid 25429] 10:12:34.215402 read(9,  <unfinished ...>
[pid 25426] 10:12:34.215429 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.215451 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25429] 10:12:34.215484 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25426] 10:12:34.215502 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.215532 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25429] 10:12:34.215565 close(9 <unfinished ...>
[pid 25426] 10:12:34.215588 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.215613 <... mmap resumed> ) = 0x7f380b386000
[pid 25429] 10:12:34.215633 <... close resumed> ) = 0
[pid 25426] 10:12:34.215647 <... mmap resumed> ) = 0x7fc4db3ba000
[pid 25425] 10:12:34.215664 mprotect(0x7f380b388000, 2093056, PROT_NONE <unfinished ...>
[pid 25429] 10:12:34.215695 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25426] 10:12:34.215719 read(5,  <unfinished ...>
[pid 25425] 10:12:34.215745 <... mprotect resumed> ) = 0
[pid 25429] 10:12:34.215764 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.215777 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.216183 mmap(0x7f380b587000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25429] 10:12:34.216208 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.216214 close(5 <unfinished ...>
[pid 25425] 10:12:34.216226 <... mmap resumed> ) = 0x7f380b587000
[pid 25429] 10:12:34.216247 <... lseek resumed> ) = 19
[pid 25426] 10:12:34.216253 <... close resumed> ) = 0
[pid 25425] 10:12:34.216262 close(6 <unfinished ...>
[pid 25429] 10:12:34.216274 read(6,  <unfinished ...>
[pid 25426] 10:12:34.216280 munmap(0x7fc4db3ba000, 4096 <unfinished ...>
[pid 25425] 10:12:34.216294 <... close resumed> ) = 0
[pid 25429] 10:12:34.216312 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2423) = 1858
[pid 25426] 10:12:34.216320 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.216940 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25429] 10:12:34.216988 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25426] 10:12:34.217011 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25425] 10:12:34.217051 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.217073 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25425] 10:12:34.217096 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.217131 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25425] 10:12:34.217159 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.217179 <... readlink resumed> 0x7ffecfa8d360, 4095) = -1 EINVAL (Invalid argument)
[pid 25425] 10:12:34.217203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.217236 getcwd( <unfinished ...>
[pid 25425] 10:12:34.217260 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.217281 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25425] 10:12:34.217306 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.217341 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25425] 10:12:34.217427 <... open resumed> ) = 6
[pid 25426] 10:12:34.217448 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25425] 10:12:34.217480 read(6,  <unfinished ...>
[pid 25426] 10:12:34.217507 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.217545 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25426] 10:12:34.217573 <... open resumed> ) = 5
[pid 25425] 10:12:34.217590 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.217616 fstat(5,  <unfinished ...>
[pid 25425] 10:12:34.217638 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25426] 10:12:34.217670 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25425] 10:12:34.217706 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.217737 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.217762 <... mmap resumed> ) = 0x7f380d417000
[pid 25423] 10:12:34.217782 <... select resumed> ) = 1 (in [11], left {299, 983202})
[pid 25426] 10:12:34.217808 <... mmap resumed> ) = 0x7fc4db3ba000
[pid 25425] 10:12:34.217824 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.217857 recvfrom(11,  <unfinished ...>
[pid 25426] 10:12:34.217888 read(5,  <unfinished ...>
[pid 25425] 10:12:34.217915 <... mmap resumed> ) = 0x7f380aff2000
[pid 25423] 10:12:34.217931 <... recvfrom resumed> "250-mx.google.com at your service, [50.116.78.207]\r\n250-SIZE 35882577\r\n250-8BITMIME\r\n250-STARTTLS\r\n250-ENHANCEDSTATUSCODES\r\n250-PIPELINING\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n", 4096, 0, NULL, NULL) = 168
[pid 25426] 10:12:34.217979 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25425] 10:12:34.218001 mprotect(0x7f380b17c000, 2097152, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.218029 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0 <unfinished ...>
[pid 25426] 10:12:34.218079 read(5,  <unfinished ...>
[pid 25425] 10:12:34.218104 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.218120 <... sendto resumed> ) = 10
[pid 25426] 10:12:34.218141 <... read resumed> "", 1024) = 0
[pid 25425] 10:12:34.218164 mmap(0x7f380b37c000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25423] 10:12:34.218195 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25426] 10:12:34.218227 setregid(499, 499 <unfinished ...>
[pid 25425] 10:12:34.218250 <... mmap resumed> ) = 0x7f380b37c000
[pid 25426] 10:12:34.218273 <... setregid resumed> ) = 0
[pid 25425] 10:12:34.218299 mmap(0x7f380b381000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25429] 10:12:34.218333 <... write resumed> ) = 4
[pid 25426] 10:12:34.218346 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25425] 10:12:34.218633 <... mmap resumed> ) = 0x7f380b381000
[pid 25411] 10:12:34.218661 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25429] 10:12:34.218691 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.218719 close(6 <unfinished ...>
[pid 25411] 10:12:34.218746 read(14,  <unfinished ...>
[pid 25429] 10:12:34.218775 <... write resumed> ) = 4
[pid 25426] 10:12:34.218788 <... execve resumed> ) = 0
[pid 25425] 10:12:34.218818 <... close resumed> ) = 0
[pid 25411] 10:12:34.218842 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25429] 10:12:34.218867 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25426] 10:12:34.218890 brk(0 <unfinished ...>
[pid 25425] 10:12:34.218911 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.218940 read(14,  <unfinished ...>
[pid 25429] 10:12:34.218968 <... write resumed> ) = 4
[pid 25426] 10:12:34.218981 <... brk resumed> ) = 0x1e66000
[pid 25425] 10:12:34.219000 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.219018 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25429] 10:12:34.219042 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25426] 10:12:34.219067 fcntl(0, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.219089 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.219119 read(14,  <unfinished ...>
[pid 25429] 10:12:34.219149 <... write resumed> ) = 40
[pid 25426] 10:12:34.219162 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.219179 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.219195 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25429] 10:12:34.219218 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25426] 10:12:34.219241 fcntl(1, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.219262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.219290 read(14,  <unfinished ...>
[pid 25429] 10:12:34.219318 <... write resumed> ) = 4
[pid 25426] 10:12:34.219330 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.219348 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.219475 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25429] 10:12:34.219501 close(15 <unfinished ...>
[pid 25426] 10:12:34.219524 fcntl(2, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.219546 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.219582 wait4(-1,  <unfinished ...>
[pid 25429] 10:12:34.219615 <... close resumed> ) = 0
[pid 25426] 10:12:34.219630 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.219661 <... open resumed> ) = 6
[pid 25429] 10:12:34.219683 exit_group(0) = ?
[pid 25426] 10:12:34.219696 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25425] 10:12:34.219892 read(6,  <unfinished ...>
[pid 25429] 10:12:34.219931 +++ exited with 0 +++
[pid 25426] 10:12:34.219943 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.219973 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.220000 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25429
[pid 25426] 10:12:34.220024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.220051 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.220074 close(14 <unfinished ...>
[pid 25426] 10:12:34.220104 <... mmap resumed> ) = 0x7fcf4086d000
[pid 25425] 10:12:34.220133 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25411] 10:12:34.220172 <... close resumed> ) = 0
[pid 25426] 10:12:34.220194 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25425] 10:12:34.220221 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.220249 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25426] 10:12:34.220281 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.220305 <... mmap resumed> ) = 0x7f380ad86000
[pid 25411] 10:12:34.220322 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25426] 10:12:34.220439 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.220478 mprotect(0x7f380ade8000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.220506 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.220537 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.220554 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.220569 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.220614 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.220644 mmap(0x7f380afe7000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25411] 10:12:34.220674 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.220706 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.220723 <... mmap resumed> ) = 0x7f380afe7000
[pid 25411] 10:12:34.220748 <... open resumed> ) = 9
[pid 25426] 10:12:34.220771 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.220800 close(6 <unfinished ...>
[pid 25411] 10:12:34.220821 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.220848 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.220864 <... close resumed> ) = 0
[pid 25411] 10:12:34.220889 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.220926 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25425] 10:12:34.220955 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.220983 fstat(9,  <unfinished ...>
[pid 25426] 10:12:34.221009 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221026 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.221042 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.221073 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.221100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.221130 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.221160 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221176 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.221193 <... mmap resumed> ) = 0x7f81692a0000
[pid 25426] 10:12:34.221214 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.221245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.221274 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.221301 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221318 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.221335 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.221360 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.221395 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.221426 read(9,  <unfinished ...>
[pid 25426] 10:12:34.221456 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221473 <... open resumed> ) = 6
[pid 25411] 10:12:34.221488 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25426] 10:12:34.221528 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25425] 10:12:34.221558 read(6,  <unfinished ...>
[pid 25411] 10:12:34.221581 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.221610 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25425] 10:12:34.221637 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.221659 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.221698 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.221734 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.221759 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.221788 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221804 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25411] 10:12:34.221829 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.221879 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.221897 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.221911 stat("/home/finest09/etc/finestweddingsites.com/phoenixmarriottmesa/filter",  <unfinished ...>
[pid 25426] 10:12:34.221931 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.221940 <... mmap resumed> ) = 0x7f380a9a3000
[pid 25411] 10:12:34.221948 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.221964 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.221980 mprotect(0x7f380ab5c000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.221992 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.222008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222017 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.222024 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.222055 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25425] 10:12:34.222070 mmap(0x7f380ad5b000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25411] 10:12:34.222085 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.222103 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222112 <... mmap resumed> ) = 0x7f380ad5b000
[pid 25411] 10:12:34.222124 <... open resumed> ) = 10
[pid 25426] 10:12:34.222137 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.222152 mmap(0x7f380ad82000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.222164 fstat(10,  <unfinished ...>
[pid 25426] 10:12:34.222177 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222185 <... mmap resumed> ) = 0x7f380ad82000
[pid 25411] 10:12:34.222198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.222223 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.222238 close(6 <unfinished ...>
[pid 25411] 10:12:34.222246 fstat(10,  <unfinished ...>
[pid 25426] 10:12:34.222258 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222267 <... close resumed> ) = 0
[pid 25411] 10:12:34.222282 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.222303 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.222318 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.222331 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.222347 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.222619 <... mmap resumed> ) = 0x7f816929f000
[pid 25426] 10:12:34.222640 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25425] 10:12:34.222670 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.222700 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.222727 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.222759 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.222776 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.222797 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.222826 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.222853 read(10,  <unfinished ...>
[pid 25426] 10:12:34.222884 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.222900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.222918 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25426] 10:12:34.222947 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.222974 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.223004 read(10,  <unfinished ...>
[pid 25426] 10:12:34.223031 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223048 <... open resumed> ) = 6
[pid 25411] 10:12:34.223063 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.223100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.223133 read(6,  <unfinished ...>
[pid 25411] 10:12:34.223155 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.223187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223203 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.223225 <... open resumed> ) = 11
[pid 25426] 10:12:34.223327 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25425] 10:12:34.223369 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.223392 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.223419 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223437 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25411] 10:12:34.223471 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.223502 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.223531 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.223557 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.223586 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223602 <... mmap resumed> ) = 0x7f380d416000
[pid 25411] 10:12:34.223621 <... mmap resumed> ) = 0x7f816929e000
[pid 25426] 10:12:34.223642 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25425] 10:12:34.223674 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.223702 read(11,  <unfinished ...>
[pid 25426] 10:12:34.223732 <... stat resumed> 0x7ffef3fc0310) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223749 <... mmap resumed> ) = 0x7f380a776000
[pid 25411] 10:12:34.223764 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.223799 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.223828 mprotect(0x7f380a7a2000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.223860 close(11 <unfinished ...>
[pid 25426] 10:12:34.223895 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.223912 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.223928 <... close resumed> ) = 0
[pid 25426] 10:12:34.223947 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25425] 10:12:34.223973 mmap(0x7f380a9a2000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25411] 10:12:34.224001 munmap(0x7f816929e000, 4096 <unfinished ...>
[pid 25426] 10:12:34.224031 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.224061 <... mmap resumed> ) = 0x7f380a9a2000
[pid 25411] 10:12:34.224082 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.224115 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.224146 close(6 <unfinished ...>
[pid 25411] 10:12:34.224167 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.224196 <... open resumed> ) = 6
[pid 25425] 10:12:34.224211 <... close resumed> ) = 0
[pid 25411] 10:12:34.224233 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.224279 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.224304 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.224336 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25426] 10:12:34.224474 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25425] 10:12:34.224506 <... open resumed> ) = 6
[pid 25411] 10:12:34.224522 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25426] 10:12:34.224564 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.224596 read(6,  <unfinished ...>
[pid 25411] 10:12:34.224625 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25426] 10:12:34.224659 <... mmap resumed> ) = 0x7fcf40863000
[pid 25425] 10:12:34.224675 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.224702 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.224756 close(6 <unfinished ...>
[pid 25425] 10:12:34.224783 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.224805 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.224838 <... close resumed> ) = 0
[pid 25425] 10:12:34.224861 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25411] 10:12:34.224890 <... open resumed> ) = 11
[pid 25426] 10:12:34.224911 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.224941 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.224970 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.224997 <... open resumed> ) = 6
[pid 25425] 10:12:34.225012 <... mmap resumed> ) = 0x7f380a571000
[pid 25411] 10:12:34.225028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.225062 read(6,  <unfinished ...>
[pid 25425] 10:12:34.225085 mprotect(0x7f380a576000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.225111 fstat(11,  <unfinished ...>
[pid 25426] 10:12:34.225137 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.225160 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.225176 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.225207 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.225229 mmap(0x7f380a775000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25411] 10:12:34.225256 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.225286 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.225314 <... mmap resumed> ) = 0x7f380a775000
[pid 25411] 10:12:34.225334 <... mmap resumed> ) = 0x7f816929e000
[pid 25426] 10:12:34.225359 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.225386 close(6 <unfinished ...>
[pid 25411] 10:12:34.225408 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.225434 <... mmap resumed> ) = 0x7fcf40435000
[pid 25425] 10:12:34.225451 <... close resumed> ) = 0
[pid 25411] 10:12:34.225478 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.225500 mprotect(0x7fcf4044b000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.225526 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.225559 read(11,  <unfinished ...>
[pid 25426] 10:12:34.225590 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.225605 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.225622 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25426] 10:12:34.225650 mmap(0x7fcf4064b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25425] 10:12:34.225666 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.225682 read(11,  <unfinished ...>
[pid 25426] 10:12:34.225695 <... mmap resumed> ) = 0x7fcf4064b000
[pid 25425] 10:12:34.225707 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.225716 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.225740 mmap(0x7fcf4064d000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.225754 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.225769 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.225784 <... mmap resumed> ) = 0x7fcf4064d000
[pid 25425] 10:12:34.225798 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.225808 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.225838 close(6 <unfinished ...>
[pid 25425] 10:12:34.225847 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.225860 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25426] 10:12:34.225877 <... close resumed> ) = 0
[pid 25425] 10:12:34.225891 <... open resumed> ) = 6
[pid 25411] 10:12:34.225899 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25426] 10:12:34.225931 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.225946 read(6,  <unfinished ...>
[pid 25411] 10:12:34.225955 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25426] 10:12:34.225971 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.225980 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.225992 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.226036 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.226054 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.226062 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.226077 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.226085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25411] 10:12:34.226104 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.226136 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.226151 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.226166 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25426] 10:12:34.226182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.226193 <... mmap resumed> ) = 0x7f380a36e000
[pid 25411] 10:12:34.226201 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.226238 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.226254 mprotect(0x7f380a370000, 2093056, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.226266 stat("/etc/userdomains",  <unfinished ...>
[pid 25426] 10:12:34.226281 <... open resumed> ) = 6
[pid 25425] 10:12:34.226288 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.226296 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.226323 read(6,  <unfinished ...>
[pid 25425] 10:12:34.226332 mmap(0x7f380a56f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25411] 10:12:34.226346 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.226642 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.226667 <... mmap resumed> ) = 0x7f380a56f000
[pid 25411] 10:12:34.226693 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.226789 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.226819 close(6 <unfinished ...>
[pid 25411] 10:12:34.226841 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.226869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.226898 <... close resumed> ) = 0
[pid 25411] 10:12:34.226922 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.226945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.226972 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.227006 read(10,  <unfinished ...>
[pid 25426] 10:12:34.227033 <... mmap resumed> ) = 0x7fcf40862000
[pid 25425] 10:12:34.227053 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.227071 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25426] 10:12:34.227101 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.227128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.227159 read(10,  <unfinished ...>
[pid 25426] 10:12:34.227185 <... mmap resumed> ) = 0x7fcf4021c000
[pid 25425] 10:12:34.227201 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.227217 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.227263 mprotect(0x7fcf40232000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.227294 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.227324 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.227361 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.227377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.227395 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25426] 10:12:34.227437 mmap(0x7fcf40431000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25425] 10:12:34.227471 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.227502 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.227534 <... mmap resumed> ) = 0x7fcf40431000
[pid 25425] 10:12:34.227554 <... open resumed> ) = 6
[pid 25411] 10:12:34.227570 <... open resumed> ) = 12
[pid 25426] 10:12:34.227590 mmap(0x7fcf40433000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.227617 read(6,  <unfinished ...>
[pid 25411] 10:12:34.227640 fstat(12,  <unfinished ...>
[pid 25426] 10:12:34.227666 <... mmap resumed> ) = 0x7fcf40433000
[pid 25425] 10:12:34.227686 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.227711 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25426] 10:12:34.227745 close(6 <unfinished ...>
[pid 25425] 10:12:34.227768 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.227790 fstat(12,  <unfinished ...>
[pid 25426] 10:12:34.227816 <... close resumed> ) = 0
[pid 25425] 10:12:34.227837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25411] 10:12:34.227865 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25426] 10:12:34.227892 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.227907 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.227919 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.227933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.227942 <... mmap resumed> ) = 0x7f380d415000
[pid 25411] 10:12:34.227952 <... mmap resumed> ) = 0x7f816929d000
[pid 25426] 10:12:34.227965 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.227980 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.227994 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.228007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.228015 <... mmap resumed> ) = 0x7f380a14b000
[pid 25411] 10:12:34.228023 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.228035 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.228049 mprotect(0x7f380a162000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.228061 read(12,  <unfinished ...>
[pid 25426] 10:12:34.228074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.228086 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.228094 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.228113 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.228128 mmap(0x7f380a362000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25411] 10:12:34.228142 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.228158 <... open resumed> ) = 6
[pid 25425] 10:12:34.228165 <... mmap resumed> ) = 0x7f380a362000
[pid 25411] 10:12:34.228181 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25426] 10:12:34.228217 read(6,  <unfinished ...>
[pid 25425] 10:12:34.228227 close(6 <unfinished ...>
[pid 25411] 10:12:34.228235 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.228252 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.228264 <... close resumed> ) = 0
[pid 25411] 10:12:34.228290 <... open resumed> ) = 13
[pid 25426] 10:12:34.228304 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.228312 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.228326 fstat(13,  <unfinished ...>
[pid 25426] 10:12:34.228339 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.228588 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.228607 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.228644 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.228672 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.228704 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.228733 <... mmap resumed> ) = 0x7fcf3ffe5000
[pid 25425] 10:12:34.228749 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.228765 <... mmap resumed> ) = 0x7f816929c000
[pid 25426] 10:12:34.228786 mprotect(0x7fcf3ffec000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.228811 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.228839 read(13,  <unfinished ...>
[pid 25426] 10:12:34.228869 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.228885 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.228902 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.228937 mmap(0x7fcf401ec000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25425] 10:12:34.228967 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.228998 close(13 <unfinished ...>
[pid 25426] 10:12:34.229026 <... mmap resumed> ) = 0x7fcf401ec000
[pid 25425] 10:12:34.229046 <... open resumed> ) = 6
[pid 25411] 10:12:34.229063 <... close resumed> ) = 0
[pid 25426] 10:12:34.229082 mmap(0x7fcf401ee000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.229110 read(6,  <unfinished ...>
[pid 25411] 10:12:34.229132 munmap(0x7f816929c000, 4096 <unfinished ...>
[pid 25426] 10:12:34.229163 <... mmap resumed> ) = 0x7fcf401ee000
[pid 25425] 10:12:34.229183 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.229208 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.229247 close(6 <unfinished ...>
[pid 25425] 10:12:34.229273 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.229295 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.229327 <... close resumed> ) = 0
[pid 25425] 10:12:34.229349 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:34.229385 <... open resumed> ) = 13
[pid 25426] 10:12:34.229407 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.229435 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.229466 fstat(13,  <unfinished ...>
[pid 25426] 10:12:34.229493 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.229509 <... mmap resumed> ) = 0x7f3809f07000
[pid 25411] 10:12:34.229525 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.229569 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.229606 mprotect(0x7f3809f48000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.229633 fstat(13,  <unfinished ...>
[pid 25426] 10:12:34.229659 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.229676 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.229691 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.229722 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.229751 mmap(0x7f380a148000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25411] 10:12:34.229779 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.229808 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.229826 <... mmap resumed> ) = 0x7f380a148000
[pid 25411] 10:12:34.229850 <... mmap resumed> ) = 0x7f816929c000
[pid 25426] 10:12:34.229874 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.229905 close(6 <unfinished ...>
[pid 25411] 10:12:34.229927 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.229954 <... open resumed> ) = 6
[pid 25425] 10:12:34.229970 <... close resumed> ) = 0
[pid 25411] 10:12:34.229991 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.230005 read(6,  <unfinished ...>
[pid 25425] 10:12:34.230014 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.230029 read(13,  <unfinished ...>
[pid 25426] 10:12:34.230045 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.230057 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.230065 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25426] 10:12:34.230083 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.230092 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.230107 read(13,  <unfinished ...>
[pid 25426] 10:12:34.230120 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.230139 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.230147 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.230169 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.230183 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.230197 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25426] 10:12:34.230215 <... mmap resumed> ) = 0x7fcf3fd61000
[pid 25425] 10:12:34.230224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.230233 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25426] 10:12:34.230262 mprotect(0x7fcf3fde4000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.230275 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.230290 stat("/usr/local/cpanel/3rdparty/mailman/lists/rivankovich_phoenixmarriottmesa.com/config.pck",  <unfinished ...>
[pid 25426] 10:12:34.230310 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.230318 <... open resumed> ) = 6
[pid 25411] 10:12:34.230325 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.230348 mmap(0x7fcf3ffe3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25425] 10:12:34.230611 read(6,  <unfinished ...>
[pid 25411] 10:12:34.230641 stat("/etc/demouids",  <unfinished ...>
[pid 25426] 10:12:34.230677 <... mmap resumed> ) = 0x7fcf3ffe3000
[pid 25425] 10:12:34.230703 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.230728 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.230773 close(6 <unfinished ...>
[pid 25425] 10:12:34.230798 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.230820 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.230852 <... close resumed> ) = 0
[pid 25425] 10:12:34.230874 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:34.230904 <... open resumed> ) = 14
[pid 25426] 10:12:34.230925 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.230954 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.230980 fstat(14,  <unfinished ...>
[pid 25426] 10:12:34.231007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.231023 <... mmap resumed> ) = 0x7f380d414000
[pid 25411] 10:12:34.231042 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.231077 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.231108 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.231136 fstat(14,  <unfinished ...>
[pid 25426] 10:12:34.231162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.231179 <... mmap resumed> ) = 0x7f3809c20000
[pid 25411] 10:12:34.231195 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.231231 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.231260 mprotect(0x7f3809cfb000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.231286 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.231315 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.231333 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.231349 <... mmap resumed> ) = 0x7f816929b000
[pid 25426] 10:12:34.231374 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.231404 mmap(0x7f3809efb000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25411] 10:12:34.231433 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.231461 <... open resumed> ) = 6
[pid 25425] 10:12:34.231476 <... mmap resumed> ) = 0x7f3809efb000
[pid 25411] 10:12:34.231500 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.231523 read(6,  <unfinished ...>
[pid 25425] 10:12:34.231546 close(6 <unfinished ...>
[pid 25411] 10:12:34.231568 read(14,  <unfinished ...>
[pid 25426] 10:12:34.231603 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.231630 <... close resumed> ) = 0
[pid 25411] 10:12:34.231657 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.231688 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.231713 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.231752 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25426] 10:12:34.231785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25425] 10:12:34.231813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.231830 <... select resumed> ) = 1 (in [11], left {299, 986476})
[pid 25411] 10:12:34.231849 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25426] 10:12:34.231989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.232023 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.232052 recvfrom(11,  <unfinished ...>
[pid 25411] 10:12:34.232064 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.232083 <... mmap resumed> ) = 0x7fcf40861000
[pid 25425] 10:12:34.232095 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.232105 <... recvfrom resumed> "220 2.0.0 Ready to start TLS\r\n", 4096, 0, NULL, NULL) = 30
[pid 25411] 10:12:34.234175 <... open resumed> ) = 15
[pid 25426] 10:12:34.234215 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.234248 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.234286 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25411] 10:12:34.234319 fstat(15,  <unfinished ...>
[pid 25426] 10:12:34.234353 <... mmap resumed> ) = 0x7fcf3fb53000
[pid 25425] 10:12:34.234370 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.234389 <... open resumed> ) = 14
[pid 25411] 10:12:34.234409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.234447 mprotect(0x7fcf3fb5f000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.234476 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.234507 fstat(14,  <unfinished ...>
[pid 25411] 10:12:34.234529 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.234560 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.234576 <... open resumed> ) = 6
[pid 25423] 10:12:34.234591 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25411] 10:12:34.234624 <... mmap resumed> ) = 0x7f816929a000
[pid 25426] 10:12:34.234647 mmap(0x7fcf3fd5f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25425] 10:12:34.234677 read(6,  <unfinished ...>
[pid 25423] 10:12:34.234700 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25411] 10:12:34.234725 read(15,  <unfinished ...>
[pid 25426] 10:12:34.234758 <... mmap resumed> ) = 0x7fcf3fd5f000
[pid 25425] 10:12:34.234783 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.234808 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25411] 10:12:34.234830 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.234862 close(6 <unfinished ...>
[pid 25425] 10:12:34.234885 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.234907 read(14,  <unfinished ...>
[pid 25411] 10:12:34.234934 close(15 <unfinished ...>
[pid 25426] 10:12:34.234964 <... close resumed> ) = 0
[pid 25425] 10:12:34.234986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25423] 10:12:34.235017 <... read resumed> "\224\241_\300\3651\276>97{i\0251\216\313\351\1\36\365F\322\207\261!\326\275\244\265\206=\\BD\372\237\362\3\233\220\347\336\225fCA \305", 48) = 48
[pid 25411] 10:12:34.235038 <... close resumed> ) = 0
[pid 25426] 10:12:34.235060 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.235092 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.235121 close(14 <unfinished ...>
[pid 25411] 10:12:34.235145 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25426] 10:12:34.235294 <... open resumed> ) = 6
[pid 25425] 10:12:34.235314 <... mmap resumed> ) = 0x7f3809a1c000
[pid 25423] 10:12:34.235336 <... close resumed> ) = 0
[pid 25411] 10:12:34.235387 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.235463 read(6,  <unfinished ...>
[pid 25425] 10:12:34.235494 mprotect(0x7f3809a1f000, 2093056, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.235521 getuid( <unfinished ...>
[pid 25411] 10:12:34.235542 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25426] 10:12:34.235575 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.235598 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.235614 <... getuid resumed> ) = 47
[pid 25411] 10:12:34.241209 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25426] 10:12:34.241280 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.241308 mmap(0x7f3809c1e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25423] 10:12:34.241338 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.241366 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.241400 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25425] 10:12:34.241431 <... mmap resumed> ) = 0x7f3809c1e000
[pid 25411] 10:12:34.241457 <... open resumed> ) = 15
[pid 25426] 10:12:34.241482 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.241510 close(6 <unfinished ...>
[pid 25411] 10:12:34.241532 fstat(15,  <unfinished ...>
[pid 25426] 10:12:34.241559 <... mmap resumed> ) = 0x7fcf3f930000
[pid 25425] 10:12:34.241574 <... close resumed> ) = 0
[pid 25411] 10:12:34.241599 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.241632 mprotect(0x7fcf3f951000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.241659 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.241689 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.241719 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.241735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.241752 <... mmap resumed> ) = 0x7f816929a000
[pid 25426] 10:12:34.241772 mmap(0x7fcf3fb51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25425] 10:12:34.241800 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.241831 read(15,  <unfinished ...>
[pid 25426] 10:12:34.241862 <... mmap resumed> ) = 0x7fcf3fb51000
[pid 25425] 10:12:34.241883 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.241901 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.241940 close(6 <unfinished ...>
[pid 25425] 10:12:34.241963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.241992 close(15 <unfinished ...>
[pid 25426] 10:12:34.242020 <... close resumed> ) = 0
[pid 25425] 10:12:34.242042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.242061 <... close resumed> ) = 0
[pid 25426] 10:12:34.242081 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.242109 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.242138 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25426] 10:12:34.242170 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.242187 <... open resumed> ) = 6
[pid 25411] 10:12:34.242202 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.242233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.242267 read(6,  <unfinished ...>
[pid 25411] 10:12:34.242291 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.242321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.242338 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25411] 10:12:34.242480 <... open resumed> ) = 15
[pid 25426] 10:12:34.242509 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.242542 fstat(6,  <unfinished ...>
[pid 25411] 10:12:34.242564 fstat(15,  <unfinished ...>
[pid 25426] 10:12:34.242590 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.242608 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25411] 10:12:34.242639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.242670 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.242700 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25411] 10:12:34.242729 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.242758 <... open resumed> ) = 6
[pid 25425] 10:12:34.242774 <... mmap resumed> ) = 0x7f38097f0000
[pid 25411] 10:12:34.242789 <... mmap resumed> ) = 0x7f816929a000
[pid 25426] 10:12:34.242809 read(6,  <unfinished ...>
[pid 25425] 10:12:34.242832 mprotect(0x7f3809819000, 2097152, PROT_NONE <unfinished ...>
[pid 25411] 10:12:34.242858 read(15,  <unfinished ...>
[pid 25426] 10:12:34.242888 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.242917 <... mprotect resumed> ) = 0
[pid 25411] 10:12:34.242933 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.242962 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.242985 mmap(0x7f3809a19000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25411] 10:12:34.243015 close(15 <unfinished ...>
[pid 25426] 10:12:34.243043 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.243075 <... mmap resumed> ) = 0x7f3809a19000
[pid 25411] 10:12:34.243096 <... close resumed> ) = 0
[pid 25426] 10:12:34.243117 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.243143 mmap(0x7f3809a1b000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.243170 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25426] 10:12:34.243199 <... mmap resumed> ) = 0x7fcf3f713000
[pid 25425] 10:12:34.243215 <... mmap resumed> ) = 0x7f3809a1b000
[pid 25411] 10:12:34.243236 <... munmap resumed> ) = 0
[pid 25426] 10:12:34.243368 mprotect(0x7fcf3f72a000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.243403 close(6 <unfinished ...>
[pid 25411] 10:12:34.243426 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.243460 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.243477 <... close resumed> ) = 0
[pid 25411] 10:12:34.243502 <... open resumed> ) = 15
[pid 25426] 10:12:34.243525 mmap(0x7fcf3f92a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25425] 10:12:34.243555 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.243584 fstat(15,  <unfinished ...>
[pid 25426] 10:12:34.243611 <... mmap resumed> ) = 0x7fcf3f92a000
[pid 25425] 10:12:34.243632 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.243650 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.243687 mmap(0x7fcf3f92c000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.243715 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.243746 fstat(15,  <unfinished ...>
[pid 25426] 10:12:34.243773 <... mmap resumed> ) = 0x7fcf3f92c000
[pid 25425] 10:12:34.243795 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.243813 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.243845 close(6 <unfinished ...>
[pid 25425] 10:12:34.243868 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.243898 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.243936 <... close resumed> ) = 0
[pid 25425] 10:12:34.243953 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.243964 <... mmap resumed> ) = 0x7f816929a000
[pid 25426] 10:12:34.243978 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.243993 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.244007 <... open resumed> ) = 14
[pid 25411] 10:12:34.244012 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.244038 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.244048 <... open resumed> ) = 6
[pid 25423] 10:12:34.244055 fstat(14,  <unfinished ...>
[pid 25411] 10:12:34.244061 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.244077 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.244093 read(6,  <unfinished ...>
[pid 25423] 10:12:34.244102 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.244118 read(15,  <unfinished ...>
[pid 25426] 10:12:34.244136 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.244145 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.244157 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.244164 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25426] 10:12:34.244185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.244199 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.244208 <... mmap resumed> ) = 0x7f54cb353000
[pid 25411] 10:12:34.244213 read(15,  <unfinished ...>
[pid 25426] 10:12:34.244229 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.244239 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.244257 read(14,  <unfinished ...>
[pid 25411] 10:12:34.244263 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.244560 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.244600 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.244627 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25411] 10:12:34.244646 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.244692 <... open resumed> ) = 6
[pid 25425] 10:12:34.244708 <... mmap resumed> ) = 0x7f380d413000
[pid 25423] 10:12:34.244727 read(14,  <unfinished ...>
[pid 25411] 10:12:34.244750 <... lseek resumed> ) = 353
[pid 25426] 10:12:34.244776 read(6,  <unfinished ...>
[pid 25425] 10:12:34.244799 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.244828 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25411] 10:12:34.244851 read(9,  <unfinished ...>
[pid 25426] 10:12:34.244983 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.245008 <... mmap resumed> ) = 0x7f38095da000
[pid 25423] 10:12:34.245025 read(14,  <unfinished ...>
[pid 25411] 10:12:34.245047 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.245092 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.245119 mprotect(0x7f38095ef000, 2093056, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.245147 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25411] 10:12:34.245165 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.245207 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25425] 10:12:34.245237 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.245253 read(14,  <unfinished ...>
[pid 25411] 10:12:34.245275 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.245297 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.245323 mmap(0x7f38097ee000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25423] 10:12:34.245356 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25411] 10:12:34.245376 read(9,  <unfinished ...>
[pid 25426] 10:12:34.245474 <... mmap resumed> ) = 0x7fcf40860000
[pid 25425] 10:12:34.245495 <... mmap resumed> ) = 0x7f38097ee000
[pid 25423] 10:12:34.245520 read(14,  <unfinished ...>
[pid 25411] 10:12:34.245544 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25426] 10:12:34.245605 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.245637 close(6 <unfinished ...>
[pid 25423] 10:12:34.245659 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25411] 10:12:34.245677 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.245729 <... mmap resumed> ) = 0x7fcf3f39f000
[pid 25425] 10:12:34.245745 <... close resumed> ) = 0
[pid 25423] 10:12:34.245781 read(14,  <unfinished ...>
[pid 25411] 10:12:34.245805 <... stat resumed> 0x7f816793e880) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.245842 mprotect(0x7fcf3f50e000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.245873 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.245909 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25411] 10:12:34.245926 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25426] 10:12:34.246021 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.246037 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.246051 read(14,  <unfinished ...>
[pid 25411] 10:12:34.246057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.246110 mmap(0x7fcf3f70d000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25425] 10:12:34.246128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.246145 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25411] 10:12:34.246152 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.246234 <... mmap resumed> ) = 0x7fcf3f70d000
[pid 25425] 10:12:34.246257 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.246267 read(14,  <unfinished ...>
[pid 25411] 10:12:34.246272 <... open resumed> ) = 16
[pid 25426] 10:12:34.246295 close(6 <unfinished ...>
[pid 25425] 10:12:34.246304 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.246319 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25411] 10:12:34.246326 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25426] 10:12:34.246583 <... close resumed> ) = 0
[pid 25425] 10:12:34.246610 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.246631 read(14,  <unfinished ...>
[pid 25411] 10:12:34.246654 <... ioctl resumed> , 0x7ffdf4a50ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.246678 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.246708 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.246737 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25411] 10:12:34.246755 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25426] 10:12:34.246796 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.246813 <... open resumed> ) = 6
[pid 25423] 10:12:34.246828 read(14,  <unfinished ...>
[pid 25411] 10:12:34.246850 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.246873 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.246904 read(6,  <unfinished ...>
[pid 25423] 10:12:34.246927 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25411] 10:12:34.246949 fstat(16,  <unfinished ...>
[pid 25426] 10:12:34.247037 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.247055 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.247078 read(14,  <unfinished ...>
[pid 25411] 10:12:34.247100 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25426] 10:12:34.247135 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.247165 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.247187 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25411] 10:12:34.247203 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.247289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.247310 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25423] 10:12:34.247449 read(14,  <unfinished ...>
[pid 25411] 10:12:34.247482 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.247507 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.247541 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.247571 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25411] 10:12:34.247589 fstat(16,  <unfinished ...>
[pid 25426] 10:12:34.247678 <... open resumed> ) = 6
[pid 25425] 10:12:34.247695 <... mmap resumed> ) = 0x7f38093cf000
[pid 25423] 10:12:34.247711 read(14,  <unfinished ...>
[pid 25411] 10:12:34.247734 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25426] 10:12:34.247786 read(6,  <unfinished ...>
[pid 25425] 10:12:34.247813 mprotect(0x7f38093d9000, 2093056, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.247840 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25411] 10:12:34.247858 read(16,  <unfinished ...>
[pid 25426] 10:12:34.247936 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.247966 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.247983 read(14,  <unfinished ...>
[pid 25411] 10:12:34.248005 <... read resumed> "0", 8192) = 1
[pid 25426] 10:12:34.248029 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.248052 mmap(0x7f38095d8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25423] 10:12:34.248081 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25411] 10:12:34.248099 read(16,  <unfinished ...>
[pid 25426] 10:12:34.248175 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25425] 10:12:34.248206 <... mmap resumed> ) = 0x7f38095d8000
[pid 25423] 10:12:34.248232 read(14,  <unfinished ...>
[pid 25411] 10:12:34.248256 <... read resumed> "", 8192) = 0
[pid 25426] 10:12:34.248283 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.248312 close(6 <unfinished ...>
[pid 25423] 10:12:34.248334 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25411] 10:12:34.248356 close(16 <unfinished ...>
[pid 25426] 10:12:34.248399 <... mmap resumed> ) = 0x7fcf3f110000
[pid 25425] 10:12:34.248415 <... close resumed> ) = 0
[pid 25423] 10:12:34.248441 read(14,  <unfinished ...>
[pid 25411] 10:12:34.248466 <... close resumed> ) = 0
[pid 25426] 10:12:34.248551 mprotect(0x7fcf3f19b000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.248586 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.248617 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25411] 10:12:34.248634 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.248755 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.248772 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.248789 read(14,  <unfinished ...>
[pid 25411] 10:12:34.248811 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25426] 10:12:34.248865 mmap(0x7fcf3f39b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25425] 10:12:34.248900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.248933 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25411] 10:12:34.248948 stat("/etc/localtime",  <unfinished ...>
[pid 25426] 10:12:34.249017 <... mmap resumed> ) = 0x7fcf3f39b000
[pid 25425] 10:12:34.249032 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.249041 read(14,  <unfinished ...>
[pid 25411] 10:12:34.249047 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.249086 mmap(0x7fcf3f39e000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.249101 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.249117 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25411] 10:12:34.249125 stat("/etc/localtime",  <unfinished ...>
[pid 25426] 10:12:34.249154 <... mmap resumed> ) = 0x7fcf3f39e000
[pid 25425] 10:12:34.249168 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.249178 read(14,  <unfinished ...>
[pid 25411] 10:12:34.249184 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.249214 close(6 <unfinished ...>
[pid 25425] 10:12:34.249223 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.249238 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25411] 10:12:34.249246 close(7 <unfinished ...>
[pid 25426] 10:12:34.249311 <... close resumed> ) = 0
[pid 25425] 10:12:34.249332 <... open resumed> ) = 6
[pid 25423] 10:12:34.249340 read(14,  <unfinished ...>
[pid 25411] 10:12:34.249346 <... close resumed> ) = 0
[pid 25426] 10:12:34.249582 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.249620 read(6,  <unfinished ...>
[pid 25423] 10:12:34.249644 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25411] 10:12:34.249662 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25426] 10:12:34.249760 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.249778 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.249802 read(14,  <unfinished ...>
[pid 25411] 10:12:34.249824 <... open resumed> ) = 7
[pid 25426] 10:12:34.249846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.249877 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.249904 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25411] 10:12:34.249922 fcntl(7, F_GETFD <unfinished ...>
[pid 25426] 10:12:34.250007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.250025 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.250056 read(14,  <unfinished ...>
[pid 25411] 10:12:34.250078 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.250100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.250129 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.250161 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25411] 10:12:34.250178 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.250257 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.250277 <... mmap resumed> ) = 0x7f38091cc000
[pid 25423] 10:12:34.250294 read(14,  <unfinished ...>
[pid 25411] 10:12:34.250316 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.250337 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.250373 mprotect(0x7f38091ce000, 2093056, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.250402 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25411] 10:12:34.250420 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.250458 <... open resumed> ) = 6
[pid 25425] 10:12:34.250474 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.250489 read(14,  <unfinished ...>
[pid 25411] 10:12:34.250511 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5364943, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.250545 read(6,  <unfinished ...>
[pid 25425] 10:12:34.250567 mmap(0x7f38093cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25423] 10:12:34.250597 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25411] 10:12:34.250614 write(7, "2015-12-30 10:12:34 [25411] 1aEJMX-0006bl-RX SMTP connection outbound 1451491954 1aEJMX-0006bl-RX finestweddingsites.com rivankovich@phoenixmarriottmesa.com\n", 157 <unfinished ...>
[pid 25426] 10:12:34.250706 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.250735 <... mmap resumed> ) = 0x7f38093cd000
[pid 25423] 10:12:34.250761 read(14,  <unfinished ...>
[pid 25411] 10:12:34.250785 <... write resumed> ) = 157
[pid 25426] 10:12:34.250857 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.250885 close(6 <unfinished ...>
[pid 25423] 10:12:34.250907 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25411] 10:12:34.250924 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25426] 10:12:34.251018 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25425] 10:12:34.251046 <... close resumed> ) = 0
[pid 25423] 10:12:34.251062 read(14,  <unfinished ...>
[pid 25411] 10:12:34.251069 <... open resumed> ) = 16
[pid 25426] 10:12:34.251091 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.251106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.251118 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25411] 10:12:34.251125 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25426] 10:12:34.251150 <... mmap resumed> ) = 0x7fcf3ef0a000
[pid 25425] 10:12:34.251159 <... mmap resumed> ) = 0x7f380d412000
[pid 25423] 10:12:34.251182 read(14,  <unfinished ...>
[pid 25411] 10:12:34.251188 <... lseek resumed> ) = 2
[pid 25426] 10:12:34.251205 mprotect(0x7fcf3ef10000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.251218 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.251233 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25411] 10:12:34.251240 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25426] 10:12:34.251308 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.251317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.251332 read(14,  <unfinished ...>
[pid 25411] 10:12:34.251338 <... ioctl resumed> , 0x7ffdf4a50ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.251553 mmap(0x7fcf3f10f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25425] 10:12:34.251591 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.251624 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25411] 10:12:34.251642 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25426] 10:12:34.251731 <... mmap resumed> ) = 0x7fcf3f10f000
[pid 25425] 10:12:34.251754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.251772 read(14,  <unfinished ...>
[pid 25411] 10:12:34.251794 <... lseek resumed> ) = 2
[pid 25426] 10:12:34.251821 close(6 <unfinished ...>
[pid 25425] 10:12:34.251848 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.251884 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25411] 10:12:34.251901 fstat(16,  <unfinished ...>
[pid 25426] 10:12:34.251942 <... close resumed> ) = 0
[pid 25425] 10:12:34.251964 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.251984 read(14,  <unfinished ...>
[pid 25411] 10:12:34.252006 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.252041 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.252069 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.252097 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25411] 10:12:34.252114 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.252203 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.252221 <... open resumed> ) = 6
[pid 25423] 10:12:34.252236 read(14,  <unfinished ...>
[pid 25411] 10:12:34.252258 <... fcntl resumed> ) = 0
[pid 25426] 10:12:34.252293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.252327 read(6,  <unfinished ...>
[pid 25423] 10:12:34.252445 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25411] 10:12:34.252477 write(16, "1", 1 <unfinished ...>
[pid 25426] 10:12:34.252623 <... open resumed> ) = 6
[pid 25425] 10:12:34.252650 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.252688 read(14,  <unfinished ...>
[pid 25411] 10:12:34.252714 <... write resumed> ) = 1
[pid 25426] 10:12:34.252737 read(6,  <unfinished ...>
[pid 25425] 10:12:34.252760 fstat(6,  <unfinished ...>
[pid 25423] 10:12:34.252782 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25411] 10:12:34.252800 close(16 <unfinished ...>
[pid 25426] 10:12:34.252840 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.252869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.252901 read(14,  <unfinished ...>
[pid 25411] 10:12:34.252924 <... close resumed> ) = 0
[pid 25426] 10:12:34.252972 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.252999 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25423] 10:12:34.253031 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25411] 10:12:34.253049 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25426] 10:12:34.253145 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.253176 <... mmap resumed> ) = 0x7f3808fad000
[pid 25423] 10:12:34.253193 read(14,  <unfinished ...>
[pid 25411] 10:12:34.253215 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.253245 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.253274 mprotect(0x7f3808fca000, 2093056, PROT_NONE <unfinished ...>
[pid 25423] 10:12:34.253302 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25411] 10:12:34.253320 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25428] 10:12:34.253532 <... connect resumed> ) = 0
[pid 25426] 10:12:34.253552 <... mmap resumed> ) = 0x7fcf4085f000
[pid 25425] 10:12:34.253573 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.253589 read(14,  <unfinished ...>
[pid 25411] 10:12:34.253611 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.253671 alarm(0 <unfinished ...>
[pid 25426] 10:12:34.253699 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.253726 mmap(0x7f38091c9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25423] 10:12:34.253756 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25411] 10:12:34.253775 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.253880 <... alarm resumed> ) = 300
[pid 25426] 10:12:34.253907 <... mmap resumed> ) = 0x7fcf3ebd4000
[pid 25425] 10:12:34.253924 <... mmap resumed> ) = 0x7f38091c9000
[pid 25423] 10:12:34.253945 read(14,  <unfinished ...>
[pid 25411] 10:12:34.253968 <... open resumed> ) = 16
[pid 25428] 10:12:34.253992 getsockname(11,  <unfinished ...>
[pid 25426] 10:12:34.254016 mprotect(0x7fcf3ed00000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.254043 mmap(0x7f38091cb000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.254070 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25411] 10:12:34.254095 fstat(16,  <unfinished ...>
[pid 25428] 10:12:34.254189 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(46765), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25426] 10:12:34.254223 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.254240 <... mmap resumed> ) = 0x7f38091cb000
[pid 25423] 10:12:34.254263 read(14,  <unfinished ...>
[pid 25411] 10:12:34.254288 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25428] 10:12:34.254324 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25426] 10:12:34.254354 mmap(0x7fcf3ef00000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25425] 10:12:34.254386 close(6 <unfinished ...>
[pid 25423] 10:12:34.254408 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25411] 10:12:34.254426 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.254470 <... setsockopt resumed> ) = 0
[pid 25426] 10:12:34.254491 <... mmap resumed> ) = 0x7fcf3ef00000
[pid 25425] 10:12:34.254513 <... close resumed> ) = 0
[pid 25423] 10:12:34.254568 read(14,  <unfinished ...>
[pid 25411] 10:12:34.254592 <... mmap resumed> ) = 0x7f8169299000
[pid 25428] 10:12:34.254616 stat("/etc/mailhelo",  <unfinished ...>
[pid 25426] 10:12:34.254643 mmap(0x7fcf3ef09000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.254670 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.254697 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25411] 10:12:34.254714 read(16,  <unfinished ...>
[pid 25428] 10:12:34.254819 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.254861 <... mmap resumed> ) = 0x7fcf3ef09000
[pid 25425] 10:12:34.254885 <... mmap resumed> ) = 0x7f380d411000
[pid 25423] 10:12:34.254945 read(14,  <unfinished ...>
[pid 25411] 10:12:34.254969 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25428] 10:12:34.255002 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.255031 close(6 <unfinished ...>
[pid 25425] 10:12:34.255053 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.255078 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25411] 10:12:34.255095 read(16,  <unfinished ...>
[pid 25428] 10:12:34.255194 <... open resumed> ) = 13
[pid 25426] 10:12:34.255212 <... close resumed> ) = 0
[pid 25425] 10:12:34.255234 <... mmap resumed> ) = 0x7f380d410000
[pid 25423] 10:12:34.255258 read(14,  <unfinished ...>
[pid 25411] 10:12:34.255264 <... read resumed> "", 4096) = 0
[pid 25428] 10:12:34.255284 fstat(13,  <unfinished ...>
[pid 25426] 10:12:34.255293 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.255307 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.255318 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25411] 10:12:34.255326 close(16 <unfinished ...>
[pid 25428] 10:12:34.255590 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.255627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.255645 <... mmap resumed> ) = 0x7f380d40e000
[pid 25423] 10:12:34.255667 read(14,  <unfinished ...>
[pid 25411] 10:12:34.255690 <... close resumed> ) = 0
[pid 25428] 10:12:34.255713 fstat(13,  <unfinished ...>
[pid 25426] 10:12:34.255735 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.255766 arch_prctl(ARCH_SET_FS, 0x7f380d40e7c0 <unfinished ...>
[pid 25423] 10:12:34.255789 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25411] 10:12:34.255806 munmap(0x7f8169299000, 4096 <unfinished ...>
[pid 25428] 10:12:34.255855 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25426] 10:12:34.255884 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.255900 <... arch_prctl resumed> ) = 0
[pid 25423] 10:12:34.255963 read(14,  <unfinished ...>
[pid 25411] 10:12:34.255986 <... munmap resumed> ) = 0
[pid 25428] 10:12:34.256010 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.256037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.256139 mprotect(0x7f38091c9000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.256173 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25411] 10:12:34.256192 uname( <unfinished ...>
[pid 25428] 10:12:34.256280 <... mmap resumed> ) = 0x7fb3682b8000
[pid 25426] 10:12:34.256298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.256317 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.256339 read(14,  <unfinished ...>
[pid 25411] 10:12:34.256413 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25428] 10:12:34.256516 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.256545 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.256577 mprotect(0x7f38093cd000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.256603 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25411] 10:12:34.256627 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25428] 10:12:34.256732 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.256751 <... open resumed> ) = 6
[pid 25425] 10:12:34.256767 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.256801 read(14,  <unfinished ...>
[pid 25411] 10:12:34.256825 <... socket resumed> ) = 16
[pid 25428] 10:12:34.256859 read(13,  <unfinished ...>
[pid 25426] 10:12:34.256889 read(6,  <unfinished ...>
[pid 25425] 10:12:34.256912 mprotect(0x7f38095d8000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.256938 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25411] 10:12:34.256956 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25428] 10:12:34.257051 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.257084 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.257111 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.257137 read(14,  <unfinished ...>
[pid 25411] 10:12:34.257160 <... connect resumed> ) = 0
[pid 25428] 10:12:34.257188 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.257212 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.257233 mprotect(0x7f38097ee000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.257260 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25411] 10:12:34.257278 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25428] 10:12:34.257368 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.257387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.257420 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.257453 read(14,  <unfinished ...>
[pid 25411] 10:12:34.257476 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25428] 10:12:34.257503 read(13,  <unfinished ...>
[pid 25426] 10:12:34.257526 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.257555 mprotect(0x7f3809a19000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.257581 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25411] 10:12:34.257599 sendto(16, "\273\362\1\0\0\1\0\0\0\0\0\0\23phoenixmarriottmesa\3com\0\0\17\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25428] 10:12:34.257727 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.257799 <... mmap resumed> ) = 0x7fcf3e9d0000
[pid 25425] 10:12:34.257828 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.257856 read(14,  <unfinished ...>
[pid 25411] 10:12:34.257880 <... sendto resumed> ) = 41
[pid 25428] 10:12:34.257904 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.257927 mprotect(0x7fcf3e9d2000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.257954 mprotect(0x7f3809c1e000, 4096, PROT_READ <unfinished ...>
[pid 25423] 10:12:34.257979 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25411] 10:12:34.257998 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25428] 10:12:34.258042 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.258058 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.258074 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.258212 read(14,  <unfinished ...>
[pid 25428] 10:12:34.258242 read(13,  <unfinished ...>
[pid 25426] 10:12:34.258265 mmap(0x7fcf3ebd2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25425] 10:12:34.258294 mprotect(0x7f3809efb000, 40960, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.258331 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.258481 <... mmap resumed> ) = 0x7fcf3ebd2000
[pid 25425] 10:12:34.258515 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.258632 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25428] 10:12:34.258658 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25426] 10:12:34.258698 close(6 <unfinished ...>
[pid 25425] 10:12:34.258721 mprotect(0x7f380a148000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.258752 <... lseek resumed> ) = 0
[pid 25426] 10:12:34.258769 <... close resumed> ) = 0
[pid 25425] 10:12:34.258791 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.258823 read(14,  <unfinished ...>
[pid 25428] 10:12:34.258851 read(13,  <unfinished ...>
[pid 25426] 10:12:34.258873 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.258904 mprotect(0x7f380a362000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.258935 <... read resumed> "", 4096) = 0
[pid 25426] 10:12:34.258969 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.258988 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.259008 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25428] 10:12:34.259031 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25426] 10:12:34.259142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.259177 mprotect(0x7f380a56f000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.259209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.259226 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.259461 read(14,  <unfinished ...>
[pid 25426] 10:12:34.259490 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.259520 mprotect(0x7f380ad5b000, 110592, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.259551 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.259569 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.259656 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25426] 10:12:34.259686 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.259781 mprotect(0x7f380afe7000, 16384, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.259814 <... open resumed> ) = 6
[pid 25425] 10:12:34.259829 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.259941 read(14,  <unfinished ...>
[pid 25426] 10:12:34.259971 read(6,  <unfinished ...>
[pid 25425] 10:12:34.259994 mprotect(0x7f380b37c000, 16384, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.260024 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.260047 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.260067 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25426] 10:12:34.260088 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.260167 mprotect(0x7f380b587000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.260198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.260229 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.260254 read(14,  <unfinished ...>
[pid 25426] 10:12:34.260281 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.260310 mprotect(0x7f380b78b000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.260339 <... mmap resumed> ) = 0x7fcf3e7cd000
[pid 25425] 10:12:34.260501 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.261191 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25426] 10:12:34.261218 mprotect(0x7fcf3e7cf000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.261320 mprotect(0x7f380c4e3000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.261357 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.261374 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.261410 read(14,  <unfinished ...>
[pid 25426] 10:12:34.261437 mmap(0x7fcf3e9ce000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25425] 10:12:34.261466 mprotect(0x7f380c918000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.261497 <... mmap resumed> ) = 0x7fcf3e9ce000
[pid 25425] 10:12:34.261521 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.261544 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25426] 10:12:34.261566 close(6 <unfinished ...>
[pid 25425] 10:12:34.261653 mprotect(0x7f380cb9c000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.261688 <... close resumed> ) = 0
[pid 25425] 10:12:34.261710 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.261738 read(14,  <unfinished ...>
[pid 25426] 10:12:34.261764 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.261794 mprotect(0x7f380cda5000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.261824 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.261842 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.261873 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25426] 10:12:34.261895 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.261994 mprotect(0x7f380cfea000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.262026 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.262043 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.262066 read(14,  <unfinished ...>
[pid 25426] 10:12:34.262093 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.262122 mprotect(0x7f380d204000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.262152 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.262170 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.262210 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25426] 10:12:34.262233 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.262315 mprotect(0x7f380d427000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.262441 <... open resumed> ) = 6
[pid 25425] 10:12:34.262471 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.262490 read(14,  <unfinished ...>
[pid 25426] 10:12:34.262520 read(6,  <unfinished ...>
[pid 25425] 10:12:34.262543 munmap(0x7f380d41c000, 39387 <unfinished ...>
[pid 25426] 10:12:34.262577 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.262602 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.262619 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25426] 10:12:34.262640 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.262676 set_tid_address(0x7f380d40ea90 <unfinished ...>
[pid 25426] 10:12:34.262703 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:34.262733 <... set_tid_address resumed> ) = 25425
[pid 25423] 10:12:34.262748 read(14,  <unfinished ...>
[pid 25426] 10:12:34.262773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.262799 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25426] 10:12:34.262826 <... mmap resumed> ) = 0x7fcf4085e000
[pid 25425] 10:12:34.262845 <... set_robust_list resumed> ) = 0
[pid 25423] 10:12:34.262866 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25426] 10:12:34.262888 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.262975 futex(0x7fffbdaedfac, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25426] 10:12:34.263006 <... mmap resumed> ) = 0x7fcf3e439000
[pid 25425] 10:12:34.263021 <... futex resumed> ) = 0
[pid 25423] 10:12:34.263036 read(14,  <unfinished ...>
[pid 25426] 10:12:34.263061 mprotect(0x7fcf3e5c3000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.263109 futex(0x7fffbdaedfac, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f380d40e7c0 <unfinished ...>
[pid 25426] 10:12:34.263162 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.263179 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25423] 10:12:34.263201 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25426] 10:12:34.263224 mmap(0x7fcf3e7c3000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25425] 10:12:34.263312 rt_sigaction(SIGRTMIN, {0x7f380c2d1c60, [], SA_RESTORER|SA_SIGINFO, 0x7f380c2db790},  <unfinished ...>
[pid 25426] 10:12:34.263347 <... mmap resumed> ) = 0x7fcf3e7c3000
[pid 25425] 10:12:34.263372 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.263390 read(14,  <unfinished ...>
[pid 25426] 10:12:34.263416 mmap(0x7fcf3e7c8000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.263443 rt_sigaction(SIGRT_1, {0x7f380c2d1cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f380c2db790},  <unfinished ...>
[pid 25426] 10:12:34.263475 <... mmap resumed> ) = 0x7fcf3e7c8000
[pid 25425] 10:12:34.263496 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.263514 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25426] 10:12:34.263535 close(6 <unfinished ...>
[pid 25425] 10:12:34.263619 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25426] 10:12:34.263650 <... close resumed> ) = 0
[pid 25425] 10:12:34.263673 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25423] 10:12:34.263702 read(14,  <unfinished ...>
[pid 25426] 10:12:34.263728 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.263758 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25426] 10:12:34.263785 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.263802 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25423] 10:12:34.263858 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25426] 10:12:34.263881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.263958 statfs("/selinux",  <unfinished ...>
[pid 25426] 10:12:34.263994 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.264004 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350359, f_bavail=6350359, f_files=1000000, f_ffree=691122, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25423] 10:12:34.264066 brk(0x171b000 <unfinished ...>
[pid 25426] 10:12:34.264077 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.264095 brk(0 <unfinished ...>
[pid 25426] 10:12:34.264108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.264119 <... brk resumed> ) = 0x2378000
[pid 25423] 10:12:34.264127 <... brk resumed> ) = 0x171b000
[pid 25426] 10:12:34.264135 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.264168 brk(0x2399000 <unfinished ...>
[pid 25426] 10:12:34.264182 <... open resumed> ) = 6
[pid 25425] 10:12:34.264190 <... brk resumed> ) = 0x2399000
[pid 25423] 10:12:34.264211 read(14,  <unfinished ...>
[pid 25426] 10:12:34.264220 read(6,  <unfinished ...>
[pid 25425] 10:12:34.264231 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.264257 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.264270 <... open resumed> ) = 6
[pid 25423] 10:12:34.264289 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25426] 10:12:34.264300 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.264606 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.264638 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25425] 10:12:34.264670 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.264700 read(14,  <unfinished ...>
[pid 25426] 10:12:34.264726 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.264755 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.264785 <... mmap resumed> ) = 0x7fcf3e1cd000
[pid 25425] 10:12:34.264800 <... mmap resumed> ) = 0x7f380d425000
[pid 25423] 10:12:34.264816 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25426] 10:12:34.264838 mprotect(0x7fcf3e22f000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.264931 read(6,  <unfinished ...>
[pid 25426] 10:12:34.265026 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.265043 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25423] 10:12:34.265072 read(14,  <unfinished ...>
[pid 25426] 10:12:34.265099 mmap(0x7fcf3e42e000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25425] 10:12:34.265129 read(6,  <unfinished ...>
[pid 25426] 10:12:34.265161 <... mmap resumed> ) = 0x7fcf3e42e000
[pid 25425] 10:12:34.265186 <... read resumed> "", 1024) = 0
[pid 25423] 10:12:34.265212 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25426] 10:12:34.265234 close(6 <unfinished ...>
[pid 25425] 10:12:34.265315 close(6 <unfinished ...>
[pid 25426] 10:12:34.265347 <... close resumed> ) = 0
[pid 25425] 10:12:34.265378 <... close resumed> ) = 0
[pid 25423] 10:12:34.265395 read(14,  <unfinished ...>
[pid 25426] 10:12:34.265421 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.265451 munmap(0x7f380d425000, 4096 <unfinished ...>
[pid 25426] 10:12:34.265484 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.265501 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.265571 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25426] 10:12:34.265596 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.265687 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25426] 10:12:34.265724 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.265741 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.265824 read(14,  <unfinished ...>
[pid 25426] 10:12:34.265854 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.265884 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f380c2db790},  <unfinished ...>
[pid 25426] 10:12:34.265915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.265933 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.265958 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25426] 10:12:34.265980 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.266072 fstat(2,  <unfinished ...>
[pid 25426] 10:12:34.266101 <... open resumed> ) = 6
[pid 25425] 10:12:34.266116 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25423] 10:12:34.266178 read(14,  <unfinished ...>
[pid 25426] 10:12:34.266207 read(6,  <unfinished ...>
[pid 25425] 10:12:34.266231 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f380c2db790},  <unfinished ...>
[pid 25426] 10:12:34.266261 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.266281 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.266293 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25426] 10:12:34.266305 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.266555 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25426] 10:12:34.266591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25425] 10:12:34.266622 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25423] 10:12:34.266641 read(14,  <unfinished ...>
[pid 25426] 10:12:34.266667 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.266695 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25426] 10:12:34.266725 <... mmap resumed> ) = 0x7fcf3ddea000
[pid 25425] 10:12:34.266749 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25423] 10:12:34.266767 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25426] 10:12:34.266789 mprotect(0x7fcf3dfa3000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.266877 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f380c2db790},  <unfinished ...>
[pid 25426] 10:12:34.266910 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.266926 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25423] 10:12:34.266953 read(14,  <unfinished ...>
[pid 25426] 10:12:34.266980 mmap(0x7fcf3e1a2000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25425] 10:12:34.267011 umask(0 <unfinished ...>
[pid 25426] 10:12:34.267038 <... mmap resumed> ) = 0x7fcf3e1a2000
[pid 25425] 10:12:34.267059 <... umask resumed> ) = 0
[pid 25423] 10:12:34.267111 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25426] 10:12:34.267135 mmap(0x7fcf3e1c9000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.267225 geteuid( <unfinished ...>
[pid 25426] 10:12:34.267253 <... mmap resumed> ) = 0x7fcf3e1c9000
[pid 25425] 10:12:34.267275 <... geteuid resumed> ) = 0
[pid 25423] 10:12:34.267294 read(14,  <unfinished ...>
[pid 25426] 10:12:34.267321 close(6 <unfinished ...>
[pid 25425] 10:12:34.267342 getuid( <unfinished ...>
[pid 25426] 10:12:34.267452 <... close resumed> ) = 0
[pid 25425] 10:12:34.267480 <... getuid resumed> ) = 47
[pid 25423] 10:12:34.267500 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25426] 10:12:34.267523 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.267566 getgid( <unfinished ...>
[pid 25426] 10:12:34.267593 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.267610 <... getgid resumed> ) = 12
[pid 25423] 10:12:34.267651 read(14,  <unfinished ...>
[pid 25426] 10:12:34.267679 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.267710 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25426] 10:12:34.267742 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.267759 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25423] 10:12:34.267778 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25426] 10:12:34.267798 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.267896 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25426] 10:12:34.267924 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.267943 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25423] 10:12:34.267965 read(14,  <unfinished ...>
[pid 25426] 10:12:34.267991 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.268021 getgroups(65536,  <unfinished ...>
[pid 25426] 10:12:34.268048 <... open resumed> ) = 6
[pid 25425] 10:12:34.268063 <... getgroups resumed> [12]) = 1
[pid 25423] 10:12:34.268086 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25426] 10:12:34.268107 read(6,  <unfinished ...>
[pid 25425] 10:12:34.268207 setgroups(0, [] <unfinished ...>
[pid 25426] 10:12:34.268237 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.268260 <... setgroups resumed> ) = 0
[pid 25423] 10:12:34.268278 read(14,  <unfinished ...>
[pid 25426] 10:12:34.268304 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.268327 getegid( <unfinished ...>
[pid 25426] 10:12:34.268447 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25425] 10:12:34.268485 <... getegid resumed> ) = 12
[pid 25423] 10:12:34.268501 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25426] 10:12:34.268522 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.268561 geteuid( <unfinished ...>
[pid 25426] 10:12:34.268592 <... mmap resumed> ) = 0x7fcf4085d000
[pid 25425] 10:12:34.268612 <... geteuid resumed> ) = 0
[pid 25423] 10:12:34.268633 read(14,  <unfinished ...>
[pid 25426] 10:12:34.268659 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.268687 geteuid( <unfinished ...>
[pid 25426] 10:12:34.268713 <... mmap resumed> ) = 0x7fcf3dbbd000
[pid 25425] 10:12:34.268728 <... geteuid resumed> ) = 0
[pid 25423] 10:12:34.268743 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25426] 10:12:34.268770 mprotect(0x7fcf3dbe9000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.268862 getegid( <unfinished ...>
[pid 25426] 10:12:34.268890 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.268906 <... getegid resumed> ) = 12
[pid 25423] 10:12:34.268925 read(14,  <unfinished ...>
[pid 25426] 10:12:34.268951 mmap(0x7fcf3dde9000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25425] 10:12:34.268980 setgid(12 <unfinished ...>
[pid 25426] 10:12:34.269008 <... mmap resumed> ) = 0x7fcf3dde9000
[pid 25425] 10:12:34.269029 <... setgid resumed> ) = 0
[pid 25423] 10:12:34.269047 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25426] 10:12:34.269069 close(6 <unfinished ...>
[pid 25425] 10:12:34.269104 setuid(0 <unfinished ...>
[pid 25426] 10:12:34.269132 <... close resumed> ) = 0
[pid 25425] 10:12:34.269154 <... setuid resumed> ) = 0
[pid 25423] 10:12:34.269201 read(14,  <unfinished ...>
[pid 25426] 10:12:34.269231 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.269263 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.269296 <... open resumed> ) = 6
[pid 25425] 10:12:34.269312 <... open resumed> ) = 6
[pid 25423] 10:12:34.269345 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25426] 10:12:34.269387 read(6,  <unfinished ...>
[pid 25425] 10:12:34.269543 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.269587 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.269623 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25423] 10:12:34.269677 read(14,  <unfinished ...>
[pid 25426] 10:12:34.269720 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.269744 fstat(6,  <unfinished ...>
[pid 25426] 10:12:34.269771 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25425] 10:12:34.269801 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25423] 10:12:34.269828 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25426] 10:12:34.269849 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.269949 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.269987 <... mmap resumed> ) = 0x7fcf3d9b8000
[pid 25425] 10:12:34.270004 <... mmap resumed> ) = 0x7f380d425000
[pid 25423] 10:12:34.270020 read(14,  <unfinished ...>
[pid 25426] 10:12:34.270043 mprotect(0x7fcf3d9bd000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.270057 read(6,  <unfinished ...>
[pid 25426] 10:12:34.270074 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.270082 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25423] 10:12:34.270202 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25426] 10:12:34.270217 mmap(0x7fcf3dbbc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25425] 10:12:34.270299 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25426] 10:12:34.270328 <... mmap resumed> ) = 0x7fcf3dbbc000
[pid 25425] 10:12:34.270342 <... socket resumed> ) = 7
[pid 25423] 10:12:34.270517 read(14,  <unfinished ...>
[pid 25426] 10:12:34.270551 close(6 <unfinished ...>
[pid 25425] 10:12:34.270574 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25426] 10:12:34.270615 <... close resumed> ) = 0
[pid 25425] 10:12:34.270642 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.270661 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25426] 10:12:34.270682 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.270790 close(7 <unfinished ...>
[pid 25426] 10:12:34.270822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.270839 <... close resumed> ) = 0
[pid 25423] 10:12:34.270855 read(14,  <unfinished ...>
[pid 25426] 10:12:34.270880 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.270911 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25426] 10:12:34.270943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.270960 <... socket resumed> ) = 7
[pid 25423] 10:12:34.270976 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25426] 10:12:34.270997 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.271096 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25426] 10:12:34.271132 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.271151 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.271167 read(14,  <unfinished ...>
[pid 25426] 10:12:34.271193 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.271221 close(7 <unfinished ...>
[pid 25426] 10:12:34.271250 <... open resumed> ) = 6
[pid 25425] 10:12:34.271269 <... close resumed> ) = 0
[pid 25423] 10:12:34.271295 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25426] 10:12:34.271325 read(6,  <unfinished ...>
[pid 25425] 10:12:34.271425 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.271460 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.271483 <... open resumed> ) = 7
[pid 25423] 10:12:34.271502 read(14,  <unfinished ...>
[pid 25426] 10:12:34.271531 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.271555 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.271587 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25425] 10:12:34.271621 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25423] 10:12:34.271651 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25426] 10:12:34.271675 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.271769 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.271802 <... mmap resumed> ) = 0x7fcf3d7b5000
[pid 25425] 10:12:34.271818 <... mmap resumed> ) = 0x7f380d424000
[pid 25423] 10:12:34.271834 read(14,  <unfinished ...>
[pid 25426] 10:12:34.271860 mprotect(0x7fcf3d7b7000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.271889 read(7,  <unfinished ...>
[pid 25426] 10:12:34.271922 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.271938 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25423] 10:12:34.271974 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25426] 10:12:34.271993 mmap(0x7fcf3d9b6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25425] 10:12:34.272059 read(7,  <unfinished ...>
[pid 25426] 10:12:34.272075 <... mmap resumed> ) = 0x7fcf3d9b6000
[pid 25425] 10:12:34.272091 <... read resumed> "", 4096) = 0
[pid 25423] 10:12:34.272102 read(14,  <unfinished ...>
[pid 25426] 10:12:34.272110 close(6 <unfinished ...>
[pid 25425] 10:12:34.272122 close(7 <unfinished ...>
[pid 25426] 10:12:34.272136 <... close resumed> ) = 0
[pid 25425] 10:12:34.272152 <... close resumed> ) = 0
[pid 25423] 10:12:34.272161 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25426] 10:12:34.272172 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.272236 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25426] 10:12:34.272256 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.272265 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.272286 read(14,  <unfinished ...>
[pid 25426] 10:12:34.272296 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.272315 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.272334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.272343 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.272534 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25426] 10:12:34.272564 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.272668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.272710 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.272729 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.272750 read(14,  <unfinished ...>
[pid 25426] 10:12:34.272777 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.272808 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.272841 <... open resumed> ) = 6
[pid 25425] 10:12:34.272857 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.272873 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25426] 10:12:34.272894 read(6,  <unfinished ...>
[pid 25425] 10:12:34.272955 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.272989 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.273012 <... open resumed> ) = 7
[pid 25423] 10:12:34.273027 brk(0x173c000 <unfinished ...>
[pid 25426] 10:12:34.273053 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.273076 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.273102 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25425] 10:12:34.273131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25423] 10:12:34.273158 <... brk resumed> ) = 0x173c000
[pid 25426] 10:12:34.273175 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.273240 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25426] 10:12:34.273271 <... mmap resumed> ) = 0x7fcf4085c000
[pid 25425] 10:12:34.273291 <... mmap resumed> ) = 0x7f380d404000
[pid 25423] 10:12:34.273307 read(14,  <unfinished ...>
[pid 25426] 10:12:34.273333 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.273365 close(7 <unfinished ...>
[pid 25426] 10:12:34.273392 <... mmap resumed> ) = 0x7fcf3d592000
[pid 25425] 10:12:34.273407 <... close resumed> ) = 0
[pid 25423] 10:12:34.273432 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25426] 10:12:34.273453 mprotect(0x7fcf3d5a9000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.273547 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25426] 10:12:34.273589 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.273607 <... open resumed> ) = 7
[pid 25423] 10:12:34.273625 read(14,  <unfinished ...>
[pid 25426] 10:12:34.273651 mmap(0x7fcf3d7a9000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25425] 10:12:34.273683 read(7,  <unfinished ...>
[pid 25426] 10:12:34.273714 <... mmap resumed> ) = 0x7fcf3d7a9000
[pid 25425] 10:12:34.273739 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.273764 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25426] 10:12:34.273785 close(6 <unfinished ...>
[pid 25425] 10:12:34.273819 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.273846 <... close resumed> ) = 0
[pid 25425] 10:12:34.273885 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25423] 10:12:34.273916 read(14,  <unfinished ...>
[pid 25426] 10:12:34.273926 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.273943 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25426] 10:12:34.273965 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.273974 <... mmap resumed> ) = 0x7f3808d9f000
[pid 25423] 10:12:34.273982 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25426] 10:12:34.273992 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.274238 mprotect(0x7f3808dab000, 2097152, PROT_NONE <unfinished ...>
[pid 25426] 10:12:34.274275 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.274292 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.274314 read(14,  <unfinished ...>
[pid 25426] 10:12:34.274340 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.274376 mmap(0x7f3808fab000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25426] 10:12:34.274411 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.274433 <... mmap resumed> ) = 0x7f3808fab000
[pid 25423] 10:12:34.274459 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25426] 10:12:34.274483 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.274577 close(7 <unfinished ...>
[pid 25426] 10:12:34.274607 <... open resumed> ) = 6
[pid 25425] 10:12:34.274626 <... close resumed> ) = 0
[pid 25423] 10:12:34.274663 read(14,  <unfinished ...>
[pid 25426] 10:12:34.274691 read(6,  <unfinished ...>
[pid 25425] 10:12:34.274716 mprotect(0x7f3808fab000, 4096, PROT_READ <unfinished ...>
[pid 25426] 10:12:34.274746 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.274769 <... mprotect resumed> ) = 0
[pid 25423] 10:12:34.274788 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25426] 10:12:34.274809 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.274886 munmap(0x7f380d404000, 39387 <unfinished ...>
[pid 25426] 10:12:34.274919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25425] 10:12:34.274950 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.274978 read(14,  <unfinished ...>
[pid 25426] 10:12:34.275011 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.275041 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.275076 <... mmap resumed> ) = 0x7fcf3d34e000
[pid 25425] 10:12:34.275093 <... open resumed> ) = 7
[pid 25423] 10:12:34.275114 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25426] 10:12:34.275136 mprotect(0x7fcf3d38f000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.275215 fcntl(7, F_GETFD <unfinished ...>
[pid 25426] 10:12:34.275244 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.275260 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25423] 10:12:34.275279 read(14,  <unfinished ...>
[pid 25426] 10:12:34.275305 mmap(0x7fcf3d58f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25425] 10:12:34.275334 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.275466 <... mmap resumed> ) = 0x7fcf3d58f000
[pid 25425] 10:12:34.275495 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25423] 10:12:34.275534 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25426] 10:12:34.275556 close(6 <unfinished ...>
[pid 25425] 10:12:34.275639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.275671 <... close resumed> ) = 0
[pid 25425] 10:12:34.275696 <... mmap resumed> ) = 0x7f380d424000
[pid 25423] 10:12:34.275714 read(14,  <unfinished ...>
[pid 25426] 10:12:34.275739 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.275770 read(7,  <unfinished ...>
[pid 25426] 10:12:34.275800 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.275817 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25423] 10:12:34.275861 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25426] 10:12:34.275888 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.275981 close(7 <unfinished ...>
[pid 25426] 10:12:34.276011 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.276028 <... close resumed> ) = 0
[pid 25423] 10:12:34.276043 read(14,  <unfinished ...>
[pid 25426] 10:12:34.276069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.276098 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25426] 10:12:34.276133 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.276154 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.276196 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25426] 10:12:34.276220 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.276305 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25426] 10:12:34.276338 <... open resumed> ) = 6
[pid 25425] 10:12:34.276433 <... socket resumed> ) = 7
[pid 25423] 10:12:34.276456 read(14,  <unfinished ...>
[pid 25426] 10:12:34.276483 read(6,  <unfinished ...>
[pid 25425] 10:12:34.276506 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25426] 10:12:34.276546 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.276570 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.276599 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25426] 10:12:34.276626 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.276663 close(7 <unfinished ...>
[pid 25426] 10:12:34.276696 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25425] 10:12:34.276731 <... close resumed> ) = 0
[pid 25423] 10:12:34.276748 read(14,  <unfinished ...>
[pid 25426] 10:12:34.276773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.276800 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25426] 10:12:34.276830 <... mmap resumed> ) = 0x7fcf4085b000
[pid 25425] 10:12:34.276849 <... socket resumed> ) = 7
[pid 25423] 10:12:34.276865 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25426] 10:12:34.276886 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.276995 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25426] 10:12:34.277033 <... mmap resumed> ) = 0x7fcf3d067000
[pid 25425] 10:12:34.277049 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.277065 read(14,  <unfinished ...>
[pid 25426] 10:12:34.277091 mprotect(0x7fcf3d142000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.277118 close(7 <unfinished ...>
[pid 25426] 10:12:34.277147 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.277162 <... close resumed> ) = 0
[pid 25423] 10:12:34.277183 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25426] 10:12:34.277205 mmap(0x7fcf3d342000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25425] 10:12:34.277291 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.277326 <... mmap resumed> ) = 0x7fcf3d342000
[pid 25425] 10:12:34.277446 <... open resumed> ) = 7
[pid 25423] 10:12:34.277474 read(14,  <unfinished ...>
[pid 25426] 10:12:34.277503 close(6 <unfinished ...>
[pid 25425] 10:12:34.277525 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.277552 <... close resumed> ) = 0
[pid 25425] 10:12:34.277579 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25423] 10:12:34.277615 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25426] 10:12:34.277638 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.277769 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.277818 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.277838 <... mmap resumed> ) = 0x7f380d424000
[pid 25423] 10:12:34.277855 read(14,  <unfinished ...>
[pid 25426] 10:12:34.277888 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.277920 read(7,  <unfinished ...>
[pid 25426] 10:12:34.277951 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.277968 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25423] 10:12:34.278001 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25426] 10:12:34.278022 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.278116 close(7 <unfinished ...>
[pid 25426] 10:12:34.278146 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.278165 <... close resumed> ) = 0
[pid 25423] 10:12:34.278181 read(14,  <unfinished ...>
[pid 25426] 10:12:34.278206 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.278236 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25426] 10:12:34.278269 <... open resumed> ) = 6
[pid 25425] 10:12:34.278284 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.278318 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25426] 10:12:34.278342 read(6,  <unfinished ...>
[pid 25425] 10:12:34.278426 read(6,  <unfinished ...>
[pid 25426] 10:12:34.278456 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.278478 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25423] 10:12:34.278536 read(14,  <unfinished ...>
[pid 25426] 10:12:34.278568 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.278594 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25426] 10:12:34.278634 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25425] 10:12:34.278670 <... open resumed> ) = 7
[pid 25423] 10:12:34.278688 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25426] 10:12:34.278712 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.278819 fstat(7,  <unfinished ...>
[pid 25426] 10:12:34.278848 <... mmap resumed> ) = 0x7fcf3ce63000
[pid 25425] 10:12:34.278869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25423] 10:12:34.278896 read(14,  <unfinished ...>
[pid 25426] 10:12:34.278905 mprotect(0x7fcf3ce66000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.278921 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25426] 10:12:34.278937 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.278945 <... mmap resumed> ) = 0x7f380d424000
[pid 25423] 10:12:34.278953 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25426] 10:12:34.278963 mmap(0x7fcf3d065000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25425] 10:12:34.278987 read(7,  <unfinished ...>
[pid 25426] 10:12:34.279004 <... mmap resumed> ) = 0x7fcf3d065000
[pid 25425] 10:12:34.279021 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25423] 10:12:34.279035 read(14,  <unfinished ...>
[pid 25426] 10:12:34.279044 close(6 <unfinished ...>
[pid 25425] 10:12:34.279055 close(7 <unfinished ...>
[pid 25426] 10:12:34.279069 <... close resumed> ) = 0
[pid 25425] 10:12:34.279085 <... close resumed> ) = 0
[pid 25423] 10:12:34.279093 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25426] 10:12:34.279103 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.279175 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25426] 10:12:34.279194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.279204 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.279219 read(14,  <unfinished ...>
[pid 25426] 10:12:34.279228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.279248 read(6,  <unfinished ...>
[pid 25426] 10:12:34.279262 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.279270 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25423] 10:12:34.279299 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25426] 10:12:34.279311 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.279336 uname( <unfinished ...>
[pid 25426] 10:12:34.279556 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.279584 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25423] 10:12:34.279637 read(14,  <unfinished ...>
[pid 25426] 10:12:34.279668 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.279706 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25426] 10:12:34.279738 <... open resumed> ) = 6
[pid 25425] 10:12:34.279754 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f380c2db790}, 8) = 0
[pid 25423] 10:12:34.279782 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25426] 10:12:34.279804 read(6,  <unfinished ...>
[pid 25425] 10:12:34.279889 clone( <unfinished ...>
[pid 25426] 10:12:34.280111 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.280137 read(14,  <unfinished ...>
[pid 25426] 10:12:34.280164 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.280186 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25430
[pid 25426] 10:12:34.280235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25425] 10:12:34.280270 wait4(25430,  <unfinished ...>
[pid 25423] 10:12:34.280292 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25426] 10:12:34.280311 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcf3cc37000
[pid 25423] 10:12:34.280447 read(14,  <unfinished ...>
[pid 25426] 10:12:34.280474 mprotect(0x7fcf3cc60000, 2097152, PROT_NONE) = 0
[pid 25423] 10:12:34.280513 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25426] 10:12:34.280538 mmap(0x7fcf3ce60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fcf3ce60000
[pid 25423] 10:12:34.280649 read(14,  <unfinished ...>
[pid 25426] 10:12:34.280677 mmap(0x7fcf3ce62000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcf3ce62000
[pid 25423] 10:12:34.280718 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25426] 10:12:34.280740 close(6)    = 0
[pid 25423] 10:12:34.280847 read(14,  <unfinished ...>
[pid 25426] 10:12:34.280875 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.280915 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25426] 10:12:34.280941 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.280996 read(14,  <unfinished ...>
[pid 25426] 10:12:34.281021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.281060 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25426] 10:12:34.281080 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25423] 10:12:34.281194 read(14,  <unfinished ...>
[pid 25426] 10:12:34.281220 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.281257 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25426] 10:12:34.281277 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.281394 read(14,  <unfinished ...>
[pid 25426] 10:12:34.281420 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4085a000
[pid 25423] 10:12:34.281458 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25426] 10:12:34.281479 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcf3ca21000
[pid 25423] 10:12:34.281586 read(14,  <unfinished ...>
[pid 25426] 10:12:34.281617 mprotect(0x7fcf3ca36000, 2093056, PROT_NONE) = 0
[pid 25423] 10:12:34.281652 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25426] 10:12:34.281673 mmap(0x7fcf3cc35000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fcf3cc35000
[pid 25423] 10:12:34.281731 brk(0x175d000 <unfinished ...>
[pid 25426] 10:12:34.281760 close(6)    = 0
[pid 25423] 10:12:34.281810 <... brk resumed> ) = 0x175d000
[pid 25426] 10:12:34.281827 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.281942 read(14,  <unfinished ...>
[pid 25426] 10:12:34.281967 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.282008 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25426] 10:12:34.282033 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.282086 read(14,  <unfinished ...>
[pid 25426] 10:12:34.282110 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25423] 10:12:34.282134 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25426] 10:12:34.282144 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.282216 read(14,  <unfinished ...>
[pid 25426] 10:12:34.282225 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25423] 10:12:34.282257 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25426] 10:12:34.282266 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcf3c816000
[pid 25423] 10:12:34.282546 read(14,  <unfinished ...>
[pid 25426] 10:12:34.282576 mprotect(0x7fcf3c820000, 2093056, PROT_NONE) = 0
[pid 25423] 10:12:34.282614 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25426] 10:12:34.282636 mmap(0x7fcf3ca1f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fcf3ca1f000
[pid 25423] 10:12:34.282697 read(14,  <unfinished ...>
[pid 25426] 10:12:34.282725 close(6)    = 0
[pid 25423] 10:12:34.282764 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25426] 10:12:34.282786 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.282926 read(14,  <unfinished ...>
[pid 25426] 10:12:34.282953 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.282993 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25426] 10:12:34.283013 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.283066 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283092 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25423] 10:12:34.283130 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25426] 10:12:34.283156 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.283262 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283289 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.283335 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25426] 10:12:34.283360 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcf3c613000
[pid 25423] 10:12:34.283455 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283482 mprotect(0x7fcf3c615000, 2093056, PROT_NONE) = 0
[pid 25423] 10:12:34.283519 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25426] 10:12:34.283539 mmap(0x7fcf3c814000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fcf3c814000
[pid 25423] 10:12:34.283601 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283636 close(6)    = 0
[pid 25423] 10:12:34.283674 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25426] 10:12:34.283695 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf40859000
[pid 25423] 10:12:34.283805 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283833 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.283873 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25426] 10:12:34.283893 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.283945 read(14,  <unfinished ...>
[pid 25426] 10:12:34.283971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.284011 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25426] 10:12:34.284028 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25423] 10:12:34.284103 read(14,  <unfinished ...>
[pid 25426] 10:12:34.284112 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.284136 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25426] 10:12:34.284145 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25423] 10:12:34.284186 read(14,  <unfinished ...>
[pid 25426] 10:12:34.284194 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcf3c3f4000
[pid 25423] 10:12:34.284219 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25426] 10:12:34.284228 mprotect(0x7fcf3c411000, 2093056, PROT_NONE) = 0
[pid 25423] 10:12:34.284305 read(14,  <unfinished ...>
[pid 25426] 10:12:34.284313 mmap(0x7fcf3c610000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fcf3c610000
[pid 25423] 10:12:34.284342 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25426] 10:12:34.284547 mmap(0x7fcf3c612000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcf3c612000
[pid 25423] 10:12:34.284661 read(14,  <unfinished ...>
[pid 25426] 10:12:34.284691 close(6)    = 0
[pid 25423] 10:12:34.284758 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25426] 10:12:34.284782 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf40858000
[pid 25423] 10:12:34.284906 read(14,  <unfinished ...>
[pid 25426] 10:12:34.284934 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf40857000
[pid 25423] 10:12:34.284976 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25426] 10:12:34.284998 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf40855000
[pid 25423] 10:12:34.285049 read(14,  <unfinished ...>
[pid 25426] 10:12:34.285074 arch_prctl(ARCH_SET_FS, 0x7fcf408557c0) = 0
[pid 25423] 10:12:34.285146 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25426] 10:12:34.285167 mprotect(0x7fcf3c610000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285282 read(14,  <unfinished ...>
[pid 25426] 10:12:34.285309 mprotect(0x7fcf3c814000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285365 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25426] 10:12:34.285388 mprotect(0x7fcf3ca1f000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285482 read(14,  <unfinished ...>
[pid 25426] 10:12:34.285510 mprotect(0x7fcf3cc35000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285558 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25426] 10:12:34.285579 mprotect(0x7fcf3ce60000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285682 read(14,  <unfinished ...>
[pid 25426] 10:12:34.285709 mprotect(0x7fcf3d065000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.285869 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25426] 10:12:34.285892 mprotect(0x7fcf3d342000, 40960, PROT_READ) = 0
[pid 25423] 10:12:34.286070 read(14,  <unfinished ...>
[pid 25426] 10:12:34.286098 mprotect(0x7fcf3d58f000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.286142 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25426] 10:12:34.286164 mprotect(0x7fcf3d7a9000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.286256 read(14,  <unfinished ...>
[pid 25426] 10:12:34.286283 mprotect(0x7fcf3d9b6000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.286630 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25426] 10:12:34.286661 mprotect(0x7fcf3e1a2000, 110592, PROT_READ) = 0
[pid 25423] 10:12:34.286826 read(14,  <unfinished ...>
[pid 25426] 10:12:34.286855 mprotect(0x7fcf3e42e000, 16384, PROT_READ) = 0
[pid 25423] 10:12:34.286982 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25426] 10:12:34.287006 mprotect(0x7fcf3e7c3000, 16384, PROT_READ) = 0
[pid 25423] 10:12:34.287097 read(14,  <unfinished ...>
[pid 25426] 10:12:34.287124 mprotect(0x7fcf3e9ce000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.287166 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25426] 10:12:34.287187 mprotect(0x7fcf3ebd2000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288028 read(14,  <unfinished ...>
[pid 25426] 10:12:34.288065 mprotect(0x7fcf3f92a000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288120 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25426] 10:12:34.288149 mprotect(0x7fcf3fd5f000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288199 read(14,  <unfinished ...>
[pid 25426] 10:12:34.288225 mprotect(0x7fcf3ffe3000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288263 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25426] 10:12:34.288283 mprotect(0x7fcf401ec000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288401 read(14,  <unfinished ...>
[pid 25426] 10:12:34.288429 mprotect(0x7fcf40431000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288472 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25426] 10:12:34.288493 mprotect(0x7fcf4064b000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288607 read(14,  <unfinished ...>
[pid 25426] 10:12:34.288634 mprotect(0x7fcf4086e000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.288667 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25426] 10:12:34.288688 munmap(0x7fcf40863000, 39387) = 0
[pid 25423] 10:12:34.288738 read(14,  <unfinished ...>
[pid 25426] 10:12:34.288763 set_tid_address(0x7fcf40855a90) = 25426
[pid 25423] 10:12:34.288793 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25426] 10:12:34.288813 set_robust_list(0x7fcf40855aa0, 24) = 0
[pid 25423] 10:12:34.288893 brk(0x177e000 <unfinished ...>
[pid 25426] 10:12:34.288919 futex(0x7ffef3fc0c0c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25423] 10:12:34.288951 <... brk resumed> ) = 0x177e000
[pid 25426] 10:12:34.288966 futex(0x7ffef3fc0c0c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fcf408557c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25423] 10:12:34.289021 read(14,  <unfinished ...>
[pid 25426] 10:12:34.289047 rt_sigaction(SIGRTMIN, {0x7fcf3f718c60, [], SA_RESTORER|SA_SIGINFO, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25423] 10:12:34.289083 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25426] 10:12:34.289102 rt_sigaction(SIGRT_1, {0x7fcf3f718cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25423] 10:12:34.289149 read(14,  <unfinished ...>
[pid 25426] 10:12:34.289174 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25423] 10:12:34.289217 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25426] 10:12:34.289237 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25423] 10:12:34.289487 read(14,  <unfinished ...>
[pid 25426] 10:12:34.289523 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350359, f_bavail=6350359, f_files=1000000, f_ffree=691122, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25423] 10:12:34.289629 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25426] 10:12:34.289654 brk(0)      = 0x1e66000
[pid 25423] 10:12:34.289748 read(14,  <unfinished ...>
[pid 25426] 10:12:34.289774 brk(0x1e87000) = 0x1e87000
[pid 25423] 10:12:34.289816 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25426] 10:12:34.289838 open("/proc/filesystems", O_RDONLY) = 6
[pid 25423] 10:12:34.289959 read(14,  <unfinished ...>
[pid 25426] 10:12:34.289987 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.290033 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25426] 10:12:34.290054 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086c000
[pid 25423] 10:12:34.290155 read(14,  <unfinished ...>
[pid 25426] 10:12:34.290181 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25423] 10:12:34.290293 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25426] 10:12:34.290318 read(6, "", 1024) = 0
[pid 25423] 10:12:34.290440 read(14,  <unfinished ...>
[pid 25426] 10:12:34.290469 close(6)    = 0
[pid 25423] 10:12:34.290504 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25426] 10:12:34.290525 munmap(0x7fcf4086c000, 4096) = 0
[pid 25423] 10:12:34.290700 read(14,  <unfinished ...>
[pid 25426] 10:12:34.290733 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.290847 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25426] 10:12:34.290871 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25423] 10:12:34.290926 read(14,  <unfinished ...>
[pid 25426] 10:12:34.290953 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25423] 10:12:34.291027 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25426] 10:12:34.291055 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25423] 10:12:34.291168 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291196 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25423] 10:12:34.291233 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25426] 10:12:34.291252 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25423] 10:12:34.291298 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291323 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25423] 10:12:34.291370 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25426] 10:12:34.291392 umask(0)    = 022
[pid 25423] 10:12:34.291518 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291548 geteuid()   = 0
[pid 25423] 10:12:34.291581 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25426] 10:12:34.291602 getuid()    = 503
[pid 25423] 10:12:34.291645 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291670 getgid()    = 499
[pid 25423] 10:12:34.291714 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25426] 10:12:34.291736 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25423] 10:12:34.291826 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291852 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25423] 10:12:34.291886 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25426] 10:12:34.291906 getgroups(65536, [500]) = 1
[pid 25423] 10:12:34.291955 read(14,  <unfinished ...>
[pid 25426] 10:12:34.291981 setgroups(0, []) = 0
[pid 25423] 10:12:34.292014 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25426] 10:12:34.292034 getegid()   = 499
[pid 25423] 10:12:34.292120 read(14,  <unfinished ...>
[pid 25426] 10:12:34.292146 geteuid()   = 0
[pid 25423] 10:12:34.292180 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25426] 10:12:34.292201 geteuid()   = 0
[pid 25423] 10:12:34.292290 read(14,  <unfinished ...>
[pid 25426] 10:12:34.292316 getegid()   = 499
[pid 25423] 10:12:34.292478 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25426] 10:12:34.292511 setgid(499) = 0
[pid 25423] 10:12:34.292557 read(14,  <unfinished ...>
[pid 25426] 10:12:34.292582 setuid(0)   = 0
[pid 25423] 10:12:34.292644 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25426] 10:12:34.292668 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25423] 10:12:34.292790 read(14,  <unfinished ...>
[pid 25426] 10:12:34.292818 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25423] 10:12:34.292869 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25426] 10:12:34.292889 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25423] 10:12:34.292944 read(14,  <unfinished ...>
[pid 25426] 10:12:34.292968 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086c000
[pid 25423] 10:12:34.293003 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25426] 10:12:34.293022 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25423] 10:12:34.293233 read(14,  <unfinished ...>
[pid 25426] 10:12:34.293267 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25423] 10:12:34.293305 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25426] 10:12:34.293325 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.293438 read(14,  <unfinished ...>
[pid 25426] 10:12:34.293466 close(7)    = 0
[pid 25423] 10:12:34.293501 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25426] 10:12:34.293522 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25423] 10:12:34.293617 read(14,  <unfinished ...>
[pid 25426] 10:12:34.293643 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.293684 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25426] 10:12:34.293704 close(7)    = 0
[pid 25423] 10:12:34.293812 read(14,  <unfinished ...>
[pid 25426] 10:12:34.293839 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25423] 10:12:34.293880 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25426] 10:12:34.293900 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25423] 10:12:34.293959 read(14,  <unfinished ...>
[pid 25426] 10:12:34.293984 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25423] 10:12:34.294019 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25426] 10:12:34.294038 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25423] 10:12:34.294151 read(14,  <unfinished ...>
[pid 25426] 10:12:34.294179 read(7, "", 4096) = 0
[pid 25423] 10:12:34.294210 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25426] 10:12:34.294226 close(7)    = 0
[pid 25423] 10:12:34.294317 read(14,  <unfinished ...>
[pid 25426] 10:12:34.294327 munmap(0x7fcf4086b000, 4096) = 0
[pid 25423] 10:12:34.294505 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25426] 10:12:34.294535 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.294658 read(14,  <unfinished ...>
[pid 25426] 10:12:34.294684 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.294731 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25426] 10:12:34.294751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.294862 read(14,  <unfinished ...>
[pid 25426] 10:12:34.294888 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25423] 10:12:34.294925 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25426] 10:12:34.294945 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25423] 10:12:34.295000 read(14,  <unfinished ...>
[pid 25426] 10:12:34.295031 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fcf4084b000
[pid 25423] 10:12:34.295067 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25426] 10:12:34.295087 close(7)    = 0
[pid 25423] 10:12:34.295188 read(14,  <unfinished ...>
[pid 25426] 10:12:34.295216 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25423] 10:12:34.295256 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25426] 10:12:34.295276 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25423] 10:12:34.295338 brk(0x179f000 <unfinished ...>
[pid 25426] 10:12:34.295370 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25423] 10:12:34.295419 <... brk resumed> ) = 0x179f000
[pid 25426] 10:12:34.295436 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fcf3c1e6000
[pid 25423] 10:12:34.295522 read(14,  <unfinished ...>
[pid 25426] 10:12:34.295549 mprotect(0x7fcf3c1f2000, 2097152, PROT_NONE) = 0
[pid 25423] 10:12:34.295590 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25426] 10:12:34.295614 mmap(0x7fcf3c3f2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fcf3c3f2000
[pid 25423] 10:12:34.295726 read(14,  <unfinished ...>
[pid 25426] 10:12:34.295757 close(7)    = 0
[pid 25423] 10:12:34.295807 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25426] 10:12:34.295830 mprotect(0x7fcf3c3f2000, 4096, PROT_READ) = 0
[pid 25423] 10:12:34.295880 read(14,  <unfinished ...>
[pid 25426] 10:12:34.295907 munmap(0x7fcf4084b000, 39387) = 0
[pid 25423] 10:12:34.295952 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25426] 10:12:34.295973 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25423] 10:12:34.296070 read(14,  <unfinished ...>
[pid 25426] 10:12:34.296097 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25423] 10:12:34.296133 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25426] 10:12:34.296151 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25423] 10:12:34.296230 read(14,  <unfinished ...>
[pid 25426] 10:12:34.296238 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25423] 10:12:34.296261 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25426] 10:12:34.296271 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25423] 10:12:34.296323 read(14,  <unfinished ...>
[pid 25426] 10:12:34.296332 close(7)    = 0
[pid 25423] 10:12:34.296514 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25426] 10:12:34.296543 munmap(0x7fcf4086b000, 4096) = 0
[pid 25423] 10:12:34.296743 read(14,  <unfinished ...>
[pid 25426] 10:12:34.296774 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25423] 10:12:34.296810 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25426] 10:12:34.296831 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.296884 read(14,  <unfinished ...>
[pid 25426] 10:12:34.296910 close(7)    = 0
[pid 25423] 10:12:34.296944 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25426] 10:12:34.296964 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25423] 10:12:34.297067 read(14,  <unfinished ...>
[pid 25426] 10:12:34.297094 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.297134 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25426] 10:12:34.297154 close(7)    = 0
[pid 25423] 10:12:34.297262 read(14,  <unfinished ...>
[pid 25426] 10:12:34.297289 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25423] 10:12:34.297328 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25426] 10:12:34.297348 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25423] 10:12:34.297483 read(14,  <unfinished ...>
[pid 25411] 10:12:34.297512 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25426] 10:12:34.297542 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.297570 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25411] 10:12:34.297587 recvfrom(16,  <unfinished ...>
[pid 25426] 10:12:34.297690 <... mmap resumed> ) = 0x7fcf4086b000
[pid 25423] 10:12:34.297708 read(14,  <unfinished ...>
[pid 25411] 10:12:34.297730 <... recvfrom resumed> "\273\362\201\200\0\1\0\1\0\0\0\0\23phoenixmarriottmesa\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\7\7\0\v\0\n\6remote\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 64
[pid 25426] 10:12:34.297775 read(7,  <unfinished ...>
[pid 25423] 10:12:34.297802 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25411] 10:12:34.297820 close(16 <unfinished ...>
[pid 25426] 10:12:34.297865 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25423] 10:12:34.297898 read(14,  <unfinished ...>
[pid 25411] 10:12:34.297922 <... close resumed> ) = 0
[pid 25426] 10:12:34.297975 close(7 <unfinished ...>
[pid 25423] 10:12:34.298002 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25411] 10:12:34.298019 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25426] 10:12:34.298124 <... close resumed> ) = 0
[pid 25423] 10:12:34.298142 read(14,  <unfinished ...>
[pid 25411] 10:12:34.298165 <... socket resumed> ) = 16
[pid 25426] 10:12:34.298185 munmap(0x7fcf4086b000, 4096 <unfinished ...>
[pid 25423] 10:12:34.298213 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25411] 10:12:34.298231 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25426] 10:12:34.298333 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.298483 read(14,  <unfinished ...>
[pid 25411] 10:12:34.298516 <... connect resumed> ) = 0
[pid 25426] 10:12:34.298538 read(6,  <unfinished ...>
[pid 25423] 10:12:34.298561 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25411] 10:12:34.298580 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25426] 10:12:34.298678 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25423] 10:12:34.298736 read(14,  <unfinished ...>
[pid 25411] 10:12:34.298763 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25426] 10:12:34.298792 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25423] 10:12:34.298821 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25411] 10:12:34.298839 sendto(16, "\273^\1\0\0\1\0\0\0\0\0\0\6remote\23phoenixmarriottmesa\3com\0\0\1\0\1", 48, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25426] 10:12:34.298972 <... open resumed> ) = 7
[pid 25423] 10:12:34.298991 read(14,  <unfinished ...>
[pid 25411] 10:12:34.299014 <... sendto resumed> ) = 48
[pid 25426] 10:12:34.299035 fstat(7,  <unfinished ...>
[pid 25423] 10:12:34.299057 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25411] 10:12:34.299074 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25426] 10:12:34.299164 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25423] 10:12:34.299195 read(14,  <unfinished ...>
[pid 25426] 10:12:34.299220 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25423] 10:12:34.299256 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25426] 10:12:34.299275 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25423] 10:12:34.299465 read(14,  <unfinished ...>
[pid 25426] 10:12:34.299499 close(7)    = 0
[pid 25423] 10:12:34.299532 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25426] 10:12:34.299553 munmap(0x7fcf4086b000, 4096) = 0
[pid 25423] 10:12:34.299606 read(14,  <unfinished ...>
[pid 25426] 10:12:34.299633 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25423] 10:12:34.299688 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25426] 10:12:34.299710 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25423] 10:12:34.299829 read(14,  <unfinished ...>
[pid 25426] 10:12:34.299858 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, 8) = 0
[pid 25423] 10:12:34.299906 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25426] 10:12:34.299933 clone( <unfinished ...>
[pid 25423] 10:12:34.300181 read(14,  <unfinished ...>
[pid 25426] 10:12:34.300206 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fcf40855a90) = 25431
[pid 25426] 10:12:34.300253 wait4(25431,  <unfinished ...>
[pid 25423] 10:12:34.300287 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25423] 10:12:34.300371 read(14, "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25423] 10:12:34.300476 read(14, "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25423] 10:12:34.300561 read(14, "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25423] 10:12:34.300615 read(14, "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25423] 10:12:34.300703 read(14, "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25423] 10:12:34.300769 brk(0x17c0000) = 0x17c0000
[pid 25423] 10:12:34.300846 read(14, "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25423] 10:12:34.300945 read(14, "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25423] 10:12:34.301049 read(14, "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25423] 10:12:34.301155 read(14, "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25423] 10:12:34.301253 read(14, "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25423] 10:12:34.301322 read(14, "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25423] 10:12:34.301576 read(14, "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25423] 10:12:34.301691 read(14, "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25423] 10:12:34.301791 read(14, "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25423] 10:12:34.301960 read(14, "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25423] 10:12:34.302068 read(14, "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25423] 10:12:34.302168 read(14, "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25423] 10:12:34.302296 read(14, ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25423] 10:12:34.302454 read(14, "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25423] 10:12:34.302557 read(14, "", 4096) = 0
[pid 25423] 10:12:34.302607 close(14)   = 0
[pid 25423] 10:12:34.302644 munmap(0x7f54cb353000, 4096) = 0
[pid 25423] 10:12:34.303439 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 14
[pid 25423] 10:12:34.303497 fstat(14, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.303547 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb353000
[pid 25423] 10:12:34.303586 read(14, "MemTotal:        1048576 kB\nMemFree:          261516 kB\nCached:           327792 kB\nBuffers:               0 kB\nActive:           289776 kB\nInactive:         467100 kB\nActive(anon):     159284 kB\nInactive(anon):   277604 kB\nActive(file):     130492 kB\nInac"..., 1024) = 588
[pid 25423] 10:12:34.303665 close(14)   = 0
[pid 25423] 10:12:34.303704 munmap(0x7f54cb353000, 4096) = 0
[pid 25423] 10:12:34.304485 alarm(300)  = 0
[pid 25423] 10:12:34.304554 brk(0x17e1000) = 0x17e1000
[pid 25423] 10:12:34.304636 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2r\340\213\226\352`0\303\371\325\263\346\17I\347\312\225\6\313\304\5\r\241\342\302\2609G\270\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258) = 258
[pid 25423] 10:12:34.304720 read(11, Process 25430 attached
 <unfinished ...>
[pid 25430] 10:12:34.304789 set_robust_list(0x7f380d40eaa0, 24) = 0
[pid 25430] 10:12:34.304846 geteuid()   = 0
[pid 25430] 10:12:34.304886 geteuid()   = 0
[pid 25430] 10:12:34.304920 getegid()   = 12
[pid 25430] 10:12:34.304956 setgid(12)  = 0
[pid 25430] 10:12:34.304997 setuid(47)  = 0
[pid 25430] 10:12:34.306858 brk(0x23ba000) = 0x23ba000
[pid 25430] 10:12:34.307290 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25430] 10:12:34.307355 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25430] 10:12:34.307418 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25430] 10:12:34.307468 read(7, "v\31\f\31\372;[{\265L\2455\333*\r\262\227\230D;v\264\373\16F\210W\326\17\21\323\363\330@vi\3754\364\\\213\310\0354\223YD\36", 48) = 48
[pid 25430] 10:12:34.307521 close(7)    = 0
[pid 25430] 10:12:34.307573 getuid()    = 47
[pid 25430] 10:12:34.307741 exit_group(0) = ?
[pid 25430] 10:12:34.307960 +++ exited with 0 +++
[pid 25425] 10:12:34.307989 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25430
[pid 25425] 10:12:34.308015 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.308090 getcwd("/var/spool/exim", 16380) = 16
[pid 25425] 10:12:34.308166 open("/etc/localtime", O_RDONLY) = 7
[pid 25425] 10:12:34.308209 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.308256 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.308301 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.308342 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25425] 10:12:34.308472 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25425] 10:12:34.308508 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25425] 10:12:34.308563 close(7)    = 0
[pid 25425] 10:12:34.308599 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.308658 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25425] 10:12:34.308709 fcntl(7, F_GETFD) = 0
[pid 25425] 10:12:34.308742 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.308775 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5365100, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.308822 write(7, "2015-12-30 10:12:34 [25425] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMY-0006bs-1f\n", 92) = 92
[pid 25425] 10:12:34.308865 chdir("/var/spool/exim") = 0
[pid 25425] 10:12:34.308909 setgid(12)  = 0
[pid 25425] 10:12:34.308971 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25425] 10:12:34.309055 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25425] 10:12:34.309137 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25425] 10:12:34.309211 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25425] 10:12:34.309286 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25425] 10:12:34.309543 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25425] 10:12:34.309691 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25425] 10:12:34.309772 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25425] 10:12:34.309820 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.309877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.309916 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.309974 close(8)    = 0
[pid 25425] 10:12:34.310010 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.310110 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25425] 10:12:34.310207 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25425] 10:12:34.310328 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25425] 10:12:34.310549 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25425] 10:12:34.310674 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25425] 10:12:34.310730 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25425] 10:12:34.310772 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.310820 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.310859 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.310911 close(8)    = 0
[pid 25425] 10:12:34.310947 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.310994 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25425] 10:12:34.311036 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.311090 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.311127 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.311183 close(8)    = 0
[pid 25425] 10:12:34.311218 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.311278 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25425] 10:12:34.311321 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.311381 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.311500 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.311558 close(8)    = 0
[pid 25425] 10:12:34.311593 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.311707 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25425] 10:12:34.311844 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25425] 10:12:34.311947 read(6, "", 4096) = 0
[pid 25425] 10:12:34.311987 read(6, "", 4096) = 0
[pid 25425] 10:12:34.312023 close(6)    = 0
[pid 25425] 10:12:34.312057 munmap(0x7f380d425000, 4096) = 0
[pid 25425] 10:12:34.312111 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f380c2db790}, NULL, 8) = 0
[pid 25425] 10:12:34.312162 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-D", O_RDWR|O_APPEND) = 6
[pid 25425] 10:12:34.312210 fcntl(6, F_GETFD) = 0
[pid 25425] 10:12:34.312245 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.312278 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25425] 10:12:34.312319 fstat(6, {st_dev=makedev(144, 4215), st_ino=124785512, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.312373 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-H", O_RDONLY) = 8
[pid 25425] 10:12:34.312422 fstat(8, {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=983, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.312470 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d425000
[pid 25425] 10:12:34.312509 read(8, "1aEJMY-0006bs-1f-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 983
[pid 25425] 10:12:34.312587 read(8, "", 4096) = 0
[pid 25425] 10:12:34.312624 close(8)    = 0
[pid 25425] 10:12:34.312659 munmap(0x7f380d425000, 4096) = 0
[pid 25425] 10:12:34.312700 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.312754 open("/var/spool/exim/msglog/Y/1aEJMY-0006bs-1f", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25425] 10:12:34.312802 fcntl(8, F_GETFD) = 0
[pid 25425] 10:12:34.312836 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.312873 fchown(8, 47, 12) = 0
[pid 25425] 10:12:34.312916 fchmod(8, 0640) = 0
[pid 25425] 10:12:34.312957 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25425] 10:12:34.312993 fstat(8, {st_dev=makedev(144, 4215), st_ino=124794958, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.313040 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d425000
[pid 25425] 10:12:34.313078 lseek(8, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.313124 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25425] 10:12:34.313182 pipe([9, 10]) = 0
[pid 25425] 10:12:34.313222 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [], SA_RESTORER, 0x7f380c2db790}, 8) = 0
[pid 25425] 10:12:34.313266 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25432
[pid 25425] 10:12:34.313631 close(10)   = 0
[pid 25425] 10:12:34.313671 read(9, Process 25431 attached
 <unfinished ...>
[pid 25431] 10:12:34.313732 set_robust_list(0x7fcf40855aa0, 24) = 0
[pid 25431] 10:12:34.313789 geteuid()   = 0
[pid 25431] 10:12:34.313832 geteuid()   = 0
[pid 25431] 10:12:34.313866 getegid()   = 499
[pid 25431] 10:12:34.313902 setgid(12)  = 0
[pid 25431] 10:12:34.313936 setuid(47)  = 0
[pid 25431] 10:12:34.315546 brk(0x1ea8000) = 0x1ea8000
[pid 25431] 10:12:34.315940 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25431] 10:12:34.315998 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25431] 10:12:34.316051 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25431] 10:12:34.316092 read(7, "\"\240!&\367\225\231\313\212%\256\360koI\234\2225\261^\\\177,P<\364Mb\272\360\25\n\224\332\0334v\350P[J\276\r\350\354\312\325\222", 48) = 48
[pid 25431] 10:12:34.316133 close(7)    = 0
[pid 25431] 10:12:34.316180 getuid()    = 47
[pid 25431] 10:12:34.316340 exit_group(0) = ?
[pid 25431] 10:12:34.316620 +++ exited with 0 +++
[pid 25426] 10:12:34.316651 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25431
[pid 25426] 10:12:34.316676 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, 8) = 0
[pid 25426] 10:12:34.316736 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25426] 10:12:34.316807 open("/etc/localtime", O_RDONLY) = 7
[pid 25426] 10:12:34.316854 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.316900 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.316946 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.316981 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25426] 10:12:34.317027 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25426] 10:12:34.317060 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25426] 10:12:34.317111 close(7)    = 0
[pid 25426] 10:12:34.317146 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.317194 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25426] 10:12:34.317239 fcntl(7, F_GETFD) = 0
[pid 25426] 10:12:34.317270 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25426] 10:12:34.317301 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5365192, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.317347 write(7, "2015-12-30 10:12:34 [25426] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25426] 10:12:34.317387 chdir("/var/spool/exim") = 0
[pid 25426] 10:12:34.317430 geteuid()   = 0
[pid 25426] 10:12:34.317462 getegid()   = 499
[pid 25426] 10:12:34.317504 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.317546 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.317590 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.317625 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.317670 close(8)    = 0
[pid 25426] 10:12:34.317704 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.317763 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25426] 10:12:34.317818 read(8, "65536\n", 31) = 6
[pid 25426] 10:12:34.317853 close(8)    = 0
[pid 25426] 10:12:34.317890 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.317930 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.317976 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.318010 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.318045 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.318093 read(8, "", 4096) = 0
[pid 25426] 10:12:34.318128 close(8)    = 0
[pid 25426] 10:12:34.318160 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.318197 setgroups(1, [12]) = 0
[pid 25426] 10:12:34.318232 setgid(12)  = 0
[pid 25426] 10:12:34.318264 setuid(47)  = 0
[pid 25426] 10:12:34.318321 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25426] 10:12:34.318409 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25426] 10:12:34.318623 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25426] 10:12:34.318697 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25426] 10:12:34.318770 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25426] 10:12:34.318857 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25426] 10:12:34.318967 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25426] 10:12:34.319037 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.319079 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.319125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.319161 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.319206 close(8)    = 0
[pid 25426] 10:12:34.319238 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.319334 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25426] 10:12:34.319513 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25426] 10:12:34.319639 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25426] 10:12:34.319760 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25426] 10:12:34.319876 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25426] 10:12:34.319931 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.319972 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.320017 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.320053 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.320101 close(8)    = 0
[pid 25426] 10:12:34.320134 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.320179 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.320219 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.320263 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.320297 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.320344 close(8)    = 0
[pid 25426] 10:12:34.320376 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.320437 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25426] 10:12:34.320478 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25426] 10:12:34.320529 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.320571 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25426] 10:12:34.320619 close(8)    = 0
[pid 25426] 10:12:34.320652 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.320756 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25426] 10:12:34.320883 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25426] 10:12:34.320983 read(6, "", 4096) = 0
[pid 25426] 10:12:34.321020 read(6, "", 4096) = 0
[pid 25426] 10:12:34.321054 close(6)    = 0
[pid 25426] 10:12:34.321087 munmap(0x7fcf4086c000, 4096) = 0
[pid 25426] 10:12:34.321125 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25426] 10:12:34.321164 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.321214 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086c000
[pid 25426] 10:12:34.321250 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.321298 close(6)    = 0
[pid 25426] 10:12:34.321331 munmap(0x7fcf4086c000, 4096) = 0
[pid 25426] 10:12:34.321380 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25423] 10:12:34.321583 <... read resumed> "\26\3\3\0;\2\0", 7) = 7
[pid 25426] 10:12:34.321619 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.321719 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0},  <unfinished ...>
[pid 25423] 10:12:34.321753 read(11,  <unfinished ...>
[pid 25426] 10:12:34.321776 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25426] 10:12:34.321798 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25423] 10:12:34.321836 <... read resumed> "\0007\3\3V\204\2r\322\366 \357\364%0\16\316MOc\330\205 \372C\361b\247\221\264\344\377\\tHO\0\300/\0\0\17\377\1\0\1\0\0#\0\0\0\v\0\2\1\0", 57) = 57
[pid 25426] 10:12:34.321860 fstat(0,  <unfinished ...>
[pid 25423] 10:12:34.321910 read(11,  <unfinished ...>
[pid 25426] 10:12:34.321936 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130166360, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25423] 10:12:34.321965 <... read resumed> "\26\3\3\16*", 5) = 5
[pid 25426] 10:12:34.321984 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.322014 read(11,  <unfinished ...>
[pid 25426] 10:12:34.322042 <... mmap resumed> ) = 0x7fcf4086c000
[pid 25423] 10:12:34.322058 <... read resumed> "\v\0\16&\0\16#\0\6\2450\202\6\2410\202\5\211\240\3\2\1\2\2\10R\357\363\340\22\17\266\0040\r\6\t*\206H\206\367\r\1\1\v\5\0000I1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\n\23\nGoogle Inc1%0#\6\3U\4\3\23\34Google Internet Authority G20\36\27\r151210182812Z\27\r160309000000Z0g1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\10\f\nCalifornia1\0260\24\6\3U\4\7\f\rMountain View1\0230\21\6\3U\4\n\f\nGoogle Inc1\0260\24\6\3U\4\3\f\rmx.google"..., 3626) = 3626
[pid 25426] 10:12:34.322082 read(0, "To:  weddings@hillcrestgolfclub.com, kcarter@scottsdalegolfgroup.com, hillcrestgolfclub@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tyle"..., 4096) = 2132
[pid 25426] 10:12:34.322531 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.322610 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25426] 10:12:34.322693 fchown(6, 47, 12) = 0
[pid 25426] 10:12:34.322734 fchmod(6, 0640) = 0
[pid 25426] 10:12:34.322773 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25426] 10:12:34.322812 fstat(6, {st_dev=makedev(144, 4215), st_ino=124798116, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.322859 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086b000
[pid 25426] 10:12:34.322903 lseek(6, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.322939 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25426] 10:12:34.323032 read(0, "", 4096) = 0
[pid 25426] 10:12:34.323070 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.323109 write(6, "1aEJMY-0006c6-AN-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25426] 10:12:34.323156 fsync(6 <unfinished ...>
[pid 25423] 10:12:34.323790 read(11, "\26\3\3\1M", 5) = 5
[pid 25423] 10:12:34.323837 read(11, "\f\0\1I\3\0\27A\4\2428\261\273\354T\177\337\377\3717\263\345x\307e\r\\\314\220\213\301\270\310\230}\324\247\342s\270\256\255\350\262\37\311\262\37\364Z\357@\335\272(*\341\335\26\366\177\"CZ\n5c\333\330Y\271|\361\4\1\1\0]>\3229\t\363\1\325E\306\3\3C\305H\334\313\324\360\241\2\10\240>\242\371lh\240\307\201\221\303\260\10!u\367\352j\4T\360\212x\10\264\3043\202\254\\YOf\244\265\f\5@\302s\342\360\365\320\367\317\221\240\272Vx\2753\34I\32\273\324\35h\207\35\306m|\243\347A\26\1\26*w\276\272\231\33\22.\372 \241\tN\245\257\215\303\332\\\353\377T~\t\264\270\312\336\1'\26630d\375\211M\276\225\263\16Xr\212?\23\314(\36\353\252\352\366\2425\376\345\340\211j\24\16\36\307\3367!\342O\206\222Go\"r\5\312$\1\252\246\345\212\254d\212"..., 333) = 333
[pid 25423] 10:12:34.324031 read(11,  <unfinished ...>
[pid 25426] 10:12:34.324065 <... fsync resumed> ) = 0
[pid 25426] 10:12:34.324102 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.324193 fstat(6, {st_dev=makedev(144, 4215), st_ino=124798116, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.324339 brk(0x1ea8000) = 0x1ea8000
[pid 25426] 10:12:34.324500 getuid()    = 47
[pid 25426] 10:12:34.324544 geteuid()   = 47
[pid 25426] 10:12:34.324580 getgid()    = 12
[pid 25426] 10:12:34.324614 getegid()   = 12
[pid 25426] 10:12:34.324722 open("/dev/urandom", O_RDONLY) = 8
[pid 25426] 10:12:34.324770 read(8, "\30w!\225", 4) = 4
[pid 25426] 10:12:34.324808 close(8)    = 0
[pid 25426] 10:12:34.324934 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25426] 10:12:34.325052 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7bea0) = -1 EINVAL (Invalid argument)
[pid 25426] 10:12:34.325098 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25426] 10:12:34.325137 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7bea0) = -1 EINVAL (Invalid argument)
[pid 25426] 10:12:34.325173 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25426] 10:12:34.325208 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7beb0) = -1 EINVAL (Invalid argument)
[pid 25426] 10:12:34.325244 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25426] 10:12:34.325281 open("/dev/null", O_RDONLY) = 8
[pid 25426] 10:12:34.325323 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7bf80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.325359 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.325394 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25426] 10:12:34.325435 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fcf3f722790}, 8) = 0
[pid 25426] 10:12:34.325478 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fcf3f722790}, 8) = 0
[pid 25426] 10:12:34.325774 read(8, "", 8192) = 0
[pid 25426] 10:12:34.325829 close(8)    = 0
[pid 25426] 10:12:34.326079 brk(0x1ec9000) = 0x1ec9000
[pid 25426] 10:12:34.326235 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25426] 10:12:34.326313 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25426] 10:12:34.326364 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7bdb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.326408 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.326541 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25426] 10:12:34.327590 brk(0x1eea000) = 0x1eea000
[pid 25426] 10:12:34.327825 read(8,  <unfinished ...>
[pid 25423] 10:12:34.327864 <... read resumed> "\26\3\3\0\4", 5) = 5
[pid 25423] 10:12:34.327889 read(11, "\16\0\0\0", 4) = 4
[pid 25426] 10:12:34.328373 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25426] 10:12:34.329314 brk(0x1f0b000) = 0x1f0b000
[pid 25426] 10:12:34.330780 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25423] 10:12:34.332146 write(11, "\26\3\3\0F\20\0\0BA\4J0\31e\252\20\332\242\32Z\352\362\v\243\t1\\%$\320N^TS\320fw\266\203\347\353\335g.\247\332s\177\352oj`\335\254\274\0358#E\3667[C9\244\203<\307\n\223\205)\35\222\24\3\3\0\1\1\26\3\3\0(\1,~\337e\2162\223\217,\354\2669l(\23$\215q\217\2\331AjZ*C.\342\207k\v(d\274\246\343t\270\227", 126 <unfinished ...>
[pid 25426] 10:12:34.332537 brk(0x1f2c000) = 0x1f2c000
[pid 25426] 10:12:34.332833 read(8,  <unfinished ...>
[pid 25423] 10:12:34.332896 <... write resumed> ) = 126
[pid 25423] 10:12:34.332920 read(11,  <unfinished ...>
[pid 25426] 10:12:34.332950 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25426] 10:12:34.333229 read(8, "", 8192) = 0
[pid 25426] 10:12:34.333277 close(8)    = 0
[pid 25426] 10:12:34.333332 stat("/usr/share/amavis/amavis-filter", 0x7fcf3ef09880) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.333383 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25426] 10:12:34.333510 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25426] 10:12:34.333563 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25426] 10:12:34.333605 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7bdb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.333644 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.333699 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25426] 10:12:34.334131 stat("/etc/exim/perl/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334185 stat("/etc/exim/perl/warnings.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334227 stat("/usr/local/cpanel/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334268 stat("/usr/local/cpanel/warnings.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334308 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334355 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334398 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334514 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334562 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334606 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334648 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.334689 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.334745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25426] 10:12:34.334790 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7b7c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.334829 lseek(9, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.334873 brk(0x1f4d000) = 0x1f4d000
[pid 25426] 10:12:34.334933 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25426] 10:12:34.335249 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25426] 10:12:34.336044 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25426] 10:12:34.336174 brk(0x1f6e000) = 0x1f6e000
[pid 25426] 10:12:34.336588 read(9, "", 8192) = 0
[pid 25426] 10:12:34.336639 close(9)    = 0
[pid 25426] 10:12:34.337315 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25426] 10:12:34.338106 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25426] 10:12:34.338865 read(8, Process 25432 attached
 <unfinished ...>
[pid 25432] 10:12:34.338938 set_robust_list(0x7f380d40eaa0, 24) = 0
[pid 25432] 10:12:34.339031 close(9 <unfinished ...>
[pid 25426] 10:12:34.339056 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25432] 10:12:34.339473 <... close resumed> ) = 0
[pid 25432] 10:12:34.339513 geteuid()   = 0
[pid 25432] 10:12:34.339548 getegid()   = 12
[pid 25432] 10:12:34.339585 setgid(494) = 0
[pid 25432] 10:12:34.339618 setuid(495) = 0
[pid 25432] 10:12:34.339671 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25432] 10:12:34.339727 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25432] 10:12:34.339827 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25432] 10:12:34.339875 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25432] 10:12:34.339913 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25432] 10:12:34.339956 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25432] 10:12:34.339999 close(9)    = 0
[pid 25432] 10:12:34.340032 munmap(0x7f380d424000, 4096) = 0
[pid 25432] 10:12:34.340112 brk(0x23bb000) = 0x23bb000
[pid 25432] 10:12:34.340305 lseek(6, 19, SEEK_SET) = 19
[pid 25432] 10:12:34.340514 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2373) = 1858
[pid 25426] 10:12:34.340757 read(8,  <unfinished ...>
[pid 25432] 10:12:34.340999 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25426] 10:12:34.341031 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25426] 10:12:34.341218 brk(0x1f8f000 <unfinished ...>
[pid 25425] 10:12:34.341252 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25425] 10:12:34.341276 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341296 <... write resumed> ) = 4
[pid 25432] 10:12:34.341315 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.341336 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25425] 10:12:34.341355 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341374 <... write resumed> ) = 4
[pid 25432] 10:12:34.341391 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.341475 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.341500 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341527 <... write resumed> ) = 4
[pid 25432] 10:12:34.341545 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25425] 10:12:34.341567 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25425] 10:12:34.341590 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341610 <... write resumed> ) = 4
[pid 25432] 10:12:34.341633 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.341655 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.341674 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341692 <... write resumed> ) = 4
[pid 25432] 10:12:34.341709 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25425] 10:12:34.341737 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25425] 10:12:34.341762 read(9,  <unfinished ...>
[pid 25432] 10:12:34.341782 <... write resumed> ) = 40
[pid 25432] 10:12:34.341799 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25425] 10:12:34.341821 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.341843 wait4(-1,  <unfinished ...>
[pid 25432] 10:12:34.341862 <... write resumed> ) = 4
[pid 25432] 10:12:34.341879 close(10)   = 0
[pid 25432] 10:12:34.341920 exit_group(0) = ?
[pid 25432] 10:12:34.342128 +++ exited with 0 +++
[pid 25425] 10:12:34.342155 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25432
[pid 25425] 10:12:34.342177 close(9)    = 0
[pid 25425] 10:12:34.342212 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.342272 brk(0x23ba000) = 0x23ba000
[pid 25425] 10:12:34.342315 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25425] 10:12:34.342364 alarm(60)   = 0
[pid 25425] 10:12:34.342397 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25425] 10:12:34.342504 alarm(0)    = 60
[pid 25425] 10:12:34.342584 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.342631 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25425] 10:12:34.342684 read(10, "cpu  123045 1342369 395082 67343095 2509 0 0 0\ncpu0 123045 1342369 395082 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58237612\nbtime 1450798266\nprocesses 892910\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25425] 10:12:34.342747 close(10)   = 0
[pid 25425] 10:12:34.342841 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.342903 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25425] 10:12:34.342943 fcntl(10, F_GETFD) = 0
[pid 25425] 10:12:34.342974 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.343010 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25425] 10:12:34.343062 close(10)   = 0
[pid 25425] 10:12:34.343110 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.343151 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25425] 10:12:34.343249 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d3dd000
[pid 25425] 10:12:34.343402 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25425] 10:12:34.343516 fcntl(10, F_GETFD) = 0
[pid 25425] 10:12:34.343548 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.343588 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.343675 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25425] 10:12:34.343769 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25425] 10:12:34.343830 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25425] 10:12:34.343898 close(10)   = 0
[pid 25425] 10:12:34.343958 munmap(0x7f380d3dd000, 200704) = 0
[pid 25425] 10:12:34.344025 close(9)    = 0
[pid 25425] 10:12:34.344082 open("/etc/localdomains", O_RDONLY) = 9
[pid 25425] 10:12:34.344127 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.344179 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.344223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.344259 lseek(9, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.344291 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:34.344356 stat("/jail_owner", 0x7fffbdaa9dd0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.344404 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.344555 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.344610 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.344664 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.344707 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.344771 open("/etc/demouids", O_RDONLY) = 10
[pid 25425] 10:12:34.344812 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.344858 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.344900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d423000
[pid 25425] 10:12:34.344935 lseek(10, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.344967 read(10, "", 4096) = 0
[pid 25425] 10:12:34.345006 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.345170 getuid()    = 0
[pid 25425] 10:12:34.345210 geteuid()   = 0
[pid 25425] 10:12:34.345243 getgid()    = 12
[pid 25425] 10:12:34.345275 getegid()   = 12
[pid 25425] 10:12:34.345378 open("/dev/urandom", O_RDONLY) = 11
[pid 25425] 10:12:34.345496 read(11, "\25W\206z", 4) = 4
[pid 25425] 10:12:34.345536 close(11)   = 0
[pid 25425] 10:12:34.345668 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25425] 10:12:34.345780 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.345823 lseek(0, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.345858 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.345893 lseek(1, 0, SEEK_CUR) = 0
[pid 25423] 10:12:34.345938 <... read resumed> "\26\3\3\0\256", 5) = 5
[pid 25423] 10:12:34.345962 read(11, "\4\0\0\252\0\1\211\300\0\244C\34\306\3156\251\362MsK\235\215e\353\211V\t\312R\320\351}\242\257\331y\333\271\215\270\201\3\323\31|\0377O\213y,\271\33m\306\300\260\352\243aarw^\306s\243=\0301\330\334-\\.\21\311\257\224\227\266(\370Jl\341\36\322\\A\375\227\336E\234T/\240>.c@\263\204@\341\202\3554\27\6\203\3550\332nE^\272%\357\246\275\276w\274\247)Q\204\207Dx\1M\345.\324\211\r\262\333C\340\274\274F\200?8yR\7\275\25-\26\256!\271\357\31g\275\2276\203\212\36\376\33\365C\344", 174) = 174
[pid 25423] 10:12:34.346020 read(11, "\24\3\3\0\1", 5) = 5
[pid 25423] 10:12:34.346057 read(11, "\1", 1) = 1
[pid 25423] 10:12:34.346133 read(11, "\26\3\3\0(", 5) = 5
[pid 25423] 10:12:34.346171 read(11, "\0\0\0\0\0\0\0\0o*W\275$7Y_q\255\370-\302\353R\224T\340a\300\206\212\210ar3\262\353\302\\%\270", 40) = 40
[pid 25423] 10:12:34.346242 alarm(0)    = 300
[pid 25423] 10:12:34.346309 write(11, "\27\3\3\0009\1,~\337e\2162\224h\205\324\262\372\251\321\242I\245\307\211\240\275<\217\230f5\232`&\5\1Er\355\v\327\235\245\332\vH\0216\303\273v\nb\357\356\242pG\355\324>", 62) = 62
[pid 25425] 10:12:34.346374 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4370) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.346482 lseek(2, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.346525 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.346553 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25425] 10:12:34.346588 <... open resumed> ) = 11
[pid 25425] 10:12:34.346615 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4440) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.346654 lseek(11, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.346691 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.346726 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.346995 brk(0x23db000) = 0x23db000
[pid 25425] 10:12:34.347045 read(11, "", 8192) = 0
[pid 25425] 10:12:34.347090 close(11)   = 0
[pid 25425] 10:12:34.347389 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25425] 10:12:34.347530 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25425] 10:12:34.347572 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.347608 lseek(11, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.347660 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25425] 10:12:34.348520 brk(0x23fc000) = 0x23fc000
[pid 25425] 10:12:34.348918 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25425] 10:12:34.349777 brk(0x241d000) = 0x241d000
[pid 25425] 10:12:34.350217 read(11, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25425] 10:12:34.350914 brk(0x243e000) = 0x243e000
[pid 25425] 10:12:34.351376 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25425] 10:12:34.351744 read(11, "", 8192) = 0
[pid 25425] 10:12:34.351791 close(11)   = 0
[pid 25425] 10:12:34.351842 stat("/usr/share/amavis/amavis-filter", 0x7f380bac2880) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.351888 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25425] 10:12:34.351938 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25425] 10:12:34.351986 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25425] 10:12:34.352024 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa4270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.352059 lseek(11, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.352107 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25425] 10:12:34.352396 brk(0x245f000) = 0x245f000
[pid 25425] 10:12:34.352680 stat("/etc/exim/perl/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352729 stat("/etc/exim/perl/warnings.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352767 stat("/usr/local/cpanel/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352804 stat("/usr/local/cpanel/warnings.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352842 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352883 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352923 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.352961 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.353000 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.353039 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.353078 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.353116 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.353168 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25425] 10:12:34.353209 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa3c80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.353244 lseek(12, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.353294 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25425] 10:12:34.353702 read(12,  <unfinished ...>
[pid 25426] 10:12:34.353734 <... brk resumed> ) = 0x1f8f000
[pid 25426] 10:12:34.354190 read(8,  <unfinished ...>
[pid 25425] 10:12:34.354223 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25425] 10:12:34.354851 brk(0x2480000 <unfinished ...>
[pid 25426] 10:12:34.354887 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25425] 10:12:34.355480 <... brk resumed> ) = 0x2480000
[pid 25425] 10:12:34.355690 read(12, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25428] 10:12:34.355784 <... select resumed> ) = 1 (in [11], left {299, 903353})
[pid 25428] 10:12:34.355822 recvfrom(11, "220 esa4.hilton.iphmx.com ESMTP\r\n", 4096, 0, NULL, NULL) = 33
[pid 25428] 10:12:34.355880 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25428] 10:12:34.355943 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25425] 10:12:34.356331 read(12,  <unfinished ...>
[pid 25426] 10:12:34.356784 brk(0x1fb0000 <unfinished ...>
[pid 25425] 10:12:34.356817 <... read resumed> "", 8192) = 0
[pid 25425] 10:12:34.356842 close(12)   = 0
[pid 25426] 10:12:34.357481 <... brk resumed> ) = 0x1fb0000
[pid 25426] 10:12:34.357676 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25426] 10:12:34.358211 read(8,  <unfinished ...>
[pid 25425] 10:12:34.358376 read(11, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25425] 10:12:34.359159 read(11,  <unfinished ...>
[pid 25426] 10:12:34.359192 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25423] 10:12:34.359588 <... select resumed> ) = 1 (in [11], left {299, 987025})
[pid 25423] 10:12:34.359631 read(11, "\27\3\3\0\262", 5) = 5
[pid 25423] 10:12:34.359672 read(11, "\0\0\0\0\0\0\0\1;\210\257E\214\355GUJ\234\203I\36\230\5@\203z\371X\327\323\255\352\262\322\224y\3128\20\246_N\275\215\305G\274R\232\226\22\346\261p\t^)u`\374;\261$!\314\320\266Y\355\324;\257\232\256\241\256PmcOf\231\177i\355\360\362\352|0\223#\331y\16\4\335L\17\255\0Sml)\352\312\252e\n'\316\300\346\235\245\314\220M>\206aY\\\207\0%{\262\210\7\303\376*\324\251\260v9\377\266)w)\310\275X\234\f\34~z[\263}\377t\317VH!\20\277M\303z\271'l\r\342{#0\266\301\260>", 178) = 178
[pid 25423] 10:12:34.359745 write(11, "\27\3\3\0r\1,~\337e\2162\225\264\v\253\237\177=2\0A\\\276\305]al\272\232\26\322\320\313\251sS\5zv\220\35W*\345x\331P\0G\2138-?\307\16(aK\10\323Ml\231\272\3207\0]\220t\17\21-\2036&\317\337\315\264\5\253\222\242]\262h\223J\364\302|\316\347\254n\224L\336\226\312\32\7\356\2419\356\345\212\f%\261i~\305\271\4\366", 119) = 119
[pid 25423] 10:12:34.359812 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25426] 10:12:34.360053 brk(0x1fd1000) = 0x1fd1000
[pid 25426] 10:12:34.360216 read(8,  <unfinished ...>
[pid 25425] 10:12:34.360246 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25426] 10:12:34.360490 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25426] 10:12:34.361127 read(8,  <unfinished ...>
[pid 25425] 10:12:34.361906 read(11,  <unfinished ...>
[pid 25426] 10:12:34.361941 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25426] 10:12:34.362409 brk(0x1ff2000 <unfinished ...>
[pid 25425] 10:12:34.362498 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25425] 10:12:34.363031 brk(0x24a1000 <unfinished ...>
[pid 25426] 10:12:34.363063 <... brk resumed> ) = 0x1ff2000
[pid 25426] 10:12:34.363398 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.363492 <... brk resumed> ) = 0x24a1000
[pid 25425] 10:12:34.363593 read(11,  <unfinished ...>
[pid 25426] 10:12:34.363624 <... stat resumed> 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.363646 stat("/usr/local/cpanel/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.363688 stat("/etc/exim/perl/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.363727 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25426] 10:12:34.363750 stat("/etc/exim/perl/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.364335 read(11,  <unfinished ...>
[pid 25426] 10:12:34.364371 stat("/usr/local/cpanel/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364469 stat("/usr/local/cpanel/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364520 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364565 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364606 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364645 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364685 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364725 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364765 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.364804 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.364858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25426] 10:12:34.364902 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7b7c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.364938 lseek(9, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.365000 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25426] 10:12:34.365235 lseek(9, 878, SEEK_SET) = 878
[pid 25426] 10:12:34.365278 lseek(9, 0, SEEK_CUR) = 878
[pid 25426] 10:12:34.365311 close(9)    = 0
[pid 25426] 10:12:34.365644 read(8,  <unfinished ...>
[pid 25425] 10:12:34.365677 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25425] 10:12:34.366170 brk(0x24c2000 <unfinished ...>
[pid 25426] 10:12:34.366204 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25426] 10:12:34.366856 read(8,  <unfinished ...>
[pid 25425] 10:12:34.366893 <... brk resumed> ) = 0x24c2000
[pid 25425] 10:12:34.367342 read(11,  <unfinished ...>
[pid 25426] 10:12:34.367376 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25426] 10:12:34.367578 brk(0x2013000) = 0x2013000
[pid 25425] 10:12:34.368492 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25425] 10:12:34.369064 read(11, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25425] 10:12:34.369435 brk(0x24e3000 <unfinished ...>
[pid 25426] 10:12:34.369760 read(8,  <unfinished ...>
[pid 25425] 10:12:34.369793 <... brk resumed> ) = 0x24e3000
[pid 25425] 10:12:34.370081 read(11,  <unfinished ...>
[pid 25426] 10:12:34.370111 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25426] 10:12:34.370337 brk(0x2034000 <unfinished ...>
[pid 25425] 10:12:34.370370 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25425] 10:12:34.370987 read(11,  <unfinished ...>
[pid 25426] 10:12:34.371019 <... brk resumed> ) = 0x2034000
[pid 25426] 10:12:34.372112 read(8,  <unfinished ...>
[pid 25425] 10:12:34.372239 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25425] 10:12:34.372553 brk(0x2504000) = 0x2504000
[pid 25425] 10:12:34.373112 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25426] 10:12:34.373148 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25423] 10:12:34.373190 <... select resumed> ) = 1 (in [11], left {299, 986664})
[pid 25423] 10:12:34.373218 read(11, "\27\3\3\0B", 5) = 5
[pid 25423] 10:12:34.373255 read(11, "\0\0\0\0\0\0\0\2%e\257\215s\330\35\26\337\373\217\212\245\220gr\346 ]\371\244co2\356\31\362\230z\331\355\367\364KI\263\254[\342\200\03307\236r\372\212\213p`B\326x\307Ks\337\35", 66) = 66
[pid 25423] 10:12:34.373301 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25426] 10:12:34.373502 brk(0x2055000) = 0x2055000
[pid 25426] 10:12:34.374279 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25425] 10:12:34.374319 <... stat resumed> 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374343 stat("/usr/local/cpanel/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374384 stat("/etc/exim/perl/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374478 stat("/etc/exim/perl/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374518 stat("/usr/local/cpanel/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374553 stat("/usr/local/cpanel/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374591 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374631 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374670 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374746 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374789 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374837 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.374875 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.374929 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25425] 10:12:34.374973 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa3c80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.375009 lseek(12, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.375062 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25425] 10:12:34.375287 lseek(12, 878, SEEK_SET) = 878
[pid 25425] 10:12:34.375329 lseek(12, 0, SEEK_CUR) = 878
[pid 25425] 10:12:34.375360 close(12)   = 0
[pid 25425] 10:12:34.375679 read(11, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25425] 10:12:34.376170 brk(0x2525000 <unfinished ...>
[pid 25426] 10:12:34.376207 <... stat resumed> 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376232 stat("/usr/local/cpanel/Errno.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376274 stat("/etc/exim/perl/Errno.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376311 stat("/etc/exim/perl/Errno.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376350 stat("/usr/local/cpanel/Errno.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376386 stat("/usr/local/cpanel/Errno.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376487 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376530 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376571 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376609 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376648 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.376686 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25426] 10:12:34.376739 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25426] 10:12:34.376782 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7b7c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.376817 lseek(9, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.376871 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25426] 10:12:34.377078 brk(0x2076000) = 0x2076000
[pid 25425] 10:12:34.377478 <... brk resumed> ) = 0x2525000
[pid 25425] 10:12:34.377620 read(11, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25426] 10:12:34.378596 lseek(9, 4868, SEEK_SET) = 4868
[pid 25426] 10:12:34.378651 lseek(9, 0, SEEK_CUR) = 4868
[pid 25426] 10:12:34.378685 close(9)    = 0
[pid 25426] 10:12:34.378740 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378784 stat("/usr/local/cpanel/Exporter.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378823 stat("/etc/exim/perl/Exporter.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378858 stat("/etc/exim/perl/Exporter.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378894 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378929 stat("/usr/local/cpanel/Exporter.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.378966 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.379013 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffef3f7b9d0) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.379054 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffef3f7ba70) = -1 ENOENT (No such file or directory)
[pid 25426] 10:12:34.379091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25426] 10:12:34.379145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25426] 10:12:34.379187 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffef3f7b7c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25426] 10:12:34.379222 lseek(9, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.379267 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25426] 10:12:34.379784 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.380102 brk(0x2546000 <unfinished ...>
[pid 25426] 10:12:34.380132 <... lseek resumed> ) = 2366
[pid 25426] 10:12:34.380153 lseek(9, 0, SEEK_CUR) = 2366
[pid 25426] 10:12:34.380185 close(9)    = 0
[pid 25426] 10:12:34.380570 read(8,  <unfinished ...>
[pid 25425] 10:12:34.380603 <... brk resumed> ) = 0x2546000
[pid 25425] 10:12:34.380747 read(11,  <unfinished ...>
[pid 25426] 10:12:34.380774 <... read resumed> "", 8192) = 0
[pid 25426] 10:12:34.380797 close(8)    = 0
[pid 25426] 10:12:34.381023 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.381055 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25426] 10:12:34.381467 <... open resumed> ) = 8
[pid 25426] 10:12:34.381499 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25426] 10:12:34.381551 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086a000
[pid 25426] 10:12:34.381588 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25426] 10:12:34.381636 close(8)    = 0
[pid 25426] 10:12:34.381670 munmap(0x7fcf4086a000, 4096) = 0
[pid 25426] 10:12:34.381759 lseek(6, 19, SEEK_SET) = 19
[pid 25426] 10:12:34.381862 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.381903 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.381937 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.381971 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382003 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382039 alarm(300)  = 0
[pid 25426] 10:12:34.382072 alarm(0)    = 300
[pid 25426] 10:12:34.382103 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382136 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382175 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382209 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382242 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fcf3f722790}, NULL, 8) = 0
[pid 25426] 10:12:34.382277 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, 8) = 0
[pid 25426] 10:12:34.382316 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, 8) = 0
[pid 25426] 10:12:34.382358 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.382512 open("/var/spool/exim/input/Y/hdr.25426", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25425] 10:12:34.383348 brk(0x2567000 <unfinished ...>
[pid 25426] 10:12:34.383381 fchown(8, 47, 12) = 0
[pid 25426] 10:12:34.383476 fchmod(8, 0640) = 0
[pid 25426] 10:12:34.383513 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25426] 10:12:34.383551 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799950, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.383598 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086a000
[pid 25426] 10:12:34.383636 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.383685 write(8, "1aEJMY-0006c6-AN-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 468) = 468
[pid 25426] 10:12:34.383733 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799950, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=468, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.383782 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006c6-AN; Wed, 30 Dec 2015 10:12:34 -0600\n111T To:  weddings@hillcrestgolfclub.com, kcarter@scottsdalegolfg"..., 594) = 594
[pid 25426] 10:12:34.383820 fsync(8 <unfinished ...>
[pid 25425] 10:12:34.383871 <... brk resumed> ) = 0x2567000
[pid 25425] 10:12:34.384114 read(11, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25426] 10:12:34.384479 <... fsync resumed> ) = 0
[pid 25426] 10:12:34.384509 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799950, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1062, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.384559 close(8)    = 0
[pid 25426] 10:12:34.384592 munmap(0x7fcf4086a000, 4096) = 0
[pid 25426] 10:12:34.384636 rename("/var/spool/exim/input/Y/hdr.25426", "/var/spool/exim/input/Y/1aEJMY-0006c6-AN-H") = 0
[pid 25426] 10:12:34.384702 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25426] 10:12:34.384742 fsync(8)    = 0
[pid 25426] 10:12:34.384775 close(8)    = 0
[pid 25426] 10:12:34.384808 fstat(6, {st_dev=makedev(144, 4215), st_ino=124798116, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.384871 open("/var/spool/exim/msglog/Y/1aEJMY-0006c6-AN", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25426] 10:12:34.384939 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25426] 10:12:34.384974 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799960, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.385017 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcf4086a000
[pid 25426] 10:12:34.385053 lseek(8, 0, SEEK_CUR) = 0
[pid 25426] 10:12:34.385086 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.385141 write(8, "2015-12-30 10:12:34 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2413 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25426] 10:12:34.385183 close(8)    = 0
[pid 25426] 10:12:34.385215 munmap(0x7fcf4086a000, 4096) = 0
[pid 25426] 10:12:34.385254 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.385310 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25426] 10:12:34.385361 close(7)    = 0
[pid 25426] 10:12:34.385472 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25426] 10:12:34.385523 fcntl(7, F_GETFD) = 0
[pid 25426] 10:12:34.385555 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25426] 10:12:34.385589 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5365293, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25426] 10:12:34.385640 write(7, "2015-12-30 10:12:34 [25426] 1aEJMY-0006c6-AN <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2413 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for weddings@hillcrestgolfclub.com kcarter@scottsda"..., 347) = 347
[pid 25426] 10:12:34.385683 close(6)    = 0
[pid 25426] 10:12:34.385718 munmap(0x7fcf4086b000, 4096) = 0
[pid 25426] 10:12:34.385753 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, 8) = 0
[pid 25426] 10:12:34.385792 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fcf3e46b6a0}, 8) = 0
[pid 25426] 10:12:34.385831 open("/proc/loadavg", O_RDONLY) = 6
[pid 25426] 10:12:34.385883 read(6, "0.18 0.08 0.01 2/246 25432\n", 40) = 27
[pid 25426] 10:12:34.385921 close(6)    = 0
[pid 25426] 10:12:34.385969 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fcf40855a90) = 25433
[pid 25426] 10:12:34.386590 exit_group(0) = ?
[pid 25426] 10:12:34.386877 +++ exited with 0 +++
[pid 25389] 10:12:34.386911 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25426
[pid 25389] 10:12:34.386935 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:34.387063 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:34.387104 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25434
[pid 25389] 10:12:34.387586 close(5)    = 0
[pid 25389] 10:12:34.387622 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:34.387661 fstat(6, {st_dev=makedev(0, 8), st_ino=2130166644, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25389] 10:12:34.387707 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:34.387752 write(6, "To:  rochelle.samms@radisson.com, radissonphx-north@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style"..., 2096) = 2096
[pid 25389] 10:12:34.387791 close(6)    = 0
[pid 25389] 10:12:34.387822 wait4(25434,  <unfinished ...>
[pid 25425] 10:12:34.388633 stat("/usr/local/cpanel/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388690 stat("/usr/local/cpanel/Errno.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388731 stat("/etc/exim/perl/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388766 stat("/etc/exim/perl/Errno.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388802 stat("/usr/local/cpanel/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388837 stat("/usr/local/cpanel/Errno.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388873 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388915 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388955 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.388993 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.389032 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.389072 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.389133 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25425] 10:12:34.389176 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa3c80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.389211 lseek(12, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.389263 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25425] 10:12:34.389376 brk(0x2588000) = 0x2588000
[pid 25425] 10:12:34.389962 lseek(12, 4868, SEEK_SET) = 4868
[pid 25425] 10:12:34.390008 lseek(12, 0, SEEK_CUR) = 4868
[pid 25425] 10:12:34.390041 close(12)   = 0
[pid 25425] 10:12:34.390087 stat("/usr/local/cpanel/Exporter.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390128 stat("/usr/local/cpanel/Exporter.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390166 stat("/etc/exim/perl/Exporter.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390201 stat("/etc/exim/perl/Exporter.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390242 stat("/usr/local/cpanel/Exporter.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390278 stat("/usr/local/cpanel/Exporter.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390317 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390362 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fffbdaa3e90) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390472 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fffbdaa3f30) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.390516 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25425] 10:12:34.390569 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25425] 10:12:34.390610 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa3c80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.390645 lseek(12, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.390690 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25425] 10:12:34.391115 lseek(12, 2366, SEEK_SET) = 2366
[pid 25425] 10:12:34.391160 lseek(12, 0, SEEK_CUR) = 2366
[pid 25425] 10:12:34.391192 close(12)   = 0
[pid 25425] 10:12:34.391588 read(11, "", 8192) = 0
[pid 25425] 10:12:34.391644 close(11)   = 0
[pid 25425] 10:12:34.391862 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.391931 open("/etc/userdomains", O_RDONLY) = 11
[pid 25425] 10:12:34.391971 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.392019 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.392062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d422000
[pid 25425] 10:12:34.392098 lseek(11, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.392130 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25425] 10:12:34.392195 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25425] 10:12:34.392240 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.392285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d421000
[pid 25425] 10:12:34.392321 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.392378 close(12)   = 0
[pid 25425] 10:12:34.392487 munmap(0x7f380d421000, 4096) = 0
[pid 25425] 10:12:34.392548 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.392611 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.392682 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25425] 10:12:34.392723 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.392769 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.392811 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d421000
[pid 25425] 10:12:34.392846 lseek(12, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.392877 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25425] 10:12:34.392921 read(12, "", 4096) = 0
[pid 25425] 10:12:34.392986 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2915, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.393065 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY) = 13
[pid 25425] 10:12:34.393108 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbdaa6d70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.393144 lseek(13, 0, SEEK_CUR) = 0
[pid 25425] 10:12:34.393179 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2915, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.393223 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.393285 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2915
[pid 25425] 10:12:34.393834 read(13, "", 8192) = 0
[pid 25425] 10:12:34.393884 close(13)   = 0
[pid 25425] 10:12:34.393952 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.394023 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.394088 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.394163 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25425] 10:12:34.394208 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.394253 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d420000
[pid 25425] 10:12:34.394288 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.394339 close(13)   = 0
[pid 25425] 10:12:34.394378 munmap(0x7f380d420000, 4096) = 0
[pid 25425] 10:12:34.394503 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.394555 pipe([13, 14]) = 0
[pid 25425] 10:12:34.394590 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.394630 close(10)   = 0
[pid 25425] 10:12:34.394663 munmap(0x7f380d423000, 4096) = 0
[pid 25425] 10:12:34.394698 close(11)   = 0
[pid 25425] 10:12:34.394729 munmap(0x7f380d422000, 4096) = 0
[pid 25425] 10:12:34.394763 close(12)   = 0
[pid 25425] 10:12:34.394794 munmap(0x7f380d421000, 4096) = 0
[pid 25425] 10:12:34.394827 close(9)    = 0
[pid 25425] 10:12:34.394859 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.394893 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25435
Process 25434 attached
[pid 25434] 10:12:34.395212 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25434] 10:12:34.395262 close(6)    = 0
[pid 25434] 10:12:34.395296 dup2(5, 0)  = 0
[pid 25434] 10:12:34.395329 close(5)    = 0
[pid 25434] 10:12:34.395368 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25425] 10:12:34.395917 close(14)   = 0
[pid 25425] 10:12:34.395953 read(13,  <unfinished ...>
[pid 25434] 10:12:34.395988 brk(0)      = 0x257a000
[pid 25434] 10:12:34.396039 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e757b000
[pid 25434] 10:12:34.396085 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.396137 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25434] 10:12:34.396175 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.396219 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f77e7571000
[pid 25434] 10:12:34.396252 close(5)    = 0
[pid 25434] 10:12:34.396292 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25434] 10:12:34.396331 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.396371 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.396500 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f77e713c000
[pid 25434] 10:12:34.396536 mprotect(0x7f77e7159000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.396571 mmap(0x7f77e7358000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f77e7358000
[pid 25434] 10:12:34.396613 mmap(0x7f77e735c000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f77e735c000
[pid 25434] 10:12:34.396650 close(5)    = 0
[pid 25434] 10:12:34.396690 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25434] 10:12:34.396730 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.396768 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.396812 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f77e6f38000
[pid 25434] 10:12:34.396846 mprotect(0x7f77e6f3a000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.396880 mmap(0x7f77e713a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f77e713a000
[pid 25434] 10:12:34.396923 close(5)    = 0
[pid 25434] 10:12:34.396961 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25434] 10:12:34.397009 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.397047 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.397090 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e7570000
[pid 25434] 10:12:34.397127 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f77e6ba4000
[pid 25434] 10:12:34.397161 mprotect(0x7f77e6d2e000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.397194 mmap(0x7f77e6f2e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f77e6f2e000
[pid 25434] 10:12:34.397234 mmap(0x7f77e6f33000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f77e6f33000
[pid 25434] 10:12:34.397275 close(5)    = 0
[pid 25434] 10:12:34.397328 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e756f000
[pid 25434] 10:12:34.397366 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e756e000
[pid 25434] 10:12:34.397478 arch_prctl(ARCH_SET_FS, 0x7f77e756f700) = 0
[pid 25434] 10:12:34.397618 mprotect(0x7f77e6f2e000, 16384, PROT_READ) = 0
[pid 25434] 10:12:34.397661 mprotect(0x7f77e713a000, 4096, PROT_READ) = 0
[pid 25434] 10:12:34.397742 mprotect(0x7f77e757c000, 4096, PROT_READ) = 0
[pid 25434] 10:12:34.397777 munmap(0x7f77e7571000, 39387) = 0
[pid 25434] 10:12:34.397844 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.397890 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25434] 10:12:34.397942 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff457ee280) = -1 EINVAL (Invalid argument)
[pid 25434] 10:12:34.398005 brk(0)      = 0x257a000
[pid 25434] 10:12:34.398081 brk(0x259b000) = 0x259b000
[pid 25434] 10:12:34.398137 getuid()    = 503
[pid 25434] 10:12:34.398172 getgid()    = 500
[pid 25434] 10:12:34.398203 geteuid()   = 503
[pid 25434] 10:12:34.398233 getegid()   = 500
[pid 25434] 10:12:34.398272 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.398342 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
[pid 25434] 10:12:34.398396 fstat(5, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.398501 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e757a000
[pid 25434] 10:12:34.398536 read(5, "MemTotal:        1048576 kB\nMemFree:          257108 kB\nCached:           327932 kB\nBuffers:               0 kB\nActive:           294256 kB\nInactive:         467116 kB\nActive(anon):     163640 kB\nInactive(anon):   277604 kB\nActive(file):     130616 kB\nInac"..., 1024) = 588
[pid 25434] 10:12:34.398621 close(5)    = 0
[pid 25434] 10:12:34.398657 munmap(0x7f77e757a000, 4096) = 0
[pid 25434] 10:12:34.398726 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25434] 10:12:34.398767 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.398809 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25434] 10:12:34.398844 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.398879 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25434] 10:12:34.398913 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.398949 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.398983 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.399022 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25434] 10:12:34.399100 getcwd("/home/finest09/public_html/includes", 4096) = 36
[pid 25434] 10:12:34.399147 getpid()    = 25434
[pid 25434] 10:12:34.399189 getppid()   = 25389
[pid 25434] 10:12:34.399229 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25434] 10:12:34.399283 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.399335 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.399380 geteuid()   = 503
[pid 25434] 10:12:34.399491 getegid()   = 500
[pid 25434] 10:12:34.399524 getuid()    = 503
[pid 25434] 10:12:34.399553 getgid()    = 500
[pid 25434] 10:12:34.399583 access("/bin/sh", X_OK) = 0
[pid 25434] 10:12:34.399618 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.399663 geteuid()   = 503
[pid 25434] 10:12:34.399692 getegid()   = 500
[pid 25434] 10:12:34.399721 getuid()    = 503
[pid 25434] 10:12:34.399750 getgid()    = 500
[pid 25434] 10:12:34.399780 access("/bin/sh", R_OK) = 0
[pid 25434] 10:12:34.399814 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.399858 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.399902 geteuid()   = 503
[pid 25434] 10:12:34.399932 getegid()   = 500
[pid 25434] 10:12:34.399960 getuid()    = 503
[pid 25434] 10:12:34.399989 getgid()    = 500
[pid 25434] 10:12:34.400018 access("/bin/sh", X_OK) = 0
[pid 25434] 10:12:34.400052 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25434] 10:12:34.400095 geteuid( <unfinished ...>
[pid 25428] 10:12:34.400118 <... select resumed> ) = 1 (in [11], left {299, 955844})
[pid 25428] 10:12:34.400148 recvfrom(11, "250-esa4.hilton.iphmx.com\r\n250-8BITMIME\r\n250-SIZE 20971520\r\n250 STARTTLS\r\n", 4096, 0, NULL, NULL) = 74
[pid 25428] 10:12:34.400212 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25428] 10:12:34.400269 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25434] 10:12:34.400297 <... geteuid resumed> ) = 503
[pid 25434] 10:12:34.400323 getegid()   = 500
[pid 25434] 10:12:34.400369 getuid()    = 503
[pid 25434] 10:12:34.400469 getgid()    = 500
[pid 25434] 10:12:34.400508 access("/bin/sh", R_OK) = 0
[pid 25434] 10:12:34.400558 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.400597 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.400642 close(5)    = 0
[pid 25434] 10:12:34.400676 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.400709 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.400748 close(5)    = 0
[pid 25434] 10:12:34.400791 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25434] 10:12:34.400832 fstat(5, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25434] 10:12:34.400877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e757a000
[pid 25434] 10:12:34.400911 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25434] 10:12:34.400963 read(5, "", 4096) = 0
[pid 25434] 10:12:34.400996 close(5)    = 0
[pid 25434] 10:12:34.401028 munmap(0x7f77e757a000, 4096) = 0
[pid 25434] 10:12:34.401072 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25434] 10:12:34.401109 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.401152 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f77e7571000
[pid 25434] 10:12:34.401186 close(5)    = 0
[pid 25434] 10:12:34.401224 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25434] 10:12:34.401263 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.401301 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.401350 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f77e6996000
[pid 25434] 10:12:34.401396 mprotect(0x7f77e69a2000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.401519 mmap(0x7f77e6ba2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7f77e6ba2000
[pid 25434] 10:12:34.401566 close(5)    = 0
[pid 25434] 10:12:34.401612 mprotect(0x7f77e6ba2000, 4096, PROT_READ) = 0
[pid 25434] 10:12:34.401650 munmap(0x7f77e7571000, 39387) = 0
[pid 25434] 10:12:34.401692 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25434] 10:12:34.401740 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25434] 10:12:34.401776 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25434] 10:12:34.401821 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77e757a000
[pid 25434] 10:12:34.401855 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25434] 10:12:34.401907 close(5)    = 0
[pid 25434] 10:12:34.401939 munmap(0x7f77e757a000, 4096) = 0
[pid 25434] 10:12:34.402008 getpgrp()   = 29163
[pid 25434] 10:12:34.402041 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.402084 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25434] 10:12:34.402173 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.402218 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.402261 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25434] 10:12:34.402355 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.402462 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f77e6bd66a0}, {SIG_IGN, [], SA_RESTORER, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.402507 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f77e6bd66a0}, 8) = 0
[pid 25434] 10:12:34.402547 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"]) = 0
[pid 25434] 10:12:34.402776 brk(0)      = 0xea5000
[pid 25434] 10:12:34.402818 fcntl(0, F_GETFD) = 0
[pid 25434] 10:12:34.402849 fcntl(1, F_GETFD) = 0
[pid 25434] 10:12:34.402879 fcntl(2, F_GETFD) = 0
[pid 25434] 10:12:34.402913 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.402964 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2c000
[pid 25434] 10:12:34.403006 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.403051 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25434] 10:12:34.403087 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.403132 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f87a9f22000
[pid 25434] 10:12:34.403165 close(5)    = 0
[pid 25434] 10:12:34.403203 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25434] 10:12:34.403241 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.403280 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.403327 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f87a997a000
[pid 25434] 10:12:34.403362 mprotect(0x7f87a9b04000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.403502 mmap(0x7f87a9d04000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f87a9d04000
[pid 25434] 10:12:34.403561 mmap(0x7f87a9d09000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f87a9d09000
[pid 25434] 10:12:34.403603 close(5)    = 0
[pid 25434] 10:12:34.403647 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f21000
[pid 25434] 10:12:34.403686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f20000
[pid 25434] 10:12:34.403721 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f1f000
[pid 25434] 10:12:34.403755 arch_prctl(ARCH_SET_FS, 0x7f87a9f20700) = 0
[pid 25434] 10:12:34.403844 mprotect(0x7f87a9d04000, 16384, PROT_READ) = 0
[pid 25434] 10:12:34.403886 mprotect(0x7f87a9f2d000, 4096, PROT_READ) = 0
[pid 25434] 10:12:34.403920 munmap(0x7f87a9f22000, 39387) = 0
[pid 25434] 10:12:34.403980 getuid()    = 503
[pid 25434] 10:12:34.404013 getgid()    = 500
[pid 25434] 10:12:34.404043 getegid()   = 499
[pid 25434] 10:12:34.404073 getppid()   = 25389
[pid 25434] 10:12:34.404105 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25434] 10:12:34.404194 brk(0)      = 0xea5000
[pid 25434] 10:12:34.404227 brk(0xec6000) = 0xec6000
[pid 25434] 10:12:34.404272 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.404308 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.404356 close(5)    = 0
[pid 25434] 10:12:34.404395 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.404499 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.404547 close(5)    = 0
[pid 25434] 10:12:34.404590 open("/etc/nsswitch.conf", O_RDONLY) = 5
[pid 25434] 10:12:34.404635 fstat(5, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25434] 10:12:34.404684 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2b000
[pid 25434] 10:12:34.404719 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25434] 10:12:34.404782 read(5, "", 4096) = 0
[pid 25434] 10:12:34.404818 close(5)    = 0
[pid 25434] 10:12:34.404850 munmap(0x7f87a9f2b000, 4096) = 0
[pid 25434] 10:12:34.404896 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25434] 10:12:34.404934 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.404978 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f87a9f22000
[pid 25434] 10:12:34.405012 close(5)    = 0
[pid 25434] 10:12:34.405049 open("/lib64/libnss_files.so.2", O_RDONLY) = 5
[pid 25434] 10:12:34.405087 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.405125 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.405174 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f87a976c000
[pid 25434] 10:12:34.405210 mprotect(0x7f87a9778000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.405244 mmap(0x7f87a9978000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000) = 0x7f87a9978000
[pid 25434] 10:12:34.405287 close(5)    = 0
[pid 25434] 10:12:34.405333 mprotect(0x7f87a9978000, 4096, PROT_READ) = 0
[pid 25434] 10:12:34.405390 munmap(0x7f87a9f22000, 39387) = 0
[pid 25434] 10:12:34.405523 open("/etc/group", O_RDONLY|O_CLOEXEC) = 5
[pid 25434] 10:12:34.405568 fcntl(5, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25434] 10:12:34.405604 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.405649 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2b000
[pid 25434] 10:12:34.405683 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.405738 close(5)    = 0
[pid 25434] 10:12:34.405771 munmap(0x7f87a9f2b000, 4096) = 0
[pid 25434] 10:12:34.405810 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.405846 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.405894 close(5)    = 0
[pid 25434] 10:12:34.405927 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25434] 10:12:34.405960 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.406000 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25411] 10:12:34.406025 recvfrom(16, "\273^\201\200\0\1\0\2\0\0\0\0\6remote\23phoenixmarriottmesa\3com\0\0\1\0\1\300\f\0\5\0\1\0\0\7\10\0\2\300\23\300\23\0\1\0\1\0\0\7\10\0\4E5\324\22", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 78
[pid 25411] 10:12:34.406073 close(16)   = 0
[pid 25411] 10:12:34.406138 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25411] 10:12:34.406179 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25411] 10:12:34.406223 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25411] 10:12:34.406264 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25411] 10:12:34.406301 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25411] 10:12:34.406347 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25411] 10:12:34.406386 close(16)   = 0
[pid 25411] 10:12:34.406504 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25411] 10:12:34.406566 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.406612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8169299000
[pid 25411] 10:12:34.406647 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25411] 10:12:34.406704 read(16, "", 1024) = 0
[pid 25411] 10:12:34.406750 read(16, "", 1024) = 0
[pid 25411] 10:12:34.406787 close(16)   = 0
[pid 25411] 10:12:34.406821 munmap(0x7f8169299000, 4096) = 0
[pid 25411] 10:12:34.406945 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:34.407018 open("/etc/passwd", O_RDONLY) = 16
[pid 25411] 10:12:34.407061 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf4a52a10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.407097 lseek(16, 0, SEEK_CUR) = 0
[pid 25411] 10:12:34.407129 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.407172 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.407214 read(16, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25411] 10:12:34.407541 close(16)   = 0
[pid 25411] 10:12:34.407621 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.407697 stat("/usr/local/cpanel/3rdparty/mailman/lists/salesadmin_phoenixmarriottmesa.com/config.pck", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.407752 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.407870 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.407997 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:34.408156 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com", 0x7f816793e880) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.408214 stat("/etc/email_send_limits", {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.408276 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY) = 16
[pid 25411] 10:12:34.408324 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf4a50ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.408364 lseek(16, 0, SEEK_CUR) = 0
[pid 25411] 10:12:34.408467 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25411] 10:12:34.408521 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.408555 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25411] 10:12:34.408605 read(16, "0", 8192) = 1
[pid 25411] 10:12:34.408642 read(16, "", 8192) = 0
[pid 25411] 10:12:34.408676 close(16)   = 0
[pid 25411] 10:12:34.408751 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:34.408821 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.408877 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.408927 close(7)    = 0
[pid 25411] 10:12:34.408963 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25411] 10:12:34.409005 fcntl(7, F_GETFD) = 0
[pid 25411] 10:12:34.409036 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.409066 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10488, st_size=5365640, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.409109 write(7, "2015-12-30 10:12:34 [25411] 1aEJMX-0006bl-RX SMTP connection outbound 1451491954 1aEJMX-0006bl-RX finestweddingsites.com salesadmin@phoenixmarriottmesa.com\n", 156) = 156
[pid 25411] 10:12:34.409181 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666) = 16
[pid 25411] 10:12:34.409229 lseek(16, 0, SEEK_END) = 3
[pid 25411] 10:12:34.409262 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdf4a50ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.409297 lseek(16, 0, SEEK_CUR) = 3
[pid 25411] 10:12:34.409330 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.409381 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:34.409523 write(16, "1", 1) = 1
[pid 25411] 10:12:34.409566 close(16)   = 0
[pid 25411] 10:12:34.409617 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.409690 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.409757 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25411] 10:12:34.409797 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25411] 10:12:34.409836 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25411] 10:12:34.409872 sendto(16, "\327g\1\0\0\1\0\0\0\0\0\0\23phoenixmarriottmesa\3com\0\0\17\0\1", 41, MSG_NOSIGNAL, NULL, 0) = 41
[pid 25411] 10:12:34.409937 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25434] 10:12:34.409964 close(5)    = 0
[pid 25434] 10:12:34.410005 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 5
[pid 25434] 10:12:34.410046 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25434] 10:12:34.410091 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2b000
[pid 25434] 10:12:34.410127 read(5, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25434] 10:12:34.410180 close(5)    = 0
[pid 25434] 10:12:34.410213 munmap(0x7f87a9f2b000, 4096) = 0
[pid 25434] 10:12:34.410255 open("/etc/group", O_RDONLY|O_CLOEXEC) = 5
[pid 25434] 10:12:34.410293 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.410346 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2b000
[pid 25434] 10:12:34.410469 read(5, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.410532 close(5)    = 0
[pid 25434] 10:12:34.410567 munmap(0x7f87a9f2b000, 4096) = 0
[pid 25434] 10:12:34.410615 readlink("/proc/25389/exe", "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25434] 10:12:34.410670 readlink("/opt/php52/bin/php-cgi", 0x7fff38ce1640, 4095) = -1 EINVAL (Invalid argument)
[pid 25434] 10:12:34.410716 getcwd("/home/finest09/public_html/includes", 4095) = 36
[pid 25434] 10:12:34.410757 stat("/proc/25389/cmdline", {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25434] 10:12:34.410813 open("/proc/25389/cmdline", O_RDONLY) = 5
[pid 25434] 10:12:34.410852 fstat(5, {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25434] 10:12:34.410894 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87a9f2b000
[pid 25434] 10:12:34.410928 read(5, "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25434] 10:12:34.410968 read(5, "", 1024) = 0
[pid 25434] 10:12:34.411004 setregid(499, 499) = 0
[pid 25434] 10:12:34.411038 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
Process 25433 attached
[pid 25433] 10:12:34.411284 set_robust_list(0x7fcf40855aa0, 24) = 0
[pid 25433] 10:12:34.411342 close(0)    = 0
[pid 25433] 10:12:34.411388 close(1)    = 0
[pid 25433] 10:12:34.411514 close(2)    = 0
[pid 25433] 10:12:34.411603 setsid( <unfinished ...>
[pid 25434] 10:12:34.411640 brk(0)      = 0x2742000
[pid 25434] 10:12:34.411676 fcntl(0, F_GETFD) = 0
[pid 25434] 10:12:34.411707 fcntl(1, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.411726 <... setsid resumed> ) = 25433
[pid 25434] 10:12:34.411744 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.411765 fstat(0,  <unfinished ...>
[pid 25434] 10:12:34.411783 fcntl(2, F_GETFD) = 0
[pid 25434] 10:12:34.411818 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25433] 10:12:34.411840 <... fstat resumed> 0x7ffef3f802f0) = -1 EBADF (Bad file descriptor)
[pid 25433] 10:12:34.411862 open("/dev/null", O_RDWR <unfinished ...>
[pid 25434] 10:12:34.411887 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.411913 <... open resumed> ) = 0
[pid 25434] 10:12:34.411950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.411974 fstat(1, 0x7ffef3f802f0) = -1 EBADF (Bad file descriptor)
[pid 25433] 10:12:34.412015 dup2(0, 1 <unfinished ...>
[pid 25434] 10:12:34.412037 <... mmap resumed> ) = 0x7f13e9a19000
[pid 25434] 10:12:34.412068 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25433] 10:12:34.412092 <... dup2 resumed> ) = 1
[pid 25433] 10:12:34.412109 fstat(2, 0x7ffef3f802f0) = -1 EBADF (Bad file descriptor)
[pid 25433] 10:12:34.412141 dup2(0, 2)  = 2
[pid 25433] 10:12:34.412173 geteuid( <unfinished ...>
[pid 25434] 10:12:34.412193 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.412211 <... geteuid resumed> ) = 47
[pid 25433] 10:12:34.412236 fstat(0,  <unfinished ...>
[pid 25434] 10:12:34.412263 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.412304 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.412337 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.412389 fstat(2,  <unfinished ...>
[pid 25434] 10:12:34.412478 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.412502 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25434] 10:12:34.412535 <... stat resumed> 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.412560 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMY-0006c6-AN"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25434] 10:12:34.412652 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.413188 <... execve resumed> ) = 0
[pid 25434] 10:12:34.413212 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413251 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413289 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413326 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413362 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25434] 10:12:34.413508 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413555 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413593 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413630 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413667 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413706 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413743 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413781 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.413828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413865 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413936 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.413972 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414008 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fff12ff47e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414044 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414080 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.414135 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25434] 10:12:34.414171 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.414214 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f13e9a0f000
[pid 25434] 10:12:34.414248 close(6)    = 0
[pid 25434] 10:12:34.414286 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25434] 10:12:34.414325 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.414368 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.414541 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f13e95e1000
[pid 25434] 10:12:34.414578 mprotect(0x7f13e95f7000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.414613 mmap(0x7f13e97f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f13e97f7000
[pid 25434] 10:12:34.414654 mmap(0x7f13e97f9000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f13e97f9000
[pid 25434] 10:12:34.414697 close(6)    = 0
[pid 25434] 10:12:34.414736 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414817 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.414858 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25434] 10:12:34.414896 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.414934 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.414978 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a0e000
[pid 25434] 10:12:34.415015 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f13e93c8000
[pid 25434] 10:12:34.415049 mprotect(0x7f13e93de000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.415083 mmap(0x7f13e95dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f13e95dd000
[pid 25434] 10:12:34.415123 mmap(0x7f13e95df000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f13e95df000
[pid 25434] 10:12:34.415162 close(6)    = 0
[pid 25434] 10:12:34.415200 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415286 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415329 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25434] 10:12:34.415373 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.415509 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.415557 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f13e9191000
[pid 25434] 10:12:34.415593 mprotect(0x7f13e9198000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.415627 mmap(0x7f13e9398000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f13e9398000
[pid 25434] 10:12:34.415667 mmap(0x7f13e939a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f13e939a000
[pid 25434] 10:12:34.415708 close(6)    = 0
[pid 25434] 10:12:34.415745 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415785 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.415863 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25434] 10:12:34.415900 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.415938 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.415982 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f13e8f0d000
[pid 25434] 10:12:34.416017 mprotect(0x7f13e8f90000, 2093056, PROT_NONE) = 0
[pid 25433] 10:12:34.416066 brk(0 <unfinished ...>
[pid 25434] 10:12:34.416086 mmap(0x7f13e918f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f13e918f000
[pid 25434] 10:12:34.416131 close(6 <unfinished ...>
[pid 25433] 10:12:34.416151 <... brk resumed> ) = 0x7ce000
[pid 25433] 10:12:34.416170 fcntl(0, F_GETFD <unfinished ...>
[pid 25434] 10:12:34.416188 <... close resumed> ) = 0
[pid 25433] 10:12:34.416206 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.416229 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.416250 fcntl(1, F_GETFD) = 0
[pid 25433] 10:12:34.416280 fcntl(2, F_GETFD) = 0
[pid 25433] 10:12:34.416322 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25434] 10:12:34.416358 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.416383 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.416491 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.416552 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.416575 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.416616 <... mmap resumed> ) = 0x7fea0f286000
[pid 25434] 10:12:34.416636 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.416669 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25434] 10:12:34.416698 <... open resumed> ) = 6
[pid 25434] 10:12:34.416716 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.416755 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25433] 10:12:34.416802 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.416820 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.416850 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.416873 <... mmap resumed> ) = 0x7f13e9a0d000
[pid 25434] 10:12:34.416893 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f13e8cff000
[pid 25433] 10:12:34.416933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.416951 mprotect(0x7f13e8d0b000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.416985 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417021 mmap(0x7f13e8f0b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f13e8f0b000
[pid 25433] 10:12:34.417058 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417104 close(6 <unfinished ...>
[pid 25433] 10:12:34.417125 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417162 <... close resumed> ) = 0
[pid 25433] 10:12:34.417179 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.417205 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.417229 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.417247 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417289 <... open resumed> ) = 6
[pid 25433] 10:12:34.417307 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417345 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.417508 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25434] 10:12:34.417538 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.417560 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25434] 10:12:34.417591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25434] 10:12:34.417621 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.417641 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417684 <... mmap resumed> ) = 0x7f13e8adc000
[pid 25434] 10:12:34.417703 mprotect(0x7f13e8afd000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.417736 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417774 mmap(0x7f13e8cfd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f13e8cfd000
[pid 25433] 10:12:34.417810 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417854 close(6 <unfinished ...>
[pid 25433] 10:12:34.417873 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25434] 10:12:34.417893 <... close resumed> ) = 0
[pid 25433] 10:12:34.417914 <... stat resumed> 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.417939 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.417960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418001 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418020 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.418040 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25434] 10:12:34.418065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.418087 <... stat resumed> 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.418106 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.418126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.418151 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418172 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418192 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.418212 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.418273 <... open resumed> ) = 6
[pid 25433] 10:12:34.418291 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418330 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.418372 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.418502 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25434] 10:12:34.418531 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.418565 <... stat resumed> 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418586 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.418606 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.418629 <... mmap resumed> ) = 0x7f13e88bf000
[pid 25433] 10:12:34.418652 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418670 mprotect(0x7f13e88d6000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.418704 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418740 mmap(0x7f13e8ad6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f13e8ad6000
[pid 25433] 10:12:34.418777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418819 mmap(0x7f13e8ad8000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.418841 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffc7275c050) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.418880 <... mmap resumed> ) = 0x7f13e8ad8000
[pid 25433] 10:12:34.418898 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.418924 close(6 <unfinished ...>
[pid 25433] 10:12:34.418948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.418967 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25434] 10:12:34.418986 <... close resumed> ) = 0
[pid 25433] 10:12:34.419006 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.419042 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.419065 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25434] 10:12:34.419104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.419123 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.419141 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.419162 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25434] 10:12:34.419196 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.419220 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fea0f27c000
[pid 25433] 10:12:34.419254 close(6)    = 0
[pid 25434] 10:12:34.419285 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.419312 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.419338 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.419362 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.419392 <... open resumed> ) = 6
[pid 25434] 10:12:34.419494 <... open resumed> ) = 6
[pid 25433] 10:12:34.419514 read(6,  <unfinished ...>
[pid 25434] 10:12:34.419532 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.419571 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.419596 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.419615 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.419658 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.419687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.419709 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.419731 <... mmap resumed> ) = 0x7f13e9a0c000
[pid 25433] 10:12:34.419750 <... mmap resumed> ) = 0x7fea0ee4e000
[pid 25434] 10:12:34.419771 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.419791 mprotect(0x7fea0ee64000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.419827 <... mmap resumed> ) = 0x7f13e854b000
[pid 25433] 10:12:34.419844 mmap(0x7fea0f064000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25434] 10:12:34.419864 mprotect(0x7f13e86ba000, 2093056, PROT_NONE) = 0
[pid 25433] 10:12:34.419900 <... mmap resumed> ) = 0x7fea0f064000
[pid 25434] 10:12:34.419919 mmap(0x7f13e88b9000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25433] 10:12:34.419943 mmap(0x7fea0f066000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.419966 <... mmap resumed> ) = 0x7f13e88b9000
[pid 25434] 10:12:34.419992 close(6 <unfinished ...>
[pid 25433] 10:12:34.420015 <... mmap resumed> ) = 0x7fea0f066000
[pid 25433] 10:12:34.420038 close(6 <unfinished ...>
[pid 25434] 10:12:34.420057 <... close resumed> ) = 0
[pid 25433] 10:12:34.420075 <... close resumed> ) = 0
[pid 25434] 10:12:34.420099 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.420131 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.420157 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.420180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.420198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.420218 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.420244 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.420267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.420285 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.420306 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.420331 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.420353 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.420373 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.420395 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25433] 10:12:34.420552 <... open resumed> ) = 6
[pid 25433] 10:12:34.420570 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.420608 read(6,  <unfinished ...>
[pid 25433] 10:12:34.420627 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.420646 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.420669 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.420700 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.420718 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.420739 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25433] 10:12:34.420770 <... mmap resumed> ) = 0x7fea0f27b000
[pid 25434] 10:12:34.420789 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.420813 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.420835 <... mmap resumed> ) = 0x7f13e82bc000
[pid 25434] 10:12:34.420853 mprotect(0x7f13e8347000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.420873 <... mmap resumed> ) = 0x7fea0ec35000
[pid 25434] 10:12:34.420894 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.420912 mprotect(0x7fea0ec4b000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.420950 mmap(0x7f13e8547000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f13e8547000
[pid 25433] 10:12:34.420987 mmap(0x7fea0ee4a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fea0ee4a000
[pid 25434] 10:12:34.421027 mmap(0x7f13e854a000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.421052 mmap(0x7fea0ee4c000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.421075 <... mmap resumed> ) = 0x7f13e854a000
[pid 25433] 10:12:34.421094 <... mmap resumed> ) = 0x7fea0ee4c000
[pid 25433] 10:12:34.421117 close(6 <unfinished ...>
[pid 25434] 10:12:34.421142 close(6 <unfinished ...>
[pid 25433] 10:12:34.421162 <... close resumed> ) = 0
[pid 25434] 10:12:34.421179 <... close resumed> ) = 0
[pid 25434] 10:12:34.421203 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.421230 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.421273 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.421292 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.421312 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.421340 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.421363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.421382 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.421511 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.421543 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.421567 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.421587 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.421611 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.421637 <... open resumed> ) = 6
[pid 25433] 10:12:34.421658 <... open resumed> ) = 6
[pid 25434] 10:12:34.421676 read(6,  <unfinished ...>
[pid 25433] 10:12:34.421694 read(6,  <unfinished ...>
[pid 25434] 10:12:34.421712 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.421737 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.421761 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.421780 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.421798 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25433] 10:12:34.421834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.421866 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.421894 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.421924 <... mmap resumed> ) = 0x7f13e80b6000
[pid 25433] 10:12:34.421944 <... mmap resumed> ) = 0x7fea0e9fe000
[pid 25433] 10:12:34.421963 mprotect(0x7fea0ea05000, 2097152, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.421988 mprotect(0x7f13e80bc000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.422015 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.422036 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.422054 mmap(0x7f13e82bb000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25433] 10:12:34.422081 mmap(0x7fea0ec05000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25434] 10:12:34.422110 <... mmap resumed> ) = 0x7f13e82bb000
[pid 25433] 10:12:34.422131 <... mmap resumed> ) = 0x7fea0ec05000
[pid 25433] 10:12:34.422154 mmap(0x7fea0ec07000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.422186 close(6 <unfinished ...>
[pid 25433] 10:12:34.422214 <... mmap resumed> ) = 0x7fea0ec07000
[pid 25434] 10:12:34.422232 <... close resumed> ) = 0
[pid 25434] 10:12:34.422257 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.422291 close(6 <unfinished ...>
[pid 25434] 10:12:34.422324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.422344 <... close resumed> ) = 0
[pid 25433] 10:12:34.422367 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.422501 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25433] 10:12:34.422556 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.422577 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.422605 read(6,  <unfinished ...>
[pid 25433] 10:12:34.422635 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.422658 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.422686 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.422712 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.422738 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:34.422773 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.422793 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a0b000
[pid 25433] 10:12:34.422832 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.422863 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.422900 <... open resumed> ) = 6
[pid 25434] 10:12:34.422921 <... mmap resumed> ) = 0x7f13e7d80000
[pid 25433] 10:12:34.422940 read(6,  <unfinished ...>
[pid 25434] 10:12:34.422965 mprotect(0x7f13e7eac000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.422991 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.423019 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.423039 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.423084 mmap(0x7f13e80ac000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25433] 10:12:34.423113 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.423144 <... mmap resumed> ) = 0x7f13e80ac000
[pid 25433] 10:12:34.423164 <... mmap resumed> ) = 0x7fea0e77a000
[pid 25433] 10:12:34.423183 mprotect(0x7fea0e7fd000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.423214 mmap(0x7f13e80b5000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.423245 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.423266 <... mmap resumed> ) = 0x7f13e80b5000
[pid 25433] 10:12:34.423285 mmap(0x7fea0e9fc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fea0e9fc000
[pid 25434] 10:12:34.423329 close(6 <unfinished ...>
[pid 25433] 10:12:34.423365 close(6 <unfinished ...>
[pid 25434] 10:12:34.423390 <... close resumed> ) = 0
[pid 25434] 10:12:34.423516 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.423548 <... close resumed> ) = 0
[pid 25433] 10:12:34.423572 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.423605 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.423628 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.423649 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.423689 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.423724 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.423748 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.423768 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.423794 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.423825 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.423847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.423868 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.423896 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.423998 <... open resumed> ) = 6
[pid 25433] 10:12:34.424023 <... open resumed> ) = 6
[pid 25433] 10:12:34.424041 read(6,  <unfinished ...>
[pid 25434] 10:12:34.424066 read(6,  <unfinished ...>
[pid 25433] 10:12:34.424091 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.424123 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.424149 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.424175 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.424199 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25434] 10:12:34.424230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.424261 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.424289 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.424319 <... mmap resumed> ) = 0x7fea0f27a000
[pid 25434] 10:12:34.424341 <... mmap resumed> ) = 0x7f13e7b7c000
[pid 25433] 10:12:34.424364 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.424391 mprotect(0x7f13e7b7e000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.424497 <... mmap resumed> ) = 0x7fea0e56c000
[pid 25433] 10:12:34.424519 mprotect(0x7fea0e578000, 2097152, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.424544 mmap(0x7f13e7d7e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25433] 10:12:34.424575 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.424597 <... mmap resumed> ) = 0x7f13e7d7e000
[pid 25433] 10:12:34.424617 mmap(0x7fea0e778000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25434] 10:12:34.424654 close(6 <unfinished ...>
[pid 25433] 10:12:34.424682 <... mmap resumed> ) = 0x7fea0e778000
[pid 25433] 10:12:34.424708 close(6 <unfinished ...>
[pid 25434] 10:12:34.424735 <... close resumed> ) = 0
[pid 25434] 10:12:34.424760 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.424789 <... close resumed> ) = 0
[pid 25433] 10:12:34.424813 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.424846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.424871 <... open resumed> ) = 6
[pid 25434] 10:12:34.424891 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.424932 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.424978 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.425004 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.425031 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25434] 10:12:34.425066 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.425087 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fea0e349000
[pid 25434] 10:12:34.425126 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.425153 mprotect(0x7fea0e36a000, 2097152, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.425184 <... open resumed> ) = 6
[pid 25433] 10:12:34.425206 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.425225 mmap(0x7fea0e56a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25434] 10:12:34.425251 read(6,  <unfinished ...>
[pid 25433] 10:12:34.425279 <... mmap resumed> ) = 0x7fea0e56a000
[pid 25434] 10:12:34.425299 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.425326 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.425356 close(6 <unfinished ...>
[pid 25434] 10:12:34.425381 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25434] 10:12:34.425524 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.425555 <... close resumed> ) = 0
[pid 25434] 10:12:34.425577 <... mmap resumed> ) = 0x7f13e7979000
[pid 25433] 10:12:34.425603 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.425632 mprotect(0x7f13e797b000, 2093056, PROT_NONE) = 0
[pid 25433] 10:12:34.425673 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.425694 mmap(0x7f13e7b7a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f13e7b7a000
[pid 25433] 10:12:34.425733 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.425785 close(6 <unfinished ...>
[pid 25433] 10:12:34.425813 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.425854 <... close resumed> ) = 0
[pid 25434] 10:12:34.425879 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.425909 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25434] 10:12:34.425953 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.425973 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.426019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.426048 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.426080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.426099 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.426132 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fea0e12c000
[pid 25434] 10:12:34.426170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.426210 mprotect(0x7fea0e143000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.426248 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.426275 mmap(0x7fea0e343000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25434] 10:12:34.426307 <... open resumed> ) = 6
[pid 25433] 10:12:34.426330 <... mmap resumed> ) = 0x7fea0e343000
[pid 25433] 10:12:34.426354 mmap(0x7fea0e345000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.426382 read(6,  <unfinished ...>
[pid 25433] 10:12:34.426489 <... mmap resumed> ) = 0x7fea0e345000
[pid 25434] 10:12:34.426510 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.426540 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.426599 close(6 <unfinished ...>
[pid 25434] 10:12:34.426627 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a0a000
[pid 25433] 10:12:34.426663 <... close resumed> ) = 0
[pid 25434] 10:12:34.426685 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.426720 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.426750 <... mmap resumed> ) = 0x7f13e75e5000
[pid 25433] 10:12:34.426773 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.426793 mprotect(0x7f13e776f000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.426830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.426871 mmap(0x7f13e796f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f13e796f000
[pid 25433] 10:12:34.426911 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.426943 mmap(0x7f13e7974000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.426975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.426996 <... mmap resumed> ) = 0x7f13e7974000
[pid 25433] 10:12:34.427017 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25434] 10:12:34.427066 close(6 <unfinished ...>
[pid 25433] 10:12:34.427093 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.427133 <... close resumed> ) = 0
[pid 25434] 10:12:34.427158 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.427187 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.427233 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f279000
[pid 25434] 10:12:34.427273 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.427296 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.427325 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.427358 <... mmap resumed> ) = 0x7fea0ddb8000
[pid 25434] 10:12:34.427386 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.427508 mprotect(0x7fea0df27000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.427550 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.427593 mmap(0x7fea0e126000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fea0e126000
[pid 25434] 10:12:34.427633 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.427671 close(6 <unfinished ...>
[pid 25434] 10:12:34.427709 <... open resumed> ) = 6
[pid 25433] 10:12:34.427733 <... close resumed> ) = 0
[pid 25434] 10:12:34.427752 read(6,  <unfinished ...>
[pid 25433] 10:12:34.427785 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.427813 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.427838 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25434] 10:12:34.427884 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.427915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.427938 <... mmap resumed> ) = 0x7f13e7379000
[pid 25433] 10:12:34.427957 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.427984 mprotect(0x7f13e73db000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.428016 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.428038 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.428057 mmap(0x7f13e75da000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25433] 10:12:34.428090 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.428121 <... mmap resumed> ) = 0x7f13e75da000
[pid 25433] 10:12:34.428144 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.428173 close(6 <unfinished ...>
[pid 25433] 10:12:34.428201 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25434] 10:12:34.428241 <... close resumed> ) = 0
[pid 25433] 10:12:34.428260 read(6,  <unfinished ...>
[pid 25434] 10:12:34.428295 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.428325 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.428350 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25433] 10:12:34.428472 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.428513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.428535 <... mmap resumed> ) = 0x7fea0db29000
[pid 25433] 10:12:34.428555 mprotect(0x7fea0dbb4000, 2097152, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.428581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.428613 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.428637 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.428657 mmap(0x7fea0ddb4000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fea0ddb4000
[pid 25434] 10:12:34.428699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.428746 mmap(0x7fea0ddb7000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.428775 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.428805 <... mmap resumed> ) = 0x7fea0ddb7000
[pid 25434] 10:12:34.428829 <... open resumed> ) = 6
[pid 25433] 10:12:34.428853 close(6 <unfinished ...>
[pid 25434] 10:12:34.428880 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.428920 <... close resumed> ) = 0
[pid 25433] 10:12:34.428945 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.428974 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25434] 10:12:34.429020 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.429057 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.429080 <... mmap resumed> ) = 0x7f13e6f96000
[pid 25434] 10:12:34.429100 mprotect(0x7f13e714f000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.429126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.429158 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.429182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.429202 mmap(0x7f13e734e000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f13e734e000
[pid 25433] 10:12:34.429242 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.429287 mmap(0x7f13e7375000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.429318 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.429348 <... mmap resumed> ) = 0x7f13e7375000
[pid 25433] 10:12:34.429372 <... open resumed> ) = 6
[pid 25434] 10:12:34.429396 close(6 <unfinished ...>
[pid 25433] 10:12:34.429507 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.429549 <... close resumed> ) = 0
[pid 25433] 10:12:34.429568 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.429602 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.429630 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25433] 10:12:34.429662 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fea0d923000
[pid 25434] 10:12:34.429704 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.429724 mprotect(0x7fea0d929000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.429760 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.429803 mmap(0x7fea0db28000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fea0db28000
[pid 25434] 10:12:34.429842 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.429874 close(6 <unfinished ...>
[pid 25434] 10:12:34.429908 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.429928 <... close resumed> ) = 0
[pid 25433] 10:12:34.429958 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.429989 open("/lib64/libpcre.so.0", O_RDONLYProcess 25435 attached
) = 6
[pid 25433] 10:12:34.430056 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.430094 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25434] 10:12:34.430122 read(6,  <unfinished ...>
[pid 25433] 10:12:34.430147 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.430174 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.430210 <... open resumed> ) = 6
[pid 25434] 10:12:34.430230 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25434] 10:12:34.430277 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.430304 read(6,  <unfinished ...>
[pid 25434] 10:12:34.430332 <... mmap resumed> ) = 0x7f13e9a09000
[pid 25433] 10:12:34.430354 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.430387 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.430535 fstat(6,  <unfinished ...>
[pid 25435] 10:12:34.430563 <... set_robust_list resumed> ) = 0
[pid 25433] 10:12:34.430581 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25435] 10:12:34.430639 close(13 <unfinished ...>
[pid 25433] 10:12:34.430667 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.430698 <... mmap resumed> ) = 0x7f13e6d69000
[pid 25433] 10:12:34.430718 <... mmap resumed> ) = 0x7fea0f278000
[pid 25433] 10:12:34.430740 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.430767 mprotect(0x7f13e6d95000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.430806 <... mmap resumed> ) = 0x7fea0d5ed000
[pid 25434] 10:12:34.430825 mmap(0x7f13e6f95000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25433] 10:12:34.430852 mprotect(0x7fea0d719000, 2097152, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.430880 <... mmap resumed> ) = 0x7f13e6f95000
[pid 25433] 10:12:34.430902 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.430921 mmap(0x7fea0d919000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25434] 10:12:34.430953 close(6 <unfinished ...>
[pid 25433] 10:12:34.430981 <... mmap resumed> ) = 0x7fea0d919000
[pid 25435] 10:12:34.431001 <... close resumed> ) = 0
[pid 25435] 10:12:34.431027 geteuid( <unfinished ...>
[pid 25434] 10:12:34.431053 <... close resumed> ) = 0
[pid 25433] 10:12:34.431075 mmap(0x7fea0d922000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.431110 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.431141 <... mmap resumed> ) = 0x7fea0d922000
[pid 25435] 10:12:34.431160 <... geteuid resumed> ) = 0
[pid 25434] 10:12:34.431185 <... open resumed> ) = 6
[pid 25435] 10:12:34.431205 getegid( <unfinished ...>
[pid 25433] 10:12:34.431236 close(6 <unfinished ...>
[pid 25435] 10:12:34.431261 <... getegid resumed> ) = 12
[pid 25435] 10:12:34.431283 setgid(500 <unfinished ...>
[pid 25433] 10:12:34.431310 <... close resumed> ) = 0
[pid 25434] 10:12:34.431329 read(6,  <unfinished ...>
[pid 25433] 10:12:34.431365 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25435] 10:12:34.431394 <... setgid resumed> ) = 0
[pid 25434] 10:12:34.431481 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25435] 10:12:34.431510 setuid(503 <unfinished ...>
[pid 25434] 10:12:34.431536 fstat(6,  <unfinished ...>
[pid 25435] 10:12:34.431562 <... setuid resumed> ) = 0
[pid 25434] 10:12:34.431581 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25433] 10:12:34.431616 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.431638 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25435] 10:12:34.431703 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.431735 <... mmap resumed> ) = 0x7f13e6b64000
[pid 25433] 10:12:34.431755 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.431797 mprotect(0x7f13e6b69000, 2093056, PROT_NONE) = 0
[pid 25433] 10:12:34.431835 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.431874 mmap(0x7f13e6d68000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f13e6d68000
[pid 25433] 10:12:34.431915 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.431947 close(6 <unfinished ...>
[pid 25433] 10:12:34.431977 <... open resumed> ) = 6
[pid 25434] 10:12:34.431996 <... close resumed> ) = 0
[pid 25433] 10:12:34.432014 read(6,  <unfinished ...>
[pid 25434] 10:12:34.432049 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.432077 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25435] 10:12:34.432108 <... open resumed> ) = 9
[pid 25433] 10:12:34.432127 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.432174 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.432206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.432234 fstat(9,  <unfinished ...>
[pid 25433] 10:12:34.432263 <... mmap resumed> ) = 0x7fea0d3e9000
[pid 25434] 10:12:34.432283 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.432314 mprotect(0x7fea0d3eb000, 2097152, PROT_NONE) = 0
[pid 25434] 10:12:34.432358 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.432384 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:34.432505 mmap(0x7fea0d5eb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25434] 10:12:34.432541 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25435] 10:12:34.432607 brk(0x25a9000 <unfinished ...>
[pid 25433] 10:12:34.432638 <... mmap resumed> ) = 0x7fea0d5eb000
[pid 25434] 10:12:34.432663 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.432692 close(6 <unfinished ...>
[pid 25434] 10:12:34.432721 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25433] 10:12:34.432759 <... close resumed> ) = 0
[pid 25433] 10:12:34.432784 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.432812 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.432852 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25433] 10:12:34.432902 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.432926 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.432953 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.432985 <... mmap resumed> ) = 0x7f13e6961000
[pid 25433] 10:12:34.433010 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.433031 <... brk resumed> ) = 0x25a9000
[pid 25435] 10:12:34.433117 fstat(9,  <unfinished ...>
[pid 25434] 10:12:34.433145 mprotect(0x7f13e6963000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.433170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.433201 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.433225 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.433244 mmap(0x7f13e6b62000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f13e6b62000
[pid 25433] 10:12:34.433284 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25434] 10:12:34.433334 close(6 <unfinished ...>
[pid 25433] 10:12:34.433361 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.433476 <... close resumed> ) = 0
[pid 25433] 10:12:34.433501 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.433537 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.433565 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.433609 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fea0d1e6000
[pid 25434] 10:12:34.433660 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.433681 mprotect(0x7fea0d1e8000, 2093056, PROT_NONE) = 0
[pid 25434] 10:12:34.433719 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.433766 mmap(0x7fea0d3e7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fea0d3e7000
[pid 25434] 10:12:34.433805 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.433842 close(6 <unfinished ...>
[pid 25434] 10:12:34.433873 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.433893 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25434] 10:12:34.433925 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25435] 10:12:34.433954 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.433980 <... close resumed> ) = 0
[pid 25434] 10:12:34.434006 <... open resumed> ) = 6
[pid 25433] 10:12:34.434031 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25435] 10:12:34.434062 <... mmap resumed> ) = 0x7f380d424000
[pid 25435] 10:12:34.434081 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25434] 10:12:34.434129 read(6,  <unfinished ...>
[pid 25433] 10:12:34.434159 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.434179 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.434204 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.434230 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.434257 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25433] 10:12:34.434294 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.434315 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25435] 10:12:34.434343 read(9,  <unfinished ...>
[pid 25434] 10:12:34.434378 <... mmap resumed> ) = 0x7f13e9a08000
[pid 25433] 10:12:34.434491 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.434529 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25435] 10:12:34.434561 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25433] 10:12:34.434595 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.434620 <... mmap resumed> ) = 0x7f13e673e000
[pid 25435] 10:12:34.434642 close(9 <unfinished ...>
[pid 25433] 10:12:34.434669 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.434696 mprotect(0x7f13e6755000, 2097152, PROT_NONE) = 0
[pid 25435] 10:12:34.434735 <... close resumed> ) = 0
[pid 25433] 10:12:34.434760 <... open resumed> ) = 6
[pid 25435] 10:12:34.434779 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25434] 10:12:34.434804 mmap(0x7f13e6955000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25435] 10:12:34.434835 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.434854 read(6,  <unfinished ...>
[pid 25434] 10:12:34.434883 <... mmap resumed> ) = 0x7f13e6955000
[pid 25433] 10:12:34.434902 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25435] 10:12:34.435321 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.435360 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.435464 close(6 <unfinished ...>
[pid 25433] 10:12:34.435497 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.435537 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f277000
[pid 25434] 10:12:34.435579 <... close resumed> ) = 0
[pid 25434] 10:12:34.435623 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.435657 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fea0ce52000
[pid 25433] 10:12:34.435696 mprotect(0x7fea0cfdc000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.435734 mmap(0x7fea0d1dc000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fea0d1dc000
[pid 25434] 10:12:34.435778 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.435802 mmap(0x7fea0d1e1000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.435892 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.435931 <... mmap resumed> ) = 0x7fea0d1e1000
[pid 25434] 10:12:34.435947 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.435971 close(6 <unfinished ...>
[pid 25434] 10:12:34.435999 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.436029 <... close resumed> ) = 0
[pid 25434] 10:12:34.436044 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.436069 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.436103 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.436134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.436151 <... open resumed> ) = 6
[pid 25433] 10:12:34.436168 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.436202 read(6,  <unfinished ...>
[pid 25433] 10:12:34.436233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.436250 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.436274 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.436335 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.436373 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.436391 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.436494 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.436530 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.436561 <... open resumed> ) = 6
[pid 25434] 10:12:34.436576 <... mmap resumed> ) = 0x7f13e64fa000
[pid 25433] 10:12:34.436593 read(6,  <unfinished ...>
[pid 25434] 10:12:34.436619 mprotect(0x7f13e653b000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.436647 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.436669 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.436687 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.436712 mmap(0x7f13e673b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25433] 10:12:34.436741 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25434] 10:12:34.436769 <... mmap resumed> ) = 0x7f13e673b000
[pid 25433] 10:12:34.436788 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.436828 close(6 <unfinished ...>
[pid 25433] 10:12:34.436852 <... mmap resumed> ) = 0x7fea0cbe6000
[pid 25434] 10:12:34.436868 <... close resumed> ) = 0
[pid 25433] 10:12:34.436885 mprotect(0x7fea0cc48000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.436922 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.436953 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.436968 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.436986 mmap(0x7fea0ce47000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25434] 10:12:34.437017 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.437049 <... mmap resumed> ) = 0x7fea0ce47000
[pid 25435] 10:12:34.437069 <... lseek resumed> ) = 19
[pid 25434] 10:12:34.437092 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.437113 read(6,  <unfinished ...>
[pid 25433] 10:12:34.437143 close(6 <unfinished ...>
[pid 25435] 10:12:34.437168 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2373) = 1858
[pid 25434] 10:12:34.437186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.437390 <... close resumed> ) = 0
[pid 25434] 10:12:34.437491 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.437530 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.437568 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.437599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.437616 <... open resumed> ) = 6
[pid 25433] 10:12:34.437633 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.437666 read(6,  <unfinished ...>
[pid 25433] 10:12:34.437691 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.437707 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.437730 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.437761 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.437785 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.437801 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.437833 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.438159 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25435] 10:12:34.438193 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.438216 <... open resumed> ) = 6
[pid 25434] 10:12:34.438231 <... mmap resumed> ) = 0x7f13e9a07000
[pid 25433] 10:12:34.438248 read(6,  <unfinished ...>
[pid 25434] 10:12:34.438276 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.438306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25434] 10:12:34.438329 <... mmap resumed> ) = 0x7f13e6213000
[pid 25433] 10:12:34.438347 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.438379 mprotect(0x7f13e62ee000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.438503 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25434] 10:12:34.438541 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.438560 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.438591 mmap(0x7f13e64ee000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25433] 10:12:34.438620 <... mmap resumed> ) = 0x7fea0c803000
[pid 25434] 10:12:34.438636 <... mmap resumed> ) = 0x7f13e64ee000
[pid 25433] 10:12:34.438653 mprotect(0x7fea0c9bc000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.438694 close(6 <unfinished ...>
[pid 25433] 10:12:34.438719 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.438734 <... close resumed> ) = 0
[pid 25433] 10:12:34.438750 mmap(0x7fea0cbbb000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25434] 10:12:34.438791 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.438823 <... mmap resumed> ) = 0x7fea0cbbb000
[pid 25434] 10:12:34.438839 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.438861 mmap(0x7fea0cbe2000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.438892 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.438924 <... mmap resumed> ) = 0x7fea0cbe2000
[pid 25434] 10:12:34.438940 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.438963 close(6 <unfinished ...>
[pid 25434] 10:12:34.438990 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.439020 <... close resumed> ) = 0
[pid 25434] 10:12:34.439035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.439060 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.439094 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.439124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.439141 <... open resumed> ) = 6
[pid 25433] 10:12:34.439158 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.439190 read(6,  <unfinished ...>
[pid 25433] 10:12:34.439214 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.439241 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.439266 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25435] 10:12:34.439292 <... write resumed> ) = 4
[pid 25434] 10:12:34.439306 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.439330 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.439357 read(13,  <unfinished ...>
[pid 25435] 10:12:34.439387 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25434] 10:12:34.439498 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.439530 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.439553 <... write resumed> ) = 4
[pid 25434] 10:12:34.439571 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.439601 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25435] 10:12:34.439630 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25434] 10:12:34.439656 <... mmap resumed> ) = 0x7f13e600f000
[pid 25433] 10:12:34.439671 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.439700 read(13,  <unfinished ...>
[pid 25435] 10:12:34.439728 <... write resumed> ) = 4
[pid 25434] 10:12:34.439741 mprotect(0x7f13e6012000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.439767 <... open resumed> ) = 6
[pid 25425] 10:12:34.439781 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25435] 10:12:34.439806 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25434] 10:12:34.439832 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.439844 read(6,  <unfinished ...>
[pid 25425] 10:12:34.439867 read(13,  <unfinished ...>
[pid 25435] 10:12:34.439896 <... write resumed> ) = 40
[pid 25434] 10:12:34.439909 mmap(0x7f13e6211000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25433] 10:12:34.439937 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.439958 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25435] 10:12:34.439982 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25434] 10:12:34.440006 <... mmap resumed> ) = 0x7f13e6211000
[pid 25433] 10:12:34.440019 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.440051 read(13,  <unfinished ...>
[pid 25435] 10:12:34.440079 <... write resumed> ) = 4
[pid 25434] 10:12:34.440091 close(6 <unfinished ...>
[pid 25433] 10:12:34.440114 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25425] 10:12:34.440139 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25435] 10:12:34.440163 close(14 <unfinished ...>
[pid 25434] 10:12:34.440186 <... close resumed> ) = 0
[pid 25433] 10:12:34.440199 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.440233 wait4(-1,  <unfinished ...>
[pid 25435] 10:12:34.440260 <... close resumed> ) = 0
[pid 25434] 10:12:34.440273 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.440316 <... mmap resumed> ) = 0x7fea0f276000
[pid 25435] 10:12:34.440334 exit_group(0) = ?
[pid 25434] 10:12:34.440352 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25435] 10:12:34.440745 +++ exited with 0 +++
[pid 25434] 10:12:34.440766 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.440797 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.440825 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25435
[pid 25434] 10:12:34.440848 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.440863 <... mmap resumed> ) = 0x7fea0c5d6000
[pid 25425] 10:12:34.440886 close(13 <unfinished ...>
[pid 25434] 10:12:34.440920 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.440948 mprotect(0x7fea0c602000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.440973 <... close resumed> ) = 0
[pid 25411] 10:12:34.440995 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25434] 10:12:34.441022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.441037 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.441053 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25411] 10:12:34.441082 recvfrom(16,  <unfinished ...>
[pid 25434] 10:12:34.441113 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.441141 mmap(0x7fea0c802000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25425] 10:12:34.441169 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25411] 10:12:34.441212 <... recvfrom resumed> "\327g\201\200\0\1\0\1\0\0\0\0\23phoenixmarriottmesa\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\7\7\0\v\0\n\6remote\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 64
[pid 25434] 10:12:34.441252 <... open resumed> ) = 6
[pid 25433] 10:12:34.441266 <... mmap resumed> ) = 0x7fea0c802000
[pid 25425] 10:12:34.441281 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.441316 close(16 <unfinished ...>
[pid 25434] 10:12:34.441351 read(6,  <unfinished ...>
[pid 25433] 10:12:34.441377 close(6 <unfinished ...>
[pid 25425] 10:12:34.441483 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.441534 <... close resumed> ) = 0
[pid 25434] 10:12:34.441584 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.441607 <... close resumed> ) = 0
[pid 25425] 10:12:34.441622 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.441661 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25434] 10:12:34.441694 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.441716 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.441745 <... open resumed> ) = 9
[pid 25411] 10:12:34.441763 <... socket resumed> ) = 16
[pid 25434] 10:12:34.441785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.441810 <... open resumed> ) = 6
[pid 25425] 10:12:34.441827 fstat(9,  <unfinished ...>
[pid 25411] 10:12:34.441850 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25434] 10:12:34.441885 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.441913 read(6,  <unfinished ...>
[pid 25425] 10:12:34.441935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.441968 <... connect resumed> ) = 0
[pid 25434] 10:12:34.441992 <... mmap resumed> ) = 0x7f13e5de3000
[pid 25433] 10:12:34.442006 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.442032 fstat(9,  <unfinished ...>
[pid 25411] 10:12:34.442057 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25434] 10:12:34.442089 mprotect(0x7f13e5e0c000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.442114 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.442135 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.442161 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25434] 10:12:34.442185 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.442198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25425] 10:12:34.442224 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.442253 sendto(16, "\277\330\1\0\0\1\0\0\0\0\0\0\6remote\23phoenixmarriottmesa\3com\0\0\1\0\1", 48, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25434] 10:12:34.442318 mmap(0x7f13e600c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25433] 10:12:34.442348 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.442379 <... mmap resumed> ) = 0x7f380d424000
[pid 25411] 10:12:34.442511 <... sendto resumed> ) = 48
[pid 25434] 10:12:34.442541 <... mmap resumed> ) = 0x7f13e600c000
[pid 25433] 10:12:34.442555 <... mmap resumed> ) = 0x7fea0c3d1000
[pid 25425] 10:12:34.442576 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.442601 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25434] 10:12:34.442632 mmap(0x7f13e600e000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.442659 mprotect(0x7fea0c3d6000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.442685 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.442707 <... mmap resumed> ) = 0x7f13e600e000
[pid 25433] 10:12:34.442720 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.442740 read(9,  <unfinished ...>
[pid 25434] 10:12:34.442773 close(6 <unfinished ...>
[pid 25433] 10:12:34.442795 mmap(0x7fea0c5d5000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25425] 10:12:34.442820 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25434] 10:12:34.442863 <... close resumed> ) = 0
[pid 25433] 10:12:34.442879 <... mmap resumed> ) = 0x7fea0c5d5000
[pid 25425] 10:12:34.442905 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.442943 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.442971 close(6 <unfinished ...>
[pid 25425] 10:12:34.442992 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.443035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.443051 <... close resumed> ) = 0
[pid 25425] 10:12:34.443072 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.443126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.443156 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.443182 <... select resumed> ) = 1 (in [11], left {299, 957171})
[pid 25425] 10:12:34.443204 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.443270 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.443289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.443306 recvfrom(11,  <unfinished ...>
[pid 25425] 10:12:34.443334 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25434] 10:12:34.443376 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.443494 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.443528 <... recvfrom resumed> "220 Go ahead with TLS\r\n", 4096, 0, NULL, NULL) = 23
[pid 25425] 10:12:34.445556 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.445601 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.445619 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.445637 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25425] 10:12:34.445674 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.445708 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.445736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.445765 <... open resumed> ) = 14
[pid 25425] 10:12:34.445786 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.445834 <... open resumed> ) = 6
[pid 25433] 10:12:34.445850 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.445866 fstat(14,  <unfinished ...>
[pid 25425] 10:12:34.445892 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.445925 read(6,  <unfinished ...>
[pid 25433] 10:12:34.445947 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.445973 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25425] 10:12:34.446008 <... open resumed> ) = 10
[pid 25434] 10:12:34.446031 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.446051 <... open resumed> ) = 6
[pid 25428] 10:12:34.446066 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25425] 10:12:34.446093 fstat(10,  <unfinished ...>
[pid 25434] 10:12:34.446120 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.446141 read(6,  <unfinished ...>
[pid 25428] 10:12:34.446168 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25425] 10:12:34.446191 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.446228 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25433] 10:12:34.446253 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.446275 read(14,  <unfinished ...>
[pid 25425] 10:12:34.446306 fstat(10,  <unfinished ...>
[pid 25434] 10:12:34.446335 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.446364 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.446391 <... read resumed> "\212Wo\304k~\242\223\337o\360\222}p\267>\364\17V\217\303\272\257]\32\200q\346\372B\0\205\314\313S\245P$\17\277\226\372a\350\214%\356\322", 48) = 48
[pid 25425] 10:12:34.446519 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.446556 <... mmap resumed> ) = 0x7f13e9a06000
[pid 25433] 10:12:34.446570 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25428] 10:12:34.446600 close(14 <unfinished ...>
[pid 25425] 10:12:34.446627 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.446662 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.446690 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.446717 <... close resumed> ) = 0
[pid 25425] 10:12:34.446750 <... mmap resumed> ) = 0x7f380d423000
[pid 25434] 10:12:34.446774 <... mmap resumed> ) = 0x7f13e5bcd000
[pid 25433] 10:12:34.446788 <... mmap resumed> ) = 0x7fea0c1ce000
[pid 25428] 10:12:34.446802 getuid( <unfinished ...>
[pid 25425] 10:12:34.446825 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.446853 mprotect(0x7f13e5be2000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.446879 mprotect(0x7fea0c1d0000, 2093056, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.446903 <... getuid resumed> ) = 47
[pid 25425] 10:12:34.452550 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.452589 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.452608 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.452624 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.452650 read(10,  <unfinished ...>
[pid 25434] 10:12:34.452682 mmap(0x7f13e5de1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25433] 10:12:34.452714 mmap(0x7fea0c3cf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25425] 10:12:34.452741 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25434] 10:12:34.452801 <... mmap resumed> ) = 0x7f13e5de1000
[pid 25433] 10:12:34.452820 <... mmap resumed> ) = 0x7fea0c3cf000
[pid 25425] 10:12:34.452846 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.452893 close(6 <unfinished ...>
[pid 25433] 10:12:34.452916 close(6 <unfinished ...>
[pid 25425] 10:12:34.452938 <... open resumed> ) = 11
[pid 25434] 10:12:34.452961 <... close resumed> ) = 0
[pid 25433] 10:12:34.452975 <... close resumed> ) = 0
[pid 25425] 10:12:34.453010 fstat(11,  <unfinished ...>
[pid 25434] 10:12:34.453051 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.453080 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.453107 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.453141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.453155 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.453171 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.453203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.453233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.453262 <... mmap resumed> ) = 0x7f380d422000
[pid 25434] 10:12:34.453283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.453297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.453314 read(11,  <unfinished ...>
[pid 25434] 10:12:34.453346 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.453374 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.453485 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.453528 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.453544 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.453561 close(11 <unfinished ...>
[pid 25434] 10:12:34.453594 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.453623 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.453651 <... close resumed> ) = 0
[pid 25434] 10:12:34.453672 <... open resumed> ) = 6
[pid 25433] 10:12:34.453685 <... open resumed> ) = 6
[pid 25425] 10:12:34.453699 munmap(0x7f380d422000, 4096 <unfinished ...>
[pid 25434] 10:12:34.453734 read(6,  <unfinished ...>
[pid 25433] 10:12:34.453757 read(6,  <unfinished ...>
[pid 25425] 10:12:34.453778 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.453833 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.453864 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.453886 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.453922 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.453944 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.453965 <... open resumed> ) = 11
[pid 25434] 10:12:34.453986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.454012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25425] 10:12:34.454040 fstat(11,  <unfinished ...>
[pid 25434] 10:12:34.454070 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.454098 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.454123 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.454158 <... mmap resumed> ) = 0x7f13e59c2000
[pid 25433] 10:12:34.454173 <... mmap resumed> ) = 0x7fea0f275000
[pid 25425] 10:12:34.454188 fstat(11,  <unfinished ...>
[pid 25434] 10:12:34.454220 mprotect(0x7f13e59cc000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.454247 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:34.454274 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.454307 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.454322 <... mmap resumed> ) = 0x7fea0bfab000
[pid 25425] 10:12:34.454337 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.454368 mmap(0x7f13e5bcb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25433] 10:12:34.454394 mprotect(0x7fea0bfc2000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.454530 <... mmap resumed> ) = 0x7f380d422000
[pid 25434] 10:12:34.454553 <... mmap resumed> ) = 0x7f13e5bcb000
[pid 25433] 10:12:34.454567 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.454591 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.454623 close(6 <unfinished ...>
[pid 25433] 10:12:34.454644 mmap(0x7fea0c1c2000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25425] 10:12:34.454671 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.454693 <... close resumed> ) = 0
[pid 25433] 10:12:34.454706 <... mmap resumed> ) = 0x7fea0c1c2000
[pid 25425] 10:12:34.454731 read(11,  <unfinished ...>
[pid 25434] 10:12:34.454773 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.454803 close(6 <unfinished ...>
[pid 25425] 10:12:34.454825 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25434] 10:12:34.454870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.454888 <... close resumed> ) = 0
[pid 25425] 10:12:34.454903 stat("/jail_owner",  <unfinished ...>
[pid 25434] 10:12:34.454961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.454992 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.455019 <... stat resumed> 0x7fffbdaa9dd0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.455046 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.455062 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.455077 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25434] 10:12:34.455113 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.455140 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.455169 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25434] 10:12:34.455209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.455224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.455241 stat("/usr/local/cpanel/3rdparty/mailman/lists/hiltongardeninn_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25434] 10:12:34.455277 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.455306 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.455335 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.455364 <... open resumed> ) = 6
[pid 25433] 10:12:34.455378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.455393 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25434] 10:12:34.455510 read(6,  <unfinished ...>
[pid 25433] 10:12:34.455533 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.455573 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25434] 10:12:34.455614 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.455635 <... open resumed> ) = 6
[pid 25428] 10:12:34.455650 <... open resumed> ) = 14
[pid 25425] 10:12:34.455665 stat("/usr/local/cpanel/3rdparty/mailman/lists/hiltongardeninn/config.pck",  <unfinished ...>
[pid 25434] 10:12:34.455712 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.455733 read(6,  <unfinished ...>
[pid 25428] 10:12:34.455755 fstat(14,  <unfinished ...>
[pid 25425] 10:12:34.455777 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.455810 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25433] 10:12:34.455837 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.455860 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.455886 stat("/etc/demouids",  <unfinished ...>
[pid 25434] 10:12:34.455920 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.455949 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.455970 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.455995 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.456053 <... mmap resumed> ) = 0x7f13e57bf000
[pid 25433] 10:12:34.456071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.456097 <... mmap resumed> ) = 0x7fb3682b7000
[pid 25425] 10:12:34.456114 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.456151 mprotect(0x7f13e57c1000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.456177 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.456204 read(14,  <unfinished ...>
[pid 25425] 10:12:34.456230 <... open resumed> ) = 12
[pid 25434] 10:12:34.456253 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.456266 <... mmap resumed> ) = 0x7fea0bd67000
[pid 25428] 10:12:34.456281 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25425] 10:12:34.456300 fstat(12,  <unfinished ...>
[pid 25434] 10:12:34.456345 mmap(0x7f13e59c0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25433] 10:12:34.456373 mprotect(0x7fea0bda8000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.456503 read(14,  <unfinished ...>
[pid 25425] 10:12:34.456533 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.456573 <... mmap resumed> ) = 0x7f13e59c0000
[pid 25433] 10:12:34.456587 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.456611 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25425] 10:12:34.456638 fstat(12,  <unfinished ...>
[pid 25434] 10:12:34.456769 close(6 <unfinished ...>
[pid 25433] 10:12:34.456792 mmap(0x7fea0bfa8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25428] 10:12:34.456822 read(14,  <unfinished ...>
[pid 25425] 10:12:34.456846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.456880 <... close resumed> ) = 0
[pid 25433] 10:12:34.456893 <... mmap resumed> ) = 0x7fea0bfa8000
[pid 25428] 10:12:34.456916 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25425] 10:12:34.456946 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.456992 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.457016 close(6 <unfinished ...>
[pid 25428] 10:12:34.457039 read(14,  <unfinished ...>
[pid 25425] 10:12:34.457061 <... mmap resumed> ) = 0x7f380d421000
[pid 25434] 10:12:34.457083 <... mmap resumed> ) = 0x7f13e9a05000
[pid 25433] 10:12:34.457097 <... close resumed> ) = 0
[pid 25428] 10:12:34.457127 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25425] 10:12:34.457157 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.457255 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.457286 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.457316 read(14,  <unfinished ...>
[pid 25425] 10:12:34.457339 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.457361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.457376 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.457392 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25425] 10:12:34.457495 read(12,  <unfinished ...>
[pid 25434] 10:12:34.457546 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.457581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.457616 read(14,  <unfinished ...>
[pid 25425] 10:12:34.457640 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.457671 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.457687 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.457702 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25425] 10:12:34.457722 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25434] 10:12:34.457819 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.457848 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.457880 read(14,  <unfinished ...>
[pid 25425] 10:12:34.457903 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25434] 10:12:34.458042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.458064 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.458081 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25425] 10:12:34.458103 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.458206 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.458235 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.458264 read(14,  <unfinished ...>
[pid 25425] 10:12:34.458287 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.458339 <... open resumed> ) = 6
[pid 25433] 10:12:34.458356 <... open resumed> ) = 6
[pid 25428] 10:12:34.458375 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25425] 10:12:34.458480 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.458586 read(6,  <unfinished ...>
[pid 25433] 10:12:34.458609 read(6,  <unfinished ...>
[pid 25428] 10:12:34.458632 read(14,  <unfinished ...>
[pid 25425] 10:12:34.458654 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.458697 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.458719 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.458747 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25425] 10:12:34.458767 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25434] 10:12:34.458820 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.458842 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.458864 read(14,  <unfinished ...>
[pid 25425] 10:12:34.458886 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.458932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25433] 10:12:34.458960 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.458987 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25425] 10:12:34.459007 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.459103 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.459133 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.459158 read(14,  <unfinished ...>
[pid 25425] 10:12:34.459181 <... open resumed> ) = 13
[pid 25434] 10:12:34.459203 <... mmap resumed> ) = 0x7f13e55a0000
[pid 25433] 10:12:34.459217 <... mmap resumed> ) = 0x7fea0f274000
[pid 25428] 10:12:34.459231 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25425] 10:12:34.459255 fstat(13,  <unfinished ...>
[pid 25434] 10:12:34.459348 mprotect(0x7f13e55bd000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.459377 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.459515 read(14,  <unfinished ...>
[pid 25425] 10:12:34.459544 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.459583 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.459597 <... mmap resumed> ) = 0x7fea0ba80000
[pid 25428] 10:12:34.459612 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25425] 10:12:34.459636 fstat(13,  <unfinished ...>
[pid 25434] 10:12:34.459732 mmap(0x7f13e57bc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25433] 10:12:34.459764 mprotect(0x7fea0bb5b000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.459791 read(14,  <unfinished ...>
[pid 25425] 10:12:34.459814 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.459849 <... mmap resumed> ) = 0x7f13e57bc000
[pid 25433] 10:12:34.459868 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.459888 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25425] 10:12:34.459908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.459992 mmap(0x7f13e57be000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.460020 mmap(0x7fea0bd5b000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25428] 10:12:34.460046 read(14,  <unfinished ...>
[pid 25425] 10:12:34.460069 <... mmap resumed> ) = 0x7f380d420000
[pid 25434] 10:12:34.460091 <... mmap resumed> ) = 0x7f13e57be000
[pid 25433] 10:12:34.460104 <... mmap resumed> ) = 0x7fea0bd5b000
[pid 25428] 10:12:34.460126 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25425] 10:12:34.460156 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.460234 close(6 <unfinished ...>
[pid 25433] 10:12:34.460256 close(6 <unfinished ...>
[pid 25428] 10:12:34.460276 read(14,  <unfinished ...>
[pid 25425] 10:12:34.460298 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.460320 <... close resumed> ) = 0
[pid 25433] 10:12:34.460334 <... close resumed> ) = 0
[pid 25428] 10:12:34.460394 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25425] 10:12:34.460516 read(13,  <unfinished ...>
[pid 25434] 10:12:34.460569 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.460596 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.460626 read(14,  <unfinished ...>
[pid 25425] 10:12:34.460649 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25434] 10:12:34.460681 <... mmap resumed> ) = 0x7f13e9a04000
[pid 25433] 10:12:34.460695 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.460749 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25425] 10:12:34.460770 read(13,  <unfinished ...>
[pid 25434] 10:12:34.460884 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.460910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.460940 read(14,  <unfinished ...>
[pid 25425] 10:12:34.460963 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.461006 <... mmap resumed> ) = 0x7f13e9a03000
[pid 25433] 10:12:34.461022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.461048 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25425] 10:12:34.461075 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.461160 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.461193 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.461222 read(14,  <unfinished ...>
[pid 25425] 10:12:34.461245 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.461297 <... mmap resumed> ) = 0x7f13e9a01000
[pid 25433] 10:12:34.461316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.461338 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25425] 10:12:34.461377 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.461514 arch_prctl(ARCH_SET_FS, 0x7f13e9a017c0 <unfinished ...>
[pid 25433] 10:12:34.461538 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.461568 read(14,  <unfinished ...>
[pid 25425] 10:12:34.461591 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25434] 10:12:34.461639 <... arch_prctl resumed> ) = 0
[pid 25433] 10:12:34.461655 <... open resumed> ) = 6
[pid 25428] 10:12:34.461713 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25425] 10:12:34.461734 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.461820 mprotect(0x7f13e57bc000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.461846 read(6,  <unfinished ...>
[pid 25428] 10:12:34.461869 read(14,  <unfinished ...>
[pid 25425] 10:12:34.461891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25434] 10:12:34.461952 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.461970 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.461997 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25425] 10:12:34.462017 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.462107 mprotect(0x7f13e59c0000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.462133 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.462155 read(14,  <unfinished ...>
[pid 25425] 10:12:34.462178 <... open resumed> ) = 14
[pid 25434] 10:12:34.462206 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.462220 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.462267 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25425] 10:12:34.462289 fstat(14,  <unfinished ...>
[pid 25434] 10:12:34.462379 mprotect(0x7f13e5bcb000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.462498 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.462531 read(14,  <unfinished ...>
[pid 25425] 10:12:34.462554 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.462590 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.462604 <... mmap resumed> ) = 0x7fea0b87c000
[pid 25428] 10:12:34.462630 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25425] 10:12:34.462650 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.462736 mprotect(0x7f13e5de1000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.462762 mprotect(0x7fea0b87f000, 2093056, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.462788 read(14,  <unfinished ...>
[pid 25425] 10:12:34.462811 <... mmap resumed> ) = 0x7f380d41f000
[pid 25434] 10:12:34.462832 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.462846 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.462876 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25425] 10:12:34.462896 read(14,  <unfinished ...>
[pid 25434] 10:12:34.462938 mprotect(0x7f13e600c000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.462963 mmap(0x7fea0ba7e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25428] 10:12:34.462991 read(14,  <unfinished ...>
[pid 25425] 10:12:34.463013 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.463049 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.463063 <... mmap resumed> ) = 0x7fea0ba7e000
[pid 25428] 10:12:34.463088 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25425] 10:12:34.463121 close(14 <unfinished ...>
[pid 25434] 10:12:34.463207 mprotect(0x7f13e6211000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.463233 close(6 <unfinished ...>
[pid 25428] 10:12:34.463254 read(14,  <unfinished ...>
[pid 25425] 10:12:34.463277 <... close resumed> ) = 0
[pid 25434] 10:12:34.463298 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.463318 <... close resumed> ) = 0
[pid 25428] 10:12:34.463539 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25425] 10:12:34.463574 munmap(0x7f380d41f000, 4096 <unfinished ...>
[pid 25434] 10:12:34.463663 mprotect(0x7f13e64ee000, 40960, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.463689 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.463718 read(14,  <unfinished ...>
[pid 25425] 10:12:34.463741 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.463772 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.463787 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.463892 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25425] 10:12:34.463914 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.463958 mprotect(0x7f13e673b000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.463982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.464013 read(14,  <unfinished ...>
[pid 25425] 10:12:34.464035 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25434] 10:12:34.464070 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.464084 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.464114 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25425] 10:12:34.464133 pipe( <unfinished ...>
[pid 25434] 10:12:34.464219 mprotect(0x7f13e6955000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.464245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.464275 read(14,  <unfinished ...>
[pid 25425] 10:12:34.464297 <... pipe resumed> [14, 15]) = 0
[pid 25434] 10:12:34.464322 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.464336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.464360 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25425] 10:12:34.464378 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25434] 10:12:34.464547 mprotect(0x7f13e6b62000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.464575 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.464607 read(14,  <unfinished ...>
[pid 25425] 10:12:34.464629 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25434] 10:12:34.464656 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.464670 <... open resumed> ) = 6
[pid 25428] 10:12:34.464894 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25425] 10:12:34.464919 close(12 <unfinished ...>
[pid 25434] 10:12:34.464961 mprotect(0x7f13e734e000, 110592, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.464986 read(6,  <unfinished ...>
[pid 25428] 10:12:34.465010 read(14,  <unfinished ...>
[pid 25425] 10:12:34.465032 <... close resumed> ) = 0
[pid 25434] 10:12:34.465053 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.465066 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.465161 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25425] 10:12:34.465181 munmap(0x7f380d421000, 4096 <unfinished ...>
[pid 25434] 10:12:34.465272 mprotect(0x7f13e75da000, 16384, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.465298 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.465324 read(14,  <unfinished ...>
[pid 25425] 10:12:34.465346 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.465369 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.465382 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.465583 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25425] 10:12:34.465604 close(9 <unfinished ...>
[pid 25434] 10:12:34.465693 mprotect(0x7f13e796f000, 16384, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.465720 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.465749 read(14,  <unfinished ...>
[pid 25425] 10:12:34.465772 <... close resumed> ) = 0
[pid 25434] 10:12:34.465793 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.465806 <... mmap resumed> ) = 0x7fea0b650000
[pid 25428] 10:12:34.465828 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25425] 10:12:34.465847 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25434] 10:12:34.465890 mprotect(0x7f13e7b7a000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.465914 mprotect(0x7fea0b679000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.465940 read(14,  <unfinished ...>
[pid 25425] 10:12:34.465962 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.465985 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.465998 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.466024 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25425] 10:12:34.466042 close(11 <unfinished ...>
[pid 25434] 10:12:34.466126 mprotect(0x7f13e7d7e000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.466158 mmap(0x7fea0b879000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25428] 10:12:34.466189 read(14,  <unfinished ...>
[pid 25425] 10:12:34.466211 <... close resumed> ) = 0
[pid 25434] 10:12:34.466233 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.466246 <... mmap resumed> ) = 0x7fea0b879000
[pid 25428] 10:12:34.467006 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25425] 10:12:34.467034 munmap(0x7f380d422000, 4096 <unfinished ...>
[pid 25434] 10:12:34.467128 mprotect(0x7f13e8ad6000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.467155 mmap(0x7fea0b87b000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.467184 read(14,  <unfinished ...>
[pid 25425] 10:12:34.467208 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.467231 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.467245 <... mmap resumed> ) = 0x7fea0b87b000
[pid 25428] 10:12:34.467286 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25425] 10:12:34.467308 close(13 <unfinished ...>
[pid 25434] 10:12:34.467458 mprotect(0x7f13e8f0b000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.467490 close(6 <unfinished ...>
[pid 25428] 10:12:34.467518 read(14,  <unfinished ...>
[pid 25425] 10:12:34.467542 <... close resumed> ) = 0
[pid 25434] 10:12:34.467564 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.467577 <... close resumed> ) = 0
[pid 25428] 10:12:34.467610 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25425] 10:12:34.467630 munmap(0x7f380d420000, 4096 <unfinished ...>
[pid 25434] 10:12:34.467726 mprotect(0x7f13e918f000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.467753 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.467783 read(14,  <unfinished ...>
[pid 25425] 10:12:34.467806 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.467828 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.467842 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.467866 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25425] 10:12:34.467885 close(10 <unfinished ...>
[pid 25434] 10:12:34.467925 mprotect(0x7f13e9398000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.467950 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.467980 read(14,  <unfinished ...>
[pid 25425] 10:12:34.468002 <... close resumed> ) = 0
[pid 25434] 10:12:34.468023 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.468036 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.468071 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25425] 10:12:34.468089 munmap(0x7f380d423000, 4096 <unfinished ...>
[pid 25434] 10:12:34.468195 mprotect(0x7f13e95dd000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.468221 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.468252 read(14,  <unfinished ...>
[pid 25425] 10:12:34.468275 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.468300 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.468315 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.468344 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25425] 10:12:34.468363 clone( <unfinished ...>
[pid 25434] 10:12:34.468802 mprotect(0x7f13e97f7000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.468832 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.468865 read(14,  <unfinished ...>
[pid 25434] 10:12:34.468894 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.468908 <... open resumed> ) = 6
[pid 25425] 10:12:34.468950 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25436
[pid 25434] 10:12:34.468994 mprotect(0x7f13e9a1a000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.469021 read(6,  <unfinished ...>
[pid 25428] 10:12:34.469044 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25425] 10:12:34.469062 close(15 <unfinished ...>
[pid 25434] 10:12:34.469159 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.469173 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.469198 read(14,  <unfinished ...>
[pid 25425] 10:12:34.469222 <... close resumed> ) = 0
[pid 25434] 10:12:34.469243 munmap(0x7f13e9a0f000, 39387 <unfinished ...>
[pid 25433] 10:12:34.469271 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.469294 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25425] 10:12:34.469313 read(14,  <unfinished ...>
[pid 25434] 10:12:34.469377 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.469464 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25428] 10:12:34.469505 read(14,  <unfinished ...>
[pid 25434] 10:12:34.469533 set_tid_address(0x7f13e9a01a90 <unfinished ...>
[pid 25433] 10:12:34.469556 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.469588 <... set_tid_address resumed> ) = 25434
[pid 25433] 10:12:34.469601 <... mmap resumed> ) = 0x7fea0f273000
[pid 25428] 10:12:34.469648 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25434] 10:12:34.469701 set_robust_list(0x7f13e9a01aa0, 24 <unfinished ...>
[pid 25433] 10:12:34.469804 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.469842 <... set_robust_list resumed> ) = 0
[pid 25433] 10:12:34.469855 <... mmap resumed> ) = 0x7fea0b43a000
[pid 25428] 10:12:34.469872 read(14,  <unfinished ...>
[pid 25434] 10:12:34.469898 futex(0x7fff12ff50dc, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25433] 10:12:34.469921 mprotect(0x7fea0b44f000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.469952 <... futex resumed> ) = 0
[pid 25433] 10:12:34.469965 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.469982 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25434] 10:12:34.470003 futex(0x7fff12ff50dc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f13e9a017c0 <unfinished ...>
[pid 25433] 10:12:34.470090 mmap(0x7fea0b64e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25434] 10:12:34.470125 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25433] 10:12:34.470141 <... mmap resumed> ) = 0x7fea0b64e000
[pid 25428] 10:12:34.470171 read(14,  <unfinished ...>
[pid 25434] 10:12:34.470201 rt_sigaction(SIGRTMIN, {0x7f13e88c4c60, [], SA_RESTORER|SA_SIGINFO, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.470227 close(6 <unfinished ...>
[pid 25434] 10:12:34.470254 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.470267 <... close resumed> ) = 0
[pid 25428] 10:12:34.470301 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25434] 10:12:34.470327 rt_sigaction(SIGRT_1, {0x7f13e88c4cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.470488 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.470526 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.470540 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.470559 read(14,  <unfinished ...>
[pid 25434] 10:12:34.470586 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25433] 10:12:34.470614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.470655 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25433] 10:12:34.470670 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.470698 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25434] 10:12:34.470720 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25433] 10:12:34.470794 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.470895 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25433] 10:12:34.470912 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.470972 read(14,  <unfinished ...>
[pid 25434] 10:12:34.471001 statfs("/selinux",  <unfinished ...>
[pid 25433] 10:12:34.471034 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.471069 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350357, f_bavail=6350357, f_files=1000000, f_ffree=691119, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25433] 10:12:34.471093 <... open resumed> ) = 6
[pid 25428] 10:12:34.471159 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25434] 10:12:34.471183 brk(0 <unfinished ...>
[pid 25433] 10:12:34.471269 read(6,  <unfinished ...>
[pid 25434] 10:12:34.471298 <... brk resumed> ) = 0x2742000
[pid 25433] 10:12:34.471313 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.471338 read(14,  <unfinished ...>
[pid 25434] 10:12:34.471365 brk(0x2763000 <unfinished ...>
[pid 25433] 10:12:34.471387 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.471480 <... brk resumed> ) = 0x2763000
[pid 25433] 10:12:34.471495 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25428] 10:12:34.471540 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25434] 10:12:34.471563 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.471611 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.471657 <... open resumed> ) = 6
[pid 25433] 10:12:34.471671 <... mmap resumed> ) = 0x7fea0b22f000
[pid 25428] 10:12:34.471709 read(14,  <unfinished ...>
[pid 25434] 10:12:34.471738 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.471759 mprotect(0x7fea0b239000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.471790 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25433] 10:12:34.471816 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.471835 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25434] 10:12:34.471856 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.471897 mmap(0x7fea0b438000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25434] 10:12:34.471931 <... mmap resumed> ) = 0x7f13e9a18000
[pid 25433] 10:12:34.471944 <... mmap resumed> ) = 0x7fea0b438000
[pid 25428] 10:12:34.471970 read(14,  <unfinished ...>
[pid 25434] 10:12:34.471999 read(6,  <unfinished ...>
[pid 25433] 10:12:34.472086 close(6 <unfinished ...>
[pid 25434] 10:12:34.472114 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25433] 10:12:34.472137 <... close resumed> ) = 0
[pid 25428] 10:12:34.472173 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25434] 10:12:34.472197 read(6,  <unfinished ...>
[pid 25433] 10:12:34.472300 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.472338 <... read resumed> "", 1024) = 0
[pid 25433] 10:12:34.472351 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.472378 read(14,  <unfinished ...>
[pid 25434] 10:12:34.472485 close(6 <unfinished ...>
[pid 25433] 10:12:34.472515 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.472552 <... close resumed> ) = 0
[pid 25433] 10:12:34.472566 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.472585 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25434] 10:12:34.472606 munmap(0x7f13e9a18000, 4096 <unfinished ...>
[pid 25433] 10:12:34.472718 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.472756 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.472769 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.472842 read(14,  <unfinished ...>
[pid 25434] 10:12:34.472872 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25433] 10:12:34.472903 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.472939 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.472953 <... open resumed> ) = 6
[pid 25428] 10:12:34.473038 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25434] 10:12:34.473063 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.473146 read(6,  <unfinished ...>
[pid 25434] 10:12:34.473175 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.473189 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.473226 read(14,  <unfinished ...>
[pid 25434] 10:12:34.473254 fstat(2,  <unfinished ...>
[pid 25433] 10:12:34.473276 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.473302 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25433] 10:12:34.473330 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25428] 10:12:34.473394 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25434] 10:12:34.473511 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.473618 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.473664 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.473680 <... mmap resumed> ) = 0x7fea0b02c000
[pid 25428] 10:12:34.473705 read(14,  <unfinished ...>
[pid 25434] 10:12:34.473732 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f13e76176a0},  <unfinished ...>
[pid 25433] 10:12:34.473759 mprotect(0x7fea0b02e000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.473790 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25433] 10:12:34.473806 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.473823 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25434] 10:12:34.473844 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f13e76176a0},  <unfinished ...>
[pid 25433] 10:12:34.473933 mmap(0x7fea0b22d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25434] 10:12:34.473969 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25433] 10:12:34.473985 <... mmap resumed> ) = 0x7fea0b22d000
[pid 25428] 10:12:34.474012 read(14,  <unfinished ...>
[pid 25434] 10:12:34.474041 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.474066 close(6 <unfinished ...>
[pid 25434] 10:12:34.474092 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.474105 <... close resumed> ) = 0
[pid 25428] 10:12:34.474140 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25434] 10:12:34.474163 umask(0 <unfinished ...>
[pid 25433] 10:12:34.474250 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.474283 <... umask resumed> ) = 022
[pid 25433] 10:12:34.474297 <... mmap resumed> ) = 0x7fea0f272000
[pid 25428] 10:12:34.474365 read(14,  <unfinished ...>
[pid 25434] 10:12:34.474468 geteuid( <unfinished ...>
[pid 25433] 10:12:34.474497 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.474534 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.474547 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.474568 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25434] 10:12:34.474591 getuid( <unfinished ...>
[pid 25433] 10:12:34.474679 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.474716 <... getuid resumed> ) = 503
[pid 25433] 10:12:34.474731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.474753 read(14,  <unfinished ...>
[pid 25434] 10:12:34.474780 getgid( <unfinished ...>
[pid 25433] 10:12:34.474800 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.474833 <... getgid resumed> ) = 499
[pid 25433] 10:12:34.474846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.474885 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25434] 10:12:34.474909 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25433] 10:12:34.474943 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.474976 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25433] 10:12:34.474992 <... open resumed> ) = 6
[pid 25428] 10:12:34.475009 read(14,  <unfinished ...>
[pid 25434] 10:12:34.475035 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25433] 10:12:34.475056 read(6,  <unfinished ...>
[pid 25434] 10:12:34.475083 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25433] 10:12:34.475098 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25428] 10:12:34.475124 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25434] 10:12:34.475144 getgroups(65536,  <unfinished ...>
[pid 25433] 10:12:34.475224 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.475253 <... getgroups resumed> [500]) = 1
[pid 25433] 10:12:34.475268 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25428] 10:12:34.475307 read(14,  <unfinished ...>
[pid 25434] 10:12:34.475336 setgroups(0, [] <unfinished ...>
[pid 25433] 10:12:34.475359 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25434] 10:12:34.475394 <... setgroups resumed> ) = 0
[pid 25433] 10:12:34.475490 <... mmap resumed> ) = 0x7fea0ae0d000
[pid 25428] 10:12:34.475513 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25434] 10:12:34.475536 getegid( <unfinished ...>
[pid 25433] 10:12:34.475616 mprotect(0x7fea0ae2a000, 2093056, PROT_NONE <unfinished ...>
[pid 25434] 10:12:34.475649 <... getegid resumed> ) = 499
[pid 25433] 10:12:34.475665 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.475681 read(14,  <unfinished ...>
[pid 25434] 10:12:34.475707 geteuid( <unfinished ...>
[pid 25433] 10:12:34.475728 mmap(0x7fea0b029000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25434] 10:12:34.475763 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.475784 <... mmap resumed> ) = 0x7fea0b029000
[pid 25428] 10:12:34.475805 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25434] 10:12:34.475827 geteuid( <unfinished ...>
[pid 25433] 10:12:34.475867 mmap(0x7fea0b02b000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.475901 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.475917 <... mmap resumed> ) = 0x7fea0b02b000
[pid 25428] 10:12:34.475939 brk(0x1c2c000 <unfinished ...>
[pid 25434] 10:12:34.475967 getegid( <unfinished ...>
[pid 25433] 10:12:34.475989 close(6 <unfinished ...>
[pid 25434] 10:12:34.476015 <... getegid resumed> ) = 499
[pid 25433] 10:12:34.476033 <... close resumed> ) = 0
[pid 25428] 10:12:34.476085 <... brk resumed> ) = 0x1c2c000
[pid 25434] 10:12:34.476104 setgid(499 <unfinished ...>
[pid 25433] 10:12:34.476187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.476220 <... setgid resumed> ) = 0
[pid 25433] 10:12:34.476238 <... mmap resumed> ) = 0x7fea0f271000
[pid 25428] 10:12:34.476292 read(14,  <unfinished ...>
[pid 25434] 10:12:34.476320 setuid(0 <unfinished ...>
[pid 25433] 10:12:34.476344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.476374 <... setuid resumed> ) = 0
[pid 25433] 10:12:34.476486 <... mmap resumed> ) = 0x7fea0f270000
[pid 25428] 10:12:34.476520 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25434] 10:12:34.476544 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.476626 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.476658 <... open resumed> ) = 6
[pid 25433] 10:12:34.476695 <... mmap resumed> ) = 0x7fea0f26e000
[pid 25428] 10:12:34.476718 read(14,  <unfinished ...>
[pid 25434] 10:12:34.476745 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.476768 arch_prctl(ARCH_SET_FS, 0x7fea0f26e7c0 <unfinished ...>
[pid 25434] 10:12:34.476795 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.476829 <... arch_prctl resumed> ) = 0
[pid 25428] 10:12:34.476880 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25434] 10:12:34.476903 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.476986 mprotect(0x7fea0b029000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.477018 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.477046 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.477066 read(14,  <unfinished ...>
[pid 25434] 10:12:34.477093 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.477118 mprotect(0x7fea0b22d000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.477148 <... mmap resumed> ) = 0x7f13e9a18000
[pid 25433] 10:12:34.477164 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.477196 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25434] 10:12:34.477218 read(6,  <unfinished ...>
[pid 25433] 10:12:34.477305 mprotect(0x7fea0b438000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.477339 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25433] 10:12:34.477554 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.477589 read(14,  <unfinished ...>
[pid 25434] 10:12:34.477618 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.477649 mprotect(0x7fea0b64e000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.477679 <... socket resumed> ) = 7
[pid 25433] 10:12:34.477695 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.477724 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25434] 10:12:34.477748 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.477849 mprotect(0x7fea0b879000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.477881 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.477899 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.477925 read(14,  <unfinished ...>
[pid 25434] 10:12:34.477953 close(7 <unfinished ...>
[pid 25433] 10:12:34.477979 mprotect(0x7fea0ba7e000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.478008 <... close resumed> ) = 0
[pid 25433] 10:12:34.478024 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.478145 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25434] 10:12:34.478169 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.478254 mprotect(0x7fea0bd5b000, 40960, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.478286 <... socket resumed> ) = 7
[pid 25433] 10:12:34.478302 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.478459 read(14,  <unfinished ...>
[pid 25434] 10:12:34.478494 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.478531 mprotect(0x7fea0bfa8000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.478569 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.478589 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.478616 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25434] 10:12:34.478640 close(7 <unfinished ...>
[pid 25433] 10:12:34.478730 mprotect(0x7fea0c1c2000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.478762 <... close resumed> ) = 0
[pid 25433] 10:12:34.478785 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.478807 read(14,  <unfinished ...>
[pid 25434] 10:12:34.478834 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.478864 mprotect(0x7fea0c3cf000, 4096, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.478894 <... open resumed> ) = 7
[pid 25433] 10:12:34.478912 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.479122 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25434] 10:12:34.479146 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.479229 mprotect(0x7fea0cbbb000, 110592, PROT_READ <unfinished ...>
[pid 25434] 10:12:34.479267 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25433] 10:12:34.479298 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.479379 read(14,  <unfinished ...>
[pid 25434] 10:12:34.479478 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.479507 mprotect(0x7fea0ce47000, 16384, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.479533 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25434] 10:12:34.479555 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.479639 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.479746 read(7,  <unfinished ...>
[pid 25433] 10:12:34.479779 mprotect(0x7fea0d1dc000, 16384, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.479805 read(14,  <unfinished ...>
[pid 25434] 10:12:34.479831 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25433] 10:12:34.479868 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.479894 read(7,  <unfinished ...>
[pid 25433] 10:12:34.479917 mprotect(0x7fea0d3e7000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.479942 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25434] 10:12:34.479963 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.480039 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.480072 close(7 <unfinished ...>
[pid 25433] 10:12:34.480097 mprotect(0x7fea0d5eb000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.480123 read(14,  <unfinished ...>
[pid 25434] 10:12:34.480149 <... close resumed> ) = 0
[pid 25433] 10:12:34.480165 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.480877 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.480916 mprotect(0x7fea0e343000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.480944 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25434] 10:12:34.480966 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.481010 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481052 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.481084 mprotect(0x7fea0e778000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.481109 read(14,  <unfinished ...>
[pid 25434] 10:12:34.481137 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.481155 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481179 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.481211 mprotect(0x7fea0e9fc000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.481237 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25434] 10:12:34.481263 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.481346 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481375 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.481474 mprotect(0x7fea0ec05000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.481503 read(14,  <unfinished ...>
[pid 25434] 10:12:34.481530 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.481548 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481585 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.481624 mprotect(0x7fea0ee4a000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.481652 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25434] 10:12:34.481676 <... open resumed> ) = 7
[pid 25433] 10:12:34.481771 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481805 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.481829 mprotect(0x7fea0f064000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.481855 read(14,  <unfinished ...>
[pid 25434] 10:12:34.481881 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25433] 10:12:34.481911 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.481955 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25433] 10:12:34.481984 mprotect(0x7fea0f287000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.482009 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25434] 10:12:34.482031 <... mmap resumed> ) = 0x7f13e99f7000
[pid 25433] 10:12:34.482057 <... mprotect resumed> ) = 0
[pid 25434] 10:12:34.482078 close(7 <unfinished ...>
[pid 25433] 10:12:34.482100 munmap(0x7fea0f27c000, 39387 <unfinished ...>
[pid 25428] 10:12:34.482128 read(14,  <unfinished ...>
[pid 25434] 10:12:34.482154 <... close resumed> ) = 0
[pid 25433] 10:12:34.482179 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.482200 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.482231 set_tid_address(0x7fea0f26ea90 <unfinished ...>
[pid 25428] 10:12:34.482254 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25434] 10:12:34.482274 <... open resumed> ) = 7
[pid 25433] 10:12:34.482349 <... set_tid_address resumed> ) = 25433
[pid 25434] 10:12:34.482374 read(7,  <unfinished ...>
[pid 25433] 10:12:34.482469 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25428] 10:12:34.482499 read(14,  <unfinished ...>
[pid 25434] 10:12:34.482526 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.482550 <... set_robust_list resumed> ) = 0
[pid 25434] 10:12:34.482576 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.482603 futex(0x7ffc7275c94c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25428] 10:12:34.482633 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25434] 10:12:34.482654 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.482710 <... futex resumed> ) = 0
[pid 25434] 10:12:34.482732 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25433] 10:12:34.482763 futex(0x7ffc7275c94c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fea0f26e7c0 <unfinished ...>
[pid 25428] 10:12:34.482788 read(14,  <unfinished ...>
[pid 25434] 10:12:34.482814 <... mmap resumed> ) = 0x7f13e5392000
[pid 25433] 10:12:34.482831 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25434] 10:12:34.482858 mprotect(0x7f13e539e000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.482887 rt_sigaction(SIGRTMIN, {0x7fea0e131c60, [], SA_RESTORER|SA_SIGINFO, 0x7fea0e13b790},  <unfinished ...>
[pid 25428] 10:12:34.482914 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25434] 10:12:34.482934 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.483031 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.483056 mmap(0x7f13e559e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25433] 10:12:34.483085 rt_sigaction(SIGRT_1, {0x7fea0e131cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fea0e13b790},  <unfinished ...>
[pid 25428] 10:12:34.483112 read(14,  <unfinished ...>
[pid 25434] 10:12:34.483138 <... mmap resumed> ) = 0x7f13e559e000
[pid 25433] 10:12:34.483164 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.483187 close(7 <unfinished ...>
[pid 25433] 10:12:34.483209 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25428] 10:12:34.483234 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25434] 10:12:34.483254 <... close resumed> ) = 0
[pid 25433] 10:12:34.483350 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25434] 10:12:34.483384 mprotect(0x7f13e559e000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.483495 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25428] 10:12:34.483520 read(14,  <unfinished ...>
[pid 25434] 10:12:34.483547 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.483567 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25434] 10:12:34.483633 munmap(0x7f13e99f7000, 39387 <unfinished ...>
[pid 25433] 10:12:34.483669 statfs("/selinux",  <unfinished ...>
[pid 25428] 10:12:34.483707 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25434] 10:12:34.483729 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.483819 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350357, f_bavail=6350357, f_files=1000000, f_ffree=691119, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25434] 10:12:34.483902 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.483935 brk(0 <unfinished ...>
[pid 25428] 10:12:34.483957 read(14,  <unfinished ...>
[pid 25434] 10:12:34.483983 <... open resumed> ) = 7
[pid 25433] 10:12:34.484004 <... brk resumed> ) = 0x7ce000
[pid 25434] 10:12:34.484025 fcntl(7, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.484047 brk(0x7ef000 <unfinished ...>
[pid 25428] 10:12:34.484071 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25434] 10:12:34.484092 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25433] 10:12:34.484183 <... brk resumed> ) = 0x7ef000
[pid 25434] 10:12:34.484216 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.484240 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.484273 read(14,  <unfinished ...>
[pid 25434] 10:12:34.484299 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.484328 <... open resumed> ) = 6
[pid 25434] 10:12:34.484360 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.484388 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.484482 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25434] 10:12:34.484506 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.484597 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.484642 read(7,  <unfinished ...>
[pid 25433] 10:12:34.484674 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.484703 read(14,  <unfinished ...>
[pid 25434] 10:12:34.484730 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.484769 <... mmap resumed> ) = 0x7fea0f285000
[pid 25434] 10:12:34.484791 close(7 <unfinished ...>
[pid 25433] 10:12:34.484816 read(6,  <unfinished ...>
[pid 25428] 10:12:34.484897 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25434] 10:12:34.484919 <... close resumed> ) = 0
[pid 25433] 10:12:34.485003 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25434] 10:12:34.485039 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.485068 read(6,  <unfinished ...>
[pid 25428] 10:12:34.485091 read(14,  <unfinished ...>
[pid 25434] 10:12:34.485116 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.485152 <... read resumed> "", 1024) = 0
[pid 25434] 10:12:34.485182 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.485215 close(6 <unfinished ...>
[pid 25428] 10:12:34.485242 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25434] 10:12:34.485264 <... socket resumed> ) = 7
[pid 25433] 10:12:34.485341 <... close resumed> ) = 0
[pid 25434] 10:12:34.485366 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.485478 munmap(0x7fea0f285000, 4096 <unfinished ...>
[pid 25428] 10:12:34.485511 read(14,  <unfinished ...>
[pid 25434] 10:12:34.485538 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.485556 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.485625 close(7 <unfinished ...>
[pid 25433] 10:12:34.485660 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25428] 10:12:34.485700 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25434] 10:12:34.485722 <... close resumed> ) = 0
[pid 25433] 10:12:34.485793 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.485881 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.485912 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fea0e13b790},  <unfinished ...>
[pid 25428] 10:12:34.485939 read(14,  <unfinished ...>
[pid 25434] 10:12:34.485966 <... socket resumed> ) = 7
[pid 25433] 10:12:34.485981 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.486010 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.486042 fstat(2,  <unfinished ...>
[pid 25428] 10:12:34.486065 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25434] 10:12:34.486086 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.486154 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25434] 10:12:34.486220 close(7 <unfinished ...>
[pid 25433] 10:12:34.486250 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fea0e13b790},  <unfinished ...>
[pid 25428] 10:12:34.486277 read(14,  <unfinished ...>
[pid 25434] 10:12:34.486303 <... close resumed> ) = 0
[pid 25433] 10:12:34.486324 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.486351 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.486383 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25428] 10:12:34.486479 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25434] 10:12:34.486503 <... open resumed> ) = 7
[pid 25433] 10:12:34.486531 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25434] 10:12:34.486556 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.486579 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25428] 10:12:34.486609 brk(0x1c4d000 <unfinished ...>
[pid 25434] 10:12:34.486642 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.486684 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25434] 10:12:34.486726 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.486754 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fea0e13b790},  <unfinished ...>
[pid 25428] 10:12:34.486779 <... brk resumed> ) = 0x1c4d000
[pid 25434] 10:12:34.486796 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.486864 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.486898 read(7,  <unfinished ...>
[pid 25433] 10:12:34.486926 umask(0 <unfinished ...>
[pid 25428] 10:12:34.486949 read(14,  <unfinished ...>
[pid 25434] 10:12:34.486975 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.487009 <... umask resumed> ) = 0
[pid 25434] 10:12:34.487066 close(7 <unfinished ...>
[pid 25433] 10:12:34.487095 geteuid( <unfinished ...>
[pid 25428] 10:12:34.487116 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25434] 10:12:34.487137 <... close resumed> ) = 0
[pid 25433] 10:12:34.487213 <... geteuid resumed> ) = 0
[pid 25434] 10:12:34.487239 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.487267 getuid( <unfinished ...>
[pid 25428] 10:12:34.487289 read(14,  <unfinished ...>
[pid 25434] 10:12:34.487314 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.487347 <... getuid resumed> ) = 47
[pid 25434] 10:12:34.487374 read(6,  <unfinished ...>
[pid 25433] 10:12:34.487473 getgid( <unfinished ...>
[pid 25428] 10:12:34.487501 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25434] 10:12:34.487524 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25433] 10:12:34.487652 <... getgid resumed> ) = 12
[pid 25434] 10:12:34.487710 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.487744 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25428] 10:12:34.487766 read(14,  <unfinished ...>
[pid 25434] 10:12:34.487792 <... open resumed> ) = 7
[pid 25433] 10:12:34.487809 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25434] 10:12:34.487832 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.487855 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25428] 10:12:34.487876 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25434] 10:12:34.487897 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.487937 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25434] 10:12:34.487967 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.487995 getgroups(65536,  <unfinished ...>
[pid 25428] 10:12:34.488017 read(14,  <unfinished ...>
[pid 25434] 10:12:34.488042 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.488059 <... getgroups resumed> [12]) = 1
[pid 25434] 10:12:34.488085 read(7,  <unfinished ...>
[pid 25433] 10:12:34.488111 setgroups(0, [] <unfinished ...>
[pid 25428] 10:12:34.488134 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25434] 10:12:34.488155 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.488233 <... setgroups resumed> ) = 0
[pid 25434] 10:12:34.488260 close(7 <unfinished ...>
[pid 25433] 10:12:34.488284 getegid( <unfinished ...>
[pid 25428] 10:12:34.488306 read(14,  <unfinished ...>
[pid 25434] 10:12:34.488332 <... close resumed> ) = 0
[pid 25433] 10:12:34.488349 <... getegid resumed> ) = 12
[pid 25434] 10:12:34.488369 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.488472 geteuid( <unfinished ...>
[pid 25428] 10:12:34.488501 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25434] 10:12:34.488524 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.488610 <... geteuid resumed> ) = 0
[pid 25434] 10:12:34.488644 read(6,  <unfinished ...>
[pid 25433] 10:12:34.488673 geteuid( <unfinished ...>
[pid 25428] 10:12:34.488696 read(14,  <unfinished ...>
[pid 25434] 10:12:34.488726 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25433] 10:12:34.488765 <... geteuid resumed> ) = 0
[pid 25434] 10:12:34.488787 uname( <unfinished ...>
[pid 25433] 10:12:34.488866 getegid( <unfinished ...>
[pid 25428] 10:12:34.488890 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25434] 10:12:34.488912 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25433] 10:12:34.489011 <... getegid resumed> ) = 12
[pid 25434] 10:12:34.489043 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f13e76176a0},  <unfinished ...>
[pid 25433] 10:12:34.489073 setgid(12 <unfinished ...>
[pid 25428] 10:12:34.489096 read(14,  <unfinished ...>
[pid 25434] 10:12:34.489122 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, 8) = 0
[pid 25433] 10:12:34.489149 <... setgid resumed> ) = 0
[pid 25434] 10:12:34.489172 clone( <unfinished ...>
[pid 25433] 10:12:34.489390 setuid(0 <unfinished ...>
[pid 25428] 10:12:34.489470 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25433] 10:12:34.489504 <... setuid resumed> ) = 0
[pid 25434] 10:12:34.489554 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f13e9a01a90) = 25437
[pid 25433] 10:12:34.489604 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.489648 wait4(25437,  <unfinished ...>
[pid 25433] 10:12:34.489737 <... open resumed> ) = 6
[pid 25433] 10:12:34.489775 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.489801 read(14,  <unfinished ...>
[pid 25433] 10:12:34.489823 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.489859 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.489904 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f285000
[pid 25433] 10:12:34.489940 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25433] 10:12:34.490074 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25433] 10:12:34.490116 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.490160 close(7)    = 0
[pid 25433] 10:12:34.490195 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25433] 10:12:34.490229 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.490268 close(7)    = 0
[pid 25433] 10:12:34.490307 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25433] 10:12:34.490349 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25433] 10:12:34.490395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25428] 10:12:34.490509 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25433] 10:12:34.490531 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25433] 10:12:34.490656 read(7, "", 4096) = 0
[pid 25428] 10:12:34.490703 read(14,  <unfinished ...>
[pid 25433] 10:12:34.490727 close(7)    = 0
[pid 25433] 10:12:34.490760 munmap(0x7fea0f284000, 4096) = 0
[pid 25433] 10:12:34.490807 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.490850 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.490891 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.490930 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25433] 10:12:34.490967 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25433] 10:12:34.491018 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fea0f264000
[pid 25433] 10:12:34.491056 close(7)    = 0
[pid 25433] 10:12:34.491096 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25433] 10:12:34.491135 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.491175 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.491223 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fea0abff000
[pid 25433] 10:12:34.491264 mprotect(0x7fea0ac0b000, 2097152, PROT_NONE) = 0
[pid 25433] 10:12:34.491299 mmap(0x7fea0ae0b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fea0ae0b000
[pid 25433] 10:12:34.491347 close(7)    = 0
[pid 25433] 10:12:34.491481 mprotect(0x7fea0ae0b000, 4096, PROT_READ <unfinished ...>
[pid 25428] 10:12:34.491515 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25433] 10:12:34.491537 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.491559 munmap(0x7fea0f264000, 39387) = 0
[pid 25433] 10:12:34.491608 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25433] 10:12:34.491658 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25433] 10:12:34.491695 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.491815 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.491844 read(14,  <unfinished ...>
[pid 25433] 10:12:34.491866 <... mmap resumed> ) = 0x7fea0f284000
[pid 25433] 10:12:34.491885 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.491941 close(7)    = 0
[pid 25433] 10:12:34.491975 munmap(0x7fea0f284000, 4096) = 0
[pid 25433] 10:12:34.492027 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25433] 10:12:34.492067 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.492110 close(7)    = 0
[pid 25433] 10:12:34.492144 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25433] 10:12:34.492177 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.492216 close(7)    = 0
[pid 25433] 10:12:34.492253 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25433] 10:12:34.492292 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.492341 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25433] 10:12:34.492379 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25428] 10:12:34.492505 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25433] 10:12:34.492528 close(7)    = 0
[pid 25433] 10:12:34.492561 munmap(0x7fea0f284000, 4096) = 0
[pid 25433] 10:12:34.492678 read(6,  <unfinished ...>
[pid 25428] 10:12:34.492715 read(14,  <unfinished ...>
[pid 25433] 10:12:34.492739 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25433] 10:12:34.492795 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25433] 10:12:34.492838 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.492883 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25433] 10:12:34.492918 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.492960 close(7)    = 0
[pid 25433] 10:12:34.492993 munmap(0x7fea0f284000, 4096) = 0
[pid 25433] 10:12:34.493034 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25433] 10:12:34.493087 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25433] 10:12:34.493144 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, {SIG_DFL, [], SA_RESTORER, 0x7fea0e13b790}, 8) = 0
[pid 25433] 10:12:34.493194 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25438
[pid 25433] 10:12:34.493515 wait4(25438,  <unfinished ...>
[pid 25428] 10:12:34.493553 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25428] 10:12:34.493591 read(14, "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25428] 10:12:34.493721 read(14, "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25428] 10:12:34.493830 read(14, "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25428] 10:12:34.493932 read(14, "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25428] 10:12:34.494028 read(14, "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25428] 10:12:34.494116 read(14, "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25428] 10:12:34.494222 read(14, "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25428] 10:12:34.494271 read(14, "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25428] 10:12:34.494365 read(14, ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25428] 10:12:34.494511 read(14, "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25428] 10:12:34.494605 read(14, "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25428] 10:12:34.494657 read(14, "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25428] 10:12:34.494746 read(14, ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25428] 10:12:34.494844 read(14, "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25428] 10:12:34.494897 read(14, "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25428] 10:12:34.495008 read(14, "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25428] 10:12:34.495108 read(14, "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25428] 10:12:34.495157 brk(0x1c6e000) = 0x1c6e000
[pid 25428] 10:12:34.495249 read(14, "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25428] 10:12:34.495366 read(14, ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25428] 10:12:34.495514 read(14, "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25428] 10:12:34.495606 read(14, "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25428] 10:12:34.495710 read(14, " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
Process 25436 attached
[pid 25428] 10:12:34.495785 read(14,  <unfinished ...>
[pid 25436] 10:12:34.495833 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25428] 10:12:34.495855 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25436] 10:12:34.495969 <... set_robust_list resumed> ) = 0
[pid 25428] 10:12:34.495986 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496043 close(14 <unfinished ...>
[pid 25428] 10:12:34.496063 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25436] 10:12:34.496101 <... close resumed> ) = 0
[pid 25428] 10:12:34.496115 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496152 geteuid( <unfinished ...>
[pid 25428] 10:12:34.496171 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25436] 10:12:34.496257 <... geteuid resumed> ) = 0
[pid 25428] 10:12:34.496274 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496303 getegid( <unfinished ...>
[pid 25428] 10:12:34.496325 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25436] 10:12:34.496501 <... getegid resumed> ) = 12
[pid 25428] 10:12:34.496522 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496557 setgid(500 <unfinished ...>
[pid 25428] 10:12:34.496577 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25436] 10:12:34.496613 <... setgid resumed> ) = 0
[pid 25428] 10:12:34.496627 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496657 setuid(503 <unfinished ...>
[pid 25428] 10:12:34.496676 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25436] 10:12:34.496757 <... setuid resumed> ) = 0
[pid 25428] 10:12:34.496774 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496832 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.496855 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25436] 10:12:34.496895 <... open resumed> ) = 9
[pid 25428] 10:12:34.496909 read(14,  <unfinished ...>
[pid 25436] 10:12:34.496944 fstat(9,  <unfinished ...>
[pid 25428] 10:12:34.496963 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25436] 10:12:34.497037 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25428] 10:12:34.497068 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497115 brk(0x25a9000 <unfinished ...>
[pid 25428] 10:12:34.497135 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25436] 10:12:34.497173 <... brk resumed> ) = 0x25a9000
[pid 25428] 10:12:34.497187 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497284 fstat(9,  <unfinished ...>
[pid 25428] 10:12:34.497305 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25436] 10:12:34.497484 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25428] 10:12:34.497520 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497553 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.497575 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25436] 10:12:34.497663 <... mmap resumed> ) = 0x7f380d424000
[pid 25428] 10:12:34.497681 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497711 read(9,  <unfinished ...>
[pid 25428] 10:12:34.497730 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25436] 10:12:34.497810 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25428] 10:12:34.497832 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497862 read(9,  <unfinished ...>
[pid 25428] 10:12:34.497881 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25436] 10:12:34.497921 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25428] 10:12:34.497940 read(14,  <unfinished ...>
[pid 25436] 10:12:34.497971 close(9 <unfinished ...>
[pid 25428] 10:12:34.497991 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25436] 10:12:34.498080 <... close resumed> ) = 0
[pid 25428] 10:12:34.498097 read(14,  <unfinished ...>
[pid 25436] 10:12:34.498127 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25428] 10:12:34.498147 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25436] 10:12:34.498222 <... munmap resumed> ) = 0
[pid 25428] 10:12:34.498239 read(14, "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25428] 10:12:34.498711 read(14, ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25428] 10:12:34.498809 read(14, ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25428] 10:12:34.498900 read(14, ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25436] 10:12:34.499116 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25428] 10:12:34.499153 read(14, "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25428] 10:12:34.499243 read(14, ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25428] 10:12:34.499332 read(14, "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25428] 10:12:34.499383 read(14, ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25428] 10:12:34.499547 read(14, "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25428] 10:12:34.499616 brk(0x1c8f000) = 0x1c8f000
[pid 25428] 10:12:34.499681 read(14, "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25428] 10:12:34.499731 read(14,  <unfinished ...>
[pid 25436] 10:12:34.499762 <... lseek resumed> ) = 19
[pid 25428] 10:12:34.499776 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25436] 10:12:34.499853 read(6,  <unfinished ...>
[pid 25428] 10:12:34.499877 read(14,  <unfinished ...>
[pid 25436] 10:12:34.499907 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2373) = 1858
[pid 25428] 10:12:34.499925 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25428] 10:12:34.500463 read(14, "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25428] 10:12:34.500570 read(14, "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25428] 10:12:34.500668 read(14, ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25428] 10:12:34.500775 read(14, "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25428] 10:12:34.500876 read(14, "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25428] 10:12:34.500928 read(14, "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25428] 10:12:34.501031 read(14, ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25428] 10:12:34.501081 read(14, "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25428] 10:12:34.501181 read(14, "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25428] 10:12:34.501231 read(14, "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25428] 10:12:34.501320 read(14, "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25428] 10:12:34.501372 read(14, "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25428] 10:12:34.501545 read(14, "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25428] 10:12:34.501600 read(14, "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25428] 10:12:34.501689 read(14, "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25428] 10:12:34.501786 read(14, "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25428] 10:12:34.501840 read(14, "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25428] 10:12:34.501935 read(14, ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25428] 10:12:34.501985 read(14, "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25428] 10:12:34.502078 read(14, "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25428] 10:12:34.502172 read(14, "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25428] 10:12:34.502267 read(14, "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25428] 10:12:34.502363 read(14, "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25428] 10:12:34.502495 read(14, "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25428] 10:12:34.502595 read(14, "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25428] 10:12:34.502705 read(14, "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25428] 10:12:34.502809 read(14, ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25428] 10:12:34.502901 brk(0x1cb0000 <unfinished ...>
[pid 25436] 10:12:34.502935 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25428] 10:12:34.502958 <... brk resumed> ) = 0x1cb0000
[pid 25436] 10:12:34.503003 <... write resumed> ) = 4
[pid 25428] 10:12:34.503019 read(14,  <unfinished ...>
[pid 25425] 10:12:34.503039 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25425] 10:12:34.503060 read(14,  <unfinished ...>
[pid 25436] 10:12:34.503092 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25428] 10:12:34.503114 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25436] 10:12:34.503163 <... write resumed> ) = 4
[pid 25428] 10:12:34.503177 read(14,  <unfinished ...>
[pid 25425] 10:12:34.503196 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25425] 10:12:34.503215 read(14,  <unfinished ...>
[pid 25436] 10:12:34.503247 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25428] 10:12:34.503267 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25436] 10:12:34.503351 <... write resumed> ) = 4
[pid 25428] 10:12:34.503369 read(14,  <unfinished ...>
[pid 25425] 10:12:34.503389 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.503488 read(14,  <unfinished ...>
[pid 25436] 10:12:34.503525 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25428] 10:12:34.503548 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25436] 10:12:34.503646 <... write resumed> ) = 40
[pid 25428] 10:12:34.503664 read(14,  <unfinished ...>
[pid 25425] 10:12:34.503684 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25425] 10:12:34.503704 read(14,  <unfinished ...>
[pid 25436] 10:12:34.503736 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25428] 10:12:34.503756 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25436] 10:12:34.503833 <... write resumed> ) = 4
[pid 25428] 10:12:34.503849 read(14,  <unfinished ...>
[pid 25425] 10:12:34.503869 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.503888 wait4(-1,  <unfinished ...>
[pid 25436] 10:12:34.503920 close(15 <unfinished ...>
[pid 25428] 10:12:34.503940 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25436] 10:12:34.503974 <... close resumed> ) = 0
[pid 25428] 10:12:34.503987 read(14,  <unfinished ...>
[pid 25436] 10:12:34.504028 exit_group(0) = ?
[pid 25428] 10:12:34.504041 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25436] 10:12:34.504380 +++ exited with 0 +++
[pid 25428] 10:12:34.504478 read(14,  <unfinished ...>
[pid 25425] 10:12:34.504506 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25436
[pid 25425] 10:12:34.504530 close(14)   = 0
[pid 25425] 10:12:34.504566 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.504629 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.504701 open("/etc/userdomains", O_RDONLY) = 9
[pid 25425] 10:12:34.504742 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.504790 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.504834 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.504871 lseek(9, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.504904 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25425] 10:12:34.504957 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.505016 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.505094 stat("/home/finest09/etc/finestweddingsites.com/hiltongardeninn/filter", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.505145 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.505204 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25425] 10:12:34.505244 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.505290 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.505333 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d423000
[pid 25425] 10:12:34.505374 lseek(10, 0, SEEK_SET) = 0
[pid 25428] 10:12:34.505519 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25425] 10:12:34.505541 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25425] 10:12:34.505585 read(10, "", 4096) = 0
[pid 25425] 10:12:34.505634 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25425] 10:12:34.505678 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.505724 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d422000
[pid 25425] 10:12:34.505765 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.505814 close(11)   = 0
[pid 25425] 10:12:34.505848 munmap(0x7f380d422000, 4096) = 0
[pid 25425] 10:12:34.505964 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.506029 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25425] 10:12:34.506088 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.506157 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25425] 10:12:34.506200 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.506245 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.506288 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d422000
[pid 25425] 10:12:34.506323 lseek(11, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.506373 read(11,  <unfinished ...>
[pid 25411] 10:12:34.506535 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25428] 10:12:34.506565 read(14,  <unfinished ...>
[pid 25425] 10:12:34.506586 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25411] 10:12:34.506612 recvfrom(16,  <unfinished ...>
[pid 25425] 10:12:34.506642 read(11,  <unfinished ...>
[pid 25411] 10:12:34.506665 <... recvfrom resumed> "\277\330\201\200\0\1\0\2\0\0\0\0\6remote\23phoenixmarriottmesa\3com\0\0\1\0\1\300\f\0\5\0\1\0\0\7\7\0\2\300\23\300\23\0\1\0\1\0\0\7\7\0\4E5\324\22", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 78
[pid 25425] 10:12:34.506698 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.506727 close(16 <unfinished ...>
[pid 25425] 10:12:34.506761 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.506787 <... close resumed> ) = 0
[pid 25425] 10:12:34.506898 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.506941 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25425] 10:12:34.506974 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25411] 10:12:34.507003 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25425] 10:12:34.507056 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.507099 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.507134 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25411] 10:12:34.507161 <... open resumed> ) = 16
[pid 25425] 10:12:34.507184 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.507238 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25425] 10:12:34.507271 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.507296 <... ioctl resumed> , 0x7ffdf4a52a10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.507320 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.507369 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25428] 10:12:34.507492 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25425] 10:12:34.507514 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25411] 10:12:34.507542 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.507564 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.507612 fstat(16,  <unfinished ...>
[pid 25425] 10:12:34.507641 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.507666 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.507697 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.507730 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.507758 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.507783 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.507815 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.507905 read(16,  <unfinished ...>
[pid 25425] 10:12:34.507938 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.507961 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25425] 10:12:34.508157 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.508181 close(16 <unfinished ...>
[pid 25425] 10:12:34.508210 read(10,  <unfinished ...>
[pid 25411] 10:12:34.508239 <... close resumed> ) = 0
[pid 25425] 10:12:34.508279 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25411] 10:12:34.508309 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25425] 10:12:34.508351 read(10,  <unfinished ...>
[pid 25411] 10:12:34.508374 <... open resumed> ) = 16
[pid 25425] 10:12:34.508393 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.508535 alarm(60 <unfinished ...>
[pid 25428] 10:12:34.508572 read(14,  <unfinished ...>
[pid 25425] 10:12:34.508592 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.508624 <... alarm resumed> ) = 0
[pid 25425] 10:12:34.508647 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25411] 10:12:34.508692 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25425] 10:12:34.508732 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.508761 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.508780 <... open resumed> ) = 12
[pid 25411] 10:12:34.508797 alarm(0 <unfinished ...>
[pid 25425] 10:12:34.508822 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.508845 <... alarm resumed> ) = 60
[pid 25425] 10:12:34.508884 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25411] 10:12:34.508917 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25425] 10:12:34.508950 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.508972 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.509004 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25411] 10:12:34.509031 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.509062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.509089 <... open resumed> ) = 17
[pid 25425] 10:12:34.509108 <... mmap resumed> ) = 0x7f380d421000
[pid 25411] 10:12:34.509124 fcntl(17, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.509150 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.509172 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.509190 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.509206 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.509232 read(12,  <unfinished ...>
[pid 25411] 10:12:34.509254 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.509273 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.509296 read(17,  <unfinished ...>
[pid 25425] 10:12:34.509323 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.509351 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25425] 10:12:34.509385 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.509516 close(17 <unfinished ...>
[pid 25428] 10:12:34.509548 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25425] 10:12:34.509567 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.509599 <... close resumed> ) = 0
[pid 25425] 10:12:34.509626 <... open resumed> ) = 13
[pid 25411] 10:12:34.509645 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.509676 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.509699 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.509720 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.509748 stat("/var/tmp",  <unfinished ...>
[pid 25425] 10:12:34.509781 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.509806 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25425] 10:12:34.509854 <... mmap resumed> ) = 0x7f380d420000
[pid 25411] 10:12:34.509874 brk(0x1c15000 <unfinished ...>
[pid 25425] 10:12:34.509901 read(13,  <unfinished ...>
[pid 25411] 10:12:34.509928 <... brk resumed> ) = 0x1c15000
[pid 25425] 10:12:34.510036 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.510071 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.510105 close(13 <unfinished ...>
[pid 25411] 10:12:34.510129 <... open resumed> ) = 17
[pid 25425] 10:12:34.510147 <... close resumed> ) = 0
[pid 25411] 10:12:34.510162 fcntl(17, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.510187 munmap(0x7f380d420000, 4096 <unfinished ...>
[pid 25411] 10:12:34.510215 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.510233 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.510268 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.510298 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.510326 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.510345 <... open resumed> ) = 13
[pid 25411] 10:12:34.510363 fstat(17,  <unfinished ...>
[pid 25425] 10:12:34.510388 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.510490 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.510539 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.510572 pread(17,  <unfinished ...>
[pid 25425] 10:12:34.510600 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.510628 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25425] 10:12:34.510674 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.510705 pread(17,  <unfinished ...>
[pid 25425] 10:12:34.510732 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.510758 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25425] 10:12:34.510797 <... mmap resumed> ) = 0x7f380d420000
[pid 25411] 10:12:34.510817 pread(17,  <unfinished ...>
[pid 25425] 10:12:34.510844 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.510866 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25425] 10:12:34.510914 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.510934 close(17 <unfinished ...>
[pid 25425] 10:12:34.510962 read(13,  <unfinished ...>
[pid 25411] 10:12:34.510988 <... close resumed> ) = 0
[pid 25425] 10:12:34.511021 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25411] 10:12:34.511048 close(16 <unfinished ...>
[pid 25425] 10:12:34.511079 read(13,  <unfinished ...>
[pid 25411] 10:12:34.511101 <... close resumed> ) = 0
[pid 25425] 10:12:34.511129 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.511157 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.511186 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25411] 10:12:34.511217 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.511237 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.511272 read(13,  <unfinished ...>
[pid 25425] 10:12:34.511300 stat("/usr/local/cpanel/3rdparty/mailman/lists/tracy.thompson_hilton.com/config.pck",  <unfinished ...>
[pid 25411] 10:12:34.511329 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:34.511370 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.511507 stat("/jail_owner",  <unfinished ...>
[pid 25425] 10:12:34.511545 stat("/etc/demouids",  <unfinished ...>
[pid 25411] 10:12:34.511571 <... stat resumed> 0x7ffdf4a513f0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.511597 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.511639 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:34.511673 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.511700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.511738 <... open resumed> ) = 14
[pid 25411] 10:12:34.511755 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25425] 10:12:34.511787 fstat(14,  <unfinished ...>
[pid 25411] 10:12:34.511809 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.511835 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.511867 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:34.511897 fstat(14,  <unfinished ...>
[pid 25411] 10:12:34.511920 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.511953 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.511981 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25425] 10:12:34.512011 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.512037 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.512061 <... mmap resumed> ) = 0x7f380d41f000
[pid 25411] 10:12:34.512078 stat("/etc/demouids",  <unfinished ...>
[pid 25425] 10:12:34.512106 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.512128 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.512171 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.512190 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25425] 10:12:34.512221 read(14,  <unfinished ...>
[pid 25411] 10:12:34.512243 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.512332 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.512364 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.512479 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25411] 10:12:34.512514 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.512563 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.512699 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.512739 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.512767 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.512806 <... open resumed> ) = 15
[pid 25411] 10:12:34.512826 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25425] 10:12:34.512859 fstat(15,  <unfinished ...>
[pid 25411] 10:12:34.512881 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.512919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.512948 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.512980 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.513006 <... open resumed> ) = 16
[pid 25425] 10:12:34.513026 <... mmap resumed> ) = 0x7f380d41e000
[pid 25411] 10:12:34.513043 fstat(16,  <unfinished ...>
[pid 25425] 10:12:34.513068 read(15,  <unfinished ...>
[pid 25411] 10:12:34.513095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.513128 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.513154 fstat(16,  <unfinished ...>
[pid 25425] 10:12:34.513180 close(15 <unfinished ...>
[pid 25411] 10:12:34.513203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.513233 <... close resumed> ) = 0
[pid 25411] 10:12:34.513248 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.513277 munmap(0x7f380d41e000, 4096 <unfinished ...>
[pid 25411] 10:12:34.513304 <... mmap resumed> ) = 0x7f8169299000
[pid 25425] 10:12:34.513324 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.513386 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.513501 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25411] 10:12:34.513530 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.513550 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:34.513600 read(16,  <unfinished ...>
[pid 25425] 10:12:34.513634 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.513663 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25425] 10:12:34.513722 <... open resumed> ) = 15
[pid 25411] 10:12:34.513744 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25425] 10:12:34.513779 fstat(15,  <unfinished ...>
[pid 25411] 10:12:34.513957 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4088, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
Process 25438 attached
Process 25437 attached
[pid 25428] 10:12:34.514042 read(14,  <unfinished ...>
[pid 25425] 10:12:34.514097 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.514127 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25438] 10:12:34.514165 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25437] 10:12:34.514186 set_robust_list(0x7f13e9a01aa0, 24 <unfinished ...>
[pid 25428] 10:12:34.514207 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25425] 10:12:34.514225 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.514262 <... open resumed> ) = 17
[pid 25438] 10:12:34.514287 <... set_robust_list resumed> ) = 0
[pid 25437] 10:12:34.514301 <... set_robust_list resumed> ) = 0
[pid 25428] 10:12:34.514339 read(14,  <unfinished ...>
[pid 25425] 10:12:34.514390 <... mmap resumed> ) = 0x7f380d41e000
[pid 25411] 10:12:34.514477 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25438] 10:12:34.514512 geteuid( <unfinished ...>
[pid 25437] 10:12:34.514533 geteuid( <unfinished ...>
[pid 25428] 10:12:34.514553 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25425] 10:12:34.514572 read(15,  <unfinished ...>
[pid 25411] 10:12:34.514687 <... ioctl resumed> , 0x7ffdf4a4e390) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25438] 10:12:34.514719 <... geteuid resumed> ) = 0
[pid 25437] 10:12:34.514734 <... geteuid resumed> ) = 0
[pid 25428] 10:12:34.514755 read(14,  <unfinished ...>
[pid 25425] 10:12:34.514786 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.514815 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25438] 10:12:34.514846 geteuid( <unfinished ...>
[pid 25437] 10:12:34.514866 geteuid( <unfinished ...>
[pid 25428] 10:12:34.514887 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25425] 10:12:34.514910 close(15 <unfinished ...>
[pid 25411] 10:12:34.515007 <... lseek resumed> ) = 0
[pid 25438] 10:12:34.515032 <... geteuid resumed> ) = 0
[pid 25437] 10:12:34.515046 <... geteuid resumed> ) = 0
[pid 25428] 10:12:34.515060 read(14,  <unfinished ...>
[pid 25425] 10:12:34.515084 <... close resumed> ) = 0
[pid 25411] 10:12:34.515100 fstat(17,  <unfinished ...>
[pid 25438] 10:12:34.515130 getegid( <unfinished ...>
[pid 25437] 10:12:34.515151 getegid( <unfinished ...>
[pid 25428] 10:12:34.515172 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25425] 10:12:34.515190 munmap(0x7f380d41e000, 4096 <unfinished ...>
[pid 25411] 10:12:34.515289 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4088, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25438] 10:12:34.515327 <... getegid resumed> ) = 12
[pid 25437] 10:12:34.515343 <... getegid resumed> ) = 499
[pid 25428] 10:12:34.515362 read(14,  <unfinished ...>
[pid 25425] 10:12:34.515390 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.515500 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25438] 10:12:34.515536 setgid(12 <unfinished ...>
[pid 25437] 10:12:34.515558 setgid(12 <unfinished ...>
[pid 25428] 10:12:34.515580 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25425] 10:12:34.515599 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.515721 <... fcntl resumed> ) = 0
[pid 25438] 10:12:34.515752 <... setgid resumed> ) = 0
[pid 25437] 10:12:34.515767 <... setgid resumed> ) = 0
[pid 25428] 10:12:34.515782 read(14,  <unfinished ...>
[pid 25425] 10:12:34.515807 <... open resumed> ) = 15
[pid 25411] 10:12:34.515823 read(17,  <unfinished ...>
[pid 25438] 10:12:34.515854 setuid(47 <unfinished ...>
[pid 25437] 10:12:34.515875 setuid(47 <unfinished ...>
[pid 25428] 10:12:34.515897 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25425] 10:12:34.515914 fstat(15,  <unfinished ...>
[pid 25411] 10:12:34.515950 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4088
[pid 25438] 10:12:34.516584 <... setuid resumed> ) = 0
[pid 25437] 10:12:34.516611 <... setuid resumed> ) = 0
[pid 25428] 10:12:34.518238 read(14,  <unfinished ...>
[pid 25425] 10:12:34.519639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.519689 read(17,  <unfinished ...>
[pid 25438] 10:12:34.519725 brk(0x810000 <unfinished ...>
[pid 25428] 10:12:34.519746 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25425] 10:12:34.519770 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.519798 <... read resumed> "", 8192) = 0
[pid 25425] 10:12:34.519823 <... mmap resumed> ) = 0x7f380d41e000
[pid 25411] 10:12:34.519841 close(17 <unfinished ...>
[pid 25425] 10:12:34.519869 read(15,  <unfinished ...>
[pid 25411] 10:12:34.519895 <... close resumed> ) = 0
[pid 25425] 10:12:34.519936 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.519966 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.519996 close(15 <unfinished ...>
[pid 25411] 10:12:34.520019 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.520068 <... close resumed> ) = 0
[pid 25411] 10:12:34.520087 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.520118 munmap(0x7f380d41e000, 4096 <unfinished ...>
[pid 25411] 10:12:34.520145 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.520184 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.520295 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.520335 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.520365 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.520499 <... open resumed> ) = 15
[pid 25411] 10:12:34.520526 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.520559 fstat(15,  <unfinished ...>
[pid 25411] 10:12:34.520582 <... open resumed> ) = 17
[pid 25425] 10:12:34.521060 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.521104 fstat(17,  <unfinished ...>
[pid 25437] 10:12:34.521136 brk(0x2784000 <unfinished ...>
[pid 25428] 10:12:34.521156 read(14,  <unfinished ...>
[pid 25425] 10:12:34.521175 fstat(15,  <unfinished ...>
[pid 25411] 10:12:34.521197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.521227 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.521254 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.521283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.521308 <... mmap resumed> ) = 0x7f8169298000
[pid 25425] 10:12:34.521327 <... mmap resumed> ) = 0x7f380d41e000
[pid 25411] 10:12:34.521345 read(17,  <unfinished ...>
[pid 25425] 10:12:34.521381 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.521467 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25428] 10:12:34.521507 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25425] 10:12:34.521526 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.521542 close(17 <unfinished ...>
[pid 25425] 10:12:34.521569 read(15,  <unfinished ...>
[pid 25411] 10:12:34.521595 <... close resumed> ) = 0
[pid 25425] 10:12:34.521619 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25411] 10:12:34.521647 munmap(0x7f8169298000, 4096 <unfinished ...>
[pid 25425] 10:12:34.521682 read(15,  <unfinished ...>
[pid 25411] 10:12:34.521710 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.521742 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.521826 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.521867 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.521890 <... open resumed> ) = 17
[pid 25425] 10:12:34.521909 <... lseek resumed> ) = 353
[pid 25411] 10:12:34.521930 fstat(17,  <unfinished ...>
[pid 25425] 10:12:34.521956 read(9,  <unfinished ...>
[pid 25411] 10:12:34.521978 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.522009 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.522044 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.522079 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.522102 <... mmap resumed> ) = 0x7f8169298000
[pid 25425] 10:12:34.522121 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.522138 read(17,  <unfinished ...>
[pid 25425] 10:12:34.522167 read(9,  <unfinished ...>
[pid 25411] 10:12:34.522190 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.522223 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.522271 close(17 <unfinished ...>
[pid 25425] 10:12:34.522303 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.522335 <... close resumed> ) = 0
[pid 25425] 10:12:34.522355 <... stat resumed> 0x7f380bac2880) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.522563 munmap(0x7f8169298000, 4096 <unfinished ...>
[pid 25438] 10:12:34.522610 <... brk resumed> ) = 0x810000
[pid 25437] 10:12:34.522822 <... brk resumed> ) = 0x2784000
[pid 25428] 10:12:34.522845 read(14,  <unfinished ...>
[pid 25425] 10:12:34.523248 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25411] 10:12:34.523279 <... munmap resumed> ) = 0
[pid 25437] 10:12:34.523311 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25428] 10:12:34.523336 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25425] 10:12:34.523361 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.523466 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.523507 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.523540 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.523572 <... open resumed> ) = 16
[pid 25411] 10:12:34.523595 pipe( <unfinished ...>
[pid 25438] 10:12:34.523898 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25428] 10:12:34.523925 read(14,  <unfinished ...>
[pid 25425] 10:12:34.523946 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.523970 <... pipe resumed> [17, 18]) = 0
[pid 25425] 10:12:34.523991 <... ioctl resumed> , 0x7fffbdaa98d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.524010 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25425] 10:12:34.524041 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.524063 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25425] 10:12:34.524090 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.524108 close(15 <unfinished ...>
[pid 25425] 10:12:34.524135 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.524157 <... close resumed> ) = 0
[pid 25425] 10:12:34.524176 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25411] 10:12:34.524205 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25425] 10:12:34.524236 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.524260 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.524280 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.524298 close(14 <unfinished ...>
[pid 25425] 10:12:34.524325 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.524348 <... close resumed> ) = 0
[pid 25425] 10:12:34.524366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25411] 10:12:34.524476 munmap(0x7f816929b000, 4096 <unfinished ...>
[pid 25425] 10:12:34.524515 read(16,  <unfinished ...>
[pid 25411] 10:12:34.524538 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.524558 <... read resumed> "0", 8192) = 1
[pid 25411] 10:12:34.524578 close(9 <unfinished ...>
[pid 25425] 10:12:34.524608 read(16,  <unfinished ...>
[pid 25411] 10:12:34.524636 <... close resumed> ) = 0
[pid 25425] 10:12:34.524658 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.524703 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25438] 10:12:34.524740 <... open resumed> ) = 7
[pid 25437] 10:12:34.524753 <... open resumed> ) = 7
[pid 25428] 10:12:34.524775 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25425] 10:12:34.524802 close(16 <unfinished ...>
[pid 25411] 10:12:34.524903 <... munmap resumed> ) = 0
[pid 25438] 10:12:34.524929 fstat(7,  <unfinished ...>
[pid 25437] 10:12:34.524957 fstat(7,  <unfinished ...>
[pid 25428] 10:12:34.524978 read(14,  <unfinished ...>
[pid 25425] 10:12:34.525000 <... close resumed> ) = 0
[pid 25411] 10:12:34.525072 close(13 <unfinished ...>
[pid 25438] 10:12:34.525111 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25437] 10:12:34.525139 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25428] 10:12:34.525171 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25425] 10:12:34.525196 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.525294 <... close resumed> ) = 0
[pid 25438] 10:12:34.525318 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25437] 10:12:34.525346 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25428] 10:12:34.525369 read(14,  <unfinished ...>
[pid 25425] 10:12:34.525391 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:34.525514 munmap(0x7f816929c000, 4096 <unfinished ...>
[pid 25438] 10:12:34.525555 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25437] 10:12:34.525572 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25428] 10:12:34.525594 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25425] 10:12:34.525623 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.525734 <... munmap resumed> ) = 0
[pid 25438] 10:12:34.525760 read(7,  <unfinished ...>
[pid 25437] 10:12:34.525788 read(7,  <unfinished ...>
[pid 25428] 10:12:34.525813 read(14,  <unfinished ...>
[pid 25425] 10:12:34.525836 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.525877 close(12 <unfinished ...>
[pid 25438] 10:12:34.525911 <... read resumed> "|\224cL\246\214!\364\326\302\263J\344\326\260\236\357f\270>6\340\240\r:\26R\320/\vK\6c\223o\247849\260\243\325z;G\220\323\357", 48) = 48
[pid 25437] 10:12:34.525927 <... read resumed> "\260\323/\16\360\260k\2013\31\262N*s<W\220\363\231L\177\225$}\216t#\21\2127ZDR\1sk\306\344\35>ch\263\315\0049J\255", 48) = 48
[pid 25428] 10:12:34.525947 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25425] 10:12:34.525968 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.526003 <... close resumed> ) = 0
[pid 25438] 10:12:34.526026 close(7 <unfinished ...>
[pid 25437] 10:12:34.526047 close(7 <unfinished ...>
[pid 25428] 10:12:34.526069 read(14,  <unfinished ...>
[pid 25425] 10:12:34.526091 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.526128 munmap(0x7f816929d000, 4096 <unfinished ...>
[pid 25438] 10:12:34.526162 <... close resumed> ) = 0
[pid 25437] 10:12:34.526175 <... close resumed> ) = 0
[pid 25428] 10:12:34.526208 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25425] 10:12:34.526244 close(7 <unfinished ...>
[pid 25411] 10:12:34.526330 <... munmap resumed> ) = 0
[pid 25438] 10:12:34.526358 getuid( <unfinished ...>
[pid 25437] 10:12:34.526381 getuid( <unfinished ...>
[pid 25428] 10:12:34.526480 read(14,  <unfinished ...>
[pid 25425] 10:12:34.526508 <... close resumed> ) = 0
[pid 25411] 10:12:34.526528 close(16 <unfinished ...>
[pid 25438] 10:12:34.526560 <... getuid resumed> ) = 47
[pid 25437] 10:12:34.526573 <... getuid resumed> ) = 47
[pid 25428] 10:12:34.526742 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25425] 10:12:34.526899 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25411] 10:12:34.526953 <... close resumed> ) = 0
[pid 25438] 10:12:34.526977 exit_group(0) = ?
[pid 25437] 10:12:34.526991 exit_group(0) = ?
[pid 25428] 10:12:34.527232 read(14,  <unfinished ...>
[pid 25425] 10:12:34.527549 <... open resumed> ) = 7
[pid 25411] 10:12:34.527568 munmap(0x7f8169299000, 4096 <unfinished ...>
[pid 25438] 10:12:34.527636 +++ exited with 0 +++
[pid 25437] 10:12:34.527651 +++ exited with 0 +++
[pid 25434] 10:12:34.527663 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25437
[pid 25433] 10:12:34.527687 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25438
[pid 25428] 10:12:34.527706 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25425] 10:12:34.527724 fcntl(7, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.527812 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.527838 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f13e76176a0},  <unfinished ...>
[pid 25433] 10:12:34.527866 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25428] 10:12:34.527891 read(14,  <unfinished ...>
[pid 25425] 10:12:34.527913 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.527929 close(11 <unfinished ...>
[pid 25434] 10:12:34.527960 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, 8) = 0
[pid 25433] 10:12:34.528003 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25428] 10:12:34.528046 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25425] 10:12:34.528067 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.528156 <... close resumed> ) = 0
[pid 25434] 10:12:34.528180 getcwd( <unfinished ...>
[pid 25433] 10:12:34.528205 getcwd( <unfinished ...>
[pid 25428] 10:12:34.528228 read(14,  <unfinished ...>
[pid 25425] 10:12:34.528249 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.528265 munmap(0x7f816929e000, 4096 <unfinished ...>
[pid 25434] 10:12:34.528304 <... getcwd resumed> "/home/finest09/public_html/includes", 16380) = 36
[pid 25433] 10:12:34.528364 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25428] 10:12:34.528498 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25425] 10:12:34.528526 fstat(7,  <unfinished ...>
[pid 25411] 10:12:34.528605 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.528630 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.528659 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.528686 read(14,  <unfinished ...>
[pid 25425] 10:12:34.528709 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5365796, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.528740 close(10 <unfinished ...>
[pid 25434] 10:12:34.528771 <... open resumed> ) = 7
[pid 25433] 10:12:34.528786 <... open resumed> ) = 7
[pid 25428] 10:12:34.528802 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25425] 10:12:34.528819 write(7, "2015-12-30 10:12:34 [25425] 1aEJMY-0006bs-1f SMTP connection outbound 1451491954 1aEJMY-0006bs-1f finestweddingsites.com tracy.thompson@hilton.com\n", 147 <unfinished ...>
[pid 25411] 10:12:34.528861 <... close resumed> ) = 0
[pid 25434] 10:12:34.528884 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.528906 fstat(7,  <unfinished ...>
[pid 25428] 10:12:34.528927 brk(0x1cd1000 <unfinished ...>
[pid 25425] 10:12:34.528949 <... write resumed> ) = 147
[pid 25411] 10:12:34.529009 munmap(0x7f816929f000, 4096 <unfinished ...>
[pid 25434] 10:12:34.529048 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:34.529079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25428] 10:12:34.529106 <... brk resumed> ) = 0x1cd1000
[pid 25425] 10:12:34.529127 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25411] 10:12:34.529162 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.529188 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.529210 fstat(7,  <unfinished ...>
[pid 25428] 10:12:34.529231 read(14,  <unfinished ...>
[pid 25425] 10:12:34.529254 <... open resumed> ) = 16
[pid 25411] 10:12:34.529273 clone( <unfinished ...>
[pid 25434] 10:12:34.529616 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:34.529649 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25428] 10:12:34.529675 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25425] 10:12:34.529759 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25434] 10:12:34.529795 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.529822 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.529846 read(14,  <unfinished ...>
[pid 25425] 10:12:34.529869 <... lseek resumed> ) = 4
[pid 25411] 10:12:34.529886 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25439
[pid 25434] 10:12:34.529927 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.529946 <... mmap resumed> ) = 0x7fea0f284000
[pid 25428] 10:12:34.529963 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25425] 10:12:34.530048 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.530076 close(18 <unfinished ...>
[pid 25434] 10:12:34.530105 read(7,  <unfinished ...>
[pid 25433] 10:12:34.530131 read(7,  <unfinished ...>
[pid 25428] 10:12:34.530156 read(14,  <unfinished ...>
[pid 25425] 10:12:34.530179 <... ioctl resumed> , 0x7fffbdaa98d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.530197 <... close resumed> ) = 0
[pid 25434] 10:12:34.530219 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25433] 10:12:34.530247 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25428] 10:12:34.530271 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25425] 10:12:34.530347 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.530378 read(17,  <unfinished ...>
[pid 25434] 10:12:34.530523 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:34.530549 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25428] 10:12:34.530571 read(14,  <unfinished ...>
[pid 25425] 10:12:34.530595 <... lseek resumed> ) = 4
[pid 25434] 10:12:34.530618 <... lseek resumed> ) = 1279
[pid 25433] 10:12:34.530635 <... lseek resumed> ) = 1279
[pid 25428] 10:12:34.530650 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25425] 10:12:34.530743 fstat(16,  <unfinished ...>
[pid 25434] 10:12:34.530776 read(7,  <unfinished ...>
[pid 25433] 10:12:34.530800 read(7,  <unfinished ...>
[pid 25428] 10:12:34.530822 read(14,  <unfinished ...>
[pid 25425] 10:12:34.530845 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.530880 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25433] 10:12:34.530912 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25428] 10:12:34.530943 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25425] 10:12:34.531036 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.531069 close(7 <unfinished ...>
[pid 25433] 10:12:34.531093 close(7 <unfinished ...>
[pid 25428] 10:12:34.531115 read(14,  <unfinished ...>
[pid 25425] 10:12:34.531138 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.531172 <... close resumed> ) = 0
[pid 25433] 10:12:34.531190 <... close resumed> ) = 0
[pid 25428] 10:12:34.531205 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25425] 10:12:34.531304 write(16, "1", 1 <unfinished ...>
[pid 25434] 10:12:34.531345 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.531373 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25428] 10:12:34.531494 read(14,  <unfinished ...>
[pid 25425] 10:12:34.531525 <... write resumed> ) = 1
[pid 25434] 10:12:34.531548 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.531577 <... munmap resumed> ) = 0
[pid 25428] 10:12:34.531606 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25425] 10:12:34.531688 close(16 <unfinished ...>
[pid 25434] 10:12:34.531723 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25433] 10:12:34.531755 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25428] 10:12:34.531783 read(14,  <unfinished ...>
[pid 25425] 10:12:34.531806 <... close resumed> ) = 0
[pid 25434] 10:12:34.531847 <... open resumed> ) = 7
[pid 25433] 10:12:34.531870 <... open resumed> ) = 7
[pid 25428] 10:12:34.531887 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25425] 10:12:34.531977 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.532017 fcntl(7, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.532039 fcntl(7, F_GETFD <unfinished ...>
[pid 25428] 10:12:34.532061 read(14,  <unfinished ...>
[pid 25425] 10:12:34.532085 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.532114 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.532132 <... fcntl resumed> ) = 0
[pid 25428] 10:12:34.532147 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25425] 10:12:34.532232 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.532269 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.532292 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25428] 10:12:34.532313 read(14,  <unfinished ...>
[pid 25425] 10:12:34.532337 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.532389 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.532479 <... fcntl resumed> ) = 0
[pid 25428] 10:12:34.532497 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25425] 10:12:34.532582 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.532624 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.532647 fstat(7,  <unfinished ...>
[pid 25428] 10:12:34.532670 read(14,  <unfinished ...>
[pid 25425] 10:12:34.532693 <... open resumed> ) = 16
[pid 25434] 10:12:34.532716 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5365943, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25433] 10:12:34.532749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5365943, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25428] 10:12:34.532778 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25425] 10:12:34.532919 fstat(16,  <unfinished ...>
[pid 25434] 10:12:34.532951 write(7, "2015-12-30 10:12:34 [25434] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101 <unfinished ...>
[pid 25433] 10:12:34.532986 write(7, "2015-12-30 10:12:34 [25433] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMY-0006c6-AN\n", 92 <unfinished ...>
[pid 25428] 10:12:34.533012 read(14,  <unfinished ...>
[pid 25425] 10:12:34.533035 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25434] 10:12:34.533068 <... write resumed> ) = 101
[pid 25433] 10:12:34.533087 <... write resumed> ) = 92
[pid 25428] 10:12:34.533106 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25425] 10:12:34.533192 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.533229 chdir("/var/spool/exim" <unfinished ...>
[pid 25433] 10:12:34.533258 chdir("/var/spool/exim" <unfinished ...>
[pid 25428] 10:12:34.533283 read(14,  <unfinished ...>
[pid 25425] 10:12:34.533305 <... mmap resumed> ) = 0x7f380d41d000
[pid 25434] 10:12:34.533327 <... chdir resumed> ) = 0
[pid 25433] 10:12:34.533347 <... chdir resumed> ) = 0
[pid 25428] 10:12:34.533367 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25425] 10:12:34.533528 read(16,  <unfinished ...>
[pid 25434] 10:12:34.533571 geteuid( <unfinished ...>
[pid 25433] 10:12:34.533593 setgid(12 <unfinished ...>
[pid 25428] 10:12:34.533615 read(14,  <unfinished ...>
[pid 25425] 10:12:34.533638 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25434] 10:12:34.533670 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.533688 <... setgid resumed> ) = 0
[pid 25428] 10:12:34.533732 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25425] 10:12:34.533753 read(16,  <unfinished ...>
[pid 25434] 10:12:34.533875 getegid( <unfinished ...>
[pid 25433] 10:12:34.533899 read(6,  <unfinished ...>
[pid 25428] 10:12:34.533925 read(14,  <unfinished ...>
[pid 25425] 10:12:34.533948 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.533971 <... getegid resumed> ) = 499
[pid 25433] 10:12:34.534000 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25428] 10:12:34.534063 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25425] 10:12:34.534082 close(16 <unfinished ...>
[pid 25434] 10:12:34.534162 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.534192 read(6,  <unfinished ...>
[pid 25428] 10:12:34.534216 read(14,  <unfinished ...>
[pid 25425] 10:12:34.534238 <... close resumed> ) = 0
[pid 25434] 10:12:34.534259 <... open resumed> ) = 8
[pid 25433] 10:12:34.534278 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25428] 10:12:34.534349 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25425] 10:12:34.534370 munmap(0x7f380d41d000, 4096 <unfinished ...>
[pid 25434] 10:12:34.534544 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.534569 read(6,  <unfinished ...>
[pid 25428] 10:12:34.534592 read(14,  <unfinished ...>
[pid 25425] 10:12:34.534614 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.534636 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.534667 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25428] 10:12:34.534723 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.534738 uname( <unfinished ...>
[pid 25434] 10:12:34.534781 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.534808 read(6,  <unfinished ...>
[pid 25428] 10:12:34.534831 close(14 <unfinished ...>
[pid 25425] 10:12:34.534853 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25434] 10:12:34.534943 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.534965 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25428] 10:12:34.535024 <... close resumed> ) = 0
[pid 25425] 10:12:34.535041 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25434] 10:12:34.535086 read(8,  <unfinished ...>
[pid 25433] 10:12:34.535123 read(6,  <unfinished ...>
[pid 25428] 10:12:34.535158 munmap(0x7fb3682b7000, 4096 <unfinished ...>
[pid 25425] 10:12:34.535199 <... socket resumed> ) = 16
[pid 25434] 10:12:34.535242 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.535281 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25428] 10:12:34.535364 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.536204 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25434] 10:12:34.536254 close(8 <unfinished ...>
[pid 25433] 10:12:34.536280 read(6,  <unfinished ...>
[pid 25428] 10:12:34.536327 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.536372 <... connect resumed> ) = 0
[pid 25434] 10:12:34.536446 <... close resumed> ) = 0
[pid 25433] 10:12:34.536469 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25428] 10:12:34.536571 <... open resumed> ) = 14
[pid 25425] 10:12:34.536590 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25434] 10:12:34.536627 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.536656 read(6,  <unfinished ...>
[pid 25428] 10:12:34.536680 fstat(14,  <unfinished ...>
[pid 25425] 10:12:34.536701 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25434] 10:12:34.536727 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.536749 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25428] 10:12:34.536801 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.536833 sendto(16, "\3057\1\0\0\1\0\0\0\0\0\0\6hilton\3com\0\0\17\0\1", 28, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25434] 10:12:34.536899 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.536933 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25428] 10:12:34.536960 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.536986 <... sendto resumed> ) = 28
[pid 25434] 10:12:34.537008 <... open resumed> ) = 8
[pid 25433] 10:12:34.537024 <... open resumed> ) = 8
[pid 25428] 10:12:34.537040 <... mmap resumed> ) = 0x7fb3682b7000
[pid 25425] 10:12:34.537054 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25434] 10:12:34.537087 read(8,  <unfinished ...>
[pid 25433] 10:12:34.537110 fstat(8,  <unfinished ...>
[pid 25428] 10:12:34.537132 read(14,  <unfinished ...>
[pid 25434] 10:12:34.537186 <... read resumed> "65536\n", 31) = 6
[pid 25433] 10:12:34.537205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25434] 10:12:34.537238 close(8 <unfinished ...>
[pid 25433] 10:12:34.537262 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.537286 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          256672 kB\nCached:           328340 kB\nBuffers:               0 kB\nActive:           294504 kB\nInactive:         467152 kB\nActive(anon):     163516 kB\nInactive(anon):   277604 kB\nActive(file):     130988 kB\nInac"..., 1024) = 588
[pid 25434] 10:12:34.537308 <... close resumed> ) = 0
[pid 25433] 10:12:34.537344 <... mmap resumed> ) = 0x7fea0f284000
[pid 25434] 10:12:34.537367 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.537396 read(8,  <unfinished ...>
[pid 25428] 10:12:34.537514 close(14 <unfinished ...>
[pid 25434] 10:12:34.537544 <... open resumed> ) = 8
[pid 25433] 10:12:34.537568 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25434] 10:12:34.537601 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.537624 close(8 <unfinished ...>
[pid 25428] 10:12:34.537648 <... close resumed> ) = 0
[pid 25434] 10:12:34.537664 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.537700 <... close resumed> ) = 0
[pid 25434] 10:12:34.537721 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.537747 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25428] 10:12:34.537774 munmap(0x7fb3682b7000, 4096 <unfinished ...>
[pid 25434] 10:12:34.537801 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.537818 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.537900 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:34.537927 read(6,  <unfinished ...>
[pid 25428] 10:12:34.537950 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.537967 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.538720 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25434] 10:12:34.538818 read(8,  <unfinished ...>
[pid 25433] 10:12:34.538850 read(6,  <unfinished ...>
[pid 25428] 10:12:34.538874 alarm(300 <unfinished ...>
[pid 25434] 10:12:34.538901 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.538932 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25434] 10:12:34.539036 read(8,  <unfinished ...>
[pid 25433] 10:12:34.539063 read(6,  <unfinished ...>
[pid 25428] 10:12:34.539086 <... alarm resumed> ) = 0
[pid 25434] 10:12:34.539102 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.539143 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25434] 10:12:34.539255 close(8 <unfinished ...>
[pid 25433] 10:12:34.539283 read(6,  <unfinished ...>
[pid 25428] 10:12:34.539307 brk(0x1cf4000 <unfinished ...>
[pid 25434] 10:12:34.539335 <... close resumed> ) = 0
[pid 25433] 10:12:34.539351 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25434] 10:12:34.539527 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.539563 read(6,  <unfinished ...>
[pid 25428] 10:12:34.539588 <... brk resumed> ) = 0x1cf4000
[pid 25434] 10:12:34.539605 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.539665 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25434] 10:12:34.539710 setgroups(1, [12] <unfinished ...>
[pid 25433] 10:12:34.539738 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25428] 10:12:34.539766 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2r\357\340\232\207.\253\355\201\313\371\265\r\253G\353\323H\340i0\346\244\305\275\5Q9\211\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25434] 10:12:34.539826 <... setgroups resumed> ) = 0
[pid 25433] 10:12:34.539847 <... open resumed> ) = 8
[pid 25434] 10:12:34.539869 setgid(12 <unfinished ...>
[pid 25433] 10:12:34.539892 fstat(8,  <unfinished ...>
[pid 25428] 10:12:34.539914 <... write resumed> ) = 258
[pid 25434] 10:12:34.539930 <... setgid resumed> ) = 0
[pid 25433] 10:12:34.539950 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25434] 10:12:34.539986 setuid(47 <unfinished ...>
[pid 25433] 10:12:34.540009 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.540034 read(11,  <unfinished ...>
[pid 25434] 10:12:34.540059 <... setuid resumed> ) = 0
[pid 25433] 10:12:34.540102 <... mmap resumed> ) = 0x7fea0f284000
[pid 25434] 10:12:34.540125 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540151 read(8,  <unfinished ...>
[pid 25434] 10:12:34.540180 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25433] 10:12:34.540240 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25434] 10:12:34.540277 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540301 close(8 <unfinished ...>
[pid 25434] 10:12:34.540330 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25433] 10:12:34.540394 <... close resumed> ) = 0
[pid 25434] 10:12:34.540498 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540524 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25434] 10:12:34.540555 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25433] 10:12:34.540612 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.540644 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540669 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.540701 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25433] 10:12:34.540759 <... open resumed> ) = 8
[pid 25434] 10:12:34.540780 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540804 fstat(8,  <unfinished ...>
[pid 25434] 10:12:34.540829 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25433] 10:12:34.540904 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.540942 read(6,  <unfinished ...>
[pid 25433] 10:12:34.540965 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.540994 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25433] 10:12:34.541088 <... mmap resumed> ) = 0x7fea0f284000
[pid 25434] 10:12:34.541113 read(6,  <unfinished ...>
[pid 25433] 10:12:34.541137 read(8,  <unfinished ...>
[pid 25434] 10:12:34.541166 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25433] 10:12:34.541213 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.541250 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.541279 close(8 <unfinished ...>
[pid 25434] 10:12:34.541305 <... open resumed> ) = 8
[pid 25433] 10:12:34.541322 <... close resumed> ) = 0
[pid 25434] 10:12:34.541340 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.541364 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25434] 10:12:34.541394 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.541507 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.541553 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.541584 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.541616 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.541632 <... open resumed> ) = 8
[pid 25434] 10:12:34.541651 read(8,  <unfinished ...>
[pid 25433] 10:12:34.541678 fstat(8,  <unfinished ...>
[pid 25434] 10:12:34.541703 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.541729 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.541760 close(8 <unfinished ...>
[pid 25433] 10:12:34.541784 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.541812 <... close resumed> ) = 0
[pid 25433] 10:12:34.541827 <... mmap resumed> ) = 0x7fea0f284000
[pid 25434] 10:12:34.541909 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.541943 read(8,  <unfinished ...>
[pid 25434] 10:12:34.541973 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.542051 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.542094 read(6,  <unfinished ...>
[pid 25433] 10:12:34.542119 close(8 <unfinished ...>
[pid 25434] 10:12:34.542146 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25433] 10:12:34.542221 <... close resumed> ) = 0
[pid 25434] 10:12:34.542244 read(6,  <unfinished ...>
[pid 25433] 10:12:34.542268 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25434] 10:12:34.542298 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25433] 10:12:34.542454 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.542557 read(6,  <unfinished ...>
[pid 25433] 10:12:34.542586 read(6,  <unfinished ...>
[pid 25434] 10:12:34.542613 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25433] 10:12:34.542720 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25434] 10:12:34.542840 read(6,  <unfinished ...>
[pid 25433] 10:12:34.542867 read(6,  <unfinished ...>
[pid 25434] 10:12:34.542893 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25433] 10:12:34.542989 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25434] 10:12:34.543081 read(6,  <unfinished ...>
[pid 25433] 10:12:34.543109 read(6,  <unfinished ...>
[pid 25434] 10:12:34.543135 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25433] 10:12:34.543170 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.543194 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.543223 read(6,  <unfinished ...>
[pid 25434] 10:12:34.543249 <... open resumed> ) = 8
[pid 25433] 10:12:34.543265 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.543288 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.543310 close(6 <unfinished ...>
[pid 25434] 10:12:34.543337 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.543367 <... close resumed> ) = 0
[pid 25434] 10:12:34.543386 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.543489 munmap(0x7fea0f285000, 4096 <unfinished ...>
[pid 25434] 10:12:34.543523 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.543545 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.543582 read(8,  <unfinished ...>
[pid 25433] 10:12:34.543611 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fea0e13b790},  <unfinished ...>
[pid 25434] 10:12:34.543642 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.543671 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25434] 10:12:34.543701 close(8 <unfinished ...>
[pid 25433] 10:12:34.543728 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25434] 10:12:34.543767 <... close resumed> ) = 0
[pid 25433] 10:12:34.543783 <... open resumed> ) = 6
[pid 25434] 10:12:34.543802 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.543828 fcntl(6, F_GETFD <unfinished ...>
[pid 25434] 10:12:34.543853 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.543879 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.543900 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.543928 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.543954 <... open resumed> ) = 8
[pid 25433] 10:12:34.543970 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.543989 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.544011 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25434] 10:12:34.544041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.544070 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.544088 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.544114 fstat(6,  <unfinished ...>
[pid 25434] 10:12:34.544139 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.544155 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124798116, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.544192 read(8,  <unfinished ...>
[pid 25433] 10:12:34.544220 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-H", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.544253 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.544282 <... open resumed> ) = 8
[pid 25434] 10:12:34.544302 close(8 <unfinished ...>
[pid 25433] 10:12:34.544342 fstat(8,  <unfinished ...>
[pid 25434] 10:12:34.544369 <... close resumed> ) = 0
[pid 25433] 10:12:34.544385 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124799950, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1062, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.544523 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.544551 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.544580 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.544620 <... mmap resumed> ) = 0x7fea0f285000
[pid 25434] 10:12:34.544643 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.544672 read(8,  <unfinished ...>
[pid 25434] 10:12:34.544702 <... open resumed> ) = 8
[pid 25433] 10:12:34.544718 <... read resumed> "1aEJMY-0006c6-AN-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1062
[pid 25434] 10:12:34.544782 fstat(8,  <unfinished ...>
[pid 25433] 10:12:34.544808 read(8,  <unfinished ...>
[pid 25434] 10:12:34.544833 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.544861 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.544881 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.544906 close(8 <unfinished ...>
[pid 25434] 10:12:34.544933 <... mmap resumed> ) = 0x7f13e9a17000
[pid 25433] 10:12:34.544948 <... close resumed> ) = 0
[pid 25434] 10:12:34.544967 read(8,  <unfinished ...>
[pid 25433] 10:12:34.544992 munmap(0x7fea0f285000, 4096 <unfinished ...>
[pid 25434] 10:12:34.545022 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.545050 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.545073 close(8 <unfinished ...>
[pid 25433] 10:12:34.545096 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-J", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.545136 <... close resumed> ) = 0
[pid 25433] 10:12:34.545152 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.545177 munmap(0x7f13e9a17000, 4096 <unfinished ...>
[pid 25433] 10:12:34.545203 open("/var/spool/exim/msglog/Y/1aEJMY-0006c6-AN", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25434] 10:12:34.545241 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.545325 <... open resumed> ) = 8
[pid 25434] 10:12:34.545349 read(6,  <unfinished ...>
[pid 25433] 10:12:34.545376 fcntl(8, F_GETFD <unfinished ...>
[pid 25434] 10:12:34.545492 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25433] 10:12:34.545607 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.545630 read(6,  <unfinished ...>
[pid 25433] 10:12:34.545654 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.545680 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25433] 10:12:34.545758 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.545787 read(6,  <unfinished ...>
[pid 25433] 10:12:34.545811 fchown(8, 47, 12 <unfinished ...>
[pid 25434] 10:12:34.545842 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.545860 <... fchown resumed> ) = 0
[pid 25434] 10:12:34.545881 read(6,  <unfinished ...>
[pid 25433] 10:12:34.545904 fchmod(8, 0640 <unfinished ...>
[pid 25434] 10:12:34.545931 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.545950 <... fchmod resumed> ) = 0
[pid 25434] 10:12:34.545973 close(6 <unfinished ...>
[pid 25433] 10:12:34.545998 fcntl(8, F_GETFL <unfinished ...>
[pid 25434] 10:12:34.546023 <... close resumed> ) = 0
[pid 25433] 10:12:34.546038 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25434] 10:12:34.546060 munmap(0x7f13e9a18000, 4096 <unfinished ...>
[pid 25433] 10:12:34.546088 fstat(8,  <unfinished ...>
[pid 25434] 10:12:34.546114 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.546134 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124799960, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.546174 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.546203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.546232 <... open resumed> ) = 6
[pid 25433] 10:12:34.546249 <... mmap resumed> ) = 0x7fea0f285000
[pid 25434] 10:12:34.546268 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.546291 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25434] 10:12:34.546316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.546345 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.546375 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.546484 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25434] 10:12:34.546518 <... mmap resumed> ) = 0x7f13e9a18000
[pid 25433] 10:12:34.546535 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25434] 10:12:34.546571 read(6,  <unfinished ...>
[pid 25433] 10:12:34.546599 pipe( <unfinished ...>
[pid 25434] 10:12:34.546629 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.546660 <... pipe resumed> [9, 10]) = 0
[pid 25434] 10:12:34.546681 close(6 <unfinished ...>
[pid 25433] 10:12:34.546705 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25434] 10:12:34.546734 <... close resumed> ) = 0
[pid 25433] 10:12:34.546749 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fea0e13b790}, 8) = 0
[pid 25434] 10:12:34.546774 munmap(0x7f13e9a18000, 4096 <unfinished ...>
[pid 25433] 10:12:34.546801 clone( <unfinished ...>
[pid 25434] 10:12:34.547014 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.547051 fstat(1,  <unfinished ...>
[pid 25433] 10:12:34.547078 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25440
[pid 25434] 10:12:34.547126 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25433] 10:12:34.547170 close(10 <unfinished ...>
[pid 25434] 10:12:34.547198 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f13e88ce790},  <unfinished ...>
[pid 25433] 10:12:34.547224 <... close resumed> ) = 0
[pid 25434] 10:12:34.547244 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.547275 read(9,  <unfinished ...>
[pid 25434] 10:12:34.547300 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25434] 10:12:34.547338 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25434] 10:12:34.547379 fstat(0, {st_dev=makedev(0, 8), st_ino=2130166644, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.547499 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a18000
[pid 25434] 10:12:34.547534 read(0, "To:  rochelle.samms@radisson.com, radissonphx-north@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style"..., 4096) = 2096
[pid 25434] 10:12:34.547643 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.547714 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25434] 10:12:34.547793 fchown(6, 47, 12) = 0
[pid 25434] 10:12:34.547832 fchmod(6, 0640) = 0
[pid 25434] 10:12:34.547868 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25434] 10:12:34.547901 fstat(6, {st_dev=makedev(144, 4215), st_ino=124799976, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.547945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a17000
[pid 25434] 10:12:34.547979 lseek(6, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.548011 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25434] 10:12:34.548102 read(0, "", 4096) = 0
[pid 25434] 10:12:34.548136 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.548171 write(6, "1aEJMY-0006cE-He-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25434] 10:12:34.548217 fsync(6Process 25439 attached
 <unfinished ...>
[pid 25439] 10:12:34.548338 set_robust_list(0x7f816928aaa0, 24) = 0
[pid 25439] 10:12:34.548552 close(17)   = 0
[pid 25434] 10:12:34.548611 <... fsync resumed> ) = 0
[pid 25434] 10:12:34.548646 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.548733 fstat(6, {st_dev=makedev(144, 4215), st_ino=124799976, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.548875 brk(0x2784000) = 0x2784000
[pid 25434] 10:12:34.548941 getuid()    = 47
[pid 25434] 10:12:34.548975 geteuid()   = 47
[pid 25434] 10:12:34.549008 getgid()    = 12
[pid 25434] 10:12:34.549040 getegid()   = 12
[pid 25434] 10:12:34.549145 open("/dev/urandom", O_RDONLY) = 8
[pid 25434] 10:12:34.549192 read(8, "_\32\37\210", 4) = 4
[pid 25434] 10:12:34.549229 close(8)    = 0
[pid 25434] 10:12:34.549368 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25434] 10:12:34.549586 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0370) = -1 EINVAL (Invalid argument)
[pid 25434] 10:12:34.549642 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25434] 10:12:34.549689 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0370) = -1 EINVAL (Invalid argument)
[pid 25434] 10:12:34.549734 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25434] 10:12:34.549777 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0380) = -1 EINVAL (Invalid argument)
[pid 25434] 10:12:34.549820 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25434] 10:12:34.549866 open("/dev/null", O_RDONLY) = 8
[pid 25434] 10:12:34.549917 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.549962 lseek(8, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.550012 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25434] 10:12:34.550056 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f13e88ce790}, 8) = 0
[pid 25434] 10:12:34.550109 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f13e88ce790}, 8) = 0
[pid 25434] 10:12:34.550546 read(8, "", 8192) = 0
[pid 25434] 10:12:34.550616 close(8)    = 0
[pid 25434] 10:12:34.550873 brk(0x27a5000) = 0x27a5000
[pid 25425] 10:12:34.550924 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25425] 10:12:34.550953 recvfrom(16, "\3057\201\200\0\1\0\2\0\0\0\0\6hilton\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\1>\0\25\0\n\3mx2\6hilton\5iphmx\300\23\300\f\0\17\0\1\0\0\1>\0\10\0\n\3mx1\300.", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 81
[pid 25425] 10:12:34.551012 close(16)   = 0
[pid 25425] 10:12:34.551084 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25425] 10:12:34.551124 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25425] 10:12:34.551165 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25425] 10:12:34.551202 sendto(16, "\305\305\1\0\0\1\0\0\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0) = 38
[pid 25425] 10:12:34.551271 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25434] 10:12:34.551495 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25434] 10:12:34.551554 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25434] 10:12:34.551596 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0280) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.551635 lseek(8, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.551689 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25434] 10:12:34.552760 brk(0x27c6000) = 0x27c6000
[pid 25434] 10:12:34.552992 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25434] 10:12:34.553974 brk(0x27e7000) = 0x27e7000
[pid 25434] 10:12:34.554313 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25434] 10:12:34.555225 brk(0x2808000) = 0x2808000
[pid 25434] 10:12:34.555581 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25434] 10:12:34.555890 read(8, "", 8192) = 0
[pid 25434] 10:12:34.555939 close(8)    = 0
[pid 25434] 10:12:34.555993 stat("/usr/share/amavis/amavis-filter", 0x7f13e80b5880) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.556043 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25434] 10:12:34.556125 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25434] 10:12:34.556231 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25434] 10:12:34.556276 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fb0280) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.556315 lseek(8, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.556370 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25434] 10:12:34.556898 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25425] 10:12:34.556933 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25425] 10:12:34.556957 recvfrom(16, "\305\305\201\200\0\1\0\10\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\6\347\0\4D\350\216\t\300\f\0\1\0\1\0\0\6\347\0\4D\350\217\220\300\f\0\1\0\1\0\0\6\347\0\4D\350\217\276\300\f\0\1\0\1\0\0\6\347\0\4D\350\211\\\300\f\0\1\0\1\0\0\6\347\0\4D\350\2159\300\f\0\1\0\1\0\0\6\347\0\4D\350\2167\300\f\0\1\0\1\0\0\6\347\0\4D\350\207\324\300\f\0\1\0\1\0\0\6\347\0\4D\350\214v", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 166
[pid 25425] 10:12:34.557007 close(16)   = 0
[pid 25425] 10:12:34.557067 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25425] 10:12:34.557110 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25425] 10:12:34.557155 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25425] 10:12:34.557197 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25425] 10:12:34.557235 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25425] 10:12:34.557272 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25425] 10:12:34.557308 close(16)   = 0
[pid 25425] 10:12:34.557349 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.557493 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.557511 <... open resumed> ) = 16
[pid 25425] 10:12:34.557535 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.557582 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d41d000
[pid 25425] 10:12:34.557619 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25425] 10:12:34.557677 read(16, "", 1024) = 0
[pid 25425] 10:12:34.557723 read(16, "", 1024) = 0
[pid 25425] 10:12:34.557761 close(16)   = 0
[pid 25425] 10:12:34.557796 munmap(0x7f380d41d000, 4096) = 0
[pid 25425] 10:12:34.557903 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25425] 10:12:34.557944 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25425] 10:12:34.557984 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25425] 10:12:34.558021 sendto(16, "\231\30\1\0\0\1\0\0\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0) = 38
[pid 25425] 10:12:34.558084 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25434] 10:12:34.558119 stat("/etc/exim/perl/warnings.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558161 stat("/usr/local/cpanel/warnings.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558209 stat("/usr/local/cpanel/warnings.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558251 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558297 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558340 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558390 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558644 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558703 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558749 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.558793 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.558856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25434] 10:12:34.558906 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fafc90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.558948 lseek(9, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.559003 brk(0x2829000) = 0x2829000
[pid 25434] 10:12:34.559058 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25434] 10:12:34.559415 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25434] 10:12:34.560157 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25434] 10:12:34.560283 brk(0x284a000) = 0x284a000
[pid 25434] 10:12:34.560631 read(9, "", 8192) = 0
[pid 25434] 10:12:34.560682 close(9)    = 0
[pid 25434] 10:12:34.561490 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25434] 10:12:34.562299 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25439] 10:12:34.562467 geteuid(Process 25440 attached
 <unfinished ...>
[pid 25440] 10:12:34.562604 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25439] 10:12:34.562648 <... geteuid resumed> ) = 0
[pid 25439] 10:12:34.562668 getegid()   = 12
[pid 25439] 10:12:34.562707 setgid(500 <unfinished ...>
[pid 25434] 10:12:34.563348 read(8,  <unfinished ...>
[pid 25440] 10:12:34.563383 <... set_robust_list resumed> ) = 0
[pid 25439] 10:12:34.563409 <... setgid resumed> ) = 0
[pid 25439] 10:12:34.563534 setuid(503) = 0
[pid 25439] 10:12:34.563616 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25440] 10:12:34.563684 close(9 <unfinished ...>
[pid 25439] 10:12:34.563720 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25440] 10:12:34.563776 <... close resumed> ) = 0
[pid 25439] 10:12:34.563925 fstat(9,  <unfinished ...>
[pid 25440] 10:12:34.563963 geteuid()   = 0
[pid 25440] 10:12:34.563998 getegid()   = 12
[pid 25440] 10:12:34.564033 setgid(494) = 0
[pid 25440] 10:12:34.564067 setuid(495) = 0
[pid 25440] 10:12:34.564122 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25440] 10:12:34.564171 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25440] 10:12:34.564260 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25440] 10:12:34.564311 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25440] 10:12:34.564356 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25439] 10:12:34.564405 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25439] 10:12:34.564438 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25440] 10:12:34.564468 read(9,  <unfinished ...>
[pid 25439] 10:12:34.564566 <... mmap resumed> ) = 0x7f81692a0000
[pid 25440] 10:12:34.564596 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25439] 10:12:34.564623 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25440] 10:12:34.564681 close(9)    = 0
[pid 25440] 10:12:34.564719 munmap(0x7fea0f284000, 4096) = 0
[pid 25439] 10:12:34.564762 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25440] 10:12:34.564852 brk(0x811000 <unfinished ...>
[pid 25439] 10:12:34.564884 close(9)    = 0
[pid 25439] 10:12:34.564920 munmap(0x7f81692a0000, 4096) = 0
[pid 25439] 10:12:34.565362 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25440] 10:12:34.565400 <... brk resumed> ) = 0x811000
[pid 25440] 10:12:34.565656 lseek(6, 19, SEEK_SET) = 19
[pid 25440] 10:12:34.565708 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2413) = 1858
[pid 25440] 10:12:34.565977 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25434] 10:12:34.566015 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25439] 10:12:34.566385 <... lseek resumed> ) = 19
[pid 25439] 10:12:34.566420 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2423) = 1858
[pid 25439] 10:12:34.566982 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.567034 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25433] 10:12:34.567058 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567087 <... write resumed> ) = 4
[pid 25440] 10:12:34.567106 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.567136 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25433] 10:12:34.567155 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567183 <... write resumed> ) = 4
[pid 25440] 10:12:34.567201 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.567230 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:34.567250 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567277 <... write resumed> ) = 4
[pid 25440] 10:12:34.567296 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25433] 10:12:34.567326 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25433] 10:12:34.567348 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567383 <... write resumed> ) = 4
[pid 25440] 10:12:34.567407 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.567437 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:34.567457 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567548 <... write resumed> ) = 4
[pid 25440] 10:12:34.567570 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25433] 10:12:34.567605 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25433] 10:12:34.567627 read(9,  <unfinished ...>
[pid 25440] 10:12:34.567654 <... write resumed> ) = 40
[pid 25440] 10:12:34.567673 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.567702 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:34.567726 wait4(-1,  <unfinished ...>
[pid 25440] 10:12:34.567811 <... write resumed> ) = 4
[pid 25440] 10:12:34.567833 close(10)   = 0
[pid 25440] 10:12:34.567879 exit_group(0) = ?
[pid 25440] 10:12:34.568183 +++ exited with 0 +++
[pid 25433] 10:12:34.568200 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25440
[pid 25433] 10:12:34.568222 close(9)    = 0
[pid 25433] 10:12:34.568262 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25433] 10:12:34.568325 brk(0x810000) = 0x810000
[pid 25433] 10:12:34.568380 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25433] 10:12:34.568447 alarm(60)   = 0
[pid 25433] 10:12:34.568537 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25433] 10:12:34.568580 alarm(0)    = 60
[pid 25433] 10:12:34.568662 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.568715 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25433] 10:12:34.568765 read(10, "cpu  123049 1342376 395094 67343095 2509 0 0 0\ncpu0 123049 1342376 395094 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58259430\nbtime 1450798266\nprocesses 892918\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25433] 10:12:34.568831 close(10)   = 0
[pid 25433] 10:12:34.568925 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:34.568989 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25433] 10:12:34.569031 fcntl(10, F_GETFD) = 0
[pid 25433] 10:12:34.569063 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25433] 10:12:34.569100 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25433] 10:12:34.569152 close(10)   = 0
[pid 25433] 10:12:34.569203 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.569247 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25433] 10:12:34.569349 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f23d000
[pid 25433] 10:12:34.569588 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25433] 10:12:34.569637 fcntl(10, F_GETFD) = 0
[pid 25433] 10:12:34.569670 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25433] 10:12:34.569706 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:34.569789 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25433] 10:12:34.569877 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25434] 10:12:34.570239 read(8,  <unfinished ...>
[pid 25433] 10:12:34.570270 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25433] 10:12:34.570355 close(10)   = 0
[pid 25433] 10:12:34.570431 munmap(0x7fea0f23d000, 200704) = 0
[pid 25433] 10:12:34.570580 close(9)    = 0
[pid 25433] 10:12:34.570643 open("/etc/localdomains", O_RDONLY) = 9
[pid 25433] 10:12:34.570692 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.570754 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.570803 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25433] 10:12:34.570841 lseek(9, 0, SEEK_SET) = 0
[pid 25433] 10:12:34.570876 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25433] 10:12:34.570943 stat("/jail_owner", 0x7ffc72718770) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.570996 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25433] 10:12:34.571067 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.571132 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25439] 10:12:34.571162 <... write resumed> ) = 4
[pid 25433] 10:12:34.571177 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25411] 10:12:34.571208 read(17,  <unfinished ...>
[pid 25439] 10:12:34.571233 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.571260 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25439] 10:12:34.571298 <... write resumed> ) = 4
[pid 25433] 10:12:34.571312 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25411] 10:12:34.571344 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25439] 10:12:34.571366 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.571407 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.571436 read(17,  <unfinished ...>
[pid 25439] 10:12:34.571470 <... write resumed> ) = 4
[pid 25434] 10:12:34.571562 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25433] 10:12:34.571589 stat("/etc/demouids",  <unfinished ...>
[pid 25411] 10:12:34.571805 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25439] 10:12:34.571836 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25434] 10:12:34.571864 brk(0x286b000 <unfinished ...>
[pid 25433] 10:12:34.571885 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.571933 read(17,  <unfinished ...>
[pid 25439] 10:12:34.571967 <... write resumed> ) = 40
[pid 25433] 10:12:34.571987 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.572020 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25439] 10:12:34.572043 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.572068 <... open resumed> ) = 10
[pid 25411] 10:12:34.572084 read(17,  <unfinished ...>
[pid 25439] 10:12:34.572112 <... write resumed> ) = 4
[pid 25433] 10:12:34.572125 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.572150 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25439] 10:12:34.572172 close(18 <unfinished ...>
[pid 25433] 10:12:34.572195 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.572226 wait4(-1,  <unfinished ...>
[pid 25439] 10:12:34.572258 <... close resumed> ) = 0
[pid 25434] 10:12:34.572272 <... brk resumed> ) = 0x286b000
[pid 25433] 10:12:34.572303 fstat(10,  <unfinished ...>
[pid 25439] 10:12:34.572392 exit_group(0) = ?
[pid 25433] 10:12:34.572409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25439] 10:12:34.573290 +++ exited with 0 +++
[pid 25434] 10:12:34.573315 read(8,  <unfinished ...>
[pid 25433] 10:12:34.573341 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.573371 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25439
[pid 25433] 10:12:34.573401 <... mmap resumed> ) = 0x7fea0f283000
[pid 25411] 10:12:34.573425 close(17 <unfinished ...>
[pid 25433] 10:12:34.573465 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.573546 <... close resumed> ) = 0
[pid 25433] 10:12:34.573569 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.573587 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25433] 10:12:34.573621 read(10,  <unfinished ...>
[pid 25411] 10:12:34.573645 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25433] 10:12:34.573694 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.573723 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.573760 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25411] 10:12:34.573789 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.573838 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.573987 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.574028 getuid( <unfinished ...>
[pid 25411] 10:12:34.574051 <... open resumed> ) = 9
[pid 25433] 10:12:34.574071 <... getuid resumed> ) = 0
[pid 25411] 10:12:34.574090 fstat(9,  <unfinished ...>
[pid 25433] 10:12:34.574117 geteuid( <unfinished ...>
[pid 25411] 10:12:34.574139 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.574175 <... geteuid resumed> ) = 0
[pid 25411] 10:12:34.574195 fstat(9,  <unfinished ...>
[pid 25433] 10:12:34.574222 getgid( <unfinished ...>
[pid 25411] 10:12:34.574244 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.574281 <... getgid resumed> ) = 12
[pid 25411] 10:12:34.574300 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.574333 getegid( <unfinished ...>
[pid 25411] 10:12:34.574356 <... mmap resumed> ) = 0x7f81692a0000
[pid 25433] 10:12:34.574382 <... getegid resumed> ) = 12
[pid 25411] 10:12:34.574550 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.574587 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.574622 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.574643 <... open resumed> ) = 11
[pid 25411] 10:12:34.574661 read(9,  <unfinished ...>
[pid 25433] 10:12:34.574692 read(11,  <unfinished ...>
[pid 25411] 10:12:34.574719 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:34.574764 <... read resumed> "/\337\251\301", 4) = 4
[pid 25411] 10:12:34.574788 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.574818 close(11 <unfinished ...>
[pid 25411] 10:12:34.574842 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.574884 <... close resumed> ) = 0
[pid 25411] 10:12:34.574991 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.575027 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25433] 10:12:34.575045 readlink("/proc/self/exe",  <unfinished ...>
[pid 25411] 10:12:34.575431 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.575585 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25411] 10:12:34.575668 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25433] 10:12:34.575711 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.575742 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.575770 <... ioctl resumed> , 0x7ffc72712d00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.575793 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:34.575826 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.575850 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.575893 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.575917 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.575951 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.575975 <... open resumed> ) = 10
[pid 25433] 10:12:34.575995 <... ioctl resumed> , 0x7ffc72712d00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.576013 fstat(10,  <unfinished ...>
[pid 25433] 10:12:34.576040 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.576062 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.576103 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.576123 fstat(10,  <unfinished ...>
[pid 25433] 10:12:34.576150 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.576173 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.576204 <... ioctl resumed> , 0x7ffc72712d10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.576222 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.576252 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.576276 <... mmap resumed> ) = 0x7f816929f000
[pid 25433] 10:12:34.576296 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.576317 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.576347 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.576385 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.576411 <... open resumed> ) = 11
[pid 25411] 10:12:34.576430 read(10,  <unfinished ...>
[pid 25433] 10:12:34.576471 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.577073 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25434] 10:12:34.577111 brk(0x288c000 <unfinished ...>
[pid 25433] 10:12:34.577135 <... ioctl resumed> , 0x7ffc72712de0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.577154 read(10,  <unfinished ...>
[pid 25433] 10:12:34.577182 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.577205 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.577248 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.577271 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.577306 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.577330 <... open resumed> ) = 11
[pid 25433] 10:12:34.577354 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.577375 fstat(11,  <unfinished ...>
[pid 25433] 10:12:34.577402 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25411] 10:12:34.577425 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.577460 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25411] 10:12:34.577782 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.577823 brk(0x831000 <unfinished ...>
[pid 25411] 10:12:34.577849 <... mmap resumed> ) = 0x7f816929e000
[pid 25433] 10:12:34.577869 <... brk resumed> ) = 0x831000
[pid 25411] 10:12:34.577898 read(11,  <unfinished ...>
[pid 25433] 10:12:34.577930 read(11,  <unfinished ...>
[pid 25411] 10:12:34.577953 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.577989 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.578012 close(11 <unfinished ...>
[pid 25433] 10:12:34.578041 close(11 <unfinished ...>
[pid 25411] 10:12:34.578064 <... close resumed> ) = 0
[pid 25433] 10:12:34.578090 <... close resumed> ) = 0
[pid 25411] 10:12:34.578365 munmap(0x7f816929e000, 4096 <unfinished ...>
[pid 25433] 10:12:34.578410 stat("/etc/exim.pl",  <unfinished ...>
[pid 25411] 10:12:34.578440 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.578532 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25411] 10:12:34.578574 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.578606 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.578634 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.578684 <... open resumed> ) = 11
[pid 25411] 10:12:34.578705 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25433] 10:12:34.578738 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.578762 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25433] 10:12:34.578804 <... ioctl resumed> , 0x7ffc72712c10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.578824 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:34.578857 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.578880 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.578939 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.578980 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.579019 read(11,  <unfinished ...>
[pid 25411] 10:12:34.579046 <... open resumed> ) = 11
[pid 25433] 10:12:34.579065 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25411] 10:12:34.579953 fstat(11,  <unfinished ...>
[pid 25433] 10:12:34.579999 brk(0x852000 <unfinished ...>
[pid 25411] 10:12:34.580027 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.580066 <... brk resumed> ) = 0x852000
[pid 25411] 10:12:34.580414 fstat(11,  <unfinished ...>
[pid 25434] 10:12:34.580461 <... brk resumed> ) = 0x288c000
[pid 25433] 10:12:34.580680 read(11,  <unfinished ...>
[pid 25411] 10:12:34.580718 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.580756 read(8,  <unfinished ...>
[pid 25433] 10:12:34.580778 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25411] 10:12:34.581638 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.581695 brk(0x873000 <unfinished ...>
[pid 25411] 10:12:34.581723 <... mmap resumed> ) = 0x7f816929e000
[pid 25433] 10:12:34.581744 <... brk resumed> ) = 0x873000
[pid 25411] 10:12:34.582160 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.582201 read(11,  <unfinished ...>
[pid 25411] 10:12:34.582228 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.582249 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25411] 10:12:34.582270 read(11,  <unfinished ...>
[pid 25433] 10:12:34.583011 brk(0x894000 <unfinished ...>
[pid 25411] 10:12:34.583047 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25434] 10:12:34.583102 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25433] 10:12:34.583124 <... brk resumed> ) = 0x894000
[pid 25411] 10:12:34.583381 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.583966 read(11,  <unfinished ...>
[pid 25411] 10:12:34.583995 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.584041 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25411] 10:12:34.584062 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:34.584366 read(11,  <unfinished ...>
[pid 25411] 10:12:34.584404 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:34.584461 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.584537 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:34.584581 close(11 <unfinished ...>
[pid 25411] 10:12:34.584606 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.584666 <... close resumed> ) = 0
[pid 25411] 10:12:34.584682 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25433] 10:12:34.584738 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25411] 10:12:34.584766 <... stat resumed> 0x7ffdf4a4fe40) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.584796 <... stat resumed> 0x7fea0d922880) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.584812 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.584846 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25411] 10:12:34.584871 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.584923 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25411] 10:12:34.585278 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25434] 10:12:34.585326 read(8,  <unfinished ...>
[pid 25433] 10:12:34.585350 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25411] 10:12:34.585383 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.585467 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25411] 10:12:34.585571 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.585608 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.585635 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.585683 <... open resumed> ) = 11
[pid 25411] 10:12:34.585699 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25433] 10:12:34.585739 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.585764 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25433] 10:12:34.585807 <... ioctl resumed> , 0x7ffc72712c10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.585825 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:34.585860 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.585883 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.585929 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.585946 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.585996 read(11,  <unfinished ...>
[pid 25411] 10:12:34.586022 <... lseek resumed> ) = 2781
[pid 25433] 10:12:34.586062 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25411] 10:12:34.586085 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.586397 brk(0x8b5000 <unfinished ...>
[pid 25411] 10:12:34.586439 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.586559 <... brk resumed> ) = 0x8b5000
[pid 25411] 10:12:34.586580 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:34.586803 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.586832 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:34.586887 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.586911 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25434] 10:12:34.586948 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25433] 10:12:34.586967 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.587548 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25434] 10:12:34.587646 brk(0x28ad000 <unfinished ...>
[pid 25433] 10:12:34.587679 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.587696 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25433] 10:12:34.587749 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.587778 <... stat resumed> 0x7ffdf4a4fe40) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.587807 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.587823 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.587855 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.587881 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.587926 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.587943 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:34.587982 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.588017 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:34.588075 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588094 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.588131 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.588161 <... open resumed> ) = 12
[pid 25433] 10:12:34.588182 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588197 fstat(12,  <unfinished ...>
[pid 25433] 10:12:34.588228 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.588256 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.588291 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588306 fstat(12,  <unfinished ...>
[pid 25433] 10:12:34.588335 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.588365 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.588403 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.588457 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.588572 <... mmap resumed> ) = 0x7f816929d000
[pid 25433] 10:12:34.588596 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588612 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.588650 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.588684 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.588712 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588730 read(12,  <unfinished ...>
[pid 25433] 10:12:34.588767 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25411] 10:12:34.588797 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25433] 10:12:34.588835 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.588853 stat("/jail_owner",  <unfinished ...>
[pid 25433] 10:12:34.588885 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25411] 10:12:34.588913 <... stat resumed> 0x7ffdf4a513f0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.588939 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25411] 10:12:34.588966 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25433] 10:12:34.589004 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.589034 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25433] 10:12:34.589073 <... open resumed> ) = 12
[pid 25411] 10:12:34.589088 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25433] 10:12:34.589125 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.589149 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.589177 <... ioctl resumed> , 0x7ffc72712620) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.589197 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25434] 10:12:34.589233 <... brk resumed> ) = 0x28ad000
[pid 25433] 10:12:34.589247 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.589416 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25434] 10:12:34.589562 read(8,  <unfinished ...>
[pid 25433] 10:12:34.589590 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.589604 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25433] 10:12:34.589685 read(12,  <unfinished ...>
[pid 25411] 10:12:34.589717 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.589751 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25411] 10:12:34.589772 stat("/etc/demouids",  <unfinished ...>
[pid 25433] 10:12:34.590102 read(12,  <unfinished ...>
[pid 25411] 10:12:34.590129 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.590177 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25411] 10:12:34.590199 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.590887 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25433] 10:12:34.590911 brk(0x8d6000 <unfinished ...>
[pid 25411] 10:12:34.591557 <... open resumed> ) = 13
[pid 25433] 10:12:34.591585 <... brk resumed> ) = 0x8d6000
[pid 25411] 10:12:34.591607 fstat(13,  <unfinished ...>
[pid 25433] 10:12:34.591841 read(12,  <unfinished ...>
[pid 25411] 10:12:34.591869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.591909 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25411] 10:12:34.591929 fstat(13,  <unfinished ...>
[pid 25433] 10:12:34.592315 read(12,  <unfinished ...>
[pid 25411] 10:12:34.592343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.592381 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.592396 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.592433 close(12 <unfinished ...>
[pid 25411] 10:12:34.592458 <... mmap resumed> ) = 0x7f816929c000
[pid 25433] 10:12:34.592542 <... close resumed> ) = 0
[pid 25411] 10:12:34.592563 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.593288 read(11,  <unfinished ...>
[pid 25411] 10:12:34.593320 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.593343 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25411] 10:12:34.593366 read(13,  <unfinished ...>
[pid 25433] 10:12:34.594171 read(11,  <unfinished ...>
[pid 25411] 10:12:34.594203 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.594236 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25411] 10:12:34.594265 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:34.595066 read(11,  <unfinished ...>
[pid 25411] 10:12:34.595092 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.595172 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.595234 lseek(9, 353, SEEK_SET) = 353
[pid 25411] 10:12:34.595288 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25411] 10:12:34.595336 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.595384 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929b000
[pid 25411] 10:12:34.595422 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.595470 close(14)   = 0
[pid 25411] 10:12:34.595577 munmap(0x7f816929b000, 4096) = 0
[pid 25411] 10:12:34.595649 stat("//etc/fin.finestweddingsites.com", 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.595710 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.595780 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25411] 10:12:34.595842 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25411] 10:12:34.595972 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.596035 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.596099 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25411] 10:12:34.596121 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.596656 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25434] 10:12:34.596806 read(8,  <unfinished ...>
[pid 25411] 10:12:34.596831 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.596859 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25411] 10:12:34.596921 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25411] 10:12:34.596962 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25411] 10:12:34.597011 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.597063 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25411] 10:12:34.597082 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929b000
[pid 25411] 10:12:34.597581 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25428] 10:12:34.597660 <... read resumed> "\26\3\1\0005\2\0", 7) = 7
[pid 25411] 10:12:34.597746 <... lseek resumed> ) = 0
[pid 25428] 10:12:34.597772 read(11,  <unfinished ...>
[pid 25411] 10:12:34.597799 read(14,  <unfinished ...>
[pid 25428] 10:12:34.597825 <... read resumed> "\0001\3\1V\204\2s\6N\2136\312| \332\275\26\7Q\337\323\250E\334\256\n\313W*\370\362\356^\34X\0\0009\0\0\t\377\1\0\1\0\0#\0\0", 51) = 51
[pid 25411] 10:12:34.597887 <... read resumed> "", 4096) = 0
[pid 25428] 10:12:34.597928 read(11,  <unfinished ...>
[pid 25411] 10:12:34.597957 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25428] 10:12:34.597992 <... read resumed> "\26\3\1\n\27", 5) = 5
[pid 25411] 10:12:34.598011 <... open resumed> ) = 15
[pid 25428] 10:12:34.598031 read(11,  <unfinished ...>
[pid 25411] 10:12:34.598058 fstat(15,  <unfinished ...>
[pid 25428] 10:12:34.598084 <... read resumed> "\v\0\n\23\0\n\20\0\00560\202\00520\202\4\32\240\3\2\1\2\2\t\0\210\340\207\345T\361\313\3270\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2641\v0\t\6\3U\4\6\23\2US1\0200\16\6\3U\4\10\23\7Arizona1\0230\21\6\3U\4\7\23\nScottsdale1\0320\30\6\3U\4\n\23\21GoDaddy.com, Inc.1-0+\6\3U\4\v\23$http://certs.godaddy.com/repository/1301\6\3U\4\3\23*Go Daddy Secure Certificate Authority - G20\36\27\r151125010838Z\27\r18112"..., 2583) = 2583
[pid 25411] 10:12:34.598855 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25428] 10:12:34.598907 read(11,  <unfinished ...>
[pid 25425] 10:12:34.598935 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25411] 10:12:34.598958 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.598991 <... read resumed> "\26\3\1\2\r", 5) = 5
[pid 25425] 10:12:34.599227 recvfrom(16,  <unfinished ...>
[pid 25411] 10:12:34.599265 <... mmap resumed> ) = 0x7f816929a000
[pid 25433] 10:12:34.599291 brk(0x8f7000 <unfinished ...>
[pid 25428] 10:12:34.599312 read(11,  <unfinished ...>
[pid 25425] 10:12:34.599340 <... recvfrom resumed> "\231\30\201\200\0\1\0\10\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\10&\0\4D\350\214v\300\f\0\1\0\1\0\0\10&\0\4D\350\2167\300\f\0\1\0\1\0\0\10&\0\4D\350\211\266\300\f\0\1\0\1\0\0\10&\0\4D\350\207\324\300\f\0\1\0\1\0\0\10&\0\4D\350\214\344\300\f\0\1\0\1\0\0\10&\0\4D\350\2159\300\f\0\1\0\1\0\0\10&\0\4D\350\217\276\300\f\0\1\0\1\0\0\10&\0\4D\350\211\265", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 166
[pid 25411] 10:12:34.599382 read(15,  <unfinished ...>
[pid 25428] 10:12:34.599416 <... read resumed> "\f\0\2\t\0\200\370\325\314\350z9a\265\365\313\3104@\305\30V\340\346\372mZ\262\203\20x\310gb\34\244l\250}\177\243\261\257u\2704<i\223t\323i \362\343\232e=\350\360rZ\246\342\322\227u7U\214\342~xOKT\233\357\265X\222{\243\f\213\330\35\254\334\256\223\2{]\316\33\301vp\257}\354\350\21I\253\327\3262\331\270\nc\227\316\274\307\251a\234\3178(\216\243\325#(wC\260No\263\0\1\2\0\200\37pgm\4\261\232\314\315\226\5\354\20\314\203\323\6\21Z\374\256\215\17\253\247\217\22\321\23\205\363\261\233\243\211\342i\10=JC0\344\3509\337\33\352+\2\21\261\201\24\343\317\247\201h`\3\230\314\226!\364&\261\324\273\333\22Ss\202U\16p\37\327\4\300\345Df\220\324\33\234\33b\366/=\307\274\2303\2u\343\253\310\334@8\206ZM\263\276\177\205at\2357"..., 525) = 525
[pid 25425] 10:12:34.599621 close(16 <unfinished ...>
[pid 25411] 10:12:34.599672 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25428] 10:12:34.599712 read(11,  <unfinished ...>
[pid 25425] 10:12:34.599738 <... close resumed> ) = 0
[pid 25411] 10:12:34.599910 close(15 <unfinished ...>
[pid 25428] 10:12:34.599948 <... read resumed> "\26\3\1\0\4", 5) = 5
[pid 25425] 10:12:34.599969 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25411] 10:12:34.599997 <... close resumed> ) = 0
[pid 25428] 10:12:34.600018 read(11,  <unfinished ...>
[pid 25425] 10:12:34.600044 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25411] 10:12:34.600096 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25428] 10:12:34.600134 <... read resumed> "\16\0\0\0", 4) = 4
[pid 25425] 10:12:34.601939 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.602086 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.602129 brk(0x28ce000 <unfinished ...>
[pid 25428] 10:12:34.602158 write(11, "\26\3\1\0\206\20\0\0\202\0\200\37\215\304\332Qc\0\235\225v\265\224\231Q\0005\242t\1\321%\315@\1\201F\353[\4U\224\242\34\251#\300h\230N8\273v\f\272%\346c{\342\220\203R\360\343\244\317H\301\276\355\21\20\2174\214\366\371<\32\357\264\237^W62\26\312\261bcx_\2420\351\351xw\234\215\202^\341\331\245qr+\211`\270D\247f\327I\362\335k\372\303\351\200~\345>\230bg<yU\275\261I(\356\24\3\1\0\1\1\26\3\1\0000M\243\240:\233\266\325\341\21\364J\304\227\203I\244(\356\34hs\261A\23\236\213\337T\274\343ac\321\363\5z\0\350\322\236oQ\3733\376\336v\377", 198 <unfinished ...>
[pid 25425] 10:12:34.602215 <... open resumed> ) = 16
[pid 25411] 10:12:34.602236 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.602271 <... brk resumed> ) = 0x8f7000
[pid 25428] 10:12:34.602285 <... write resumed> ) = 198
[pid 25425] 10:12:34.602384 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.602418 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.602541 read(11,  <unfinished ...>
[pid 25428] 10:12:34.602575 read(11,  <unfinished ...>
[pid 25425] 10:12:34.602605 <... ioctl resumed> , 0x7fffbdaab3f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.602630 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25434] 10:12:34.602680 <... brk resumed> ) = 0x28ce000
[pid 25433] 10:12:34.602699 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25425] 10:12:34.603049 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.603554 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.603591 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.603626 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.603649 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.603687 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.603714 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.603755 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.603787 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25425] 10:12:34.603834 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.603870 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.603937 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.603982 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25425] 10:12:34.604035 read(16,  <unfinished ...>
[pid 25411] 10:12:34.604073 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.604114 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25411] 10:12:34.604582 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.604660 close(16 <unfinished ...>
[pid 25411] 10:12:34.604712 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.604792 <... close resumed> ) = 0
[pid 25411] 10:12:34.604867 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25434] 10:12:34.604907 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.604923 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25411] 10:12:34.604967 <... stat resumed> 0x7ffdf4a541e0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.604994 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.605023 <... open resumed> ) = 16
[pid 25411] 10:12:34.605040 stat("/etc/userdomains",  <unfinished ...>
[pid 25434] 10:12:34.605070 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.605084 alarm(60 <unfinished ...>
[pid 25411] 10:12:34.605115 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.605158 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.605401 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.605426 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.605462 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.605543 read(11,  <unfinished ...>
[pid 25425] 10:12:34.605573 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25411] 10:12:34.605604 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.605729 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.605768 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.605785 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.605814 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.605830 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.605860 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.605888 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.605917 <... alarm resumed> ) = 60
[pid 25411] 10:12:34.605962 read(14,  <unfinished ...>
[pid 25434] 10:12:34.605991 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.606006 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25411] 10:12:34.606038 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.606080 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.606111 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.606145 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.606178 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.606193 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.606236 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.606280 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25433] 10:12:34.606319 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25425] 10:12:34.606338 <... open resumed> ) = 17
[pid 25411] 10:12:34.606553 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.606603 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.606625 fcntl(17, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.606652 <... open resumed> ) = 15
[pid 25434] 10:12:34.606679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.606715 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.606735 fstat(15,  <unfinished ...>
[pid 25434] 10:12:34.606764 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.606779 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.606808 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.606847 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.607268 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.607290 fstat(15,  <unfinished ...>
[pid 25434] 10:12:34.607322 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.607338 brk(0x918000 <unfinished ...>
[pid 25425] 10:12:34.607363 read(17,  <unfinished ...>
[pid 25411] 10:12:34.607387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.607423 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.607453 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25411] 10:12:34.607550 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.607591 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.607607 close(17 <unfinished ...>
[pid 25411] 10:12:34.607650 <... mmap resumed> ) = 0x7f816929a000
[pid 25434] 10:12:34.607673 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.607714 <... close resumed> ) = 0
[pid 25411] 10:12:34.607740 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.607771 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.607786 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.607817 <... lseek resumed> ) = 0
[pid 25434] 10:12:34.607839 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.607868 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.607887 read(15,  <unfinished ...>
[pid 25434] 10:12:34.607915 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.607929 stat("/var/tmp",  <unfinished ...>
[pid 25411] 10:12:34.607965 <... read resumed> "", 4096) = 0
[pid 25434] 10:12:34.607994 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.608026 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25411] 10:12:34.608078 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25434] 10:12:34.608124 <... stat resumed> 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.608139 brk(0x25d6000 <unfinished ...>
[pid 25423] 10:12:34.608166 <... select resumed> ) = 1 (in [11], left {299, 765231})
[pid 25411] 10:12:34.608195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25434] 10:12:34.608248 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25425] 10:12:34.608281 <... brk resumed> ) = 0x25d6000
[pid 25423] 10:12:34.608411 read(11,  <unfinished ...>
[pid 25411] 10:12:34.608442 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.608557 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.608590 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25423] 10:12:34.608634 <... read resumed> "\27\3\3\0B", 5) = 5
[pid 25411] 10:12:34.608662 <... open resumed> ) = 16
[pid 25434] 10:12:34.608687 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.608729 <... open resumed> ) = 17
[pid 25423] 10:12:34.608749 read(11,  <unfinished ...>
[pid 25411] 10:12:34.608778 fstat(16,  <unfinished ...>
[pid 25434] 10:12:34.608810 <... open resumed> ) = 9
[pid 25433] 10:12:34.608823 <... brk resumed> ) = 0x918000
[pid 25425] 10:12:34.608841 fcntl(17, F_GETFD <unfinished ...>
[pid 25423] 10:12:34.609316 <... read resumed> "\0\0\0\0\0\0\0\3\255\237o6\7*\177b\310\360gp\251w\362\207\273\310\254\242\373\244\333\252\303\245\25234\236Xk\35\23\267\346\3X\250\20\30:!\233X#\316\213\321/\340\247|\247\261D)\357", 66) = 66
[pid 25411] 10:12:34.609356 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25434] 10:12:34.609399 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:34.609474 read(11,  <unfinished ...>
[pid 25425] 10:12:34.609565 <... fcntl resumed> ) = 0
[pid 25423] 10:12:34.609582 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25411] 10:12:34.609614 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.609659 <... ioctl resumed> , 0x7fff12fafc90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.609677 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25423] 10:12:34.609710 <... select resumed> ) = 1 (in [11], left {299, 999998})
[pid 25411] 10:12:34.609739 <... mmap resumed> ) = 0x7f8169299000
[pid 25434] 10:12:34.609764 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25425] 10:12:34.609788 <... fcntl resumed> ) = 0
[pid 25423] 10:12:34.609806 read(11,  <unfinished ...>
[pid 25411] 10:12:34.609832 read(16,  <unfinished ...>
[pid 25434] 10:12:34.609866 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.609879 fstat(17,  <unfinished ...>
[pid 25423] 10:12:34.609935 <... read resumed> "\27\3\3\0C", 5) = 5
[pid 25411] 10:12:34.609956 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25434] 10:12:34.609990 read(9,  <unfinished ...>
[pid 25425] 10:12:34.610014 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25423] 10:12:34.610062 read(11,  <unfinished ...>
[pid 25411] 10:12:34.610091 close(16 <unfinished ...>
[pid 25434] 10:12:34.610122 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25425] 10:12:34.610140 pread(17,  <unfinished ...>
[pid 25423] 10:12:34.610378 <... read resumed> "\0\0\0\0\0\0\0\4b\222\5\253\331\rzS\321\340J\355\231\372'%\363]\237\204\342v)\3$\235$\340\356\273\210!k\253[\335\213\2356: \t\"TV\212\17\325\223\365\303\326x\22\267n\343\342\261", 67) = 67
[pid 25411] 10:12:34.610439 <... close resumed> ) = 0
[pid 25434] 10:12:34.610468 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.610566 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25423] 10:12:34.610627 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.610658 munmap(0x7f8169299000, 4096 <unfinished ...>
[pid 25434] 10:12:34.610705 <... lseek resumed> ) = 878
[pid 25425] 10:12:34.610720 pread(17,  <unfinished ...>
[pid 25423] 10:12:34.610751 <... lseek resumed> ) = 19
[pid 25411] 10:12:34.610767 <... munmap resumed> ) = 0
[pid 25434] 10:12:34.610810 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25425] 10:12:34.610835 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25423] 10:12:34.610875 read(6,  <unfinished ...>
[pid 25411] 10:12:34.610908 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25434] 10:12:34.610946 <... lseek resumed> ) = 878
[pid 25425] 10:12:34.610959 pread(17,  <unfinished ...>
[pid 25423] 10:12:34.610987 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25411] 10:12:34.611017 <... open resumed> ) = 16
[pid 25434] 10:12:34.611041 close(9 <unfinished ...>
[pid 25425] 10:12:34.611066 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25423] 10:12:34.611114 read(6,  <unfinished ...>
[pid 25411] 10:12:34.611141 fstat(16,  <unfinished ...>
[pid 25434] 10:12:34.611178 <... close resumed> ) = 0
[pid 25433] 10:12:34.611191 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25425] 10:12:34.611447 close(17 <unfinished ...>
[pid 25423] 10:12:34.611627 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.611650 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25434] 10:12:34.612188 read(8,  <unfinished ...>
[pid 25433] 10:12:34.612226 read(11,  <unfinished ...>
[pid 25425] 10:12:34.612249 <... close resumed> ) = 0
[pid 25423] 10:12:34.612290 alarm(300 <unfinished ...>
[pid 25411] 10:12:34.612319 fstat(16,  <unfinished ...>
[pid 25434] 10:12:34.612351 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25425] 10:12:34.612371 close(16 <unfinished ...>
[pid 25423] 10:12:34.613050 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.613086 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25434] 10:12:34.613129 read(8,  <unfinished ...>
[pid 25425] 10:12:34.613156 <... close resumed> ) = 0
[pid 25423] 10:12:34.613184 write(11, "\27\3\3\f \1,~\337e\2162\226\360J{K\235q\360)\356\361Y\303\344D\364o\246\177\377\3m\316T\fm@\342\352\356\327\2134\5o\n\352\"\270\212\337\306c\356LO@\35\34\225{\240\374\220/e\205\3603\372\t\267\270HJ\257\363\346\203HBj\30\21U\4\311f\277\372\342\235\315\t\204X\21\205\207\177\370\202\f\353\32\23\374;\312\246n\217Fm\212\2134]\205\203\270\t\t\225C\207w%\371#\26\240\244\272\210\274\3\317\212>\264O\231\312\247\34\3212\224\304Kn;6\3634_]\271h\300\250\36\270\2,m\250\314+\315\374\333\374\262\10Fh\365\252Lt<Z?@\25r\233\26\37\21\0246\356\236\223l_\363%\346]\210g\235\265bUH\245m5\\\205\366+\31cb\221\364\223V\215\232\370\220\217\371\0028\327%\225\247\317\226\246o,<8#\251\213\0\313\235$7TZ\326"..., 3109 <unfinished ...>
[pid 25411] 10:12:34.613259 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25434] 10:12:34.613296 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25425] 10:12:34.613315 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.613459 <... write resumed> ) = 3109
[pid 25411] 10:12:34.613540 <... mmap resumed> ) = 0x7f8169299000
[pid 25434] 10:12:34.613572 brk(0x28ef000 <unfinished ...>
[pid 25425] 10:12:34.613597 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.613622 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.613650 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25434] 10:12:34.613680 <... brk resumed> ) = 0x28ef000
[pid 25425] 10:12:34.613694 read(13,  <unfinished ...>
[pid 25423] 10:12:34.614555 <... alarm resumed> ) = 300
[pid 25411] 10:12:34.614580 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.614612 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25423] 10:12:34.614655 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25411] 10:12:34.614689 read(16,  <unfinished ...>
[pid 25425] 10:12:34.614721 stat("/jail_owner",  <unfinished ...>
[pid 25411] 10:12:34.614752 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25425] 10:12:34.614791 <... stat resumed> 0x7fffbdaa9dd0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.614817 read(16,  <unfinished ...>
[pid 25425] 10:12:34.614845 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25411] 10:12:34.614879 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.614917 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.614965 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.615001 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25411] 10:12:34.615032 <... open resumed> ) = 17
[pid 25425] 10:12:34.615053 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.615078 fstat(17,  <unfinished ...>
[pid 25425] 10:12:34.615106 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25411] 10:12:34.615135 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.615166 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25411] 10:12:34.615203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.615235 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25411] 10:12:34.615264 <... mmap resumed> ) = 0x7f8169298000
[pid 25425] 10:12:34.615284 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.615305 read(17,  <unfinished ...>
[pid 25425] 10:12:34.615337 stat("/etc/demouids",  <unfinished ...>
[pid 25411] 10:12:34.615366 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.615401 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.615447 close(17 <unfinished ...>
[pid 25425] 10:12:34.615560 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25411] 10:12:34.615602 <... close resumed> ) = 0
[pid 25433] 10:12:34.615624 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25425] 10:12:34.615642 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25411] 10:12:34.616105 munmap(0x7f8169298000, 4096 <unfinished ...>
[pid 25433] 10:12:34.616156 brk(0x939000 <unfinished ...>
[pid 25425] 10:12:34.616178 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.616207 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.616239 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.616290 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.616330 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.616361 <... open resumed> ) = 17
[pid 25425] 10:12:34.616381 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.616436 fstat(17,  <unfinished ...>
[pid 25425] 10:12:34.616465 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25411] 10:12:34.616566 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25425] 10:12:34.616604 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.616643 fstat(17,  <unfinished ...>
[pid 25425] 10:12:34.616672 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.616702 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25425] 10:12:34.616737 <... open resumed> ) = 16
[pid 25411] 10:12:34.616756 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.616787 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.616810 <... mmap resumed> ) = 0x7f8169298000
[pid 25425] 10:12:34.616830 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.616861 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.616889 fstat(16,  <unfinished ...>
[pid 25411] 10:12:34.616911 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.616931 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.616958 read(17,  <unfinished ...>
[pid 25425] 10:12:34.616985 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.617010 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.617044 <... mmap resumed> ) = 0x7f380d41d000
[pid 25411] 10:12:34.617063 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.617093 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.617123 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25434] 10:12:34.617430 read(8,  <unfinished ...>
[pid 25425] 10:12:34.617467 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.617568 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:34.617612 <... brk resumed> ) = 0x939000
[pid 25425] 10:12:34.617633 read(16,  <unfinished ...>
[pid 25411] 10:12:34.617958 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.618010 read(11,  <unfinished ...>
[pid 25425] 10:12:34.618034 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25411] 10:12:34.618105 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.618144 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25411] 10:12:34.618177 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.618221 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4088, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.618273 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.618307 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.618338 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.618384 <... open resumed> ) = 17
[pid 25411] 10:12:34.618406 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.618435 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.618461 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.618594 <... ioctl resumed> , 0x7fffbdaa6d70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.618626 write(8, "2015-12-30 10:12:34 routing failed for finest09@fin.finestweddingsites.com <phoenixmarriottmesa@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 181 <unfinished ...>
[pid 25425] 10:12:34.618674 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.618704 <... write resumed> ) = 181
[pid 25434] 10:12:34.618739 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25425] 10:12:34.618760 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.618987 stat("/etc/localtime",  <unfinished ...>
[pid 25434] 10:12:34.619028 brk(0x2910000 <unfinished ...>
[pid 25425] 10:12:34.619048 fstat(17,  <unfinished ...>
[pid 25411] 10:12:34.619072 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:34.619123 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25425] 10:12:34.619145 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4088, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.619554 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.619598 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.619630 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.619684 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.619718 close(7 <unfinished ...>
[pid 25425] 10:12:34.619757 read(17,  <unfinished ...>
[pid 25411] 10:12:34.619782 <... close resumed> ) = 0
[pid 25425] 10:12:34.619805 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4088
[pid 25411] 10:12:34.620361 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25425] 10:12:34.620409 read(17,  <unfinished ...>
[pid 25411] 10:12:34.620433 <... open resumed> ) = 7
[pid 25425] 10:12:34.620453 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.620525 fcntl(7, F_GETFD <unfinished ...>
[pid 25434] 10:12:34.620568 <... brk resumed> ) = 0x2910000
[pid 25425] 10:12:34.620582 close(17 <unfinished ...>
[pid 25411] 10:12:34.620646 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.620670 <... close resumed> ) = 0
[pid 25411] 10:12:34.621465 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.621565 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.621597 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.621618 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.621669 fstat(7,  <unfinished ...>
[pid 25425] 10:12:34.621700 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.621729 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5366136, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.621762 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.621798 write(7, "2015-12-30 10:12:34 [25411] 1aEJMX-0006bl-RX ** finest09@fin.finestweddingsites.com <phoenixmarriottmesa@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 190 <unfinished ...>
[pid 25425] 10:12:34.621836 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.621862 <... write resumed> ) = 190
[pid 25425] 10:12:34.621884 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.622295 close(16 <unfinished ...>
[pid 25433] 10:12:34.622341 read(11,  <unfinished ...>
[pid 25425] 10:12:34.622364 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.622396 <... close resumed> ) = 0
[pid 25425] 10:12:34.622416 <... open resumed> ) = 17
[pid 25411] 10:12:34.622434 munmap(0x7f8169299000, 4096 <unfinished ...>
[pid 25425] 10:12:34.622468 fstat(17,  <unfinished ...>
[pid 25411] 10:12:34.622566 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.622590 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.622622 close(17 <unfinished ...>
[pid 25425] 10:12:34.622651 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.622685 <... close resumed> ) = 0
[pid 25425] 10:12:34.622705 <... mmap resumed> ) = 0x7f380d41c000
[pid 25411] 10:12:34.622722 munmap(0x7f8169298000, 4096 <unfinished ...>
[pid 25425] 10:12:34.622752 read(17,  <unfinished ...>
[pid 25411] 10:12:34.622780 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.622802 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.622835 close(13 <unfinished ...>
[pid 25425] 10:12:34.622864 close(17 <unfinished ...>
[pid 25411] 10:12:34.622888 <... close resumed> ) = 0
[pid 25425] 10:12:34.622907 <... close resumed> ) = 0
[pid 25411] 10:12:34.622923 munmap(0x7f816929c000, 4096 <unfinished ...>
[pid 25425] 10:12:34.622952 munmap(0x7f380d41c000, 4096 <unfinished ...>
[pid 25411] 10:12:34.622979 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.622999 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.623028 close(14 <unfinished ...>
[pid 25425] 10:12:34.623058 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.623088 <... close resumed> ) = 0
[pid 25425] 10:12:34.623107 <... open resumed> ) = 17
[pid 25411] 10:12:34.623124 munmap(0x7f816929b000, 4096 <unfinished ...>
[pid 25425] 10:12:34.623153 fstat(17,  <unfinished ...>
[pid 25411] 10:12:34.623176 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.623197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25411] 10:12:34.623226 close(9 <unfinished ...>
[pid 25425] 10:12:34.623253 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.623280 <... close resumed> ) = 0
[pid 25425] 10:12:34.623299 <... mmap resumed> ) = 0x7f380d41c000
[pid 25411] 10:12:34.623315 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25425] 10:12:34.623348 read(17,  <unfinished ...>
[pid 25411] 10:12:34.623376 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.623397 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25411] 10:12:34.623427 close(12 <unfinished ...>
[pid 25425] 10:12:34.623455 close(17 <unfinished ...>
[pid 25411] 10:12:34.623555 <... close resumed> ) = 0
[pid 25425] 10:12:34.623580 <... close resumed> ) = 0
[pid 25411] 10:12:34.623603 munmap(0x7f816929d000, 4096 <unfinished ...>
[pid 25433] 10:12:34.623635 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25425] 10:12:34.623654 munmap(0x7f380d41c000, 4096 <unfinished ...>
[pid 25411] 10:12:34.623729 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.623759 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.623980 close(15 <unfinished ...>
[pid 25433] 10:12:34.624019 brk(0x95a000 <unfinished ...>
[pid 25425] 10:12:34.624041 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.624069 <... close resumed> ) = 0
[pid 25425] 10:12:34.624089 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25411] 10:12:34.624121 munmap(0x7f816929a000, 4096 <unfinished ...>
[pid 25425] 10:12:34.624152 pipe( <unfinished ...>
[pid 25411] 10:12:34.624187 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.624209 <... pipe resumed> [17, 18]) = 0
[pid 25411] 10:12:34.624228 close(11 <unfinished ...>
[pid 25425] 10:12:34.624256 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25411] 10:12:34.624284 <... close resumed> ) = 0
[pid 25425] 10:12:34.624303 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25411] 10:12:34.624324 munmap(0x7f816929e000, 4096 <unfinished ...>
[pid 25425] 10:12:34.624356 close(15 <unfinished ...>
[pid 25411] 10:12:34.624382 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.624402 <... close resumed> ) = 0
[pid 25411] 10:12:34.624420 close(10 <unfinished ...>
[pid 25425] 10:12:34.624447 munmap(0x7f380d41e000, 4096 <unfinished ...>
[pid 25411] 10:12:34.624539 <... close resumed> ) = 0
[pid 25425] 10:12:34.624569 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.624601 munmap(0x7f816929f000, 4096 <unfinished ...>
[pid 25433] 10:12:34.624642 <... brk resumed> ) = 0x95a000
[pid 25425] 10:12:34.624656 close(14 <unfinished ...>
[pid 25411] 10:12:34.624943 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.624987 <... close resumed> ) = 0
[pid 25411] 10:12:34.625006 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25425] 10:12:34.625526 munmap(0x7f380d41f000, 4096 <unfinished ...>
[pid 25411] 10:12:34.625569 <... open resumed> ) = 9
[pid 25425] 10:12:34.625592 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.625611 fcntl(9, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.625649 close(9 <unfinished ...>
[pid 25411] 10:12:34.625678 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.625704 <... close resumed> ) = 0
[pid 25411] 10:12:34.625725 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.625754 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25411] 10:12:34.625783 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.625802 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.625820 fchown(9, 47, 12 <unfinished ...>
[pid 25425] 10:12:34.625856 close(13 <unfinished ...>
[pid 25411] 10:12:34.625881 <... fchown resumed> ) = 0
[pid 25425] 10:12:34.625901 <... close resumed> ) = 0
[pid 25411] 10:12:34.625917 fchmod(9, 0640 <unfinished ...>
[pid 25434] 10:12:34.626230 read(8,  <unfinished ...>
[pid 25425] 10:12:34.626255 munmap(0x7f380d420000, 4096 <unfinished ...>
[pid 25411] 10:12:34.626284 <... fchmod resumed> ) = 0
[pid 25425] 10:12:34.626332 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.626356 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25425] 10:12:34.626398 close(12 <unfinished ...>
[pid 25411] 10:12:34.626424 <... open resumed> ) = 10
[pid 25425] 10:12:34.626444 <... close resumed> ) = 0
[pid 25411] 10:12:34.626460 alarm(60 <unfinished ...>
[pid 25425] 10:12:34.626558 munmap(0x7f380d421000, 4096 <unfinished ...>
[pid 25411] 10:12:34.626587 <... alarm resumed> ) = 0
[pid 25425] 10:12:34.626613 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.626637 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25425] 10:12:34.626672 close(16 <unfinished ...>
[pid 25411] 10:12:34.626697 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.626724 <... close resumed> ) = 0
[pid 25411] 10:12:34.626746 alarm(0 <unfinished ...>
[pid 25425] 10:12:34.626773 munmap(0x7f380d41d000, 4096 <unfinished ...>
[pid 25411] 10:12:34.626799 <... alarm resumed> ) = 60
[pid 25425] 10:12:34.626854 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.626876 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25425] 10:12:34.626909 close(11 <unfinished ...>
[pid 25411] 10:12:34.626933 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.626971 <... close resumed> ) = 0
[pid 25411] 10:12:34.626987 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.627028 munmap(0x7f380d422000, 4096 <unfinished ...>
[pid 25411] 10:12:34.627055 <... open resumed> ) = 11
[pid 25425] 10:12:34.627075 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.627093 fcntl(11, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.627119 close(10 <unfinished ...>
[pid 25411] 10:12:34.627143 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.627162 <... close resumed> ) = 0
[pid 25411] 10:12:34.627178 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.627204 munmap(0x7f380d423000, 4096 <unfinished ...>
[pid 25411] 10:12:34.627377 <... fcntl resumed> ) = 0
[pid 25434] 10:12:34.627411 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25433] 10:12:34.627432 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25425] 10:12:34.627557 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.627602 read(11,  <unfinished ...>
[pid 25425] 10:12:34.627641 clone( <unfinished ...>
[pid 25411] 10:12:34.628016 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25411] 10:12:34.628053 close(11 <unfinished ...>
[pid 25425] 10:12:34.628082 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25441
[pid 25411] 10:12:34.628124 <... close resumed> ) = 0
[pid 25425] 10:12:34.628151 close(18 <unfinished ...>
[pid 25411] 10:12:34.628175 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.628207 <... close resumed> ) = 0
[pid 25411] 10:12:34.628223 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.628245 read(17,  <unfinished ...>
[pid 25411] 10:12:34.628268 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25411] 10:12:34.628440 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25411] 10:12:34.628555 fcntl(11, F_GETFD) = 0
[pid 25411] 10:12:34.628683 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25434] 10:12:34.628718 brk(0x2931000 <unfinished ...>
[pid 25433] 10:12:34.628743 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.628762 <... brk resumed> ) = 0x2931000
[pid 25411] 10:12:34.628779 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.629543 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25411] 10:12:34.629579 fstat(11, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:34.629672 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.629701 pread(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25411] 10:12:34.629769 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25411] 10:12:34.629822 close(11)   = 0
[pid 25411] 10:12:34.629876 close(10)   = 0
[pid 25411] 10:12:34.629931 open("/etc/userdomains", O_RDONLY) = 10
[pid 25411] 10:12:34.629974 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.630026 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.630071 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:34.630110 lseek(10, 0, SEEK_SET) = 0
[pid 25411] 10:12:34.630144 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.630208 pipe([11, 12]) = 0
[pid 25411] 10:12:34.630251 close(10)   = 0
[pid 25411] 10:12:34.630286 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:34.630326 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25442
[pid 25411] 10:12:34.630794 close(12)   = 0
[pid 25411] 10:12:34.630832 read(11,  <unfinished ...>
[pid 25433] 10:12:34.630866 stat("/etc/exim/perl/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.630909 stat("/etc/exim/perl/strict.pm", 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.630950 stat("/usr/local/cpanel/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.630990 stat("/usr/local/cpanel/strict.pm", 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631032 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631081 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631125 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631168 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631211 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631255 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631299 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.631343 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:34.631408 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25433] 10:12:34.631456 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc72712620) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:34.631569 lseek(12, 0, SEEK_CUR) = 0
[pid 25433] 10:12:34.631643 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25433] 10:12:34.631889 lseek(12, 878, SEEK_SET) = 878
[pid 25433] 10:12:34.631934 lseek(12, 0, SEEK_CUR) = 878
[pid 25433] 10:12:34.631971 close(12)   = 0
[pid 25433] 10:12:34.632226 read(11, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25434] 10:12:34.632637 stat("/usr/local/cpanel/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.632709 stat("/usr/local/cpanel/Errno.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.632758 stat("/etc/exim/perl/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.632799 stat("/etc/exim/perl/Errno.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.632839 stat("/usr/local/cpanel/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.632879 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:34.633186 brk(0x97b000 <unfinished ...>
[pid 25434] 10:12:34.633222 <... stat resumed> 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633248 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633295 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633341 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633387 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633432 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.633540 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25434] 10:12:34.633615 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25434] 10:12:34.633671 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fafc90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.633723 lseek(9, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.633784 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25434] 10:12:34.634008 brk(0x2952000 <unfinished ...>
[pid 25433] 10:12:34.634045 <... brk resumed> ) = 0x97b000
[pid 25433] 10:12:34.634173 read(11,  <unfinished ...>
[pid 25434] 10:12:34.634208 <... brk resumed> ) = 0x2952000
[pid 25433] 10:12:34.634543 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25434] 10:12:34.635750 lseek(9, 4868, SEEK_SET) = 4868
[pid 25434] 10:12:34.635804 lseek(9, 0, SEEK_CUR) = 4868
[pid 25434] 10:12:34.635840 close(9)    = 0
[pid 25434] 10:12:34.635891 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.635937 stat("/usr/local/cpanel/Exporter.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.635979 stat("/etc/exim/perl/Exporter.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636017 stat("/etc/exim/perl/Exporter.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636056 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636094 stat("/usr/local/cpanel/Exporter.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636134 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636178 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff12fafea0) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636222 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fff12faff40) = -1 ENOENT (No such file or directory)
[pid 25434] 10:12:34.636264 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25434] 10:12:34.636333 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25434] 10:12:34.636401 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff12fafc90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25434] 10:12:34.636451 lseek(9, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.636579 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25434] 10:12:34.637025 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.637217 brk(0x99c000 <unfinished ...>
[pid 25434] 10:12:34.637250 <... lseek resumed> ) = 2366
[pid 25434] 10:12:34.637271 lseek(9, 0, SEEK_CUR) = 2366
[pid 25434] 10:12:34.637306 close(9)    = 0
[pid 25433] 10:12:34.637537 <... brk resumed> ) = 0x99c000
[pid 25433] 10:12:34.637880 read(11, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25434] 10:12:34.638557 read(8, "", 8192) = 0
[pid 25434] 10:12:34.638623 close(8)    = 0
[pid 25434] 10:12:34.638884 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25434] 10:12:34.638939 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25434] 10:12:34.638997 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a16000
[pid 25434] 10:12:34.639038 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25434] 10:12:34.639088 close(8)    = 0
[pid 25434] 10:12:34.639125 munmap(0x7f13e9a16000, 4096) = 0
[pid 25434] 10:12:34.639209 lseek(6, 19, SEEK_SET) = 19
[pid 25434] 10:12:34.639250 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639292 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639329 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639368 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639404 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639443 alarm(300)  = 0
[pid 25434] 10:12:34.639543 alarm(0)    = 300
[pid 25434] 10:12:34.639585 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639629 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639674 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639723 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639760 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f13e88ce790}, NULL, 8) = 0
[pid 25434] 10:12:34.639800 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, 8) = 0
[pid 25434] 10:12:34.639840 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, 8) = 0
[pid 25434] 10:12:34.639886 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.639951 open("/var/spool/exim/input/Y/hdr.25434", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25434] 10:12:34.640549 fchown(8, 47, 12) = 0
[pid 25434] 10:12:34.640604 fchmod(8, 0640) = 0
[pid 25434] 10:12:34.640658 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25434] 10:12:34.640711 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799978, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.640763 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a16000
[pid 25434] 10:12:34.640802 lseek(8, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.640853 write(8, "1aEJMY-0006cE-He-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 433) = 433
[pid 25434] 10:12:34.640909 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799978, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=433, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.640962 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006cE-He; Wed, 30 Dec 2015 10:12:34 -0600\n075T To:  rochelle.samms@radisson.com, radissonphx-north@finestwe"..., 558) = 558
[pid 25434] 10:12:34.641003 fsync(8 <unfinished ...>
[pid 25433] 10:12:34.641247 brk(0x9bd000Process 25441 attached
 <unfinished ...>
[pid 25441] 10:12:34.641427 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25433] 10:12:34.641458 <... brk resumed> ) = 0x9bd000
[pid 25441] 10:12:34.641547 <... set_robust_list resumed> ) = 0
[pid 25434] 10:12:34.641576 <... fsync resumed> ) = 0
[pid 25434] 10:12:34.641597 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799978, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=991, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.641659 close(8)    = 0
[pid 25434] 10:12:34.641700 munmap(0x7f13e9a16000, 4096) = 0
[pid 25434] 10:12:34.641744 rename("/var/spool/exim/input/Y/hdr.25434", "/var/spool/exim/input/Y/1aEJMY-0006cE-He-H") = 0
[pid 25434] 10:12:34.641816 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25434] 10:12:34.641860 fsync(8)    = 0
[pid 25434] 10:12:34.641897 close(8)    = 0
[pid 25434] 10:12:34.641934 fstat(6, {st_dev=makedev(144, 4215), st_ino=124799976, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.641995 open("/var/spool/exim/msglog/Y/1aEJMY-0006cE-He", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25434] 10:12:34.642066 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25434] 10:12:34.642105 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799982, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.642152 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13e9a16000
[pid 25434] 10:12:34.642191 lseek(8, 0, SEEK_CUR) = 0
[pid 25434] 10:12:34.642228 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.642287 write(8, "2015-12-30 10:12:34 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2377 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25434] 10:12:34.642335 close(8)    = 0
[pid 25434] 10:12:34.642373 munmap(0x7f13e9a16000, 4096) = 0
[pid 25434] 10:12:34.642415 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.642541 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25434] 10:12:34.642605 close(7)    = 0
[pid 25434] 10:12:34.642646 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25434] 10:12:34.642692 fcntl(7, F_GETFD) = 0
[pid 25434] 10:12:34.642726 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25434] 10:12:34.642760 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5366326, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25434] 10:12:34.642806 write(7, "2015-12-30 10:12:34 [25434] 1aEJMY-0006cE-He <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2377 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for rochelle.samms@radisson.com radissonphx-north@f"..., 312) = 312
[pid 25434] 10:12:34.642852 close(6)    = 0
[pid 25434] 10:12:34.642892 munmap(0x7f13e9a17000, 4096) = 0
[pid 25434] 10:12:34.642937 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, 8) = 0
[pid 25434] 10:12:34.642981 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f13e76176a0}, 8) = 0
[pid 25434] 10:12:34.643022 open("/proc/loadavg", O_RDONLY) = 6
[pid 25434] 10:12:34.643072 read(6, "0.18 0.08 0.01 4/249 25442\n", 40) = 27
[pid 25434] 10:12:34.643114 close(6)    = 0
[pid 25434] 10:12:34.643163 clone( <unfinished ...>
[pid 25441] 10:12:34.643583 close(17 <unfinished ...>
[pid 25433] 10:12:34.643848 read(11,  <unfinished ...>
[pid 25441] 10:12:34.643881 <... close resumed> ) = 0
[pid 25441] 10:12:34.643910 geteuid()   = 0
[pid 25441] 10:12:34.643946 getegid()   = 12
[pid 25441] 10:12:34.643983 setgid(500) = 0
[pid 25441] 10:12:34.644020 setuid(503) = 0
[pid 25441] 10:12:34.644088 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25441] 10:12:34.644142 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25441] 10:12:34.644310 fstat(9,  <unfinished ...>
[pid 25434] 10:12:34.644377 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f13e9a01a90) = 25443
[pid 25433] 10:12:34.644405 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25441] 10:12:34.644538 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25441] 10:12:34.644581 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
Process 25442 attached
[pid 25434] 10:12:34.644893 exit_group(0) = ?
[pid 25441] 10:12:34.644919 read(9,  <unfinished ...>
[pid 25442] 10:12:34.644961 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25441] 10:12:34.645004 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25442] 10:12:34.645029 <... set_robust_list resumed> ) = 0
[pid 25441] 10:12:34.645049 read(9,  <unfinished ...>
[pid 25442] 10:12:34.645167 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25441] 10:12:34.645204 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25441] 10:12:34.645230 close(9)    = 0
[pid 25441] 10:12:34.645436 munmap(0x7f380d424000, 4096) = 0
[pid 25441] 10:12:34.645958 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25442] 10:12:34.645995 <... setrlimit resumed> ) = 0
[pid 25442] 10:12:34.646158 open("/etc/userdomains", O_RDONLY) = 10
[pid 25434] 10:12:34.646925 +++ exited with 0 +++
[pid 25389] 10:12:34.646946 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25434
[pid 25389] 10:12:34.646972 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:34.647114 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:34.647162 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25444
[pid 25389] 10:12:34.647787 close(5)    = 0
[pid 25389] 10:12:34.647831 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:34.647868 fstat(6, {st_dev=makedev(0, 8), st_ino=2130166821, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25389] 10:12:34.647917 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:34.647962 write(6, "To:  info@theviewsatsuperstition.com, paula@wagthedogmedia.com, terri@theviewsatsuperstition.com, theviewsatsuperstition@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@f"..., 2165) = 2165
[pid 25389] 10:12:34.648005 close(6)    = 0
[pid 25389] 10:12:34.648037 wait4(25444,  <unfinished ...>
[pid 25442] 10:12:34.648074 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25442] 10:12:34.648136 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25442] 10:12:34.648185 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25442] 10:12:34.648225 lseek(10, 0, SEEK_SET) = 0
[pid 25442] 10:12:34.648262 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25442] 10:12:34.648347 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25442] 10:12:34.648433 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25442] 10:12:34.648549 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25442] 10:12:34.648607 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25442] 10:12:34.648653 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929f000
[pid 25442] 10:12:34.648691 lseek(13, 0, SEEK_SET) = 0
[pid 25442] 10:12:34.648728 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25442] 10:12:34.648779 read(13, "", 4096) = 0
[pid 25442] 10:12:34.648844 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25441] 10:12:34.648880 <... lseek resumed> ) = 19
[pid 25441] 10:12:34.648899 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2373) = 1858
[pid 25441] 10:12:34.649385 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25442] 10:12:34.649421 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25442] 10:12:34.649450 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25442] 10:12:34.649557 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f8168157790}, 8) = 0
[pid 25442] 10:12:34.649603 close(11)   = 0
[pid 25442] 10:12:34.649644 fcntl(12, F_GETFD) = 0
[pid 25433] 10:12:34.650109 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25442] 10:12:34.650151 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25442] 10:12:34.650204 geteuid()   = 0
[pid 25442] 10:12:34.650241 getegid()   = 12
[pid 25442] 10:12:34.650276 setgid(500) = 0
[pid 25442] 10:12:34.650310 setuid(503) = 0
[pid 25442] 10:12:34.650345 chdir("/")  = 0
[pid 25442] 10:12:34.650394 geteuid()   = 503
[pid 25442] 10:12:34.650427 getegid()   = 500
[pid 25442] 10:12:34.650530 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom", {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25442] 10:12:34.650596 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom") = 0
[pid 25442] 10:12:34.650634 stat("tmp", {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25442] 10:12:34.650685 stat("new", {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25442] 10:12:34.650736 stat("cur", {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25442] 10:12:34.650846 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25442] 10:12:34.650897 read(11, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2915
[pid 25442] 10:12:34.650993 stat("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", 0x7ffdf4a543e0) = -1 ENOENT (No such file or directory)
[pid 25442] 10:12:34.651045 open("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25442] 10:12:34.651118 chown("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", 503, 500) = 0
[pid 25442] 10:12:34.651168 chmod("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", 0660) = 0
[pid 25442] 10:12:34.651210 chown("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", 503, 500) = 0
[pid 25442] 10:12:34.651250 chmod("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", 0660) = 0
[pid 25442] 10:12:34.651323 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25442] 10:12:34.651412 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25441] 10:12:34.651457 <... write resumed> ) = 4
[pid 25425] 10:12:34.651472 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25425] 10:12:34.651578 read(17,  <unfinished ...>
[pid 25442] 10:12:34.651610 <... lseek resumed> ) = 19
[pid 25433] 10:12:34.651636 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25441] 10:12:34.651658 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25442] 10:12:34.651686 read(6,  <unfinished ...>
[pid 25441] 10:12:34.651723 <... write resumed> ) = 4
[pid 25425] 10:12:34.651740 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25425] 10:12:34.651761 read(17,  <unfinished ...>
[pid 25442] 10:12:34.651795 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25441] 10:12:34.651820 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.651848 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25441] 10:12:34.651880 <... write resumed> ) = 4
[pid 25425] 10:12:34.651894 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.651916 read(17,  <unfinished ...>
[pid 25442] 10:12:34.651953 read(6,  <unfinished ...>
[pid 25433] 10:12:34.651982 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25441] 10:12:34.652002 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25425] 10:12:34.652040 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25425] 10:12:34.652061 read(17,  <unfinished ...>
[pid 25433] 10:12:34.652093 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25441] 10:12:34.652121 write(18, "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.652155 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:34.652174 wait4(-1,  <unfinished ...>
[pid 25442] 10:12:34.652203 <... read resumed> "", 8192) = 0
[pid 25441] 10:12:34.652222 close(18 <unfinished ...>
[pid 25433] 10:12:34.652250 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25442] 10:12:34.652270 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2568 <unfinished ...>
[pid 25441] 10:12:34.652302 <... close resumed> ) = 0
[pid 25433] 10:12:34.652322 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25442] 10:12:34.652358 <... write resumed> ) = 2568
[pid 25441] 10:12:34.652389 exit_group(0) = ?
[pid 25433] 10:12:34.652411 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.652434 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25442] 10:12:34.652467 fsync(14 <unfinished ...>
[pid 25433] 10:12:34.652573 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25441] 10:12:34.652893 +++ exited with 0 +++
[pid 25425] 10:12:34.652911 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25441
[pid 25425] 10:12:34.652933 close(17)   = 0
[pid 25425] 10:12:34.652970 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25425] 10:12:34.653035 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.653103 open("/etc/userdomains", O_RDONLY) = 9
[pid 25425] 10:12:34.653146 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.653194 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.653239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25425] 10:12:34.653283 lseek(9, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.653319 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25425] 10:12:34.653375 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.653436 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.653587 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.653642 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.653702 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25425] 10:12:34.653746 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.653794 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.653838 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d423000
[pid 25425] 10:12:34.653874 lseek(10, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.653907 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25425] 10:12:34.653952 read(10, "", 4096) = 0
[pid 25425] 10:12:34.654003 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25425] 10:12:34.654047 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.654094 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d422000
[pid 25425] 10:12:34.654129 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.654180 close(11)   = 0
[pid 25425] 10:12:34.654215 munmap(0x7f380d422000, 4096) = 0
[pid 25425] 10:12:34.654266 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.654331 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25425] 10:12:34.654400 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.654552 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25425] 10:12:34.654604 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.654653 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.654697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d422000
[pid 25425] 10:12:34.654736 lseek(11, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.654772 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25425] 10:12:34.654833 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.654890 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.654951 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.655024 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable", 0x7fffbdaa8820) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.655075 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.655135 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.655213 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.655276 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25425] 10:12:34.655335 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.655407 lseek(11, 2781, SEEK_SET) = 2781
[pid 25425] 10:12:34.655457 stat("/etc/userdomains",  <unfinished ...>
[pid 25428] 10:12:34.655600 <... read resumed> "\26\3\1\0\312", 5) = 5
[pid 25425] 10:12:34.655628 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25428] 10:12:34.655668 read(11,  <unfinished ...>
[pid 25425] 10:12:34.655695 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25428] 10:12:34.655727 <... read resumed> "\4\0\0\306\0\0\0\0\0\300\274\347\234sv\235_\276\221\204\366B@\375\233\362`\202RFf\341\276\24\0169\300\303\304\370\361\262\371\300a\17\312\2474~\277\332\364\17\23\373\275\340\214oc\265\243\241\255\33U\330\370d\322q'\332$\211\366kW?\341J\331\27\247\237'B\353Rn\272_\371\252\260\352JB\206\2G\343\331\310\30\357C\232)\323\10\232\376\322PuzaOC2\306hN\361\254\177\263 Z\200}\372\232F\204Qs\226\333r&\360V\344\305\314\320\201\244\177X?\315D\257?x$ dCt\20'Q\353\300\naGo\303\253\213\341T\300>\264\364t\340\t\3\v\226\366\365Z\272\352C\2346+:\312z\335%", 202) = 202
[pid 25425] 10:12:34.655781 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25428] 10:12:34.655826 read(11,  <unfinished ...>
[pid 25425] 10:12:34.655853 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25428] 10:12:34.655884 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25425] 10:12:34.655902 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25428] 10:12:34.655954 read(11,  <unfinished ...>
[pid 25425] 10:12:34.655980 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25428] 10:12:34.656013 <... read resumed> "\1", 1) = 1
[pid 25425] 10:12:34.656078 <... stat resumed> 0x7fffbdaa8820) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.656111 read(11,  <unfinished ...>
[pid 25425] 10:12:34.656137 stat("/etc/userdomains",  <unfinished ...>
[pid 25428] 10:12:34.656167 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25425] 10:12:34.656185 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25428] 10:12:34.656229 read(11,  <unfinished ...>
[pid 25425] 10:12:34.656257 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25428] 10:12:34.656288 <... read resumed> "r\2067z+wB.\257\221\246\340\242\367R[/:.^3\230\340\337)W\33 5P\322l\340\214u\177\327(\363v,\335>A\305\26_\271", 48) = 48
[pid 25425] 10:12:34.656357 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25428] 10:12:34.656419 alarm(0 <unfinished ...>
[pid 25425] 10:12:34.656450 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25428] 10:12:34.656617 <... alarm resumed> ) = 300
[pid 25425] 10:12:34.656675 <... open resumed> ) = 12
[pid 25433] 10:12:34.656696 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25428] 10:12:34.656790 write(11, "\27\3\1\0 E\243\364\302\275\236\343\31\313]9\301\317(\352\353\200\34\330\223\254\22\370h\246\264\2\257;\224H\10\27\3\1\0@j\251dY%C~\367o^[B\205\314i\332\215\2513U\245\20\240@y*\323\344\237)\361\301N7\22\205\313\31\234\214\364Q_\222#TM\367\241\317\356\307\1\340\304\21n\377\221\222\320\373\tr", 106 <unfinished ...>
[pid 25425] 10:12:34.656847 fstat(12,  <unfinished ...>
[pid 25428] 10:12:34.656876 <... write resumed> ) = 106
[pid 25425] 10:12:34.656897 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25428] 10:12:34.656934 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25425] 10:12:34.656968 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.657014 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d421000
[pid 25425] 10:12:34.657051 lseek(12, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.657085 read(12, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:34.657138 stat("/jail_owner", 0x7fffbdaa9dd0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.657185 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.657248 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.657296 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25442] 10:12:34.657369 <... fsync resumed> ) = 0
[pid 25433] 10:12:34.657391 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.657406 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.657450 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25442] 10:12:34.657608 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25433] 10:12:34.657633 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25425] 10:12:34.657655 open("/etc/demouids", O_RDONLY) = 13
[pid 25425] 10:12:34.657694 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.657742 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.657786 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d420000
[pid 25425] 10:12:34.657880 lseek(13, 0, SEEK_SET) = 0
[pid 25425] 10:12:34.657915 read(13, "", 4096) = 0
[pid 25425] 10:12:34.657956 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.658049 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.658107 lseek(9, 353, SEEK_SET) = 353
[pid 25425] 10:12:34.658156 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25425] 10:12:34.658202 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25425] 10:12:34.658249 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d41f000
[pid 25425] 10:12:34.658285 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25425] 10:12:34.658332 close(14)   = 0
[pid 25425] 10:12:34.658369 munmap(0x7f380d41f000, 4096) = 0
[pid 25425] 10:12:34.658419 stat("//etc/fin.finestweddingsites.com", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.658465 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.658599 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25425] 10:12:34.658660 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25425] 10:12:34.658724 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.658784 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.658839 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.658903 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.658947 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25425] 10:12:34.659002 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25425] 10:12:34.659043 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25425] 10:12:34.659096 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25423] 10:12:34.659147 <... select resumed> ) = 1 (in [11], left {599, 955566})
[pid 25425] 10:12:34.659178 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.659206 read(11,  <unfinished ...>
[pid 25425] 10:12:34.659234 <... mmap resumed> ) = 0x7f380d41f000
[pid 25423] 10:12:34.659251 <... read resumed> "\27\3\3\1l", 5) = 5
[pid 25425] 10:12:34.659275 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.659299 read(11,  <unfinished ...>
[pid 25425] 10:12:34.659345 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.659374 <... read resumed> "\0\0\0\0\0\0\0\5\2077\325)\255\273\202_\352?%\303\240\2767\326\326\315\267\217\334*R\224\\\3301\37\t\273\274\217\236\215]\236%\371}\220\322d~\r6*\335\312\244\33\246\242\27\254\27%\247\201M\306\274\330b\2429C}5\246C\361B\225\22g\212\340\21\241\302\261c.\267\244\232\313g\373frOW\324\341f\22.\34\372\343\251\34^\373\221\272\262\10d\f\341\254\305\302\325\376\332\263\227 \f\370,\320\207\21\254:u\3516\314\252E\373\264\1\37Ij\224\25\24\256\177K\345531\23r\315?qi\30)\247\367|=\222\274\20\347E\304\5\362\222\3208\3\300\315t\24\347\240\305\263\207M\270\211:2:=\3\27\350\250\255\364\265\4\244>\211\210,\vT\300\373s\252\261\204\213\304zP\213N>[c\252\274+\4\201O:fO\375G\356\251AR\365\302h9e\5-U,\350Q\274"..., 364) = 364
[pid 25425] 10:12:34.659439 read(14,  <unfinished ...>
[pid 25423] 10:12:34.659466 write(11, "\27\3\3\0\36\1,~\337e\2162\227j\\z\316\367\320\244\310\250\261\317V\373\271\211\326&?\203\361\231+", 35 <unfinished ...>
[pid 25425] 10:12:34.659620 <... read resumed> "", 4096) = 0
[pid 25423] 10:12:34.659654 <... write resumed> ) = 35
[pid 25425] 10:12:34.659687 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25423] 10:12:34.659720 write(11, "\25\3\3\0\32\1,~\337e\2162\230\301\272\236\241oq\215\240\245\273\210 Z\v\266W\352\337", 31 <unfinished ...>
[pid 25425] 10:12:34.659767 <... open resumed> ) = 15
[pid 25423] 10:12:34.659785 <... write resumed> ) = 31
[pid 25425] 10:12:34.659841 fstat(15,  <unfinished ...>
[pid 25423] 10:12:34.659867 close(11 <unfinished ...>
[pid 25425] 10:12:34.659919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25423] 10:12:34.659951 <... close resumed> ) = 0
[pid 25425] 10:12:34.659983 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25423] 10:12:34.660012 close(13 <unfinished ...>
[pid 25425] 10:12:34.660041 <... mmap resumed> ) = 0x7f380d41e000
[pid 25423] 10:12:34.660058 <... close resumed> ) = 0
[pid 25425] 10:12:34.660077 read(15,  <unfinished ...>
[pid 25423] 10:12:34.660105 munmap(0x7f54cb354000, 4096 <unfinished ...>
[pid 25425] 10:12:34.660137 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25423] 10:12:34.660165 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.660186 close(15 <unfinished ...>
[pid 25423] 10:12:34.660211 close(10 <unfinished ...>
[pid 25425] 10:12:34.660239 <... close resumed> ) = 0
[pid 25423] 10:12:34.660255 <... close resumed> ) = 0
[pid 25425] 10:12:34.660274 munmap(0x7f380d41e000, 4096 <unfinished ...>
[pid 25423] 10:12:34.660300 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25425] 10:12:34.660331 <... munmap resumed> ) = 0
[pid 25423] 10:12:34.660360 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.660398 stat("/etc/userdomains",  <unfinished ...>
[pid 25423] 10:12:34.660428 write(12, "S000004\10\f\0\0", 11 <unfinished ...>
[pid 25425] 10:12:34.660472 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.660604 <... write resumed> ) = 11
[pid 25399] 10:12:34.660631 <... select resumed> ) = 1 (in [11], left {59, 480348})
[pid 25442] 10:12:34.660664 <... lseek resumed> ) = 2915
[pid 25433] 10:12:34.660678 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.660694 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25423] 10:12:34.660720 write(12, "X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 113 <unfinished ...>
[pid 25399] 10:12:34.660746 read(11,  <unfinished ...>
[pid 25425] 10:12:34.660779 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.660802 <... write resumed> ) = 113
[pid 25399] 10:12:34.660876 <... read resumed> "S000004\10\f\0\0X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 16384) = 124
[pid 25425] 10:12:34.660914 stat("/etc/userdomains",  <unfinished ...>
[pid 25423] 10:12:34.660942 write(12, "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 2404 <unfinished ...>
[pid 25399] 10:12:34.660970 wait4(-1,  <unfinished ...>
[pid 25425] 10:12:34.660998 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.661033 <... write resumed> ) = 2404
[pid 25399] 10:12:34.661054 <... wait4 resumed> 0x7ffed9b0f6a0, WNOHANG, NULL) = 0
[pid 25425] 10:12:34.661078 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25423] 10:12:34.661107 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25399] 10:12:34.661131 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25425] 10:12:34.661164 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25423] 10:12:34.661203 <... write resumed> ) = 9
[pid 25399] 10:12:34.661224 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25425] 10:12:34.661249 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25423] 10:12:34.661288 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25399] 10:12:34.661319 read(11,  <unfinished ...>
[pid 25442] 10:12:34.661353 write(11, "2568 1\n", 7 <unfinished ...>
[pid 25433] 10:12:34.661375 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25425] 10:12:34.661397 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.661446 <... write resumed> ) = 11
[pid 25399] 10:12:34.661471 <... read resumed> "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 16384) = 2424
[pid 25442] 10:12:34.661858 <... write resumed> ) = 7
[pid 25433] 10:12:34.661879 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.661895 stat("/etc/userdomains",  <unfinished ...>
[pid 25423] 10:12:34.661928 write(12, "A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 451 <unfinished ...>
[pid 25399] 10:12:34.661957 wait4(-1,  <unfinished ...>
[pid 25425] 10:12:34.661986 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.662031 <... write resumed> ) = 451
[pid 25399] 10:12:34.662054 <... wait4 resumed> 0x7ffed9b0f6a0, WNOHANG, NULL) = 0
[pid 25425] 10:12:34.662078 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25423] 10:12:34.662105 write(12, "I00002050.116.78.207\00037775\0", 27 <unfinished ...>
[pid 25399] 10:12:34.662130 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25425] 10:12:34.662162 <... stat resumed> 0x7fffbdaacbc0) = -1 ENOENT (No such file or directory)
[pid 25423] 10:12:34.662185 <... write resumed> ) = 27
[pid 25399] 10:12:34.662204 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25425] 10:12:34.662230 stat("/etc/userdomains",  <unfinished ...>
[pid 25423] 10:12:34.662256 write(12, "Z0000010", 8 <unfinished ...>
[pid 25399] 10:12:34.662280 read(11,  <unfinished ...>
[pid 25425] 10:12:34.662311 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25423] 10:12:34.662346 <... write resumed> ) = 8
[pid 25399] 10:12:34.662365 <... read resumed> "A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 16384) = 486
[pid 25425] 10:12:34.662396 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25423] 10:12:34.662424 close(12 <unfinished ...>
[pid 25399] 10:12:34.662448 close(11 <unfinished ...>
[pid 25425] 10:12:34.662554 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25423] 10:12:34.662662 <... close resumed> ) = 0
[pid 25399] 10:12:34.663047 <... close resumed> ) = 0
[pid 25425] 10:12:34.663074 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25423] 10:12:34.663099 exit_group(0) = ?
[pid 25399] 10:12:34.663808 wait4(25423,  <unfinished ...>
[pid 25425] 10:12:34.663860 <... lseek resumed> ) = 0
[pid 25423] 10:12:34.663878 +++ exited with 0 +++
[pid 25399] 10:12:34.663890 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25423
[pid 25425] 10:12:34.663927 read(14,  <unfinished ...>
[pid 25399] 10:12:34.663954 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.663984 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.664026 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.664091 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25399] 10:12:34.664124 write(8, "2015-12-30 10:12:34 info@evrc.net F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=ASPMX.L.GOOGLE.COM [173.194.77.27]:25 X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes DN=\"/C=US/ST=California/L="..., 695 <unfinished ...>
[pid 25425] 10:12:34.664162 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.664207 <... write resumed> ) = 695
[pid 25425] 10:12:34.664233 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.664264 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.664294 <... open resumed> ) = 15
[pid 25399] 10:12:34.664311 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.664356 fstat(15,  <unfinished ...>
[pid 25399] 10:12:34.664384 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.664414 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.664446 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.664557 fstat(15,  <unfinished ...>
[pid 25399] 10:12:34.664589 close(7 <unfinished ...>
[pid 25425] 10:12:34.664619 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.664648 <... close resumed> ) = 0
[pid 25425] 10:12:34.664671 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.664700 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25425] 10:12:34.664739 <... mmap resumed> ) = 0x7f380d41e000
[pid 25399] 10:12:34.664757 <... open resumed> ) = 7
[pid 25425] 10:12:34.664777 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25399] 10:12:34.664800 fcntl(7, F_GETFD <unfinished ...>
[pid 25425] 10:12:34.664827 <... lseek resumed> ) = 0
[pid 25399] 10:12:34.664843 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.664863 read(15,  <unfinished ...>
[pid 25399] 10:12:34.664886 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.664914 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.664938 <... fcntl resumed> ) = 0
[pid 25425] 10:12:34.664960 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25399] 10:12:34.664987 fstat(7,  <unfinished ...>
[pid 25425] 10:12:34.665014 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25399] 10:12:34.665056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5366638, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.665090 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.665119 write(7, "2015-12-30 10:12:34 [25399] 1aEJMX-0006bd-HC ** info@evrc.net F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=ASPMX.L.GOOGLE.COM [173.194.77.27]:25 X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=ye"..., 723 <unfinished ...>
[pid 25425] 10:12:34.665156 <... open resumed> ) = 16
[pid 25399] 10:12:34.665174 <... write resumed> ) = 723
[pid 25425] 10:12:34.665199 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.665224 geteuid( <unfinished ...>
[pid 25425] 10:12:34.665256 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25399] 10:12:34.665284 <... geteuid resumed> ) = 0
[pid 25425] 10:12:34.665305 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.665333 getegid( <unfinished ...>
[pid 25425] 10:12:34.665365 <... mmap resumed> ) = 0x7f380d41d000
[pid 25399] 10:12:34.665386 <... getegid resumed> ) = 12
[pid 25425] 10:12:34.665413 read(16,  <unfinished ...>
[pid 25399] 10:12:34.665448 setgid(12 <unfinished ...>
[pid 25425] 10:12:34.665558 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25399] 10:12:34.665590 <... setgid resumed> ) = 0
[pid 25425] 10:12:34.665611 close(16 <unfinished ...>
[pid 25399] 10:12:34.665637 setuid(47 <unfinished ...>
[pid 25425] 10:12:34.665664 <... close resumed> ) = 0
[pid 25399] 10:12:34.665680 <... setuid resumed> ) = 0
[pid 25425] 10:12:34.665703 munmap(0x7f380d41d000, 4096 <unfinished ...>
[pid 25399] 10:12:34.665731 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25425] 10:12:34.665765 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.665795 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25425] 10:12:34.665830 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.665861 stat("/etc/localtime",  <unfinished ...>
[pid 25425] 10:12:34.665891 <... open resumed> ) = 16
[pid 25399] 10:12:34.665908 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.665946 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.665971 pipe( <unfinished ...>
[pid 25425] 10:12:34.666002 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25399] 10:12:34.666033 <... pipe resumed> [10, 11]) = 0
[pid 25425] 10:12:34.666055 fstat(16,  <unfinished ...>
[pid 25399] 10:12:34.666078 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0},  <unfinished ...>
[pid 25425] 10:12:34.666109 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25399] 10:12:34.666136 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25425] 10:12:34.666160 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.666187 clone( <unfinished ...>
[pid 25425] 10:12:34.666457 <... mmap resumed> ) = 0x7f380d41d000
[pid 25425] 10:12:34.666545 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25399] 10:12:34.666575 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f54cb33fa90) = 25445
[pid 25425] 10:12:34.666617 <... lseek resumed> ) = 0
[pid 25399] 10:12:34.666637 close(10 <unfinished ...>
[pid 25425] 10:12:34.666663 read(16,  <unfinished ...>
[pid 25399] 10:12:34.666689 <... close resumed> ) = 0
[pid 25425] 10:12:34.666710 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25399] 10:12:34.666751 fcntl(11, F_GETFL <unfinished ...>
[pid 25425] 10:12:34.666779 read(16,  <unfinished ...>
[pid 25399] 10:12:34.666802 <... fcntl resumed> ) = 0x1 (flags O_WRONLY)
[pid 25425] 10:12:34.666829 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.666862 fstat(11,  <unfinished ...>
[pid 25425] 10:12:34.666893 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25399] 10:12:34.666923 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130166832, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.666956 <... open resumed> ) = 17
[pid 25399] 10:12:34.666974 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.667004 fstat(17,  <unfinished ...>
[pid 25399] 10:12:34.667028 <... mmap resumed> ) = 0x7f54cb355000
[pid 25425] 10:12:34.667048 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25399] 10:12:34.667076 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25425] 10:12:34.667103 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.667128 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25425] 10:12:34.667229 <... mmap resumed> ) = 0x7f380d41c000
[pid 25399] 10:12:34.667252 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.667279 read(17,  <unfinished ...>
[pid 25399] 10:12:34.667306 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25425] 10:12:34.667341 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25399] 10:12:34.667387 write(11, "X-Failed-Recipients: info@evrc.net,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type"..., 1995 <unfinished ...>
[pid 25425] 10:12:34.667424 close(17 <unfinished ...>
[pid 25399] 10:12:34.667553 <... write resumed> ) = 1995
[pid 25442] 10:12:34.667600 close(11 <unfinished ...>
[pid 25433] 10:12:34.667624 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25425] 10:12:34.667647 <... close resumed> ) = 0
[pid 25399] 10:12:34.667664 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.667691 munmap(0x7f380d41c000, 4096 <unfinished ...>
[pid 25399] 10:12:34.667719 <... lseek resumed> ) = 19
[pid 25425] 10:12:34.667740 <... munmap resumed> ) = 0
[pid 25399] 10:12:34.667766 read(6,  <unfinished ...>
[pid 25425] 10:12:34.667801 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25399] 10:12:34.667832 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25425] 10:12:34.667864 <... open resumed> ) = 17
[pid 25399] 10:12:34.667882 read(6,  <unfinished ...>
[pid 25425] 10:12:34.667909 fstat(17,  <unfinished ...>
[pid 25399] 10:12:34.667932 <... read resumed> "", 8192) = 0
[pid 25425] 10:12:34.667959 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:34.667992 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bd-HC; Wed, 30 Dec 2015 10:12:33 -0600\nTo:  info@evrc.net,"..., 2401 <unfinished ...>
[pid 25425] 10:12:34.668025 fstat(17,  <unfinished ...>
[pid 25399] 10:12:34.668048 <... write resumed> ) = 2401
[pid 25425] 10:12:34.668070 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25399] 10:12:34.668098 write(11, "\n--1451491954-eximdsn-670341853--\n", 34 <unfinished ...>
[pid 25425] 10:12:34.668127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25399] 10:12:34.668153 <... write resumed> ) = 34
[pid 25425] 10:12:34.668173 <... mmap resumed> ) = 0x7f380d41c000
[pid 25399] 10:12:34.668190 close(11 <unfinished ...>
[pid 25425] 10:12:34.668216 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25399] 10:12:34.668239 <... close resumed> ) = 0
[pid 25425] 10:12:34.668258 <... lseek resumed> ) = 0
[pid 25399] 10:12:34.668275 munmap(0x7f54cb355000, 4096 <unfinished ...>
[pid 25425] 10:12:34.668306 read(17,  <unfinished ...>
[pid 25399] 10:12:34.668329 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.668355 <... read resumed> "", 4096) = 0
[pid 25399] 10:12:34.668386 wait4(25445,  <unfinished ...>
[pid 25425] 10:12:34.668414 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.668472 stat("/etc/userdomains",  <unfinished ...>
[pid 25442] 10:12:34.668604 <... close resumed> ) = 0
[pid 25433] 10:12:34.668619 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.668634 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.668675 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.668732 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.668790 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.668862 write(8, "2015-12-30 10:12:34 routing failed for finest09@fin.finestweddingsites.com <hiltongardeninn@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 177) = 177
[pid 25425] 10:12:34.668911 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.668967 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25425] 10:12:34.669025 close(7)    = 0
[pid 25425] 10:12:34.669061 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25425] 10:12:34.669104 fcntl(7, F_GETFD) = 0
[pid 25425] 10:12:34.669137 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.669169 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5367361, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25425] 10:12:34.669213 write(7, "2015-12-30 10:12:34 [25425] 1aEJMY-0006bs-1f ** finest09@fin.finestweddingsites.com <hiltongardeninn@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 186) = 186
[pid 25425] 10:12:34.669253 close(16)   = 0
[pid 25425] 10:12:34.669287 munmap(0x7f380d41d000, 4096) = 0
[pid 25425] 10:12:34.669325 close(17)   = 0
[pid 25425] 10:12:34.669365 munmap(0x7f380d41c000, 4096) = 0
[pid 25425] 10:12:34.669407 close(13Process 25444 attached
Process 25443 attached
)   = 0
[pid 25442] 10:12:34.669591 fstat(14,  <unfinished ...>
[pid 25433] 10:12:34.669614 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25425] 10:12:34.669639 munmap(0x7f380d420000, 4096) = 0
[pid 25425] 10:12:34.669676 close(14)   = 0
[pid 25425] 10:12:34.669710 munmap(0x7f380d41f000, 4096) = 0
[pid 25425] 10:12:34.669744 close(9)    = 0
[pid 25425] 10:12:34.669777 munmap(0x7f380d424000, 4096) = 0
[pid 25425] 10:12:34.669813 close(12)   = 0
[pid 25425] 10:12:34.669847 munmap(0x7f380d421000, 4096) = 0
[pid 25425] 10:12:34.669882 close(15)   = 0
[pid 25425] 10:12:34.669914 munmap(0x7f380d41e000, 4096) = 0
[pid 25425] 10:12:34.669948 close(11)   = 0
[pid 25425] 10:12:34.669981 munmap(0x7f380d422000, 4096) = 0
[pid 25425] 10:12:34.670015 close(10)   = 0
[pid 25425] 10:12:34.670048 munmap(0x7f380d423000, 4096) = 0
[pid 25425] 10:12:34.670091 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-J", O_WRONLY|O_CREAT|O_APPEND, 0640) = 9
[pid 25425] 10:12:34.670174 fcntl(9, F_GETFD) = 0
[pid 25425] 10:12:34.670207 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.670239 fchown(9, 47, 12) = 0
[pid 25425] 10:12:34.670279 fchmod(9, 0640) = 0
[pid 25425] 10:12:34.670339 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 10
[pid 25425] 10:12:34.670389 alarm(60)   = 0
[pid 25425] 10:12:34.670424 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25425] 10:12:34.670462 alarm(0)    = 60
[pid 25425] 10:12:34.670596 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.670659 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25425] 10:12:34.670701 fcntl(11, F_GETFD) = 0
[pid 25425] 10:12:34.670732 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.670765 read(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25425] 10:12:34.670810 close(11)   = 0
[pid 25425] 10:12:34.670850 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.670891 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25425] 10:12:34.671054 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25425] 10:12:34.671101 fcntl(11, F_GETFD) = 0
[pid 25425] 10:12:34.671134 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25425] 10:12:34.671168 fstat(11, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25425] 10:12:34.671232 pread(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25425] 10:12:34.671291 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25444] 10:12:34.671398 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25443] 10:12:34.671428 set_robust_list(0x7f13e9a01aa0, 24 <unfinished ...>
[pid 25442] 10:12:34.671460 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016462, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2568, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25433] 10:12:34.671571 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.671590 close(11 <unfinished ...>
[pid 25444] 10:12:34.671630 <... set_robust_list resumed> ) = 0
[pid 25443] 10:12:34.671644 <... set_robust_list resumed> ) = 0
[pid 25442] 10:12:34.671679 close(14 <unfinished ...>
[pid 25433] 10:12:34.671730 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25425] 10:12:34.671763 <... close resumed> ) = 0
[pid 25444] 10:12:34.671805 close(6 <unfinished ...>
[pid 25443] 10:12:34.671832 close(0 <unfinished ...>
[pid 25442] 10:12:34.671859 <... close resumed> ) = 0
[pid 25433] 10:12:34.671873 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.671908 close(10 <unfinished ...>
[pid 25444] 10:12:34.671945 <... close resumed> ) = 0
[pid 25443] 10:12:34.671958 <... close resumed> ) = 0
[pid 25442] 10:12:34.671973 rename("tmp/1451491954.H650983P25442.fin.finestweddingsites.com", "new/1451491954.H650983P25442.fin.finestweddingsites.com,S=2568" <unfinished ...>
[pid 25433] 10:12:34.672031 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25425] 10:12:34.672063 <... close resumed> ) = 0
[pid 25444] 10:12:34.672098 dup2(5, 0 <unfinished ...>
[pid 25443] 10:12:34.672123 close(1 <unfinished ...>
[pid 25442] 10:12:34.672145 <... rename resumed> ) = 0
[pid 25433] 10:12:34.672159 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:34.672191 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.672240 <... dup2 resumed> ) = 0
[pid 25443] 10:12:34.672254 <... close resumed> ) = 0
[pid 25442] 10:12:34.672268 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.672302 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.672333 <... open resumed> ) = 10
[pid 25444] 10:12:34.672360 close(5 <unfinished ...>
[pid 25443] 10:12:34.672382 close(2 <unfinished ...>
[pid 25442] 10:12:34.672404 <... write resumed> ) = 4
[pid 25433] 10:12:34.672417 <... open resumed> ) = 12
[pid 25425] 10:12:34.672432 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.672461 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.672568 <... close resumed> ) = 0
[pid 25443] 10:12:34.672588 <... close resumed> ) = 0
[pid 25442] 10:12:34.672615 write(12, "\10\n\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.672712 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25425] 10:12:34.672739 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.672772 read(11,  <unfinished ...>
[pid 25444] 10:12:34.672808 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25443] 10:12:34.673349 setsid( <unfinished ...>
[pid 25442] 10:12:34.673381 <... write resumed> ) = 4
[pid 25433] 10:12:34.673396 <... ioctl resumed> , 0x7ffc72712620) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25425] 10:12:34.673414 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.673440 <... read resumed> "\10\n\0\0", 4) = 4
[pid 25443] 10:12:34.673468 <... setsid resumed> ) = 25443
[pid 25442] 10:12:34.673565 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25433] 10:12:34.673601 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25425] 10:12:34.673625 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.673659 read(11,  <unfinished ...>
[pid 25444] 10:12:34.673692 <... execve resumed> ) = 0
[pid 25443] 10:12:34.673706 fstat(0,  <unfinished ...>
[pid 25442] 10:12:34.673746 <... write resumed> ) = 4
[pid 25433] 10:12:34.673763 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.673815 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.673846 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25444] 10:12:34.673874 brk(0 <unfinished ...>
[pid 25443] 10:12:34.673897 <... fstat resumed> 0x7fff12fb47c0) = -1 EBADF (Bad file descriptor)
[pid 25442] 10:12:34.673912 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.673943 read(12,  <unfinished ...>
[pid 25425] 10:12:34.673968 <... mmap resumed> ) = 0x7f380d424000
[pid 25411] 10:12:34.673985 read(11,  <unfinished ...>
[pid 25444] 10:12:34.674017 <... brk resumed> ) = 0x12b8000
[pid 25443] 10:12:34.674030 open("/dev/null", O_RDWR <unfinished ...>
[pid 25442] 10:12:34.674084 <... write resumed> ) = 4
[pid 25433] 10:12:34.674101 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25425] 10:12:34.674230 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.674262 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.674289 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.674318 <... open resumed> ) = 0
[pid 25442] 10:12:34.674332 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.674361 brk(0x9de000 <unfinished ...>
[pid 25425] 10:12:34.674385 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.674402 read(11,  <unfinished ...>
[pid 25444] 10:12:34.674450 <... mmap resumed> ) = 0x7ff554aa8000
[pid 25443] 10:12:34.674464 fstat(1,  <unfinished ...>
[pid 25442] 10:12:34.674569 <... write resumed> ) = 4
[pid 25433] 10:12:34.674588 <... brk resumed> ) = 0x9de000
[pid 25425] 10:12:34.675159 read(10,  <unfinished ...>
[pid 25411] 10:12:34.675201 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.675232 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25443] 10:12:34.675262 <... fstat resumed> 0x7fff12fb47c0) = -1 EBADF (Bad file descriptor)
[pid 25442] 10:12:34.675279 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.675316 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.675339 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.675384 read(11,  <unfinished ...>
[pid 25444] 10:12:34.675420 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.675435 dup2(0, 1 <unfinished ...>
[pid 25442] 10:12:34.675471 <... write resumed> ) = 4
[pid 25433] 10:12:34.675541 <... lseek resumed> ) = 4868
[pid 25425] 10:12:34.675557 pipe( <unfinished ...>
[pid 25411] 10:12:34.675587 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.675615 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.675644 <... dup2 resumed> ) = 1
[pid 25442] 10:12:34.675658 write(12, "\260\3\235\1\0\0\0\0", 8 <unfinished ...>
[pid 25433] 10:12:34.675686 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25425] 10:12:34.675708 <... pipe resumed> [11, 12]) = 0
[pid 25411] 10:12:34.675726 read(11,  <unfinished ...>
[pid 25444] 10:12:34.675759 <... open resumed> ) = 5
[pid 25443] 10:12:34.675772 fstat(2,  <unfinished ...>
[pid 25442] 10:12:34.675795 <... write resumed> ) = 8
[pid 25433] 10:12:34.675811 <... lseek resumed> ) = 4868
[pid 25425] 10:12:34.675824 close(10 <unfinished ...>
[pid 25411] 10:12:34.675851 <... read resumed> "\260\3\235\1\0\0\0\0", 8) = 8
[pid 25444] 10:12:34.675884 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.675907 <... fstat resumed> 0x7fff12fb47c0) = -1 EBADF (Bad file descriptor)
[pid 25442] 10:12:34.675922 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.675949 close(12 <unfinished ...>
[pid 25425] 10:12:34.675972 <... close resumed> ) = 0
[pid 25411] 10:12:34.675988 read(11,  <unfinished ...>
[pid 25444] 10:12:34.676020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25443] 10:12:34.676047 dup2(0, 2 <unfinished ...>
[pid 25442] 10:12:34.676071 <... write resumed> ) = 4
[pid 25433] 10:12:34.676087 <... close resumed> ) = 0
[pid 25425] 10:12:34.676100 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25411] 10:12:34.676148 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.676176 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.676203 <... dup2 resumed> ) = 2
[pid 25442] 10:12:34.676217 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25433] 10:12:34.676243 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25425] 10:12:34.676270 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.676288 read(11,  <unfinished ...>
[pid 25444] 10:12:34.676323 <... mmap resumed> ) = 0x7ff554a9e000
[pid 25443] 10:12:34.676337 geteuid( <unfinished ...>
[pid 25442] 10:12:34.676360 <... write resumed> ) = 4
[pid 25433] 10:12:34.676376 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.676392 clone( <unfinished ...>
[pid 25411] 10:12:34.676771 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25444] 10:12:34.676802 close(5 <unfinished ...>
[pid 25443] 10:12:34.676824 <... geteuid resumed> ) = 47
[pid 25442] 10:12:34.676838 close(12 <unfinished ...>
[pid 25433] 10:12:34.676862 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25411] 10:12:34.676885 close(11 <unfinished ...>
[pid 25442] 10:12:34.676916 <... close resumed> ) = 0
[pid 25425] 10:12:34.676934 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25446
[pid 25411] 10:12:34.676974 <... close resumed> ) = 0
[pid 25442] 10:12:34.677008 close(10 <unfinished ...>
[pid 25425] 10:12:34.677035 close(12 <unfinished ...>
[pid 25411] 10:12:34.677062 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25442] 10:12:34.677107 <... close resumed> ) = 0
[pid 25433] 10:12:34.677123 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.677145 <... close resumed> ) = 0
[pid 25411] 10:12:34.677161 <... write resumed> ) = 55
[pid 25442] 10:12:34.677192 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25433] 10:12:34.677223 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25425] 10:12:34.677250 read(11,  <unfinished ...>
[pid 25411] 10:12:34.677272 fsync(9 <unfinished ...>
[pid 25442] 10:12:34.677352 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.677386 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25442] 10:12:34.677547 close(13 <unfinished ...>
[pid 25433] 10:12:34.677561 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25442] 10:12:34.677577 <... close resumed> ) = 0
[pid 25433] 10:12:34.677585 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25442] 10:12:34.677617 munmap(0x7f816929f000, 4096 <unfinished ...>
[pid 25433] 10:12:34.677651 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25442] 10:12:34.677684 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.678104 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.678127 <... fsync resumed> ) = 0
[pid 25442] 10:12:34.678148 exit_group(0) = ?
[pid 25433] 10:12:34.678541 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25411] 10:12:34.678587 wait4(-1,  <unfinished ...>
[pid 25444] 10:12:34.678631 <... close resumed> ) = 0
[pid 25443] 10:12:34.678645 fstat(0,  <unfinished ...>
[pid 25442] 10:12:34.678666 +++ exited with 0 +++
[pid 25433] 10:12:34.678678 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.678700 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25442
[pid 25433] 10:12:34.678757 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25411] 10:12:34.678796 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.678829 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.678847 <... open resumed> ) = 10
[pid 25433] 10:12:34.678868 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25411] 10:12:34.678899 fstat(10,  <unfinished ...>
[pid 25433] 10:12:34.678925 <... stat resumed> 0x7ffc72712830) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.678945 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.678983 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25411] 10:12:34.679016 fstat(10,  <unfinished ...>
[pid 25433] 10:12:34.679042 <... stat resumed> 0x7ffc727128d0) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.679059 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.679091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25411] 10:12:34.679120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.679152 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25411] 10:12:34.679183 <... mmap resumed> ) = 0x7f81692a0000
[pid 25433] 10:12:34.679204 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.679236 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:34.679263 <... open resumed> ) = 12
[pid 25411] 10:12:34.679281 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.679302 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.679328 read(10,  <unfinished ...>
[pid 25433] 10:12:34.679362 <... ioctl resumed> , 0x7ffc72712620) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.679380 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:34.679429 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.679457 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:34.679573 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.679610 <... stat resumed> 0x7ffdf4a53130) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.679643 read(12,  <unfinished ...>
[pid 25411] 10:12:34.679673 stat("/etc/localtime",  <unfinished ...>
[pid 25433] 10:12:34.679703 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25411] 10:12:34.680146 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:34.680213 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.680240 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25411] 10:12:34.680294 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.680359 stat("/etc/localtime",  <unfinished ...>
[pid 25433] 10:12:34.680393 <... lseek resumed> ) = 2366
[pid 25411] 10:12:34.680409 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:34.680444 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.680468 close(7 <unfinished ...>
[pid 25433] 10:12:34.680582 <... lseek resumed> ) = 2366
[pid 25411] 10:12:34.680601 <... close resumed> ) = 0
Process 25445 attached
[pid 25444] 10:12:34.680682 open("/lib64/libtinfo.so.5", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.680737 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.680767 close(12 <unfinished ...>
[pid 25411] 10:12:34.680795 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.680838 set_robust_list(0x7f54cb33faa0, 24 <unfinished ...>
[pid 25444] 10:12:34.680861 <... open resumed> ) = 5
[pid 25443] 10:12:34.680875 fstat(1,  <unfinished ...>
[pid 25433] 10:12:34.680899 <... close resumed> ) = 0
[pid 25411] 10:12:34.681224 <... open resumed> ) = 7
[pid 25445] 10:12:34.681260 <... set_robust_list resumed> ) = 0
[pid 25444] 10:12:34.681276 read(5,  <unfinished ...>
[pid 25443] 10:12:34.681328 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.681360 read(11,  <unfinished ...>
[pid 25411] 10:12:34.681386 fcntl(7, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.681417 close(0 <unfinished ...>
[pid 25444] 10:12:34.681439 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.681460 fstat(2,  <unfinished ...>
[pid 25433] 10:12:34.681558 <... read resumed> "", 8192) = 0
[pid 25411] 10:12:34.681574 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.681609 <... close resumed> ) = 0
[pid 25444] 10:12:34.681630 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.681711 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.681745 close(11 <unfinished ...>
[pid 25411] 10:12:34.681782 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.681814 dup2(10, 0 <unfinished ...>
[pid 25444] 10:12:34.681837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.681863 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMY-0006cE-He"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25433] 10:12:34.682692 <... close resumed> ) = 0
[pid 25411] 10:12:34.682918 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.682953 <... dup2 resumed> ) = 0
[pid 25444] 10:12:34.682969 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25433] 10:12:34.683001 stat("/etc/userdomains",  <unfinished ...>
[pid 25411] 10:12:34.683029 fstat(7,  <unfinished ...>
[pid 25445] 10:12:34.683060 close(10 <unfinished ...>
[pid 25444] 10:12:34.683083 <... mmap resumed> ) = 0x7ff554669000
[pid 25443] 10:12:34.683098 <... execve resumed> ) = 0
[pid 25433] 10:12:34.683113 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.683160 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5367547, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.683209 <... close resumed> ) = 0
[pid 25444] 10:12:34.683224 mprotect(0x7ff554686000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.683260 brk(0 <unfinished ...>
[pid 25433] 10:12:34.683283 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.683311 write(7, "2015-12-30 10:12:34 [25411] 1aEJMX-0006bl-RX => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2568 QT=1s DT=0s\n", 232 <unfinished ...>
[pid 25445] 10:12:34.683357 close(11 <unfinished ...>
[pid 25444] 10:12:34.683381 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.683395 <... brk resumed> ) = 0x1c31000
[pid 25433] 10:12:34.683410 <... open resumed> ) = 11
[pid 25411] 10:12:34.683427 <... write resumed> ) = 232
[pid 25445] 10:12:34.683461 <... close resumed> ) = 0
[pid 25444] 10:12:34.683556 mmap(0x7ff554885000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000 <unfinished ...>
[pid 25443] 10:12:34.683604 fcntl(0, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.683631 fstat(11,  <unfinished ...>
[pid 25411] 10:12:34.683654 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25445] 10:12:34.683702 fstat(0,  <unfinished ...>
[pid 25444] 10:12:34.683725 <... mmap resumed> ) = 0x7ff554885000
[pid 25443] 10:12:34.683738 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.683758 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.683793 <... open resumed> ) = 11
[pid 25445] 10:12:34.683818 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130166832, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.683843 mmap(0x7ff554889000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.683872 fcntl(1, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.683895 fstat(11,  <unfinished ...>
[pid 25411] 10:12:34.683917 alarm(60 <unfinished ...>
[pid 25445] 10:12:34.683949 fstat(1,  <unfinished ...>
[pid 25444] 10:12:34.683971 <... mmap resumed> ) = 0x7ff554889000
[pid 25443] 10:12:34.683984 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.684000 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.684029 <... alarm resumed> ) = 0
[pid 25445] 10:12:34.684052 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25444] 10:12:34.684077 close(5 <unfinished ...>
[pid 25443] 10:12:34.684101 fcntl(2, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.684123 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.684149 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25445] 10:12:34.684186 fstat(2,  <unfinished ...>
[pid 25444] 10:12:34.684209 <... close resumed> ) = 0
[pid 25443] 10:12:34.684222 <... fcntl resumed> ) = 0
[pid 25433] 10:12:34.684252 <... mmap resumed> ) = 0x7fea0f282000
[pid 25411] 10:12:34.684277 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.684302 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25444] 10:12:34.684328 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.684378 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25433] 10:12:34.684407 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.684431 alarm(0 <unfinished ...>
[pid 25445] 10:12:34.684462 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMX-0006bd-HC"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25444] 10:12:34.684963 <... open resumed> ) = 5
[pid 25443] 10:12:34.684989 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.685013 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.685048 <... alarm resumed> ) = 60
[pid 25444] 10:12:34.685142 read(5,  <unfinished ...>
[pid 25443] 10:12:34.685169 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.685195 read(11,  <unfinished ...>
[pid 25411] 10:12:34.685222 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25445] 10:12:34.685262 <... execve resumed> ) = 0
[pid 25444] 10:12:34.685276 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.685312 <... mmap resumed> ) = 0x7fdec5aba000
[pid 25433] 10:12:34.685331 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.685398 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25445] 10:12:34.685455 brk(0 <unfinished ...>
[pid 25444] 10:12:34.685583 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.685613 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25433] 10:12:34.685642 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.685672 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.685710 <... brk resumed> ) = 0x1332000
[pid 25444] 10:12:34.685724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.685754 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.685773 <... open resumed> ) = 12
[pid 25411] 10:12:34.685804 <... open resumed> ) = 12
[pid 25445] 10:12:34.685831 fcntl(0, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.685853 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.685880 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.685914 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.685937 fcntl(12, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.685967 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.685980 <... mmap resumed> ) = 0x7ff554465000
[pid 25443] 10:12:34.685995 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.686011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25411] 10:12:34.686041 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.686064 fcntl(1, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.686086 mprotect(0x7ff554467000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.686112 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.686139 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.686165 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.686195 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.686208 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.686223 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.686240 <... mmap resumed> ) = 0x7fea0f281000
[pid 25411] 10:12:34.686258 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.686282 fcntl(2, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.686304 mmap(0x7ff554667000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000 <unfinished ...>
[pid 25443] 10:12:34.686334 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.686363 read(12,  <unfinished ...>
[pid 25411] 10:12:34.686390 read(12,  <unfinished ...>
[pid 25445] 10:12:34.686421 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.686434 <... mmap resumed> ) = 0x7ff554667000
[pid 25443] 10:12:34.686455 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.686551 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25411] 10:12:34.686594 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25445] 10:12:34.686636 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25444] 10:12:34.686665 close(5 <unfinished ...>
[pid 25443] 10:12:34.686687 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25433] 10:12:34.686728 close(12 <unfinished ...>
[pid 25411] 10:12:34.686753 close(12 <unfinished ...>
[pid 25445] 10:12:34.686784 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.686798 <... close resumed> ) = 0
[pid 25443] 10:12:34.686825 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.686849 <... close resumed> ) = 0
[pid 25411] 10:12:34.686869 <... close resumed> ) = 0
[pid 25445] 10:12:34.686899 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.686928 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.686960 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.686989 munmap(0x7fea0f281000, 4096 <unfinished ...>
[pid 25411] 10:12:34.687018 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.687052 <... mmap resumed> ) = 0x7fb627068000
[pid 25444] 10:12:34.687066 <... open resumed> ) = 5
[pid 25443] 10:12:34.687093 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.687111 <... munmap resumed> ) = 0
[pid 25411] 10:12:34.687161 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.687193 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25444] 10:12:34.687222 read(5,  <unfinished ...>
[pid 25443] 10:12:34.687245 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.687272 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.687302 stat("/var/tmp",  <unfinished ...>
[pid 25445] 10:12:34.687341 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.687355 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.687387 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.687405 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.687447 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25445] 10:12:34.687723 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.687764 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.687788 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.687817 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25411] 10:12:34.687847 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.687885 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.687906 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.687936 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.687953 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.687994 <... open resumed> ) = 12
[pid 25445] 10:12:34.688019 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.688046 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.688072 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25433] 10:12:34.688098 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.688127 fcntl(12, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.688157 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.688172 <... mmap resumed> ) = 0x7ff554a9d000
[pid 25443] 10:12:34.688187 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25433] 10:12:34.688220 <... open resumed> ) = 12
[pid 25411] 10:12:34.688240 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.688264 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.688291 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.688318 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.688358 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.688382 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.688412 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.688426 <... mmap resumed> ) = 0x7ff5540d1000
[pid 25443] 10:12:34.688442 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.688457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.688587 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.688620 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25444] 10:12:34.688649 mprotect(0x7ff55425b000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.688676 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.688705 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.688729 fstat(12,  <unfinished ...>
[pid 25445] 10:12:34.688759 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.688774 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.688789 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.688806 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25411] 10:12:34.688836 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25445] 10:12:34.688897 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.688929 mmap(0x7ff55445b000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25443] 10:12:34.688960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.688991 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25411] 10:12:34.689017 pread(12,  <unfinished ...>
[pid 25445] 10:12:34.689050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.689064 <... mmap resumed> ) = 0x7ff55445b000
[pid 25443] 10:12:34.689079 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.689101 <... mmap resumed> ) = 0x7fea0f281000
[pid 25411] 10:12:34.689120 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25445] 10:12:34.689167 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.689198 mmap(0x7ff554460000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.689225 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25433] 10:12:34.689255 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.689278 pread(12,  <unfinished ...>
[pid 25445] 10:12:34.689310 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.689325 <... mmap resumed> ) = 0x7ff554460000
[pid 25443] 10:12:34.689341 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.689364 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.689386 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25445] 10:12:34.689424 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.689456 close(5 <unfinished ...>
[pid 25443] 10:12:34.689581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.689621 read(12,  <unfinished ...>
[pid 25411] 10:12:34.689649 close(12 <unfinished ...>
[pid 25445] 10:12:34.689682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.689696 <... close resumed> ) = 0
[pid 25443] 10:12:34.689712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.689751 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25411] 10:12:34.689782 <... close resumed> ) = 0
[pid 25445] 10:12:34.689824 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25444] 10:12:34.689859 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.689886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.689915 read(12,  <unfinished ...>
[pid 25411] 10:12:34.689938 close(11 <unfinished ...>
[pid 25445] 10:12:34.689974 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25444] 10:12:34.690000 <... mmap resumed> ) = 0x7ff554a9c000
[pid 25443] 10:12:34.690016 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.690036 <... read resumed> "", 4096) = 0
[pid 25411] 10:12:34.690102 <... close resumed> ) = 0
[pid 25445] 10:12:34.690155 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.690189 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.690215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.690246 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25411] 10:12:34.690278 pipe( <unfinished ...>
[pid 25445] 10:12:34.690313 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.690327 <... mmap resumed> ) = 0x7ff554a9b000
[pid 25443] 10:12:34.690345 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.690364 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2922, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.690425 <... pipe resumed> [11, 12]) = 0
[pid 25445] 10:12:34.690455 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.690561 arch_prctl(ARCH_SET_FS, 0x7ff554a9c700 <unfinished ...>
[pid 25443] 10:12:34.690589 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25433] 10:12:34.690618 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.690649 close(10 <unfinished ...>
[pid 25445] 10:12:34.690682 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.690697 <... arch_prctl resumed> ) = 0
[pid 25443] 10:12:34.690712 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:34.690829 <... open resumed> ) = 13
[pid 25411] 10:12:34.690854 <... close resumed> ) = 0
[pid 25445] 10:12:34.690878 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.690909 mprotect(0x7ff55445b000, 16384, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.690936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.690965 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25411] 10:12:34.690991 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25445] 10:12:34.691029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.691043 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.691058 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.691085 <... ioctl resumed> , 0x7ffc72715710) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25411] 10:12:34.691107 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.691133 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25444] 10:12:34.691162 mprotect(0x7ff554667000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.691188 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.691215 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25411] 10:12:34.691238 clone( <unfinished ...>
[pid 25445] 10:12:34.691651 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.691669 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.691683 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.691698 <... lseek resumed> ) = 0
[pid 25433] 10:12:34.691724 fstat(13,  <unfinished ...>
[pid 25411] 10:12:34.691749 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25447
[pid 25433] 10:12:34.691788 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2922, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.691821 close(12 <unfinished ...>
[pid 25433] 10:12:34.691848 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.691872 <... close resumed> ) = 0
[pid 25433] 10:12:34.691891 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.691968 read(11,  <unfinished ...>
[pid 25433] 10:12:34.691996 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2922
[pid 25433] 10:12:34.692564 read(13, "", 8192) = 0
[pid 25433] 10:12:34.692617 close(13)   = 0
[pid 25433] 10:12:34.692696 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:34.692772 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:34.692836 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:34.692914 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25433] 10:12:34.692963 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25444] 10:12:34.693062 mprotect(0x7ff554aa9000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.693087 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f280000
[pid 25433] 10:12:34.693126 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.693180 close(13 <unfinished ...>
[pid 25444] 10:12:34.693216 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.693240 <... close resumed> ) = 0
[pid 25444] 10:12:34.693261 munmap(0x7ff554a9e000, 39387 <unfinished ...>
[pid 25433] 10:12:34.693294 munmap(0x7fea0f280000, 4096 <unfinished ...>
[pid 25444] 10:12:34.693326 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.693375 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.693405 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25433] 10:12:34.693432 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25444] 10:12:34.693463 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25433] 10:12:34.693565 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25445] 10:12:34.693623 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.693648 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25443] 10:12:34.693684 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.693715 pipe( <unfinished ...>
[pid 25444] 10:12:34.693750 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25443] 10:12:34.693774 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.693792 <... pipe resumed> [13, 14]) = 0
[pid 25444] 10:12:34.693815 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.693840 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25433] 10:12:34.693867 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25444] 10:12:34.693900 <... ioctl resumed> , 0x7fffdfb66370) = -1 EINVAL (Invalid argument)
[pid 25443] 10:12:34.693946 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.693965 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25444] 10:12:34.693991 brk(0 <unfinished ...>
[pid 25443] 10:12:34.694081 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.694116 close(10 <unfinished ...>
[pid 25444] 10:12:34.694147 <... brk resumed> ) = 0x12b8000
[pid 25443] 10:12:34.694206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.694227 <... close resumed> ) = 0
[pid 25444] 10:12:34.694248 brk(0x12d9000 <unfinished ...>
[pid 25443] 10:12:34.694272 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25433] 10:12:34.694301 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25444] 10:12:34.694333 <... brk resumed> ) = 0x12d9000
[pid 25443] 10:12:34.694372 <... stat resumed> 0x7ffd9475d060) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.694392 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.694414 getuid( <unfinished ...>
[pid 25443] 10:12:34.694438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.694468 close(11 <unfinished ...>
[pid 25444] 10:12:34.694550 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.694571 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.694589 <... close resumed> ) = 0
[pid 25444] 10:12:34.694610 getgid( <unfinished ...>
[pid 25443] 10:12:34.694633 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25433] 10:12:34.694661 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25444] 10:12:34.694693 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.694710 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:34.694761 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.694787 geteuid( <unfinished ...>
[pid 25443] 10:12:34.694811 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.694840 close(12 <unfinished ...>
[pid 25444] 10:12:34.694870 <... geteuid resumed> ) = 503
[pid 25443] 10:12:34.694887 <... open resumed> ) = 6
[pid 25433] 10:12:34.694903 <... close resumed> ) = 0
[pid 25444] 10:12:34.694923 getegid( <unfinished ...>
[pid 25443] 10:12:34.694946 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.694968 munmap(0x7fea0f281000, 4096 <unfinished ...>
[pid 25444] 10:12:34.695001 <... getegid resumed> ) = 500
[pid 25443] 10:12:34.695026 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25433] 10:12:34.695057 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.695079 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25443] 10:12:34.695102 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.695128 close(9 <unfinished ...>
[pid 25444] 10:12:34.695158 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25443] 10:12:34.695211 <... mmap resumed> ) = 0x7fdec5ab0000
[pid 25433] 10:12:34.695230 <... close resumed> ) = 0
[pid 25444] 10:12:34.695251 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.695289 close(6 <unfinished ...>
[pid 25433] 10:12:34.695314 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25444] 10:12:34.695345 <... open resumed> ) = 5
[pid 25443] 10:12:34.695368 <... close resumed> ) = 0
[pid 25433] 10:12:34.695394 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.695417 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.695441 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.695473 clone( <unfinished ...>
[pid 25445] 10:12:34.695871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.695888 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.695920 <... open resumed> ) = 6
[pid 25444] 10:12:34.695943 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.695971 read(6,  <unfinished ...>
[pid 25433] 10:12:34.695996 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25448
[pid 25444] 10:12:34.696038 <... mmap resumed> ) = 0x7ff554aa7000
[pid 25443] 10:12:34.696058 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.696084 close(14 <unfinished ...>
[pid 25444] 10:12:34.696113 read(5,  <unfinished ...>
[pid 25443] 10:12:34.696170 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.696194 <... close resumed> ) = 0
[pid 25444] 10:12:34.696215 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          256200 kB\nCached:           328680 kB\nBuffers:               0 kB\nActive:           294792 kB\nInactive:         467148 kB\nActive(anon):     163460 kB\nInactive(anon):   277604 kB\nActive(file):     131332 kB\nInac"..., 1024) = 588
[pid 25443] 10:12:34.696254 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.696292 read(13,  <unfinished ...>
[pid 25444] 10:12:34.696319 close(5 <unfinished ...>
[pid 25443] 10:12:34.696353 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.696385 <... close resumed> ) = 0
[pid 25443] 10:12:34.696402 <... mmap resumed> ) = 0x7fdec5682000
[pid 25444] 10:12:34.696422 munmap(0x7ff554aa7000, 4096 <unfinished ...>
[pid 25443] 10:12:34.696451 mprotect(0x7fdec5698000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.696591 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.696644 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.696670 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.696693 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.696721 mmap(0x7fdec5898000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25444] 10:12:34.696756 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:34.696775 <... mmap resumed> ) = 0x7fdec5898000
[pid 25444] 10:12:34.696801 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.696829 mmap(0x7fdec589a000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.696862 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.696882 <... mmap resumed> ) = 0x7fdec589a000
[pid 25444] 10:12:34.696908 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.696936 close(6 <unfinished ...>
[pid 25444] 10:12:34.696963 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:34.696982 <... close resumed> ) = 0
[pid 25444] 10:12:34.697009 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.697036 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.697072 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.697091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.697113 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.697138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.697175 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:34.697194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.697214 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.697240 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.697273 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.697294 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.697319 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25443] 10:12:34.697345 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.697386 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25443] 10:12:34.697414 <... open resumed> ) = 6
[pid 25444] 10:12:34.697436 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.697463 read(6,  <unfinished ...>
[pid 25445] 10:12:34.697578 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.697595 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.697624 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.697655 uname( <unfinished ...>
[pid 25443] 10:12:34.697679 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.697706 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25443] 10:12:34.697774 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.697813 getcwd( <unfinished ...>
[pid 25443] 10:12:34.697840 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.697871 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25443] 10:12:34.697899 <... mmap resumed> ) = 0x7fdec5aaf000
[pid 25444] 10:12:34.697925 getpid( <unfinished ...>
[pid 25443] 10:12:34.697949 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.697980 <... getpid resumed> ) = 25444
[pid 25443] 10:12:34.698007 <... mmap resumed> ) = 0x7fdec5469000
[pid 25444] 10:12:34.698029 getppid( <unfinished ...>
[pid 25443] 10:12:34.698052 mprotect(0x7fdec547f000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.698083 <... getppid resumed> ) = 25389
[pid 25443] 10:12:34.698109 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.698130 stat(".",  <unfinished ...>
[pid 25443] 10:12:34.698156 mmap(0x7fdec567e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25444] 10:12:34.698190 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25443] 10:12:34.698227 <... mmap resumed> ) = 0x7fdec567e000
[pid 25444] 10:12:34.698252 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.698283 mmap(0x7fdec5680000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.698315 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.698347 <... mmap resumed> ) = 0x7fdec5680000
[pid 25444] 10:12:34.698373 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.698402 close(6 <unfinished ...>
[pid 25444] 10:12:34.698430 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.698458 <... close resumed> ) = 0
[pid 25444] 10:12:34.698560 geteuid( <unfinished ...>
[pid 25443] 10:12:34.698596 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.698646 <... geteuid resumed> ) = 503
[pid 25443] 10:12:34.698667 <... open resumed> ) = -1 ENOENT (No such file or directory)
Process 25446 attached
[pid 25445] 10:12:34.698726 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.698757 getegid( <unfinished ...>
[pid 25443] 10:12:34.698780 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.698817 <... getegid resumed> ) = 500
[pid 25443] 10:12:34.698833 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.698854 getuid( <unfinished ...>
[pid 25443] 10:12:34.698877 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.698910 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.698926 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.698952 getgid( <unfinished ...>
[pid 25443] 10:12:34.698976 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.699011 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.699027 <... open resumed> ) = 6
[pid 25444] 10:12:34.699047 access("/bin/sh", X_OK <unfinished ...>
[pid 25443] 10:12:34.699076 read(6,  <unfinished ...>
[pid 25444] 10:12:34.699104 <... access resumed> ) = 0
[pid 25443] 10:12:34.699120 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.699148 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.699174 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.699201 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.699230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.699262 geteuid( <unfinished ...>
[pid 25443] 10:12:34.699285 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.699316 <... geteuid resumed> ) = 503
[pid 25443] 10:12:34.699333 <... mmap resumed> ) = 0x7fdec5232000
[pid 25444] 10:12:34.699354 getegid( <unfinished ...>
[pid 25443] 10:12:34.699377 mprotect(0x7fdec5239000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.699408 <... getegid resumed> ) = 500
[pid 25443] 10:12:34.699424 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.699443 getuid( <unfinished ...>
[pid 25443] 10:12:34.699466 mmap(0x7fdec5439000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25444] 10:12:34.699581 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.699639 <... mmap resumed> ) = 0x7fdec5439000
[pid 25446] 10:12:34.699669 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25445] 10:12:34.699692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.699707 getgid( <unfinished ...>
[pid 25443] 10:12:34.699741 mmap(0x7fdec543b000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25446] 10:12:34.699780 <... set_robust_list resumed> ) = 0
[pid 25445] 10:12:34.699795 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25444] 10:12:34.699817 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.699833 <... mmap resumed> ) = 0x7fdec543b000
[pid 25444] 10:12:34.699858 access("/bin/sh", R_OK <unfinished ...>
[pid 25443] 10:12:34.699889 close(6 <unfinished ...>
[pid 25444] 10:12:34.699922 <... access resumed> ) = 0
[pid 25443] 10:12:34.699939 <... close resumed> ) = 0
[pid 25444] 10:12:34.699966 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.699995 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.700030 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.700059 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.700082 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.700108 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.700144 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.700172 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.700193 geteuid( <unfinished ...>
[pid 25443] 10:12:34.700216 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.700249 <... geteuid resumed> ) = 503
[pid 25443] 10:12:34.700265 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.700288 getegid( <unfinished ...>
[pid 25443] 10:12:34.700311 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.700348 <... getegid resumed> ) = 500
[pid 25443] 10:12:34.700364 <... open resumed> ) = 6
[pid 25444] 10:12:34.700384 getuid( <unfinished ...>
[pid 25443] 10:12:34.700407 read(6,  <unfinished ...>
[pid 25444] 10:12:34.700441 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.700457 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25446] 10:12:34.700663 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25445] 10:12:34.700696 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.700725 getgid( <unfinished ...>
[pid 25443] 10:12:34.700749 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.700777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.700808 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.700824 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25445] 10:12:34.700859 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.700877 access("/bin/sh", X_OK <unfinished ...>
[pid 25443] 10:12:34.700906 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.700939 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.700967 <... access resumed> ) = 0
[pid 25443] 10:12:34.700983 <... mmap resumed> ) = 0x7fdec4fae000
[pid 25445] 10:12:34.701005 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701028 stat("/bin/sh",  <unfinished ...>
[pid 25443] 10:12:34.701056 mprotect(0x7fdec5031000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.701088 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.701117 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25443] 10:12:34.701145 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.701166 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701184 geteuid( <unfinished ...>
[pid 25443] 10:12:34.701206 mmap(0x7fdec5230000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25445] 10:12:34.701240 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25444] 10:12:34.701268 <... geteuid resumed> ) = 503
[pid 25443] 10:12:34.701284 <... mmap resumed> ) = 0x7fdec5230000
[pid 25445] 10:12:34.701313 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701333 getegid( <unfinished ...>
[pid 25443] 10:12:34.701357 close(6 <unfinished ...>
[pid 25445] 10:12:34.701385 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.701414 <... getegid resumed> ) = 500
[pid 25443] 10:12:34.701430 <... close resumed> ) = 0
[pid 25445] 10:12:34.701458 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701550 getuid( <unfinished ...>
[pid 25443] 10:12:34.701580 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25446] 10:12:34.701617 <... setrlimit resumed> ) = 0
[pid 25445] 10:12:34.701631 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25444] 10:12:34.701658 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.701675 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.701697 <... stat resumed> 0x7ffe578dfb90) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701714 getgid( <unfinished ...>
[pid 25443] 10:12:34.701736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.701772 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.701800 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.701816 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.701838 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.701854 access("/bin/sh", R_OK <unfinished ...>
[pid 25443] 10:12:34.701882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.701916 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25444] 10:12:34.701943 <... access resumed> ) = 0
[pid 25443] 10:12:34.701974 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.701999 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.702031 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.702062 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.702097 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.702125 <... socket resumed> ) = 5
[pid 25443] 10:12:34.702141 <... open resumed> ) = 6
[pid 25445] 10:12:34.702162 <... open resumed> ) = 6
[pid 25444] 10:12:34.702178 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.702221 read(6,  <unfinished ...>
[pid 25445] 10:12:34.702251 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.702289 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.702306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.702338 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25444] 10:12:34.702366 close(5 <unfinished ...>
[pid 25443] 10:12:34.702393 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.702416 <... select resumed> ) = 1 (in [11], left {299, 954679})
[pid 25445] 10:12:34.702458 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.702563 <... close resumed> ) = 0
[pid 25443] 10:12:34.702582 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25428] 10:12:34.702613 read(11,  <unfinished ...>
[pid 25445] 10:12:34.702645 <... mmap resumed> ) = 0x7fb62705e000
[pid 25444] 10:12:34.702661 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.702688 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.702715 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25445] 10:12:34.702741 close(6 <unfinished ...>
[pid 25444] 10:12:34.702765 <... socket resumed> ) = 5
[pid 25443] 10:12:34.702781 <... mmap resumed> ) = 0x7fdec5aae000
[pid 25428] 10:12:34.702801 read(11,  <unfinished ...>
[pid 25445] 10:12:34.702832 <... close resumed> ) = 0
[pid 25444] 10:12:34.702856 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.702889 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25428] 10:12:34.702916 <... read resumed> "\0\322\304LU\356E}\240\301wJ\204\21\255\235\274\227\372L\344\254\243\257\262+\7\377\313\34$\321", 32) = 32
[pid 25445] 10:12:34.702950 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.702983 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.703001 <... mmap resumed> ) = 0x7fdec4da0000
[pid 25428] 10:12:34.703019 read(11,  <unfinished ...>
[pid 25445] 10:12:34.703049 <... open resumed> ) = 6
[pid 25444] 10:12:34.703066 close(5 <unfinished ...>
[pid 25443] 10:12:34.703092 mprotect(0x7fdec4dac000, 2097152, PROT_NONE <unfinished ...>
[pid 25428] 10:12:34.703121 <... read resumed> "\27\3\1\0`", 5) = 5
[pid 25445] 10:12:34.703147 read(6,  <unfinished ...>
[pid 25444] 10:12:34.703171 <... close resumed> ) = 0
[pid 25443] 10:12:34.703195 <... mprotect resumed> ) = 0
[pid 25428] 10:12:34.703213 read(11,  <unfinished ...>
[pid 25445] 10:12:34.703245 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.703275 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.703304 mmap(0x7fdec4fac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25428] 10:12:34.703335 <... read resumed> "\274\316\366)J.+A\227x\312v\246Q\321T\345\342L}\352\325\17\37R\362\204\320\275Z*\320'l-\324\265\221\225\2\317\34\371\315\204\25\310;\27\266BZ$\242\265\5\334\3727hb\17\10B\10m4\305\\\250I\355\5#\266\33\365M\323X\362\330f\374E\10vj?\334G\2607\237i\343", 96) = 96
[pid 25445] 10:12:34.703396 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.703424 <... open resumed> ) = 5
[pid 25443] 10:12:34.703443 <... mmap resumed> ) = 0x7fdec4fac000
[pid 25428] 10:12:34.703469 write(11, "\27\3\1\0 P\202m\23C\264\202;\323\264\207\313\260' ~\230L$\264\367(\214\20\234\243\212`\277\3{\310\27\3\1\0Pw\360\320\0q\"\224\250\314\205y\272T\371\312i\341\20\3403`\230\304\320\251K\35i-\266\\oZ\3\357\303\363^\27)\364G\225\335\222H\320\250\210\275wv\323h\211M4\231)\226\375\340>cry\330'\2r\277\264\266\267\310\344\341\370\306\263", 122 <unfinished ...>
[pid 25446] 10:12:34.703821 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.703846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.703877 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.703901 close(6 <unfinished ...>
[pid 25428] 10:12:34.703924 <... write resumed> ) = 122
[pid 25445] 10:12:34.703949 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.703977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25443] 10:12:34.704006 <... close resumed> ) = 0
[pid 25428] 10:12:34.704029 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25445] 10:12:34.704066 <... mmap resumed> ) = 0x7fb626c30000
[pid 25444] 10:12:34.704082 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.704109 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.704148 mprotect(0x7fb626c46000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.704175 <... mmap resumed> ) = 0x7ff554aa7000
[pid 25443] 10:12:34.704191 <... open resumed> ) = 6
[pid 25445] 10:12:34.704212 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.704228 read(5,  <unfinished ...>
[pid 25443] 10:12:34.704255 read(6,  <unfinished ...>
[pid 25445] 10:12:34.704284 mmap(0x7fb626e46000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25444] 10:12:34.704313 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25443] 10:12:34.704347 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.704378 <... mmap resumed> ) = 0x7fb626e46000
[pid 25444] 10:12:34.704400 read(5,  <unfinished ...>
[pid 25443] 10:12:34.704429 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.704458 mmap(0x7fb626e48000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.704566 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:34.704586 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25445] 10:12:34.704623 <... mmap resumed> ) = 0x7fb626e48000
[pid 25444] 10:12:34.704645 close(5 <unfinished ...>
[pid 25443] 10:12:34.704672 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.704705 close(6 <unfinished ...>
[pid 25444] 10:12:34.704727 <... close resumed> ) = 0
[pid 25443] 10:12:34.704743 <... mmap resumed> ) = 0x7fdec4b7d000
[pid 25445] 10:12:34.704764 <... close resumed> ) = 0
[pid 25444] 10:12:34.704787 munmap(0x7ff554aa7000, 4096 <unfinished ...>
[pid 25443] 10:12:34.704815 mprotect(0x7fdec4b9e000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.704848 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.704879 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.704905 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.704927 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.704945 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.704973 mmap(0x7fdec4d9e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25445] 10:12:34.705006 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.705039 <... open resumed> ) = 5
[pid 25443] 10:12:34.705055 <... mmap resumed> ) = 0x7fdec4d9e000
[pid 25445] 10:12:34.705080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.705098 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.705121 close(6 <unfinished ...>
[pid 25445] 10:12:34.705149 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.705178 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25443] 10:12:34.705206 <... close resumed> ) = 0
[pid 25445] 10:12:34.705234 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.705255 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.705282 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.705316 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.705347 <... mmap resumed> ) = 0x7ff554a9e000
[pid 25443] 10:12:34.705364 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.705397 <... open resumed> ) = 6
[pid 25444] 10:12:34.705420 close(5 <unfinished ...>
[pid 25443] 10:12:34.705469 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25446] 10:12:34.705626 <... open resumed> ) = 10
[pid 25445] 10:12:34.705647 read(6,  <unfinished ...>
[pid 25444] 10:12:34.705681 <... close resumed> ) = 0
[pid 25443] 10:12:34.705715 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.705749 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.705792 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.705837 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.705887 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.705921 <... open resumed> ) = 5
[pid 25443] 10:12:34.705943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.705977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.706021 read(5,  <unfinished ...>
[pid 25443] 10:12:34.706055 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.706106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.706144 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.706178 <... open resumed> ) = 6
[pid 25445] 10:12:34.706209 <... mmap resumed> ) = 0x7fb62705d000
[pid 25444] 10:12:34.706237 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.706272 read(6,  <unfinished ...>
[pid 25445] 10:12:34.706313 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.706353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.706402 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.706444 <... mmap resumed> ) = 0x7fb626a17000
[pid 25444] 10:12:34.706468 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.706621 fstat(6,  <unfinished ...>
[pid 25446] 10:12:34.706667 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.706696 mprotect(0x7fb626a2d000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.706735 <... mmap resumed> ) = 0x7ff553ec3000
[pid 25443] 10:12:34.706760 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25445] 10:12:34.706813 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.706836 mprotect(0x7ff553ecf000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.706875 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.706922 mmap(0x7fb626c2c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25444] 10:12:34.706964 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.706995 <... mmap resumed> ) = 0x7fdec4960000
[pid 25445] 10:12:34.707027 <... mmap resumed> ) = 0x7fb626c2c000
[pid 25444] 10:12:34.707056 mmap(0x7ff5540cf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25443] 10:12:34.707098 mprotect(0x7fdec4977000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.707144 mmap(0x7fb626c2e000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.707182 <... mmap resumed> ) = 0x7ff5540cf000
[pid 25443] 10:12:34.707217 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.707250 <... mmap resumed> ) = 0x7fb626c2e000
[pid 25444] 10:12:34.707279 close(5 <unfinished ...>
[pid 25443] 10:12:34.707315 mmap(0x7fdec4b77000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25445] 10:12:34.707364 close(6 <unfinished ...>
[pid 25444] 10:12:34.707397 <... close resumed> ) = 0
[pid 25443] 10:12:34.707438 <... mmap resumed> ) = 0x7fdec4b77000
[pid 25445] 10:12:34.707562 <... close resumed> ) = 0
[pid 25444] 10:12:34.707596 mprotect(0x7ff5540cf000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.707627 mmap(0x7fdec4b79000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25446] 10:12:34.707663 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.707691 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.707722 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.707741 <... mmap resumed> ) = 0x7fdec4b79000
[pid 25445] 10:12:34.707768 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.707788 munmap(0x7ff554a9e000, 39387 <unfinished ...>
[pid 25443] 10:12:34.707816 close(6 <unfinished ...>
[pid 25445] 10:12:34.707844 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.707877 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.707901 <... close resumed> ) = 0
[pid 25445] 10:12:34.707930 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.707949 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.707979 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.708014 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.708043 <... open resumed> ) = 5
[pid 25443] 10:12:34.708063 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.708085 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.708108 fcntl(5, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.708132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.708169 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.708199 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25443] 10:12:34.708220 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.708243 <... open resumed> ) = 6
[pid 25444] 10:12:34.708259 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.708282 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.708319 read(6,  <unfinished ...>
[pid 25444] 10:12:34.708343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.708371 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.708400 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.708424 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.708450 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.708590 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.708617 <... mmap resumed> ) = 0x7ff554aa7000
[pid 25443] 10:12:34.708640 <... open resumed> ) = 6
[pid 25446] 10:12:34.708663 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.708693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.708725 read(5,  <unfinished ...>
[pid 25443] 10:12:34.708756 read(6,  <unfinished ...>
[pid 25445] 10:12:34.708786 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.708813 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.708849 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.708880 <... mmap resumed> ) = 0x7fb6267e0000
[pid 25444] 10:12:34.708896 close(5 <unfinished ...>
[pid 25443] 10:12:34.708921 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.708949 mprotect(0x7fb6267e7000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.708976 <... close resumed> ) = 0
[pid 25443] 10:12:34.708993 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25445] 10:12:34.709027 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.709043 munmap(0x7ff554aa7000, 4096 <unfinished ...>
[pid 25443] 10:12:34.709071 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.709103 mmap(0x7fb6269e7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25444] 10:12:34.709130 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.709189 <... mmap resumed> ) = 0x7fdec5aad000
[pid 25445] 10:12:34.709217 <... mmap resumed> ) = 0x7fb6269e7000
[pid 25444] 10:12:34.709240 getpgrp( <unfinished ...>
[pid 25443] 10:12:34.709264 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.709296 mmap(0x7fb6269e9000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.709324 <... getpgrp resumed> ) = 29163
[pid 25443] 10:12:34.709342 <... mmap resumed> ) = 0x7fdec45ec000
[pid 25445] 10:12:34.709371 <... mmap resumed> ) = 0x7fb6269e9000
[pid 25444] 10:12:34.709392 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.709424 mprotect(0x7fdec475b000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.709457 close(6 <unfinished ...>
[pid 25444] 10:12:34.709561 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.709591 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.709614 <... close resumed> ) = 0
[pid 25444] 10:12:34.709637 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25443] 10:12:34.709661 mmap(0x7fdec495a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25445] 10:12:34.709696 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.709729 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25443] 10:12:34.709818 <... mmap resumed> ) = 0x7fdec495a000
[pid 25445] 10:12:34.709854 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.709875 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25443] 10:12:34.709899 close(6 <unfinished ...>
[pid 25445] 10:12:34.709926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.710021 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25443] 10:12:34.710051 <... close resumed> ) = 0
[pid 25445] 10:12:34.710083 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.710102 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25443] 10:12:34.710126 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.710160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.710190 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25443] 10:12:34.710218 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.710242 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.710261 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25443] 10:12:34.710285 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.710322 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.710356 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25443] 10:12:34.710431 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.710459 <... open resumed> ) = 6
[pid 25444] 10:12:34.710553 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.710588 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLYProcess 25448 attached
Process 25447 attached
 <unfinished ...>
[pid 25446] 10:12:34.710689 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.710722 read(6,  <unfinished ...>
[pid 25444] 10:12:34.710751 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.710771 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25448] 10:12:34.710800 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25447] 10:12:34.710823 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25446] 10:12:34.710845 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.710872 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.710904 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.710931 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25448] 10:12:34.710974 <... set_robust_list resumed> ) = 0
[pid 25447] 10:12:34.710987 <... set_robust_list resumed> ) = 0
[pid 25446] 10:12:34.711030 <... mmap resumed> ) = 0x7f380d424000
[pid 25445] 10:12:34.711129 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.711159 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.711180 <... open resumed> ) = 6
[pid 25448] 10:12:34.711205 close(13 <unfinished ...>
[pid 25447] 10:12:34.711227 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25446] 10:12:34.711253 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.711276 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.711306 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0},  <unfinished ...>
[pid 25443] 10:12:34.711332 read(6,  <unfinished ...>
[pid 25448] 10:12:34.711367 <... close resumed> ) = 0
[pid 25447] 10:12:34.711380 <... setrlimit resumed> ) = 0
[pid 25446] 10:12:34.711404 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.711626 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.711668 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7ff5541036a0}, 8) = 0
[pid 25443] 10:12:34.711692 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25448] 10:12:34.711726 geteuid( <unfinished ...>
[pid 25447] 10:12:34.711748 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25446] 10:12:34.711776 read(10,  <unfinished ...>
[pid 25445] 10:12:34.711804 <... mmap resumed> ) = 0x7fb62655c000
[pid 25444] 10:12:34.711821 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25443] 10:12:34.712081 fstat(6,  <unfinished ...>
[pid 25448] 10:12:34.712117 <... geteuid resumed> ) = 0
[pid 25447] 10:12:34.712131 <... open resumed> ) = 10
[pid 25446] 10:12:34.712146 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25445] 10:12:34.712175 mprotect(0x7fb6265df000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.712264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25448] 10:12:34.712309 getegid( <unfinished ...>
[pid 25447] 10:12:34.712332 fstat(10,  <unfinished ...>
[pid 25446] 10:12:34.712354 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25445] 10:12:34.712385 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.712400 <... execve resumed> ) = 0
[pid 25443] 10:12:34.712432 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25448] 10:12:34.712472 <... getegid resumed> ) = 12
[pid 25447] 10:12:34.712601 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25446] 10:12:34.712644 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25445] 10:12:34.712688 mmap(0x7fb6267de000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25444] 10:12:34.712752 brk(0 <unfinished ...>
[pid 25443] 10:12:34.712777 <... mmap resumed> ) = 0x7fdec435d000
[pid 25448] 10:12:34.712803 setgid(500 <unfinished ...>
[pid 25447] 10:12:34.712826 fstat(10,  <unfinished ...>
[pid 25446] 10:12:34.712848 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.712880 <... mmap resumed> ) = 0x7fb6267de000
[pid 25444] 10:12:34.712905 <... brk resumed> ) = 0x1d7b000
[pid 25443] 10:12:34.712925 mprotect(0x7fdec43e8000, 2097152, PROT_NONE <unfinished ...>
[pid 25448] 10:12:34.712963 <... setgid resumed> ) = 0
[pid 25447] 10:12:34.712977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25446] 10:12:34.713005 <... open resumed> ) = 13
[pid 25445] 10:12:34.713022 close(6 <unfinished ...>
[pid 25444] 10:12:34.713048 fcntl(0, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.713077 <... mprotect resumed> ) = 0
[pid 25448] 10:12:34.713103 setuid(503 <unfinished ...>
[pid 25447] 10:12:34.713126 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25446] 10:12:34.713153 fstat(13,  <unfinished ...>
[pid 25445] 10:12:34.713175 <... close resumed> ) = 0
[pid 25444] 10:12:34.713198 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.713215 mmap(0x7fdec45e8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25448] 10:12:34.713254 <... setuid resumed> ) = 0
[pid 25447] 10:12:34.713268 <... mmap resumed> ) = 0x7f81692a0000
[pid 25446] 10:12:34.713315 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25445] 10:12:34.713348 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.713386 fcntl(1, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.713409 <... mmap resumed> ) = 0x7fdec45e8000
[pid 25448] 10:12:34.713439 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25447] 10:12:34.713470 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25446] 10:12:34.713572 fstat(13,  <unfinished ...>
[pid 25445] 10:12:34.713601 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.713620 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.713641 mmap(0x7fdec45eb000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25448] 10:12:34.713681 <... open resumed> ) = 9
[pid 25447] 10:12:34.713694 <... lseek resumed> ) = 0
[pid 25446] 10:12:34.713715 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25445] 10:12:34.713751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.713788 fcntl(2, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.713810 <... mmap resumed> ) = 0x7fdec45eb000
[pid 25448] 10:12:34.713841 fstat(9,  <unfinished ...>
[pid 25447] 10:12:34.713865 read(10,  <unfinished ...>
[pid 25446] 10:12:34.713892 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.713917 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.713934 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.713957 close(6 <unfinished ...>
[pid 25448] 10:12:34.713990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25447] 10:12:34.714016 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25446] 10:12:34.714071 <... mmap resumed> ) = 0x7f380d423000
[pid 25445] 10:12:34.714134 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.714171 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25443] 10:12:34.714200 <... close resumed> ) = 0
[pid 25448] 10:12:34.714234 brk(0x9ff000 <unfinished ...>
[pid 25447] 10:12:34.714259 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25446] 10:12:34.714286 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.714309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.714330 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.714366 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25448] 10:12:34.714407 <... brk resumed> ) = 0x9ff000
[pid 25447] 10:12:34.714421 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25446] 10:12:34.714620 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.714685 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.714746 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.714786 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25448] 10:12:34.714826 fstat(9,  <unfinished ...>
[pid 25447] 10:12:34.714851 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25446] 10:12:34.714880 read(13,  <unfinished ...>
[pid 25445] 10:12:34.714906 <... open resumed> ) = 6
[pid 25444] 10:12:34.714923 <... mmap resumed> ) = 0x7fd066799000
[pid 25443] 10:12:34.714946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25448] 10:12:34.714988 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25447] 10:12:34.715015 <... open resumed> ) = 13
[pid 25446] 10:12:34.715032 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25445] 10:12:34.715053 read(6,  <unfinished ...>
[pid 25444] 10:12:34.715085 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25443] 10:12:34.715114 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25448] 10:12:34.715140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25447] 10:12:34.715167 fstat(13,  <unfinished ...>
[pid 25446] 10:12:34.715189 read(13,  <unfinished ...>
[pid 25445] 10:12:34.715211 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.715234 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.715257 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25448] 10:12:34.715296 <... mmap resumed> ) = 0x7fea0f284000
[pid 25447] 10:12:34.715309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25446] 10:12:34.715338 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.715396 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.715423 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.715452 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25448] 10:12:34.715557 read(9,  <unfinished ...>
[pid 25447] 10:12:34.715604 fstat(13,  <unfinished ...>
[pid 25446] 10:12:34.715635 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25445] 10:12:34.715673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25444] 10:12:34.715703 <... open resumed> ) = 5
[pid 25443] 10:12:34.715720 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25448] 10:12:34.715762 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25447] 10:12:34.715785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25446] 10:12:34.715819 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25445] 10:12:34.715841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.715868 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.715890 <... open resumed> ) = 6
[pid 25448] 10:12:34.715915 read(9,  <unfinished ...>
[pid 25447] 10:12:34.715941 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25446] 10:12:34.715966 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25445] 10:12:34.715993 <... mmap resumed> ) = 0x7fb62705c000
[pid 25444] 10:12:34.716012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25443] 10:12:34.716041 read(6,  <unfinished ...>
[pid 25448] 10:12:34.716074 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25447] 10:12:34.716091 <... mmap resumed> ) = 0x7f816929f000
[pid 25446] 10:12:34.716109 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25445] 10:12:34.716130 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.716158 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.716182 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25448] 10:12:34.716214 close(9 <unfinished ...>
[pid 25447] 10:12:34.716238 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25446] 10:12:34.716260 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25445] 10:12:34.716286 <... mmap resumed> ) = 0x7fb62634e000
[pid 25444] 10:12:34.716302 <... mmap resumed> ) = 0x7fd06678f000
[pid 25443] 10:12:34.716318 fstat(6,  <unfinished ...>
[pid 25448] 10:12:34.716352 <... close resumed> ) = 0
[pid 25447] 10:12:34.716365 <... lseek resumed> ) = 0
[pid 25446] 10:12:34.716380 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f380c2db790}, 8) = 0
[pid 25445] 10:12:34.716404 mprotect(0x7fb62635a000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.716438 close(5 <unfinished ...>
[pid 25443] 10:12:34.716461 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25448] 10:12:34.716612 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25447] 10:12:34.716734 read(13,  <unfinished ...>
[pid 25446] 10:12:34.716763 close(11 <unfinished ...>
[pid 25445] 10:12:34.716786 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.716803 <... close resumed> ) = 0
[pid 25443] 10:12:34.716830 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25448] 10:12:34.716869 <... munmap resumed> ) = 0
[pid 25447] 10:12:34.716882 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25446] 10:12:34.717293 <... close resumed> ) = 0
[pid 25445] 10:12:34.717349 mmap(0x7fb62655a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25444] 10:12:34.717385 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.717419 <... mmap resumed> ) = 0x7fdec4157000
[pid 25448] 10:12:34.717445 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25447] 10:12:34.717469 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25446] 10:12:34.717568 fcntl(12, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.717594 <... mmap resumed> ) = 0x7fb62655a000
[pid 25444] 10:12:34.717624 <... open resumed> ) = 5
[pid 25443] 10:12:34.717649 mprotect(0x7fdec415d000, 2093056, PROT_NONE <unfinished ...>
[pid 25448] 10:12:34.717694 <... lseek resumed> ) = 19
[pid 25447] 10:12:34.717711 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25446] 10:12:34.717733 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.717752 close(6 <unfinished ...>
[pid 25444] 10:12:34.717775 read(5,  <unfinished ...>
[pid 25443] 10:12:34.717798 <... mprotect resumed> ) = 0
[pid 25448] 10:12:34.717823 read(6,  <unfinished ...>
[pid 25447] 10:12:34.717846 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25446] 10:12:34.717872 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.717895 <... close resumed> ) = 0
[pid 25444] 10:12:34.717919 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.717946 mmap(0x7fdec435c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25448] 10:12:34.717985 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2413) = 1858
[pid 25447] 10:12:34.718003 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25446] 10:12:34.718465 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.718575 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.718627 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.718654 <... mmap resumed> ) = 0x7fdec435c000
[pid 25448] 10:12:34.718686 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25447] 10:12:34.718739 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0},  <unfinished ...>
[pid 25446] 10:12:34.718768 geteuid( <unfinished ...>
[pid 25445] 10:12:34.718791 <... open resumed> ) = 6
[pid 25444] 10:12:34.718807 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.718839 close(6 <unfinished ...>
[pid 25448] 10:12:34.718873 <... write resumed> ) = 4
[pid 25447] 10:12:34.718886 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f8168157790}, 8) = 0
[pid 25446] 10:12:34.718905 <... geteuid resumed> ) = 0
[pid 25445] 10:12:34.718926 read(6,  <unfinished ...>
[pid 25444] 10:12:34.718952 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.718980 <... close resumed> ) = 0
[pid 25433] 10:12:34.719004 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25448] 10:12:34.719036 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25447] 10:12:34.719060 close(11 <unfinished ...>
[pid 25446] 10:12:34.719082 getegid( <unfinished ...>
[pid 25445] 10:12:34.719104 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.719127 <... mmap resumed> ) = 0x7fd0661e7000
[pid 25443] 10:12:34.719143 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.719174 read(13,  <unfinished ...>
[pid 25448] 10:12:34.719207 <... write resumed> ) = 4
[pid 25447] 10:12:34.719220 <... close resumed> ) = 0
[pid 25446] 10:12:34.719235 <... getegid resumed> ) = 12
[pid 25445] 10:12:34.719256 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.719279 mprotect(0x7fd066371000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.719307 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.719325 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25448] 10:12:34.719353 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25447] 10:12:34.719378 fcntl(12, F_GETFD <unfinished ...>
[pid 25446] 10:12:34.719400 setgid(500 <unfinished ...>
[pid 25445] 10:12:34.719424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25444] 10:12:34.719454 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.719472 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.719593 read(13,  <unfinished ...>
[pid 25448] 10:12:34.719635 <... write resumed> ) = 4
[pid 25447] 10:12:34.719650 <... fcntl resumed> ) = 0
[pid 25446] 10:12:34.719666 <... setgid resumed> ) = 0
[pid 25445] 10:12:34.719685 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.719713 mmap(0x7fd066571000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25443] 10:12:34.719743 <... open resumed> ) = 6
[pid 25433] 10:12:34.719759 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25448] 10:12:34.719792 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25447] 10:12:34.719819 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25446] 10:12:34.719848 setuid(503 <unfinished ...>
[pid 25445] 10:12:34.719872 <... mmap resumed> ) = 0x7fb62612b000
[pid 25444] 10:12:34.719888 <... mmap resumed> ) = 0x7fd066571000
[pid 25443] 10:12:34.719909 read(6,  <unfinished ...>
[pid 25433] 10:12:34.719933 read(13,  <unfinished ...>
[pid 25448] 10:12:34.719969 <... write resumed> ) = 40
[pid 25447] 10:12:34.719983 <... fcntl resumed> ) = 0
[pid 25446] 10:12:34.719998 <... setuid resumed> ) = 0
[pid 25445] 10:12:34.720032 mprotect(0x7fb62614c000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.720062 mmap(0x7fd066576000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.720091 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.720115 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25448] 10:12:34.720144 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25447] 10:12:34.720168 geteuid( <unfinished ...>
[pid 25446] 10:12:34.720189 chdir("/" <unfinished ...>
[pid 25445] 10:12:34.720214 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.720230 <... mmap resumed> ) = 0x7fd066576000
[pid 25443] 10:12:34.720251 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.720276 read(13,  <unfinished ...>
[pid 25448] 10:12:34.720309 <... write resumed> ) = 4
[pid 25447] 10:12:34.720322 <... geteuid resumed> ) = 0
[pid 25446] 10:12:34.720338 <... chdir resumed> ) = 0
[pid 25445] 10:12:34.720369 mmap(0x7fb62634c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25444] 10:12:34.720399 close(5 <unfinished ...>
[pid 25443] 10:12:34.720422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:34.720451 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25448] 10:12:34.720553 close(14 <unfinished ...>
[pid 25447] 10:12:34.720583 getegid( <unfinished ...>
[pid 25446] 10:12:34.720606 geteuid( <unfinished ...>
[pid 25445] 10:12:34.720628 <... mmap resumed> ) = 0x7fb62634c000
[pid 25444] 10:12:34.720649 <... close resumed> ) = 0
[pid 25443] 10:12:34.720681 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.720709 wait4(-1,  <unfinished ...>
[pid 25448] 10:12:34.720741 <... close resumed> ) = 0
[pid 25447] 10:12:34.720755 <... getegid resumed> ) = 12
[pid 25446] 10:12:34.720783 <... geteuid resumed> ) = 503
[pid 25445] 10:12:34.720804 close(6 <unfinished ...>
[pid 25444] 10:12:34.720826 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.720852 <... mmap resumed> ) = 0x7fdec5aac000
[pid 25448] 10:12:34.720880 exit_group(0) = ?
[pid 25447] 10:12:34.720895 setgid(500 <unfinished ...>
[pid 25446] 10:12:34.721189 getegid( <unfinished ...>
[pid 25445] 10:12:34.721212 <... close resumed> ) = 0
[pid 25444] 10:12:34.721236 <... mmap resumed> ) = 0x7fd06678e000
[pid 25443] 10:12:34.721258 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25448] 10:12:34.721316 +++ exited with 0 +++
[pid 25447] 10:12:34.721339 <... setgid resumed> ) = 0
[pid 25446] 10:12:34.721354 <... getegid resumed> ) = 500
[pid 25445] 10:12:34.721404 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.721446 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.721473 <... mmap resumed> ) = 0x7fdec3e21000
[pid 25433] 10:12:34.721565 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25448
[pid 25447] 10:12:34.721596 setuid(503 <unfinished ...>
[pid 25446] 10:12:34.721620 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25445] 10:12:34.721653 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.721670 <... mmap resumed> ) = 0x7fd06678d000
[pid 25443] 10:12:34.721689 mprotect(0x7fdec3f4d000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.721718 close(13 <unfinished ...>
[pid 25447] 10:12:34.721754 <... setuid resumed> ) = 0
[pid 25446] 10:12:34.721767 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25445] 10:12:34.721799 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.721832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.721858 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.721874 <... close resumed> ) = 0
[pid 25447] 10:12:34.721900 chdir("/" <unfinished ...>
[pid 25446] 10:12:34.721924 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25445] 10:12:34.721950 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.721967 <... mmap resumed> ) = 0x7fd06678c000
[pid 25443] 10:12:34.721985 mmap(0x7fdec414d000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25433] 10:12:34.722016 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25447] 10:12:34.722053 <... chdir resumed> ) = 0
[pid 25446] 10:12:34.722066 <... chdir resumed> ) = 0
[pid 25445] 10:12:34.722095 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.722126 arch_prctl(ARCH_SET_FS, 0x7fd06678d700 <unfinished ...>
[pid 25443] 10:12:34.722150 <... mmap resumed> ) = 0x7fdec414d000
[pid 25433] 10:12:34.722171 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25447] 10:12:34.722224 geteuid( <unfinished ...>
[pid 25446] 10:12:34.722250 stat("tmp",  <unfinished ...>
[pid 25445] 10:12:34.722277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.722297 <... arch_prctl resumed> ) = 0
[pid 25443] 10:12:34.722385 mmap(0x7fdec4156000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.722419 stat("/etc/userdomains",  <unfinished ...>
[pid 25447] 10:12:34.722456 <... geteuid resumed> ) = 503
[pid 25446] 10:12:34.722469 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.722582 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.722616 mprotect(0x7fd066571000, 16384, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.722642 <... mmap resumed> ) = 0x7fdec4156000
[pid 25433] 10:12:34.722664 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.722719 getegid( <unfinished ...>
[pid 25446] 10:12:34.722744 stat("new",  <unfinished ...>
[pid 25445] 10:12:34.722770 <... open resumed> ) = 6
[pid 25444] 10:12:34.722791 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.722813 close(6 <unfinished ...>
[pid 25433] 10:12:34.722837 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25447] 10:12:34.722874 <... getegid resumed> ) = 500
[pid 25446] 10:12:34.722887 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.722938 read(6,  <unfinished ...>
[pid 25444] 10:12:34.722964 mprotect(0x7fd06679a000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.722991 <... close resumed> ) = 0
[pid 25433] 10:12:34.723014 <... open resumed> ) = 9
[pid 25447] 10:12:34.723041 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25446] 10:12:34.723070 stat("cur",  <unfinished ...>
[pid 25445] 10:12:34.723095 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.723118 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.723136 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.723167 fstat(9,  <unfinished ...>
[pid 25447] 10:12:34.723199 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25446] 10:12:34.723226 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25445] 10:12:34.723328 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.723358 munmap(0x7fd06678f000, 39387 <unfinished ...>
[pid 25443] 10:12:34.723397 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.723421 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.723467 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25446] 10:12:34.723580 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.723615 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.723646 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.723692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.723728 fstat(9,  <unfinished ...>
[pid 25447] 10:12:34.723760 <... chdir resumed> ) = 0
[pid 25446] 10:12:34.723773 <... open resumed> ) = 11
[pid 25445] 10:12:34.723793 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.723822 getuid( <unfinished ...>
[pid 25443] 10:12:34.723845 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.723862 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.723905 stat("tmp",  <unfinished ...>
[pid 25446] 10:12:34.723932 read(11,  <unfinished ...>
[pid 25445] 10:12:34.723957 <... mmap resumed> ) = 0x7fb625f0e000
[pid 25444] 10:12:34.723974 <... getuid resumed> ) = 503
[pid 25443] 10:12:34.723991 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.724021 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25447] 10:12:34.724056 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25446] 10:12:34.724082 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2922
[pid 25445] 10:12:34.724166 mprotect(0x7fb625f25000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.724197 getgid( <unfinished ...>
[pid 25443] 10:12:34.724219 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.724238 <... mmap resumed> ) = 0x7fea0f284000
[pid 25447] 10:12:34.724265 stat("new",  <unfinished ...>
[pid 25446] 10:12:34.724291 stat("tmp/1451491954.H724158P25446.fin.finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.724325 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.724342 <... getgid resumed> ) = 500
[pid 25443] 10:12:34.724361 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.724393 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25447] 10:12:34.724426 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25446] 10:12:34.724452 <... stat resumed> 0x7fffbdaacdc0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.724473 mmap(0x7fb626125000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25444] 10:12:34.724593 getegid( <unfinished ...>
[pid 25443] 10:12:34.724623 <... open resumed> ) = 6
[pid 25433] 10:12:34.724641 <... lseek resumed> ) = 0
[pid 25447] 10:12:34.724667 stat("cur",  <unfinished ...>
[pid 25446] 10:12:34.724694 open("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25445] 10:12:34.724754 <... mmap resumed> ) = 0x7fb626125000
[pid 25444] 10:12:34.724776 <... getegid resumed> ) = 499
[pid 25443] 10:12:34.724795 read(6,  <unfinished ...>
[pid 25433] 10:12:34.724819 read(9,  <unfinished ...>
[pid 25447] 10:12:34.724855 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25446] 10:12:34.724882 <... open resumed> ) = 14
[pid 25445] 10:12:34.724962 mmap(0x7fb626127000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.724996 getppid( <unfinished ...>
[pid 25443] 10:12:34.725020 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.725050 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25447] 10:12:34.725101 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25446] 10:12:34.725136 chown("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25445] 10:12:34.725169 <... mmap resumed> ) = 0x7fb626127000
[pid 25444] 10:12:34.725191 <... getppid resumed> ) = 25389
[pid 25443] 10:12:34.725212 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.725237 stat("/etc/userdomains",  <unfinished ...>
[pid 25447] 10:12:34.725272 <... open resumed> ) = 11
[pid 25446] 10:12:34.725285 <... chown resumed> ) = 0
[pid 25445] 10:12:34.725308 close(6 <unfinished ...>
[pid 25444] 10:12:34.725331 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25443] 10:12:34.725364 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.725395 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.725442 read(11,  <unfinished ...>
[pid 25446] 10:12:34.725468 chmod("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25445] 10:12:34.725583 <... close resumed> ) = 0
[pid 25444] 10:12:34.725609 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25443] 10:12:34.725681 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.725713 stat("/etc/userdomains",  <unfinished ...>
[pid 25447] 10:12:34.725748 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4088
[pid 25446] 10:12:34.725767 <... chmod resumed> ) = 0
[pid 25445] 10:12:34.725856 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.725944 brk(0 <unfinished ...>
[pid 25443] 10:12:34.725969 <... mmap resumed> ) = 0x7fdec3c1d000
[pid 25433] 10:12:34.725985 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.726058 stat("tmp/1451491954.H725844P25447.fin.finestweddingsites.com",  <unfinished ...>
[pid 25446] 10:12:34.726095 chown("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25445] 10:12:34.726126 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.726144 <... brk resumed> ) = 0x1d7b000
[pid 25443] 10:12:34.726161 mprotect(0x7fdec3c1f000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.726188 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25447] 10:12:34.726228 <... stat resumed> 0x7ffdf4a543e0) = -1 ENOENT (No such file or directory)
[pid 25446] 10:12:34.726249 <... chown resumed> ) = 0
[pid 25445] 10:12:34.726269 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.726303 brk(0x1d9c000 <unfinished ...>
[pid 25443] 10:12:34.726329 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.726350 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25447] 10:12:34.726381 open("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25446] 10:12:34.726433 chmod("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25445] 10:12:34.726465 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.726547 <... brk resumed> ) = 0x1d9c000
[pid 25443] 10:12:34.726584 mmap(0x7fdec3e1f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25433] 10:12:34.726617 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25447] 10:12:34.726656 <... open resumed> ) = 14
[pid 25446] 10:12:34.726669 <... chmod resumed> ) = 0
[pid 25445] 10:12:34.726725 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.726759 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.726789 <... mmap resumed> ) = 0x7fdec3e1f000
[pid 25433] 10:12:34.726814 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25447] 10:12:34.726866 chown("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25446] 10:12:34.726898 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.726924 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.726943 <... socket resumed> ) = 5
[pid 25443] 10:12:34.726960 close(6 <unfinished ...>
[pid 25433] 10:12:34.726982 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25447] 10:12:34.727019 <... chown resumed> ) = 0
[pid 25446] 10:12:34.727033 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.727099 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.727132 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.727171 <... close resumed> ) = 0
[pid 25433] 10:12:34.727195 <... open resumed> ) = 10
[pid 25447] 10:12:34.727223 chmod("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25446] 10:12:34.727253 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.727278 <... open resumed> ) = 6
[pid 25444] 10:12:34.727294 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.727312 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.727345 fstat(10,  <unfinished ...>
[pid 25447] 10:12:34.727377 <... chmod resumed> ) = 0
[pid 25446] 10:12:34.727390 <... lseek resumed> ) = 19
[pid 25445] 10:12:34.727408 read(6,  <unfinished ...>
[pid 25444] 10:12:34.727432 close(5 <unfinished ...>
[pid 25443] 10:12:34.727457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.727546 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25447] 10:12:34.727596 chown("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25446] 10:12:34.727626 read(6,  <unfinished ...>
[pid 25445] 10:12:34.727663 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.727688 <... close resumed> ) = 0
[pid 25443] 10:12:34.727712 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.727755 fstat(10,  <unfinished ...>
[pid 25447] 10:12:34.727788 <... chown resumed> ) = 0
[pid 25446] 10:12:34.727802 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25445] 10:12:34.727833 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.727856 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.727883 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.727901 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25447] 10:12:34.727938 chmod("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25446] 10:12:34.727967 read(6,  <unfinished ...>
[pid 25445] 10:12:34.727990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.728018 <... socket resumed> ) = 5
[pid 25443] 10:12:34.728034 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.728064 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25447] 10:12:34.728100 <... chmod resumed> ) = 0
[pid 25446] 10:12:34.728113 <... read resumed> "", 8192) = 0
[pid 25445] 10:12:34.728164 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.728193 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.728227 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.728245 <... mmap resumed> ) = 0x7fea0f283000
[pid 25447] 10:12:34.728272 stat("/etc/localtime",  <unfinished ...>
[pid 25446] 10:12:34.728297 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2518 <unfinished ...>
[pid 25445] 10:12:34.728334 <... mmap resumed> ) = 0x7fb62705b000
[pid 25444] 10:12:34.728356 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.728373 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.728406 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25447] 10:12:34.728438 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25446] 10:12:34.728464 <... write resumed> ) = 2518
[pid 25445] 10:12:34.728625 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.728661 close(5 <unfinished ...>
[pid 25443] 10:12:34.728688 <... open resumed> ) = 6
[pid 25433] 10:12:34.728704 <... lseek resumed> ) = 0
[pid 25447] 10:12:34.728730 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25446] 10:12:34.728754 fsync(14 <unfinished ...>
[pid 25445] 10:12:34.728828 <... mmap resumed> ) = 0x7fb625b9a000
[pid 25444] 10:12:34.728846 <... close resumed> ) = 0
[pid 25443] 10:12:34.728874 read(6,  <unfinished ...>
[pid 25433] 10:12:34.728990 read(10,  <unfinished ...>
[pid 25447] 10:12:34.729026 <... lseek resumed> ) = 19
[pid 25445] 10:12:34.729039 mprotect(0x7fb625d09000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.729070 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.729100 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.729124 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25447] 10:12:34.729186 read(6,  <unfinished ...>
[pid 25446] 10:12:34.729219 <... fsync resumed> ) = 0
[pid 25445] 10:12:34.729239 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.729256 <... open resumed> ) = 5
[pid 25443] 10:12:34.729279 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.729303 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25447] 10:12:34.729352 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25446] 10:12:34.729376 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25445] 10:12:34.729412 mmap(0x7fb625f08000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25444] 10:12:34.729443 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.729470 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.729581 <... open resumed> ) = 11
[pid 25447] 10:12:34.729611 read(6,  <unfinished ...>
[pid 25446] 10:12:34.729635 <... lseek resumed> ) = 2922
[pid 25445] 10:12:34.729652 <... mmap resumed> ) = 0x7fb625f08000
[pid 25444] 10:12:34.729677 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25443] 10:12:34.729709 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.729740 fstat(11,  <unfinished ...>
[pid 25447] 10:12:34.729772 <... read resumed> "", 8192) = 0
[pid 25446] 10:12:34.729789 write(11, "2518 1\n", 7 <unfinished ...>
[pid 25445] 10:12:34.729820 close(6 <unfinished ...>
[pid 25444] 10:12:34.729843 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.729869 <... mmap resumed> ) = 0x7fdec3a1a000
[pid 25433] 10:12:34.729891 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25447] 10:12:34.729928 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2568 <unfinished ...>
[pid 25446] 10:12:34.729963 <... write resumed> ) = 7
[pid 25445] 10:12:34.729979 <... close resumed> ) = 0
[pid 25444] 10:12:34.730003 <... mmap resumed> ) = 0x7fd066798000
[pid 25443] 10:12:34.730021 mprotect(0x7fdec3a1c000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.730049 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25447] 10:12:34.730084 <... write resumed> ) = 2568
[pid 25446] 10:12:34.730101 close(11 <unfinished ...>
[pid 25445] 10:12:34.730126 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.730156 read(5,  <unfinished ...>
[pid 25443] 10:12:34.730183 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.730199 <... mmap resumed> ) = 0x7fea0f282000
[pid 25447] 10:12:34.730225 fsync(14 <unfinished ...>
[pid 25446] 10:12:34.730273 <... close resumed> ) = 0
[pid 25445] 10:12:34.730294 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.730312 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25443] 10:12:34.730386 mmap(0x7fdec3c1b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25433] 10:12:34.730420 read(11,  <unfinished ...>
[pid 25446] 10:12:34.730456 fstat(14,  <unfinished ...>
[pid 25445] 10:12:34.730569 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.730604 read(5,  <unfinished ...>
[pid 25443] 10:12:34.730627 <... mmap resumed> ) = 0x7fdec3c1b000
[pid 25433] 10:12:34.730653 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25447] 10:12:34.730696 <... fsync resumed> ) = 0
[pid 25446] 10:12:34.730716 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016466, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2518, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.730746 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.730764 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:34.730784 close(6 <unfinished ...>
[pid 25433] 10:12:34.730808 close(11 <unfinished ...>
[pid 25447] 10:12:34.730841 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25446] 10:12:34.730864 close(14 <unfinished ...>
[pid 25445] 10:12:34.730888 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.730918 close(5 <unfinished ...>
[pid 25443] 10:12:34.730942 <... close resumed> ) = 0
[pid 25433] 10:12:34.730965 <... close resumed> ) = 0
[pid 25447] 10:12:34.730991 <... lseek resumed> ) = 4088
[pid 25446] 10:12:34.731007 <... close resumed> ) = 0
[pid 25445] 10:12:34.731035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.731055 <... close resumed> ) = 0
[pid 25443] 10:12:34.731071 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.731108 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25447] 10:12:34.731145 write(11, "2568 1\n", 7 <unfinished ...>
[pid 25446] 10:12:34.731177 rename("tmp/1451491954.H724158P25446.fin.finestweddingsites.com", "new/1451491954.H724158P25446.fin.finestweddingsites.com,S=2518" <unfinished ...>
[pid 25445] 10:12:34.731231 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.731266 munmap(0x7fd066798000, 4096 <unfinished ...>
[pid 25443] 10:12:34.731292 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.731309 <... munmap resumed> ) = 0
[pid 25447] 10:12:34.731375 <... write resumed> ) = 7
[pid 25446] 10:12:34.731398 <... rename resumed> ) = 0
[pid 25445] 10:12:34.731417 <... open resumed> ) = 6
[pid 25444] 10:12:34.731433 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.731460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.731571 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25447] 10:12:34.731613 close(11 <unfinished ...>
[pid 25446] 10:12:34.731638 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.731673 read(6,  <unfinished ...>
[pid 25444] 10:12:34.731697 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.731725 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.731742 <... open resumed> ) = 11
[pid 25447] 10:12:34.731770 <... close resumed> ) = 0
[pid 25446] 10:12:34.731788 <... write resumed> ) = 4
[pid 25445] 10:12:34.731804 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.731828 <... open resumed> ) = 5
[pid 25443] 10:12:34.731843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.731874 fstat(11,  <unfinished ...>
[pid 25425] 10:12:34.731897 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.731928 fstat(14,  <unfinished ...>
[pid 25446] 10:12:34.731953 write(12, "\326\t\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.731978 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.732000 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.732022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.732041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.732073 read(11,  <unfinished ...>
[pid 25447] 10:12:34.732110 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179004, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2568, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25446] 10:12:34.732138 <... write resumed> ) = 4
[pid 25445] 10:12:34.732154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25444] 10:12:34.732182 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25443] 10:12:34.732215 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.732247 fstat(11,  <unfinished ...>
[pid 25425] 10:12:34.732270 <... read resumed> "\326\t\0\0", 4) = 4
[pid 25447] 10:12:34.732297 close(14 <unfinished ...>
[pid 25446] 10:12:34.732322 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25445] 10:12:34.732349 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.732376 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.732402 <... open resumed> ) = 6
[pid 25433] 10:12:34.732418 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.732445 read(11,  <unfinished ...>
[pid 25447] 10:12:34.732555 <... close resumed> ) = 0
[pid 25446] 10:12:34.732588 <... write resumed> ) = 4
[pid 25445] 10:12:34.732606 <... mmap resumed> ) = 0x7fb62590b000
[pid 25444] 10:12:34.732623 <... mmap resumed> ) = 0x7fd06678f000
[pid 25443] 10:12:34.732639 read(6,  <unfinished ...>
[pid 25433] 10:12:34.732663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.732689 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25447] 10:12:34.732717 rename("tmp/1451491954.H725844P25447.fin.finestweddingsites.com", "new/1451491954.H725844P25447.fin.finestweddingsites.com,S=2568" <unfinished ...>
[pid 25446] 10:12:34.732768 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.732794 mprotect(0x7fb625996000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.732822 close(5 <unfinished ...>
[pid 25443] 10:12:34.732844 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.732868 <... mmap resumed> ) = 0x7fea0f282000
[pid 25425] 10:12:34.732885 read(11,  <unfinished ...>
[pid 25447] 10:12:34.732918 <... rename resumed> ) = 0
[pid 25446] 10:12:34.732936 <... write resumed> ) = 4
[pid 25445] 10:12:34.732952 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.732967 <... close resumed> ) = 0
[pid 25443] 10:12:34.732994 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.733018 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.733040 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.733068 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.733100 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.733124 mmap(0x7fb625b96000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25444] 10:12:34.733154 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.733186 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.733216 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.733233 read(11,  <unfinished ...>
[pid 25447] 10:12:34.733268 <... write resumed> ) = 4
[pid 25446] 10:12:34.733284 <... write resumed> ) = 4
[pid 25445] 10:12:34.733300 <... mmap resumed> ) = 0x7fb625b96000
[pid 25444] 10:12:34.733320 <... open resumed> ) = 5
[pid 25443] 10:12:34.733336 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.733364 read(11,  <unfinished ...>
[pid 25425] 10:12:34.733396 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.733414 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.733448 write(12, "\10\n\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.733553 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.733586 mmap(0x7fb625b99000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.733616 read(5,  <unfinished ...>
[pid 25443] 10:12:34.733641 <... mmap resumed> ) = 0x7fdec5aab000
[pid 25433] 10:12:34.733663 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:34.733700 read(11,  <unfinished ...>
[pid 25411] 10:12:34.733733 read(11,  <unfinished ...>
[pid 25447] 10:12:34.733778 <... write resumed> ) = 4
[pid 25446] 10:12:34.733795 <... write resumed> ) = 4
[pid 25445] 10:12:34.733811 <... mmap resumed> ) = 0x7fb625b99000
[pid 25444] 10:12:34.733832 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.733857 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.733886 stat("/jail_owner",  <unfinished ...>
[pid 25425] 10:12:34.733912 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.733930 <... read resumed> "\10\n\0\0", 4) = 4
[pid 25447] 10:12:34.733958 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.733983 write(12, "\260\0239\2\0\0\0\0", 8 <unfinished ...>
[pid 25445] 10:12:34.734007 close(6 <unfinished ...>
[pid 25444] 10:12:34.734029 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.734052 <... mmap resumed> ) = 0x7fdec3686000
[pid 25433] 10:12:34.734068 <... stat resumed> 0x7ffc72718770) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.734091 read(11,  <unfinished ...>
[pid 25411] 10:12:34.734115 read(11,  <unfinished ...>
[pid 25447] 10:12:34.734149 <... write resumed> ) = 4
[pid 25446] 10:12:34.734165 <... write resumed> ) = 8
[pid 25445] 10:12:34.734181 <... close resumed> ) = 0
[pid 25444] 10:12:34.734203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.734241 mprotect(0x7fdec3810000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.734269 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:34.734300 <... read resumed> "\260\0239\2\0\0\0\0", 8) = 8
[pid 25411] 10:12:34.734317 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25447] 10:12:34.734347 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.734373 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.734397 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.734426 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25443] 10:12:34.734454 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.734470 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.734595 read(11,  <unfinished ...>
[pid 25411] 10:12:34.734621 read(11,  <unfinished ...>
[pid 25447] 10:12:34.734656 <... write resumed> ) = 4
[pid 25446] 10:12:34.734672 <... write resumed> ) = 4
[pid 25445] 10:12:34.734688 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.734705 <... mmap resumed> ) = 0x7fd065fd9000
[pid 25443] 10:12:34.734722 mmap(0x7fdec3a10000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25433] 10:12:34.734753 stat("/usr/local/cpanel/3rdparty/mailman/lists/hillcrestgolfclub_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25425] 10:12:34.734786 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.734804 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.734834 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.734859 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25445] 10:12:34.734882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.734913 mprotect(0x7fd065fe5000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.734941 <... mmap resumed> ) = 0x7fdec3a10000
[pid 25433] 10:12:34.734963 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.734988 read(11,  <unfinished ...>
[pid 25411] 10:12:34.735013 read(11,  <unfinished ...>
[pid 25447] 10:12:34.735047 <... write resumed> ) = 4
[pid 25446] 10:12:34.735063 <... write resumed> ) = 4
[pid 25445] 10:12:34.735078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.735095 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.735111 mmap(0x7fdec3a15000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.735139 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:34.735167 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25411] 10:12:34.735185 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.735213 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.735238 close(12 <unfinished ...>
[pid 25445] 10:12:34.735261 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.735290 mmap(0x7fd0661e5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25443] 10:12:34.735317 <... mmap resumed> ) = 0x7fdec3a15000
[pid 25433] 10:12:34.735339 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.735385 close(11 <unfinished ...>
[pid 25411] 10:12:34.735416 read(11,  <unfinished ...>
[pid 25447] 10:12:34.735452 <... write resumed> ) = 4
[pid 25446] 10:12:34.735468 <... close resumed> ) = 0
[pid 25445] 10:12:34.735599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.735625 <... mmap resumed> ) = 0x7fd0661e5000
[pid 25443] 10:12:34.735651 close(6 <unfinished ...>
[pid 25433] 10:12:34.735677 stat("/usr/local/cpanel/3rdparty/mailman/lists/hillcrestgolfclub/config.pck",  <unfinished ...>
[pid 25425] 10:12:34.735708 <... close resumed> ) = 0
[pid 25411] 10:12:34.735734 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.735765 write(12, "\260\3\235\1\0\0\0\0", 8 <unfinished ...>
[pid 25446] 10:12:34.735791 close(10 <unfinished ...>
[pid 25445] 10:12:34.735815 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.735847 close(5 <unfinished ...>
[pid 25443] 10:12:34.735869 <... close resumed> ) = 0
[pid 25433] 10:12:34.735894 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.735917 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25411] 10:12:34.735954 read(11,  <unfinished ...>
[pid 25447] 10:12:34.735994 <... write resumed> ) = 8
[pid 25446] 10:12:34.736010 <... close resumed> ) = 0
[pid 25445] 10:12:34.736026 <... open resumed> ) = 6
[pid 25444] 10:12:34.736042 <... close resumed> ) = 0
[pid 25443] 10:12:34.736071 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.736104 stat("/etc/demouids",  <unfinished ...>
[pid 25425] 10:12:34.736130 <... write resumed> ) = 55
[pid 25411] 10:12:34.736153 <... read resumed> "\260\3\235\1\0\0\0\0", 8) = 8
[pid 25447] 10:12:34.736184 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.736209 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25445] 10:12:34.736238 read(6,  <unfinished ...>
[pid 25444] 10:12:34.736262 mprotect(0x7fd0661e5000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:34.736288 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.736307 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.736378 fsync(9 <unfinished ...>
[pid 25411] 10:12:34.736436 read(11,  <unfinished ...>
[pid 25447] 10:12:34.736560 <... write resumed> ) = 4
[pid 25446] 10:12:34.736574 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.736585 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.736599 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.736611 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.736630 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.736643 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.736691 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25446] 10:12:34.736720 close(13 <unfinished ...>
[pid 25445] 10:12:34.736745 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.736767 munmap(0x7fd06678f000, 39387 <unfinished ...>
[pid 25443] 10:12:34.736794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.736812 <... open resumed> ) = 12
[pid 25411] 10:12:34.736828 read(11,  <unfinished ...>
[pid 25447] 10:12:34.736863 <... write resumed> ) = 4
[pid 25446] 10:12:34.736878 <... close resumed> ) = 0
[pid 25445] 10:12:34.736894 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25444] 10:12:34.736924 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.736947 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.736978 fstat(12,  <unfinished ...>
[pid 25425] 10:12:34.737001 <... fsync resumed> ) = 0
[pid 25411] 10:12:34.737016 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25447] 10:12:34.737045 close(12 <unfinished ...>
[pid 25446] 10:12:34.737069 munmap(0x7f380d423000, 4096 <unfinished ...>
[pid 25445] 10:12:34.737096 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.737124 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.737153 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.737172 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.737209 wait4(-1,  <unfinished ...>
[pid 25411] 10:12:34.737233 close(11 <unfinished ...>
[pid 25447] 10:12:34.737269 <... close resumed> ) = 0
[pid 25446] 10:12:34.737287 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.737784 <... mmap resumed> ) = 0x7fb625705000
[pid 25444] 10:12:34.737811 <... open resumed> ) = 5
[pid 25443] 10:12:34.737832 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.737867 fstat(12,  <unfinished ...>
[pid 25411] 10:12:34.737890 <... close resumed> ) = 0
[pid 25447] 10:12:34.737927 close(10 <unfinished ...>
[pid 25446] 10:12:34.737954 exit_group(0) = ?
[pid 25445] 10:12:34.738273 mprotect(0x7fb62570b000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.738305 fcntl(5, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.738331 <... open resumed> ) = 6
[pid 25433] 10:12:34.738347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.738377 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25447] 10:12:34.738433 <... close resumed> ) = 0
[pid 25446] 10:12:34.738449 +++ exited with 0 +++
[pid 25445] 10:12:34.738461 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.738525 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25443] 10:12:34.738553 read(6,  <unfinished ...>
[pid 25433] 10:12:34.738579 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.738606 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25446
[pid 25411] 10:12:34.738697 <... write resumed> ) = 28
[pid 25447] 10:12:34.738728 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25445] 10:12:34.738757 mmap(0x7fb62590a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25444] 10:12:34.738785 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.738809 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.738833 <... mmap resumed> ) = 0x7fea0f281000
[pid 25425] 10:12:34.738850 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.738878 fsync(9 <unfinished ...>
[pid 25447] 10:12:34.738926 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.738951 <... mmap resumed> ) = 0x7fb62590a000
[pid 25444] 10:12:34.738980 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.739011 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.739022 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.739031 <... open resumed> ) = 10
[pid 25447] 10:12:34.739049 close(13 <unfinished ...>
[pid 25445] 10:12:34.739086 close(6 <unfinished ...>
[pid 25444] 10:12:34.739113 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.739139 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25433] 10:12:34.739175 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.739193 fstat(10,  <unfinished ...>
[pid 25447] 10:12:34.739226 <... close resumed> ) = 0
[pid 25445] 10:12:34.739242 <... close resumed> ) = 0
[pid 25444] 10:12:34.739264 <... mmap resumed> ) = 0x7fd066798000
[pid 25443] 10:12:34.739282 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.739310 read(12,  <unfinished ...>
[pid 25425] 10:12:34.739333 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25411] 10:12:34.739366 <... fsync resumed> ) = 0
[pid 25447] 10:12:34.739393 munmap(0x7f816929f000, 4096 <unfinished ...>
[pid 25445] 10:12:34.739421 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.739453 read(5,  <unfinished ...>
[pid 25443] 10:12:34.739597 <... mmap resumed> ) = 0x7fdec341a000
[pid 25433] 10:12:34.739623 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.739650 fstat(10,  <unfinished ...>
[pid 25411] 10:12:34.739675 wait4(-1,  <unfinished ...>
[pid 25447] 10:12:34.739706 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.740078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.740101 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.740141 mprotect(0x7fdec347c000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.740170 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25425] 10:12:34.740200 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25447] 10:12:34.740239 exit_group(0) = ?
[pid 25445] 10:12:34.740584 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.740628 close(5 <unfinished ...>
[pid 25443] 10:12:34.740654 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.740671 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.740804 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25447] 10:12:34.740858 +++ exited with 0 +++
[pid 25445] 10:12:34.740871 <... open resumed> ) = 6
[pid 25444] 10:12:34.740887 <... close resumed> ) = 0
[pid 25443] 10:12:34.740961 mmap(0x7fdec367b000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25433] 10:12:34.740997 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.741024 <... mmap resumed> ) = 0x7f380d424000
[pid 25411] 10:12:34.741041 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25447
[pid 25445] 10:12:34.741104 read(6,  <unfinished ...>
[pid 25444] 10:12:34.741132 munmap(0x7fd066798000, 4096 <unfinished ...>
[pid 25443] 10:12:34.741158 <... mmap resumed> ) = 0x7fdec367b000
[pid 25433] 10:12:34.741184 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.741234 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25411] 10:12:34.741261 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.741306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.741330 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.741355 close(6 <unfinished ...>
[pid 25433] 10:12:34.741381 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.741410 <... lseek resumed> ) = 0
[pid 25411] 10:12:34.741427 <... open resumed> ) = 10
[pid 25445] 10:12:34.741453 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.741560 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.741593 <... close resumed> ) = 0
[pid 25433] 10:12:34.741622 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.741661 read(10,  <unfinished ...>
[pid 25411] 10:12:34.741689 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.741721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.741750 <... socket resumed> ) = 5
[pid 25443] 10:12:34.741766 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.741797 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25425] 10:12:34.741824 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25411] 10:12:34.741870 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.741915 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.741945 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.741984 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.742003 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.742043 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25411] 10:12:34.742075 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.742107 <... mmap resumed> ) = 0x7fb62705a000
[pid 25444] 10:12:34.742127 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.742145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.742178 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.742207 <... stat resumed> 0x7fffbdaabb10) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.742235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.742281 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.742311 close(5 <unfinished ...>
[pid 25443] 10:12:34.742337 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.742354 <... open resumed> ) = 13
[pid 25425] 10:12:34.742371 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.742397 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.742433 <... mmap resumed> ) = 0x7fb6253cf000
[pid 25444] 10:12:34.742450 <... close resumed> ) = 0
[pid 25443] 10:12:34.742467 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.742582 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.742606 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.742652 <... mmap resumed> ) = 0x7f81692a0000
[pid 25445] 10:12:34.742680 mprotect(0x7fb6254fb000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.742709 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25443] 10:12:34.742735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.742756 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.742787 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25411] 10:12:34.742820 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.742852 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.742868 <... socket resumed> ) = 5
[pid 25443] 10:12:34.742884 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.742917 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.742940 <... write resumed> ) = 132
[pid 25411] 10:12:34.742965 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.742992 mmap(0x7fb6256fb000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25444] 10:12:34.743024 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25443] 10:12:34.743057 <... open resumed> ) = 6
[pid 25433] 10:12:34.743074 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.743101 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.743127 read(10,  <unfinished ...>
[pid 25445] 10:12:34.743163 <... mmap resumed> ) = 0x7fb6256fb000
[pid 25444] 10:12:34.743183 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.743202 read(6,  <unfinished ...>
[pid 25433] 10:12:34.743225 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.743250 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.743289 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25445] 10:12:34.743350 mmap(0x7fb625704000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.743383 close(5 <unfinished ...>
[pid 25443] 10:12:34.743410 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.743435 <... mmap resumed> ) = 0x7fea0f280000
[pid 25425] 10:12:34.743453 stat("/etc/localtime",  <unfinished ...>
[pid 25411] 10:12:34.743586 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.743631 <... mmap resumed> ) = 0x7fb625704000
[pid 25444] 10:12:34.743654 <... close resumed> ) = 0
[pid 25443] 10:12:34.743679 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.743703 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.743726 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:34.743758 <... stat resumed> 0x7ffdf4a53130) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.743795 close(6 <unfinished ...>
[pid 25444] 10:12:34.743820 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.743850 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25433] 10:12:34.743879 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.743897 close(7 <unfinished ...>
[pid 25411] 10:12:34.743921 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.743955 <... close resumed> ) = 0
[pid 25444] 10:12:34.743978 <... open resumed> ) = 5
[pid 25443] 10:12:34.743998 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.744028 read(13,  <unfinished ...>
[pid 25425] 10:12:34.744054 <... close resumed> ) = 0
[pid 25411] 10:12:34.744074 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.744123 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.744156 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.744179 <... mmap resumed> ) = 0x7fdec3037000
[pid 25433] 10:12:34.744195 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25425] 10:12:34.744221 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25411] 10:12:34.744255 write(8, "2015-12-30 10:12:34 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25445] 10:12:34.744296 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.744314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.744351 mprotect(0x7fdec31f0000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.744379 read(13,  <unfinished ...>
[pid 25425] 10:12:34.744402 <... open resumed> ) = 7
[pid 25411] 10:12:34.744418 <... write resumed> ) = 126
[pid 25445] 10:12:34.744449 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.744562 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.744593 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.744610 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.744648 fcntl(7, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.744675 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25445] 10:12:34.744713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.744730 <... mmap resumed> ) = 0x7fd066798000
[pid 25443] 10:12:34.744747 mmap(0x7fdec33ef000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25433] 10:12:34.744778 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.744805 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.744821 <... write resumed> ) = 77
[pid 25445] 10:12:34.744858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.744892 read(5,  <unfinished ...>
[pid 25443] 10:12:34.744920 <... mmap resumed> ) = 0x7fdec33ef000
[pid 25433] 10:12:34.744940 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.744986 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.745012 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.745047 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.745066 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.745102 mmap(0x7fdec3416000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.745132 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.745161 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.745177 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.745226 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.745261 close(5 <unfinished ...>
[pid 25443] 10:12:34.745286 <... mmap resumed> ) = 0x7fdec3416000
[pid 25433] 10:12:34.745308 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.745347 fstat(7,  <unfinished ...>
[pid 25411] 10:12:34.745371 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.745405 <... open resumed> ) = 6
[pid 25444] 10:12:34.745421 <... close resumed> ) = 0
[pid 25443] 10:12:34.745436 close(6 <unfinished ...>
[pid 25433] 10:12:34.745459 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.745565 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5367779, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25411] 10:12:34.745603 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.745644 read(6,  <unfinished ...>
[pid 25444] 10:12:34.745668 munmap(0x7fd066798000, 4096 <unfinished ...>
[pid 25443] 10:12:34.745696 <... close resumed> ) = 0
[pid 25433] 10:12:34.745721 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.745780 write(7, "2015-12-30 10:12:34 [25425] 1aEJMY-0006bs-1f => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2518 QT=0s DT=0s\n", 232 <unfinished ...>
[pid 25411] 10:12:34.745818 close(7 <unfinished ...>
[pid 25445] 10:12:34.745852 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.745875 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.745899 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.745931 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.745959 <... write resumed> ) = 232
[pid 25411] 10:12:34.745983 <... close resumed> ) = 0
[pid 25445] 10:12:34.746013 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.746037 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.746065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.746082 <... open resumed> ) = 14
[pid 25425] 10:12:34.746099 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25411] 10:12:34.746138 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.746176 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.746206 <... open resumed> ) = 5
[pid 25443] 10:12:34.746224 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.746256 fstat(14,  <unfinished ...>
[pid 25425] 10:12:34.746279 <... open resumed> ) = 11
[pid 25411] 10:12:34.746295 <... open resumed> ) = 7
[pid 25445] 10:12:34.746319 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.746349 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.746372 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.746389 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.746418 alarm(60 <unfinished ...>
[pid 25411] 10:12:34.746445 fcntl(7, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.746593 <... mmap resumed> ) = 0x7fb6251cb000
[pid 25444] 10:12:34.746619 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.746649 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.746680 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.746707 <... alarm resumed> ) = 0
[pid 25411] 10:12:34.746723 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.746748 mprotect(0x7fb6251cd000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.746776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.746801 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.746821 <... mmap resumed> ) = 0x7fea0f27f000
[pid 25425] 10:12:34.746838 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25411] 10:12:34.746867 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.746899 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.746915 <... mmap resumed> ) = 0x7fd066798000
[pid 25443] 10:12:34.746931 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.746963 read(14,  <unfinished ...>
[pid 25425] 10:12:34.746990 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.747006 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.747030 mmap(0x7fb6253cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25444] 10:12:34.747060 read(5,  <unfinished ...>
[pid 25443] 10:12:34.747086 <... open resumed> ) = 6
[pid 25433] 10:12:34.747102 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.747133 alarm(0 <unfinished ...>
[pid 25411] 10:12:34.747157 fstat(7,  <unfinished ...>
[pid 25445] 10:12:34.747189 <... mmap resumed> ) = 0x7fb6253cd000
[pid 25444] 10:12:34.747213 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.747247 read(6,  <unfinished ...>
[pid 25433] 10:12:34.747449 close(14 <unfinished ...>
[pid 25425] 10:12:34.747547 <... alarm resumed> ) = 60
[pid 25411] 10:12:34.747602 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368011, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.747646 close(6 <unfinished ...>
[pid 25444] 10:12:34.747669 close(5 <unfinished ...>
[pid 25443] 10:12:34.747693 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.747716 <... close resumed> ) = 0
[pid 25425] 10:12:34.747732 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25411] 10:12:34.747763 write(7, "2015-12-30 10:12:34 [25411] 1aEJMX-0006bl-RX => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2568 QT=1s "..., 262 <unfinished ...>
[pid 25445] 10:12:34.747808 <... close resumed> ) = 0
[pid 25444] 10:12:34.747832 <... close resumed> ) = 0
[pid 25443] 10:12:34.747850 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.747874 munmap(0x7fea0f27f000, 4096 <unfinished ...>
[pid 25425] 10:12:34.747902 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25411] 10:12:34.747935 <... write resumed> ) = 262
[pid 25445] 10:12:34.748003 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.748038 munmap(0x7fd066798000, 4096 <unfinished ...>
[pid 25443] 10:12:34.748065 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25433] 10:12:34.748095 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.748121 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.748155 pipe( <unfinished ...>
[pid 25445] 10:12:34.748191 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.748209 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.748239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.748268 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.748295 <... open resumed> ) = 12
[pid 25411] 10:12:34.748312 <... pipe resumed> [11, 12]) = 0
[pid 25445] 10:12:34.748339 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.748371 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25443] 10:12:34.748427 <... mmap resumed> ) = 0x7fdec5aaa000
[pid 25433] 10:12:34.748448 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25425] 10:12:34.748555 fcntl(12, F_GETFD <unfinished ...>
[pid 25411] 10:12:34.748585 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25445] 10:12:34.748618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.748636 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25443] 10:12:34.748666 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.748702 pipe( <unfinished ...>
[pid 25425] 10:12:34.748731 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.748748 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.748775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.748806 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25443] 10:12:34.748835 <... mmap resumed> ) = 0x7fdec2e0a000
[pid 25433] 10:12:34.748852 <... pipe resumed> [14, 15]) = 0
[pid 25425] 10:12:34.748869 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25411] 10:12:34.748892 close(10 <unfinished ...>
[pid 25445] 10:12:34.748924 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.748943 <... readlink resumed> 0x7ffd822260c0, 4095) = -1 EINVAL (Invalid argument)
[pid 25443] 10:12:34.748968 mprotect(0x7fdec2e36000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.748996 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25425] 10:12:34.749025 <... fcntl resumed> ) = 0
[pid 25411] 10:12:34.749042 <... close resumed> ) = 0
[pid 25445] 10:12:34.749067 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.749104 getcwd( <unfinished ...>
[pid 25443] 10:12:34.749129 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.749145 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25425] 10:12:34.749167 read(12,  <unfinished ...>
[pid 25411] 10:12:34.749191 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25445] 10:12:34.749227 <... open resumed> ) = 6
[pid 25444] 10:12:34.749243 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25443] 10:12:34.749269 mmap(0x7fdec3036000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25433] 10:12:34.749299 close(12 <unfinished ...>
[pid 25425] 10:12:34.749323 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25411] 10:12:34.749350 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.749380 read(6,  <unfinished ...>
[pid 25444] 10:12:34.749406 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25443] 10:12:34.749436 <... mmap resumed> ) = 0x7fdec3036000
[pid 25433] 10:12:34.749457 <... close resumed> ) = 0
[pid 25425] 10:12:34.749474 close(12 <unfinished ...>
[pid 25411] 10:12:34.749591 clone( <unfinished ...>
[pid 25445] 10:12:34.749935 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.749961 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25443] 10:12:34.749993 close(6 <unfinished ...>
[pid 25433] 10:12:34.750017 munmap(0x7fea0f281000, 4096 <unfinished ...>
[pid 25425] 10:12:34.750044 <... close resumed> ) = 0
[pid 25445] 10:12:34.750080 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.750106 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.750135 <... close resumed> ) = 0
[pid 25433] 10:12:34.750159 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.750178 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.750206 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25449
[pid 25445] 10:12:34.750250 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.750282 <... open resumed> ) = 5
[pid 25443] 10:12:34.750301 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.750336 close(9 <unfinished ...>
[pid 25425] 10:12:34.750363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25411] 10:12:34.750383 close(12 <unfinished ...>
[pid 25445] 10:12:34.750428 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.750465 fstat(5,  <unfinished ...>
[pid 25443] 10:12:34.750567 <... open resumed> ) = 6
[pid 25433] 10:12:34.750586 <... close resumed> ) = 0
[pid 25425] 10:12:34.750602 stat("/var/tmp",  <unfinished ...>
[pid 25411] 10:12:34.750634 <... close resumed> ) = 0
[pid 25445] 10:12:34.750682 <... mmap resumed> ) = 0x7fb624fc8000
[pid 25444] 10:12:34.750702 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25443] 10:12:34.750731 read(6,  <unfinished ...>
[pid 25433] 10:12:34.750755 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25425] 10:12:34.750784 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25411] 10:12:34.750913 wait4(-1,  <unfinished ...>
[pid 25445] 10:12:34.750951 mprotect(0x7fb624fca000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.750979 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.751006 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.751030 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.751048 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25411] 10:12:34.751079 <... wait4 resumed> 0x7ffdf4a546e0, WNOHANG, NULL) = 0
[pid 25445] 10:12:34.751119 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.751138 <... mmap resumed> ) = 0x7fd066798000
[pid 25443] 10:12:34.751155 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.751178 close(11 <unfinished ...>
[pid 25425] 10:12:34.751203 <... open resumed> ) = 12
[pid 25411] 10:12:34.751218 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25445] 10:12:34.751256 mmap(0x7fb6251c9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25444] 10:12:34.751285 read(5,  <unfinished ...>
[pid 25443] 10:12:34.751314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25433] 10:12:34.751345 <... close resumed> ) = 0
[pid 25425] 10:12:34.751363 fcntl(12, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.751395 <... mmap resumed> ) = 0x7fb6251c9000
[pid 25444] 10:12:34.751420 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25443] 10:12:34.751444 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.751548 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25425] 10:12:34.751584 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.751609 close(6 <unfinished ...>
[pid 25444] 10:12:34.751632 read(5,  <unfinished ...>
[pid 25443] 10:12:34.751657 <... mmap resumed> ) = 0x7fdec2c05000
[pid 25433] 10:12:34.751673 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.751690 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.751721 <... close resumed> ) = 0
[pid 25444] 10:12:34.751744 <... read resumed> "", 1024) = 0
[pid 25443] 10:12:34.751768 mprotect(0x7fdec2c0a000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.751796 close(13 <unfinished ...>
[pid 25425] 10:12:34.751821 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.751851 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.751883 setregid(499, 499 <unfinished ...>
[pid 25443] 10:12:34.751907 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.751923 <... close resumed> ) = 0
[pid 25425] 10:12:34.751939 fstat(12,  <unfinished ...>
[pid 25445] 10:12:34.751969 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.751987 <... setregid resumed> ) = 0
[pid 25443] 10:12:34.752005 mmap(0x7fdec2e09000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25433] 10:12:34.752036 munmap(0x7fea0f280000, 4096 <unfinished ...>
[pid 25425] 10:12:34.752061 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25445] 10:12:34.752115 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.752151 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25443] 10:12:34.752388 <... mmap resumed> ) = 0x7fdec2e09000
[pid 25433] 10:12:34.752417 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.752440 pread(12,  <unfinished ...>
[pid 25445] 10:12:34.752574 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.752601 close(6 <unfinished ...>
[pid 25433] 10:12:34.752626 close(10 <unfinished ...>
[pid 25425] 10:12:34.752651 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25445] 10:12:34.752704 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.752740 <... execve resumed> ) = 0
[pid 25443] 10:12:34.752771 <... close resumed> ) = 0
[pid 25433] 10:12:34.752800 <... close resumed> ) = 0
[pid 25425] 10:12:34.752818 pread(12,  <unfinished ...>
[pid 25445] 10:12:34.752850 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.752869 brk(0 <unfinished ...>
[pid 25443] 10:12:34.752892 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.752922 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25425] 10:12:34.752948 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25445] 10:12:34.752987 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.753019 <... brk resumed> ) = 0xe6a000
[pid 25443] 10:12:34.753037 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.753054 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.753073 close(12 <unfinished ...>
[pid 25445] 10:12:34.753104 <... open resumed> ) = 6
[pid 25444] 10:12:34.753120 fcntl(0, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.753142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.753174 clone( <unfinished ...>
[pid 25425] 10:12:34.753542 <... close resumed> ) = 0
[pid 25445] 10:12:34.753590 read(6,  <unfinished ...>
[pid 25444] 10:12:34.753617 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.753633 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.753652 close(11 <unfinished ...>
[pid 25445] 10:12:34.753688 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.753712 fcntl(1, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.753735 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.753765 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25450
[pid 25425] 10:12:34.753801 <... close resumed> ) = 0
[pid 25445] 10:12:34.753858 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.753885 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.753901 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.753921 close(15 <unfinished ...>
[pid 25425] 10:12:34.753944 pipe( <unfinished ...>
[pid 25445] 10:12:34.753977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.754008 fcntl(2, F_GETFD <unfinished ...>
[pid 25443] 10:12:34.754031 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.754066 <... close resumed> ) = 0
[pid 25425] 10:12:34.754083 <... pipe resumed> [11, 12]) = 0
[pid 25445] 10:12:34.754109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.754137 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.754158 <... open resumed> ) = 6
[pid 25433] 10:12:34.754175 read(14,  <unfinished ...>
[pid 25425] 10:12:34.754197 close(10 <unfinished ...>
[pid 25445] 10:12:34.754227 <... mmap resumed> ) = 0x7fb627059000
[pid 25444] 10:12:34.754247 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25443] 10:12:34.754276 read(6,  <unfinished ...>
[pid 25425] 10:12:34.754300 <... close resumed> ) = 0
[pid 25445] 10:12:34.754321 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.754350 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.754383 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:34.754408 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25445] 10:12:34.754445 <... mmap resumed> ) = 0x7fb624c34000
[pid 25444] 10:12:34.754462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.754576 fstat(6,  <unfinished ...>
[pid 25425] 10:12:34.754602 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.754628 mprotect(0x7fb624dbe000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.754657 <... mmap resumed> ) = 0x7f20f9cb7000
[pid 25443] 10:12:34.754688 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25425] 10:12:34.754723 clone( <unfinished ...>
[pid 25445] 10:12:34.755056 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.755074 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25443] 10:12:34.755104 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.755141 mmap(0x7fb624fbe000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25444] 10:12:34.755171 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.755196 <... mmap resumed> ) = 0x7fdec2a02000
[pid 25425] 10:12:34.755214 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25451
[pid 25445] 10:12:34.755256 <... mmap resumed> ) = 0x7fb624fbe000
[pid 25444] 10:12:34.755280 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.755312 mprotect(0x7fdec2a04000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:34.755340 close(12 <unfinished ...>
[pid 25445] 10:12:34.755372 mmap(0x7fb624fc3000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.755401 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.755419 <... mprotect resumed> ) = 0
[pid 25425] 10:12:34.755436 <... close resumed> ) = 0
[pid 25445] 10:12:34.755458 <... mmap resumed> ) = 0x7fb624fc3000
[pid 25444] 10:12:34.755541 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.755590 mmap(0x7fdec2c03000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25425] 10:12:34.755628 read(11,  <unfinished ...>
[pid 25445] 10:12:34.755657 close(6 <unfinished ...>
[pid 25444] 10:12:34.755679 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.755698 <... mmap resumed> ) = 0x7fdec2c03000
[pid 25445] 10:12:34.755728 <... close resumed> ) = 0
[pid 25444] 10:12:34.755754 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.755785 close(6 <unfinished ...>
[pid 25445] 10:12:34.755813 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.755842 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.755858 <... close resumed> ) = 0
[pid 25445] 10:12:34.755888 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.755912 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25443] 10:12:34.755971 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.756027 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.756060 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.756077 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.756099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.756116 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.756145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.756180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.756208 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.756225 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.756246 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.756266 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.756293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.756327 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.756359 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.756377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.756400 <... open resumed> ) = 6
[pid 25444] 10:12:34.756416 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.756446 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.756556 read(6,  <unfinished ...>
[pid 25444] 10:12:34.756588 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.756606 <... open resumed> ) = 6
[pid 25445] 10:12:34.756627 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.756651 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25443] 10:12:34.756678 read(6,  <unfinished ...>
[pid 25445] 10:12:34.756706 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.756730 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25443] 10:12:34.756765 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.756793 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25444] 10:12:34.756823 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.756855 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.756948 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.756979 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.756997 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25445] 10:12:34.757032 <... mmap resumed> ) = 0x7fb6249c8000
[pid 25444] 10:12:34.757049 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.757079 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.757111 mprotect(0x7fb624a2a000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.757138 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.757155 <... mmap resumed> ) = 0x7fdec5aa9000
[pid 25445] 10:12:34.757180 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.757197 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.757228 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.757262 mmap(0x7fb624c29000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25444] 10:12:34.757291 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.757308 <... mmap resumed> ) = 0x7fdec27df000
[pid 25445] 10:12:34.757330 <... mmap resumed> ) = 0x7fb624c29000
[pid 25444] 10:12:34.757355 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25443] 10:12:34.757395 mprotect(0x7fdec27f6000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.757436 close(6 <unfinished ...>
[pid 25444] 10:12:34.757467 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.757551 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.757578 <... close resumed> ) = 0
[pid 25444] 10:12:34.757605 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.757640 mmap(0x7fdec29f6000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25445] 10:12:34.757674 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.757704 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.757720 <... mmap resumed> ) = 0x7fdec29f6000
[pid 25445] 10:12:34.757752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.757777 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.757808 close(6 <unfinished ...>
[pid 25445] 10:12:34.757836 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.757867 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.757885 <... close resumed> ) = 0
[pid 25445] 10:12:34.757929 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.757948 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.757979 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.758013 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.758042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.758058 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.758080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.758098 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25443] 10:12:34.758127 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.758163 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.758195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.758224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.758246 <... open resumed> ) = 6
[pid 25444] 10:12:34.758262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.758291 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.758325 read(6,  <unfinished ...>
[pid 25444] 10:12:34.758349 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.758365 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.758389 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.758413 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.758442 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.758577 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.758608 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.758628 <... open resumed> ) = 6
[pid 25445] 10:12:34.758649 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25444] 10:12:34.758681 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.758710 read(6,  <unfinished ...>
[pid 25445] 10:12:34.758740 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.758774 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.758791 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.758820 <... mmap resumed> ) = 0x7fb6245e5000
[pid 25444] 10:12:34.758836 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25443] 10:12:34.758864 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.758891 mprotect(0x7fb62479e000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.758919 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.758936 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25445] 10:12:34.758971 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.758987 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.759017 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.759051 mmap(0x7fb62499d000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25444] 10:12:34.759080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.759097 <... mmap resumed> ) = 0x7fdec259b000
[pid 25445] 10:12:34.759118 <... mmap resumed> ) = 0x7fb62499d000
[pid 25444] 10:12:34.759139 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25443] 10:12:34.759168 mprotect(0x7fdec25dc000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.759200 mmap(0x7fb6249c4000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.759227 <... stat resumed> 0x7ffd6887e570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.759245 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.759266 <... mmap resumed> ) = 0x7fb6249c4000
[pid 25444] 10:12:34.759287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.759320 mmap(0x7fdec27dc000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25445] 10:12:34.759354 close(6 <unfinished ...>
[pid 25444] 10:12:34.759377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.759398 <... mmap resumed> ) = 0x7fdec27dc000
[pid 25445] 10:12:34.759435 <... close resumed> ) = 0
[pid 25444] 10:12:34.759470 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25443] 10:12:34.759594 close(6 <unfinished ...>
[pid 25445] 10:12:34.759624 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.759654 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.759684 <... close resumed> ) = 0
[pid 25445] 10:12:34.759714 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.759733 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.759762 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.759796 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.759833 <... open resumed> ) = 6
[pid 25443] 10:12:34.759849 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.759871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.759888 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.759911 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.759946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.759975 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25443] 10:12:34.760002 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.760024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.760043 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.760069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.760103 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.760133 <... mmap resumed> ) = 0x7f20f9cad000
[pid 25443] 10:12:34.760149 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.760172 <... open resumed> ) = 6
[pid 25444] 10:12:34.760188 close(6 <unfinished ...>
[pid 25443] 10:12:34.760211 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.760246 read(6,  <unfinished ...>
[pid 25444] 10:12:34.760269 <... close resumed> ) = 0
[pid 25443] 10:12:34.760294 <... open resumed> ) = 6
[pid 25445] 10:12:34.760315 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.760337 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.760367 read(6,  <unfinished ...>
[pid 25445] 10:12:34.760396 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.760421 <... open resumed> ) = 6
[pid 25443] 10:12:34.760436 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.760463 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25444] 10:12:34.760594 read(6,  <unfinished ...>
[pid 25443] 10:12:34.760619 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.760648 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.760674 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.760704 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25445] 10:12:34.760739 <... mmap resumed> ) = 0x7fb627058000
[pid 25444] 10:12:34.760760 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.760783 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.760814 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.760841 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.760870 <... mmap resumed> ) = 0x7fdec5aa8000
[pid 25445] 10:12:34.760895 <... mmap resumed> ) = 0x7fb6243b8000
[pid 25444] 10:12:34.760911 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.760938 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.760970 mprotect(0x7fb6243e4000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.760997 <... mmap resumed> ) = 0x7f20f987f000
[pid 25443] 10:12:34.761016 <... mmap resumed> ) = 0x7fdec22b4000
[pid 25445] 10:12:34.761038 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.761054 mprotect(0x7f20f9895000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.761080 mprotect(0x7fdec238f000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.761111 mmap(0x7fb6245e4000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25444] 10:12:34.761140 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.761156 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.761176 <... mmap resumed> ) = 0x7fb6245e4000
[pid 25444] 10:12:34.761197 mmap(0x7f20f9a95000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25443] 10:12:34.761226 mmap(0x7fdec258f000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25445] 10:12:34.761258 close(6 <unfinished ...>
[pid 25444] 10:12:34.761280 <... mmap resumed> ) = 0x7f20f9a95000
[pid 25443] 10:12:34.761301 <... mmap resumed> ) = 0x7fdec258f000
[pid 25445] 10:12:34.761333 <... close resumed> ) = 0
[pid 25444] 10:12:34.761359 mmap(0x7f20f9a97000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.761394 close(6 <unfinished ...>
[pid 25445] 10:12:34.761430 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.761551 <... mmap resumed> ) = 0x7f20f9a97000
[pid 25443] 10:12:34.761582 <... close resumed> ) = 0
[pid 25445] 10:12:34.761614 <... open resumed> ) = 6
[pid 25444] 10:12:34.761633 close(6 <unfinished ...>
[pid 25443] 10:12:34.761656 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.761691 read(6,  <unfinished ...>
[pid 25444] 10:12:34.761714 <... close resumed> ) = 0
[pid 25443] 10:12:34.761736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.761760 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.761789 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.761820 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.761856 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.761878 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.761895 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.761917 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25444] 10:12:34.761947 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.761979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.762012 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.762041 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.762057 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.762080 <... mmap resumed> ) = 0x7fb6241b3000
[pid 25444] 10:12:34.762097 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.762126 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.762162 mprotect(0x7fb6241b8000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.762189 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.762209 <... open resumed> ) = 6
[pid 25445] 10:12:34.762231 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.762247 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.762277 read(6,  <unfinished ...>
[pid 25445] 10:12:34.762305 mmap(0x7fb6243b7000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25444] 10:12:34.762333 <... open resumed> ) = 6
[pid 25443] 10:12:34.762350 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.762377 <... mmap resumed> ) = 0x7fb6243b7000
[pid 25444] 10:12:34.762400 read(6,  <unfinished ...>
[pid 25443] 10:12:34.762429 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.762472 close(6 <unfinished ...>
[pid 25444] 10:12:34.762607 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.762633 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25445] 10:12:34.762688 <... close resumed> ) = 0
[pid 25444] 10:12:34.762727 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.762767 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.762822 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.762868 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.762900 <... mmap resumed> ) = 0x7fdec20b0000
[pid 25445] 10:12:34.762922 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.762940 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.762967 mprotect(0x7fdec20b3000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.762999 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.763031 <... mmap resumed> ) = 0x7f20f9cac000
[pid 25443] 10:12:34.763052 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.763074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.763091 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.763118 mmap(0x7fdec22b2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25445] 10:12:34.763152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.763182 <... mmap resumed> ) = 0x7f20f9666000
[pid 25443] 10:12:34.763198 <... mmap resumed> ) = 0x7fdec22b2000
[pid 25445] 10:12:34.763228 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.763249 mprotect(0x7f20f967c000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.763276 close(6 <unfinished ...>
[pid 25445] 10:12:34.763304 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.763334 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.763350 <... close resumed> ) = 0
[pid 25445] 10:12:34.763382 <... open resumed> ) = 6
[pid 25444] 10:12:34.763404 mmap(0x7f20f987b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25443] 10:12:34.763441 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.763560 read(6,  <unfinished ...>
[pid 25444] 10:12:34.763590 <... mmap resumed> ) = 0x7f20f987b000
[pid 25443] 10:12:34.763611 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.763635 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.763660 mmap(0x7f20f987d000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.763688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.763726 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.763750 <... mmap resumed> ) = 0x7f20f987d000
[pid 25443] 10:12:34.763771 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.763795 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25444] 10:12:34.763832 close(6 <unfinished ...>
[pid 25443] 10:12:34.763856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.763891 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.763920 <... close resumed> ) = 0
[pid 25443] 10:12:34.763942 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.763967 <... mmap resumed> ) = 0x7fb623fb0000
[pid 25444] 10:12:34.763983 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.764012 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.764049 mprotect(0x7fb623fb2000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.764086 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.764111 <... open resumed> ) = 6
[pid 25445] 10:12:34.764133 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.764149 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.764181 read(6,  <unfinished ...>
[pid 25445] 10:12:34.764210 mmap(0x7fb6241b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25444] 10:12:34.764238 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.764255 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.764283 <... mmap resumed> ) = 0x7fb6241b1000
[pid 25444] 10:12:34.764307 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.764340 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.764368 close(6 <unfinished ...>
[pid 25444] 10:12:34.764391 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.764412 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25445] 10:12:34.764450 <... close resumed> ) = 0
[pid 25444] 10:12:34.764577 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.764618 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.764654 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.764684 <... open resumed> ) = 6
[pid 25443] 10:12:34.764702 <... mmap resumed> ) = 0x7fdec1e84000
[pid 25445] 10:12:34.764724 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.764741 read(6,  <unfinished ...>
[pid 25443] 10:12:34.764765 mprotect(0x7fdec1ead000, 2097152, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.764796 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.764828 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.764856 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.764878 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.764895 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.764918 mmap(0x7fdec20ad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25445] 10:12:34.764954 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.764984 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.765013 <... mmap resumed> ) = 0x7fdec20ad000
[pid 25445] 10:12:34.765040 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.765059 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.765087 mmap(0x7fdec20af000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.765119 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.765149 <... mmap resumed> ) = 0x7f20f942f000
[pid 25443] 10:12:34.765166 <... mmap resumed> ) = 0x7fdec20af000
[pid 25445] 10:12:34.765192 <... open resumed> ) = 6
[pid 25444] 10:12:34.765210 mprotect(0x7f20f9436000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.765236 close(6 <unfinished ...>
[pid 25445] 10:12:34.765264 read(6,  <unfinished ...>
[pid 25444] 10:12:34.765287 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.765302 <... close resumed> ) = 0
[pid 25445] 10:12:34.765333 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.765358 mmap(0x7f20f9636000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25443] 10:12:34.765394 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.765437 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.765468 <... mmap resumed> ) = 0x7f20f9636000
[pid 25443] 10:12:34.765588 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.765615 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.765646 mmap(0x7f20f9638000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.765675 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.765714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.765739 <... mmap resumed> ) = 0x7f20f9638000
[pid 25443] 10:12:34.765761 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.765785 <... mmap resumed> ) = 0x7fb627057000
[pid 25444] 10:12:34.765805 close(6 <unfinished ...>
[pid 25443] 10:12:34.765828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.765869 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.765898 <... close resumed> ) = 0
[pid 25443] 10:12:34.765926 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.765951 <... mmap resumed> ) = 0x7fb623d8d000
[pid 25444] 10:12:34.765968 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.765998 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.766034 mprotect(0x7fb623da4000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.766061 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.766078 <... open resumed> ) = 6
[pid 25445] 10:12:34.766099 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.766115 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.766146 read(6,  <unfinished ...>
[pid 25445] 10:12:34.766174 mmap(0x7fb623fa4000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25444] 10:12:34.766203 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.766220 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.766248 <... mmap resumed> ) = 0x7fb623fa4000
[pid 25444] 10:12:34.766275 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.766308 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.766337 close(6 <unfinished ...>
[pid 25444] 10:12:34.766359 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.766377 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25445] 10:12:34.766412 <... close resumed> ) = 0
[pid 25444] 10:12:34.766452 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.766571 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.766607 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.766637 <... open resumed> ) = 6
[pid 25443] 10:12:34.766654 <... mmap resumed> ) = 0x7fdec5aa7000
[pid 25445] 10:12:34.766678 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.766697 read(6,  <unfinished ...>
[pid 25443] 10:12:34.766721 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.766755 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.766786 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.766810 <... mmap resumed> ) = 0x7fdec1c6e000
[pid 25445] 10:12:34.766831 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.766853 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.766877 mprotect(0x7fdec1c83000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.766909 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.766938 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.766968 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.766990 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.767008 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.767036 mmap(0x7fdec1e82000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25445] 10:12:34.767069 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.767099 <... mmap resumed> ) = 0x7f20f91ab000
[pid 25443] 10:12:34.767116 <... mmap resumed> ) = 0x7fdec1e82000
[pid 25445] 10:12:34.767148 <... open resumed> ) = 6
[pid 25444] 10:12:34.767166 mprotect(0x7f20f922e000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.767192 close(6 <unfinished ...>
[pid 25445] 10:12:34.767220 read(6,  <unfinished ...>
[pid 25444] 10:12:34.767243 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.767259 <... close resumed> ) = 0
[pid 25445] 10:12:34.767297 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.767324 mmap(0x7f20f942d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25443] 10:12:34.767353 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.767396 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.767425 <... mmap resumed> ) = 0x7f20f942d000
[pid 25443] 10:12:34.767457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.767593 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.767632 close(6 <unfinished ...>
[pid 25443] 10:12:34.767656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.767693 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.767723 <... close resumed> ) = 0
[pid 25443] 10:12:34.767752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.767778 <... mmap resumed> ) = 0x7fb623b49000
[pid 25444] 10:12:34.767795 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.767824 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.767861 mprotect(0x7fb623b8a000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.767889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.767906 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.767929 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.767945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.767982 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.768019 mmap(0x7fb623d8a000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25444] 10:12:34.768048 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.768065 <... open resumed> ) = 6
[pid 25445] 10:12:34.768086 <... mmap resumed> ) = 0x7fb623d8a000
[pid 25444] 10:12:34.768110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.768142 read(6,  <unfinished ...>
[pid 25445] 10:12:34.768171 close(6 <unfinished ...>
[pid 25444] 10:12:34.768193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.768211 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.768239 <... close resumed> ) = 0
[pid 25444] 10:12:34.768266 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.768297 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.768326 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.768357 <... open resumed> ) = 6
[pid 25443] 10:12:34.768373 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
Process 25451 attached
[pid 25445] 10:12:34.768450 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.768568 read(6,  <unfinished ...>
[pid 25443] 10:12:34.768602 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25451] 10:12:34.768639 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25445] 10:12:34.768660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.768693 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.768716 <... mmap resumed> ) = 0x7fdec1a63000
[pid 25445] 10:12:34.768738 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.768755 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.768778 mprotect(0x7fdec1a6d000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.768810 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.768839 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25443] 10:12:34.768868 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.768889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.768913 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.768940 mmap(0x7fdec1c6c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25445] 10:12:34.768981 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.769012 <... mmap resumed> ) = 0x7f20f9cab000
[pid 25443] 10:12:34.769032 <... mmap resumed> ) = 0x7fdec1c6c000
[pid 25445] 10:12:34.769063 <... open resumed> ) = 6
[pid 25444] 10:12:34.769081 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.769109 close(6 <unfinished ...>
[pid 25445] 10:12:34.769137 read(6,  <unfinished ...>
[pid 25444] 10:12:34.769160 <... mmap resumed> ) = 0x7f20f8f9d000
[pid 25443] 10:12:34.769176 <... close resumed> ) = 0
[pid 25445] 10:12:34.769206 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.769230 mprotect(0x7f20f8fa9000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.769258 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.769293 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.769316 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.769332 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.769354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.769383 mmap(0x7f20f91a9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25443] 10:12:34.769412 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.769452 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.769598 <... mmap resumed> ) = 0x7f20f91a9000
[pid 25443] 10:12:34.769629 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.769655 <... mmap resumed> ) = 0x7fb627056000
[pid 25444] 10:12:34.769675 close(6 <unfinished ...>
[pid 25443] 10:12:34.769698 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.769735 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.769763 <... close resumed> ) = 0
[pid 25443] 10:12:34.769786 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.769810 <... mmap resumed> ) = 0x7fb623862000
[pid 25444] 10:12:34.769827 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.769860 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.769897 mprotect(0x7fb62393d000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.769924 <... open resumed> ) = 6
[pid 25443] 10:12:34.769940 <... open resumed> ) = 6
[pid 25445] 10:12:34.769961 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.769977 read(6,  <unfinished ...>
[pid 25443] 10:12:34.770001 read(6,  <unfinished ...>
[pid 25445] 10:12:34.770029 mmap(0x7fb623b3d000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25444] 10:12:34.770057 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.770087 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.770115 <... mmap resumed> ) = 0x7fb623b3d000
[pid 25444] 10:12:34.770140 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.770165 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.770200 close(6 <unfinished ...>
[pid 25444] 10:12:34.770223 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25443] 10:12:34.770254 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25445] 10:12:34.770288 <... close resumed> ) = 0
[pid 25444] 10:12:34.770312 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.770341 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.770377 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.770414 <... mmap resumed> ) = 0x7f20f8d7a000
[pid 25443] 10:12:34.770436 <... mmap resumed> ) = 0x7fdec1860000
[pid 25445] 10:12:34.770458 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.770564 mprotect(0x7f20f8d9b000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.770601 mprotect(0x7fdec1862000, 2093056, PROT_NONEProcess 25450 attached
 <unfinished ...>
[pid 25451] 10:12:34.770644 <... set_robust_list resumed> ) = 0
[pid 25445] 10:12:34.770660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.770694 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.770710 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.770731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.770748 mmap(0x7f20f8f9b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25443] 10:12:34.770778 mmap(0x7fdec1a61000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25445] 10:12:34.770817 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.770848 <... mmap resumed> ) = 0x7f20f8f9b000
[pid 25443] 10:12:34.770870 <... mmap resumed> ) = 0x7fdec1a61000
[pid 25445] 10:12:34.770900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.770921 close(6 <unfinished ...>
[pid 25443] 10:12:34.770944 close(6 <unfinished ...>
[pid 25445] 10:12:34.770971 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.771001 <... close resumed> ) = 0
[pid 25443] 10:12:34.771024 <... close resumed> ) = 0
[pid 25445] 10:12:34.771052 <... open resumed> ) = 6
[pid 25444] 10:12:34.771075 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.771177 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.771212 read(6,  <unfinished ...>
[pid 25444] 10:12:34.771235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.771253 <... mmap resumed> ) = 0x7fdec5aa6000
[pid 25445] 10:12:34.771290 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.771316 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.771348 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.771382 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.771412 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.771431 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.771454 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.771542 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.771576 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.771613 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.771643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.771661 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.771684 <... mmap resumed> ) = 0x7fb62365e000
[pid 25444] 10:12:34.771700 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.771731 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.771766 mprotect(0x7fb623661000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.771792 <... open resumed> ) = 6
[pid 25443] 10:12:34.771808 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.771831 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.771847 read(6,  <unfinished ...>
[pid 25443] 10:12:34.771871 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.771904 mmap(0x7fb623860000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25444] 10:12:34.771933 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.771956 <... open resumed> ) = 6
[pid 25445] 10:12:34.771977 <... mmap resumed> ) = 0x7fb623860000
[pid 25444] 10:12:34.772002 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.772028 read(6,  <unfinished ...>
[pid 25445] 10:12:34.772057 close(6 <unfinished ...>
[pid 25444] 10:12:34.772088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.772119 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25445] 10:12:34.772146 <... close resumed> ) = 0
[pid 25444] 10:12:34.772170 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.772199 fstat(6,  <unfinished ...>
[pid 25445] 10:12:34.772228 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.772257 <... mmap resumed> ) = 0x7f20f8b5d000
[pid 25443] 10:12:34.772273 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25445] 10:12:34.772310 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.772329 mprotect(0x7f20f8b74000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.772357 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25445] 10:12:34.772391 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.772423 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.772439 <... mmap resumed> ) = 0x7fdec1641000
[pid 25445] 10:12:34.772460 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.772580 mmap(0x7f20f8d74000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25443] 10:12:34.772622 mprotect(0x7fdec165e000, 2093056, PROT_NONE <unfinished ...>
[pid 25445] 10:12:34.772656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.772687 <... mmap resumed> ) = 0x7f20f8d74000
[pid 25443] 10:12:34.772708 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.772730 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.772749 mmap(0x7f20f8d76000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.772777 mmap(0x7fdec185d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25445] 10:12:34.772811 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.772843 <... mmap resumed> ) = 0x7f20f8d76000
[pid 25443] 10:12:34.772864 <... mmap resumed> ) = 0x7fdec185d000
[pid 25445] 10:12:34.772892 <... open resumed> ) = 6
[pid 25444] 10:12:34.772908 close(6 <unfinished ...>
[pid 25443] 10:12:34.772931 mmap(0x7fdec185f000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.772963 read(6,  <unfinished ...>
[pid 25444] 10:12:34.772986 <... close resumed> ) = 0
[pid 25443] 10:12:34.773009 <... mmap resumed> ) = 0x7fdec185f000
[pid 25445] 10:12:34.773037 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.773067 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.773099 close(6 <unfinished ...>
[pid 25445] 10:12:34.773127 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.773149 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.773166 <... close resumed> ) = 0
[pid 25445] 10:12:34.773224 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.773263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.773297 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.773330 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.773358 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.773375 <... mmap resumed> ) = 0x7fdec5aa5000
[pid 25445] 10:12:34.773437 <... mmap resumed> ) = 0x7fb623432000
[pid 25444] 10:12:34.773455 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.773566 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.773600 mprotect(0x7fb62345b000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.773628 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.773647 <... mmap resumed> ) = 0x7fdec5aa4000
[pid 25445] 10:12:34.773679 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.773696 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.773727 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.773758 mmap(0x7fb62365b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25444] 10:12:34.773787 <... open resumed> ) = 6
[pid 25443] 10:12:34.773803 <... mmap resumed> ) = 0x7fdec5aa2000
[pid 25445] 10:12:34.773829 <... mmap resumed> ) = 0x7fb62365b000
[pid 25444] 10:12:34.773851 read(6,  <unfinished ...>
[pid 25443] 10:12:34.773875 arch_prctl(ARCH_SET_FS, 0x7fdec5aa27c0 <unfinished ...>
[pid 25445] 10:12:34.773904 mmap(0x7fb62365d000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.773932 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.773956 <... arch_prctl resumed> ) = 0
[pid 25445] 10:12:34.774017 <... mmap resumed> ) = 0x7fb62365d000
[pid 25444] 10:12:34.774040 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.774065 mprotect(0x7fdec185d000, 4096, PROT_READ <unfinished ...>
[pid 25445] 10:12:34.774097 close(6 <unfinished ...>
[pid 25444] 10:12:34.774119 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25443] 10:12:34.774149 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.774180 <... close resumed> ) = 0
[pid 25444] 10:12:34.774207 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.774234 mprotect(0x7fdec1a61000, 4096, PROT_READ <unfinished ...>
[pid 25445] 10:12:34.774265 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.774296 <... mmap resumed> ) = 0x7f20f9caa000
[pid 25443] 10:12:34.774316 <... mprotect resumed> ) = 0
[pid 25445] 10:12:34.774353 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.774372 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.774399 mprotect(0x7fdec1c6c000, 4096, PROT_READ <unfinished ...>
[pid 25445] 10:12:34.774430 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.774462 <... mmap resumed> ) = 0x7f20f87e9000
[pid 25443] 10:12:34.774678 <... mprotect resumed> ) = 0
Process 25449 attached
[pid 25451] 10:12:34.774736 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25450] 10:12:34.774765 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25445] 10:12:34.774803 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.774823 mprotect(0x7f20f8958000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.774851 mprotect(0x7fdec1e82000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.774886 <... setrlimit resumed> ) = 0
[pid 25450] 10:12:34.774899 <... set_robust_list resumed> ) = 0
[pid 25449] 10:12:34.775054 set_robust_list(0x7f816928aaa0, 24 <unfinished ...>
[pid 25445] 10:12:34.775107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.775139 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.775155 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.775193 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25450] 10:12:34.775223 close(14 <unfinished ...>
[pid 25449] 10:12:34.775245 <... set_robust_list resumed> ) = 0
[pid 25445] 10:12:34.775258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.775304 mmap(0x7f20f8b57000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25443] 10:12:34.775337 mprotect(0x7fdec20ad000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.775373 <... open resumed> ) = 10
[pid 25450] 10:12:34.775386 <... close resumed> ) = 0
[pid 25449] 10:12:34.775409 fcntl(12, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.775445 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.775535 <... mmap resumed> ) = 0x7f20f8b57000
[pid 25443] 10:12:34.775568 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.775607 fstat(10,  <unfinished ...>
[pid 25450] 10:12:34.775632 geteuid( <unfinished ...>
[pid 25449] 10:12:34.775653 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.775668 <... open resumed> ) = 6
[pid 25444] 10:12:34.775685 close(6 <unfinished ...>
[pid 25443] 10:12:34.775708 mprotect(0x7fdec22b2000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.775743 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25450] 10:12:34.775771 <... geteuid resumed> ) = 0
[pid 25449] 10:12:34.775801 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.775828 read(6,  <unfinished ...>
[pid 25444] 10:12:34.775851 <... close resumed> ) = 0
[pid 25443] 10:12:34.775874 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.776004 fstat(10,  <unfinished ...>
[pid 25450] 10:12:34.776030 getegid( <unfinished ...>
[pid 25449] 10:12:34.776051 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.776064 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.776098 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.776129 mprotect(0x7fdec258f000, 40960, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.776165 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25450] 10:12:34.776192 <... getegid resumed> ) = 12
[pid 25449] 10:12:34.776208 close(6 <unfinished ...>
[pid 25445] 10:12:34.776236 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.776259 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.776277 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.776381 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25450] 10:12:34.776418 setgid(500 <unfinished ...>
[pid 25449] 10:12:34.776448 <... close resumed> ) = 0
[pid 25445] 10:12:34.776462 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.776592 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.776627 mprotect(0x7fdec27dc000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.776663 <... mmap resumed> ) = 0x7f380d424000
[pid 25450] 10:12:34.776677 <... setgid resumed> ) = 0
[pid 25449] 10:12:34.776694 open("/var/spool/exim/input/X/1aEJMX-0006bl-RX-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.776737 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.776765 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.776783 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.776820 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25450] 10:12:34.776844 setuid(503 <unfinished ...>
[pid 25449] 10:12:34.776868 <... open resumed> ) = 6
[pid 25445] 10:12:34.776881 <... mmap resumed> ) = 0x7fb627055000
[pid 25444] 10:12:34.776914 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.776948 mprotect(0x7fdec29f6000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.776983 <... lseek resumed> ) = 0
[pid 25450] 10:12:34.776997 <... setuid resumed> ) = 0
[pid 25449] 10:12:34.777014 fcntl(6, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.777065 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.777095 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.777114 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.777145 read(10,  <unfinished ...>
[pid 25450] 10:12:34.777173 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25449] 10:12:34.777204 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.777218 <... mmap resumed> ) = 0x7fb62321c000
[pid 25444] 10:12:34.777235 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.777267 mprotect(0x7fdec2c03000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.777303 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25450] 10:12:34.777326 <... open resumed> ) = 9
[pid 25449] 10:12:34.777384 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.777419 mprotect(0x7fb623231000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.777447 <... open resumed> ) = 6
[pid 25443] 10:12:34.777462 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.777753 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25450] 10:12:34.777792 fstat(9,  <unfinished ...>
[pid 25449] 10:12:34.777814 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.777828 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.777883 read(6,  <unfinished ...>
[pid 25443] 10:12:34.777910 mprotect(0x7fdec33ef000, 110592, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.777946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25450] 10:12:34.777974 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25449] 10:12:34.778027 geteuid( <unfinished ...>
[pid 25445] 10:12:34.778079 mmap(0x7fb623430000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25444] 10:12:34.778110 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.778134 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.778224 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25450] 10:12:34.778256 brk(0x9ff000 <unfinished ...>
[pid 25449] 10:12:34.778280 <... geteuid resumed> ) = 0
[pid 25445] 10:12:34.778294 <... mmap resumed> ) = 0x7fb623430000
[pid 25444] 10:12:34.778320 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.778346 mprotect(0x7fdec367b000, 16384, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.778381 <... open resumed> ) = 13
[pid 25450] 10:12:34.778395 <... brk resumed> ) = 0x9ff000
[pid 25449] 10:12:34.778412 getegid( <unfinished ...>
[pid 25445] 10:12:34.778570 close(6 <unfinished ...>
[pid 25444] 10:12:34.778596 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25443] 10:12:34.778628 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.778737 fstat(13,  <unfinished ...>
[pid 25450] 10:12:34.778763 fstat(9,  <unfinished ...>
[pid 25449] 10:12:34.778785 <... getegid resumed> ) = 12
[pid 25445] 10:12:34.778799 <... close resumed> ) = 0
[pid 25444] 10:12:34.778836 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.778866 mprotect(0x7fdec3a10000, 16384, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.778902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25450] 10:12:34.778928 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25449] 10:12:34.778963 setgid(12 <unfinished ...>
[pid 25445] 10:12:34.778990 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.779020 <... mmap resumed> ) = 0x7f20f855a000
[pid 25443] 10:12:34.779036 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.779066 fstat(13,  <unfinished ...>
[pid 25450] 10:12:34.779089 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25449] 10:12:34.779115 <... setgid resumed> ) = 0
[pid 25445] 10:12:34.779129 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.779149 mprotect(0x7f20f85e5000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.779179 mprotect(0x7fdec3c1b000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.779214 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25450] 10:12:34.779239 <... mmap resumed> ) = 0x7fea0f284000
[pid 25449] 10:12:34.779255 setuid(47 <unfinished ...>
[pid 25445] 10:12:34.779280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.779314 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.779330 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.779364 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25450] 10:12:34.779390 read(9,  <unfinished ...>
[pid 25449] 10:12:34.779422 <... setuid resumed> ) = 0
[pid 25445] 10:12:34.779436 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.779455 mmap(0x7f20f87e5000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25443] 10:12:34.779567 mprotect(0x7fdec3e1f000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.779606 <... mmap resumed> ) = 0x7f380d423000
[pid 25450] 10:12:34.779620 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25449] 10:12:34.779641 close(11 <unfinished ...>
[pid 25445] 10:12:34.779666 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.779697 <... mmap resumed> ) = 0x7f20f87e5000
[pid 25443] 10:12:34.779717 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.780353 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25450] 10:12:34.780384 read(9,  <unfinished ...>
[pid 25449] 10:12:34.780412 <... close resumed> ) = 0
[pid 25445] 10:12:34.780426 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.780681 mmap(0x7f20f87e8000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.780719 mprotect(0x7fdec4b77000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.780756 <... lseek resumed> ) = 0
[pid 25450] 10:12:34.780769 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25449] 10:12:34.780791 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25445] 10:12:34.780825 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.780858 <... mmap resumed> ) = 0x7f20f87e8000
[pid 25443] 10:12:34.780880 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.780928 read(13,  <unfinished ...>
[pid 25450] 10:12:34.780960 close(9 <unfinished ...>
[pid 25449] 10:12:34.780984 <... socket resumed> ) = 10
[pid 25445] 10:12:34.780998 <... open resumed> ) = 6
[pid 25444] 10:12:34.781015 close(6 <unfinished ...>
[pid 25443] 10:12:34.781038 mprotect(0x7fdec4fac000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.781073 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25450] 10:12:34.781091 <... close resumed> ) = 0
[pid 25449] 10:12:34.781146 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25445] 10:12:34.781188 read(6,  <unfinished ...>
[pid 25444] 10:12:34.781213 <... close resumed> ) = 0
[pid 25443] 10:12:34.781236 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.781268 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25450] 10:12:34.781297 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25449] 10:12:34.781323 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.781339 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.781365 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.781396 mprotect(0x7fdec5230000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.781432 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25450] 10:12:34.781448 <... munmap resumed> ) = 0
[pid 25449] 10:12:34.781463 close(10 <unfinished ...>
[pid 25445] 10:12:34.781954 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.781981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.782000 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.782031 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25450] 10:12:34.782060 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25449] 10:12:34.782083 <... close resumed> ) = 0
[pid 25445] 10:12:34.782097 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.782133 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.782166 mprotect(0x7fdec5439000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.782203 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25450] 10:12:34.782219 <... lseek resumed> ) = 19
[pid 25449] 10:12:34.782235 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25445] 10:12:34.782263 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.782294 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.782311 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.782352 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25450] 10:12:34.782380 read(6,  <unfinished ...>
[pid 25449] 10:12:34.782403 <... socket resumed> ) = 10
[pid 25445] 10:12:34.782416 <... mmap resumed> ) = 0x7fb623011000
[pid 25444] 10:12:34.782434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.782472 mprotect(0x7fdec567e000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.782576 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f380c2db790}, 8) = 0
[pid 25450] 10:12:34.782595 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2413) = 1858
[pid 25449] 10:12:34.782618 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25445] 10:12:34.783097 mprotect(0x7fb62301b000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.783126 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.783146 <... mprotect resumed> ) = 0
[pid 25451] 10:12:34.783180 close(11 <unfinished ...>
[pid 25450] 10:12:34.783204 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.783236 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.783250 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.783268 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.783300 mprotect(0x7fdec5898000, 4096, PROT_READ <unfinished ...>
[pid 25451] 10:12:34.783338 <... close resumed> ) = 0
[pid 25450] 10:12:34.783352 <... write resumed> ) = 4
[pid 25449] 10:12:34.783366 close(10 <unfinished ...>
[pid 25445] 10:12:34.783393 mmap(0x7fb62321a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25444] 10:12:34.783423 <... open resumed> ) = 6
[pid 25443] 10:12:34.783439 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.783540 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25451] 10:12:34.783579 fcntl(12, F_GETFD <unfinished ...>
[pid 25450] 10:12:34.783602 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.783626 <... close resumed> ) = 0
[pid 25445] 10:12:34.783639 <... mmap resumed> ) = 0x7fb62321a000
[pid 25444] 10:12:34.783709 read(6,  <unfinished ...>
[pid 25443] 10:12:34.783737 mprotect(0x7fdec5abb000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.783763 read(14,  <unfinished ...>
[pid 25451] 10:12:34.783797 <... fcntl resumed> ) = 0
[pid 25450] 10:12:34.783811 <... write resumed> ) = 4
[pid 25449] 10:12:34.783826 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.783857 close(6 <unfinished ...>
[pid 25444] 10:12:34.783880 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.783903 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.783920 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25451] 10:12:34.783947 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25450] 10:12:34.783978 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.784007 <... open resumed> ) = 10
[pid 25445] 10:12:34.784021 <... close resumed> ) = 0
[pid 25444] 10:12:34.784055 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.784081 munmap(0x7fdec5ab0000, 39387 <unfinished ...>
[pid 25433] 10:12:34.784110 read(14,  <unfinished ...>
[pid 25451] 10:12:34.784143 <... fcntl resumed> ) = 0
[pid 25450] 10:12:34.784157 <... write resumed> ) = 4
[pid 25449] 10:12:34.784187 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.784214 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.784245 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25443] 10:12:34.784282 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.784300 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.784330 geteuid( <unfinished ...>
[pid 25450] 10:12:34.784355 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25449] 10:12:34.784380 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.784406 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.784427 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.784456 set_tid_address(0x7fdec5aa2a90 <unfinished ...>
[pid 25433] 10:12:34.784556 read(14,  <unfinished ...>
[pid 25451] 10:12:34.784597 <... geteuid resumed> ) = 0
[pid 25450] 10:12:34.784612 <... write resumed> ) = 40
[pid 25449] 10:12:34.784628 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.784657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.784690 <... mmap resumed> ) = 0x7f20f8354000
[pid 25443] 10:12:34.784707 <... set_tid_address resumed> ) = 25443
[pid 25433] 10:12:34.784723 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25451] 10:12:34.784751 getegid( <unfinished ...>
[pid 25450] 10:12:34.784772 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.784796 <... mmap resumed> ) = 0x7f81692a0000
[pid 25445] 10:12:34.784810 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.784829 mprotect(0x7f20f835a000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.784856 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25433] 10:12:34.784879 read(14,  <unfinished ...>
[pid 25451] 10:12:34.784912 <... getegid resumed> ) = 12
[pid 25450] 10:12:34.784925 <... write resumed> ) = 4
[pid 25449] 10:12:34.784993 read(10,  <unfinished ...>
[pid 25445] 10:12:34.785029 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.785061 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.785077 <... set_robust_list resumed> ) = 0
[pid 25433] 10:12:34.785093 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.785121 setgid(500 <unfinished ...>
[pid 25450] 10:12:34.785143 close(15 <unfinished ...>
[pid 25449] 10:12:34.785165 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25445] 10:12:34.785183 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.785231 mmap(0x7f20f8559000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25443] 10:12:34.785264 futex(0x7ffd9475d95c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25433] 10:12:34.785289 wait4(-1,  <unfinished ...>
[pid 25451] 10:12:34.785320 <... setgid resumed> ) = 0
[pid 25450] 10:12:34.785335 <... close resumed> ) = 0
[pid 25449] 10:12:34.785351 close(10 <unfinished ...>
[pid 25445] 10:12:34.785386 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.785418 <... mmap resumed> ) = 0x7f20f8559000
[pid 25443] 10:12:34.785439 <... futex resumed> ) = 0
[pid 25451] 10:12:34.785464 setuid(503 <unfinished ...>
[pid 25450] 10:12:34.785548 exit_group(0) = ?
[pid 25449] 10:12:34.785564 <... close resumed> ) = 0
[pid 25445] 10:12:34.785826 <... open resumed> ) = 6
[pid 25444] 10:12:34.785848 close(6 <unfinished ...>
[pid 25443] 10:12:34.785872 futex(0x7ffd9475d95c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fdec5aa27c0 <unfinished ...>
[pid 25451] 10:12:34.785919 <... setuid resumed> ) = 0
[pid 25450] 10:12:34.785932 +++ exited with 0 +++
[pid 25449] 10:12:34.785946 munmap(0x7f81692a0000, 4096 <unfinished ...>
[pid 25445] 10:12:34.785972 read(6,  <unfinished ...>
[pid 25444] 10:12:34.785996 <... close resumed> ) = 0
[pid 25443] 10:12:34.786018 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25433] 10:12:34.786041 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25450
[pid 25451] 10:12:34.786070 chdir("/" <unfinished ...>
[pid 25449] 10:12:34.786094 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.786108 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.786173 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.786207 rt_sigaction(SIGRTMIN, {0x7fdec4965c60, [], SA_RESTORER|SA_SIGINFO, 0x7fdec496f790},  <unfinished ...>
[pid 25433] 10:12:34.786235 close(14 <unfinished ...>
[pid 25451] 10:12:34.786270 <... chdir resumed> ) = 0
[pid 25449] 10:12:34.786284 stat("/etc/mailips",  <unfinished ...>
[pid 25445] 10:12:34.786338 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.786364 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.786382 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.786399 <... close resumed> ) = 0
[pid 25451] 10:12:34.786425 geteuid( <unfinished ...>
[pid 25449] 10:12:34.786447 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.786563 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.786604 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.786640 rt_sigaction(SIGRT_1, {0x7fdec4965cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fdec496f790},  <unfinished ...>
[pid 25433] 10:12:34.786669 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25451] 10:12:34.786705 <... geteuid resumed> ) = 503
[pid 25449] 10:12:34.786718 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.786746 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.786778 <... open resumed> ) = 6
[pid 25443] 10:12:34.786794 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.786810 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25451] 10:12:34.786862 getegid( <unfinished ...>
[pid 25449] 10:12:34.786887 <... open resumed> ) = 10
[pid 25445] 10:12:34.786900 <... mmap resumed> ) = 0x7fb622e0e000
[pid 25444] 10:12:34.786922 read(6,  <unfinished ...>
[pid 25443] 10:12:34.786945 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25433] 10:12:34.786971 stat("/etc/userdomains",  <unfinished ...>
[pid 25451] 10:12:34.787006 <... getegid resumed> ) = 500
[pid 25449] 10:12:34.787025 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.787079 mprotect(0x7fb622e10000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.787107 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.787131 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25433] 10:12:34.787157 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.787209 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25449] 10:12:34.787241 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.787267 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.787305 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.787331 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25433] 10:12:34.787355 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25451] 10:12:34.787392 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25449] 10:12:34.787418 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.787443 mmap(0x7fb62300f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25444] 10:12:34.787551 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.787588 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25433] 10:12:34.787644 <... open resumed> ) = 9
[pid 25451] 10:12:34.787672 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25449] 10:12:34.787700 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.787725 <... mmap resumed> ) = 0x7fb62300f000
[pid 25444] 10:12:34.787751 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.787780 statfs("/selinux",  <unfinished ...>
[pid 25433] 10:12:34.787814 fstat(9,  <unfinished ...>
[pid 25451] 10:12:34.787846 <... chdir resumed> ) = 0
[pid 25449] 10:12:34.787860 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.787887 close(6 <unfinished ...>
[pid 25444] 10:12:34.787910 <... mmap resumed> ) = 0x7f20f9ca9000
[pid 25443] 10:12:34.787930 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350350, f_bavail=6350350, f_files=1000000, f_ffree=691111, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25433] 10:12:34.787997 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.788047 stat("tmp",  <unfinished ...>
[pid 25449] 10:12:34.788076 <... mmap resumed> ) = 0x7f81692a0000
[pid 25445] 10:12:34.788090 <... close resumed> ) = 0
[pid 25444] 10:12:34.788117 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.788146 brk(0 <unfinished ...>
[pid 25433] 10:12:34.788169 fstat(9,  <unfinished ...>
[pid 25451] 10:12:34.788200 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25449] 10:12:34.788226 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.788250 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.788276 <... mmap resumed> ) = 0x7f20f801e000
[pid 25443] 10:12:34.788292 <... brk resumed> ) = 0x1c31000
[pid 25433] 10:12:34.788312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.788363 stat("new",  <unfinished ...>
[pid 25449] 10:12:34.788390 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.788403 <... mmap resumed> ) = 0x7fb627054000
[pid 25444] 10:12:34.788438 mprotect(0x7f20f814a000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.788468 brk(0x1c52000 <unfinished ...>
[pid 25433] 10:12:34.788576 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25451] 10:12:34.788614 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25449] 10:12:34.788640 read(10,  <unfinished ...>
[pid 25445] 10:12:34.788665 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.788696 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.788712 <... brk resumed> ) = 0x1c52000
[pid 25433] 10:12:34.788738 <... mmap resumed> ) = 0x7fea0f284000
[pid 25451] 10:12:34.788764 stat("cur",  <unfinished ...>
[pid 25449] 10:12:34.788791 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.788805 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.788998 mmap(0x7f20f834a000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25443] 10:12:34.789035 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.789073 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25451] 10:12:34.789107 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25449] 10:12:34.789201 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.789235 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.789268 <... mmap resumed> ) = 0x7f20f834a000
[pid 25443] 10:12:34.789288 <... open resumed> ) = 6
[pid 25433] 10:12:34.789317 <... lseek resumed> ) = 0
[pid 25451] 10:12:34.789344 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25449] 10:12:34.789377 <... open resumed> ) = 11
[pid 25445] 10:12:34.789391 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.789412 mmap(0x7f20f8353000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.789449 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.789472 read(9,  <unfinished ...>
[pid 25451] 10:12:34.789585 <... open resumed> ) = 11
[pid 25449] 10:12:34.789605 fstat(11,  <unfinished ...>
[pid 25445] 10:12:34.789633 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.789672 <... mmap resumed> ) = 0x7f20f8353000
[pid 25443] 10:12:34.789694 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25433] 10:12:34.789726 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25451] 10:12:34.789773 read(11,  <unfinished ...>
[pid 25449] 10:12:34.789802 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.789827 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.789848 close(6 <unfinished ...>
[pid 25443] 10:12:34.789871 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.789897 stat("/etc/userdomains",  <unfinished ...>
[pid 25451] 10:12:34.789932 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4095
[pid 25449] 10:12:34.790024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.790052 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.790082 <... close resumed> ) = 0
[pid 25443] 10:12:34.790105 <... mmap resumed> ) = 0x7fdec5ab9000
[pid 25433] 10:12:34.790123 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.790171 stat("tmp/1451491954.H790016P25451.fin.finestweddingsites.com",  <unfinished ...>
[pid 25449] 10:12:34.790206 <... mmap resumed> ) = 0x7f816929f000
[pid 25445] 10:12:34.790220 <... open resumed> ) = 6
[pid 25444] 10:12:34.790237 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.790267 read(6,  <unfinished ...>
[pid 25433] 10:12:34.790358 stat("/etc/userdomains",  <unfinished ...>
[pid 25451] 10:12:34.790395 <... stat resumed> 0x7fffbdaacdc0) = -1 ENOENT (No such file or directory)
[pid 25449] 10:12:34.790415 read(11,  <unfinished ...>
[pid 25445] 10:12:34.790442 read(6,  <unfinished ...>
[pid 25444] 10:12:34.790466 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.790561 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25433] 10:12:34.790595 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.790666 open("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25449] 10:12:34.790733 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.790758 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.790795 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.790828 read(6,  <unfinished ...>
[pid 25433] 10:12:34.790851 stat("/home/finest09/etc/finestweddingsites.com/hillcrestgolfclub/filter",  <unfinished ...>
[pid 25451] 10:12:34.790890 <... open resumed> ) = 14
[pid 25449] 10:12:34.790912 close(11 <unfinished ...>
[pid 25445] 10:12:34.790936 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.790959 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.790976 <... read resumed> "", 1024) = 0
[pid 25433] 10:12:34.791000 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25451] 10:12:34.791031 chown("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25449] 10:12:34.791065 <... close resumed> ) = 0
[pid 25445] 10:12:34.791079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.791111 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.791141 close(6 <unfinished ...>
[pid 25433] 10:12:34.791168 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25451] 10:12:34.791204 <... chown resumed> ) = 0
[pid 25449] 10:12:34.791224 munmap(0x7f816929f000, 4096 <unfinished ...>
[pid 25445] 10:12:34.791252 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25444] 10:12:34.791284 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.791302 <... close resumed> ) = 0
[pid 25433] 10:12:34.791320 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25451] 10:12:34.791373 chmod("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25449] 10:12:34.791407 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.791420 <... mmap resumed> ) = 0x7fb622bef000
[pid 25444] 10:12:34.791473 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.791626 munmap(0x7fdec5ab9000, 4096 <unfinished ...>
[pid 25433] 10:12:34.791663 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25451] 10:12:34.791713 <... chmod resumed> ) = 0
[pid 25449] 10:12:34.791736 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.791773 mprotect(0x7fb622c0c000, 2093056, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.791809 <... open resumed> ) = 6
[pid 25443] 10:12:34.791830 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.791909 <... open resumed> ) = 10
[pid 25451] 10:12:34.791949 chown("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25449] 10:12:34.791991 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25445] 10:12:34.792018 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.792181 read(6,  <unfinished ...>
[pid 25443] 10:12:34.792226 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25433] 10:12:34.792281 fstat(10,  <unfinished ...>
[pid 25451] 10:12:34.792335 <... chown resumed> ) = 0
[pid 25449] 10:12:34.792361 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.792398 mmap(0x7fb622e0b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25444] 10:12:34.792448 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.792567 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.792686 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25451] 10:12:34.792754 chmod("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25449] 10:12:34.792804 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.792825 <... mmap resumed> ) = 0x7fb622e0b000
[pid 25444] 10:12:34.792875 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.792914 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fdec496f790},  <unfinished ...>
[pid 25433] 10:12:34.792958 fstat(10,  <unfinished ...>
[pid 25451] 10:12:34.793016 <... chmod resumed> ) = 0
[pid 25449] 10:12:34.793081 read(10,  <unfinished ...>
[pid 25445] 10:12:34.793120 mmap(0x7fb622e0d000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.793166 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.793218 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.793257 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25428] 10:12:34.793306 <... select resumed> ) = 1 (in [11], left {299, 911188})
[pid 25451] 10:12:34.793370 stat("/etc/localtime",  <unfinished ...>
[pid 25449] 10:12:34.793420 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.793448 <... mmap resumed> ) = 0x7fb622e0d000
[pid 25444] 10:12:34.793569 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.793616 fstat(2,  <unfinished ...>
[pid 25433] 10:12:34.793649 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.793677 read(11,  <unfinished ...>
[pid 25451] 10:12:34.793714 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25449] 10:12:34.793781 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.793806 close(6 <unfinished ...>
[pid 25444] 10:12:34.793829 <... mmap resumed> ) = 0x7f20f7e1a000
[pid 25443] 10:12:34.793845 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25433] 10:12:34.793911 <... mmap resumed> ) = 0x7fea0f283000
[pid 25428] 10:12:34.793931 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25451] 10:12:34.793962 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25449] 10:12:34.793987 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.794000 <... close resumed> ) = 0
[pid 25444] 10:12:34.794056 mprotect(0x7f20f7e1c000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.794085 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fdec496f790},  <unfinished ...>
[pid 25433] 10:12:34.794113 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25428] 10:12:34.794136 read(11,  <unfinished ...>
[pid 25451] 10:12:34.794171 <... lseek resumed> ) = 19
[pid 25449] 10:12:34.794187 read(10,  <unfinished ...>
[pid 25445] 10:12:34.794210 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.794236 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.794252 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.794272 <... lseek resumed> ) = 0
[pid 25428] 10:12:34.794290 <... read resumed> "4&\246\311\203]\f\367\246F\360{\330\236\0\354RT^\375\200\350Q\303\264\214\336s\32\253\270\331", 32) = 32
[pid 25451] 10:12:34.794328 read(6,  <unfinished ...>
[pid 25449] 10:12:34.794359 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.794400 <... mmap resumed> ) = 0x7fb627053000
[pid 25444] 10:12:34.794458 mmap(0x7f20f801c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25443] 10:12:34.794560 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:34.794591 read(10,  <unfinished ...>
[pid 25428] 10:12:34.794619 read(11,  <unfinished ...>
[pid 25451] 10:12:34.794654 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25449] 10:12:34.794684 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25445] 10:12:34.794724 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.794755 <... mmap resumed> ) = 0x7f20f801c000
[pid 25443] 10:12:34.794781 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25433] 10:12:34.794802 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25428] 10:12:34.794828 <... read resumed> "\27\3\1\0P", 5) = 5
[pid 25451] 10:12:34.794858 read(6,  <unfinished ...>
[pid 25449] 10:12:34.794881 <... open resumed> ) = 11
[pid 25445] 10:12:34.794898 <... mmap resumed> ) = 0x7fb627052000
[pid 25444] 10:12:34.794925 close(6 <unfinished ...>
[pid 25443] 10:12:34.794949 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:34.794975 read(10,  <unfinished ...>
[pid 25428] 10:12:34.794998 read(11,  <unfinished ...>
[pid 25451] 10:12:34.795033 <... read resumed> "", 8192) = 0
[pid 25449] 10:12:34.795050 alarm(60 <unfinished ...>
[pid 25445] 10:12:34.795076 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.795101 <... close resumed> ) = 0
[pid 25443] 10:12:34.795123 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25433] 10:12:34.795143 <... read resumed> "", 4096) = 0
[pid 25428] 10:12:34.795181 <... read resumed> "9Th|\0319\352\376\323\206\365\340\260\272\5\307m\256\350\253\27(&\223|\1\223\276\37\1\0366\3556\257\320\313/J\235R\355\237\321s\345\t4w\250woa\263M\331@:7[R\207N>\261%m\236Vh\212W@\304Q\367\37\232\244\366", 80) = 80
[pid 25451] 10:12:34.795242 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:34 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2518 <unfinished ...>
[pid 25449] 10:12:34.795281 <... alarm resumed> ) = 0
[pid 25445] 10:12:34.795298 <... mmap resumed> ) = 0x7fb627050000
[pid 25444] 10:12:34.795318 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.795350 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fdec496f790},  <unfinished ...>
[pid 25433] 10:12:34.795376 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25428] 10:12:34.795405 write(11, "\27\3\1\0 n\267\366\300\200\304Z\376\f\343\206\215\4\211\213\333_wi\311\7\v4\337\264V\1X>\326\201:\27\3\1\0@wA:B\t$\304\t\31\215\360+\300\f$;\235\23$\214\3059\337\372\263P\342\250\17\324+\2\233!I\2547\34\233\232\30~\355j;w\362\210;\361\"0\264\242j\324H\257T\267\334\322\276\221", 106 <unfinished ...>
[pid 25451] 10:12:34.795468 <... write resumed> ) = 2518
[pid 25449] 10:12:34.795572 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25445] 10:12:34.795608 arch_prctl(ARCH_SET_FS, 0x7fb6270507c0 <unfinished ...>
[pid 25444] 10:12:34.795631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.795649 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:34.795677 <... open resumed> ) = 11
[pid 25428] 10:12:34.795698 <... write resumed> ) = 106
[pid 25451] 10:12:34.795733 fsync(14 <unfinished ...>
[pid 25449] 10:12:34.795805 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.795823 <... arch_prctl resumed> ) = 0
[pid 25444] 10:12:34.795881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.795986 umask(0 <unfinished ...>
[pid 25433] 10:12:34.796009 fstat(11,  <unfinished ...>
[pid 25428] 10:12:34.796032 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25449] 10:12:34.796070 alarm(0 <unfinished ...>
[pid 25445] 10:12:34.796093 mprotect(0x7fb622e0b000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.796119 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.796137 <... umask resumed> ) = 0
[pid 25433] 10:12:34.796194 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25451] 10:12:34.796237 <... fsync resumed> ) = 0
[pid 25449] 10:12:34.796256 <... alarm resumed> ) = 60
[pid 25445] 10:12:34.796345 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.796371 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.796405 geteuid( <unfinished ...>
[pid 25433] 10:12:34.796427 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25451] 10:12:34.796464 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25449] 10:12:34.796555 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25445] 10:12:34.796589 mprotect(0x7fb62300f000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.796617 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.796637 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.796657 <... mmap resumed> ) = 0x7fea0f282000
[pid 25451] 10:12:34.796683 <... lseek resumed> ) = 4095
[pid 25449] 10:12:34.796700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25445] 10:12:34.796741 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.796776 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.796816 getuid( <unfinished ...>
[pid 25433] 10:12:34.796839 read(11,  <unfinished ...>
[pid 25451] 10:12:34.796874 write(11, "2518 1\n", 7 <unfinished ...>
[pid 25449] 10:12:34.796910 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.796941 mprotect(0x7fb62321a000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.796968 <... open resumed> ) = 6
[pid 25443] 10:12:34.796984 <... getuid resumed> ) = 47
[pid 25433] 10:12:34.797003 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25451] 10:12:34.797044 <... write resumed> ) = 7
[pid 25449] 10:12:34.797061 <... open resumed> ) = 13
[pid 25445] 10:12:34.797078 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.797102 read(6,  <unfinished ...>
[pid 25443] 10:12:34.797126 getgid( <unfinished ...>
[pid 25433] 10:12:34.797148 close(11 <unfinished ...>
[pid 25451] 10:12:34.797181 close(11 <unfinished ...>
[pid 25449] 10:12:34.797205 fcntl(13, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.797228 mprotect(0x7fb623430000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.797254 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.797277 <... getgid resumed> ) = 12
[pid 25433] 10:12:34.797320 <... close resumed> ) = 0
[pid 25451] 10:12:34.797346 <... close resumed> ) = 0
[pid 25449] 10:12:34.797368 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.797386 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.797414 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.797440 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25433] 10:12:34.797463 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25451] 10:12:34.797589 fstat(14,  <unfinished ...>
[pid 25449] 10:12:34.797615 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.797639 mprotect(0x7fb62365b000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.797665 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.797697 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25433] 10:12:34.797716 <... munmap resumed> ) = 0
[pid 25451] 10:12:34.797759 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179006, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2518, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25449] 10:12:34.797801 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.797822 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.797849 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.797880 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25433] 10:12:34.797903 stat("/etc/userdomains",  <unfinished ...>
[pid 25451] 10:12:34.797938 close(14 <unfinished ...>
[pid 25449] 10:12:34.797964 read(13,  <unfinished ...>
[pid 25445] 10:12:34.797987 mprotect(0x7fb623860000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.798014 <... mmap resumed> ) = 0x7f20f7c17000
[pid 25443] 10:12:34.798030 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25433] 10:12:34.798056 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25451] 10:12:34.798112 <... close resumed> ) = 0
[pid 25449] 10:12:34.798142 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25445] 10:12:34.798173 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.798289 mprotect(0x7f20f7c19000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.798319 getgroups(65536,  <unfinished ...>
[pid 25433] 10:12:34.798342 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25451] 10:12:34.798382 rename("tmp/1451491954.H790016P25451.fin.finestweddingsites.com", "new/1451491954.H790016P25451.fin.finestweddingsites.com,S=2518" <unfinished ...>
[pid 25449] 10:12:34.798436 close(13 <unfinished ...>
[pid 25445] 10:12:34.798462 mprotect(0x7fb623b3d000, 40960, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.798568 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.798587 <... getgroups resumed> [12]) = 1
[pid 25433] 10:12:34.798612 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25451] 10:12:34.798663 <... rename resumed> ) = 0
[pid 25449] 10:12:34.798684 <... close resumed> ) = 0
[pid 25445] 10:12:34.798711 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.798812 mmap(0x7f20f7e18000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25443] 10:12:34.798847 setgroups(0, [] <unfinished ...>
[pid 25433] 10:12:34.798871 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25451] 10:12:34.798910 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.798942 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.798970 mprotect(0x7fb623d8a000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.798997 <... mmap resumed> ) = 0x7f20f7e18000
[pid 25443] 10:12:34.799021 <... setgroups resumed> ) = 0
[pid 25433] 10:12:34.799042 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25451] 10:12:34.799106 <... write resumed> ) = 4
[pid 25449] 10:12:34.799127 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.799146 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.799174 close(6 <unfinished ...>
[pid 25443] 10:12:34.799198 getegid( <unfinished ...>
[pid 25433] 10:12:34.799220 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.799251 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.799283 write(12, "\326\t\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.799309 stat("/var/tmp",  <unfinished ...>
[pid 25445] 10:12:34.799350 mprotect(0x7fb623fa4000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.799381 <... close resumed> ) = 0
[pid 25443] 10:12:34.799405 <... getegid resumed> ) = 12
[pid 25433] 10:12:34.799423 <... open resumed> ) = 11
[pid 25425] 10:12:34.799447 read(11,  <unfinished ...>
[pid 25451] 10:12:34.799557 <... write resumed> ) = 4
[pid 25449] 10:12:34.799576 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25445] 10:12:34.799821 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.799848 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.799881 geteuid( <unfinished ...>
[pid 25433] 10:12:34.799904 fstat(11,  <unfinished ...>
[pid 25425] 10:12:34.799927 <... read resumed> "\326\t\0\0", 4) = 4
[pid 25451] 10:12:34.799955 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.799980 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.800010 mprotect(0x7fb6241b1000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.800037 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.800055 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.800078 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.800112 read(11,  <unfinished ...>
[pid 25451] 10:12:34.800147 <... write resumed> ) = 4
[pid 25449] 10:12:34.800163 <... open resumed> ) = 13
[pid 25445] 10:12:34.800180 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.800379 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.800414 geteuid( <unfinished ...>
[pid 25433] 10:12:34.800438 fstat(11,  <unfinished ...>
[pid 25425] 10:12:34.800461 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25451] 10:12:34.800562 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.800597 fcntl(13, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.800620 mprotect(0x7fb62499d000, 110592, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.800647 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.800665 <... geteuid resumed> ) = 0
[pid 25433] 10:12:34.800682 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.800710 read(11,  <unfinished ...>
[pid 25451] 10:12:34.800747 <... write resumed> ) = 4
[pid 25449] 10:12:34.800763 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.800780 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.800862 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.800895 getegid( <unfinished ...>
[pid 25433] 10:12:34.800917 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.800943 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.800971 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.800996 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.801019 mprotect(0x7fb624c29000, 16384, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.801045 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.801064 <... getegid resumed> ) = 12
[pid 25433] 10:12:34.801086 <... mmap resumed> ) = 0x7fea0f282000
[pid 25425] 10:12:34.801104 read(11,  <unfinished ...>
[pid 25451] 10:12:34.801137 <... write resumed> ) = 4
[pid 25449] 10:12:34.801153 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.801170 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.801267 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.801303 setgid(12 <unfinished ...>
[pid 25433] 10:12:34.801328 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.801351 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.801379 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.801404 fstat(13,  <unfinished ...>
[pid 25445] 10:12:34.801433 mprotect(0x7fb624fbe000, 16384, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.801460 <... open resumed> ) = 6
[pid 25443] 10:12:34.801536 <... setgid resumed> ) = 0
[pid 25433] 10:12:34.801563 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.801581 read(11,  <unfinished ...>
[pid 25451] 10:12:34.801615 <... write resumed> ) = 4
[pid 25449] 10:12:34.801631 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25445] 10:12:34.801693 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.801717 read(6,  <unfinished ...>
[pid 25443] 10:12:34.801744 setuid(0 <unfinished ...>
[pid 25433] 10:12:34.801768 read(11,  <unfinished ...>
[pid 25425] 10:12:34.801795 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.801823 write(12, "\260\0239\2\0\0\0\0", 8 <unfinished ...>
[pid 25449] 10:12:34.801853 pread(13,  <unfinished ...>
[pid 25445] 10:12:34.801883 mprotect(0x7fb6251c9000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.801909 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.801933 <... setuid resumed> ) = 0
[pid 25433] 10:12:34.801981 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25425] 10:12:34.802011 read(11,  <unfinished ...>
[pid 25451] 10:12:34.802046 <... write resumed> ) = 8
[pid 25449] 10:12:34.802062 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25445] 10:12:34.802113 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.802141 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.802166 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.802196 read(11,  <unfinished ...>
[pid 25425] 10:12:34.802219 <... read resumed> "\260\0239\2\0\0\0\0", 8) = 8
[pid 25451] 10:12:34.802247 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.802272 pread(13,  <unfinished ...>
[pid 25445] 10:12:34.802296 mprotect(0x7fb6253cd000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.802322 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25443] 10:12:34.802352 <... open resumed> ) = 6
[pid 25433] 10:12:34.802386 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.802418 read(11,  <unfinished ...>
[pid 25451] 10:12:34.802455 <... write resumed> ) = 4
[pid 25449] 10:12:34.802472 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25445] 10:12:34.802598 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.803273 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.803311 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.803335 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.803362 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.803392 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25449] 10:12:34.803419 close(13 <unfinished ...>
[pid 25445] 10:12:34.803444 mprotect(0x7fb626125000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.803470 <... mmap resumed> ) = 0x7f20f9ca8000
[pid 25443] 10:12:34.803535 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.803574 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.803612 read(11,  <unfinished ...>
[pid 25451] 10:12:34.803648 <... write resumed> ) = 4
[pid 25449] 10:12:34.803664 <... close resumed> ) = 0
[pid 25445] 10:12:34.803705 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.803746 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.803788 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.803812 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25425] 10:12:34.803841 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25451] 10:12:34.803869 close(12 <unfinished ...>
[pid 25449] 10:12:34.803894 close(11 <unfinished ...>
[pid 25445] 10:12:34.803920 mprotect(0x7fb62655a000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.803947 <... mmap resumed> ) = 0x7f20f7883000
[pid 25443] 10:12:34.803963 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:34.803992 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:34.804032 close(11 <unfinished ...>
[pid 25451] 10:12:34.804072 <... close resumed> ) = 0
[pid 25449] 10:12:34.804090 <... close resumed> ) = 0
[pid 25445] 10:12:34.804132 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.804158 mprotect(0x7f20f7a0d000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.804187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.804214 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25425] 10:12:34.804242 <... close resumed> ) = 0
[pid 25451] 10:12:34.804279 close(10 <unfinished ...>
[pid 25449] 10:12:34.804306 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25445] 10:12:34.804336 mprotect(0x7fb6267de000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.804363 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.804380 <... mmap resumed> ) = 0x7fdec5ab9000
[pid 25433] 10:12:34.804399 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.804464 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25451] 10:12:34.804592 <... close resumed> ) = 0
[pid 25449] 10:12:34.804611 <... socket resumed> ) = 11
[pid 25445] 10:12:34.804636 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.804657 mmap(0x7f20f7c0d000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25443] 10:12:34.804690 read(6,  <unfinished ...>
[pid 25433] 10:12:34.804719 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.804749 <... write resumed> ) = 28
[pid 25451] 10:12:34.804776 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25449] 10:12:34.804805 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25445] 10:12:34.804832 mprotect(0x7fb6269e7000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.804859 <... mmap resumed> ) = 0x7f20f7c0d000
[pid 25443] 10:12:34.804881 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25433] 10:12:34.805007 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.805060 fsync(9 <unfinished ...>
[pid 25451] 10:12:34.805121 <... munmap resumed> ) = 0
[pid 25449] 10:12:34.805140 <... setsockopt resumed> ) = 0
[pid 25445] 10:12:34.805176 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.805271 mmap(0x7f20f7c12000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.805303 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.805334 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25451] 10:12:34.805372 close(13 <unfinished ...>
[pid 25449] 10:12:34.805403 alarm(300 <unfinished ...>
[pid 25445] 10:12:34.805428 mprotect(0x7fb626c2c000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.805454 <... mmap resumed> ) = 0x7f20f7c12000
[pid 25443] 10:12:34.805543 <... socket resumed> ) = 7
[pid 25433] 10:12:34.805568 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25451] 10:12:34.805632 <... close resumed> ) = 0
[pid 25449] 10:12:34.805652 <... alarm resumed> ) = 0
[pid 25445] 10:12:34.805675 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.805700 close(6 <unfinished ...>
[pid 25443] 10:12:34.805724 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.805765 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:34.805791 <... fsync resumed> ) = 0
[pid 25451] 10:12:34.805817 munmap(0x7f380d423000, 4096 <unfinished ...>
[pid 25449] 10:12:34.805846 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("69.53.212.18")}, 16 <unfinished ...>
[pid 25445] 10:12:34.805927 mprotect(0x7fb626e46000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.805957 <... close resumed> ) = 0
[pid 25443] 10:12:34.805982 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.806001 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.806039 wait4(-1,  <unfinished ...>
[pid 25451] 10:12:34.806072 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.806552 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.806604 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.806639 close(7 <unfinished ...>
[pid 25433] 10:12:34.806667 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25451] 10:12:34.806703 exit_group(0) = ?
[pid 25445] 10:12:34.807042 mprotect(0x7fb627069000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.807074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.807092 <... close resumed> ) = 0
[pid 25433] 10:12:34.807109 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25451] 10:12:34.807227 +++ exited with 0 +++
[pid 25445] 10:12:34.807245 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.807262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.807297 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.807325 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.807348 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25451
[pid 25445] 10:12:34.807410 munmap(0x7fb62705e000, 39387 <unfinished ...>
[pid 25444] 10:12:34.807444 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.807462 <... socket resumed> ) = 7
[pid 25433] 10:12:34.807538 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.807562 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.807601 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.807617 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.807648 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.807680 read(10,  <unfinished ...>
[pid 25425] 10:12:34.807704 <... open resumed> ) = 10
[pid 25445] 10:12:34.807731 set_tid_address(0x7fb627050a90 <unfinished ...>
[pid 25444] 10:12:34.807766 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.807787 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.807804 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25425] 10:12:34.807839 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.807872 <... set_tid_address resumed> ) = 25445
[pid 25444] 10:12:34.807892 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.807930 close(7 <unfinished ...>
[pid 25433] 10:12:34.807957 read(10,  <unfinished ...>
[pid 25425] 10:12:34.807980 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.808022 set_robust_list(0x7fb627050aa0, 24 <unfinished ...>
[pid 25444] 10:12:34.808047 <... open resumed> ) = 6
[pid 25443] 10:12:34.808063 <... close resumed> ) = 0
[pid 25433] 10:12:34.808087 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.808134 fstat(10,  <unfinished ...>
[pid 25445] 10:12:34.808169 <... set_robust_list resumed> ) = 0
[pid 25444] 10:12:34.808185 read(6,  <unfinished ...>
[pid 25443] 10:12:34.808208 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.808237 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.808265 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.808307 futex(0x7ffe578e048c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25444] 10:12:34.808332 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.808355 <... open resumed> ) = 7
[pid 25433] 10:12:34.808374 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25425] 10:12:34.808416 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.808452 <... futex resumed> ) = 0
[pid 25444] 10:12:34.808468 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.808575 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.808600 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.808630 <... mmap resumed> ) = 0x7f380d424000
[pid 25445] 10:12:34.808655 futex(0x7ffe578e048c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fb6270507c0 <unfinished ...>
[pid 25444] 10:12:34.808680 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25443] 10:12:34.808711 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25433] 10:12:34.808741 <... open resumed> ) = 12
[pid 25425] 10:12:34.808758 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.808792 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25444] 10:12:34.808817 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.808851 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.808877 fstat(12,  <unfinished ...>
[pid 25425] 10:12:34.808900 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.808924 rt_sigaction(SIGRTMIN, {0x7fb625f13c60, [], SA_RESTORER|SA_SIGINFO, 0x7fb625f1d790},  <unfinished ...>
[pid 25444] 10:12:34.808953 <... mmap resumed> ) = 0x7f20f7617000
[pid 25443] 10:12:34.808969 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:34.808986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25425] 10:12:34.809016 read(10,  <unfinished ...>
[pid 25445] 10:12:34.809051 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25444] 10:12:34.809068 mprotect(0x7f20f7679000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.809095 read(7,  <unfinished ...>
[pid 25433] 10:12:34.809122 fstat(12,  <unfinished ...>
[pid 25425] 10:12:34.809145 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25445] 10:12:34.809203 rt_sigaction(SIGRT_1, {0x7fb625f13cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fb625f1d790},  <unfinished ...>
[pid 25444] 10:12:34.809236 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.809252 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25433] 10:12:34.809288 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25425] 10:12:34.809318 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.809354 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25444] 10:12:34.809370 mmap(0x7f20f7878000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25443] 10:12:34.809401 read(7,  <unfinished ...>
[pid 25433] 10:12:34.809424 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.809451 <... stat resumed> 0x7fffbdaabb10) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.809600 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25444] 10:12:34.809637 <... mmap resumed> ) = 0x7f20f7878000
[pid 25443] 10:12:34.809663 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:34.809683 <... mmap resumed> ) = 0x7fea0f281000
[pid 25425] 10:12:34.809700 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.809734 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25444] 10:12:34.809758 close(6 <unfinished ...>
[pid 25443] 10:12:34.809782 close(7 <unfinished ...>
[pid 25433] 10:12:34.809807 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.809837 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.809893 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25444] 10:12:34.809923 <... close resumed> ) = 0
[pid 25443] 10:12:34.809949 <... close resumed> ) = 0
[pid 25433] 10:12:34.809967 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.809983 write(8, "2015-12-30 10:12:34 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25445] 10:12:34.810023 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25444] 10:12:34.810077 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.810110 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:34.810138 read(12,  <unfinished ...>
[pid 25425] 10:12:34.810161 <... write resumed> ) = 126
[pid 25445] 10:12:34.810193 statfs("/selinux",  <unfinished ...>
[pid 25444] 10:12:34.810226 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.810243 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.810274 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.810301 write(8, "2015-12-30 10:12:34 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25445] 10:12:34.810338 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350349, f_bavail=6350349, f_files=1000000, f_ffree=691110, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25444] 10:12:34.810403 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.810441 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.810471 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:34.810574 <... write resumed> ) = 77
[pid 25445] 10:12:34.810614 brk(0 <unfinished ...>
[pid 25444] 10:12:34.810640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.810658 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.810675 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:34.810722 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.810758 <... brk resumed> ) = 0x1332000
[pid 25444] 10:12:34.810774 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.810810 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.810849 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:34.810884 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.810935 brk(0x1353000 <unfinished ...>
[pid 25444] 10:12:34.810962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.810981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.810998 <... open resumed> ) = 13
[pid 25425] 10:12:34.811015 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.811049 <... brk resumed> ) = 0x1353000
[pid 25444] 10:12:34.811074 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.811107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.811138 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.811161 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.811200 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.811236 <... open resumed> ) = 6
[pid 25443] 10:12:34.811251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.811268 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:34.811296 close(7 <unfinished ...>
[pid 25445] 10:12:34.811328 <... open resumed> ) = 6
[pid 25444] 10:12:34.811355 read(6,  <unfinished ...>
[pid 25443] 10:12:34.811381 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.811410 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.811437 <... close resumed> ) = 0
[pid 25445] 10:12:34.811463 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.811586 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.811613 <... open resumed> ) = 7
[pid 25433] 10:12:34.811630 <... mmap resumed> ) = 0x7fea0f280000
[pid 25425] 10:12:34.811647 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.811694 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.811724 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.811748 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.811771 read(13,  <unfinished ...>
[pid 25425] 10:12:34.811800 <... open resumed> ) = 7
[pid 25445] 10:12:34.811830 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.811861 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25443] 10:12:34.811897 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25433] 10:12:34.811926 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:34.811957 fcntl(7, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.811989 <... mmap resumed> ) = 0x7fb627067000
[pid 25444] 10:12:34.812006 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.812036 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25433] 10:12:34.812062 close(13 <unfinished ...>
[pid 25425] 10:12:34.812086 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.812110 read(6,  <unfinished ...>
[pid 25444] 10:12:34.812163 <... mmap resumed> ) = 0x7f20f7234000
[pid 25443] 10:12:34.812181 <... mmap resumed> ) = 0x7fdec5a98000
[pid 25433] 10:12:34.812198 <... close resumed> ) = 0
[pid 25425] 10:12:34.812214 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.812244 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25444] 10:12:34.812273 mprotect(0x7f20f73ed000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.812301 close(7 <unfinished ...>
[pid 25433] 10:12:34.812324 munmap(0x7fea0f280000, 4096 <unfinished ...>
[pid 25425] 10:12:34.812351 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.812375 read(6,  <unfinished ...>
[pid 25444] 10:12:34.812398 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.812413 <... close resumed> ) = 0
[pid 25433] 10:12:34.812439 <... munmap resumed> ) = 0
[pid 25425] 10:12:34.812557 fstat(7,  <unfinished ...>
[pid 25445] 10:12:34.812596 <... read resumed> "", 1024) = 0
[pid 25444] 10:12:34.812620 mmap(0x7f20f75ec000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25443] 10:12:34.812652 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.812685 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25425] 10:12:34.812714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368273, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.812754 close(6 <unfinished ...>
[pid 25444] 10:12:34.812781 <... mmap resumed> ) = 0x7f20f75ec000
[pid 25443] 10:12:34.812803 <... open resumed> ) = 7
[pid 25433] 10:12:34.812822 <... open resumed> ) = 13
[pid 25425] 10:12:34.812843 write(7, "2015-12-30 10:12:34 [25425] 1aEJMY-0006bs-1f => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2518 QT=0s "..., 262 <unfinished ...>
[pid 25445] 10:12:34.812899 <... close resumed> ) = 0
[pid 25444] 10:12:34.812918 mmap(0x7f20f7613000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.812947 read(7,  <unfinished ...>
[pid 25433] 10:12:34.812971 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.812993 <... write resumed> ) = 262
[pid 25445] 10:12:34.813055 munmap(0x7fb627067000, 4096 <unfinished ...>
[pid 25444] 10:12:34.813086 <... mmap resumed> ) = 0x7f20f7613000
[pid 25443] 10:12:34.813107 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.813133 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.813165 pipe( <unfinished ...>
[pid 25445] 10:12:34.813200 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.813263 close(6 <unfinished ...>
[pid 25443] 10:12:34.813289 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.813312 fstat(13,  <unfinished ...>
[pid 25425] 10:12:34.813334 <... pipe resumed> [11, 12]) = 0
[pid 25445] 10:12:34.813359 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25444] 10:12:34.813400 <... close resumed> ) = 0
[pid 25443] 10:12:34.813424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25433] 10:12:34.813458 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:34.813567 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25445] 10:12:34.813602 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.813683 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.813719 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25433] 10:12:34.813753 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:34.813778 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.813803 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb625f1d790},  <unfinished ...>
[pid 25444] 10:12:34.813840 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.813860 <... mmap resumed> ) = 0x7fdec1433000
[pid 25433] 10:12:34.813877 <... mmap resumed> ) = 0x7fea0f280000
[pid 25425] 10:12:34.813897 close(10 <unfinished ...>
[pid 25445] 10:12:34.813935 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25444] 10:12:34.813960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.813994 mprotect(0x7fdec143f000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.814021 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:34.814044 <... close resumed> ) = 0
[pid 25445] 10:12:34.814072 fstat(2,  <unfinished ...>
[pid 25444] 10:12:34.814096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.814113 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.814130 <... lseek resumed> ) = 0
[pid 25425] 10:12:34.814147 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25445] 10:12:34.814182 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25444] 10:12:34.814238 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.814272 mmap(0x7fdec163f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25433] 10:12:34.814302 read(13,  <unfinished ...>
[pid 25425] 10:12:34.814328 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.814355 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fb625f1d790},  <unfinished ...>
[pid 25444] 10:12:34.814382 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.814402 <... mmap resumed> ) = 0x7fdec163f000
[pid 25433] 10:12:34.814426 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:34.814454 clone( <unfinished ...>
[pid 25445] 10:12:34.814804 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25444] 10:12:34.814835 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.814878 close(7 <unfinished ...>
[pid 25433] 10:12:34.814907 read(13,  <unfinished ...>
[pid 25445] 10:12:34.814940 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fb624c666a0},  <unfinished ...>
[pid 25444] 10:12:34.814967 <... open resumed> ) = 6
[pid 25443] 10:12:34.814983 <... close resumed> ) = 0
[pid 25433] 10:12:34.815019 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:34.815048 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25452
[pid 25445] 10:12:34.815093 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25444] 10:12:34.815115 read(6,  <unfinished ...>
[pid 25443] 10:12:34.815139 mprotect(0x7fdec163f000, 4096, PROT_READ <unfinished ...>
[pid 25433] 10:12:34.815166 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:34.815196 close(12 <unfinished ...>
[pid 25445] 10:12:34.815226 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fb624c666a0},  <unfinished ...>
[pid 25444] 10:12:34.815252 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.815276 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.815295 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:34.815332 <... close resumed> ) = 0
[pid 25445] 10:12:34.815381 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25444] 10:12:34.815404 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.815428 munmap(0x7fdec5a98000, 39387 <unfinished ...>
[pid 25433] 10:12:34.815457 stat("/usr/local/cpanel/3rdparty/mailman/lists/kcarter_scottsdalegolfgroup.com/config.pck",  <unfinished ...>
[pid 25425] 10:12:34.815562 wait4(-1,  <unfinished ...>
[pid 25445] 10:12:34.815594 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790},  <unfinished ...>
[pid 25444] 10:12:34.815621 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25443] 10:12:34.815651 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.815676 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:34.815707 <... wait4 resumed> 0x7fffbdaad0c0, WNOHANG, NULL) = 0
[pid 25445] 10:12:34.815746 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25444] 10:12:34.815776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.815808 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.815846 stat("/etc/demouids",  <unfinished ...>
[pid 25425] 10:12:34.815877 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25445] 10:12:34.815918 umask(0 <unfinished ...>
[pid 25444] 10:12:34.815941 <... mmap resumed> ) = 0x7f20f9ca7000
[pid 25443] 10:12:34.815961 <... open resumed> ) = 7
[pid 25433] 10:12:34.815983 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.816032 <... umask resumed> ) = 0
[pid 25444] 10:12:34.816088 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.816121 fcntl(7, F_GETFD <unfinished ...>
[pid 25433] 10:12:34.816144 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.816179 geteuid( <unfinished ...>
[pid 25444] 10:12:34.816201 <... mmap resumed> ) = 0x7f20f7007000
[pid 25443] 10:12:34.816217 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25433] 10:12:34.816238 <... open resumed> ) = 14
[pid 25445] 10:12:34.816261 <... geteuid resumed> ) = 0
[pid 25444] 10:12:34.816279 mprotect(0x7f20f7033000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.816307 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.816330 fstat(14,  <unfinished ...>
[pid 25445] 10:12:34.816358 getuid( <unfinished ...>
[pid 25444] 10:12:34.816380 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.816396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.816424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.816461 <... getuid resumed> ) = 47
[pid 25444] 10:12:34.816555 mmap(0x7f20f7233000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25443] 10:12:34.816593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.816620 fstat(14,  <unfinished ...>
[pid 25445] 10:12:34.816649 getgid( <unfinished ...>
[pid 25444] 10:12:34.816671 <... mmap resumed> ) = 0x7f20f7233000
[pid 25443] 10:12:34.816692 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:34.816710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.816745 <... getgid resumed> ) = 12
[pid 25444] 10:12:34.816818 close(6 <unfinished ...>
[pid 25443] 10:12:34.816851 read(7,  <unfinished ...>
[pid 25433] 10:12:34.816887 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.816921 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25444] 10:12:34.816944 <... close resumed> ) = 0
[pid 25443] 10:12:34.816967 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.817007 <... mmap resumed> ) = 0x7fea0f27f000
[pid 25445] 10:12:34.817031 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25444] 10:12:34.817050 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.817085 close(7 <unfinished ...>
[pid 25433] 10:12:34.817109 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.817139 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25444] 10:12:34.817161 <... open resumed> ) = 6
[pid 25443] 10:12:34.817176 <... close resumed> ) = 0
[pid 25433] 10:12:34.817192 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.817215 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25444] 10:12:34.817235 read(6,  <unfinished ...>
[pid 25443] 10:12:34.817259 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:34.817287 read(14,  <unfinished ...>
[pid 25445] 10:12:34.817316 getgroups(65536,  <unfinished ...>
[pid 25444] 10:12:34.817339 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.817362 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.817399 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.817434 <... getgroups resumed> []) = 0
[pid 25444] 10:12:34.817459 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.817568 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.817599 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25445] 10:12:34.817635 setgroups(0, [] <unfinished ...>
[pid 25444] 10:12:34.817659 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25443] 10:12:34.817690 <... socket resumed> ) = 7
[pid 25433] 10:12:34.817707 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25445] 10:12:34.817870 <... setgroups resumed> ) = 0
[pid 25444] 10:12:34.817903 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.817936 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.817972 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.818007 getegid( <unfinished ...>
[pid 25444] 10:12:34.818030 <... mmap resumed> ) = 0x7f20f6e02000
[pid 25443] 10:12:34.818046 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.818064 <... open resumed> ) = 15
[pid 25445] 10:12:34.818089 <... getegid resumed> ) = 12
[pid 25444] 10:12:34.818106 mprotect(0x7f20f6e07000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.818140 close(7 <unfinished ...>
[pid 25433] 10:12:34.818167 fstat(15,  <unfinished ...>
[pid 25445] 10:12:34.818197 geteuid( <unfinished ...>
[pid 25444] 10:12:34.818218 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.818234 <... close resumed> ) = 0
[pid 25433] 10:12:34.818250 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.818285 <... geteuid resumed> ) = 0
[pid 25444] 10:12:34.818307 mmap(0x7f20f7006000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25443] 10:12:34.818338 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:34.818365 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.818400 geteuid( <unfinished ...>
[pid 25444] 10:12:34.818436 <... mmap resumed> ) = 0x7f20f7006000
[pid 25443] 10:12:34.818459 <... socket resumed> ) = 7
[pid 25433] 10:12:34.818548 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25445] 10:12:34.818579 <... geteuid resumed> ) = 0
[pid 25444] 10:12:34.818596 close(6 <unfinished ...>
[pid 25443] 10:12:34.818619 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:34.818652 read(15,  <unfinished ...>
[pid 25445] 10:12:34.818685 getegid( <unfinished ...>
[pid 25444] 10:12:34.818708 <... close resumed> ) = 0
[pid 25443] 10:12:34.818735 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.818754 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.818787 <... getegid resumed> ) = 12
[pid 25444] 10:12:34.818807 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.818842 close(7 <unfinished ...>
[pid 25433] 10:12:34.818875 close(15 <unfinished ...>
[pid 25445] 10:12:34.818912 setgid(12 <unfinished ...>
[pid 25444] 10:12:34.818942 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.818961 <... close resumed> ) = 0
[pid 25433] 10:12:34.818982 <... close resumed> ) = 0
[pid 25445] 10:12:34.819005 <... setgid resumed> ) = 0
[pid 25444] 10:12:34.819024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.819057 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.819085 munmap(0x7fea0f27e000, 4096 <unfinished ...>
[pid 25445] 10:12:34.819119 setuid(0 <unfinished ...>
[pid 25444] 10:12:34.819143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.819160 <... open resumed> ) = 7
[pid 25433] 10:12:34.819177 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.819245 <... setuid resumed> ) = 0
[pid 25444] 10:12:34.819292 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.819328 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.819354 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25445] 10:12:34.819387 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.819415 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.819434 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:34.819464 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25445] 10:12:34.819598 <... open resumed> ) = 6
[pid 25444] 10:12:34.819627 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.819660 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.819687 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.819720 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.819743 <... open resumed> ) = 6
[pid 25443] 10:12:34.819759 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:34.819776 <... open resumed> ) = 15
[pid 25445] 10:12:34.819798 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.819834 read(6,  <unfinished ...>
[pid 25443] 10:12:34.819865 read(7,  <unfinished ...>
[pid 25433] 10:12:34.819898 fstat(15,  <unfinished ...>
[pid 25445] 10:12:34.819932 fstat(6,  <unfinished ...>
[pid 25444] 10:12:34.819956 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.819980 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:34.820012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25445] 10:12:34.820047 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.820074 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.820097 close(7 <unfinished ...>
[pid 25433] 10:12:34.820121 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.820153 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.820177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25443] 10:12:34.820207 <... close resumed> ) = 0
[pid 25433] 10:12:34.820223 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25445] 10:12:34.820246 <... mmap resumed> ) = 0x7fb627067000
[pid 25444] 10:12:34.820262 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.820292 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:34.820320 read(15,  <unfinished ...>
[pid 25445] 10:12:34.820353 read(6,  <unfinished ...>
[pid 25444] 10:12:34.820379 <... mmap resumed> ) = 0x7f20f6bff000
[pid 25443] 10:12:34.820395 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.820430 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25445] 10:12:34.820472 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25444] 10:12:34.820694 mprotect(0x7f20f6c01000, 2093056, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.820730 read(6,  <unfinished ...>
[pid 25433] 10:12:34.820755 close(15 <unfinished ...>
[pid 25445] 10:12:34.820786 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25444] 10:12:34.820813 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.820834 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25433] 10:12:34.820904 <... close resumed> ) = 0
[pid 25445] 10:12:34.820934 <... socket resumed> ) = 7
[pid 25444] 10:12:34.820951 mmap(0x7f20f6e00000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25443] 10:12:34.820982 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:34.821011 munmap(0x7fea0f27e000, 4096 <unfinished ...>
[pid 25445] 10:12:34.821045 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25444] 10:12:34.821079 <... mmap resumed> ) = 0x7f20f6e00000
[pid 25443] 10:12:34.821104 <... open resumed> ) = 7
[pid 25433] 10:12:34.821124 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.821156 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.821176 close(6 <unfinished ...>
[pid 25443] 10:12:34.821200 fstat(7,  <unfinished ...>
[pid 25433] 10:12:34.821223 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.821257 close(7 <unfinished ...>
[pid 25444] 10:12:34.821284 <... close resumed> ) = 0
[pid 25443] 10:12:34.821309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:34.821341 <... open resumed> ) = 15
[pid 25445] 10:12:34.821364 <... close resumed> ) = 0
[pid 25444] 10:12:34.821380 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.821410 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.821439 fstat(15,  <unfinished ...>
[pid 25445] 10:12:34.821468 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25444] 10:12:34.821574 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.821594 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:34.821612 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25445] 10:12:34.821648 <... socket resumed> ) = 7
[pid 25444] 10:12:34.821664 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.821697 read(7,  <unfinished ...>
[pid 25433] 10:12:34.821724 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.821757 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25444] 10:12:34.821788 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.821811 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:34.821843 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25445] 10:12:34.821871 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.821960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.821996 close(7 <unfinished ...>
[pid 25433] 10:12:34.822020 read(15,  <unfinished ...>
[pid 25445] 10:12:34.822054 close(7 <unfinished ...>
[pid 25444] 10:12:34.822080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.822100 <... close resumed> ) = 0
[pid 25433] 10:12:34.822117 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25445] 10:12:34.822149 <... close resumed> ) = 0
[pid 25444] 10:12:34.822172 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.822206 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:34.822235 close(15 <unfinished ...>
[pid 25445] 10:12:34.822266 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.822294 <... open resumed> ) = 6
[pid 25443] 10:12:34.822310 <... munmap resumed> ) = 0
[pid 25433] 10:12:34.822335 <... close resumed> ) = 0
[pid 25445] 10:12:34.822358 <... open resumed> ) = 7
[pid 25444] 10:12:34.822377 read(6,  <unfinished ...>
[pid 25443] 10:12:34.822403 read(6,  <unfinished ...>
[pid 25433] 10:12:34.822428 munmap(0x7fea0f27e000, 4096 <unfinished ...>
[pid 25445] 10:12:34.822460 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.822540 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:34.822567 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25433] 10:12:34.822606 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.822721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25444] 10:12:34.822759 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.822784 uname( <unfinished ...>
[pid 25433] 10:12:34.822807 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.822854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.822886 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25443] 10:12:34.822922 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25433] 10:12:34.822973 <... open resumed> ) = 15
[pid 25445] 10:12:34.823001 <... mmap resumed> ) = 0x7fb627066000
[pid 25444] 10:12:34.823018 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.823045 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:34.823074 fstat(15,  <unfinished ...>
[pid 25445] 10:12:34.823103 read(7,  <unfinished ...>
[pid 25444] 10:12:34.823130 <... mmap resumed> ) = 0x7f20f9ca6000
[pid 25443] 10:12:34.823149 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fdec496f790}, 8) = 0
[pid 25433] 10:12:34.823177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.823216 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25444] 10:12:34.823254 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:34.823286 clone( <unfinished ...>
[pid 25433] 10:12:34.823598 fstat(15,  <unfinished ...>
[pid 25445] 10:12:34.823631 read(7,  <unfinished ...>
[pid 25444] 10:12:34.823655 <... mmap resumed> ) = 0x7f20f69dc000
[pid 25433] 10:12:34.823673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.823708 <... read resumed> "", 4096) = 0
[pid 25444] 10:12:34.823726 mprotect(0x7f20f69f3000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:34.823755 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25453
[pid 25433] 10:12:34.823797 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.823838 close(7 <unfinished ...>
[pid 25444] 10:12:34.823871 <... mprotect resumed> ) = 0
[pid 25443] 10:12:34.823890 wait4(25453,  <unfinished ...>
[pid 25433] 10:12:34.823918 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25445] 10:12:34.823941 <... close resumed> ) = 0
[pid 25444] 10:12:34.823957 mmap(0x7f20f6bf3000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25433] 10:12:34.823986 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.824015 munmap(0x7fb627066000, 4096 <unfinished ...>
[pid 25444] 10:12:34.824042 <... mmap resumed> ) = 0x7f20f6bf3000
[pid 25433] 10:12:34.824068 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.824092 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.824122 close(6 <unfinished ...>
[pid 25433] 10:12:34.824146 read(15,  <unfinished ...>
[pid 25445] 10:12:34.824178 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.824210 <... close resumed> ) = 0
[pid 25433] 10:12:34.824246 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25445] 10:12:34.824274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.824293 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.824323 read(15,  <unfinished ...>
[pid 25445] 10:12:34.824351 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.824382 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.824400 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.824553 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.824586 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.824623 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.824652 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.824681 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.824698 <... lseek resumed> ) = 353
[pid 25445] 10:12:34.824724 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.824741 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.824771 read(9,  <unfinished ...>
[pid 25445] 10:12:34.824800 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.824833 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.824859 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.824911 <... open resumed> ) = 7
[pid 25444] 10:12:34.824935 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.824968 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.824996 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.825020 <... open resumed> ) = 6
[pid 25433] 10:12:34.825036 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.825057 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25444] 10:12:34.825087 read(6,  <unfinished ...>
[pid 25433] 10:12:34.825111 read(9,  <unfinished ...>
[pid 25445] 10:12:34.825139 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25444] 10:12:34.825166 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.825189 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25445] 10:12:34.825243 <... mmap resumed> ) = 0x7fb627046000
[pid 25444] 10:12:34.825264 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.825287 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.825324 close(7 <unfinished ...>
[pid 25444] 10:12:34.825346 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.825376 <... stat resumed> 0x7fea0d922880) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.825411 <... close resumed> ) = 0
[pid 25444] 10:12:34.825439 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.825472 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25445] 10:12:34.825589 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.825621 <... mmap resumed> ) = 0x7f20f6798000
[pid 25433] 10:12:34.825638 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.825699 <... open resumed> ) = 7
[pid 25444] 10:12:34.825720 mprotect(0x7f20f67d9000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.825749 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.825786 read(7,  <unfinished ...>
[pid 25444] 10:12:34.825810 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.825830 <... open resumed> ) = 16
[pid 25445] 10:12:34.825865 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.825895 mmap(0x7f20f69d9000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25433] 10:12:34.825933 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25445] 10:12:34.825964 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.825988 <... mmap resumed> ) = 0x7f20f69d9000
[pid 25433] 10:12:34.826014 <... ioctl resumed> , 0x7ffc72718270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.826041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.826074 close(6 <unfinished ...>
[pid 25433] 10:12:34.826098 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25445] 10:12:34.826126 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25444] 10:12:34.826157 <... close resumed> ) = 0
[pid 25433] 10:12:34.826181 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.826205 <... mmap resumed> ) = 0x7fb6229e1000
[pid 25444] 10:12:34.826222 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.826252 fstat(16,  <unfinished ...>
[pid 25445] 10:12:34.826280 mprotect(0x7fb6229ed000, 2097152, PROT_NONE <unfinished ...>
[pid 25444] 10:12:34.826307 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.826324 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25445] 10:12:34.826359 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.826375 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.826407 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.826435 mmap(0x7fb622bed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25444] 10:12:34.826464 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.826560 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.826589 <... mmap resumed> ) = 0x7fb622bed000
[pid 25444] 10:12:34.826615 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.826649 fstat(16,  <unfinished ...>
[pid 25445] 10:12:34.826678 close(7 <unfinished ...>
[pid 25444] 10:12:34.826700 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.826719 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25445] 10:12:34.826773 <... close resumed> ) = 0
[pid 25444] 10:12:34.826810 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.826856 read(16,  <unfinished ...>
[pid 25445] 10:12:34.826890 mprotect(0x7fb622bed000, 4096, PROT_READ <unfinished ...>
[pid 25444] 10:12:34.826922 <... open resumed> ) = 6
[pid 25433] 10:12:34.826939 <... read resumed> "0", 8192) = 1
[pid 25445] 10:12:34.826963 <... mprotect resumed> ) = 0
[pid 25444] 10:12:34.826983 read(6,  <unfinished ...>
[pid 25433] 10:12:34.827006 read(16,  <unfinished ...>
[pid 25445] 10:12:34.827033 munmap(0x7fb627046000, 39387 <unfinished ...>
[pid 25444] 10:12:34.827060 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.827084 <... read resumed> "", 8192) = 0
[pid 25445] 10:12:34.827109 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.827133 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.827158 close(16 <unfinished ...>
[pid 25445] 10:12:34.827186 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.827214 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.827243 <... close resumed> ) = 0
[pid 25445] 10:12:34.827320 <... open resumed> ) = 7
[pid 25444] 10:12:34.827349 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.827378 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.827413 fcntl(7, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.827437 <... mmap resumed> ) = 0x7f20f9ca5000
[pid 25433] 10:12:34.827457 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25445] 10:12:34.827588 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25444] 10:12:34.827614 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.827645 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.827677 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.827700 <... mmap resumed> ) = 0x7f20f64b1000
[pid 25433] 10:12:34.827716 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.827761 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25444] 10:12:34.827791 mprotect(0x7f20f658c000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.827819 stat("/etc/localtime",  <unfinished ...>
[pid 25445] 10:12:34.827858 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.827886 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.827906 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.827955 <... mmap resumed> ) = 0x7fb627066000
[pid 25444] 10:12:34.827974 mmap(0x7f20f678c000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25433] 10:12:34.828003 close(7 <unfinished ...>
[pid 25445] 10:12:34.828034 read(7,  <unfinished ...>
[pid 25444] 10:12:34.828064 <... mmap resumed> ) = 0x7f20f678c000
[pid 25433] 10:12:34.828089 <... close resumed> ) = 0
[pid 25445] 10:12:34.828115 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.828153 close(6 <unfinished ...>
[pid 25433] 10:12:34.828177 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25445] 10:12:34.828216 close(7 <unfinished ...>
[pid 25444] 10:12:34.828240 <... close resumed> ) = 0
[pid 25433] 10:12:34.828264 <... open resumed> ) = 7
[pid 25445] 10:12:34.828286 <... close resumed> ) = 0
[pid 25444] 10:12:34.828303 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.828333 fcntl(7, F_GETFD <unfinished ...>
[pid 25445] 10:12:34.828361 munmap(0x7fb627066000, 4096 <unfinished ...>
[pid 25444] 10:12:34.828391 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.828410 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.828431 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.828465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.828580 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.828611 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25444] 10:12:34.828638 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.828656 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.828677 <... socket resumed> ) = 7
[pid 25444] 10:12:34.828693 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.828724 fstat(7,  <unfinished ...>
[pid 25445] 10:12:34.828752 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25444] 10:12:34.828784 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.828802 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368535, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.828842 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.828864 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.828900 write(7, "2015-12-30 10:12:34 [25433] 1aEJMY-0006c6-AN SMTP connection outbound 1451491954 1aEJMY-0006c6-AN finestweddingsites.com kcarter@scottsdalegolfgroup.com\n", 153 <unfinished ...>
[pid 25445] 10:12:34.828941 close(7 <unfinished ...>
[pid 25444] 10:12:34.828968 <... open resumed> ) = 6
[pid 25433] 10:12:34.828984 <... write resumed> ) = 153
[pid 25445] 10:12:34.829045 <... close resumed> ) = 0
[pid 25444] 10:12:34.829067 read(6,  <unfinished ...>
[pid 25433] 10:12:34.829092 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25445] 10:12:34.829133 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25444] 10:12:34.829161 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.829190 <... open resumed> ) = 16
[pid 25445] 10:12:34.829217 <... socket resumed> ) = 7
[pid 25444] 10:12:34.829235 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.829258 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25445] 10:12:34.829286 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25444] 10:12:34.829317 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.829348 <... lseek resumed> ) = 5
[pid 25445] 10:12:34.829371 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.829388 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.829420 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25445] 10:12:34.829452 close(7 <unfinished ...>
[pid 25444] 10:12:34.829561 <... mmap resumed> ) = 0x7f20f62ad000
[pid 25433] 10:12:34.829584 <... ioctl resumed> , 0x7ffc72718270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.829608 <... close resumed> ) = 0
[pid 25444] 10:12:34.829630 mprotect(0x7f20f62b0000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.829660 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25445] 10:12:34.829688 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.829717 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.829733 <... lseek resumed> ) = 5
[pid 25445] 10:12:34.829755 <... open resumed> ) = 7
[pid 25444] 10:12:34.829772 mmap(0x7f20f64af000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25433] 10:12:34.829802 fstat(16,  <unfinished ...>
[pid 25445] 10:12:34.829835 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.829864 <... mmap resumed> ) = 0x7f20f64af000
[pid 25433] 10:12:34.829893 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=5, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.829937 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25444] 10:12:34.829965 close(6 <unfinished ...>
[pid 25433] 10:12:34.829988 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25445] 10:12:34.830016 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.830042 <... close resumed> ) = 0
[pid 25433] 10:12:34.830065 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.830098 <... mmap resumed> ) = 0x7fb627066000
[pid 25444] 10:12:34.830117 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.830148 write(16, "1", 1 <unfinished ...>
[pid 25445] 10:12:34.830183 read(7,  <unfinished ...>
[pid 25444] 10:12:34.830210 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.830227 <... write resumed> ) = 1
[pid 25445] 10:12:34.830249 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25444] 10:12:34.830282 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.830321 close(16 <unfinished ...>
[pid 25445] 10:12:34.830354 close(7 <unfinished ...>
[pid 25444] 10:12:34.830378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.830395 <... close resumed> ) = 0
[pid 25445] 10:12:34.830435 <... close resumed> ) = 0
[pid 25444] 10:12:34.830455 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.830565 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.830603 munmap(0x7fb627066000, 4096 <unfinished ...>
[pid 25444] 10:12:34.830631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.830650 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.830680 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.830715 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.830751 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25445] 10:12:34.830784 read(6,  <unfinished ...>
[pid 25444] 10:12:34.830808 <... open resumed> ) = 6
[pid 25433] 10:12:34.830823 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.830881 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25444] 10:12:34.830947 read(6,  <unfinished ...>
[pid 25433] 10:12:34.830976 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.831010 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.831037 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.831060 <... open resumed> ) = 16
[pid 25445] 10:12:34.831082 <... open resumed> ) = 7
[pid 25444] 10:12:34.831099 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.831122 fstat(16,  <unfinished ...>
[pid 25445] 10:12:34.831149 fstat(7,  <unfinished ...>
[pid 25444] 10:12:34.831171 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:34.831202 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25445] 10:12:34.831235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25444] 10:12:34.831262 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:34.831292 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.831323 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.831350 <... mmap resumed> ) = 0x7f20f6081000
[pid 25433] 10:12:34.831366 <... mmap resumed> ) = 0x7fea0f27d000
[pid 25445] 10:12:34.831393 <... mmap resumed> ) = 0x7fb627066000
[pid 25444] 10:12:34.831411 mprotect(0x7f20f60aa000, 2097152, PROT_NONE <unfinished ...>
[pid 25433] 10:12:34.831438 read(16,  <unfinished ...>
[pid 25445] 10:12:34.831470 read(7,  <unfinished ...>
[pid 25444] 10:12:34.831621 <... mprotect resumed> ) = 0
[pid 25433] 10:12:34.831651 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25445] 10:12:34.831699 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.831739 mmap(0x7f20f62aa000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25433] 10:12:34.831781 read(16,  <unfinished ...>
[pid 25445] 10:12:34.831810 close(7 <unfinished ...>
[pid 25444] 10:12:34.831834 <... mmap resumed> ) = 0x7f20f62aa000
[pid 25433] 10:12:34.831860 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.831889 <... close resumed> ) = 0
[pid 25444] 10:12:34.831910 mmap(0x7f20f62ac000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:34.831944 close(16 <unfinished ...>
[pid 25445] 10:12:34.831974 munmap(0x7fb627066000, 4096 <unfinished ...>
[pid 25444] 10:12:34.832000 <... mmap resumed> ) = 0x7f20f62ac000
[pid 25433] 10:12:34.832021 <... close resumed> ) = 0
[pid 25445] 10:12:34.832044 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.832068 close(6 <unfinished ...>
[pid 25433] 10:12:34.832092 munmap(0x7fea0f27d000, 4096 <unfinished ...>
[pid 25445] 10:12:34.832123 read(6,  <unfinished ...>
[pid 25444] 10:12:34.832146 <... close resumed> ) = 0
[pid 25433] 10:12:34.832172 <... munmap resumed> ) = 0
[pid 25445] 10:12:34.832194 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25444] 10:12:34.832233 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.832266 uname( <unfinished ...>
[pid 25445] 10:12:34.832293 uname( <unfinished ...>
[pid 25444] 10:12:34.832316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.832334 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25445] 10:12:34.832418 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25444] 10:12:34.832471 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.832589 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25445] 10:12:34.832623 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb624c666a0},  <unfinished ...>
[pid 25444] 10:12:34.832651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.832669 <... socket resumed> ) = 16
[pid 25445] 10:12:34.832698 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, 8) = 0
[pid 25444] 10:12:34.832727 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.832758 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25445] 10:12:34.832796 clone( <unfinished ...>
[pid 25444] 10:12:34.833030 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:34.833052 <... connect resumed> ) = 0
[pid 25444] 10:12:34.833080 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25433] 10:12:34.833114 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25445] 10:12:34.833146 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb627050a90) = 25454
[pid 25444] 10:12:34.833202 <... open resumed> ) = 6
[pid 25433] 10:12:34.833243 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25445] 10:12:34.833297 wait4(25454,  <unfinished ...>
[pid 25444] 10:12:34.833327 read(6,  <unfinished ...>
[pid 25433] 10:12:34.833351 sendto(16, "\365!\1\0\0\1\0\0\0\0\0\0\23scottsdalegolfgroup\3com\0\0\17\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25444] 10:12:34.833417 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:34.833442 <... sendto resumed> ) = 41
[pid 25444] 10:12:34.833463 fstat(6,  <unfinished ...>
[pid 25433] 10:12:34.833558 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25444] 10:12:34.833591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.833626 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9ca4000
[pid 25444] 10:12:34.833669 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f20f5e6b000
[pid 25444] 10:12:34.833711 mprotect(0x7f20f5e80000, 2093056, PROT_NONE) = 0
[pid 25444] 10:12:34.833748 mmap(0x7f20f607f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f20f607f000
[pid 25444] 10:12:34.833797 close(6)    = 0
[pid 25444] 10:12:34.833852 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.833906 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.833956 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.833997 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25444] 10:12:34.834038 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.834078 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25444] 10:12:34.834125 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f20f5c60000
[pid 25444] 10:12:34.834165 mprotect(0x7f20f5c6a000, 2093056, PROT_NONE) = 0
[pid 25444] 10:12:34.834200 mmap(0x7f20f5e69000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f20f5e69000
[pid 25444] 10:12:34.834254 close(6)    = 0
[pid 25444] 10:12:34.834297 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.834340 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.834382 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.834422 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25444] 10:12:34.834465 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.834586 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.834636 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f20f5a5d000
[pid 25444] 10:12:34.834678 mprotect(0x7f20f5a5f000, 2093056, PROT_NONE) = 0
[pid 25444] 10:12:34.834714 mmap(0x7f20f5c5e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f20f5c5e000
[pid 25444] 10:12:34.834760 close(6)    = 0
[pid 25444] 10:12:34.834801 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9ca3000
[pid 25444] 10:12:34.834859 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.834914 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.834963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.835005 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25444] 10:12:34.835044 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.835084 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25444] 10:12:34.835132 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f20f583e000
[pid 25444] 10:12:34.835172 mprotect(0x7f20f585b000, 2093056, PROT_NONE) = 0
[pid 25444] 10:12:34.835208 mmap(0x7f20f5a5a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f20f5a5a000
[pid 25444] 10:12:34.835250 mmap(0x7f20f5a5c000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f20f5a5c000
[pid 25444] 10:12:34.835292 close(6)    = 0
[pid 25444] 10:12:34.835360 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9ca2000
[pid 25444] 10:12:34.835434 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9ca1000
[pid 25444] 10:12:34.835562 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9c9f000
[pid 25444] 10:12:34.835610 arch_prctl(ARCH_SET_FS, 0x7f20f9c9f7c0) = 0
[pid 25444] 10:12:34.835681 mprotect(0x7f20f5a5a000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.835723 mprotect(0x7f20f5c5e000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.835773 mprotect(0x7f20f5e69000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.835817 mprotect(0x7f20f607f000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.835875 mprotect(0x7f20f62aa000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.835931 mprotect(0x7f20f64af000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.836074 mprotect(0x7f20f678c000, 40960, PROT_READ) = 0
[pid 25444] 10:12:34.836192 mprotect(0x7f20f69d9000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.836241 mprotect(0x7f20f6bf3000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.836282 mprotect(0x7f20f6e00000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.836601 mprotect(0x7f20f75ec000, 110592, PROT_READ) = 0
[pid 25444] 10:12:34.836715 mprotect(0x7f20f7878000, 16384, PROT_READ) = 0
[pid 25444] 10:12:34.836833 mprotect(0x7f20f7c0d000, 16384, PROT_READ) = 0
[pid 25444] 10:12:34.836926 mprotect(0x7f20f7e18000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.836977 mprotect(0x7f20f801c000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837694 mprotect(0x7f20f8d74000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837766 mprotect(0x7f20f91a9000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837810 mprotect(0x7f20f942d000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837850 mprotect(0x7f20f9636000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837902 mprotect(0x7f20f987b000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.837946 mprotect(0x7f20f9a95000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.838007 mprotect(0x7f20f9cb8000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.838045 munmap(0x7f20f9cad000, 39387) = 0
[pid 25444] 10:12:34.838086 set_tid_address(0x7f20f9c9fa90) = 25444
[pid 25444] 10:12:34.838120 set_robust_list(0x7f20f9c9faa0, 24) = 0
[pid 25444] 10:12:34.838152 futex(0x7ffd6887ee6c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25444] 10:12:34.838186 futex(0x7ffd6887ee6c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f20f9c9f7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25444] 10:12:34.838228 rt_sigaction(SIGRTMIN, {0x7f20f8b62c60, [], SA_RESTORER|SA_SIGINFO, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.838267 rt_sigaction(SIGRT_1, {0x7f20f8b62cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.838307 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25444] 10:12:34.838354 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25444] 10:12:34.838425 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350349, f_bavail=6350349, f_files=1000000, f_ffree=691110, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25444] 10:12:34.838587 brk(0)      = 0xe6a000
[pid 25444] 10:12:34.838629 brk(0xe8b000) = 0xe8b000
[pid 25444] 10:12:34.838674 open("/proc/filesystems", O_RDONLY) = 6
[pid 25444] 10:12:34.838736 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.838786 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb6000
[pid 25444] 10:12:34.838824 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25444] 10:12:34.838933 read(6, "", 1024) = 0
[pid 25444] 10:12:34.838974 close(6)    = 0
[pid 25444] 10:12:34.839013 munmap(0x7f20f9cb6000, 4096) = 0
[pid 25444] 10:12:34.839096 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.839215 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.839265 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25444] 10:12:34.839345 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.839390 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25444] 10:12:34.839430 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25444] 10:12:34.839468 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.839585 umask(0)    = 022
[pid 25444] 10:12:34.839655 geteuid()   = 0
[pid 25444] 10:12:34.839693 getuid()    = 503
[pid 25444] 10:12:34.839727 getgid()    = 499
[pid 25444] 10:12:34.839773 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25444] 10:12:34.839811 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25444] 10:12:34.839847 getgroups(65536, [500]) = 1
[pid 25444] 10:12:34.839886 setgroups(0, []) = 0
[pid 25444] 10:12:34.839923 getegid()   = 499
[pid 25444] 10:12:34.839956 geteuid()   = 0
[pid 25444] 10:12:34.839994 geteuid()   = 0
[pid 25444] 10:12:34.840027 getegid()   = 499
[pid 25444] 10:12:34.840061 setgid(499) = 0
[pid 25444] 10:12:34.840097 setuid(0)   = 0
[pid 25444] 10:12:34.840158 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25444] 10:12:34.840219 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.840273 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.840318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb6000
[pid 25444] 10:12:34.840357 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25444] 10:12:34.840555 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25444] 10:12:34.840604 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.840651 close(7)    = 0
[pid 25444] 10:12:34.840688 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25444] 10:12:34.840724 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.840765 close(7)    = 0
[pid 25444] 10:12:34.840806 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25444] 10:12:34.840849 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25444] 10:12:34.840897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.840935 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25444] 10:12:34.840991 read(7, "", 4096) = 0
[pid 25444] 10:12:34.841027 close(7)    = 0
[pid 25444] 10:12:34.841068 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.841117 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.841162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.841205 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.841245 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25444] 10:12:34.841283 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25444] 10:12:34.841328 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f20f9c95000
[pid 25444] 10:12:34.841365 close(7)    = 0
[pid 25444] 10:12:34.841407 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25444] 10:12:34.841450 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25444] 10:12:34.841565 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25444] 10:12:34.841619 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f20f5630000
Process 25452 attached
[pid 25444] 10:12:34.841695 mprotect(0x7f20f563c000, 2097152, PROT_NONE) = 0
[pid 25444] 10:12:34.841735 mmap(0x7f20f583c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f20f583c000
[pid 25444] 10:12:34.841782 close(7)    = 0
[pid 25444] 10:12:34.841834 mprotect(0x7f20f583c000, 4096, PROT_READ) = 0
[pid 25444] 10:12:34.841876 munmap(0x7f20f9c95000, 39387) = 0
[pid 25444] 10:12:34.841922 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25444] 10:12:34.841968 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25444] 10:12:34.842005 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25444] 10:12:34.842051 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.842088 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.842146 close(7)    = 0
[pid 25444] 10:12:34.842182 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.842236 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25444] 10:12:34.842278 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.842322 close(7)    = 0
[pid 25444] 10:12:34.842358 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25444] 10:12:34.842394 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.842434 close(7)    = 0
[pid 25444] 10:12:34.842576 open("/etc/group", O_RDONLY|O_CLOEXECProcess 25453 attached
 <unfinished ...>
[pid 25452] 10:12:34.842662 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25444] 10:12:34.842689 <... open resumed> ) = 7
[pid 25453] 10:12:34.842712 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25452] 10:12:34.842734 <... set_robust_list resumed> ) = 0
[pid 25444] 10:12:34.842748 fstat(7,  <unfinished ...>
[pid 25453] 10:12:34.842804 <... set_robust_list resumed> ) = 0
[pid 25452] 10:12:34.842818 fcntl(12, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.842863 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25453] 10:12:34.842898 geteuid( <unfinished ...>
[pid 25452] 10:12:34.842920 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.842933 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25453] 10:12:34.842966 <... geteuid resumed> ) = 0
[pid 25452] 10:12:34.842980 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.843010 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25453] 10:12:34.843032 geteuid( <unfinished ...>
[pid 25452] 10:12:34.843054 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.843067 read(7,  <unfinished ...>
[pid 25453] 10:12:34.843102 <... geteuid resumed> ) = 0
[pid 25452] 10:12:34.843116 close(6 <unfinished ...>
[pid 25444] 10:12:34.843140 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25453] 10:12:34.843178 getegid( <unfinished ...>
[pid 25452] 10:12:34.843201 <... close resumed> ) = 0
[pid 25444] 10:12:34.843214 close(7 <unfinished ...>
[pid 25453] 10:12:34.843269 <... getegid resumed> ) = 12
[pid 25452] 10:12:34.843283 open("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25444] 10:12:34.843328 <... close resumed> ) = 0
[pid 25453] 10:12:34.843350 setgid(12 <unfinished ...>
[pid 25452] 10:12:34.843372 <... open resumed> ) = 6
[pid 25444] 10:12:34.843386 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25453] 10:12:34.843426 <... setgid resumed> ) = 0
[pid 25452] 10:12:34.843442 fcntl(6, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.843466 <... munmap resumed> ) = 0
[pid 25453] 10:12:34.843569 setuid(47 <unfinished ...>
[pid 25452] 10:12:34.843599 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.843613 read(6,  <unfinished ...>
[pid 25453] 10:12:34.843644 <... setuid resumed> ) = 0
[pid 25452] 10:12:34.843657 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.844538 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25444] 10:12:34.844602 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25444] 10:12:34.844648 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25444] 10:12:34.844696 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.844733 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.844776 close(7)    = 0
[pid 25444] 10:12:34.844810 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.844854 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25444] 10:12:34.844916 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25444] 10:12:34.844976 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, 8) = 0
[pid 25444] 10:12:34.845026 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f20f9c9fa90) = 25455
[pid 25444] 10:12:34.845279 wait4(25455,  <unfinished ...>
[pid 25452] 10:12:34.845313 <... fcntl resumed> ) = 0
[pid 25452] 10:12:34.845376 geteuid()   = 0
[pid 25452] 10:12:34.845415 getegid()   = 12
[pid 25452] 10:12:34.845450 setgid(12)  = 0
[pid 25452] 10:12:34.845567 setuid(47)  = 0
[pid 25452] 10:12:34.845609 close(11)   = 0
[pid 25452] 10:12:34.845749 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 10
[pid 25452] 10:12:34.845792 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:34.845840 close(10)   = 0
[pid 25452] 10:12:34.845880 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 10
[pid 25452] 10:12:34.845918 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:34.845961 close(10)   = 0
[pid 25428] 10:12:34.846007 <... select resumed> ) = 1 (in [11], left {299, 950051})
[pid 25428] 10:12:34.846040 read(11, "\27\3\1\0 ", 5) = 5
[pid 25428] 10:12:34.846080 read(11, "\315\313]\327\267\177\263\255\270cL\211\26\365\nOQK\261\356\343\225b\356g\313J\266)\0238\t", 32) = 32
[pid 25428] 10:12:34.846124 read(11, "\27\3\1\0@", 5) = 5
[pid 25428] 10:12:34.846161 read(11, "C\347V\300\0\256\nS:\311\275\347\333\344A\363\301h\2737\376\276pt[uA1\3453\353R\345\367G\30\356X\177\36\373ON\17\240\374\241U\374\301P]\224\266\274\354\215\"e\270k\17@|", 64) = 64
[pid 25428] 10:12:34.846212 write(11, "\27\3\1\0 \236\372\227\213S\353y_\35\373}\323\272C$s\364\21j\270ILb\315-YW\177\27385O\27\3\1\0 O\16\22\272\n\227\345\272h\211\232\273\277C\31\\\230_\201\317q\3279\324kjQ\0:\v\366X", 74) = 74
[pid 25428] 10:12:34.846277 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25452] 10:12:34.846550 open("/etc/services", O_RDONLY|O_CLOEXEC) = 10
[pid 25452] 10:12:34.846613 fstat(10, {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25452] 10:12:34.846679 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25452] 10:12:34.846723 read(10, "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25452] 10:12:34.846796 close(10)   = 0
[pid 25452] 10:12:34.846834 munmap(0x7f380d424000, 4096) = 0
[pid 25452] 10:12:34.846912 stat("/etc/mailips", {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:34.847601 open("/etc/mailips", O_RDONLY) = 10
[pid 25452] 10:12:34.847659 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:34.847729 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:34.847785 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d424000
[pid 25452] 10:12:34.847825 lseek(10, 0, SEEK_SET) = 0
[pid 25452] 10:12:34.847862 read(10, "", 4096) = 0
[pid 25452] 10:12:34.847911 lseek(10, 0, SEEK_SET) = 0
[pid 25452] 10:12:34.847949 read(10, "", 4096) = 0
[pid 25452] 10:12:34.848168 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 11
[pid 25452] 10:12:34.848217 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25452] 10:12:34.848266 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f380d423000
[pid 25452] 10:12:34.848305 read(11, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25452] 10:12:34.848361 close(11)   = 0
[pid 25452] 10:12:34.848399 munmap(0x7f380d423000, 4096) = 0
[pid 25452] 10:12:34.848465 open("/etc/shadow", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
[pid 25452] 10:12:34.848716 lseek(10, 0, SEEK_SET) = 0
[pid 25452] 10:12:34.848761 read(10, "", 4096) = 0
[pid 25452] 10:12:34.848800 lseek(10, 0, SEEK_SET) = 0
[pid 25452] 10:12:34.848836 read(10, "", 4096) = 0
[pid 25452] 10:12:34.848893 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25452] 10:12:34.848948 alarm(60)   = 0
[pid 25452] 10:12:34.848985 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25452] 10:12:34.849027 alarm(0)    = 60
[pid 25452] 10:12:34.849150 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25452] 10:12:34.849225 open("/var/spool/exim/db/retry", O_RDONLY) = 13
[pid 25452] 10:12:34.849271 fcntl(13, F_GETFD) = 0
[pid 25452] 10:12:34.849306 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25452] 10:12:34.849344 read(13, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25452] 10:12:34.849393 close(13)   = 0
[pid 25452] 10:12:34.849440 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:34.849560 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25452] 10:12:34.849851 open("/var/spool/exim/db/retry", O_RDONLY) = 13
[pid 25452] 10:12:34.849901 fcntl(13, F_GETFD) = 0
[pid 25452] 10:12:34.849936 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25453] 10:12:34.850060 brk(0x1c73000 <unfinished ...>
[pid 25452] 10:12:34.850085 fstat(13, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25452] 10:12:34.850179 pread(13, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25452] 10:12:34.850253 pread(13, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25452] 10:12:34.850341 pread(13, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
Process 25454 attached
[pid 25452] 10:12:34.850419 close(13 <unfinished ...>
[pid 25454] 10:12:34.850472 set_robust_list(0x7fb627050aa0, 24 <unfinished ...>
[pid 25453] 10:12:34.850567 <... brk resumed> ) = 0x1c73000
[pid 25452] 10:12:34.850583 <... close resumed> ) = 0
[pid 25454] 10:12:34.850666 <... set_robust_list resumed> ) = 0
[pid 25454] 10:12:34.850747 geteuid( <unfinished ...>
[pid 25452] 10:12:34.850773 close(11 <unfinished ...>
[pid 25454] 10:12:34.851121 <... geteuid resumed> ) = 0
[pid 25453] 10:12:34.851137 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25452] 10:12:34.851171 <... close resumed> ) = 0
[pid 25454] 10:12:34.851187 geteuid()   = 0
[pid 25452] 10:12:34.851249 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25454] 10:12:34.851287 getegid( <unfinished ...>
[pid 25452] 10:12:34.851307 <... socket resumed> ) = 11
[pid 25454] 10:12:34.851334 <... getegid resumed> ) = 12
[pid 25452] 10:12:34.851349 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25454] 10:12:34.851386 setgid(12 <unfinished ...>
[pid 25452] 10:12:34.851406 <... setsockopt resumed> ) = 0
[pid 25454] 10:12:34.851439 <... setgid resumed> ) = 0
[pid 25452] 10:12:34.851455 alarm(300 <unfinished ...>
[pid 25454] 10:12:34.851541 setuid(47 <unfinished ...>
[pid 25452] 10:12:34.851563 <... alarm resumed> ) = 0
[pid 25454] 10:12:34.851597 <... setuid resumed> ) = 0
[pid 25452] 10:12:34.851615 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("68.232.143.144")}, 16 <unfinished ...>
[pid 25453] 10:12:34.852554 <... open resumed> ) = 7
[pid 25453] 10:12:34.852587 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25453] 10:12:34.852656 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25453] 10:12:34.852707 read(7, "\320\25w{G\223\34#\227u1\273e\10;\202\207yd\25\7{\211Y\36\303\360X\344z\222C\302\31 )tVPs\1\257\30\211\22\310\220\301", 48) = 48
[pid 25453] 10:12:34.852754 close(7)    = 0
[pid 25453] 10:12:34.852807 getuid()    = 47
[pid 25453] 10:12:34.852976 exit_group(0) = ?
[pid 25453] 10:12:34.853229 +++ exited with 0 +++
[pid 25443] 10:12:34.853250 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25453
[pid 25443] 10:12:34.853275 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25443] 10:12:34.853341 getcwd("/var/spool/exim", 16380) = 16
[pid 25443] 10:12:34.853413 open("/etc/localtime", O_RDONLY) = 7
[pid 25443] 10:12:34.853457 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:34.853569 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:34.853627 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:34.853673 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25443] 10:12:34.853723 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25443] 10:12:34.853758 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25443] 10:12:34.853808 close(7)    = 0
[pid 25443] 10:12:34.853844 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.853895 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25443] 10:12:34.853944 fcntl(7, F_GETFD) = 0
[pid 25443] 10:12:34.853977 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:34.854010 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368688, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.854057 write(7, "2015-12-30 10:12:34 [25443] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMY-0006cE-He\n", 92) = 92
[pid 25443] 10:12:34.854099 chdir("/var/spool/exim") = 0
[pid 25443] 10:12:34.854139 setgid(12)  = 0
[pid 25443] 10:12:34.854200 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25443] 10:12:34.854284 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25443] 10:12:34.854374 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25443] 10:12:34.854450 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25443] 10:12:34.854644 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25443] 10:12:34.854748 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25443] 10:12:34.854861 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25443] 10:12:34.854936 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25443] 10:12:34.854982 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.855030 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:34.855067 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.855115 close(8)    = 0
[pid 25443] 10:12:34.855150 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.855246 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25443] 10:12:34.855343 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25443] 10:12:34.855465 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25443] 10:12:34.855679 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25443] 10:12:34.855799 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25443] 10:12:34.856581 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25443] 10:12:34.856638 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.856688 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:34.856725 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.856776 close(8)    = 0
[pid 25443] 10:12:34.856816 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.856869 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25443] 10:12:34.856912 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.856959 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:34.856996 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.857047 close(8)    = 0
[pid 25443] 10:12:34.857082 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.857141 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25443] 10:12:34.857185 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.857232 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:34.857269 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.857317 close(8)    = 0
[pid 25443] 10:12:34.857352 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.857459 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25443] 10:12:34.857688 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25443] 10:12:34.857795 read(6, "", 4096) = 0
[pid 25443] 10:12:34.857835 read(6, "", 4096) = 0
[pid 25443] 10:12:34.857872 close(6)    = 0
[pid 25443] 10:12:34.857908 munmap(0x7fdec5ab9000, 4096) = 0
[pid 25443] 10:12:34.857961 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fdec496f790}, NULL, 8) = 0
[pid 25443] 10:12:34.858012 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-D", O_RDWR|O_APPEND) = 6
[pid 25443] 10:12:34.858061 fcntl(6, F_GETFD) = 0
[pid 25443] 10:12:34.858095 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:34.858129 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25443] 10:12:34.858173 fstat(6, {st_dev=makedev(144, 4215), st_ino=124799976, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.858228 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-H", O_RDONLY) = 8
[pid 25443] 10:12:34.858274 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799978, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=991, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.858320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab9000
[pid 25443] 10:12:34.858359 read(8, "1aEJMY-0006cE-He-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 991
[pid 25443] 10:12:34.858432 read(8, "", 4096) = 0
[pid 25443] 10:12:34.858470 close(8)    = 0
[pid 25443] 10:12:34.858580 munmap(0x7fdec5ab9000, 4096) = 0
[pid 25443] 10:12:34.858633 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.858691 open("/var/spool/exim/msglog/Y/1aEJMY-0006cE-He", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25443] 10:12:34.858739 fcntl(8, F_GETFD) = 0
[pid 25443] 10:12:34.858773 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:34.858811 fchown(8, 47, 12) = 0
[pid 25443] 10:12:34.858854 fchmod(8, 0640) = 0
[pid 25443] 10:12:34.858894 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25443] 10:12:34.858930 fstat(8, {st_dev=makedev(144, 4215), st_ino=124799982, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.858979 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab9000
[pid 25454] 10:12:34.859113 brk(0x1374000 <unfinished ...>
[pid 25443] 10:12:34.859136 lseek(8, 0, SEEK_CUR) = 0
[pid 25443] 10:12:34.859177 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:34.859233 pipe([9, 10]) = 0
[pid 25443] 10:12:34.859274 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [], SA_RESTORER, 0x7fdec496f790}, 8) = 0
[pid 25443] 10:12:34.859318 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25456
[pid 25443] 10:12:34.859614 close(10)   = 0
[pid 25443] 10:12:34.859656 read(9,  <unfinished ...>
[pid 25454] 10:12:34.859687 <... brk resumed> ) = 0x1374000
[pid 25454] 10:12:34.860044 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25454] 10:12:34.860104 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25454] 10:12:34.860159 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25454] 10:12:34.860204 read(7, "0\345G\253%\322!`5L>\271E\325\237\316Yvp\350\363\321\340\236\367\370\307*\334\1\372\r\37[\10%u\36\177 \303\342\301BE\35a\5", 48) = 48
[pid 25454] 10:12:34.860250 close(7)    = 0
[pid 25454] 10:12:34.860300 getuid()    = 47
[pid 25454] 10:12:34.860468 exit_group(0) = ?
[pid 25454] 10:12:34.860778 +++ exited with 0 +++
[pid 25445] 10:12:34.860802 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25454
[pid 25445] 10:12:34.860834 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, 8) = 0
[pid 25445] 10:12:34.860900 getcwd("/var/spool/exim", 16380) = 16
[pid 25445] 10:12:34.861027 open("/etc/localtime", O_RDONLY) = 7
[pid 25445] 10:12:34.861072 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.861121 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.861166 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.861203 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25445] 10:12:34.861251 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25445] 10:12:34.861286 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25445] 10:12:34.861335 close(7)    = 0
[pid 25445] 10:12:34.861371 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.861423 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25445] 10:12:34.861472 fcntl(7, F_GETFD) = 0
[pid 25445] 10:12:34.861581 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25445] 10:12:34.861624 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368780, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.861681 write(7, "2015-12-30 10:12:34 [25445] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMX-0006bd-HC\n", 108) = 108
[pid 25445] 10:12:34.861725 chdir("/var/spool/exim") = 0
[pid 25445] 10:12:34.861765 geteuid()   = 0
[pid 25445] 10:12:34.861799 getegid()   = 12
[pid 25445] 10:12:34.861840 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25445] 10:12:34.861884 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.861930 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.861973 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.862022 close(8)    = 0
[pid 25445] 10:12:34.862058 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.862099 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25445] 10:12:34.862143 read(8, "65536\n", 31) = 6
[pid 25445] 10:12:34.862180 close(8)    = 0
[pid 25445] 10:12:34.862219 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25445] 10:12:34.862261 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25445] 10:12:34.862306 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.862345 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.862381 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25445] 10:12:34.862432 read(8, "", 4096) = 0
[pid 25445] 10:12:34.862469 close(8)    = 0
[pid 25445] 10:12:34.862580 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.862633 setgroups(1, [12]) = 0
[pid 25445] 10:12:34.862677 setgid(12)  = 0
[pid 25445] 10:12:34.862716 setuid(47)  = 0
[pid 25445] 10:12:34.862775 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25445] 10:12:34.862859 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25445] 10:12:34.862942 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25445] 10:12:34.863016 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25445] 10:12:34.863092 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25445] 10:12:34.863180 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25445] 10:12:34.863291 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25445] 10:12:34.863362 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25445] 10:12:34.863406 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.863463 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.863587 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.863650 close(8)    = 0
[pid 25445] 10:12:34.863692 munmap(0x7fb627066000, 4096Process 25455 attached
) = 0
[pid 25455] 10:12:34.863826 set_robust_list(0x7f20f9c9faa0, 24 <unfinished ...>
[pid 25445] 10:12:34.863856 read(6,  <unfinished ...>
[pid 25455] 10:12:34.863884 <... set_robust_list resumed> ) = 0
[pid 25445] 10:12:34.863898 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25455] 10:12:34.863998 geteuid( <unfinished ...>
[pid 25445] 10:12:34.864026 read(6,  <unfinished ...>
[pid 25455] 10:12:34.864053 <... geteuid resumed> ) = 0
[pid 25445] 10:12:34.864067 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25455] 10:12:34.864176 geteuid( <unfinished ...>
[pid 25445] 10:12:34.864203 read(6,  <unfinished ...>
[pid 25455] 10:12:34.864230 <... geteuid resumed> ) = 0
[pid 25445] 10:12:34.864244 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25455] 10:12:34.864350 getegid( <unfinished ...>
[pid 25445] 10:12:34.864375 read(6,  <unfinished ...>
[pid 25455] 10:12:34.864403 <... getegid resumed> ) = 499
[pid 25445] 10:12:34.864417 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25455] 10:12:34.864592 setgid(12 <unfinished ...>
[pid 25445] 10:12:34.864632 read(6,  <unfinished ...>
[pid 25455] 10:12:34.864664 <... setgid resumed> ) = 0
[pid 25445] 10:12:34.864683 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25455] 10:12:34.864726 setuid(47 <unfinished ...>
[pid 25445] 10:12:34.864752 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25455] 10:12:34.864785 <... setuid resumed> ) = 0
[pid 25445] 10:12:34.864799 <... open resumed> ) = 8
[pid 25445] 10:12:34.865535 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.865598 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.865643 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.865708 close(8)    = 0
[pid 25445] 10:12:34.865748 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.865796 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25445] 10:12:34.865839 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25445] 10:12:34.865885 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.865921 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25445] 10:12:34.865970 close(8)    = 0
[pid 25445] 10:12:34.866004 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.866062 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25445] 10:12:34.866105 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25445] 10:12:34.866150 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.866186 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25445] 10:12:34.866233 close(8)    = 0
[pid 25445] 10:12:34.866266 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.866368 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25445] 10:12:34.866575 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25445] 10:12:34.866711 read(6, "", 4096) = 0
[pid 25445] 10:12:34.866753 read(6, "", 4096) = 0
[pid 25445] 10:12:34.866789 close(6)    = 0
[pid 25445] 10:12:34.866824 munmap(0x7fb627067000, 4096) = 0
[pid 25445] 10:12:34.866864 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25445] 10:12:34.866905 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.866952 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627067000
[pid 25445] 10:12:34.866988 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.867034 close(6)    = 0
[pid 25445] 10:12:34.867068 munmap(0x7fb627067000, 4096) = 0
[pid 25445] 10:12:34.867113 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25445] 10:12:34.867183 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.867236 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25445] 10:12:34.867276 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25445] 10:12:34.867316 fstat(0, {st_dev=makedev(0, 8), st_ino=2130166832, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.867362 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627067000
[pid 25445] 10:12:34.867397 read(0, "X-Failed-Recipients: info@evrc.net,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type"..., 4096) = 4096
[pid 25445] 10:12:34.867555 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.867639 open("/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25445] 10:12:34.868597 fchown(6, 47, 12) = 0
[pid 25445] 10:12:34.868641 fchmod(6, 0640) = 0
[pid 25445] 10:12:34.868679 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25445] 10:12:34.868714 fstat(6, {st_dev=makedev(144, 4215), st_ino=124800000, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.868761 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627066000
[pid 25445] 10:12:34.868798 lseek(6, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.868831 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25445] 10:12:34.868960 read(0, "016</td>      </tr>      <tr>        <td width=\"50%\" align=\"right\" bgcolor=\"#FFFFFF\"><span class=\"style3\">Preferred Contact Method : </span></td>        <td width=\"50%\" bgcolor=\"#FFFFFF\" class=\"style3\">&nbsp;Send me Information via Email</td>      </tr>   "..., 4096) = 334
[pid 25445] 10:12:34.869008 read(0, "", 4096) = 0
[pid 25445] 10:12:34.869041 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.869078 write(6, "1aEJMY-0006cP-Ry-D\n--1451491954-eximdsn-670341853\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a perm"..., 4059) = 4059
[pid 25445] 10:12:34.869125 fsync(6 <unfinished ...>
[pid 25455] 10:12:34.869256 brk(0xeac000) = 0xeac000
[pid 25445] 10:12:34.869545 <... fsync resumed> ) = 0
[pid 25445] 10:12:34.869590 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.869683 fstat(6, {st_dev=makedev(144, 4215), st_ino=124800000, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4059, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.869817 brk(0x1374000) = 0x1374000
[pid 25445] 10:12:34.869882 getuid()    = 47
[pid 25445] 10:12:34.869919 geteuid()   = 47
[pid 25445] 10:12:34.869954 getgid()    = 12
[pid 25445] 10:12:34.869988 getegid()   = 12
[pid 25445] 10:12:34.870085 open("/dev/urandom", O_RDONLY) = 8
[pid 25445] 10:12:34.870133 read(8, "\254^\303\344", 4) = 4
[pid 25445] 10:12:34.870177 close(8)    = 0
[pid 25445] 10:12:34.870297 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25445] 10:12:34.870409 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b720) = -1 EINVAL (Invalid argument)
[pid 25445] 10:12:34.870457 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25445] 10:12:34.870556 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b720) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.870596 lseek(1, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.870631 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.870666 lseek(2, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.870702 open("/dev/null", O_RDONLY) = 8
[pid 25445] 10:12:34.870746 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b800) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.870782 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.870816 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25445] 10:12:34.870852 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb625f1d790}, 8) = 0
[pid 25445] 10:12:34.870893 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb625f1d790}, 8) = 0
[pid 25445] 10:12:34.871174 read(8, "", 8192) = 0
[pid 25445] 10:12:34.871223 close(8)    = 0
[pid 25445] 10:12:34.871551 brk(0x1395000) = 0x1395000
[pid 25445] 10:12:34.871719 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25445] 10:12:34.871786 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25445] 10:12:34.871828 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.871867 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.871920 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25445] 10:12:34.872994 brk(0x13b6000) = 0x13b6000
[pid 25445] 10:12:34.873231 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25445] 10:12:34.874232 brk(0x13d7000) = 0x13d7000
[pid 25445] 10:12:34.874654 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25445] 10:12:34.875581 brk(0x13f8000) = 0x13f8000
[pid 25445] 10:12:34.875888 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25445] 10:12:34.876197 read(8, "", 8192) = 0
[pid 25445] 10:12:34.876247 close(8)    = 0
[pid 25445] 10:12:34.876302 stat("/usr/share/amavis/amavis-filter", 0x7fb625704880) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.876354 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25445] 10:12:34.876418 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25445] 10:12:34.876471 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25445] 10:12:34.876577 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.876629 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.876690 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25445] 10:12:34.877136 stat("/etc/exim/perl/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877191 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25455] 10:12:34.877472 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25445] 10:12:34.877566 <... stat resumed> 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877598 stat("/usr/local/cpanel/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877649 stat("/usr/local/cpanel/warnings.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877700 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877754 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877799 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877841 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877883 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877927 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.877970 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.878013 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25445] 10:12:34.878069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25445] 10:12:34.878115 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.878153 lseek(9, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.878198 brk(0x1419000) = 0x1419000
[pid 25445] 10:12:34.878248 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25455] 10:12:34.878297 <... open resumed> ) = 7
[pid 25445] 10:12:34.878691 read(9,  <unfinished ...>
[pid 25455] 10:12:34.878740 fstat(7,  <unfinished ...>
[pid 25445] 10:12:34.878766 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25455] 10:12:34.878795 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25445] 10:12:34.879561 read(9,  <unfinished ...>
[pid 25455] 10:12:34.879619 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25445] 10:12:34.879654 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25455] 10:12:34.879680 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25445] 10:12:34.879778 brk(0x143a000 <unfinished ...>
[pid 25455] 10:12:34.879818 read(7,  <unfinished ...>
[pid 25445] 10:12:34.879849 <... brk resumed> ) = 0x143a000
[pid 25455] 10:12:34.879865 <... read resumed> "\3260\364-\360\236{\271\362R%\255\313\252\303\357\320\34387\247.\346\354\360\275\267\321]\35a\37{\307#\346u\200\n\260\7\27\3051\215\312\375\336", 48) = 48
[pid 25445] 10:12:34.880186 read(9,  <unfinished ...>
[pid 25455] 10:12:34.880222 close(7)    = 0
[pid 25455] 10:12:34.880277 getuid()    = 47
[pid 25455] 10:12:34.880445 exit_group(0) = ?
[pid 25445] 10:12:34.880733 <... read resumed> "", 8192) = 0
[pid 25445] 10:12:34.880769 close(9)    = 0
[pid 25445] 10:12:34.881469 read(8, Process 25456 attached
 <unfinished ...>
[pid 25456] 10:12:34.881653 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25455] 10:12:34.881701 +++ exited with 0 +++
[pid 25444] 10:12:34.881714 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25455
[pid 25444] 10:12:34.881739 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, 8) = 0
[pid 25444] 10:12:34.881803 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25444] 10:12:34.881878 open("/etc/localtime", O_RDONLY) = 7
[pid 25444] 10:12:34.881921 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.881969 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.882013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.882050 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25444] 10:12:34.882098 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25444] 10:12:34.882131 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25444] 10:12:34.882185 close(7)    = 0
[pid 25444] 10:12:34.882220 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.882270 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25444] 10:12:34.882318 fcntl(7, F_GETFD) = 0
[pid 25444] 10:12:34.882350 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25444] 10:12:34.882383 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368888, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.882429 write(7, "2015-12-30 10:12:34 [25444] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25444] 10:12:34.882472 chdir("/var/spool/exim") = 0
[pid 25444] 10:12:34.882605 geteuid()   = 0
[pid 25444] 10:12:34.882647 getegid()   = 499
[pid 25444] 10:12:34.882701 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25444] 10:12:34.882747 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25444] 10:12:34.882793 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.882829 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.882876 close(8)    = 0
[pid 25444] 10:12:34.882911 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.882951 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25444] 10:12:34.882995 read(8, "65536\n", 31) = 6
[pid 25444] 10:12:34.883030 close(8)    = 0
[pid 25444] 10:12:34.883068 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25444] 10:12:34.883109 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25444] 10:12:34.883154 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb5000
[pid 25444] 10:12:34.883189 lseek(8, 0, SEEK_CUR) = 0
[pid 25444] 10:12:34.883224 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25444] 10:12:34.883273 read(8, "", 4096) = 0
[pid 25444] 10:12:34.883310 close(8)    = 0
[pid 25456] 10:12:34.883348 <... set_robust_list resumed> ) = 0
[pid 25444] 10:12:34.883363 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25456] 10:12:34.883450 close(9 <unfinished ...>
[pid 25444] 10:12:34.883472 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.883564 setgroups(1, [12]) = 0
[pid 25444] 10:12:34.883607 setgid(12 <unfinished ...>
[pid 25456] 10:12:34.883644 <... close resumed> ) = 0
[pid 25444] 10:12:34.883658 <... setgid resumed> ) = 0
[pid 25456] 10:12:34.883696 geteuid( <unfinished ...>
[pid 25444] 10:12:34.883725 setuid(47 <unfinished ...>
[pid 25456] 10:12:34.883753 <... geteuid resumed> ) = 0
[pid 25444] 10:12:34.883767 <... setuid resumed> ) = 0
[pid 25456] 10:12:34.883815 getegid( <unfinished ...>
[pid 25444] 10:12:34.883840 read(6,  <unfinished ...>
[pid 25456] 10:12:34.883870 <... getegid resumed> ) = 12
[pid 25444] 10:12:34.883884 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25456] 10:12:34.883952 setgid(494 <unfinished ...>
[pid 25444] 10:12:34.883977 read(6,  <unfinished ...>
[pid 25456] 10:12:34.884004 <... setgid resumed> ) = 0
[pid 25444] 10:12:34.884018 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25456] 10:12:34.884087 setuid(495 <unfinished ...>
[pid 25444] 10:12:34.884123 read(6,  <unfinished ...>
[pid 25456] 10:12:34.884183 <... setuid resumed> ) = 0
[pid 25445] 10:12:34.884198 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25444] 10:12:34.884239 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25456] 10:12:34.884606 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.884656 read(6,  <unfinished ...>
[pid 25456] 10:12:34.884692 <... open resumed> ) = 9
[pid 25444] 10:12:34.884707 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25456] 10:12:34.884781 fstat(9,  <unfinished ...>
[pid 25444] 10:12:34.884807 read(6,  <unfinished ...>
[pid 25456] 10:12:34.884834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.884864 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25456] 10:12:34.884978 fstat(9,  <unfinished ...>
[pid 25444] 10:12:34.885006 read(6,  <unfinished ...>
[pid 25456] 10:12:34.885034 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.885062 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25456] 10:12:34.885159 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.885198 read(6,  <unfinished ...>
[pid 25456] 10:12:34.885227 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25444] 10:12:34.885241 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25456] 10:12:34.885296 read(9,  <unfinished ...>
[pid 25444] 10:12:34.885329 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25456] 10:12:34.885363 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25444] 10:12:34.885381 <... open resumed> ) = 8
[pid 25456] 10:12:34.885405 read(9,  <unfinished ...>
[pid 25444] 10:12:34.885432 fstat(8,  <unfinished ...>
[pid 25456] 10:12:34.885583 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25444] 10:12:34.885608 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25456] 10:12:34.886177 close(9 <unfinished ...>
[pid 25445] 10:12:34.886216 read(8,  <unfinished ...>
[pid 25444] 10:12:34.886238 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25456] 10:12:34.886270 <... close resumed> ) = 0
[pid 25444] 10:12:34.886284 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25456] 10:12:34.886307 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25444] 10:12:34.886333 read(8,  <unfinished ...>
[pid 25456] 10:12:34.886365 <... munmap resumed> ) = 0
[pid 25444] 10:12:34.886379 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25456] 10:12:34.886454 brk(0x1c74000 <unfinished ...>
[pid 25444] 10:12:34.886552 close(8 <unfinished ...>
[pid 25456] 10:12:34.886586 <... brk resumed> ) = 0x1c74000
[pid 25444] 10:12:34.886605 <... close resumed> ) = 0
[pid 25456] 10:12:34.886813 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.886845 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25456] 10:12:34.886877 <... lseek resumed> ) = 19
[pid 25444] 10:12:34.886891 <... munmap resumed> ) = 0
[pid 25456] 10:12:34.886984 read(6,  <unfinished ...>
[pid 25444] 10:12:34.887013 read(6,  <unfinished ...>
[pid 25456] 10:12:34.887041 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2377) = 1858
[pid 25444] 10:12:34.887061 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25456] 10:12:34.887364 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25444] 10:12:34.887394 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25444] 10:12:34.887595 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25444] 10:12:34.887735 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25456] 10:12:34.887868 <... write resumed> ) = 4
[pid 25444] 10:12:34.887888 read(6,  <unfinished ...>
[pid 25443] 10:12:34.887914 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25456] 10:12:34.887938 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25444] 10:12:34.887962 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25443] 10:12:34.887998 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888030 <... write resumed> ) = 4
[pid 25444] 10:12:34.888043 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.888074 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25456] 10:12:34.888097 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25444] 10:12:34.888120 <... open resumed> ) = 8
[pid 25443] 10:12:34.888136 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888164 <... write resumed> ) = 4
[pid 25444] 10:12:34.888177 fstat(8,  <unfinished ...>
[pid 25443] 10:12:34.888202 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25456] 10:12:34.888224 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25444] 10:12:34.888247 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.888281 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888317 <... write resumed> ) = 4
[pid 25444] 10:12:34.888330 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.888359 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25456] 10:12:34.888382 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25444] 10:12:34.888406 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25443] 10:12:34.888424 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888453 <... write resumed> ) = 4
[pid 25444] 10:12:34.888466 read(8,  <unfinished ...>
[pid 25443] 10:12:34.888568 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25456] 10:12:34.888600 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25444] 10:12:34.888633 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.888667 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888700 <... write resumed> ) = 40
[pid 25444] 10:12:34.888714 close(8 <unfinished ...>
[pid 25443] 10:12:34.888740 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25456] 10:12:34.888764 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25444] 10:12:34.888788 <... close resumed> ) = 0
[pid 25443] 10:12:34.888804 read(9,  <unfinished ...>
[pid 25456] 10:12:34.888832 <... write resumed> ) = 4
[pid 25444] 10:12:34.888845 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25443] 10:12:34.888878 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25456] 10:12:34.888911 close(10 <unfinished ...>
[pid 25445] 10:12:34.888935 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25444] 10:12:34.888953 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.889565 wait4(-1,  <unfinished ...>
[pid 25456] 10:12:34.889614 <... close resumed> ) = 0
[pid 25444] 10:12:34.889635 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25456] 10:12:34.889684 exit_group(0) = ?
[pid 25444] 10:12:34.889698 <... open resumed> ) = 8
[pid 25456] 10:12:34.889925 +++ exited with 0 +++
[pid 25444] 10:12:34.889942 fstat(8,  <unfinished ...>
[pid 25443] 10:12:34.889966 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25456
[pid 25444] 10:12:34.889990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.890021 close(9 <unfinished ...>
[pid 25444] 10:12:34.890053 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.890080 <... close resumed> ) = 0
[pid 25444] 10:12:34.890100 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25443] 10:12:34.890117 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25444] 10:12:34.890149 read(8,  <unfinished ...>
[pid 25443] 10:12:34.890175 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25444] 10:12:34.890216 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.890248 brk(0x1c73000 <unfinished ...>
[pid 25444] 10:12:34.890277 close(8 <unfinished ...>
[pid 25443] 10:12:34.890301 <... brk resumed> ) = 0x1c73000
[pid 25444] 10:12:34.890330 <... close resumed> ) = 0
[pid 25443] 10:12:34.890347 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25444] 10:12:34.890385 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25443] 10:12:34.890413 <... open resumed> ) = 9
[pid 25444] 10:12:34.890436 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.890545 alarm(60 <unfinished ...>
[pid 25444] 10:12:34.890583 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.890613 <... alarm resumed> ) = 0
[pid 25444] 10:12:34.890633 <... open resumed> ) = 8
[pid 25443] 10:12:34.890650 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25444] 10:12:34.890682 fstat(8,  <unfinished ...>
[pid 25443] 10:12:34.890705 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.890725 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.890754 alarm(0 <unfinished ...>
[pid 25444] 10:12:34.890781 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.890807 <... alarm resumed> ) = 60
[pid 25444] 10:12:34.890871 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25443] 10:12:34.890945 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.890994 read(8,  <unfinished ...>
[pid 25443] 10:12:34.891021 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.891043 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.891079 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.891120 close(8 <unfinished ...>
[pid 25443] 10:12:34.891144 <... open resumed> ) = 10
[pid 25444] 10:12:34.891164 <... close resumed> ) = 0
[pid 25443] 10:12:34.891181 read(10,  <unfinished ...>
[pid 25444] 10:12:34.891230 munmap(0x7f20f9cb5000, 4096 <unfinished ...>
[pid 25443] 10:12:34.891258 <... read resumed> "cpu  123054 1342383 395114 67343095 2509 0 0 0\ncpu0 123054 1342383 395114 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58297316\nbtime 1450798266\nprocesses 892934\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25444] 10:12:34.891283 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.891371 close(10 <unfinished ...>
[pid 25444] 10:12:34.891409 read(6,  <unfinished ...>
[pid 25443] 10:12:34.891434 <... close resumed> ) = 0
[pid 25444] 10:12:34.891575 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25443] 10:12:34.891699 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25444] 10:12:34.891738 read(6,  <unfinished ...>
[pid 25443] 10:12:34.891763 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25444] 10:12:34.891804 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25443] 10:12:34.891885 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25445] 10:12:34.892138 read(8,  <unfinished ...>
[pid 25444] 10:12:34.892161 read(6,  <unfinished ...>
[pid 25443] 10:12:34.892185 <... open resumed> ) = 10
[pid 25444] 10:12:34.892207 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:34.892227 fcntl(10, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.892254 read(6,  <unfinished ...>
[pid 25443] 10:12:34.892276 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.892295 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:34.892314 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.892346 close(6 <unfinished ...>
[pid 25443] 10:12:34.892370 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.892395 <... close resumed> ) = 0
[pid 25443] 10:12:34.892412 read(10,  <unfinished ...>
[pid 25444] 10:12:34.892439 munmap(0x7f20f9cb6000, 4096 <unfinished ...>
[pid 25443] 10:12:34.892467 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25444] 10:12:34.892577 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.892601 close(10 <unfinished ...>
[pid 25444] 10:12:34.892631 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.892661 <... close resumed> ) = 0
[pid 25444] 10:12:34.892698 <... open resumed> ) = 6
[pid 25443] 10:12:34.892718 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.892750 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.892779 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.892804 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.892840 stat("/var/tmp",  <unfinished ...>
[pid 25445] 10:12:34.892877 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25444] 10:12:34.892895 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.893413 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25444] 10:12:34.893574 <... mmap resumed> ) = 0x7f20f9cb6000
[pid 25443] 10:12:34.893600 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25444] 10:12:34.893634 read(6,  <unfinished ...>
[pid 25443] 10:12:34.893662 <... mmap resumed> ) = 0x7fdec5a71000
[pid 25444] 10:12:34.893801 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.893837 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.893873 close(6 <unfinished ...>
[pid 25443] 10:12:34.893897 <... open resumed> ) = 10
[pid 25444] 10:12:34.893917 <... close resumed> ) = 0
[pid 25443] 10:12:34.893934 fcntl(10, F_GETFD <unfinished ...>
[pid 25444] 10:12:34.893960 munmap(0x7f20f9cb6000, 4096 <unfinished ...>
[pid 25443] 10:12:34.893988 <... fcntl resumed> ) = 0
[pid 25444] 10:12:34.894008 <... munmap resumed> ) = 0
[pid 25443] 10:12:34.894040 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.894071 fstat(1,  <unfinished ...>
[pid 25443] 10:12:34.894094 <... fcntl resumed> ) = 0
[pid 25452] 10:12:34.894127 <... connect resumed> ) = 0
[pid 25444] 10:12:34.894145 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25443] 10:12:34.894187 fstat(10,  <unfinished ...>
[pid 25452] 10:12:34.894219 alarm(0 <unfinished ...>
[pid 25444] 10:12:34.894242 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f20f8b6c790},  <unfinished ...>
[pid 25443] 10:12:34.894269 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25452] 10:12:34.894337 <... alarm resumed> ) = 300
[pid 25444] 10:12:34.894366 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25443] 10:12:34.894396 pread(10,  <unfinished ...>
[pid 25452] 10:12:34.894428 getsockname(11,  <unfinished ...>
[pid 25444] 10:12:34.894455 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0},  <unfinished ...>
[pid 25443] 10:12:34.894551 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25452] 10:12:34.894642 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(51198), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25444] 10:12:34.894687 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:34.894711 pread(10,  <unfinished ...>
[pid 25452] 10:12:34.894742 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25444] 10:12:34.894768 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0},  <unfinished ...>
[pid 25443] 10:12:34.894795 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25452] 10:12:34.894838 <... setsockopt resumed> ) = 0
[pid 25444] 10:12:34.894864 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:34.894886 pread(10,  <unfinished ...>
[pid 25452] 10:12:34.894916 stat("/etc/mailhelo",  <unfinished ...>
[pid 25444] 10:12:34.894943 fstat(0,  <unfinished ...>
[pid 25443] 10:12:34.894966 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25452] 10:12:34.895022 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25444] 10:12:34.895065 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130166821, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.895095 close(10 <unfinished ...>
[pid 25452] 10:12:34.895125 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.895153 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.895180 <... close resumed> ) = 0
[pid 25452] 10:12:34.895226 <... open resumed> ) = 13
[pid 25444] 10:12:34.895246 <... mmap resumed> ) = 0x7f20f9cb6000
[pid 25443] 10:12:34.895373 munmap(0x7fdec5a71000, 200704 <unfinished ...>
[pid 25452] 10:12:34.895435 fstat(13,  <unfinished ...>
[pid 25445] 10:12:34.895460 read(8,  <unfinished ...>
[pid 25444] 10:12:34.895570 read(0,  <unfinished ...>
[pid 25443] 10:12:34.895604 <... munmap resumed> ) = 0
[pid 25452] 10:12:34.895649 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25444] 10:12:34.895687 <... read resumed> "To:  info@theviewsatsuperstition.com, paula@wagthedogmedia.com, terri@theviewsatsuperstition.com, theviewsatsuperstition@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@f"..., 4096) = 2165
[pid 25443] 10:12:34.895777 close(9 <unfinished ...>
[pid 25452] 10:12:34.895817 fstat(13,  <unfinished ...>
[pid 25444] 10:12:34.895841 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:34.895867 <... close resumed> ) = 0
[pid 25452] 10:12:34.895912 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25445] 10:12:34.895944 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25444] 10:12:34.895962 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:34.896179 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25452] 10:12:34.896226 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25445] 10:12:34.896254 brk(0x145b000 <unfinished ...>
[pid 25444] 10:12:34.896275 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25443] 10:12:34.896342 <... open resumed> ) = 9
[pid 25452] 10:12:34.896369 <... mmap resumed> ) = 0x7f380d423000
[pid 25444] 10:12:34.896388 <... open resumed> ) = 6
[pid 25443] 10:12:34.896409 fstat(9,  <unfinished ...>
[pid 25452] 10:12:34.896438 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.896461 fchown(6, 47, 12 <unfinished ...>
[pid 25443] 10:12:34.896563 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:34.896611 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.896636 <... fchown resumed> ) = 0
[pid 25443] 10:12:34.896665 fstat(9,  <unfinished ...>
[pid 25452] 10:12:34.896695 read(13,  <unfinished ...>
[pid 25444] 10:12:34.896718 fchmod(6, 0640 <unfinished ...>
[pid 25443] 10:12:34.896747 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:34.896782 <... read resumed> "", 4096) = 0
[pid 25445] 10:12:34.896815 <... brk resumed> ) = 0x145b000
[pid 25444] 10:12:34.896832 <... fchmod resumed> ) = 0
[pid 25443] 10:12:34.897275 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:34.897322 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.897346 read(8,  <unfinished ...>
[pid 25444] 10:12:34.897369 fcntl(6, F_GETFL <unfinished ...>
[pid 25443] 10:12:34.897392 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25452] 10:12:34.897414 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.897431 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25443] 10:12:34.897449 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25452] 10:12:34.897544 read(13,  <unfinished ...>
[pid 25444] 10:12:34.897573 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.897601 <... lseek resumed> ) = 0
[pid 25452] 10:12:34.897630 <... read resumed> "", 4096) = 0
[pid 25444] 10:12:34.897712 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.897751 read(9,  <unfinished ...>
[pid 25452] 10:12:34.897790 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.897814 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:34.897840 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25452] 10:12:34.897892 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.897913 <... mmap resumed> ) = 0x7f20f9cb5000
[pid 25443] 10:12:34.897930 stat("/jail_owner",  <unfinished ...>
[pid 25452] 10:12:34.897963 read(13,  <unfinished ...>
[pid 25444] 10:12:34.897986 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.898009 <... stat resumed> 0x7ffd94719780) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:34.898039 <... read resumed> "", 4096) = 0
[pid 25444] 10:12:34.898060 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.898076 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25452] 10:12:34.898115 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.898138 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25443] 10:12:34.898166 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25452] 10:12:34.898210 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.898228 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.898297 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25452] 10:12:34.898336 read(13,  <unfinished ...>
[pid 25444] 10:12:34.898361 read(0,  <unfinished ...>
[pid 25443] 10:12:34.898383 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:34.898412 <... read resumed> "", 4096) = 0
[pid 25444] 10:12:34.898445 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:34.898464 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25452] 10:12:34.898579 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25444] 10:12:34.898616 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f20f8b6c790},  <unfinished ...>
[pid 25443] 10:12:34.898648 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25444] 10:12:34.898688 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25443] 10:12:34.898706 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25444] 10:12:34.898741 write(6, "1aEJMY-0006cO-Sq-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877 <unfinished ...>
[pid 25443] 10:12:34.898777 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.898804 <... write resumed> ) = 1877
[pid 25443] 10:12:34.898829 stat("/etc/demouids",  <unfinished ...>
[pid 25445] 10:12:34.898863 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25444] 10:12:34.898880 fsync(6 <unfinished ...>
[pid 25443] 10:12:34.899577 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.899650 open("/etc/demouids", O_RDONLY) = 10
[pid 25443] 10:12:34.899741 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.899792 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.899839 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab7000
[pid 25444] 10:12:34.899886 <... fsync resumed> ) = 0
[pid 25443] 10:12:34.899918 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.899948 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:34.899975 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.899996 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:34.900061 read(10,  <unfinished ...>
[pid 25444] 10:12:34.900092 fstat(6,  <unfinished ...>
[pid 25443] 10:12:34.900114 <... read resumed> "", 4096) = 0
[pid 25444] 10:12:34.900142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.900253 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25444] 10:12:34.900293 brk(0xeac000 <unfinished ...>
[pid 25443] 10:12:34.900317 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25444] 10:12:34.900447 <... brk resumed> ) = 0xeac000
[pid 25443] 10:12:34.900563 getuid( <unfinished ...>
[pid 25444] 10:12:34.900598 getuid( <unfinished ...>
[pid 25443] 10:12:34.900620 <... getuid resumed> ) = 0
[pid 25444] 10:12:34.900642 <... getuid resumed> ) = 47
[pid 25443] 10:12:34.900660 geteuid( <unfinished ...>
[pid 25444] 10:12:34.900687 geteuid( <unfinished ...>
[pid 25443] 10:12:34.900708 <... geteuid resumed> ) = 0
[pid 25444] 10:12:34.900729 <... geteuid resumed> ) = 47
[pid 25443] 10:12:34.900747 getgid( <unfinished ...>
[pid 25444] 10:12:34.900774 getgid( <unfinished ...>
[pid 25443] 10:12:34.900795 <... getgid resumed> ) = 12
[pid 25444] 10:12:34.900816 <... getgid resumed> ) = 12
[pid 25443] 10:12:34.900834 getegid( <unfinished ...>
[pid 25444] 10:12:34.900860 getegid( <unfinished ...>
[pid 25443] 10:12:34.900882 <... getegid resumed> ) = 12
[pid 25444] 10:12:34.900965 <... getegid resumed> ) = 12
[pid 25443] 10:12:34.901039 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.901080 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.901107 <... open resumed> ) = 11
[pid 25444] 10:12:34.901129 <... open resumed> ) = 8
[pid 25443] 10:12:34.901146 read(11,  <unfinished ...>
[pid 25444] 10:12:34.901175 read(8,  <unfinished ...>
[pid 25443] 10:12:34.901198 <... read resumed> "\272u\226\347", 4) = 4
[pid 25444] 10:12:34.901221 <... read resumed> "!\3\4}", 4) = 4
[pid 25443] 10:12:34.901240 close(11 <unfinished ...>
[pid 25444] 10:12:34.901268 close(8 <unfinished ...>
[pid 25443] 10:12:34.901290 <... close resumed> ) = 0
[pid 25444] 10:12:34.901391 <... close resumed> ) = 0
[pid 25443] 10:12:34.901557 readlink("/proc/self/exe",  <unfinished ...>
[pid 25444] 10:12:34.901620 readlink("/proc/self/exe",  <unfinished ...>
[pid 25443] 10:12:34.901654 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25444] 10:12:34.901729 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25443] 10:12:34.901790 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.901824 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.901848 <... ioctl resumed> , 0x7ffd94713d10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.901873 <... ioctl resumed> , 0x7ffd6883a100) = -1 EINVAL (Invalid argument)
[pid 25443] 10:12:34.901893 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.902171 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.902206 <... lseek resumed> ) = 0
[pid 25445] 10:12:34.902234 brk(0x147c000 <unfinished ...>
[pid 25444] 10:12:34.902256 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25443] 10:12:34.902278 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.902307 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.902331 <... ioctl resumed> , 0x7ffd94713d10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.902352 <... ioctl resumed> , 0x7ffd6883a100) = -1 EINVAL (Invalid argument)
[pid 25443] 10:12:34.902370 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.902396 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.902418 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.902439 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25443] 10:12:34.902460 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.902557 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.902584 <... ioctl resumed> , 0x7ffd94713d20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.902606 <... ioctl resumed> , 0x7ffd6883a110) = -1 EINVAL (Invalid argument)
[pid 25443] 10:12:34.902624 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.902650 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.902672 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.902696 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25443] 10:12:34.902717 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.902753 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.902781 <... open resumed> ) = 11
[pid 25444] 10:12:34.902802 <... open resumed> ) = 8
[pid 25443] 10:12:34.902821 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.902848 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.902871 <... ioctl resumed> , 0x7ffd94713df0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.902892 <... ioctl resumed> , 0x7ffd6883a1e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.902909 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.902935 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.902957 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.902978 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.902996 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.903027 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.903051 <... fcntl resumed> ) = 0
[pid 25445] 10:12:34.903073 <... brk resumed> ) = 0x147c000
[pid 25444] 10:12:34.903088 <... fcntl resumed> ) = 0
[pid 25443] 10:12:34.903253 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25445] 10:12:34.903290 read(8,  <unfinished ...>
[pid 25444] 10:12:34.903311 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25443] 10:12:34.903333 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25444] 10:12:34.903671 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f20f8b6c790}, 8) = 0
[pid 25443] 10:12:34.903710 brk(0x1c94000 <unfinished ...>
[pid 25444] 10:12:34.903741 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790},  <unfinished ...>
[pid 25443] 10:12:34.903774 <... brk resumed> ) = 0x1c94000
[pid 25444] 10:12:34.903810 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f20f8b6c790}, 8) = 0
[pid 25443] 10:12:34.904052 read(11,  <unfinished ...>
[pid 25444] 10:12:34.904087 read(8,  <unfinished ...>
[pid 25443] 10:12:34.904110 <... read resumed> "", 8192) = 0
[pid 25444] 10:12:34.904137 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:34.904164 close(11 <unfinished ...>
[pid 25445] 10:12:34.904194 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25444] 10:12:34.904212 close(8 <unfinished ...>
[pid 25443] 10:12:34.904552 <... close resumed> ) = 0
[pid 25444] 10:12:34.904837 <... close resumed> ) = 0
[pid 25443] 10:12:34.905029 stat("/etc/exim.pl",  <unfinished ...>
[pid 25444] 10:12:34.905072 brk(0xecd000 <unfinished ...>
[pid 25443] 10:12:34.905099 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.905136 <... brk resumed> ) = 0xecd000
[pid 25443] 10:12:34.905244 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.905287 stat("/etc/exim.pl",  <unfinished ...>
[pid 25443] 10:12:34.905313 <... open resumed> ) = 11
[pid 25444] 10:12:34.905335 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:34.905366 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.905395 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.905424 <... ioctl resumed> , 0x7ffd94713c20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.905447 <... open resumed> ) = 8
[pid 25443] 10:12:34.905465 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.905563 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.905590 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.905632 <... ioctl resumed> , 0x7ffd6883a010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.905655 read(11,  <unfinished ...>
[pid 25444] 10:12:34.905686 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.905709 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25444] 10:12:34.906561 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.906615 brk(0x1cb5000 <unfinished ...>
[pid 25444] 10:12:34.906651 read(8,  <unfinished ...>
[pid 25443] 10:12:34.906676 <... brk resumed> ) = 0x1cb5000
[pid 25445] 10:12:34.907352 read(8,  <unfinished ...>
[pid 25444] 10:12:34.907388 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25443] 10:12:34.908406 read(11,  <unfinished ...>
[pid 25444] 10:12:34.908456 brk(0xeee000 <unfinished ...>
[pid 25443] 10:12:34.908487 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25444] 10:12:34.909287 <... brk resumed> ) = 0xeee000
[pid 25443] 10:12:34.909608 brk(0x1cd6000 <unfinished ...>
[pid 25444] 10:12:34.909658 read(8,  <unfinished ...>
[pid 25443] 10:12:34.909695 <... brk resumed> ) = 0x1cd6000
[pid 25444] 10:12:34.910144 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25443] 10:12:34.911159 read(11,  <unfinished ...>
[pid 25444] 10:12:34.911205 brk(0xf0f000) = 0xf0f000
[pid 25443] 10:12:34.911609 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25444] 10:12:34.912292 read(8,  <unfinished ...>
[pid 25443] 10:12:34.912339 brk(0x1cf7000 <unfinished ...>
[pid 25444] 10:12:34.912368 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25443] 10:12:34.912391 <... brk resumed> ) = 0x1cf7000
[pid 25444] 10:12:34.913327 brk(0xf30000 <unfinished ...>
[pid 25443] 10:12:34.913854 read(11,  <unfinished ...>
[pid 25444] 10:12:34.913887 <... brk resumed> ) = 0xf30000
[pid 25443] 10:12:34.913905 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25444] 10:12:34.914182 read(8,  <unfinished ...>
[pid 25443] 10:12:34.914558 read(11,  <unfinished ...>
[pid 25444] 10:12:34.914588 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25445] 10:12:34.914622 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25443] 10:12:34.914933 <... read resumed> "", 8192) = 0
[pid 25445] 10:12:34.915461 brk(0x149d000 <unfinished ...>
[pid 25444] 10:12:34.915554 read(8,  <unfinished ...>
[pid 25443] 10:12:34.915587 close(11 <unfinished ...>
[pid 25444] 10:12:34.915623 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:34.915650 <... close resumed> ) = 0
[pid 25444] 10:12:34.915671 close(8 <unfinished ...>
[pid 25443] 10:12:34.915723 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25444] 10:12:34.915756 <... close resumed> ) = 0
[pid 25443] 10:12:34.915772 <... stat resumed> 0x7fdec4156880) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.915809 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25443] 10:12:34.915846 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25444] 10:12:34.915875 <... stat resumed> 0x7f20f8353880) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.915892 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.915935 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25443] 10:12:34.915967 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25444] 10:12:34.915994 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:34.916022 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25444] 10:12:34.916052 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25443] 10:12:34.916083 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.916113 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:34.916141 <... open resumed> ) = 11
[pid 25444] 10:12:34.916160 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.916193 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.916221 <... open resumed> ) = 8
[pid 25443] 10:12:34.916237 <... ioctl resumed> , 0x7ffd94713c20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.916259 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.916287 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.916313 <... ioctl resumed> , 0x7ffd6883a010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.916330 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.916348 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.916397 read(11,  <unfinished ...>
[pid 25444] 10:12:34.916428 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.916444 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25444] 10:12:34.916568 read(8,  <unfinished ...>
[pid 25443] 10:12:34.916893 brk(0x1d18000 <unfinished ...>
[pid 25444] 10:12:34.916925 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25443] 10:12:34.916947 <... brk resumed> ) = 0x1d18000
[pid 25444] 10:12:34.917384 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.917712 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.917746 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.917765 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.917784 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:34.917814 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25444] 10:12:34.917840 <... stat resumed> 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.917856 <... stat resumed> 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.917878 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.917915 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.917942 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.917959 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.917984 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:34.918015 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25445] 10:12:34.918049 <... brk resumed> ) = 0x149d000
[pid 25444] 10:12:34.918063 <... stat resumed> 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.918224 read(8,  <unfinished ...>
[pid 25443] 10:12:34.918259 <... stat resumed> 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.918278 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.918324 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.918355 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.918372 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.918391 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:34.918425 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25444] 10:12:34.918457 <... stat resumed> 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.918551 <... stat resumed> 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.918578 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.918629 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.918664 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.918682 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.918706 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25445] 10:12:34.918746 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25443] 10:12:34.918765 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25444] 10:12:34.918885 <... stat resumed> 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.919535 <... stat resumed> 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.919573 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.919629 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.919667 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.919690 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.919710 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:34.919744 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25444] 10:12:34.919783 <... stat resumed> 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.919800 <... stat resumed> 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.919821 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:34.919859 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25444] 10:12:34.919889 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.919906 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.919931 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:34.919966 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25444] 10:12:34.919996 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.920027 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.920057 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25443] 10:12:34.920094 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.920127 <... open resumed> ) = 9
[pid 25443] 10:12:34.920144 <... open resumed> ) = 12
[pid 25444] 10:12:34.920163 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.920194 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25444] 10:12:34.920220 <... ioctl resumed> , 0x7ffd68839a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.920237 <... ioctl resumed> , 0x7ffd94713630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.920256 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.920283 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.920308 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.920324 <... lseek resumed> ) = 0
[pid 25444] 10:12:34.920354 brk(0xf51000 <unfinished ...>
[pid 25443] 10:12:34.920413 read(12,  <unfinished ...>
[pid 25444] 10:12:34.920443 <... brk resumed> ) = 0xf51000
[pid 25443] 10:12:34.920460 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25444] 10:12:34.920884 read(9,  <unfinished ...>
[pid 25443] 10:12:34.920924 read(12,  <unfinished ...>
[pid 25444] 10:12:34.920953 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25443] 10:12:34.920976 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25444] 10:12:34.921294 read(9,  <unfinished ...>
[pid 25443] 10:12:34.921973 brk(0x1d39000 <unfinished ...>
[pid 25444] 10:12:34.922007 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25443] 10:12:34.922031 <... brk resumed> ) = 0x1d39000
[pid 25444] 10:12:34.922845 read(9,  <unfinished ...>
[pid 25443] 10:12:34.923077 read(12,  <unfinished ...>
[pid 25444] 10:12:34.923107 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25443] 10:12:34.923137 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25444] 10:12:34.923241 brk(0xf72000 <unfinished ...>
[pid 25443] 10:12:34.923780 read(12,  <unfinished ...>
[pid 25444] 10:12:34.923812 <... brk resumed> ) = 0xf72000
[pid 25443] 10:12:34.923830 <... read resumed> "", 8192) = 0
[pid 25444] 10:12:34.924170 read(9,  <unfinished ...>
[pid 25443] 10:12:34.924211 close(12 <unfinished ...>
[pid 25444] 10:12:34.924239 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:34.924257 <... close resumed> ) = 0
[pid 25444] 10:12:34.924277 close(9 <unfinished ...>
[pid 25443] 10:12:34.925073 read(11,  <unfinished ...>
[pid 25444] 10:12:34.925108 <... close resumed> ) = 0
[pid 25443] 10:12:34.925126 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25444] 10:12:34.925887 read(8,  <unfinished ...>
[pid 25443] 10:12:34.926713 read(11,  <unfinished ...>
[pid 25444] 10:12:34.926748 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25443] 10:12:34.926772 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25445] 10:12:34.927595 read(8,  <unfinished ...>
[pid 25444] 10:12:34.928329 read(8,  <unfinished ...>
[pid 25445] 10:12:34.928369 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25443] 10:12:34.928390 read(11,  <unfinished ...>
[pid 25444] 10:12:34.928555 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25444] 10:12:34.929281 read(8,  <unfinished ...>
[pid 25443] 10:12:34.929625 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25443] 10:12:34.930176 brk(0x1d5a000 <unfinished ...>
[pid 25445] 10:12:34.930455 brk(0x14be000 <unfinished ...>
[pid 25444] 10:12:34.930545 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25428] 10:12:34.931090 <... select resumed> ) = 1 (in [11], left {299, 915220})
[pid 25428] 10:12:34.931138 read(11, "\27\3\1\0 ", 5) = 5
[pid 25428] 10:12:34.931180 read(11, "L\270\346\214E#y\1\267y\317\20\351\363\32\256\336\243zn\253\215#A\215\342\0325,~\226*", 32) = 32
[pid 25428] 10:12:34.931231 read(11, "\27\3\1\0000", 5) = 5
[pid 25428] 10:12:34.931269 read(11, "o\216\320\315=\347X\305T\212\263V\240c\316ODjFFH\224\216z\362.e,\346\341z\22\270\\\3632$B\314\342\316\336\235\357\300\6*'", 48) = 48
[pid 25428] 10:12:34.931333 lseek(6, 19, SEEK_SET) = 19
[pid 25428] 10:12:34.931372 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25428] 10:12:34.931424 read(6, "", 8192) = 0
[pid 25428] 10:12:34.931460 alarm(300)  = 0
[pid 25428] 10:12:34.931580 write(11, "\27\3\1\0 gfH\312\236\31\215\376\234\35Te@Lyv\365)%\0\235\260\260\235=\352=\315\257R\21\177\27\3\1\f@\312&\256\266Mk\227r\321\221\325P%V\267X\255\233dU\217!H\307\340\21\fP\362V\362\310\332\300ds\1\307\2534n\205\264\1\215\255~\323X\253t\316\205ry\16\350'S\367\241|-b)\267M\223\336\221\231\361\243\26\200\352J\257Z\272\r\5]\343I\324\340\351\253.\312\203\32\312\264\203\233\7\370}\207\300\262Mhw\1\253\217\33\226f0\360\303\t\275\312\33!\373\31\264\275\215\364\256@,\2240i\214z\3542!\213\2137Bc\27\31\364D\314\0312\302\277\30\324\"^\326\331 .\20\4\4\257f$\275\242\17K6X\251\335|98\245\262\213\345\323\346I\26\320j\242\201\17g2 \333\214\207\216\242z\236h\n\177A_\346\3v\17q\6\313\327\232P"..., 3178) = 3178
[pid 25428] 10:12:34.931683 alarm(0)    = 300
[pid 25428] 10:12:34.931723 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25445] 10:12:34.931763 <... brk resumed> ) = 0x14be000
[pid 25445] 10:12:34.932103 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:34.932146 <... brk resumed> ) = 0x1d5a000
[pid 25443] 10:12:34.932245 read(11,  <unfinished ...>
[pid 25444] 10:12:34.932392 read(8,  <unfinished ...>
[pid 25445] 10:12:34.932428 <... stat resumed> 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.932453 stat("/usr/local/cpanel/strict.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.932559 stat("/etc/exim/perl/strict.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.932608 stat("/etc/exim/perl/strict.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.932659 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:34.932696 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25445] 10:12:34.932724 <... stat resumed> 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.932745 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25443] 10:12:34.933345 read(11,  <unfinished ...>
[pid 25445] 10:12:34.933380 <... stat resumed> 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.933407 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.933459 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.933567 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25445] 10:12:34.933602 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.933687 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.933906 brk(0xf93000 <unfinished ...>
[pid 25445] 10:12:34.933945 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.933993 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.934037 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.934079 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25445] 10:12:34.934137 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25445] 10:12:34.934184 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.934224 lseek(9, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.934280 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25444] 10:12:34.934553 <... brk resumed> ) = 0xf93000
[pid 25444] 10:12:34.935040 read(8,  <unfinished ...>
[pid 25445] 10:12:34.935134 lseek(9, 878, SEEK_SET) = 878
[pid 25445] 10:12:34.935174 lseek(9, 0, SEEK_CUR) = 878
[pid 25445] 10:12:34.935209 close(9)    = 0
[pid 25445] 10:12:34.935460 read(8,  <unfinished ...>
[pid 25443] 10:12:34.935557 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25445] 10:12:34.935654 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25445] 10:12:34.936227 read(8,  <unfinished ...>
[pid 25444] 10:12:34.936432 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25443] 10:12:34.937008 brk(0x1d7b000 <unfinished ...>
[pid 25444] 10:12:34.937892 brk(0xfb4000 <unfinished ...>
[pid 25443] 10:12:34.937929 <... brk resumed> ) = 0x1d7b000
[pid 25443] 10:12:34.938393 read(11,  <unfinished ...>
[pid 25445] 10:12:34.938438 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25445] 10:12:34.938661 brk(0x14df000) = 0x14df000
[pid 25444] 10:12:34.939537 <... brk resumed> ) = 0xfb4000
[pid 25443] 10:12:34.939679 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25452] 10:12:34.940042 <... select resumed> ) = 1 (in [11], left {299, 958571})
[pid 25452] 10:12:34.940093 recvfrom(11, "220 esa10.hilton.iphmx.com ESMTP\r\n", 4096, 0, NULL, NULL) = 34
[pid 25452] 10:12:34.940154 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25452] 10:12:34.940221 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25444] 10:12:34.940355 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25444] 10:12:34.940981 read(8,  <unfinished ...>
[pid 25443] 10:12:34.941258 read(11,  <unfinished ...>
[pid 25445] 10:12:34.941555 read(8,  <unfinished ...>
[pid 25443] 10:12:34.941591 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25443] 10:12:34.941956 brk(0x1d9c000 <unfinished ...>
[pid 25444] 10:12:34.941997 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25445] 10:12:34.942543 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25445] 10:12:34.942785 brk(0x1500000 <unfinished ...>
[pid 25443] 10:12:34.942828 <... brk resumed> ) = 0x1d9c000
[pid 25443] 10:12:34.943125 read(11,  <unfinished ...>
[pid 25445] 10:12:34.943163 <... brk resumed> ) = 0x1500000
[pid 25444] 10:12:34.943568 brk(0xfd5000 <unfinished ...>
[pid 25443] 10:12:34.943612 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25443] 10:12:34.944236 read(11,  <unfinished ...>
[pid 25444] 10:12:34.944279 <... brk resumed> ) = 0xfd5000
[pid 25444] 10:12:34.944453 read(8,  <unfinished ...>
[pid 25445] 10:12:34.945360 read(8,  <unfinished ...>
[pid 25444] 10:12:34.945397 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25444] 10:12:34.946037 read(8,  <unfinished ...>
[pid 25443] 10:12:34.946080 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25443] 10:12:34.946337 brk(0x1dbd000 <unfinished ...>
[pid 25444] 10:12:34.946378 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25443] 10:12:34.946541 <... brk resumed> ) = 0x1dbd000
[pid 25443] 10:12:34.947093 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25445] 10:12:34.947553 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25445] 10:12:34.947685 brk(0x1521000) = 0x1521000
[pid 25445] 10:12:34.948470 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25444] 10:12:34.948623 brk(0xff6000) = 0xff6000
[pid 25444] 10:12:34.948971 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:34.949016 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949039 stat("/usr/local/cpanel/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949084 stat("/etc/exim/perl/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949124 stat("/etc/exim/perl/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949165 stat("/usr/local/cpanel/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949204 stat("/usr/local/cpanel/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949245 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949289 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949357 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949423 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949468 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949588 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949635 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.949678 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.949734 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25443] 10:12:34.949782 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd94713630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.949821 lseek(12, 0, SEEK_CUR) = 0
[pid 25443] 10:12:34.949877 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25443] 10:12:34.950105 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.950145 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950167 stat("/usr/local/cpanel/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950211 stat("/etc/exim/perl/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950250 stat("/etc/exim/perl/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950290 stat("/usr/local/cpanel/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950329 stat("/usr/local/cpanel/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950379 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950424 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950467 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950516 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950559 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950601 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950644 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.950689 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.950746 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25444] 10:12:34.950792 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:34.950821 <... lseek resumed> ) = 878
[pid 25444] 10:12:34.950841 <... ioctl resumed> , 0x7ffd68839a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.950862 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25444] 10:12:34.950889 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:34.950915 <... lseek resumed> ) = 878
[pid 25444] 10:12:34.950934 <... lseek resumed> ) = 0
[pid 25443] 10:12:34.950953 close(12 <unfinished ...>
[pid 25444] 10:12:34.951001 read(9,  <unfinished ...>
[pid 25443] 10:12:34.951032 <... close resumed> ) = 0
[pid 25443] 10:12:34.951263 read(11,  <unfinished ...>
[pid 25444] 10:12:34.951301 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25445] 10:12:34.951605 <... stat resumed> 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951642 stat("/usr/local/cpanel/Errno.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951698 stat("/etc/exim/perl/Errno.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951739 stat("/etc/exim/perl/Errno.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951779 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951817 stat("/usr/local/cpanel/Errno.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951857 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951900 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951944 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.951986 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.952035 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.952079 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25445] 10:12:34.952136 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25445] 10:12:34.952182 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.952220 lseek(9, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.952277 read(9,  <unfinished ...>
[pid 25444] 10:12:34.952363 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25445] 10:12:34.952395 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25445] 10:12:34.952590 brk(0x1542000 <unfinished ...>
[pid 25443] 10:12:34.952628 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25443] 10:12:34.953106 brk(0x1dde000 <unfinished ...>
[pid 25444] 10:12:34.953147 <... lseek resumed> ) = 878
[pid 25444] 10:12:34.953168 lseek(9, 0, SEEK_CUR) = 878
[pid 25444] 10:12:34.953204 close(9)    = 0
[pid 25444] 10:12:34.953450 read(8,  <unfinished ...>
[pid 25445] 10:12:34.953574 <... brk resumed> ) = 0x1542000
[pid 25445] 10:12:34.954009 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.954052 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25443] 10:12:34.954547 <... brk resumed> ) = 0x1dde000
[pid 25443] 10:12:34.954694 read(11,  <unfinished ...>
[pid 25445] 10:12:34.954736 <... lseek resumed> ) = 4868
[pid 25443] 10:12:34.954770 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25445] 10:12:34.954807 lseek(9, 0, SEEK_CUR) = 4868
[pid 25443] 10:12:34.955869 brk(0x1dff000 <unfinished ...>
[pid 25445] 10:12:34.955913 close(9)    = 0
[pid 25445] 10:12:34.955968 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956016 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956057 stat("/etc/exim/perl/Exporter.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956095 stat("/etc/exim/perl/Exporter.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956134 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956173 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956213 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.956423 read(8,  <unfinished ...>
[pid 25445] 10:12:34.956459 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffe5789b250) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956581 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffe5789b2f0) = -1 ENOENT (No such file or directory)
[pid 25445] 10:12:34.956627 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25445] 10:12:34.956685 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25445] 10:12:34.956731 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe5789b040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25445] 10:12:34.956769 lseek(9, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.956818 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25445] 10:12:34.957259 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25444] 10:12:34.957302 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25444] 10:12:34.957447 brk(0x1017000) = 0x1017000
[pid 25445] 10:12:34.958421 <... lseek resumed> ) = 2366
[pid 25445] 10:12:34.958459 lseek(9, 0, SEEK_CUR) = 2366
[pid 25445] 10:12:34.958570 close(9)    = 0
[pid 25445] 10:12:34.958898 read(8, "", 8192) = 0
[pid 25445] 10:12:34.958947 close(8)    = 0
[pid 25445] 10:12:34.959169 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.959201 <... brk resumed> ) = 0x1dff000
[pid 25443] 10:12:34.959349 read(11,  <unfinished ...>
[pid 25445] 10:12:34.959382 <... open resumed> ) = 8
[pid 25445] 10:12:34.959405 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25445] 10:12:34.959453 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627065000
[pid 25445] 10:12:34.959551 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25445] 10:12:34.959603 close(8)    = 0
[pid 25445] 10:12:34.959638 munmap(0x7fb627065000, 4096) = 0
[pid 25445] 10:12:34.959721 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25443] 10:12:34.959749 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25443] 10:12:34.960818 brk(0x1e20000 <unfinished ...>
[pid 25445] 10:12:34.960854 <... lseek resumed> ) = 19
[pid 25445] 10:12:34.960876 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.960917 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.960953 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.960987 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961028 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961066 alarm(300)  = 0
[pid 25445] 10:12:34.961100 alarm(0)    = 300
[pid 25445] 10:12:34.961132 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961166 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961200 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961234 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961268 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fb625f1d790}, NULL, 8) = 0
[pid 25445] 10:12:34.961304 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, 8) = 0
[pid 25445] 10:12:34.961342 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, 8) = 0
[pid 25445] 10:12:34.961385 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.961448 open("/var/spool/exim/input/Y/hdr.25445", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25444] 10:12:34.961734 read(8,  <unfinished ...>
[pid 25445] 10:12:34.961763 fchown(8, 47, 12) = 0
[pid 25445] 10:12:34.961803 fchmod(8, 0640) = 0
[pid 25445] 10:12:34.961839 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25445] 10:12:34.961876 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800010, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.961923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627065000
[pid 25445] 10:12:34.961961 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.962009 write(8, "1aEJMY-0006cP-Ry-H\nmailnull 47 12\n<>\n1451491954 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25445] 10:12:34.962060 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800010, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.962111 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMY-0006cP-Ry\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:34 -0600\n074  X-Failed-Recipients: info@evrc.net,\n  finest09@fin.finestweddingsites.com\n"..., 708) = 708
[pid 25445] 10:12:34.962150 fsync(8 <unfinished ...>
[pid 25444] 10:12:34.962221 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25444] 10:12:34.962446 brk(0x1038000) = 0x1038000
[pid 25445] 10:12:34.963535 <... fsync resumed> ) = 0
[pid 25445] 10:12:34.963569 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800010, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=976, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.963621 close(8)    = 0
[pid 25445] 10:12:34.963656 munmap(0x7fb627065000, 4096) = 0
[pid 25445] 10:12:34.963701 rename("/var/spool/exim/input/Y/hdr.25445", "/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-H") = 0
[pid 25445] 10:12:34.963774 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25445] 10:12:34.963816 fsync(8)    = 0
[pid 25445] 10:12:34.963851 close(8)    = 0
[pid 25445] 10:12:34.963885 fstat(6, {st_dev=makedev(144, 4215), st_ino=124800000, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4059, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.963946 open("/var/spool/exim/msglog/Y/1aEJMY-0006cP-Ry", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25445] 10:12:34.964015 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25445] 10:12:34.964050 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800030, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.964095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb627065000
[pid 25445] 10:12:34.964131 lseek(8, 0, SEEK_CUR) = 0
[pid 25445] 10:12:34.964166 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.964222 write(8, "2015-12-30 10:12:34 Received from <> R=1aEJMX-0006bd-HC U=mailnull P=local S=4699 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25445] 10:12:34.964266 close(8)    = 0
[pid 25445] 10:12:34.964299 munmap(0x7fb627065000, 4096) = 0
[pid 25445] 10:12:34.964342 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.964398 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25445] 10:12:34.964449 close(7)    = 0
[pid 25445] 10:12:34.964567 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25445] 10:12:34.964616 fcntl(7, F_GETFD) = 0
[pid 25445] 10:12:34.964648 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25445] 10:12:34.964680 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5368989, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25445] 10:12:34.964725 write(7, "2015-12-30 10:12:34 [25445] 1aEJMY-0006cP-Ry <= <> R=1aEJMX-0006bd-HC U=mailnull P=local S=4699 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25445] 10:12:34.964767 close(6)    = 0
[pid 25445] 10:12:34.964803 munmap(0x7fb627066000, 4096) = 0
[pid 25445] 10:12:34.964839 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, 8) = 0
[pid 25445] 10:12:34.964879 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb624c666a0}, 8) = 0
[pid 25445] 10:12:34.964917 open("/proc/loadavg", O_RDONLY) = 6
[pid 25445] 10:12:34.964966 read(6, "0.18 0.08 0.01 3/250 25456\n", 40) = 27
[pid 25445] 10:12:34.965007 close(6)    = 0
[pid 25445] 10:12:34.965054 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb627050a90) = 25457
[pid 25445] 10:12:34.965643 exit_group(0) = ?
[pid 25443] 10:12:34.965674 <... brk resumed> ) = 0x1e20000
[pid 25443] 10:12:34.965932 read(11,  <unfinished ...>
[pid 25445] 10:12:34.966206 +++ exited with 0 +++
[pid 25399] 10:12:34.966248 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25445
[pid 25399] 10:12:34.966277 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f54c8f556a0}, 8) = 0
[pid 25399] 10:12:34.966333 write(8, "2015-12-30 10:12:34 evrc@finestweddingsites.com: children all complete\n", 71) = 71
[pid 25399] 10:12:34.966383 open("/var/spool/exim/input/X/hdr.25399", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25399] 10:12:34.966457 fchown(10, 47, 12) = 0
[pid 25399] 10:12:34.966555 fchmod(10, 0640) = 0
[pid 25399] 10:12:34.966594 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25399] 10:12:34.966633 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.966682 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f54cb355000
[pid 25399] 10:12:34.966721 lseek(10, 0, SEEK_CUR) = 0
[pid 25399] 10:12:34.966768 write(10, "1aEJMX-0006bd-HC-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 676) = 676
[pid 25399] 10:12:34.966820 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=676, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.966881 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bd-HC; Wed, 30 Dec 2015 10:12:33 -0600\n048T To:  info@evrc.net, evrc@finestweddingsites.com\n051  Subject"..., 531) = 531
[pid 25399] 10:12:34.966929 fsync(10 <unfinished ...>
[pid 25443] 10:12:34.966984 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25399] 10:12:34.967233 <... fsync resumed> ) = 0
[pid 25399] 10:12:34.967263 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1207, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.967315 close(10)   = 0
[pid 25399] 10:12:34.967350 munmap(0x7f54cb355000, 4096) = 0
[pid 25399] 10:12:34.967394 rename("/var/spool/exim/input/X/hdr.25399", "/var/spool/exim/input/X/1aEJMX-0006bd-HC-H") = 0
[pid 25399] 10:12:34.967492 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25399] 10:12:34.967539 fsync(10)   = 0
[pid 25399] 10:12:34.967573 close(10)   = 0
[pid 25399] 10:12:34.967611 unlink("/var/spool/exim/msglog/X/1aEJMX-0006bd-HC") = 0
[pid 25399] 10:12:34.967665 unlink("/var/spool/exim/input/X/1aEJMX-0006bd-HC-D") = 0
[pid 25399] 10:12:34.967713 unlink("/var/spool/exim/input/X/1aEJMX-0006bd-HC-H") = 0
[pid 25399] 10:12:34.967782 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.967847 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25399] 10:12:34.967996 close(7)    = 0
[pid 25399] 10:12:34.968035 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25399] 10:12:34.968087 fcntl(7, F_GETFD) = 0
[pid 25399] 10:12:34.968120 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25399] 10:12:34.968153 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5369193, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25399] 10:12:34.968199 write(7, "2015-12-30 10:12:34 [25399] 1aEJMX-0006bd-HC Completed QT=1s\n", 61) = 61
[pid 25399] 10:12:34.968242 close(8)    = 0
[pid 25399] 10:12:34.968292 munmap(0x7f54cb356000, 4096) = 0
[pid 25399] 10:12:34.968339 close(9)    = 0
[pid 25399] 10:12:34.968379 unlink("/var/spool/exim/input/X/1aEJMX-0006bd-HC-J") = 0
[pid 25399] 10:12:34.968446 close(6)    = 0
[pid 25399] 10:12:34.968721 exit_group(0) = ?
[pid 25399] 10:12:34.969339 +++ exited with 0 +++
[pid 25444] 10:12:34.969732 read(8,  <unfinished ...>
[pid 25443] 10:12:34.970424 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25444] 10:12:34.970462 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25444] 10:12:34.970647 brk(0x1059000) = 0x1059000
[pid 25444] 10:12:34.971428 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25443] 10:12:34.971468 <... stat resumed> 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971498 stat("/usr/local/cpanel/Errno.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971543 stat("/etc/exim/perl/Errno.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971581 stat("/etc/exim/perl/Errno.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971620 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971657 stat("/usr/local/cpanel/Errno.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971697 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971741 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971783 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971823 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971864 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.971906 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:34.971962 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25443] 10:12:34.972008 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd94713630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.972046 lseek(12, 0, SEEK_CUR) = 0
[pid 25443] 10:12:34.972100 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25443] 10:12:34.972230 brk(0x1e41000) = 0x1e41000
[pid 25444] 10:12:34.972595 <... stat resumed> 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972626 stat("/usr/local/cpanel/Errno.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972671 stat("/etc/exim/perl/Errno.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972709 stat("/etc/exim/perl/Errno.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972747 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972784 stat("/usr/local/cpanel/Errno.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972823 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972864 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972905 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972945 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.972986 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.973025 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25444] 10:12:34.973080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25444] 10:12:34.973124 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd68839a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.973160 lseek(9, 0, SEEK_CUR) = 0
[pid 25444] 10:12:34.973218 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25444] 10:12:34.973765 brk(0x107a000) = 0x107a000
[pid 25444] 10:12:34.974209 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25443] 10:12:34.974307 lseek(12, 4868, SEEK_SET) = 4868
[pid 25443] 10:12:34.974349 lseek(12, 0, SEEK_CUR) = 4868
[pid 25443] 10:12:34.974383 close(12)   = 0
[pid 25443] 10:12:34.974434 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974537 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974599 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974639 stat("/etc/exim/perl/Exporter.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974676 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974714 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974753 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974795 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd94713840) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974844 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd947138e0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:34.974886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25443] 10:12:34.974943 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25443] 10:12:34.974987 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd94713630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:34.975024 lseek(12, 0, SEEK_CUR) = 0
[pid 25443] 10:12:34.975071 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25444] 10:12:34.975554 <... lseek resumed> ) = 4868
[pid 25444] 10:12:34.975587 lseek(9, 0, SEEK_CUR) = 4868
[pid 25444] 10:12:34.975623 close(9)    = 0
[pid 25444] 10:12:34.975674 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975718 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975759 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975796 stat("/etc/exim/perl/Exporter.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975833 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975870 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975909 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975950 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd68839c30) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.975991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd68839cd0) = -1 ENOENT (No such file or directory)
[pid 25444] 10:12:34.976031 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25444] 10:12:34.976085 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25444] 10:12:34.976129 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd68839a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.976165 lseek(9, 0, SEEK_CUR) = 0
[pid 25444] 10:12:34.976212 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25443] 10:12:34.976617 lseek(12, 2366, SEEK_SET) = 2366
[pid 25443] 10:12:34.976665 lseek(12, 0, SEEK_CUR) = 2366
[pid 25443] 10:12:34.976699 close(12)   = 0
[pid 25443] 10:12:34.977012 read(11,  <unfinished ...>
[pid 25444] 10:12:34.977247 lseek(9, 2366, SEEK_SET) = 2366
[pid 25444] 10:12:34.977291 lseek(9, 0, SEEK_CUR) = 2366
[pid 25444] 10:12:34.977325 close(9)    = 0
[pid 25443] 10:12:34.977551 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:34.977588 close(11)   = 0
[pid 25443] 10:12:34.977807 stat("/etc/userdomains",  <unfinished ...>
[pid 25444] 10:12:34.978003 read(8,  <unfinished ...>
[pid 25443] 10:12:34.978034 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.978079 open("/etc/userdomains", O_RDONLY) = 11
[pid 25443] 10:12:34.978121 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.978170 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.978215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab6000
[pid 25443] 10:12:34.978252 lseek(11, 0, SEEK_SET) = 0
[pid 25443] 10:12:34.978285 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25443] 10:12:34.978352 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25444] 10:12:34.978379 <... read resumed> "", 8192) = 0
[pid 25444] 10:12:34.978401 close(8 <unfinished ...>
[pid 25443] 10:12:34.978424 <... open resumed> ) = 12
[pid 25444] 10:12:34.978445 <... close resumed> ) = 0
[pid 25443] 10:12:34.978465 fstat(12,  <unfinished ...>
[pid 25444] 10:12:34.978667 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:34.978699 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.978732 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab5000
[pid 25443] 10:12:34.978769 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:34.978823 close(12)   = 0
[pid 25443] 10:12:34.978858 munmap(0x7fdec5ab5000, 4096) = 0
[pid 25443] 10:12:34.978916 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:34.978982 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:34.979042 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25443] 10:12:34.979083 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:34.979131 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:34.979181 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab5000
[pid 25443] 10:12:34.979218 lseek(12, 0, SEEK_SET) = 0
[pid 25443] 10:12:34.979251 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25443] 10:12:34.979297 read(12, "", 4096) = 0
[pid 25443] 10:12:34.979383 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25444] 10:12:34.979415 <... open resumed> ) = 8
[pid 25443] 10:12:34.979441 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2929, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.979474 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:34.979678 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25444] 10:12:34.979703 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb4000
[pid 25444] 10:12:34.979745 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25444] 10:12:34.979793 close(8 <unfinished ...>
[pid 25443] 10:12:34.979819 <... open resumed> ) = 13
[pid 25444] 10:12:34.979839 <... close resumed> ) = 0
[pid 25444] 10:12:34.979857 munmap(0x7f20f9cb4000, 4096) = 0
[pid 25443] 10:12:34.979896 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd94716720) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25444] 10:12:34.979975 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25443] 10:12:34.980001 lseek(13, 0, SEEK_CUR) = 0
[pid 25443] 10:12:34.980038 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2929, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:34.980086 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:34.980149 read(13,  <unfinished ...>
[pid 25444] 10:12:34.980173 <... lseek resumed> ) = 19
[pid 25444] 10:12:34.980191 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25443] 10:12:34.980231 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2929
[pid 25444] 10:12:34.980254 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25443] 10:12:34.980875 read(13,  <unfinished ...>
[pid 25444] 10:12:34.980903 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.980940 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.980975 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981012 alarm(300)  = 0
[pid 25444] 10:12:34.981045 alarm(0)    = 300
[pid 25444] 10:12:34.981077 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981111 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981145 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981186 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981221 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f20f8b6c790}, NULL, 8) = 0
[pid 25444] 10:12:34.981257 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, 8) = 0
[pid 25444] 10:12:34.981295 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, 8) = 0
[pid 25444] 10:12:34.981338 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.981399 open("/var/spool/exim/input/Y/hdr.25444", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25444] 10:12:34.981469 fchown(8, 47, 12) = 0
[pid 25444] 10:12:34.981623 fchmod(8, 0640) = 0
[pid 25444] 10:12:34.981660 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25444] 10:12:34.981697 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800102, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.981744 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb4000
[pid 25444] 10:12:34.981781 lseek(8, 0, SEEK_CUR) = 0
[pid 25444] 10:12:34.981829 write(8, "1aEJMY-0006cO-Sq-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 500) = 500
[pid 25444] 10:12:34.981876 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800102, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=500, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.981926 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006cO-Sq; Wed, 30 Dec 2015 10:12:34 -0600\n144T To:  info@theviewsatsuperstition.com, paula@wagthedogmedia.c"..., 627) = 627
[pid 25444] 10:12:34.981965 fsync(8 <unfinished ...>
[pid 25443] 10:12:34.982015 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:34.982046 close(13)   = 0
[pid 25443] 10:12:34.982158 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:34.982231 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:34.982294 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25444] 10:12:34.982318 <... fsync resumed> ) = 0
[pid 25444] 10:12:34.982336 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800102, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1127, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.982381 close(8)    = 0
[pid 25444] 10:12:34.982414 munmap(0x7f20f9cb4000, 4096) = 0
[pid 25444] 10:12:34.982456 rename("/var/spool/exim/input/Y/hdr.25444", "/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-H") = 0
[pid 25444] 10:12:34.982566 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25444] 10:12:34.982607 fsync(8)    = 0
[pid 25444] 10:12:34.982649 close(8)    = 0
[pid 25444] 10:12:34.982684 fstat(6, {st_dev=makedev(144, 4215), st_ino=124800004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.982740 open("/var/spool/exim/msglog/Y/1aEJMY-0006cO-Sq", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25444] 10:12:34.982806 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25444] 10:12:34.982841 fstat(8, {st_dev=makedev(144, 4215), st_ino=124800124, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.982886 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f20f9cb4000
[pid 25444] 10:12:34.982922 lseek(8, 0, SEEK_CUR) = 0
[pid 25444] 10:12:34.982957 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.983013 write(8, "2015-12-30 10:12:34 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2446 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25444] 10:12:34.983060 close(8)    = 0
[pid 25444] 10:12:34.983093 munmap(0x7f20f9cb4000, 4096) = 0
[pid 25444] 10:12:34.983133 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.983191 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25444] 10:12:34.983241 close(7)    = 0
[pid 25444] 10:12:34.983277 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25444] 10:12:34.983317 fcntl(7, F_GETFD) = 0
[pid 25444] 10:12:34.983349 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25444] 10:12:34.983381 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5369254, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25444] 10:12:34.983425 write(7, "2015-12-30 10:12:34 [25444] 1aEJMY-0006cO-Sq <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2446 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for info@theviewsatsuperstition.com paula@wagthedog"..., 379) = 379
[pid 25444] 10:12:34.983463 close(6)    = 0
[pid 25444] 10:12:34.983628 munmap(0x7f20f9cb5000, 4096) = 0
[pid 25444] 10:12:34.983668 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, 8) = 0
[pid 25444] 10:12:34.983712 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f20f78b56a0}, 8) = 0
[pid 25444] 10:12:34.983752 open("/proc/loadavg", O_RDONLY) = 6
[pid 25444] 10:12:34.983799 read(6, "0.18 0.08 0.01 3/249 25457\n", 40) = 27
[pid 25444] 10:12:34.983838 close(6)    = 0
[pid 25444] 10:12:34.983883 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f20f9c9fa90) = 25458
[pid 25452] 10:12:34.984170 <... select resumed> ) = 1 (in [11], left {299, 956084})
[pid 25452] 10:12:34.984197 recvfrom(11, "250-esa10.hilton.iphmx.com\r\n250-8BITMIME\r\n250-SIZE 20971520\r\n250 STARTTLS\r\n", 4096, 0, NULL, NULL) = 75
[pid 25452] 10:12:34.984264 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25452] 10:12:34.984329 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:34.984366 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:34.984428 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25443] 10:12:34.984536 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:34.984593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab4000
[pid 25443] 10:12:34.984631 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:34.984684 close(13)   = 0
[pid 25443] 10:12:34.984718 munmap(0x7fdec5ab4000, 4096) = 0
[pid 25443] 10:12:34.984765 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:34.984817 pipe([13, 14]) = 0
[pid 25443] 10:12:34.984855 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25443] 10:12:34.984896 close(10)   = 0
[pid 25443] 10:12:34.984930 munmap(0x7fdec5ab7000, 4096) = 0
[pid 25443] 10:12:34.984966 close(11 <unfinished ...>
[pid 25444] 10:12:34.985203 exit_group(0) = ?
[pid 25443] 10:12:34.985228 <... close resumed> ) = 0
[pid 25443] 10:12:34.985247 munmap(0x7fdec5ab6000, 4096) = 0
[pid 25443] 10:12:34.985284 close(12)   = 0
[pid 25443] 10:12:34.985318 munmap(0x7fdec5ab5000, 4096) = 0
[pid 25443] 10:12:34.985353 close(9)    = 0
[pid 25443] 10:12:34.985386 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:34.985422 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25459
[pid 25443] 10:12:34.985938 close(14 <unfinished ...>
[pid 25444] 10:12:34.986003 +++ exited with 0 +++
[pid 25389] 10:12:34.986036 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25444
[pid 25389] 10:12:34.986061 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25428] 10:12:34.986217 <... select resumed> ) = 1 (in [11], left {599, 945535})
[pid 25389] 10:12:34.986231 pipe2( <unfinished ...>
[pid 25428] 10:12:34.986269 read(11,  <unfinished ...>
[pid 25389] 10:12:34.986276 <... pipe2 resumed> [5, 6], O_CLOEXEC) = 0
[pid 25428] 10:12:34.986304 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25389] 10:12:34.986314 clone( <unfinished ...>
[pid 25428] 10:12:34.986861 read(11,  <unfinished ...>
[pid 25389] 10:12:34.986874 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25460
[pid 25428] 10:12:34.986921 <... read resumed> "\337\314V\252X\356\265\356\5ER^\273T8%\302l\323\321\315\263\271\22E?\24\366\5\2077\266", 32) = 32
[pid 25389] 10:12:34.986932 close(5 <unfinished ...>
[pid 25428] 10:12:34.986965 read(11,  <unfinished ...>
[pid 25389] 10:12:34.986972 <... close resumed> ) = 0
[pid 25428] 10:12:34.986995 <... read resumed> "\27\3\1\0@", 5) = 5
[pid 25389] 10:12:34.987003 fcntl(6, F_SETFD, 0 <unfinished ...>
[pid 25428] 10:12:34.987026 read(11,  <unfinished ...>
[pid 25389] 10:12:34.987033 <... fcntl resumed> ) = 0
[pid 25428] 10:12:34.987059 <... read resumed> "[\17b\240\316\315Ru\307\36\305n\20\321\347\10\256\4Btr\375W\1\31_V\201\344)m\\\272o\223\363\0\177\271\346\"$\3\243\16\332T(\365\316\215\201\231f\260\27/\323\4\246i,\212\257", 64) = 64
[pid 25389] 10:12:34.987068 fstat(6,  <unfinished ...>
[pid 25428] 10:12:34.987109 write(9, "kay.olesen2@hilton.com\n", 23 <unfinished ...>
[pid 25389] 10:12:34.987120 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167227, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25428] 10:12:34.987164 <... write resumed> ) = 23
[pid 25389] 10:12:34.987170 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25428] 10:12:34.987197 fsync(9 <unfinished ...>
[pid 25389] 10:12:34.987204 <... mmap resumed> ) = 0x7ff3d4f3d000
[pid 25389] 10:12:34.987254 write(6, "To:  gretchen.murry@onehospitalitygroup.com, Jennifer.Gonzales@onehospitalitygroup.com, embassytempe@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.co"..., 2145) = 2145
[pid 25389] 10:12:34.987305 close(6)    = 0
[pid 25389] 10:12:34.987369 wait4(25460,  <unfinished ...>
[pid 25443] 10:12:34.987391 <... close resumed> ) = 0
[pid 25443] 10:12:34.987410 read(13, Process 25457 attached
 <unfinished ...>
[pid 25457] 10:12:34.987463 set_robust_list(0x7fb627050aa0, 24 <unfinished ...>
[pid 25428] 10:12:34.987554 <... fsync resumed> ) = 0
[pid 25428] 10:12:34.987585 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25428] 10:12:34.987631 alarm(60)   = 0
[pid 25428] 10:12:34.987666 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25428] 10:12:34.987704 alarm(0)    = 60
[pid 25428] 10:12:34.987769 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25428] 10:12:34.987828 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25428] 10:12:34.987868 fcntl(15, F_GETFD) = 0
[pid 25428] 10:12:34.987900 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25428] 10:12:34.987933 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25428] 10:12:34.987977 close(15)   = 0
[pid 25428] 10:12:34.988016 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25428] 10:12:34.988058 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25428] 10:12:34.988129 brk(0x1d32000) = 0x1d32000
[pid 25428] 10:12:34.988242 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25428] 10:12:34.988287 fcntl(15, F_GETFD) = 0
[pid 25428] 10:12:34.988322 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25428] 10:12:34.988355 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25428] 10:12:34.988410 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25428] 10:12:34.988469 pread(15, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25428] 10:12:34.988611 close(15)   = 0
[pid 25428] 10:12:34.988666 close(14)   = 0
[pid 25428] 10:12:34.988711 write(11, "\27\3\1\0 [\235R\31\304\221\337\361\244.Y\23Z9\35\377\216|\17\375\31\35\210u\376\257]\321< #\254\27\3\1\0 P\27o\233\373)\2103%\325\347\247\22en\361\263\236_a\264\361\311\270Iq\223\206)\25{\373", 74) = 74
[pid 25428] 10:12:34.988777 write(11, "\25\3\1\0 \324\335\323\202\332ql9\10\f]\27(\277\352\2#\7\25\273\220\1j\260\234xH\264\376\315\362\226", 37) = 37
[pid 25428] 10:12:34.988860 close(11)   = 0
[pid 25428] 10:12:34.988931 close(13)   = 0
[pid 25428] 10:12:34.988967 munmap(0x7fb3682b8000, 4096) = 0
[pid 25428] 10:12:34.989006 close(10)   = 0
[pid 25428] 10:12:34.989040 munmap(0x7fb3682b9000, 4096) = 0
[pid 25428] 10:12:34.989084 write(12, "S000004\36\f\0\0", 11) = 11
[pid 25404] 10:12:34.989124 <... select resumed> ) = 1 (in [11], left {59, 192257})
[pid 25428] 10:12:34.989159 write(12, "X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0", 87 <unfinished ...>
[pid 25404] 10:12:34.989169 read(11,  <unfinished ...>
[pid 25428] 10:12:34.989197 <... write resumed> ) = 87
[pid 25404] 10:12:34.989203 <... read resumed> "S000004\36\f\0\0", 16384) = 11
[pid 25428] 10:12:34.989272 write(12, "X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 1900 <unfinished ...>
[pid 25404] 10:12:34.989283 wait4(-1,  <unfinished ...>
[pid 25428] 10:12:34.989311 <... write resumed> ) = 1900
[pid 25404] 10:12:34.989317 <... wait4 resumed> 0x7ffeeb785840, WNOHANG, NULL) = 0
[pid 25428] 10:12:34.989346 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25404] 10:12:34.989355 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25428] 10:12:34.989387 <... write resumed> ) = 9
[pid 25404] 10:12:34.989394 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25428] 10:12:34.989433 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25404] 10:12:34.989442 read(11,  <unfinished ...>
[pid 25428] 10:12:34.989466 <... write resumed> ) = 11
[pid 25404] 10:12:34.989471 <... read resumed> "X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nM"..., 16384) = 1996
[pid 25428] 10:12:34.989565 write(12, "A000090\0=\0\0\0\0\0\0\0\0\0\001250 ok:  Message 198255414 accepted\0\0mx2.hilton.iphmx.com\00068.232.137.182\0\31\0\0\0000", 97) = 97
[pid 25404] 10:12:34.989856 wait4(-1,  <unfinished ...>
[pid 25428] 10:12:34.989884 write(12, "I00002050.116.78.207\00046765\0", 27 <unfinished ...>
[pid 25404] 10:12:34.989893 <... wait4 resumed> 0x7ffeeb785840, WNOHANG, NULL) = 0
[pid 25428] 10:12:34.989917 <... write resumed> ) = 27
[pid 25404] 10:12:34.989924 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25428] 10:12:34.989952 write(12, "Z0000010", 8 <unfinished ...>
[pid 25404] 10:12:34.989960 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25428] 10:12:34.989992 <... write resumed> ) = 8
[pid 25404] 10:12:34.989999 read(11,  <unfinished ...>
[pid 25428] 10:12:34.990022 close(12 <unfinished ...>
[pid 25404] 10:12:34.990028 <... read resumed> "D000004\2\0\0\0A000090\0=\0\0\0\0\0\0\0\0\0\001250 ok:  Message 198255414 accepted\0\0mx2.hilton.iphmx.com\00068.232.137.182\0\31\0\0\0000I00002050.116.78.207\00046765\0Z0000010", 16384) = 143
[pid 25428] 10:12:34.990058 <... close resumed> ) = 0
[pid 25404] 10:12:34.990065 close(11 <unfinished ...>
[pid 25428] 10:12:34.990409 exit_group(0) = ?
[pid 25404] 10:12:34.990417 <... close resumed> ) = 0
[pid 25428] 10:12:34.991036 +++ exited with 0 +++
[pid 25404] 10:12:34.991044 wait4(25428, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25428
[pid 25404] 10:12:34.991104 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.991172 write(8, "2015-12-30 10:12:34 kay.olesen2@hilton.com: remote_smtp transport succeeded\n", 76) = 76
[pid 25404] 10:12:34.991232 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.991292 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.991345 close(7)    = 0
[pid 25404] 10:12:34.991382 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25404] 10:12:34.991425 fcntl(7, F_GETFD) = 0
[pid 25404] 10:12:34.991457 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25404] 10:12:34.991585 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10496, st_size=5369633, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.991640 write(7, "2015-12-30 10:12:34 [25404] 1aEJMX-0006bg-Lo => kay.olesen2@hilton.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3102 H=mx2.hilton.iphmx.com [68.232.137.182]:25 X=TLSv1:DH"..., 392) = 392
[pid 25404] 10:12:34.991713 geteuid()   = 0
[pid 25404] 10:12:34.991748 getegid()   = 12
[pid 25404] 10:12:34.991782 setgid(12)  = 0
[pid 25404] 10:12:34.991815 setuid(47)  = 0
[pid 25404] 10:12:34.991852 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25404] 10:12:34.991900 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25404] 10:12:34.991953 pipe([10, 11]) = 0
[pid 25404] 10:12:34.991991 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25404] 10:12:34.992031 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb3682a3a90) = 25461
[pid 25404] 10:12:34.992327 close(10)   = 0
[pid 25404] 10:12:34.992364 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25404] 10:12:34.992404 fstat(11, {st_dev=makedev(0, 8), st_ino=2130167232, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25404] 10:12:34.992452 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3682b9000
[pid 25404] 10:12:34.992571 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25404] 10:12:34.992678 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25404] 10:12:34.992732 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1050) = 1050
[pid 25404] 10:12:34.992785 lseek(6, 19, SEEK_SET) = 19
[pid 25404] 10:12:34.992822 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25404] 10:12:34.992871 read(6, "", 8192) = 0
[pid 25404] 10:12:34.992905 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bg-Lo; Wed, 30 Dec 2015 10:12:33 -0600\nTo:  kay.olesen2@hi"..., 2421) = 2421
[pid 25404] 10:12:34.992945 write(11, "\n--1451491954-eximdsn-102148205--\n", 34) = 34
[pid 25404] 10:12:34.992980 close(11)   = 0
[pid 25404] 10:12:34.993012 munmap(0x7fb3682b9000, 4096) = 0
[pid 25404] 10:12:34.993053 wait4(25461,  <unfinished ...>
[pid 25457] 10:12:34.993076 <... set_robust_list resumed> ) = 0
[pid 25457] 10:12:34.993115 close(0)    = 0
[pid 25457] 10:12:34.993152 close(1)    = 0
[pid 25457] 10:12:34.993184 close(2)    = 0
[pid 25457] 10:12:34.993266 setsid()    = 25457
[pid 25457] 10:12:34.993306 fstat(0, 0x7ffe5789fb70) = -1 EBADF (Bad file descriptor)
[pid 25457] 10:12:34.993345 open("/dev/null", O_RDWR) = 0
[pid 25457] 10:12:34.993392 fstat(1, 0x7ffe5789fb70) = -1 EBADF (Bad file descriptor)
[pid 25457] 10:12:34.993431 dup2(0, 1)  = 1
[pid 25457] 10:12:34.993464 fstat(2, 0x7ffe5789fb70) = -1 EBADF (Bad file descriptor)
[pid 25457] 10:12:34.993579 dup2(0, 2)  = 2
[pid 25457] 10:12:34.993614 geteuid()   = 47
[pid 25457] 10:12:34.993653 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25457] 10:12:34.993702 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25457] 10:12:34.993746 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25457] 10:12:34.993795 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMY-0006cP-Ry"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25457] 10:12:34.994422 brk(0)      = 0x779000
[pid 25457] 10:12:34.994460 fcntl(0, F_GETFD) = 0
[pid 25457] 10:12:34.994497 fcntl(1, F_GETFD) = 0
[pid 25457] 10:12:34.994528 fcntl(2, F_GETFD) = 0
[pid 25457] 10:12:34.994563 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994617 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0ed000
[pid 25457] 10:12:34.994668 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994719 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994764 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994802 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994839 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994876 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994913 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994949 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.994987 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25457] 10:12:34.995035 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995080 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995119 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995159 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995238 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995282 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995323 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25457] 10:12:34.995368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995392 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995415 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995438 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995461 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995666 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffd7b0afa70) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995708 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.995747 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25457] 10:12:34.995797 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25457] 10:12:34.995834 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25457] 10:12:34.995929 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f293c0e3000
[pid 25457] 10:12:34.995966 close(6)    = 0
[pid 25457] 10:12:34.996007 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25457] 10:12:34.996048 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.996088 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:34.996134 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293bcb5000
[pid 25457] 10:12:34.996170 mprotect(0x7f293bccb000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.996206 mmap(0x7f293becb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f293becb000
[pid 25457] 10:12:34.996248 mmap(0x7f293becd000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293becd000
[pid 25457] 10:12:34.996289 close(6)    = 0
[pid 25457] 10:12:34.996329 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.996374 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.996423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.996465 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25457] 10:12:34.996595 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.996638 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:34.996684 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0e2000
[pid 25457] 10:12:34.996724 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293ba9c000
[pid 25457] 10:12:34.996761 mprotect(0x7f293bab2000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:34.996797 mmap(0x7f293bcb1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f293bcb1000
[pid 25457] 10:12:34.996838 mmap(0x7f293bcb3000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293bcb3000
[pid 25457] 10:12:34.996879 close(6)    = 0
[pid 25457] 10:12:34.996919 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.996961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997045 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25457] 10:12:34.997084 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.997123 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:34.997168 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293b865000
[pid 25457] 10:12:34.997204 mprotect(0x7f293b86c000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.997238 mmap(0x7f293ba6c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f293ba6c000
[pid 25457] 10:12:34.997279 mmap(0x7f293ba6e000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293ba6e000
[pid 25457] 10:12:34.997320 close(6)    = 0
[pid 25457] 10:12:34.997357 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997487 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25457] 10:12:34.997529 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.997571 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:34.997618 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293b5e1000
[pid 25457] 10:12:34.997656 mprotect(0x7f293b664000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:34.997692 mmap(0x7f293b863000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f293b863000
[pid 25457] 10:12:34.997741 close(6)    = 0
[pid 25457] 10:12:34.997790 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997840 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.997931 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25457] 10:12:34.997972 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.998010 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25457] 10:12:34.998041 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0e1000
[pid 25457] 10:12:34.998065 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293b3d3000
[pid 25457] 10:12:34.998087 mprotect(0x7f293b3df000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.998109 mmap(0x7f293b5df000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f293b5df000
[pid 25457] 10:12:34.998138 close(6)    = 0
[pid 25457] 10:12:34.998162 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25457] 10:12:34.998190 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.998213 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25457] 10:12:34.998243 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293b1b0000
[pid 25457] 10:12:34.998264 mprotect(0x7f293b1d1000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.998285 mmap(0x7f293b3d1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f293b3d1000
[pid 25457] 10:12:34.998310 close(6)    = 0
[pid 25457] 10:12:34.998334 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.998359 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.998386 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.998411 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25457] 10:12:34.998436 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.998458 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:34.998717 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293af93000
[pid 25457] 10:12:34.998767 mprotect(0x7f293afaa000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.998810 mmap(0x7f293b1aa000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f293b1aa000
[pid 25457] 10:12:34.998861 mmap(0x7f293b1ac000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293b1ac000
[pid 25457] 10:12:34.998905 close(6)    = 0
[pid 25457] 10:12:34.998947 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.998991 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999036 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999079 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25457] 10:12:34.999119 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.999161 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:34.999209 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0e0000
[pid 25457] 10:12:34.999249 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293ac1f000
[pid 25457] 10:12:34.999287 mprotect(0x7f293ad8e000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:34.999325 mmap(0x7f293af8d000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f293af8d000
[pid 25457] 10:12:34.999377 close(6)    = 0
[pid 25457] 10:12:34.999419 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999463 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999512 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999555 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25457] 10:12:34.999601 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:34.999642 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25457] 10:12:34.999690 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293a990000
[pid 25457] 10:12:34.999729 mprotect(0x7f293aa1b000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:34.999768 mmap(0x7f293ac1b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f293ac1b000
[pid 25457] 10:12:34.999812 mmap(0x7f293ac1e000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293ac1e000
[pid 25457] 10:12:34.999856 close(6)    = 0
[pid 25457] 10:12:34.999899 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999942 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:34.999986 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.000029 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25457] 10:12:35.000072 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.000110 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25457] 10:12:35.000141 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293a78a000
[pid 25457] 10:12:35.000165 mprotect(0x7f293a790000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.000186 mmap(0x7f293a98f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f293a98f000
[pid 25457] 10:12:35.000212 close(6)    = 0
[pid 25457] 10:12:35.000236 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.000261 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25457] 10:12:35.000286 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.000309 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25457] 10:12:35.000340 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0df000
[pid 25457] 10:12:35.000364 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293a454000
[pid 25457] 10:12:35.000386 mprotect(0x7f293a580000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.000407 mmap(0x7f293a780000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f293a780000
[pid 25457] 10:12:35.000433 mmap(0x7f293a789000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293a789000
[pid 25457] 10:12:35.000460 close(6)    = 0
[pid 25457] 10:12:35.000687 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.000743 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.000795 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.000838 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25457] 10:12:35.000880 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.000921 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.000969 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293a250000
[pid 25457] 10:12:35.001012 mprotect(0x7f293a252000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.001056 mmap(0x7f293a452000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f293a452000
[pid 25457] 10:12:35.001104 close(6)    = 0
[pid 25457] 10:12:35.001145 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001231 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001272 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.001314 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.001360 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.001408 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293a04d000
[pid 25457] 10:12:35.001447 mprotect(0x7f293a04f000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.001488 mmap(0x7f293a24e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f293a24e000
[pid 25457] 10:12:35.001541 close(6)    = 0
[pid 25457] 10:12:35.001582 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001626 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.001713 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25457] 10:12:35.001767 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.001816 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.001864 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0de000
[pid 25457] 10:12:35.001905 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2939cb9000
[pid 25457] 10:12:35.001944 mprotect(0x7f2939e43000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.001980 mmap(0x7f293a043000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f293a043000
[pid 25457] 10:12:35.002023 mmap(0x7f293a048000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f293a048000
[pid 25457] 10:12:35.002067 close(6)    = 0
[pid 25457] 10:12:35.002108 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002194 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002231 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25457] 10:12:35.002257 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.002280 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25457] 10:12:35.002310 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2939a4d000
[pid 25457] 10:12:35.002332 mprotect(0x7f2939aaf000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.002353 mmap(0x7f2939cae000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f2939cae000
[pid 25457] 10:12:35.002383 close(6)    = 0
[pid 25457] 10:12:35.002409 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002435 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002461 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.002676 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25457] 10:12:35.002722 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.002765 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25457] 10:12:35.002822 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293966a000
[pid 25457] 10:12:35.002870 mprotect(0x7f2939823000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.002912 mmap(0x7f2939a22000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f2939a22000
[pid 25457] 10:12:35.002956 mmap(0x7f2939a49000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2939a49000
[pid 25457] 10:12:35.003000 close(6)    = 0
[pid 25457] 10:12:35.003043 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.003087 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.003129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.003171 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25457] 10:12:35.003212 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.003253 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25457] 10:12:35.003300 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0dd000
[pid 25457] 10:12:35.003350 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f293943d000
[pid 25457] 10:12:35.003392 mprotect(0x7f2939469000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.003430 mmap(0x7f2939669000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f2939669000
[pid 25457] 10:12:35.003554 close(6)    = 0
[pid 25457] 10:12:35.003609 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.003656 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.003699 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25457] 10:12:35.003747 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2939238000
[pid 25457] 10:12:35.003788 mprotect(0x7f293923d000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.003826 mmap(0x7f293943c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f293943c000
[pid 25457] 10:12:35.003870 close(6)    = 0
[pid 25457] 10:12:35.003912 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.003957 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004000 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004043 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25457] 10:12:35.004083 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.004124 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25457] 10:12:35.004174 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2939035000
[pid 25457] 10:12:35.004214 mprotect(0x7f2939037000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.004251 mmap(0x7f2939236000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f2939236000
[pid 25457] 10:12:35.004298 close(6)    = 0
[pid 25457] 10:12:35.004342 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004386 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004429 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004471 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.004520 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.004567 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.004616 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0dc000
[pid 25457] 10:12:35.004659 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2938e12000
[pid 25457] 10:12:35.004699 mprotect(0x7f2938e29000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.004757 mmap(0x7f2939029000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f2939029000
[pid 25457] 10:12:35.004808 close(6)    = 0
[pid 25457] 10:12:35.004863 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004909 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004953 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.004997 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25457] 10:12:35.005040 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.005078 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.005110 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2938bce000
[pid 25457] 10:12:35.005134 mprotect(0x7f2938c0f000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.005155 mmap(0x7f2938e0f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f2938e0f000
[pid 25457] 10:12:35.005185 close(6)    = 0
[pid 25457] 10:12:35.005211 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005237 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005288 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25457] 10:12:35.005313 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.005336 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.005366 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0db000
[pid 25457] 10:12:35.005391 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f29388e7000
[pid 25457] 10:12:35.005415 mprotect(0x7f29389c2000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.005436 mmap(0x7f2938bc2000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f2938bc2000
[pid 25457] 10:12:35.005466 close(6)    = 0
[pid 25457] 10:12:35.005750 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005797 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005840 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.005881 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25457] 10:12:35.005922 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.005963 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.006012 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f29386e3000
[pid 25433] 10:12:35.006062 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25433] 10:12:35.006094 recvfrom(16, "\365!\201\200\0\1\0\2\0\0\0\0\23scottsdalegolfgroup\3com\0\0\17\0\1\300\f\0\17\0\1\0\0T_\0\22\0\n\3mx1\temailsrvr\300 \300\f\0\17\0\1\0\0T_\0\10\0\24\3mx2\300;", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 91
[pid 25433] 10:12:35.006158 close(16)   = 0
[pid 25433] 10:12:35.006237 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25433] 10:12:35.006280 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25433] 10:12:35.006324 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25433] 10:12:35.006364 sendto(16, "u\274\1\0\0\1\0\0\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0) = 35
[pid 25433] 10:12:35.006433 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25457] 10:12:35.006466 mprotect(0x7f29386e6000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.006510 mmap(0x7f29388e5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f29388e5000
[pid 25457] 10:12:35.006560 close(6)    = 0
[pid 25457] 10:12:35.006604 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.006648 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.006691 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.006733 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25457] 10:12:35.006783 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.006825 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.006874 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f29384b7000
[pid 25457] 10:12:35.006915 mprotect(0x7f29384e0000, 2097152, PROT_NONE) = 0
[pid 25457] 10:12:35.006952 mmap(0x7f29386e0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f29386e0000
[pid 25457] 10:12:35.006996 mmap(0x7f29386e2000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f29386e2000
[pid 25457] 10:12:35.007040 close(6)    = 0
[pid 25457] 10:12:35.007084 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007171 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007213 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.007254 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.007294 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.007338 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0da000
[pid 25457] 10:12:35.007364 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f29382a1000
[pid 25457] 10:12:35.007388 mprotect(0x7f29382b6000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.007409 mmap(0x7f29384b5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f29384b5000
[pid 25457] 10:12:35.007439 close(6)    = 0
[pid 25457] 10:12:35.007637 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007732 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.007774 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25457] 10:12:35.007815 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.007862 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.007912 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2938096000
[pid 25457] 10:12:35.007953 mprotect(0x7f29380a0000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.007990 mmap(0x7f293829f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f293829f000
[pid 25457] 10:12:35.008038 close(6)    = 0
[pid 25457] 10:12:35.008082 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008212 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.008254 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.008295 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.008343 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2937e93000
[pid 25457] 10:12:35.008385 mprotect(0x7f2937e95000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.008422 mmap(0x7f2938094000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f2938094000
[pid 25457] 10:12:35.008548 close(6)    = 0
[pid 25457] 10:12:35.008608 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0d9000
[pid 25457] 10:12:35.008664 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008711 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008755 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.008798 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25457] 10:12:35.008838 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.008880 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.008934 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2937c74000
[pid 25457] 10:12:35.008977 mprotect(0x7f2937c91000, 2093056, PROT_NONE) = 0
[pid 25457] 10:12:35.009014 mmap(0x7f2937e90000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f2937e90000
[pid 25457] 10:12:35.009059 mmap(0x7f2937e92000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2937e92000
[pid 25457] 10:12:35.009105 close(6)    = 0
[pid 25457] 10:12:35.009172 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0d8000
[pid 25457] 10:12:35.009247 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0d7000
[pid 25457] 10:12:35.009293 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0d5000
[pid 25457] 10:12:35.009335 arch_prctl(ARCH_SET_FS, 0x7f293c0d57c0) = 0
[pid 25457] 10:12:35.009409 mprotect(0x7f2937e90000, 4096, PROT_READProcess 25460 attached
 <unfinished ...>
[pid 25460] 10:12:35.009482 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25457] 10:12:35.009514 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.009538 mprotect(0x7f2938094000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.009577 <... set_robust_list resumed> ) = 0
[pid 25457] 10:12:35.009612 mprotect(0x7f293829f000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.009659 close(6 <unfinished ...>
[pid 25457] 10:12:35.009688 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.009709 <... close resumed> ) = 0
[pid 25457] 10:12:35.009740 mprotect(0x7f29384b5000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.009770 dup2(5, 0)  = 0
[pid 25460] 10:12:35.009805 close(5)    = 0
[pid 25457] 10:12:35.009840 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.009865 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25457] 10:12:35.009969 mprotect(0x7f29386e0000, 4096, PROT_READProcess 25459 attached
 <unfinished ...>
[pid 25460] 10:12:35.010615 <... execve resumed> ) = 0
[pid 25459] 10:12:35.010656 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25457] 10:12:35.010695 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.010724 mprotect(0x7f29388e5000, 4096, PROT_READ <unfinished ...>
[pid 25459] 10:12:35.010753 <... set_robust_list resumed> ) = 0
[pid 25459] 10:12:35.010793 close(13 <unfinished ...>
[pid 25457] 10:12:35.010823 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.010946 mprotect(0x7f2938bc2000, 40960, PROT_READ <unfinished ...>
[pid 25459] 10:12:35.010977 <... close resumed> ) = 0
[pid 25459] 10:12:35.011003 geteuid()   = 0
[pid 25459] 10:12:35.011039 getegid()   = 12
[pid 25459] 10:12:35.011075 setgid(500) = 0
[pid 25459] 10:12:35.011110 setuid(503) = 0
[pid 25459] 10:12:35.011177 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25459] 10:12:35.011229 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25459] 10:12:35.011314 brk(0x1e62000 <unfinished ...>
[pid 25457] 10:12:35.011348 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.011447 mprotect(0x7f2938e0f000, 4096, PROT_READ <unfinished ...>
[pid 25459] 10:12:35.011537 <... brk resumed> ) = 0x1e62000
[pid 25459] 10:12:35.011636 fstat(9,  <unfinished ...>
[pid 25457] 10:12:35.011671 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.011703 mprotect(0x7f2939029000, 4096, PROT_READ <unfinished ...>
[pid 25459] 10:12:35.011732 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25457] 10:12:35.011767 <... mprotect resumed> ) = 0
[pid 25459] 10:12:35.011788 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.011821 mprotect(0x7f2939236000, 4096, PROT_READ <unfinished ...>
[pid 25459] 10:12:35.011851 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25457] 10:12:35.011872 <... mprotect resumed> ) = 0
[pid 25459] 10:12:35.011892 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25457] 10:12:35.012142 mprotect(0x7f2939a22000, 110592, PROT_READ <unfinished ...>
[pid 25433] 10:12:35.012167 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25433] 10:12:35.012189 recvfrom(16, "u\274\201\200\0\1\0\1\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1%\0\4b\201\271\203", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 51
[pid 25433] 10:12:35.012302 close(16)   = 0
[pid 25433] 10:12:35.012365 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25433] 10:12:35.012407 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25433] 10:12:35.012454 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25433] 10:12:35.012501 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:35.012542 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:35.012579 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:35.012616 close(16)   = 0
[pid 25433] 10:12:35.012655 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25433] 10:12:35.012723 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:35.012780 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f27d000
[pid 25433] 10:12:35.012825 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25433] 10:12:35.012892 read(16, "", 1024) = 0
[pid 25433] 10:12:35.012940 read(16, "", 1024) = 0
[pid 25433] 10:12:35.012979 close(16)   = 0
[pid 25433] 10:12:35.013015 munmap(0x7fea0f27d000, 4096) = 0
[pid 25433] 10:12:35.013081 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25433] 10:12:35.013123 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25433] 10:12:35.013164 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25433] 10:12:35.013202 sendto(16, "U\377\1\0\0\1\0\0\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0) = 35
[pid 25433] 10:12:35.013267 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25459] 10:12:35.013302 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25459] 10:12:35.013349 close(9)    = 0
[pid 25459] 10:12:35.013385 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25459] 10:12:35.013883 lseek(6, 19, SEEK_SETProcess 25461 attached
 <unfinished ...>
[pid 25461] 10:12:35.013958 set_robust_list(0x7fb3682a3aa0, 24 <unfinished ...>
[pid 25457] 10:12:35.013991 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.014026 brk(0 <unfinished ...>
[pid 25461] 10:12:35.014054 <... set_robust_list resumed> ) = 0
[pid 25457] 10:12:35.014138 mprotect(0x7f2939cae000, 16384, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.014192 close(0 <unfinished ...>
[pid 25460] 10:12:35.014219 <... brk resumed> ) = 0x11a3000
[pid 25460] 10:12:35.014254 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.014285 <... close resumed> ) = 0
[pid 25461] 10:12:35.014352 dup2(10, 0 <unfinished ...>
[pid 25460] 10:12:35.014382 <... mmap resumed> ) = 0x7f1c07341000
[pid 25460] 10:12:35.014411 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.014466 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.014509 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.014540 <... open resumed> ) = 5
[pid 25460] 10:12:35.014588 fstat(5,  <unfinished ...>
[pid 25461] 10:12:35.014622 <... dup2 resumed> ) = 0
[pid 25460] 10:12:35.014643 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25461] 10:12:35.014678 close(10 <unfinished ...>
[pid 25460] 10:12:35.014704 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f1c07337000
[pid 25461] 10:12:35.014742 <... close resumed> ) = 0
[pid 25461] 10:12:35.014762 close(11 <unfinished ...>
[pid 25460] 10:12:35.014788 close(5 <unfinished ...>
[pid 25461] 10:12:35.014814 <... close resumed> ) = 0
[pid 25460] 10:12:35.014833 <... close resumed> ) = 0
[pid 25457] 10:12:35.014915 mprotect(0x7f293a043000, 16384, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.014958 fstat(0,  <unfinished ...>
[pid 25460] 10:12:35.014994 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25461] 10:12:35.015039 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167232, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25461] 10:12:35.015072 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25460] 10:12:35.015124 read(5,  <unfinished ...>
[pid 25461] 10:12:35.015151 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25460] 10:12:35.015197 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25461] 10:12:35.015228 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMX-0006bg-Lo"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25460] 10:12:35.015334 fstat(5,  <unfinished ...>
[pid 25449] 10:12:35.015369 <... connect resumed> ) = 0
[pid 25449] 10:12:35.015390 alarm(0)    = 300
[pid 25449] 10:12:35.015433 getsockname(11, {sa_family=AF_INET, sin_port=htons(47463), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25449] 10:12:35.015612 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25449] 10:12:35.015668 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25449] 10:12:35.015731 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25449] 10:12:35.015771 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25449] 10:12:35.015840 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25449] 10:12:35.015889 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f816929f000
[pid 25449] 10:12:35.015927 lseek(13, 0, SEEK_SET) = 0
[pid 25449] 10:12:35.015962 read(13, "", 4096) = 0
[pid 25449] 10:12:35.016058 lseek(13, 0, SEEK_SET) = 0
[pid 25449] 10:12:35.016098 read(13, "", 4096) = 0
[pid 25449] 10:12:35.016134 lseek(13, 0, SEEK_SET) = 0
[pid 25449] 10:12:35.016168 read(13, "", 4096) = 0
[pid 25449] 10:12:35.016214 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25460] 10:12:35.016253 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25460] 10:12:35.016619 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f1c06f02000
[pid 25460] 10:12:35.016674 mprotect(0x7f1c06f1f000, 2093056, PROT_NONE) = 0
[pid 25460] 10:12:35.016714 mmap(0x7f1c0711e000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f1c0711e000
[pid 25460] 10:12:35.016759 mmap(0x7f1c07122000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.016791 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.016813 <... mmap resumed> ) = 0x7f1c07122000
[pid 25457] 10:12:35.016838 mprotect(0x7f293a24e000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.016867 close(5)    = 0
[pid 25457] 10:12:35.016904 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.016934 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.016973 mprotect(0x7f293a452000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.017007 <... open resumed> ) = 5
[pid 25457] 10:12:35.017029 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.017562 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.017626 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.017679 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f1c06cfe000
[pid 25460] 10:12:35.017719 mprotect(0x7f1c06d00000, 2097152, PROT_NONE) = 0
[pid 25460] 10:12:35.017757 mmap(0x7f1c06f00000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f1c06f00000
[pid 25460] 10:12:35.017805 close(5 <unfinished ...>
[pid 25459] 10:12:35.017835 <... lseek resumed> ) = 19
[pid 25459] 10:12:35.017855 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2377) = 1858
[pid 25460] 10:12:35.017896 <... close resumed> ) = 0
[pid 25459] 10:12:35.018364 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.018412 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25460] 10:12:35.018456 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.018504 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.018553 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c07336000
[pid 25460] 10:12:35.018597 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f1c0696a000
[pid 25460] 10:12:35.018635 mprotect(0x7f1c06af4000, 2097152, PROT_NONE) = 0
[pid 25460] 10:12:35.018673 mmap(0x7f1c06cf4000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f1c06cf4000
[pid 25460] 10:12:35.018718 mmap(0x7f1c06cf9000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1c06cf9000
[pid 25460] 10:12:35.018763 close(5)    = 0
[pid 25460] 10:12:35.018818 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.018924 <... execve resumed> ) = 0
Process 25458 attached
[pid 25460] 10:12:35.018969 <... mmap resumed> ) = 0x7f1c07335000
[pid 25460] 10:12:35.018993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.019032 set_robust_list(0x7f20f9c9faa0, 24 <unfinished ...>
[pid 25460] 10:12:35.019060 <... mmap resumed> ) = 0x7f1c07334000
[pid 25460] 10:12:35.019081 arch_prctl(ARCH_SET_FS, 0x7f1c07335700) = 0
[pid 25458] 10:12:35.019116 <... set_robust_list resumed> ) = 0
[pid 25460] 10:12:35.019207 mprotect(0x7f1c06cf4000, 16384, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.019257 close(0)    = 0
[pid 25458] 10:12:35.019297 close(1)    = 0
[pid 25458] 10:12:35.019334 close(2)    = 0
[pid 25461] 10:12:35.019383 brk(0 <unfinished ...>
[pid 25458] 10:12:35.019461 setsid( <unfinished ...>
[pid 25461] 10:12:35.019632 <... brk resumed> ) = 0x131a000
[pid 25461] 10:12:35.019660 fcntl(0, F_GETFD) = 0
[pid 25461] 10:12:35.019696 fcntl(1, F_GETFD) = 0
[pid 25461] 10:12:35.019730 fcntl(2, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.019760 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.019779 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.019804 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25460] 10:12:35.019838 mprotect(0x7f1c06f00000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.019868 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.019891 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.019923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.019954 <... setsid resumed> ) = 25458
[pid 25460] 10:12:35.020016 mprotect(0x7f1c07342000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.020050 fstat(0, 0x7ffd6883e550) = -1 EBADF (Bad file descriptor)
[pid 25458] 10:12:35.020088 open("/dev/null", O_RDWR <unfinished ...>
[pid 25461] 10:12:35.020119 <... mmap resumed> ) = 0x7f2b29366000
[pid 25458] 10:12:35.020147 <... open resumed> ) = 0
[pid 25461] 10:12:35.020181 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25458] 10:12:35.020214 fstat(1, 0x7ffd6883e550) = -1 EBADF (Bad file descriptor)
[pid 25461] 10:12:35.020252 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.020278 dup2(0, 1 <unfinished ...>
[pid 25461] 10:12:35.020313 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.020348 <... dup2 resumed> ) = 1
[pid 25458] 10:12:35.020367 fstat(2,  <unfinished ...>
[pid 25460] 10:12:35.020396 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.020421 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.020443 <... fstat resumed> 0x7ffd6883e550) = -1 EBADF (Bad file descriptor)
[pid 25458] 10:12:35.020463 dup2(0, 2 <unfinished ...>
[pid 25460] 10:12:35.020566 munmap(0x7f1c07337000, 39387 <unfinished ...>
[pid 25458] 10:12:35.020596 <... dup2 resumed> ) = 2
[pid 25461] 10:12:35.020619 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25460] 10:12:35.020658 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.020678 geteuid( <unfinished ...>
[pid 25461] 10:12:35.020707 <... stat resumed> 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.020727 <... geteuid resumed> ) = 47
[pid 25458] 10:12:35.020754 fstat(0,  <unfinished ...>
[pid 25461] 10:12:35.020783 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.020842 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25461] 10:12:35.020874 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.020894 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25461] 10:12:35.020928 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25458] 10:12:35.020956 fstat(1,  <unfinished ...>
[pid 25461] 10:12:35.020985 <... stat resumed> 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.021005 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25458] 10:12:35.021036 fstat(2,  <unfinished ...>
[pid 25461] 10:12:35.021062 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.021089 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25461] 10:12:35.021123 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.021149 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMY-0006cO-Sq"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25461] 10:12:35.021250 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.021802 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.021840 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25461] 10:12:35.021870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.021900 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25461] 10:12:35.021930 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25460] 10:12:35.021987 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25461] 10:12:35.022009 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.022060 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25461] 10:12:35.022089 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25460] 10:12:35.022117 <... ioctl resumed> , 0x7ffd74eea5e0) = -1 EINVAL (Invalid argument)
[pid 25461] 10:12:35.022142 <... stat resumed> 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.022188 brk(0 <unfinished ...>
[pid 25461] 10:12:35.022216 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.022258 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.022299 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.022341 <... brk resumed> ) = 0x11a3000
[pid 25460] 10:12:35.022400 brk(0x11c4000 <unfinished ...>
[pid 25461] 10:12:35.022430 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.022546 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.022605 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25461] 10:12:35.022665 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.022904 mprotect(0x7f293b1aa000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.022942 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25460] 10:12:35.022972 <... brk resumed> ) = 0x11c4000
[pid 25461] 10:12:35.022995 <... stat resumed> 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.023035 getuid( <unfinished ...>
[pid 25461] 10:12:35.023063 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.023104 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.023144 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.023172 <... getuid resumed> ) = 503
[pid 25461] 10:12:35.023195 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.023218 getgid()    = 500
[pid 25461] 10:12:35.023252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25460] 10:12:35.023280 geteuid( <unfinished ...>
[pid 25461] 10:12:35.023310 <... stat resumed> 0x7ffc6a265790) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.023330 <... geteuid resumed> ) = 503
[pid 25460] 10:12:35.023350 getegid( <unfinished ...>
[pid 25461] 10:12:35.023375 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.023416 <... getegid resumed> ) = 500
[pid 25460] 10:12:35.023445 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25459] 10:12:35.023486 <... write resumed> ) = 4
[pid 25443] 10:12:35.023500 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25443] 10:12:35.023522 read(13,  <unfinished ...>
[pid 25461] 10:12:35.023552 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25459] 10:12:35.023605 write(14, "\1\0\0\0", 4) = 4
[pid 25443] 10:12:35.023641 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25443] 10:12:35.023662 read(13,  <unfinished ...>
[pid 25461] 10:12:35.023692 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.023720 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25459] 10:12:35.023757 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.023824 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.023857 <... open resumed> ) = 6
[pid 25459] 10:12:35.023882 <... write resumed> ) = 4
[pid 25443] 10:12:35.023896 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25443] 10:12:35.023919 read(13,  <unfinished ...>
[pid 25459] 10:12:35.023949 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25461] 10:12:35.023977 fstat(6,  <unfinished ...>
[pid 25459] 10:12:35.024009 <... write resumed> ) = 40
[pid 25443] 10:12:35.024023 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25443] 10:12:35.024043 read(13,  <unfinished ...>
[pid 25461] 10:12:35.024072 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25459] 10:12:35.024103 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.024130 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f2b2935c000
[pid 25459] 10:12:35.024173 <... write resumed> ) = 4
[pid 25443] 10:12:35.024187 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25443] 10:12:35.024207 wait4(-1,  <unfinished ...>
[pid 25459] 10:12:35.024235 close(14 <unfinished ...>
[pid 25461] 10:12:35.024261 close(6 <unfinished ...>
[pid 25459] 10:12:35.024287 <... close resumed> ) = 0
[pid 25461] 10:12:35.024312 <... close resumed> ) = 0
[pid 25459] 10:12:35.024341 exit_group(0) = ?
[pid 25461] 10:12:35.024369 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25459] 10:12:35.024903 +++ exited with 0 +++
[pid 25443] 10:12:35.024921 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25459
[pid 25443] 10:12:35.024944 close(13)   = 0
[pid 25443] 10:12:35.024982 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25443] 10:12:35.025045 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.025113 open("/etc/userdomains", O_RDONLY) = 9
[pid 25443] 10:12:35.025155 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.025204 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.025250 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:35.025288 lseek(9, 0, SEEK_SET) = 0
[pid 25443] 10:12:35.025322 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25443] 10:12:35.025385 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.025447 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.025611 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter", 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.025673 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.025733 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25443] 10:12:35.025776 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.025824 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.025869 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab7000
[pid 25443] 10:12:35.025906 lseek(10, 0, SEEK_SET) = 0
[pid 25443] 10:12:35.025940 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25443] 10:12:35.026009 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25443] 10:12:35.026056 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.026103 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab6000
[pid 25443] 10:12:35.026139 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:35.026190 close(11)   = 0
[pid 25443] 10:12:35.026225 munmap(0x7fdec5ab6000, 4096) = 0
[pid 25443] 10:12:35.026293 open("/etc/localdomains", O_RDONLY) = 11
[pid 25443] 10:12:35.026339 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.026388 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.026434 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab6000
[pid 25443] 10:12:35.026471 lseek(11, 0, SEEK_SET) = 0
[pid 25443] 10:12:35.026510 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25443] 10:12:35.026564 stat("/jail_owner", 0x7ffd94719780) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.026612 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25443] 10:12:35.026673 stat("/usr/local/cpanel/3rdparty/mailman/lists/radissonphx-north_finestweddingsites.com/config.pck", 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.026724 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25443] 10:12:35.026781 stat("/usr/local/cpanel/3rdparty/mailman/lists/radissonphx-north/config.pck", 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.026827 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.026896 open("/etc/demouids", O_RDONLY) = 12
[pid 25452] 10:12:35.026950 <... select resumed> ) = 1 (in [11], left {299, 957405})
[pid 25443] 10:12:35.026973 fstat(12,  <unfinished ...>
[pid 25452] 10:12:35.027000 recvfrom(11,  <unfinished ...>
[pid 25443] 10:12:35.027025 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.027058 <... recvfrom resumed> "220 Go ahead with TLS\r\n", 4096, 0, NULL, NULL) = 23
[pid 25443] 10:12:35.029133 fstat(12,  <unfinished ...>
[pid 25452] 10:12:35.029179 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25443] 10:12:35.029214 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.029249 <... open resumed> ) = 14
[pid 25443] 10:12:35.029270 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.029303 fstat(14,  <unfinished ...>
[pid 25443] 10:12:35.029325 <... mmap resumed> ) = 0x7fdec5ab5000
[pid 25452] 10:12:35.029347 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25443] 10:12:35.029383 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25452] 10:12:35.029411 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25443] 10:12:35.029437 <... lseek resumed> ) = 0
[pid 25452] 10:12:35.029458 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25443] 10:12:35.029538 read(12,  <unfinished ...>
[pid 25452] 10:12:35.029576 read(14,  <unfinished ...>
[pid 25443] 10:12:35.029606 <... read resumed> "", 4096) = 0
[pid 25452] 10:12:35.029636 <... read resumed> "\355\2371#T\365\373\215\5\234\vf\333m\270\233\374\n\217m\320GW\367\f\357\3544\266\0\234\24S\213\255W\374+A\253\230\24\2472\370\334kf", 48) = 48
[pid 25443] 10:12:35.029662 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25452] 10:12:35.029696 close(14 <unfinished ...>
[pid 25443] 10:12:35.029719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25452] 10:12:35.029853 <... close resumed> ) = 0
[pid 25443] 10:12:35.029895 stat("/etc/userdomains",  <unfinished ...>
[pid 25452] 10:12:35.029928 getuid( <unfinished ...>
[pid 25443] 10:12:35.029951 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.029999 <... getuid resumed> ) = 47
[pid 25443] 10:12:35.035666 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.035721 read(6,  <unfinished ...>
[pid 25460] 10:12:35.035745 <... open resumed> ) = 5
[pid 25457] 10:12:35.035760 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.035783 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.035833 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.035881 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.035904 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.035931 <... execve resumed> ) = 0
[pid 25457] 10:12:35.035945 mprotect(0x7f293b5df000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.035990 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25461] 10:12:35.036034 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.036057 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.036083 brk(0 <unfinished ...>
[pid 25457] 10:12:35.036108 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.036122 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.036177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.036208 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.036238 <... brk resumed> ) = 0x1436000
[pid 25457] 10:12:35.036253 mprotect(0x7f293b863000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.036281 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.036333 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.036380 <... mmap resumed> ) = 0x7f1c07340000
[pid 25458] 10:12:35.036400 fcntl(0, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.036431 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.036445 <... open resumed> ) = 13
[pid 25461] 10:12:35.036561 <... mmap resumed> ) = 0x7f2b28f2e000
[pid 25460] 10:12:35.036583 read(5,  <unfinished ...>
[pid 25458] 10:12:35.036639 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.036655 mprotect(0x7f293ba6c000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.036682 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.036714 mprotect(0x7f2b28f44000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.036740 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          255428 kB\nCached:           329500 kB\nBuffers:               0 kB\nActive:           295684 kB\nInactive:         467228 kB\nActive(anon):     163612 kB\nInactive(anon):   277604 kB\nActive(file):     132072 kB\nInac"..., 1024) = 588
[pid 25458] 10:12:35.036759 fcntl(1, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.036801 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.036815 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.036874 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.036890 close(5 <unfinished ...>
[pid 25458] 10:12:35.036917 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.036932 mprotect(0x7f293bcb1000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.036959 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.036990 mmap(0x7f2b29144000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25460] 10:12:35.037020 <... close resumed> ) = 0
[pid 25458] 10:12:35.037034 fcntl(2, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.037057 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.037071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.037116 <... mmap resumed> ) = 0x7f2b29144000
[pid 25460] 10:12:35.037132 munmap(0x7f1c07340000, 4096 <unfinished ...>
[pid 25458] 10:12:35.037165 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.037179 mprotect(0x7f293becb000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.037216 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.037251 mmap(0x7f2b29146000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.037277 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.037292 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25457] 10:12:35.037359 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.037374 <... mmap resumed> ) = 0x7fdec5ab4000
[pid 25461] 10:12:35.037430 <... mmap resumed> ) = 0x7f2b29146000
[pid 25460] 10:12:35.037446 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.037486 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.037503 mprotect(0x7f293c0ee000, 4096, PROT_READ <unfinished ...>
[pid 25443] 10:12:35.037543 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.037576 close(6 <unfinished ...>
[pid 25460] 10:12:35.037598 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25458] 10:12:35.037615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.037642 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.037656 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.037682 <... close resumed> ) = 0
[pid 25460] 10:12:35.037696 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.037730 <... mmap resumed> ) = 0x7f03f4bea000
[pid 25457] 10:12:35.037745 munmap(0x7f293c0e3000, 39387 <unfinished ...>
[pid 25443] 10:12:35.037790 read(13,  <unfinished ...>
[pid 25461] 10:12:35.037827 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.037858 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.037875 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25457] 10:12:35.037904 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.037917 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25461] 10:12:35.037953 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.037968 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.037996 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.038010 set_tid_address(0x7f293c0d5a90 <unfinished ...>
[pid 25443] 10:12:35.038042 read(13,  <unfinished ...>
[pid 25461] 10:12:35.038073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.038104 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25458] 10:12:35.038121 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.038150 <... set_tid_address resumed> ) = 25457
[pid 25443] 10:12:35.038164 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.038223 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.038241 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.038269 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.038283 set_robust_list(0x7f293c0d5aa0, 24 <unfinished ...>
[pid 25452] 10:12:35.038307 <... open resumed> ) = 14
[pid 25443] 10:12:35.038320 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.038369 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.038400 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.038414 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.038422 <... set_robust_list resumed> ) = 0
[pid 25452] 10:12:35.038427 fstat(14,  <unfinished ...>
[pid 25443] 10:12:35.038432 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.038473 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.038679 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.038725 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.038756 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.038782 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.038797 futex(0x7ffd7b0b036c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25452] 10:12:35.038822 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.038850 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.038896 <... open resumed> ) = 6
[pid 25460] 10:12:35.038912 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25458] 10:12:35.038929 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.038958 <... futex resumed> ) = 0
[pid 25452] 10:12:35.038972 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.039000 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.039036 read(6,  <unfinished ...>
[pid 25460] 10:12:35.039058 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.039083 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.039097 futex(0x7ffd7b0b036c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f293c0d57c0 <unfinished ...>
[pid 25452] 10:12:35.039122 <... mmap resumed> ) = 0x7f380d422000
[pid 25443] 10:12:35.039136 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.039201 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.039226 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.039245 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25457] 10:12:35.039276 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25452] 10:12:35.039291 read(14,  <unfinished ...>
[pid 25443] 10:12:35.039324 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.039365 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.039387 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25458] 10:12:35.039409 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.039429 rt_sigaction(SIGRTMIN, {0x7f293af98c60, [], SA_RESTORER|SA_SIGINFO, 0x7f293afa2790},  <unfinished ...>
[pid 25452] 10:12:35.039457 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25443] 10:12:35.039591 <... open resumed> ) = 14
[pid 25461] 10:12:35.039625 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.039654 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25458] 10:12:35.039674 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.039706 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25452] 10:12:35.039721 read(14,  <unfinished ...>
[pid 25443] 10:12:35.039745 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.039778 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.039803 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.039830 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.039845 rt_sigaction(SIGRT_1, {0x7f293af98cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f293afa2790},  <unfinished ...>
[pid 25452] 10:12:35.039873 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25443] 10:12:35.039893 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.040027 <... mmap resumed> ) = 0x7f2b2935b000
[pid 25460] 10:12:35.040046 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.040069 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.040102 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25452] 10:12:35.040116 read(14,  <unfinished ...>
[pid 25443] 10:12:35.040141 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.040176 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.040202 uname( <unfinished ...>
[pid 25458] 10:12:35.040225 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.040239 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25452] 10:12:35.040265 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25443] 10:12:35.040283 <... mmap resumed> ) = 0x7fdec5ab3000
[pid 25461] 10:12:35.040321 <... mmap resumed> ) = 0x7f2b28d15000
[pid 25460] 10:12:35.040336 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25458] 10:12:35.040355 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.040433 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25452] 10:12:35.040449 read(14,  <unfinished ...>
[pid 25443] 10:12:35.040570 read(14,  <unfinished ...>
[pid 25461] 10:12:35.040609 mprotect(0x7f2b28d2b000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.040636 getcwd( <unfinished ...>
[pid 25458] 10:12:35.040661 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.040676 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25452] 10:12:35.040700 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25443] 10:12:35.040719 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.040826 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.040844 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25458] 10:12:35.040861 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25457] 10:12:35.040900 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25452] 10:12:35.040917 read(14,  <unfinished ...>
[pid 25443] 10:12:35.040980 close(14 <unfinished ...>
[pid 25461] 10:12:35.041015 mmap(0x7f2b28f2a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25460] 10:12:35.041046 getpid( <unfinished ...>
[pid 25458] 10:12:35.041068 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25457] 10:12:35.041095 statfs("/selinux",  <unfinished ...>
[pid 25452] 10:12:35.041129 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25443] 10:12:35.041147 <... close resumed> ) = 0
[pid 25461] 10:12:35.041185 <... mmap resumed> ) = 0x7f2b28f2a000
[pid 25460] 10:12:35.041199 <... getpid resumed> ) = 25460
[pid 25458] 10:12:35.041219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.041264 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350348, f_bavail=6350348, f_files=1000000, f_ffree=691108, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25452] 10:12:35.041283 read(14,  <unfinished ...>
[pid 25443] 10:12:35.041357 munmap(0x7fdec5ab3000, 4096 <unfinished ...>
[pid 25461] 10:12:35.041396 mmap(0x7f2b28f2c000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.041424 getppid( <unfinished ...>
[pid 25458] 10:12:35.041446 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.041460 brk(0 <unfinished ...>
[pid 25452] 10:12:35.041565 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25443] 10:12:35.041586 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.041683 <... mmap resumed> ) = 0x7f2b28f2c000
[pid 25460] 10:12:35.041702 <... getppid resumed> ) = 25389
[pid 25458] 10:12:35.041723 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.041768 <... brk resumed> ) = 0x779000
[pid 25452] 10:12:35.041788 read(14,  <unfinished ...>
[pid 25443] 10:12:35.041813 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.041849 close(6 <unfinished ...>
[pid 25460] 10:12:35.041871 stat(".",  <unfinished ...>
[pid 25458] 10:12:35.041894 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.041909 brk(0x79a000 <unfinished ...>
[pid 25452] 10:12:35.041934 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25443] 10:12:35.041952 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.042051 <... close resumed> ) = 0
[pid 25460] 10:12:35.042068 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25458] 10:12:35.042103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.042145 <... brk resumed> ) = 0x79a000
[pid 25452] 10:12:35.042160 read(14,  <unfinished ...>
[pid 25443] 10:12:35.042194 pipe( <unfinished ...>
[pid 25461] 10:12:35.042231 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.042259 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.042288 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.042303 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.042334 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25443] 10:12:35.042353 <... pipe resumed> [14, 15]) = 0
[pid 25461] 10:12:35.042438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.042456 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.042490 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25457] 10:12:35.042522 <... open resumed> ) = 6
[pid 25452] 10:12:35.042536 read(14,  <unfinished ...>
[pid 25443] 10:12:35.042576 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25461] 10:12:35.042614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.042655 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.042684 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.042699 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.042723 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25443] 10:12:35.042741 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25461] 10:12:35.042784 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.042805 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.042833 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.042865 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25452] 10:12:35.042891 read(14,  <unfinished ...>
[pid 25443] 10:12:35.042917 close(12 <unfinished ...>
[pid 25461] 10:12:35.042951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.042979 geteuid( <unfinished ...>
[pid 25458] 10:12:35.043001 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.043015 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.043041 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25443] 10:12:35.043056 <... close resumed> ) = 0
[pid 25461] 10:12:35.043131 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.043139 <... geteuid resumed> ) = 503
[pid 25458] 10:12:35.043144 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.043151 <... mmap resumed> ) = 0x7f293c0ec000
[pid 25452] 10:12:35.043157 read(14,  <unfinished ...>
[pid 25443] 10:12:35.043162 munmap(0x7fdec5ab5000, 4096) = 0
[pid 25443] 10:12:35.043186 close(9)    = 0
[pid 25443] 10:12:35.043206 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:35.043227 close(11)   = 0
[pid 25443] 10:12:35.043246 munmap(0x7fdec5ab6000, 4096) = 0
[pid 25443] 10:12:35.043266 close(13)   = 0
[pid 25443] 10:12:35.043285 munmap(0x7fdec5ab4000, 4096) = 0
[pid 25443] 10:12:35.043305 close(10)   = 0
[pid 25443] 10:12:35.043324 munmap(0x7fdec5ab7000, 4096) = 0
[pid 25443] 10:12:35.043344 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25462
[pid 25443] 10:12:35.043770 close(15)   = 0
[pid 25443] 10:12:35.043809 read(14,  <unfinished ...>
[pid 25461] 10:12:35.043866 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.043898 getegid( <unfinished ...>
[pid 25458] 10:12:35.043921 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.043936 read(6,  <unfinished ...>
[pid 25452] 10:12:35.044026 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25461] 10:12:35.044052 <... open resumed> ) = 6
[pid 25460] 10:12:35.044128 <... getegid resumed> ) = 500
[pid 25458] 10:12:35.044147 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.044180 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25461] 10:12:35.044204 read(6,  <unfinished ...>
[pid 25460] 10:12:35.044239 getuid( <unfinished ...>
[pid 25458] 10:12:35.044262 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.044276 read(14,  <unfinished ...>
[pid 25461] 10:12:35.044314 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.044335 <... getuid resumed> ) = 503
[pid 25458] 10:12:35.044351 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25457] 10:12:35.044381 read(6,  <unfinished ...>
[pid 25461] 10:12:35.044410 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.044432 getgid( <unfinished ...>
[pid 25458] 10:12:35.044454 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25452] 10:12:35.044560 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25461] 10:12:35.044591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.044679 <... getgid resumed> ) = 500
[pid 25458] 10:12:35.044699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.044732 <... read resumed> "", 1024) = 0
[pid 25461] 10:12:35.044753 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.044790 access("/bin/sh", X_OK <unfinished ...>
[pid 25458] 10:12:35.044819 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.044834 read(14,  <unfinished ...>
[pid 25461] 10:12:35.044865 <... mmap resumed> ) = 0x7f2b28ade000
[pid 25460] 10:12:35.044879 <... access resumed> ) = 0
[pid 25458] 10:12:35.044894 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.044923 close(6 <unfinished ...>
[pid 25461] 10:12:35.044954 mprotect(0x7f2b28ae5000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.044982 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.045008 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.045023 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25461] 10:12:35.045048 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.045113 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.045145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.045175 <... close resumed> ) = 0
[pid 25461] 10:12:35.045196 mmap(0x7f2b28ce5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25460] 10:12:35.045229 geteuid( <unfinished ...>
[pid 25458] 10:12:35.045251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.045272 read(14,  <unfinished ...>
[pid 25461] 10:12:35.045304 <... mmap resumed> ) = 0x7f2b28ce5000
[pid 25460] 10:12:35.045318 <... geteuid resumed> ) = 503
[pid 25458] 10:12:35.045340 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25457] 10:12:35.045370 munmap(0x7f293c0ec000, 4096 <unfinished ...>
[pid 25461] 10:12:35.045403 mmap(0x7f2b28ce7000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.045431 getegid( <unfinished ...>
[pid 25458] 10:12:35.045453 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.045468 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25461] 10:12:35.045574 <... mmap resumed> ) = 0x7f2b28ce7000
[pid 25460] 10:12:35.045645 <... getegid resumed> ) = 500
[pid 25458] 10:12:35.045669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.045704 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.045725 close(6 <unfinished ...>
[pid 25460] 10:12:35.045806 getuid( <unfinished ...>
[pid 25458] 10:12:35.045829 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.045844 read(14,  <unfinished ...>
[pid 25461] 10:12:35.045875 <... close resumed> ) = 0
[pid 25460] 10:12:35.045888 <... getuid resumed> ) = 503
[pid 25458] 10:12:35.045909 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25457] 10:12:35.045939 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25461] 10:12:35.045976 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.046005 getgid( <unfinished ...>
[pid 25458] 10:12:35.046027 <... stat resumed> 0x7ffc7add7480) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.046042 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25461] 10:12:35.046068 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.046094 <... getgid resumed> ) = 500
[pid 25458] 10:12:35.046110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.046139 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.046160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.046259 access("/bin/sh", R_OK <unfinished ...>
[pid 25458] 10:12:35.046288 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.046303 read(14,  <unfinished ...>
[pid 25461] 10:12:35.046336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.046351 <... access resumed> ) = 0
[pid 25458] 10:12:35.046366 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25457] 10:12:35.046398 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f293afa2790},  <unfinished ...>
[pid 25461] 10:12:35.046431 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.046459 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.046552 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25452] 10:12:35.046583 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25461] 10:12:35.046617 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.046718 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.046753 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.046783 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.046804 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.046847 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.046873 <... open resumed> ) = 6
[pid 25452] 10:12:35.046887 read(14,  <unfinished ...>
[pid 25461] 10:12:35.046918 <... open resumed> ) = 6
[pid 25460] 10:12:35.046932 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.046959 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.046983 fstat(2,  <unfinished ...>
[pid 25461] 10:12:35.047011 read(6,  <unfinished ...>
[pid 25460] 10:12:35.047033 geteuid( <unfinished ...>
[pid 25458] 10:12:35.047055 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25452] 10:12:35.047080 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25461] 10:12:35.047105 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.047176 <... geteuid resumed> ) = 503
[pid 25458] 10:12:35.047195 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.047223 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25461] 10:12:35.047256 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.047312 getegid( <unfinished ...>
[pid 25458] 10:12:35.047336 <... mmap resumed> ) = 0x7f03f4be0000
[pid 25452] 10:12:35.047351 read(14,  <unfinished ...>
[pid 25461] 10:12:35.047382 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.047409 <... getegid resumed> ) = 500
[pid 25458] 10:12:35.047427 close(6 <unfinished ...>
[pid 25457] 10:12:35.047450 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f293afa2790},  <unfinished ...>
[pid 25461] 10:12:35.047587 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.047628 getuid( <unfinished ...>
[pid 25458] 10:12:35.047651 <... close resumed> ) = 0
[pid 25452] 10:12:35.047664 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25461] 10:12:35.047699 <... mmap resumed> ) = 0x7f2b2885a000
[pid 25460] 10:12:35.047729 <... getuid resumed> ) = 503
[pid 25458] 10:12:35.047745 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.047776 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.047797 mprotect(0x7f2b288dd000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.047830 getgid( <unfinished ...>
[pid 25458] 10:12:35.047852 <... open resumed> ) = 6
[pid 25452] 10:12:35.047865 read(14,  <unfinished ...>
[pid 25461] 10:12:35.047895 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.047909 <... getgid resumed> ) = 500
[pid 25458] 10:12:35.047924 read(6,  <unfinished ...>
[pid 25457] 10:12:35.047947 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25461] 10:12:35.047979 mmap(0x7f2b28adc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25460] 10:12:35.048008 access("/bin/sh", X_OK <unfinished ...>
[pid 25458] 10:12:35.048036 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.048056 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25461] 10:12:35.048083 <... mmap resumed> ) = 0x7f2b28adc000
[pid 25460] 10:12:35.048149 <... access resumed> ) = 0
[pid 25458] 10:12:35.048177 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.048204 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25461] 10:12:35.048228 close(6 <unfinished ...>
[pid 25460] 10:12:35.048252 stat("/bin/sh",  <unfinished ...>
[pid 25458] 10:12:35.048278 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.048304 read(14,  <unfinished ...>
[pid 25461] 10:12:35.048336 <... close resumed> ) = 0
[pid 25460] 10:12:35.048350 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25458] 10:12:35.048383 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.048413 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25461] 10:12:35.048445 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.048479 geteuid( <unfinished ...>
[pid 25458] 10:12:35.048502 <... mmap resumed> ) = 0x7f03f47b2000
[pid 25452] 10:12:35.048515 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25461] 10:12:35.048547 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.048618 <... geteuid resumed> ) = 503
[pid 25458] 10:12:35.048637 mprotect(0x7f03f47c8000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.048666 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25461] 10:12:35.048689 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.048723 getegid( <unfinished ...>
[pid 25458] 10:12:35.048746 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.048761 read(14,  <unfinished ...>
[pid 25461] 10:12:35.048791 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.048806 <... getegid resumed> ) = 500
[pid 25458] 10:12:35.048821 mmap(0x7f03f49c8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25457] 10:12:35.048851 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f293afa2790},  <unfinished ...>
[pid 25461] 10:12:35.048884 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.048913 getuid( <unfinished ...>
[pid 25458] 10:12:35.048935 <... mmap resumed> ) = 0x7f03f49c8000
[pid 25452] 10:12:35.048948 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25461] 10:12:35.048978 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.049047 <... getuid resumed> ) = 503
[pid 25458] 10:12:35.049068 mmap(0x7f03f49ca000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.049098 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.049119 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.049162 getgid( <unfinished ...>
[pid 25458] 10:12:35.049185 <... mmap resumed> ) = 0x7f03f49ca000
[pid 25452] 10:12:35.049198 read(14,  <unfinished ...>
[pid 25461] 10:12:35.049233 <... open resumed> ) = 6
[pid 25460] 10:12:35.049240 <... getgid resumed> ) = 500
[pid 25458] 10:12:35.049245 close(6 <unfinished ...>
[pid 25457] 10:12:35.049251 umask(0 <unfinished ...>
[pid 25452] 10:12:35.049258 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25461] 10:12:35.049332 read(6,  <unfinished ...>
[pid 25460] 10:12:35.049340 access("/bin/sh", R_OK <unfinished ...>
[pid 25458] 10:12:35.049348 <... close resumed> ) = 0
[pid 25457] 10:12:35.049353 <... umask resumed> ) = 0
[pid 25452] 10:12:35.049358 read(14,  <unfinished ...>
[pid 25461] 10:12:35.049439 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.049455 <... access resumed> ) = 0
[pid 25458] 10:12:35.049461 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.049468 geteuid( <unfinished ...>
[pid 25452] 10:12:35.049473 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25461] 10:12:35.049686 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.049722 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.049752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.049767 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.049789 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25460] 10:12:35.049821 <... socket resumed> ) = 5
[pid 25458] 10:12:35.049838 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.049870 read(14,  <unfinished ...>
[pid 25461] 10:12:35.049899 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.049926 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.049962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.049977 getuid( <unfinished ...>
[pid 25461] 10:12:35.050007 <... mmap resumed> ) = 0x7f2b2935a000
[pid 25460] 10:12:35.050021 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.050041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.050072 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25461] 10:12:35.050096 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.050182 close(5 <unfinished ...>
[pid 25458] 10:12:35.050209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.050225 <... getuid resumed> ) = 47
[pid 25461] 10:12:35.050249 <... mmap resumed> ) = 0x7f2b2864c000
[pid 25460] 10:12:35.050269 <... close resumed> ) = 0
[pid 25458] 10:12:35.050284 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.050315 read(14,  <unfinished ...>
[pid 25461] 10:12:35.050344 mprotect(0x7f2b28658000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.050371 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.050396 <... open resumed> ) = 6
[pid 25457] 10:12:35.050410 getgid( <unfinished ...>
[pid 25461] 10:12:35.050439 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.050455 <... socket resumed> ) = 5
[pid 25458] 10:12:35.050469 read(6,  <unfinished ...>
[pid 25452] 10:12:35.050599 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25461] 10:12:35.050627 mmap(0x7f2b28858000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25460] 10:12:35.050711 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.050746 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.050773 <... getgid resumed> ) = 12
[pid 25461] 10:12:35.050797 <... mmap resumed> ) = 0x7f2b28858000
[pid 25460] 10:12:35.050841 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.050868 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.050895 read(14,  <unfinished ...>
[pid 25461] 10:12:35.050924 close(6 <unfinished ...>
[pid 25460] 10:12:35.050946 close(5 <unfinished ...>
[pid 25458] 10:12:35.050970 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.050998 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25461] 10:12:35.051029 <... close resumed> ) = 0
[pid 25460] 10:12:35.051042 <... close resumed> ) = 0
[pid 25458] 10:12:35.051065 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.051101 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25461] 10:12:35.051126 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.051171 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.051199 <... mmap resumed> ) = 0x7f03f4bdf000
[pid 25457] 10:12:35.051213 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25461] 10:12:35.051240 <... open resumed> ) = 6
[pid 25460] 10:12:35.051257 <... open resumed> ) = 5
[pid 25458] 10:12:35.051272 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.051302 read(14,  <unfinished ...>
[pid 25461] 10:12:35.051331 read(6,  <unfinished ...>
[pid 25460] 10:12:35.051356 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.051378 <... mmap resumed> ) = 0x7f03f4599000
[pid 25457] 10:12:35.051392 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25461] 10:12:35.051421 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.051441 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25458] 10:12:35.051470 mprotect(0x7f03f45af000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.051611 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25461] 10:12:35.051640 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.051723 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.051749 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.051764 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25461] 10:12:35.051787 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25460] 10:12:35.051824 <... mmap resumed> ) = 0x7f1c07340000
[pid 25458] 10:12:35.051843 mmap(0x7f03f47ae000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25452] 10:12:35.051874 read(14,  <unfinished ...>
[pid 25461] 10:12:35.051905 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.051931 read(5,  <unfinished ...>
[pid 25458] 10:12:35.051958 <... mmap resumed> ) = 0x7f03f47ae000
[pid 25457] 10:12:35.051972 getgroups(65536,  <unfinished ...>
[pid 25461] 10:12:35.052007 <... mmap resumed> ) = 0x7f2b28429000
[pid 25460] 10:12:35.052021 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25458] 10:12:35.052040 mmap(0x7f03f47b0000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.052082 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25461] 10:12:35.052106 mprotect(0x7f2b2844a000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.052193 read(5,  <unfinished ...>
[pid 25458] 10:12:35.052217 <... mmap resumed> ) = 0x7f03f47b0000
[pid 25457] 10:12:35.052231 <... getgroups resumed> [12]) = 1
[pid 25461] 10:12:35.052259 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.052286 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:35.052304 close(6 <unfinished ...>
[pid 25452] 10:12:35.052328 read(14,  <unfinished ...>
[pid 25461] 10:12:35.052358 mmap(0x7f2b2864a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25460] 10:12:35.052388 close(5 <unfinished ...>
[pid 25458] 10:12:35.052413 <... close resumed> ) = 0
[pid 25457] 10:12:35.052426 setgroups(0, [] <unfinished ...>
[pid 25461] 10:12:35.052463 <... mmap resumed> ) = 0x7f2b2864a000
[pid 25460] 10:12:35.052578 <... close resumed> ) = 0
[pid 25458] 10:12:35.052601 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.052633 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25461] 10:12:35.052657 close(6 <unfinished ...>
[pid 25460] 10:12:35.052694 munmap(0x7f1c07340000, 4096 <unfinished ...>
[pid 25458] 10:12:35.052721 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.052739 <... setgroups resumed> ) = 0
[pid 25461] 10:12:35.052759 <... close resumed> ) = 0
[pid 25460] 10:12:35.052786 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.052813 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.052846 read(14,  <unfinished ...>
[pid 25461] 10:12:35.052876 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.052905 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.052933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.052950 getegid( <unfinished ...>
[pid 25461] 10:12:35.052978 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.052995 <... open resumed> ) = 5
[pid 25458] 10:12:35.053011 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.053048 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25461] 10:12:35.053072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.053166 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.053191 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.053212 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.053233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.053252 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.053281 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.053311 read(14,  <unfinished ...>
[pid 25461] 10:12:35.053340 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.053370 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.053396 <... open resumed> ) = 6
[pid 25457] 10:12:35.053412 geteuid( <unfinished ...>
[pid 25461] 10:12:35.053440 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.053458 <... mmap resumed> ) = 0x7f1c07337000
[pid 25458] 10:12:35.053479 read(6,  <unfinished ...>
[pid 25452] 10:12:35.053503 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25461] 10:12:35.053527 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.053621 close(5 <unfinished ...>
[pid 25458] 10:12:35.053649 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.053676 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.053706 <... open resumed> ) = 6
[pid 25460] 10:12:35.053723 <... close resumed> ) = 0
[pid 25458] 10:12:35.053747 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.053771 geteuid( <unfinished ...>
[pid 25452] 10:12:35.053793 read(14,  <unfinished ...>
[pid 25461] 10:12:35.053821 read(6,  <unfinished ...>
[pid 25460] 10:12:35.053845 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.053876 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.053915 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.054047 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.054085 <... open resumed> ) = 5
[pid 25458] 10:12:35.054102 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.054130 getegid( <unfinished ...>
[pid 25452] 10:12:35.054152 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25433] 10:12:35.054170 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25461] 10:12:35.054211 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.054235 read(5,  <unfinished ...>
[pid 25458] 10:12:35.054258 <... mmap resumed> ) = 0x7f03f4362000
[pid 25457] 10:12:35.054274 <... getegid resumed> ) = 12
[pid 25452] 10:12:35.054292 read(14,  <unfinished ...>
[pid 25433] 10:12:35.054317 recvfrom(16,  <unfinished ...>
[pid 25461] 10:12:35.054355 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.054386 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.054409 mprotect(0x7f03f4369000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.054437 setgid(12 <unfinished ...>
[pid 25452] 10:12:35.054460 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25433] 10:12:35.054555 <... recvfrom resumed> "U\377\201\200\0\1\0\1\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\3\203\0\4\255\313\2 ", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 51
[pid 25461] 10:12:35.054667 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.054702 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.054726 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.054743 <... setgid resumed> ) = 0
[pid 25452] 10:12:35.054763 read(14,  <unfinished ...>
[pid 25433] 10:12:35.054787 close(16 <unfinished ...>
[pid 25461] 10:12:35.054825 <... mmap resumed> ) = 0x7f2b2820c000
[pid 25460] 10:12:35.054841 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.054878 mmap(0x7f03f4569000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25457] 10:12:35.054909 setuid(0 <unfinished ...>
[pid 25452] 10:12:35.054934 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25433] 10:12:35.054951 <... close resumed> ) = 0
[pid 25461] 10:12:35.055131 mprotect(0x7f2b28223000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.055174 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.055204 <... mmap resumed> ) = 0x7f03f4569000
[pid 25457] 10:12:35.055225 <... setuid resumed> ) = 0
[pid 25452] 10:12:35.055270 read(14,  <unfinished ...>
[pid 25433] 10:12:35.055298 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25461] 10:12:35.055336 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.055352 <... mmap resumed> ) = 0x7f1c0675c000
[pid 25458] 10:12:35.055368 mmap(0x7f03f456b000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.055398 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.055428 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25433] 10:12:35.055445 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25461] 10:12:35.055581 mmap(0x7f2b28423000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25460] 10:12:35.055621 mprotect(0x7f1c06768000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.055649 <... mmap resumed> ) = 0x7f03f456b000
[pid 25457] 10:12:35.055671 <... open resumed> ) = 6
[pid 25452] 10:12:35.055706 read(14,  <unfinished ...>
[pid 25433] 10:12:35.055732 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.055771 <... mmap resumed> ) = 0x7f2b28423000
[pid 25460] 10:12:35.055796 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.055819 close(6 <unfinished ...>
[pid 25457] 10:12:35.055843 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.055869 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25433] 10:12:35.055893 <... open resumed> ) = 16
[pid 25461] 10:12:35.055985 mmap(0x7f2b28425000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.056019 mmap(0x7f1c06968000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25458] 10:12:35.056047 <... close resumed> ) = 0
[pid 25457] 10:12:35.056069 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25452] 10:12:35.056104 read(14,  <unfinished ...>
[pid 25433] 10:12:35.056129 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25461] 10:12:35.056163 <... mmap resumed> ) = 0x7f2b28425000
[pid 25460] 10:12:35.056185 <... mmap resumed> ) = 0x7f1c06968000
[pid 25458] 10:12:35.056212 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.056243 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.056266 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25433] 10:12:35.056284 <... ioctl resumed> , 0x7ffc72719d90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25461] 10:12:35.056324 close(6 <unfinished ...>
[pid 25460] 10:12:35.056350 close(5 <unfinished ...>
[pid 25458] 10:12:35.056373 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.056396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25452] 10:12:35.056425 read(14,  <unfinished ...>
[pid 25433] 10:12:35.056448 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25461] 10:12:35.056622 <... close resumed> ) = 0
[pid 25460] 10:12:35.056654 <... close resumed> ) = 0
[pid 25458] 10:12:35.056685 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.056720 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.056747 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25433] 10:12:35.056765 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.056865 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.056900 mprotect(0x7f1c06968000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.056927 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.056945 <... mmap resumed> ) = 0x7f293c0ec000
[pid 25452] 10:12:35.056962 read(14,  <unfinished ...>
[pid 25433] 10:12:35.056985 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.057017 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.057035 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.057054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.057084 read(6,  <unfinished ...>
[pid 25452] 10:12:35.057112 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25433] 10:12:35.057130 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25461] 10:12:35.057235 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.057271 munmap(0x7f1c07337000, 39387 <unfinished ...>
[pid 25458] 10:12:35.057300 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.057319 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25452] 10:12:35.057441 read(14,  <unfinished ...>
[pid 25433] 10:12:35.057471 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.057590 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.057610 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.057634 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.057665 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25452] 10:12:35.057693 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25433] 10:12:35.057712 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.057836 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.057877 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.057909 <... open resumed> ) = 6
[pid 25457] 10:12:35.057930 <... socket resumed> ) = 7
[pid 25452] 10:12:35.057947 read(14,  <unfinished ...>
[pid 25433] 10:12:35.057970 read(16,  <unfinished ...>
[pid 25461] 10:12:35.058004 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.058023 <... open resumed> ) = 5
[pid 25458] 10:12:35.058042 read(6,  <unfinished ...>
[pid 25457] 10:12:35.058066 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25452] 10:12:35.058099 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25433] 10:12:35.058117 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25461] 10:12:35.058363 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.058404 fcntl(5, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.058428 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.058452 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.058470 read(14,  <unfinished ...>
[pid 25433] 10:12:35.058588 close(16 <unfinished ...>
[pid 25461] 10:12:35.058631 <... open resumed> ) = 6
[pid 25460] 10:12:35.058648 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25458] 10:12:35.058670 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.058694 close(7 <unfinished ...>
[pid 25452] 10:12:35.058720 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25433] 10:12:35.058739 <... close resumed> ) = 0
[pid 25461] 10:12:35.058853 read(6,  <unfinished ...>
[pid 25460] 10:12:35.058885 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.058909 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.058942 <... close resumed> ) = 0
[pid 25452] 10:12:35.058960 read(14,  <unfinished ...>
[pid 25433] 10:12:35.058983 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.059016 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.059046 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.059082 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.059111 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25452] 10:12:35.059139 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25433] 10:12:35.059157 <... lseek resumed> ) = 0
Process 25462 attached
[pid 25461] 10:12:35.059262 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.059303 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.059331 <... mmap resumed> ) = 0x7f03f40de000
[pid 25457] 10:12:35.059347 <... socket resumed> ) = 7
[pid 25452] 10:12:35.059363 read(14,  <unfinished ...>
[pid 25433] 10:12:35.059385 read(13,  <unfinished ...>
[pid 25462] 10:12:35.059420 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25461] 10:12:35.059442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.059472 <... mmap resumed> ) = 0x7f1c07340000
[pid 25458] 10:12:35.059493 mprotect(0x7f03f4161000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.059521 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25452] 10:12:35.059554 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25433] 10:12:35.059571 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25462] 10:12:35.059663 <... set_robust_list resumed> ) = 0
[pid 25461] 10:12:35.059681 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.059732 read(5,  <unfinished ...>
[pid 25458] 10:12:35.059761 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.059777 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.059794 read(14,  <unfinished ...>
[pid 25433] 10:12:35.059817 read(13,  <unfinished ...>
[pid 25462] 10:12:35.059850 close(14 <unfinished ...>
[pid 25461] 10:12:35.059871 <... mmap resumed> ) = 0x7f2b29359000
[pid 25460] 10:12:35.059891 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.059927 mmap(0x7f03f4360000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25457] 10:12:35.059959 close(7 <unfinished ...>
[pid 25452] 10:12:35.059986 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25433] 10:12:35.060001 <... read resumed> "", 4096) = 0
[pid 25462] 10:12:35.060080 <... close resumed> ) = 0
[pid 25461] 10:12:35.060088 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.060111 close(5 <unfinished ...>
[pid 25458] 10:12:35.060122 <... mmap resumed> ) = 0x7f03f4360000
[pid 25457] 10:12:35.060138 <... close resumed> ) = 0
[pid 25452] 10:12:35.060152 read(14,  <unfinished ...>
[pid 25433] 10:12:35.060158 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25462] 10:12:35.060188 geteuid( <unfinished ...>
[pid 25461] 10:12:35.060194 <... mmap resumed> ) = 0x7f2b27e98000
[pid 25460] 10:12:35.060203 <... close resumed> ) = 0
[pid 25458] 10:12:35.060211 close(6 <unfinished ...>
[pid 25457] 10:12:35.060220 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.060233 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25433] 10:12:35.060241 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25462] 10:12:35.060336 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.060344 mprotect(0x7f2b28007000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.060359 munmap(0x7f1c07340000, 4096 <unfinished ...>
[pid 25458] 10:12:35.060372 <... close resumed> ) = 0
[pid 25457] 10:12:35.060387 <... open resumed> ) = 7
[pid 25452] 10:12:35.060401 read(14,  <unfinished ...>
[pid 25433] 10:12:35.060407 stat("/usr/local/cpanel/3rdparty/mailman/lists/weddings_hillcrestgolfclub.com/config.pck",  <unfinished ...>
[pid 25462] 10:12:35.060442 getegid( <unfinished ...>
[pid 25461] 10:12:35.060448 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.060458 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.060709 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.060749 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.060772 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25433] 10:12:35.060791 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25462] 10:12:35.060842 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.060859 mmap(0x7f2b28206000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25460] 10:12:35.060896 getpgrp( <unfinished ...>
[pid 25458] 10:12:35.060919 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.060936 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25452] 10:12:35.060966 read(14,  <unfinished ...>
[pid 25433] 10:12:35.060989 stat("/etc/demouids",  <unfinished ...>
[pid 25462] 10:12:35.061025 setgid(500 <unfinished ...>
[pid 25461] 10:12:35.061047 <... mmap resumed> ) = 0x7f2b28206000
[pid 25460] 10:12:35.061072 <... getpgrp resumed> ) = 29163
[pid 25458] 10:12:35.061091 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.061123 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.061149 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25433] 10:12:35.061172 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25462] 10:12:35.061244 <... setgid resumed> ) = 0
[pid 25461] 10:12:35.061262 close(6 <unfinished ...>
[pid 25460] 10:12:35.061287 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.061315 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.061332 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.061348 read(14,  <unfinished ...>
[pid 25433] 10:12:35.061371 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25462] 10:12:35.061411 setuid(503 <unfinished ...>
[pid 25461] 10:12:35.061434 <... close resumed> ) = 0
[pid 25460] 10:12:35.061458 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.061568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.061610 read(7,  <unfinished ...>
[pid 25452] 10:12:35.061641 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25433] 10:12:35.061660 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25462] 10:12:35.061850 <... setuid resumed> ) = 0
[pid 25461] 10:12:35.061874 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.061938 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25458] 10:12:35.061962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.061981 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25452] 10:12:35.062019 read(14,  <unfinished ...>
[pid 25433] 10:12:35.062044 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25462] 10:12:35.062081 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.062109 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.062127 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25458] 10:12:35.062203 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.062238 read(7,  <unfinished ...>
[pid 25452] 10:12:35.062261 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25433] 10:12:35.062279 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25462] 10:12:35.062565 <... open resumed> ) = 9
[pid 25461] 10:12:35.062593 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.062643 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25458] 10:12:35.062673 <... open resumed> ) = 6
[pid 25457] 10:12:35.062690 <... read resumed> "", 4096) = 0
[pid 25452] 10:12:35.062708 read(14,  <unfinished ...>
[pid 25433] 10:12:35.062731 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25462] 10:12:35.062774 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.062797 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.062815 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25458] 10:12:35.062842 read(6,  <unfinished ...>
[pid 25457] 10:12:35.062866 close(7 <unfinished ...>
[pid 25452] 10:12:35.062890 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25433] 10:12:35.062908 <... stat resumed> 0x7fea0d922880) = -1 ENOENT (No such file or directory)
[pid 25462] 10:12:35.063003 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.063037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.063087 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25458] 10:12:35.063110 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.063133 <... close resumed> ) = 0
[pid 25452] 10:12:35.063150 read(14,  <unfinished ...>
[pid 25433] 10:12:35.063172 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25462] 10:12:35.063209 brk(0x1e62000 <unfinished ...>
[pid 25461] 10:12:35.063232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.063252 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25458] 10:12:35.063282 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.063307 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.063336 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25433] 10:12:35.063354 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25462] 10:12:35.063479 <... brk resumed> ) = 0x1e62000
[pid 25461] 10:12:35.063499 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.063599 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25458] 10:12:35.063622 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25457] 10:12:35.063652 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.063680 read(14,  <unfinished ...>
[pid 25433] 10:12:35.063711 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25462] 10:12:35.063757 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.063779 <... open resumed> ) = 6
[pid 25460] 10:12:35.063795 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25458] 10:12:35.063868 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.063900 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.063931 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25433] 10:12:35.063949 <... open resumed> ) = 16
[pid 25462] 10:12:35.064046 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.064077 read(6,  <unfinished ...>
[pid 25460] 10:12:35.064105 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.064132 <... mmap resumed> ) = 0x7f03f4bde000
[pid 25457] 10:12:35.064152 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.064170 read(14,  <unfinished ...>
[pid 25433] 10:12:35.064193 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25462] 10:12:35.064225 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.064233 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.064250 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.064262 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.064274 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.064292 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25433] 10:12:35.064300 <... ioctl resumed> , 0x7ffc72718270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25462] 10:12:35.064387 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25461] 10:12:35.064395 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.064406 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.064417 <... mmap resumed> ) = 0x7f03f3ed0000
[pid 25457] 10:12:35.064425 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.064434 read(14,  <unfinished ...>
[pid 25433] 10:12:35.064440 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25462] 10:12:35.064461 read(9,  <unfinished ...>
[pid 25461] 10:12:35.064467 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25460] 10:12:35.064731 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.064755 mprotect(0x7f03f3edc000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.064784 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.064816 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25433] 10:12:35.064834 <... lseek resumed> ) = 0
[pid 25462] 10:12:35.064916 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25461] 10:12:35.064938 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.064970 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0},  <unfinished ...>
[pid 25458] 10:12:35.064996 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.065012 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.065030 read(14,  <unfinished ...>
[pid 25433] 10:12:35.065053 fstat(16,  <unfinished ...>
[pid 25462] 10:12:35.065087 read(9,  <unfinished ...>
[pid 25461] 10:12:35.065113 <... mmap resumed> ) = 0x7f2b27c09000
[pid 25460] 10:12:35.065130 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f1c0699c6a0}, 8) = 0
[pid 25458] 10:12:35.065153 mmap(0x7f03f40dc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25457] 10:12:35.065183 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.065212 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25433] 10:12:35.065230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25462] 10:12:35.065282 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25461] 10:12:35.065301 mprotect(0x7f2b27c94000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.065334 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25458] 10:12:35.065690 <... mmap resumed> ) = 0x7f03f40dc000
[pid 25457] 10:12:35.065718 <... open resumed> ) = 7
[pid 25452] 10:12:35.065737 read(14,  <unfinished ...>
[pid 25433] 10:12:35.065761 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25462] 10:12:35.065795 close(9 <unfinished ...>
[pid 25461] 10:12:35.065818 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.065836 close(6 <unfinished ...>
[pid 25457] 10:12:35.065858 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.065881 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25433] 10:12:35.065899 <... fcntl resumed> ) = 0
[pid 25462] 10:12:35.065989 <... close resumed> ) = 0
[pid 25461] 10:12:35.066007 mmap(0x7f2b27e94000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25460] 10:12:35.066041 <... execve resumed> ) = 0
[pid 25458] 10:12:35.066071 <... close resumed> ) = 0
[pid 25457] 10:12:35.066095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25452] 10:12:35.066126 read(14,  <unfinished ...>
[pid 25433] 10:12:35.066150 fstat(16,  <unfinished ...>
[pid 25462] 10:12:35.066183 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25461] 10:12:35.066208 <... mmap resumed> ) = 0x7f2b27e94000
[pid 25460] 10:12:35.066229 brk(0 <unfinished ...>
[pid 25458] 10:12:35.066252 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.066285 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25452] 10:12:35.066311 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25433] 10:12:35.066329 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25462] 10:12:35.066432 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.066450 mmap(0x7f2b27e97000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.066871 <... brk resumed> ) = 0x762000
[pid 25458] 10:12:35.066892 <... open resumed> ) = 6
[pid 25457] 10:12:35.066909 <... mmap resumed> ) = 0x7f293c0cb000
[pid 25452] 10:12:35.066925 read(14,  <unfinished ...>
[pid 25433] 10:12:35.066949 read(16,  <unfinished ...>
[pid 25462] 10:12:35.066983 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.067012 <... mmap resumed> ) = 0x7f2b27e97000
[pid 25460] 10:12:35.067033 fcntl(0, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.067058 read(6,  <unfinished ...>
[pid 25457] 10:12:35.067081 close(7 <unfinished ...>
[pid 25452] 10:12:35.067104 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25433] 10:12:35.067122 <... read resumed> "0", 8192) = 1
[pid 25462] 10:12:35.067165 <... lseek resumed> ) = 19
[pid 25461] 10:12:35.067181 close(6 <unfinished ...>
[pid 25460] 10:12:35.067205 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.067220 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.067243 <... close resumed> ) = 0
[pid 25452] 10:12:35.067268 brk(0x25f7000 <unfinished ...>
[pid 25433] 10:12:35.067292 read(16,  <unfinished ...>
[pid 25462] 10:12:35.067325 read(6,  <unfinished ...>
[pid 25461] 10:12:35.067351 <... close resumed> ) = 0
[pid 25460] 10:12:35.067374 fcntl(1, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.067398 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.067421 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.067451 <... brk resumed> ) = 0x25f7000
[pid 25433] 10:12:35.067465 <... read resumed> "", 8192) = 0
[pid 25462] 10:12:35.067672 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2377) = 1858
[pid 25461] 10:12:35.067698 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.068190 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.068208 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25457] 10:12:35.068241 <... open resumed> ) = 7
[pid 25452] 10:12:35.068257 read(14,  <unfinished ...>
[pid 25433] 10:12:35.068280 close(16 <unfinished ...>
[pid 25462] 10:12:35.068316 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.068346 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.068365 fcntl(2, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.068388 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.068417 read(7,  <unfinished ...>
[pid 25452] 10:12:35.068508 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25433] 10:12:35.068534 <... close resumed> ) = 0
[pid 25462] 10:12:35.068671 <... write resumed> ) = 4
[pid 25461] 10:12:35.068694 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.068731 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.068753 <... mmap resumed> ) = 0x7f03f3cad000
[pid 25457] 10:12:35.068770 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.068800 read(14,  <unfinished ...>
[pid 25443] 10:12:35.068824 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25433] 10:12:35.068844 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25462] 10:12:35.068885 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.068909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.068927 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25458] 10:12:35.068955 mprotect(0x7f03f3cce000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.068982 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.069005 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25443] 10:12:35.069023 read(14,  <unfinished ...>
[pid 25433] 10:12:35.069110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25462] 10:12:35.069169 <... write resumed> ) = 4
[pid 25461] 10:12:35.069185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.069217 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.069249 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.069267 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.069300 read(14,  <unfinished ...>
[pid 25443] 10:12:35.069325 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25433] 10:12:35.069343 stat("/etc/localtime",  <unfinished ...>
[pid 25462] 10:12:35.069390 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.069414 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.069434 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.069461 mmap(0x7f03f3ece000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25457] 10:12:35.069587 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25452] 10:12:35.069626 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25443] 10:12:35.069712 read(14,  <unfinished ...>
[pid 25433] 10:12:35.069740 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25462] 10:12:35.069794 <... write resumed> ) = 4
[pid 25461] 10:12:35.069810 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.069845 <... mmap resumed> ) = 0x7f9a212f9000
[pid 25458] 10:12:35.069869 <... mmap resumed> ) = 0x7f03f3ece000
[pid 25457] 10:12:35.069895 <... mmap resumed> ) = 0x7f2937a66000
[pid 25452] 10:12:35.069912 read(14,  <unfinished ...>
[pid 25449] 10:12:35.069937 <... select resumed> ) = 1 (in [11], left {299, 946847})
[pid 25443] 10:12:35.069965 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.069986 stat("/etc/localtime",  <unfinished ...>
[pid 25462] 10:12:35.070028 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25461] 10:12:35.070052 <... open resumed> ) = 6
[pid 25460] 10:12:35.070068 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25458] 10:12:35.070096 close(6 <unfinished ...>
[pid 25457] 10:12:35.070119 mprotect(0x7f2937a72000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.070146 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25449] 10:12:35.070224 recvfrom(11,  <unfinished ...>
[pid 25443] 10:12:35.070254 read(14,  <unfinished ...>
[pid 25433] 10:12:35.070280 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25462] 10:12:35.070327 <... write resumed> ) = 40
[pid 25461] 10:12:35.070342 read(6,  <unfinished ...>
[pid 25460] 10:12:35.070367 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.070390 <... close resumed> ) = 0
[pid 25457] 10:12:35.070413 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.070430 read(14,  <unfinished ...>
[pid 25449] 10:12:35.070454 <... recvfrom resumed> "220 remote.phoenixmarriottmesa.com Microsoft ESMTP MAIL Service ready at Wed, 30 Dec 2015 09:12:34 -0700\r\n", 4096, 0, NULL, NULL) = 106
[pid 25443] 10:12:35.070495 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25433] 10:12:35.070517 close(7 <unfinished ...>
[pid 25462] 10:12:35.070557 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.070581 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.070604 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.070632 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.070661 mmap(0x7f2937c72000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25452] 10:12:35.070694 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25449] 10:12:35.070770 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25443] 10:12:35.070823 read(14,  <unfinished ...>
[pid 25433] 10:12:35.070849 <... close resumed> ) = 0
[pid 25462] 10:12:35.070882 <... write resumed> ) = 4
[pid 25461] 10:12:35.070897 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.070922 <... open resumed> ) = 5
[pid 25458] 10:12:35.070938 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.070955 <... mmap resumed> ) = 0x7f2937c72000
[pid 25452] 10:12:35.070987 read(14,  <unfinished ...>
[pid 25449] 10:12:35.071014 <... sendto resumed> ) = 33
[pid 25443] 10:12:35.071032 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.071051 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25462] 10:12:35.071100 close(15 <unfinished ...>
[pid 25461] 10:12:35.071122 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25460] 10:12:35.071153 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.071177 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.071208 close(7 <unfinished ...>
[pid 25452] 10:12:35.071231 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25449] 10:12:35.071308 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.071325 wait4(-1,  <unfinished ...>
[pid 25433] 10:12:35.071334 <... open resumed> ) = 7
[pid 25462] 10:12:35.071353 <... close resumed> ) = 0
[pid 25461] 10:12:35.071359 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.071387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.071407 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.071416 <... close resumed> ) = 0
[pid 25452] 10:12:35.071443 read(14,  <unfinished ...>
[pid 25433] 10:12:35.071454 fcntl(7, F_GETFD <unfinished ...>
[pid 25462] 10:12:35.071472 exit_group(0) = ?
[pid 25461] 10:12:35.071661 <... mmap resumed> ) = 0x7f2b27a03000
[pid 25460] 10:12:35.071914 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.071945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.071977 mprotect(0x7f2937c72000, 4096, PROT_READ <unfinished ...>
[pid 25452] 10:12:35.072003 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25433] 10:12:35.072085 <... fcntl resumed> ) = 0
[pid 25462] 10:12:35.072129 +++ exited with 0 +++
[pid 25461] 10:12:35.072143 mprotect(0x7f2b27a09000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.072170 <... mmap resumed> ) = 0x7f9a212ef000
[pid 25458] 10:12:35.072186 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.072205 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.072225 read(14,  <unfinished ...>
[pid 25443] 10:12:35.072249 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25462
[pid 25433] 10:12:35.072269 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.072302 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.072321 close(5 <unfinished ...>
[pid 25458] 10:12:35.072344 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.072376 munmap(0x7f293c0cb000, 39387 <unfinished ...>
[pid 25452] 10:12:35.072404 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25443] 10:12:35.072559 close(14 <unfinished ...>
[pid 25433] 10:12:35.072598 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.072631 mmap(0x7f2b27c08000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25460] 10:12:35.072664 <... close resumed> ) = 0
[pid 25458] 10:12:35.072690 <... open resumed> ) = 6
[pid 25457] 10:12:35.072707 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.072731 read(14,  <unfinished ...>
[pid 25443] 10:12:35.072757 <... close resumed> ) = 0
[pid 25433] 10:12:35.072774 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.072807 <... mmap resumed> ) = 0x7f2b27c08000
[pid 25460] 10:12:35.072828 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.072861 read(6,  <unfinished ...>
[pid 25457] 10:12:35.072884 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.072912 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25443] 10:12:35.072991 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:35.073023 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370025, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25461] 10:12:35.073064 close(6 <unfinished ...>
[pid 25460] 10:12:35.073087 <... open resumed> ) = 5
[pid 25458] 10:12:35.073103 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.073126 <... open resumed> ) = 7
[pid 25452] 10:12:35.073147 read(14,  <unfinished ...>
[pid 25443] 10:12:35.073172 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25433] 10:12:35.073211 write(7, "2015-12-30 10:12:35 [25433] 1aEJMY-0006c6-AN SMTP connection outbound 1451491955 1aEJMY-0006c6-AN finestweddingsites.com weddings@hillcrestgolfclub.com\n", 152 <unfinished ...>
[pid 25461] 10:12:35.073256 <... close resumed> ) = 0
[pid 25460] 10:12:35.073279 read(5,  <unfinished ...>
[pid 25458] 10:12:35.073304 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.073328 fcntl(7, F_GETFD <unfinished ...>
[pid 25452] 10:12:35.073351 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25443] 10:12:35.073383 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.073411 <... write resumed> ) = 152
[pid 25461] 10:12:35.073463 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.073614 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.073651 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25457] 10:12:35.073683 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25452] 10:12:35.073705 read(14,  <unfinished ...>
[pid 25443] 10:12:35.073730 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.073772 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25461] 10:12:35.073823 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.073842 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.073865 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.073893 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.073916 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25443] 10:12:35.074000 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.074034 <... open resumed> ) = 16
[pid 25461] 10:12:35.074063 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.074097 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.074128 <... mmap resumed> ) = 0x7f03f3a90000
[pid 25457] 10:12:35.074144 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25452] 10:12:35.074172 read(14,  <unfinished ...>
[pid 25443] 10:12:35.074196 <... open resumed> ) = 9
[pid 25433] 10:12:35.074212 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25461] 10:12:35.074246 <... open resumed> ) = 6
[pid 25460] 10:12:35.074261 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.074289 mprotect(0x7f03f3aa7000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.074316 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.074342 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25443] 10:12:35.074433 fstat(9,  <unfinished ...>
[pid 25433] 10:12:35.074461 <... lseek resumed> ) = 6
[pid 25461] 10:12:35.074493 read(6,  <unfinished ...>
[pid 25460] 10:12:35.074518 <... mmap resumed> ) = 0x7f9a20d47000
[pid 25458] 10:12:35.074535 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.074550 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.074567 read(14,  <unfinished ...>
[pid 25443] 10:12:35.074590 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.074626 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25461] 10:12:35.074670 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.074694 mprotect(0x7f9a20ed1000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.074722 mmap(0x7f03f3ca7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25457] 10:12:35.074754 read(7,  <unfinished ...>
[pid 25452] 10:12:35.074781 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25443] 10:12:35.074811 fstat(9,  <unfinished ...>
[pid 25433] 10:12:35.074835 <... ioctl resumed> , 0x7ffc72718270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25461] 10:12:35.074863 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.074887 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.074903 <... mmap resumed> ) = 0x7f03f3ca7000
[pid 25457] 10:12:35.074923 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25452] 10:12:35.074958 read(14,  <unfinished ...>
[pid 25443] 10:12:35.074970 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.074989 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25461] 10:12:35.075008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25460] 10:12:35.075027 mmap(0x7f9a210d1000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25458] 10:12:35.075042 mmap(0x7f03f3ca9000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.075054 close(7 <unfinished ...>
[pid 25452] 10:12:35.075064 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25443] 10:12:35.075135 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.075149 <... lseek resumed> ) = 6
[pid 25461] 10:12:35.075168 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.075180 <... mmap resumed> ) = 0x7f9a210d1000
[pid 25458] 10:12:35.075192 <... mmap resumed> ) = 0x7f03f3ca9000
[pid 25457] 10:12:35.075206 <... close resumed> ) = 0
[pid 25452] 10:12:35.075214 read(14,  <unfinished ...>
[pid 25443] 10:12:35.075225 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:35.075234 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.075253 <... mmap resumed> ) = 0x7f2b29358000
[pid 25460] 10:12:35.075264 mmap(0x7f9a210d6000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.075278 close(6 <unfinished ...>
[pid 25457] 10:12:35.075287 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.075299 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25443] 10:12:35.075321 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.075331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=6, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25461] 10:12:35.075360 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.075373 <... mmap resumed> ) = 0x7f9a210d6000
[pid 25458] 10:12:35.075386 <... close resumed> ) = 0
[pid 25457] 10:12:35.075400 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.075431 read(14,  <unfinished ...>
[pid 25443] 10:12:35.075443 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.075452 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.075472 <... mmap resumed> ) = 0x7f2b276cd000
[pid 25460] 10:12:35.075636 close(5 <unfinished ...>
[pid 25458] 10:12:35.075668 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.075699 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25452] 10:12:35.075720 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25443] 10:12:35.075827 read(9,  <unfinished ...>
[pid 25433] 10:12:35.075844 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.075873 mprotect(0x7f2b277f9000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.075888 <... close resumed> ) = 0
[pid 25458] 10:12:35.075909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.075920 <... socket resumed> ) = 7
[pid 25452] 10:12:35.075928 read(14,  <unfinished ...>
[pid 25443] 10:12:35.075938 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:35.075967 write(16, "1", 1 <unfinished ...>
[pid 25461] 10:12:35.075998 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.076007 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.076021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.076039 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25452] 10:12:35.076060 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25443] 10:12:35.076136 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.076150 <... write resumed> ) = 1
[pid 25461] 10:12:35.076170 mmap(0x7f2b279f9000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25460] 10:12:35.076188 <... mmap resumed> ) = 0x7f9a212ee000
[pid 25458] 10:12:35.076202 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.076211 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.076220 read(14,  <unfinished ...>
[pid 25443] 10:12:35.076230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.076262 close(16 <unfinished ...>
[pid 25461] 10:12:35.076285 <... mmap resumed> ) = 0x7f2b279f9000
[pid 25460] 10:12:35.076298 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.076310 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.076325 close(7 <unfinished ...>
[pid 25452] 10:12:35.076337 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25443] 10:12:35.076410 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.076424 <... close resumed> ) = 0
[pid 25461] 10:12:35.076466 mmap(0x7f2b27a02000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.076484 <... mmap resumed> ) = 0x7f9a212ed000
[pid 25458] 10:12:35.076500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.076513 <... close resumed> ) = 0
[pid 25452] 10:12:35.076523 read(14,  <unfinished ...>
[pid 25443] 10:12:35.076533 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.076585 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.076613 <... mmap resumed> ) = 0x7f2b27a02000
[pid 25460] 10:12:35.076629 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.076641 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.076656 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25452] 10:12:35.076668 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25443] 10:12:35.076751 stat("/home/finest09/etc/finestweddingsites.com/radissonphx-north/filter",  <unfinished ...>
[pid 25433] 10:12:35.076773 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.076800 close(6 <unfinished ...>
[pid 25460] 10:12:35.076810 <... mmap resumed> ) = 0x7f9a212ec000
[pid 25458] 10:12:35.076821 <... open resumed> ) = 6
[pid 25457] 10:12:35.076829 <... socket resumed> ) = 7
[pid 25452] 10:12:35.076837 read(14,  <unfinished ...>
[pid 25443] 10:12:35.076847 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.076860 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.076883 <... close resumed> ) = 0
[pid 25460] 10:12:35.076898 arch_prctl(ARCH_SET_FS, 0x7f9a212ed700 <unfinished ...>
[pid 25458] 10:12:35.076909 read(6,  <unfinished ...>
[pid 25457] 10:12:35.076918 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25452] 10:12:35.076935 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25443] 10:12:35.077011 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.077026 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.077076 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.077094 <... arch_prctl resumed> ) = 0
[pid 25458] 10:12:35.077169 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.077183 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.077193 read(14,  <unfinished ...>
[pid 25443] 10:12:35.077203 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.077234 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25461] 10:12:35.077259 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.077270 mprotect(0x7f9a210d1000, 16384, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.077283 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.077292 close(7 <unfinished ...>
[pid 25452] 10:12:35.077303 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25443] 10:12:35.077399 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.077417 <... socket resumed> ) = 16
[pid 25461] 10:12:35.077436 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.077453 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.077466 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.077486 <... close resumed> ) = 0
[pid 25452] 10:12:35.077508 read(14,  <unfinished ...>
[pid 25443] 10:12:35.077519 <... open resumed> ) = 10
[pid 25433] 10:12:35.077528 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25461] 10:12:35.077555 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.077565 mprotect(0x7f9a212fa000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.077577 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.077590 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.077604 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25443] 10:12:35.078122 fstat(10,  <unfinished ...>
[pid 25433] 10:12:35.078156 <... connect resumed> ) = 0
[pid 25461] 10:12:35.078186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.078218 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.078234 <... mmap resumed> ) = 0x7f03f4bdd000
[pid 25457] 10:12:35.078262 <... open resumed> ) = 7
[pid 25452] 10:12:35.078282 read(14,  <unfinished ...>
[pid 25443] 10:12:35.078307 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.078340 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25461] 10:12:35.078378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.078397 munmap(0x7f9a212ef000, 39387 <unfinished ...>
[pid 25458] 10:12:35.078429 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.078458 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.078484 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25443] 10:12:35.078622 fstat(10,  <unfinished ...>
[pid 25433] 10:12:35.078665 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25461] 10:12:35.078698 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.078732 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.078779 <... mmap resumed> ) = 0x7f03f371c000
[pid 25457] 10:12:35.078798 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25452] 10:12:35.078827 read(14,  <unfinished ...>
[pid 25443] 10:12:35.078851 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.078878 sendto(16, "\275w\1\0\0\1\0\0\0\0\0\0\21hillcrestgolfclub\3com\0\0\17\0\1", 39, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25461] 10:12:35.078949 <... open resumed> ) = 6
[pid 25460] 10:12:35.078967 getuid( <unfinished ...>
[pid 25458] 10:12:35.078989 mprotect(0x7f03f388b000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.079017 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.079043 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25443] 10:12:35.079117 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.079147 <... sendto resumed> ) = 39
[pid 25461] 10:12:35.079174 read(6,  <unfinished ...>
[pid 25460] 10:12:35.079198 <... getuid resumed> ) = 503
[pid 25458] 10:12:35.079215 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.079231 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.079247 read(14,  <unfinished ...>
[pid 25443] 10:12:35.079271 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25433] 10:12:35.079287 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25461] 10:12:35.079325 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.079359 getgid( <unfinished ...>
[pid 25458] 10:12:35.079385 mmap(0x7f03f3a8a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25457] 10:12:35.079415 read(7,  <unfinished ...>
[pid 25452] 10:12:35.079442 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25443] 10:12:35.079472 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.079614 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.079649 <... getgid resumed> ) = 500
[pid 25458] 10:12:35.079670 <... mmap resumed> ) = 0x7f03f3a8a000
[pid 25457] 10:12:35.079699 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25452] 10:12:35.079739 brk(0x2618000 <unfinished ...>
[pid 25443] 10:12:35.079767 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.079794 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.079829 getegid( <unfinished ...>
[pid 25458] 10:12:35.079852 close(6 <unfinished ...>
[pid 25457] 10:12:35.079875 close(7 <unfinished ...>
[pid 25452] 10:12:35.079900 <... brk resumed> ) = 0x2618000
[pid 25443] 10:12:35.079973 read(10,  <unfinished ...>
[pid 25461] 10:12:35.080014 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.080046 <... getegid resumed> ) = 499
[pid 25458] 10:12:35.080064 <... close resumed> ) = 0
[pid 25457] 10:12:35.080089 <... close resumed> ) = 0
[pid 25452] 10:12:35.080106 read(14,  <unfinished ...>
[pid 25443] 10:12:35.080131 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25461] 10:12:35.080166 <... mmap resumed> ) = 0x7f2b274c9000
[pid 25460] 10:12:35.080184 getppid( <unfinished ...>
[pid 25458] 10:12:35.080206 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.080237 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.080264 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25443] 10:12:35.080345 read(10,  <unfinished ...>
[pid 25461] 10:12:35.080382 mprotect(0x7f2b274cb000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.080410 <... getppid resumed> ) = 25389
[pid 25458] 10:12:35.080430 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.080448 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.080489 read(14,  <unfinished ...>
[pid 25443] 10:12:35.080518 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.080565 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.080587 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25458] 10:12:35.080619 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.080654 read(6,  <unfinished ...>
[pid 25452] 10:12:35.080679 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25443] 10:12:35.080769 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.080813 mmap(0x7f2b276cb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25460] 10:12:35.080845 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25458] 10:12:35.080919 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.080940 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25452] 10:12:35.081000 read(14,  <unfinished ...>
[pid 25443] 10:12:35.081029 <... open resumed> ) = 11
[pid 25461] 10:12:35.081058 <... mmap resumed> ) = 0x7f2b276cb000
[pid 25460] 10:12:35.081085 brk(0 <unfinished ...>
[pid 25458] 10:12:35.081109 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.081140 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.081171 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25443] 10:12:35.081202 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.081235 close(6 <unfinished ...>
[pid 25460] 10:12:35.081258 <... brk resumed> ) = 0x762000
[pid 25458] 10:12:35.081274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.081293 <... open resumed> ) = 7
[pid 25452] 10:12:35.081310 read(14,  <unfinished ...>
[pid 25443] 10:12:35.081334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.081373 <... close resumed> ) = 0
[pid 25460] 10:12:35.081396 brk(0x783000 <unfinished ...>
[pid 25458] 10:12:35.081423 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.081456 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.081611 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25443] 10:12:35.081698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.081740 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.081772 <... brk resumed> ) = 0x783000
[pid 25458] 10:12:35.081803 <... open resumed> ) = 6
[pid 25457] 10:12:35.081820 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25452] 10:12:35.081850 read(14,  <unfinished ...>
[pid 25443] 10:12:35.081874 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25461] 10:12:35.081900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.081918 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.081948 read(6,  <unfinished ...>
[pid 25457] 10:12:35.081977 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.082003 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25443] 10:12:35.082080 read(11,  <unfinished ...>
[pid 25461] 10:12:35.082121 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.082154 <... socket resumed> ) = 5
[pid 25458] 10:12:35.082170 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.082193 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.082210 read(14,  <unfinished ...>
[pid 25443] 10:12:35.082234 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.082274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.082292 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.082328 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.082352 read(7,  <unfinished ...>
[pid 25452] 10:12:35.082379 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25443] 10:12:35.082450 close(11 <unfinished ...>
[pid 25461] 10:12:35.082568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.082603 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.082621 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25457] 10:12:35.082652 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25452] 10:12:35.082676 read(14,  <unfinished ...>
[pid 25443] 10:12:35.082701 <... close resumed> ) = 0
[pid 25461] 10:12:35.082726 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.082745 close(5 <unfinished ...>
[pid 25458] 10:12:35.082772 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.082801 close(7 <unfinished ...>
[pid 25452] 10:12:35.082826 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25443] 10:12:35.082898 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25461] 10:12:35.082948 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.082982 <... close resumed> ) = 0
[pid 25458] 10:12:35.082998 <... mmap resumed> ) = 0x7f03f348d000
[pid 25457] 10:12:35.083014 <... close resumed> ) = 0
[pid 25452] 10:12:35.083030 read(14,  <unfinished ...>
[pid 25443] 10:12:35.083054 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.083094 <... open resumed> ) = 6
[pid 25460] 10:12:35.083113 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.083140 mprotect(0x7f03f3518000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.083168 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.083194 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25443] 10:12:35.083272 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.083311 read(6,  <unfinished ...>
[pid 25460] 10:12:35.083335 <... socket resumed> ) = 5
[pid 25458] 10:12:35.083351 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.083367 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.083391 read(14,  <unfinished ...>
[pid 25443] 10:12:35.083417 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.083473 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.083505 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.083538 mmap(0x7f03f3718000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25457] 10:12:35.083570 read(6,  <unfinished ...>
[pid 25452] 10:12:35.083595 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25443] 10:12:35.083670 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25461] 10:12:35.083713 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.083736 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.083753 <... mmap resumed> ) = 0x7f03f3718000
[pid 25457] 10:12:35.083774 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25452] 10:12:35.083814 read(14,  <unfinished ...>
[pid 25443] 10:12:35.083843 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25461] 10:12:35.083894 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.083924 close(5 <unfinished ...>
[pid 25458] 10:12:35.083937 mmap(0x7f03f371b000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.083952 uname( <unfinished ...>
[pid 25452] 10:12:35.083961 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25443] 10:12:35.084023 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.084049 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.084064 <... close resumed> ) = 0
[pid 25458] 10:12:35.084082 <... mmap resumed> ) = 0x7f03f371b000
[pid 25457] 10:12:35.084095 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25452] 10:12:35.084142 read(14,  <unfinished ...>
[pid 25443] 10:12:35.084154 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.084207 <... mmap resumed> ) = 0x7f2b272c6000
[pid 25460] 10:12:35.084217 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.084233 close(6 <unfinished ...>
[pid 25457] 10:12:35.084242 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25452] 10:12:35.084255 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25443] 10:12:35.084276 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.084300 mprotect(0x7f2b272c8000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.084325 <... open resumed> ) = 5
[pid 25458] 10:12:35.084351 <... close resumed> ) = 0
[pid 25457] 10:12:35.084367 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f293afa2790}, 8) = 0
[pid 25452] 10:12:35.084388 read(14,  <unfinished ...>
[pid 25443] 10:12:35.084399 <... open resumed> ) = 11
[pid 25461] 10:12:35.084418 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.084426 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.084435 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.084450 clone( <unfinished ...>
[pid 25452] 10:12:35.084885 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25443] 10:12:35.085040 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.085084 mmap(0x7f2b274c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25460] 10:12:35.085117 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25458] 10:12:35.085151 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.085172 read(14,  <unfinished ...>
[pid 25443] 10:12:35.085196 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.085243 <... mmap resumed> ) = 0x7f2b274c7000
[pid 25460] 10:12:35.085269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.085298 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.085332 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f293c0d5a90) = 25463
[pid 25452] 10:12:35.085374 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25443] 10:12:35.085455 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.085497 close(6 <unfinished ...>
[pid 25460] 10:12:35.085521 <... mmap resumed> ) = 0x7f9a212f8000
[pid 25458] 10:12:35.085537 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.085555 wait4(25463,  <unfinished ...>
[pid 25452] 10:12:35.085578 read(14,  <unfinished ...>
[pid 25443] 10:12:35.085602 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.085638 <... close resumed> ) = 0
[pid 25460] 10:12:35.085662 read(5,  <unfinished ...>
[pid 25458] 10:12:35.085691 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.085722 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25443] 10:12:35.085807 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.085847 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.085878 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25458] 10:12:35.085916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.085936 read(14,  <unfinished ...>
[pid 25443] 10:12:35.085961 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25461] 10:12:35.085986 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.086003 read(5,  <unfinished ...>
[pid 25458] 10:12:35.086026 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.086058 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25443] 10:12:35.086136 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.086172 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.086204 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:35.086224 <... open resumed> ) = 6
[pid 25452] 10:12:35.086241 read(14,  <unfinished ...>
[pid 25443] 10:12:35.086265 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.086289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.086307 close(5 <unfinished ...>
[pid 25458] 10:12:35.086337 read(6,  <unfinished ...>
[pid 25452] 10:12:35.086361 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25443] 10:12:35.086431 read(11,  <unfinished ...>
[pid 25461] 10:12:35.086471 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.086633 <... close resumed> ) = 0
[pid 25458] 10:12:35.086651 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.086675 read(14,  <unfinished ...>
[pid 25443] 10:12:35.086699 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25461] 10:12:35.086736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.086758 munmap(0x7f9a212f8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.086786 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.086810 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25443] 10:12:35.086901 read(11,  <unfinished ...>
[pid 25461] 10:12:35.086937 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.086970 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.086997 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25452] 10:12:35.087030 read(14,  <unfinished ...>
[pid 25443] 10:12:35.087055 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.087092 <... open resumed> ) = 6
[pid 25460] 10:12:35.087111 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.087139 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.087168 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25443] 10:12:35.087198 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.087232 read(6,  <unfinished ...>
[pid 25460] 10:12:35.087255 <... open resumed> ) = 5
[pid 25458] 10:12:35.087271 <... mmap resumed> ) = 0x7f03f3287000
[pid 25452] 10:12:35.087288 read(14,  <unfinished ...>
[pid 25443] 10:12:35.087311 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.087355 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.087387 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.087413 mprotect(0x7f03f328d000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.087441 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25443] 10:12:35.087625 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.087673 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.087697 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.087728 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.087756 read(14,  <unfinished ...>
[pid 25443] 10:12:35.087786 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.087846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.087884 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.087912 mmap(0x7f03f348c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25452] 10:12:35.087940 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25443] 10:12:35.087971 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.088008 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.088034 <... mmap resumed> ) = 0x7f9a212ef000
[pid 25458] 10:12:35.088051 <... mmap resumed> ) = 0x7f03f348c000
[pid 25452] 10:12:35.088071 read(14,  <unfinished ...>
[pid 25443] 10:12:35.088096 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.088159 <... mmap resumed> ) = 0x7f2b29357000
[pid 25460] 10:12:35.088187 close(5 <unfinished ...>
[pid 25458] 10:12:35.088211 close(6 <unfinished ...>
[pid 25452] 10:12:35.088234 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25443] 10:12:35.088309 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.088348 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.088377 <... close resumed> ) = 0
[pid 25458] 10:12:35.088402 <... close resumed> ) = 0
[pid 25452] 10:12:35.088425 read(14,  <unfinished ...>
[pid 25443] 10:12:35.088456 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.088514 <... mmap resumed> ) = 0x7f2b26f32000
[pid 25460] 10:12:35.088535 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.088569 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.088599 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25443] 10:12:35.088630 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.088667 mprotect(0x7f2b270bc000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.088696 <... open resumed> ) = 5
[pid 25458] 10:12:35.088712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.088730 read(14,  <unfinished ...>
[pid 25443] 10:12:35.088754 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.088818 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.088840 read(5,  <unfinished ...>
[pid 25458] 10:12:35.088864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.088904 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25443] 10:12:35.088985 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.089024 mmap(0x7f2b272bc000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25460] 10:12:35.089055 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.089077 <... open resumed> ) = 6
[pid 25452] 10:12:35.089085 read(14,  <unfinished ...>
[pid 25443] 10:12:35.089096 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.089132 <... mmap resumed> ) = 0x7f2b272bc000
[pid 25460] 10:12:35.089146 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.089156 read(6,  <unfinished ...>
[pid 25452] 10:12:35.089165 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25443] 10:12:35.089238 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.089260 mmap(0x7f2b272c1000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.089275 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.089301 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.089314 read(14,  <unfinished ...>
[pid 25443] 10:12:35.089324 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.089418 <... mmap resumed> ) = 0x7f2b272c1000
[pid 25460] 10:12:35.089435 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25458] 10:12:35.089449 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.089458 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25443] 10:12:35.089692 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.089733 close(6 <unfinished ...>
[pid 25460] 10:12:35.089757 <... mmap resumed> ) = 0x7f9a20b39000
[pid 25458] 10:12:35.089777 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25452] 10:12:35.089815 read(14,  <unfinished ...>
[pid 25443] 10:12:35.089844 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.089874 <... close resumed> ) = 0
[pid 25460] 10:12:35.089900 mprotect(0x7f9a20b45000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.089930 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.089956 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25443] 10:12:35.090054 read(10,  <unfinished ...>
[pid 25461] 10:12:35.090091 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.090123 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.090139 <... mmap resumed> ) = 0x7f03f4bdc000
[pid 25452] 10:12:35.090159 read(14,  <unfinished ...>
[pid 25443] 10:12:35.090184 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25461] 10:12:35.090218 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.090237 mmap(0x7f9a20d45000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25458] 10:12:35.090267 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.090294 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25443] 10:12:35.090384 read(10,  <unfinished ...>
[pid 25461] 10:12:35.090423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.090456 <... mmap resumed> ) = 0x7f9a20d45000
[pid 25458] 10:12:35.090569 <... mmap resumed> ) = 0x7f03f2f51000
[pid 25452] 10:12:35.090594 read(14,  <unfinished ...>
[pid 25443] 10:12:35.090619 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.090672 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.090696 close(5 <unfinished ...>
[pid 25458] 10:12:35.090719 mprotect(0x7f03f307d000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.090747 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25443] 10:12:35.090781 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.090825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.090865 <... close resumed> ) = 0
[pid 25458] 10:12:35.090896 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.090914 brk(0x2639000 <unfinished ...>
[pid 25443] 10:12:35.090938 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25461] 10:12:35.090988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.091010 mprotect(0x7f9a20d45000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.091037 mmap(0x7f03f327d000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25452] 10:12:35.091067 <... brk resumed> ) = 0x2639000
[pid 25443] 10:12:35.091148 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.091191 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.091223 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.091242 <... mmap resumed> ) = 0x7f03f327d000
[pid 25452] 10:12:35.091263 read(14,  <unfinished ...>
[pid 25443] 10:12:35.091288 <... open resumed> ) = 12
[pid 25461] 10:12:35.091313 <... open resumed> ) = 6
[pid 25460] 10:12:35.091329 munmap(0x7f9a212ef000, 39387 <unfinished ...>
[pid 25458] 10:12:35.091357 mmap(0x7f03f3286000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.091385 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25443] 10:12:35.091488 fstat(12,  <unfinished ...>
[pid 25461] 10:12:35.091525 read(6,  <unfinished ...>
[pid 25460] 10:12:35.091549 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.091572 <... mmap resumed> ) = 0x7f03f3286000
[pid 25452] 10:12:35.091598 read(14,  <unfinished ...>
[pid 25443] 10:12:35.091625 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25461] 10:12:35.091666 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.091696 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.091727 close(6 <unfinished ...>
[pid 25452] 10:12:35.091750 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25443] 10:12:35.091785 fstat(12,  <unfinished ...>
[pid 25461] 10:12:35.091824 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.091848 <... open resumed> ) = 5
[pid 25458] 10:12:35.091871 <... close resumed> ) = 0
[pid 25452] 10:12:35.091900 read(14,  <unfinished ...>
[pid 25443] 10:12:35.091926 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25461] 10:12:35.091963 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25460] 10:12:35.091993 fcntl(5, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.092017 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.092047 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25443] 10:12:35.092119 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.092158 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.092186 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25458] 10:12:35.092207 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.092223 read(14,  <unfinished ...>
[pid 25443] 10:12:35.092234 <... mmap resumed> ) = 0x7fdec5ab5000
[pid 25461] 10:12:35.092251 <... mmap resumed> ) = 0x7f2b26cc6000
[pid 25460] 10:12:35.092259 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.092268 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.092285 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25443] 10:12:35.092358 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.092377 mprotect(0x7f2b26d28000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.092391 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:35.092410 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.092419 read(14,  <unfinished ...>
[pid 25443] 10:12:35.092429 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.092445 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.092454 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.092465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.092676 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25443] 10:12:35.092713 read(12,  <unfinished ...>
[pid 25461] 10:12:35.092748 mmap(0x7f2b26f27000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25460] 10:12:35.092784 <... mmap resumed> ) = 0x7f9a212f8000
[pid 25458] 10:12:35.092808 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.092828 read(14,  <unfinished ...>
[pid 25443] 10:12:35.092853 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.092886 <... mmap resumed> ) = 0x7f2b26f27000
[pid 25460] 10:12:35.092914 read(5,  <unfinished ...>
[pid 25458] 10:12:35.092947 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.092979 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25443] 10:12:35.093095 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.093135 close(6 <unfinished ...>
[pid 25460] 10:12:35.093158 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:35.093196 <... open resumed> ) = 6
[pid 25452] 10:12:35.093214 read(14,  <unfinished ...>
[pid 25443] 10:12:35.093239 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.093292 <... close resumed> ) = 0
[pid 25460] 10:12:35.093322 close(5 <unfinished ...>
[pid 25458] 10:12:35.093349 read(6,  <unfinished ...>
[pid 25452] 10:12:35.093374 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25443] 10:12:35.093407 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.093444 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.093547 <... close resumed> ) = 0
[pid 25458] 10:12:35.093571 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.093596 read(14,  <unfinished ...>
[pid 25443] 10:12:35.093620 <... open resumed> ) = 13
[pid 25461] 10:12:35.093646 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.093664 munmap(0x7f9a212f8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.093692 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.093716 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25443] 10:12:35.093809 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.093845 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.093879 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.093902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.093938 read(14,  <unfinished ...>
[pid 25443] 10:12:35.093963 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.093999 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.094017 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.094046 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.094076 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25443] 10:12:35.094149 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.094188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.094220 <... socket resumed> ) = 5
[pid 25458] 10:12:35.094236 <... mmap resumed> ) = 0x7f03f2d4d000
[pid 25452] 10:12:35.094253 read(14,  <unfinished ...>
[pid 25443] 10:12:35.094277 <... mmap resumed> ) = 0x7fdec5ab4000
[pid 25461] 10:12:35.094301 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.094321 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.094357 mprotect(0x7f03f2d4f000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.094385 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25443] 10:12:35.094414 read(13,  <unfinished ...>
[pid 25461] 10:12:35.094449 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.094486 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.094504 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.094520 read(14,  <unfinished ...>
[pid 25443] 10:12:35.094544 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.094583 <... open resumed> ) = 6
[pid 25460] 10:12:35.094600 close(5 <unfinished ...>
[pid 25458] 10:12:35.094627 mmap(0x7f03f2f4f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25452] 10:12:35.094658 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25443] 10:12:35.094741 close(13 <unfinished ...>
[pid 25461] 10:12:35.094778 read(6,  <unfinished ...>
[pid 25460] 10:12:35.094804 <... close resumed> ) = 0
[pid 25458] 10:12:35.094820 <... mmap resumed> ) = 0x7f03f2f4f000
[pid 25452] 10:12:35.094845 read(14,  <unfinished ...>
[pid 25443] 10:12:35.094872 <... close resumed> ) = 0
[pid 25461] 10:12:35.094895 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.094920 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.094947 close(6 <unfinished ...>
[pid 25452] 10:12:35.094970 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25443] 10:12:35.094996 munmap(0x7fdec5ab4000, 4096 <unfinished ...>
[pid 25461] 10:12:35.095019 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.095029 <... socket resumed> ) = 5
[pid 25458] 10:12:35.095036 <... close resumed> ) = 0
[pid 25452] 10:12:35.095051 read(14,  <unfinished ...>
[pid 25443] 10:12:35.095061 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.095098 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25460] 10:12:35.095122 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.095139 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.095155 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25443] 10:12:35.095218 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.095242 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.095257 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.095267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.095276 read(14,  <unfinished ...>
[pid 25443] 10:12:35.095286 <... open resumed> ) = 13
[pid 25461] 10:12:35.095302 <... mmap resumed> ) = 0x7f2b268e3000
[pid 25460] 10:12:35.095310 close(5 <unfinished ...>
[pid 25458] 10:12:35.095323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.095340 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25443] 10:12:35.095361 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.095378 mprotect(0x7f2b26a9c000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.095391 <... close resumed> ) = 0
[pid 25458] 10:12:35.095403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.095412 read(14,  <unfinished ...>
[pid 25443] 10:12:35.095423 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.095452 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.095461 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.095697 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.095739 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25443] 10:12:35.095821 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.095857 mmap(0x7f2b26c9b000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25460] 10:12:35.095890 <... open resumed> ) = 5
[pid 25458] 10:12:35.095909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.095928 read(14,  <unfinished ...>
[pid 25443] 10:12:35.095952 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.095990 <... mmap resumed> ) = 0x7f2b26c9b000
[pid 25460] 10:12:35.096012 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.096036 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.096067 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25443] 10:12:35.096140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.096179 mmap(0x7f2b26cc2000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.096207 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.096236 <... open resumed> ) = 6
[pid 25452] 10:12:35.096252 read(14,  <unfinished ...>
[pid 25443] 10:12:35.096276 <... mmap resumed> ) = 0x7fdec5ab4000
[pid 25461] 10:12:35.096301 <... mmap resumed> ) = 0x7f2b26cc2000
[pid 25460] 10:12:35.096323 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.096350 read(6,  <unfinished ...>
[pid 25452] 10:12:35.096374 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25443] 10:12:35.096440 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.096480 close(6 <unfinished ...>
[pid 25460] 10:12:35.096504 <... mmap resumed> ) = 0x7f9a212f8000
[pid 25458] 10:12:35.096522 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.096553 read(14,  <unfinished ...>
[pid 25443] 10:12:35.096578 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.096603 <... close resumed> ) = 0
[pid 25460] 10:12:35.096628 read(5,  <unfinished ...>
[pid 25458] 10:12:35.096656 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.096679 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25443] 10:12:35.096711 read(13,  <unfinished ...>
[pid 25461] 10:12:35.096750 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.096787 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.096823 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.096855 read(14,  <unfinished ...>
[pid 25443] 10:12:35.096880 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25461] 10:12:35.097026 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.097046 close(5 <unfinished ...>
[pid 25458] 10:12:35.097071 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.097102 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25443] 10:12:35.097193 read(13,  <unfinished ...>
[pid 25461] 10:12:35.097228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.097262 <... close resumed> ) = 0
[pid 25458] 10:12:35.097279 <... mmap resumed> ) = 0x7f03f2b4a000
[pid 25452] 10:12:35.097295 read(14,  <unfinished ...>
[pid 25443] 10:12:35.097319 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.097353 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.097374 munmap(0x7f9a212f8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.097405 mprotect(0x7f03f2b4c000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.097433 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25443] 10:12:35.097572 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25461] 10:12:35.097630 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.097668 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.097692 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.097709 read(14,  <unfinished ...>
[pid 25443] 10:12:35.097734 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25461] 10:12:35.097779 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.097806 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.097837 mmap(0x7f03f2d4b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25452] 10:12:35.097867 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25443] 10:12:35.097944 stat("/usr/local/cpanel/3rdparty/mailman/lists/rochelle.samms_radisson.com/config.pck",  <unfinished ...>
[pid 25461] 10:12:35.097989 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.098022 <... open resumed> ) = 5
[pid 25458] 10:12:35.098039 <... mmap resumed> ) = 0x7f03f2d4b000
[pid 25452] 10:12:35.098064 read(14,  <unfinished ...>
[pid 25443] 10:12:35.098091 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.098128 <... open resumed> ) = 6
[pid 25460] 10:12:35.098147 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.098170 close(6 <unfinished ...>
[pid 25452] 10:12:35.098192 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25443] 10:12:35.098269 stat("/etc/demouids",  <unfinished ...>
[pid 25461] 10:12:35.098309 read(6,  <unfinished ...>
[pid 25460] 10:12:35.098333 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:35.098362 <... close resumed> ) = 0
[pid 25452] 10:12:35.098384 read(14,  <unfinished ...>
[pid 25443] 10:12:35.098412 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.098460 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.098609 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.098644 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.098676 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25443] 10:12:35.098754 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.098795 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.098818 <... mmap resumed> ) = 0x7f9a212f8000
[pid 25458] 10:12:35.098836 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.098853 read(14,  <unfinished ...>
[pid 25443] 10:12:35.098878 <... open resumed> ) = 14
[pid 25461] 10:12:35.098902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25460] 10:12:35.098940 read(5,  <unfinished ...>
[pid 25458] 10:12:35.098967 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.099000 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25443] 10:12:35.099071 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.099107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.099134 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:35.099168 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.099187 read(14,  <unfinished ...>
[pid 25443] 10:12:35.099211 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.099251 <... mmap resumed> ) = 0x7f2b29356000
[pid 25460] 10:12:35.099272 close(5 <unfinished ...>
[pid 25458] 10:12:35.099297 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.099327 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25443] 10:12:35.099397 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.099434 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.099463 <... close resumed> ) = 0
[pid 25458] 10:12:35.099564 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.099593 read(14,  <unfinished ...>
[pid 25443] 10:12:35.099623 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.099662 <... mmap resumed> ) = 0x7f2b266b6000
[pid 25460] 10:12:35.099679 munmap(0x7f9a212f8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.099706 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.099738 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25443] 10:12:35.099808 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.099847 mprotect(0x7f2b266e2000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.099875 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.099905 <... open resumed> ) = 6
[pid 25452] 10:12:35.099923 read(14,  <unfinished ...>
[pid 25443] 10:12:35.099947 <... mmap resumed> ) = 0x7fdec5ab3000
[pid 25461] 10:12:35.099971 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.099988 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25458] 10:12:35.100032 read(6,  <unfinished ...>
[pid 25452] 10:12:35.100056 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25443] 10:12:35.100090 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.100122 mmap(0x7f2b268e2000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25460] 10:12:35.100152 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25458] 10:12:35.100177 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.100202 read(14,  <unfinished ...>
[pid 25443] 10:12:35.100228 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.100253 <... mmap resumed> ) = 0x7f2b268e2000
[pid 25460] 10:12:35.100275 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25458] 10:12:35.100305 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.100328 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25443] 10:12:35.100404 read(14,  <unfinished ...>
[pid 25461] 10:12:35.100441 close(6 <unfinished ...>
[pid 25460] 10:12:35.100464 <... readlink resumed> 0x7ffe7e223220, 4095) = -1 EINVAL (Invalid argument)
[pid 25458] 10:12:35.100579 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.100618 read(14,  <unfinished ...>
[pid 25443] 10:12:35.100643 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.100676 <... close resumed> ) = 0
[pid 25460] 10:12:35.100704 getcwd( <unfinished ...>
[pid 25458] 10:12:35.100731 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.100759 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25443] 10:12:35.100809 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.100849 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.100884 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25458] 10:12:35.100910 <... mmap resumed> ) = 0x7f03f4bdb000
[pid 25452] 10:12:35.100931 brk(0x265a000 <unfinished ...>
[pid 25443] 10:12:35.100956 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.101114 <... open resumed> ) = 6
[pid 25460] 10:12:35.101140 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25458] 10:12:35.101169 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.101199 <... brk resumed> ) = 0x265a000
[pid 25443] 10:12:35.101249 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.101291 read(6,  <unfinished ...>
[pid 25460] 10:12:35.101316 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25458] 10:12:35.101353 <... mmap resumed> ) = 0x7f03f27b6000
[pid 25452] 10:12:35.101371 read(14,  <unfinished ...>
[pid 25443] 10:12:35.101397 <... open resumed> ) = 15
[pid 25461] 10:12:35.101424 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.101449 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.101557 mprotect(0x7f03f2940000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.101591 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25443] 10:12:35.101622 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.101655 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.101678 <... open resumed> ) = 5
[pid 25458] 10:12:35.101696 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.101712 read(14,  <unfinished ...>
[pid 25443] 10:12:35.101737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25461] 10:12:35.101773 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25460] 10:12:35.101803 fstat(5,  <unfinished ...>
[pid 25458] 10:12:35.101827 mmap(0x7f03f2b40000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25452] 10:12:35.101858 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25443] 10:12:35.101939 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.101979 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.102008 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25458] 10:12:35.102037 <... mmap resumed> ) = 0x7f03f2b40000
[pid 25452] 10:12:35.102059 read(14,  <unfinished ...>
[pid 25443] 10:12:35.102084 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25461] 10:12:35.102108 <... mmap resumed> ) = 0x7f2b264b1000
[pid 25460] 10:12:35.102125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.102151 mmap(0x7f03f2b45000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.102178 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25443] 10:12:35.102216 read(15,  <unfinished ...>
[pid 25461] 10:12:35.102252 mprotect(0x7f2b264b6000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.102280 <... mmap resumed> ) = 0x7f9a212f8000
[pid 25458] 10:12:35.102297 <... mmap resumed> ) = 0x7f03f2b45000
[pid 25452] 10:12:35.102318 read(14,  <unfinished ...>
[pid 25443] 10:12:35.102345 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25461] 10:12:35.102379 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.102396 read(5,  <unfinished ...>
[pid 25458] 10:12:35.102425 close(6 <unfinished ...>
[pid 25452] 10:12:35.102450 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25443] 10:12:35.102644 close(15 <unfinished ...>
[pid 25461] 10:12:35.102687 mmap(0x7f2b266b5000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25460] 10:12:35.102718 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25458] 10:12:35.102740 <... close resumed> ) = 0
[pid 25452] 10:12:35.102765 read(14,  <unfinished ...>
[pid 25443] 10:12:35.102791 <... close resumed> ) = 0
[pid 25461] 10:12:35.102816 <... mmap resumed> ) = 0x7f2b266b5000
[pid 25460] 10:12:35.102838 read(5,  <unfinished ...>
[pid 25458] 10:12:35.102863 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.102894 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25443] 10:12:35.102970 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25461] 10:12:35.103010 close(6 <unfinished ...>
[pid 25460] 10:12:35.103034 <... read resumed> "", 1024) = 0
[pid 25458] 10:12:35.103056 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.103075 read(14,  <unfinished ...>
[pid 25443] 10:12:35.103100 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.103171 <... close resumed> ) = 0
[pid 25460] 10:12:35.103206 setregid(499, 499 <unfinished ...>
[pid 25458] 10:12:35.103233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.103267 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25443] 10:12:35.103351 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25461] 10:12:35.103390 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.103420 <... setregid resumed> ) = 0
[pid 25458] 10:12:35.103439 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.103457 read(14,  <unfinished ...>
[pid 25443] 10:12:35.103486 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25461] 10:12:35.103541 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.103568 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25458] 10:12:35.103812 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.103846 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25443] 10:12:35.103933 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.103976 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.104010 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.104030 read(14,  <unfinished ...>
[pid 25443] 10:12:35.104055 <... open resumed> ) = 15
[pid 25461] 10:12:35.104079 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.104097 <... execve resumed> ) = 0
[pid 25458] 10:12:35.104130 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.104165 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25443] 10:12:35.104194 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.104212 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.104228 brk(0 <unfinished ...>
[pid 25458] 10:12:35.104237 <... open resumed> ) = 6
[pid 25452] 10:12:35.104244 read(14,  <unfinished ...>
[pid 25443] 10:12:35.104254 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.104281 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.104292 <... brk resumed> ) = 0x1420000
[pid 25458] 10:12:35.104303 read(6,  <unfinished ...>
[pid 25452] 10:12:35.104312 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25443] 10:12:35.104391 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.104414 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.104429 fcntl(0, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.104438 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.104451 read(14,  <unfinished ...>
[pid 25443] 10:12:35.104460 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25461] 10:12:35.104698 <... open resumed> ) = 6
[pid 25460] 10:12:35.104723 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.104740 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.104763 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25443] 10:12:35.104794 read(15,  <unfinished ...>
[pid 25461] 10:12:35.104829 read(6,  <unfinished ...>
[pid 25460] 10:12:35.104853 fcntl(1, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.104876 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25452] 10:12:35.104906 read(14,  <unfinished ...>
[pid 25443] 10:12:35.104930 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.104966 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.104989 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.105006 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.105035 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25443] 10:12:35.105132 close(15 <unfinished ...>
[pid 25461] 10:12:35.105169 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.105193 fcntl(2, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.105216 <... mmap resumed> ) = 0x7f03f254a000
[pid 25452] 10:12:35.105232 read(14,  <unfinished ...>
[pid 25443] 10:12:35.105255 <... close resumed> ) = 0
[pid 25461] 10:12:35.105279 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25460] 10:12:35.105310 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.105332 mprotect(0x7f03f25ac000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.105361 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25443] 10:12:35.105390 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25461] 10:12:35.105428 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.105458 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25458] 10:12:35.105575 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.105594 read(14,  <unfinished ...>
[pid 25443] 10:12:35.105619 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.105655 <... mmap resumed> ) = 0x7f2b262ae000
[pid 25460] 10:12:35.105675 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.105706 mmap(0x7f03f27ab000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25452] 10:12:35.105737 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25443] 10:12:35.105817 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.105859 mprotect(0x7f2b262b0000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.105887 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.105913 <... mmap resumed> ) = 0x7f03f27ab000
[pid 25452] 10:12:35.105938 read(14,  <unfinished ...>
[pid 25443] 10:12:35.105964 <... open resumed> ) = 15
[pid 25461] 10:12:35.105989 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.106006 <... mmap resumed> ) = 0x7f9083404000
[pid 25458] 10:12:35.106034 close(6 <unfinished ...>
[pid 25452] 10:12:35.106059 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25443] 10:12:35.106090 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.106122 mmap(0x7f2b264af000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25460] 10:12:35.106151 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25458] 10:12:35.106179 <... close resumed> ) = 0
[pid 25452] 10:12:35.106205 read(14,  <unfinished ...>
[pid 25443] 10:12:35.106230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.106267 <... mmap resumed> ) = 0x7f2b264af000
[pid 25460] 10:12:35.106291 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.106320 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.106357 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25443] 10:12:35.106437 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.106551 close(6 <unfinished ...>
[pid 25460] 10:12:35.106582 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.106612 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.106630 read(14,  <unfinished ...>
[pid 25443] 10:12:35.106655 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25461] 10:12:35.106680 <... close resumed> ) = 0
[pid 25460] 10:12:35.106705 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.106724 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.106758 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25443] 10:12:35.106789 read(15,  <unfinished ...>
[pid 25461] 10:12:35.106825 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.106854 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.106881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.106898 read(14,  <unfinished ...>
[pid 25443] 10:12:35.106922 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.106955 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.106973 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.106990 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.107020 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25443] 10:12:35.107097 close(15 <unfinished ...>
[pid 25461] 10:12:35.107133 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.107165 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.107193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.107211 read(14,  <unfinished ...>
[pid 25443] 10:12:35.107235 <... close resumed> ) = 0
[pid 25461] 10:12:35.107258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.107276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.107292 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.107324 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25443] 10:12:35.107404 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25461] 10:12:35.107444 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.107557 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25458] 10:12:35.107590 <... open resumed> ) = 6
[pid 25452] 10:12:35.107606 read(14,  <unfinished ...>
[pid 25443] 10:12:35.107630 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.107749 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.107777 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.107796 read(6,  <unfinished ...>
[pid 25452] 10:12:35.107819 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25443] 10:12:35.107850 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.107888 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.107921 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.107951 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.107975 read(14,  <unfinished ...>
[pid 25443] 10:12:35.107999 <... open resumed> ) = 15
[pid 25461] 10:12:35.108024 <... open resumed> ) = 6
[pid 25460] 10:12:35.108042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.108058 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.108081 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25443] 10:12:35.108165 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.108201 read(6,  <unfinished ...>
[pid 25460] 10:12:35.108233 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.108264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25452] 10:12:35.108296 read(14,  <unfinished ...>
[pid 25443] 10:12:35.108320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.108359 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.108383 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.108401 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.108440 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25443] 10:12:35.108481 fstat(15, Process 25463 attached
 <unfinished ...>
[pid 25461] 10:12:35.108542 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.108568 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.108598 <... mmap resumed> ) = 0x7f03f2167000
[pid 25452] 10:12:35.108615 read(14,  <unfinished ...>
[pid 25443] 10:12:35.108639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25463] 10:12:35.108676 set_robust_list(0x7f293c0d5aa0, 24 <unfinished ...>
[pid 25461] 10:12:35.108699 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.108731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.108748 mprotect(0x7f03f2320000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.108775 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25443] 10:12:35.108857 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25463] 10:12:35.108881 <... set_robust_list resumed> ) = 0
[pid 25461] 10:12:35.108887 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.108922 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25458] 10:12:35.108936 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.108944 read(14,  <unfinished ...>
[pid 25443] 10:12:35.108954 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25463] 10:12:35.108971 geteuid( <unfinished ...>
[pid 25461] 10:12:35.108977 <... mmap resumed> ) = 0x7f2b29355000
[pid 25460] 10:12:35.108989 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25458] 10:12:35.109009 mmap(0x7f03f251f000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25452] 10:12:35.109025 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25443] 10:12:35.109091 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25463] 10:12:35.109112 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.109117 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.109139 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.109158 <... mmap resumed> ) = 0x7f03f251f000
[pid 25452] 10:12:35.109171 read(14,  <unfinished ...>
[pid 25443] 10:12:35.109180 <... lseek resumed> ) = 0
[pid 25463] 10:12:35.109198 geteuid( <unfinished ...>
[pid 25461] 10:12:35.109204 <... mmap resumed> ) = 0x7f2b2608b000
[pid 25460] 10:12:35.109213 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.109222 mmap(0x7f03f2546000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.109235 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25443] 10:12:35.109302 read(15,  <unfinished ...>
[pid 25463] 10:12:35.109324 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.109330 mprotect(0x7f2b260a2000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.109344 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.109359 <... mmap resumed> ) = 0x7f03f2546000
[pid 25452] 10:12:35.109372 read(14,  <unfinished ...>
[pid 25443] 10:12:35.109382 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25463] 10:12:35.109403 getegid( <unfinished ...>
[pid 25461] 10:12:35.109409 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.109418 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.109428 close(6 <unfinished ...>
[pid 25452] 10:12:35.109436 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25443] 10:12:35.109763 read(15,  <unfinished ...>
[pid 25463] 10:12:35.109807 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.109822 mmap(0x7f2b262a2000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25460] 10:12:35.109859 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.109893 <... close resumed> ) = 0
[pid 25452] 10:12:35.109917 read(14,  <unfinished ...>
[pid 25443] 10:12:35.109943 <... read resumed> "", 4096) = 0
[pid 25463] 10:12:35.110038 setgid(12 <unfinished ...>
[pid 25461] 10:12:35.110068 <... mmap resumed> ) = 0x7f2b262a2000
[pid 25460] 10:12:35.110095 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.110115 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.110146 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25443] 10:12:35.110179 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25463] 10:12:35.110213 <... setgid resumed> ) = 0
[pid 25461] 10:12:35.110227 close(6 <unfinished ...>
[pid 25460] 10:12:35.110252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25458] 10:12:35.110282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.110300 read(14,  <unfinished ...>
[pid 25443] 10:12:35.110323 <... lseek resumed> ) = 353
[pid 25463] 10:12:35.110353 setuid(47 <unfinished ...>
[pid 25461] 10:12:35.110377 <... close resumed> ) = 0
[pid 25460] 10:12:35.110414 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.110433 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.110468 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25443] 10:12:35.110625 read(9,  <unfinished ...>
[pid 25463] 10:12:35.110666 <... setuid resumed> ) = 0
[pid 25461] 10:12:35.110687 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.111541 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.111586 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.111607 read(14,  <unfinished ...>
[pid 25443] 10:12:35.111636 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.111686 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.111709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.111726 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.111758 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25443] 10:12:35.111844 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.111880 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.111914 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.111943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.111963 read(14,  <unfinished ...>
[pid 25443] 10:12:35.111987 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.112012 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.112030 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.112047 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.112079 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25443] 10:12:35.112164 read(9,  <unfinished ...>
[pid 25461] 10:12:35.112200 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.112231 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.112262 <... open resumed> ) = 6
[pid 25452] 10:12:35.112277 read(14,  <unfinished ...>
[pid 25443] 10:12:35.112301 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25461] 10:12:35.112362 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.112389 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.112407 read(6,  <unfinished ...>
[pid 25452] 10:12:35.112431 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25443] 10:12:35.112604 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.112658 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.112691 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25458] 10:12:35.112721 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.112750 brk(0x267b000 <unfinished ...>
[pid 25443] 10:12:35.112776 <... stat resumed> 0x7fdec4156880) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.112816 <... open resumed> ) = 6
[pid 25460] 10:12:35.113637 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.113672 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.113698 <... brk resumed> ) = 0x267b000
[pid 25443] 10:12:35.113728 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25463] 10:12:35.113767 brk(0x7bb000 <unfinished ...>
[pid 25461] 10:12:35.113789 read(6,  <unfinished ...>
[pid 25460] 10:12:35.113813 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.113844 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25452] 10:12:35.113875 read(14,  <unfinished ...>
[pid 25443] 10:12:35.113901 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.113959 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.113988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.114006 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.114034 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25443] 10:12:35.114065 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.114107 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.114131 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.114159 <... mmap resumed> ) = 0x7f03f4bda000
[pid 25452] 10:12:35.114178 read(14,  <unfinished ...>
[pid 25443] 10:12:35.114203 <... open resumed> ) = 16
[pid 25461] 10:12:35.114232 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.114264 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.114283 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.114319 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25443] 10:12:35.114401 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25461] 10:12:35.114443 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.114473 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.114638 <... mmap resumed> ) = 0x7f03f1f3a000
[pid 25452] 10:12:35.114656 read(14,  <unfinished ...>
[pid 25443] 10:12:35.114681 <... ioctl resumed> , 0x7ffd94719280) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25461] 10:12:35.114708 <... mmap resumed> ) = 0x7f2b25e47000
[pid 25460] 10:12:35.114725 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.114742 mprotect(0x7f03f1f66000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.114770 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25443] 10:12:35.114851 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25461] 10:12:35.114887 mprotect(0x7f2b25e88000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.114915 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25458] 10:12:35.114943 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.114959 read(14,  <unfinished ...>
[pid 25443] 10:12:35.114982 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.115008 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.115024 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.115042 mmap(0x7f03f2166000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25452] 10:12:35.115071 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25443] 10:12:35.115141 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.115176 mmap(0x7f2b26088000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25460] 10:12:35.115205 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.115236 <... mmap resumed> ) = 0x7f03f2166000
[pid 25452] 10:12:35.115257 read(14,  <unfinished ...>
[pid 25443] 10:12:35.115282 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25461] 10:12:35.115320 <... mmap resumed> ) = 0x7f2b26088000
[pid 25460] 10:12:35.115345 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.115364 close(6 <unfinished ...>
[pid 25452] 10:12:35.115387 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25443] 10:12:35.115416 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.115448 close(6 <unfinished ...>
[pid 25460] 10:12:35.115472 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.115592 <... close resumed> ) = 0
[pid 25452] 10:12:35.115626 read(14,  <unfinished ...>
[pid 25443] 10:12:35.115657 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.115684 <... close resumed> ) = 0
[pid 25460] 10:12:35.115710 <... stat resumed> 0x7ffe4db68fa0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.115729 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.115763 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25443] 10:12:35.115835 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.115871 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.115901 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.115931 <... open resumed> ) = 6
[pid 25452] 10:12:35.115946 read(14,  <unfinished ...>
[pid 25443] 10:12:35.115970 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25461] 10:12:35.116024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.116045 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.116061 read(6,  <unfinished ...>
[pid 25452] 10:12:35.116085 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25443] 10:12:35.116156 read(16,  <unfinished ...>
[pid 25461] 10:12:35.116191 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.116224 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25458] 10:12:35.116252 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.116275 read(14,  <unfinished ...>
[pid 25443] 10:12:35.116299 <... read resumed> "0", 8192) = 1
[pid 25461] 10:12:35.116326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.116344 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.116375 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.116400 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25443] 10:12:35.116432 read(16,  <unfinished ...>
[pid 25461] 10:12:35.116465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.116603 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.116638 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25452] 10:12:35.116676 read(14,  <unfinished ...>
[pid 25443] 10:12:35.116702 <... read resumed> "", 8192) = 0
[pid 25461] 10:12:35.116731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.116752 <... open resumed> ) = 6
[pid 25458] 10:12:35.116768 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.116798 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25443] 10:12:35.116943 close(16 <unfinished ...>
[pid 25463] 10:12:35.116986 <... brk resumed> ) = 0x7bb000
[pid 25461] 10:12:35.117001 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.117419 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.117444 <... mmap resumed> ) = 0x7f03f1d35000
[pid 25452] 10:12:35.117461 read(14,  <unfinished ...>
[pid 25443] 10:12:35.117490 <... close resumed> ) = 0
[pid 25463] 10:12:35.117581 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25461] 10:12:35.117613 <... open resumed> ) = 6
[pid 25460] 10:12:35.117630 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.117660 mprotect(0x7f03f1d3a000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.117689 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25443] 10:12:35.117720 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.117759 read(6,  <unfinished ...>
[pid 25460] 10:12:35.117783 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.117812 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.117828 read(14,  <unfinished ...>
[pid 25443] 10:12:35.117853 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25461] 10:12:35.117910 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.117938 <... mmap resumed> ) = 0x7f90833fa000
[pid 25458] 10:12:35.117956 mmap(0x7f03f1f39000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25452] 10:12:35.117986 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25443] 10:12:35.118078 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.118117 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.118140 close(6 <unfinished ...>
[pid 25458] 10:12:35.118168 <... mmap resumed> ) = 0x7f03f1f39000
[pid 25452] 10:12:35.118190 read(14,  <unfinished ...>
[pid 25443] 10:12:35.118214 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.118263 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.118295 <... close resumed> ) = 0
[pid 25458] 10:12:35.118321 close(6 <unfinished ...>
[pid 25452] 10:12:35.118344 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25443] 10:12:35.118434 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.118474 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.118660 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.118695 <... close resumed> ) = 0
[pid 25452] 10:12:35.118722 read(14,  <unfinished ...>
[pid 25443] 10:12:35.118748 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.118790 <... mmap resumed> ) = 0x7f2b29354000
[pid 25460] 10:12:35.118811 <... open resumed> ) = 6
[pid 25458] 10:12:35.118827 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.118858 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25443] 10:12:35.118951 close(7 <unfinished ...>
[pid 25463] 10:12:35.119002 <... open resumed> ) = 7
[pid 25461] 10:12:35.119016 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.119055 read(6,  <unfinished ...>
[pid 25458] 10:12:35.119080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.119097 read(14,  <unfinished ...>
[pid 25443] 10:12:35.119121 <... close resumed> ) = 0
[pid 25463] 10:12:35.119149 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.119172 <... mmap resumed> ) = 0x7f2b25b60000
[pid 25460] 10:12:35.119189 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.119214 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.119248 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25443] 10:12:35.119336 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25463] 10:12:35.119391 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25461] 10:12:35.119419 mprotect(0x7f2b25c3b000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.119455 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.119568 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.119597 read(14,  <unfinished ...>
[pid 25443] 10:12:35.119627 <... open resumed> ) = 7
[pid 25463] 10:12:35.119653 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25461] 10:12:35.119680 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.119696 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.119727 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.119757 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25443] 10:12:35.119790 fcntl(7, F_GETFD <unfinished ...>
[pid 25463] 10:12:35.119824 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25461] 10:12:35.119840 mmap(0x7f2b25e3b000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25460] 10:12:35.119877 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.119904 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.119923 read(14,  <unfinished ...>
[pid 25443] 10:12:35.119947 <... fcntl resumed> ) = 0
[pid 25463] 10:12:35.119971 read(7,  <unfinished ...>
[pid 25461] 10:12:35.119999 <... mmap resumed> ) = 0x7f2b25e3b000
[pid 25460] 10:12:35.120025 <... mmap resumed> ) = 0x7f9082fcc000
[pid 25458] 10:12:35.120043 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.120073 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25443] 10:12:35.120164 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25463] 10:12:35.120201 <... read resumed> "D\275\21\37\20\241\243XR\n\310\35cT\1=D\334<[h\32\356_ZGfDk\304\220\v\313\27\307\360B\r\226>\201s\241\6Z\346Ot", 48) = 48
[pid 25461] 10:12:35.120218 close(6 <unfinished ...>
[pid 25460] 10:12:35.120245 mprotect(0x7f9082fe2000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.120273 <... open resumed> ) = 6
[pid 25452] 10:12:35.120289 read(14,  <unfinished ...>
[pid 25443] 10:12:35.120312 <... fcntl resumed> ) = 0
[pid 25463] 10:12:35.120338 close(7 <unfinished ...>
[pid 25461] 10:12:35.120360 <... close resumed> ) = 0
[pid 25460] 10:12:35.120386 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.120407 read(6,  <unfinished ...>
[pid 25452] 10:12:35.120431 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25443] 10:12:35.120616 fstat(7,  <unfinished ...>
[pid 25463] 10:12:35.120658 <... close resumed> ) = 0
[pid 25461] 10:12:35.120672 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.120725 mmap(0x7f90831e2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25458] 10:12:35.120764 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.120789 read(14,  <unfinished ...>
[pid 25443] 10:12:35.120813 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370177, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25463] 10:12:35.120852 getuid( <unfinished ...>
[pid 25461] 10:12:35.120874 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.120892 <... mmap resumed> ) = 0x7f90831e2000
[pid 25458] 10:12:35.120914 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.120937 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25443] 10:12:35.121021 write(7, "2015-12-30 10:12:35 [25443] 1aEJMY-0006cE-He SMTP connection outbound 1451491955 1aEJMY-0006cE-He finestweddingsites.com rochelle.samms@radisson.com\n", 149 <unfinished ...>
[pid 25463] 10:12:35.121064 <... getuid resumed> ) = 47
[pid 25461] 10:12:35.121078 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.121255 mmap(0x7f90831e4000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.121286 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25452] 10:12:35.121317 read(14,  <unfinished ...>
[pid 25443] 10:12:35.121342 <... write resumed> ) = 149
[pid 25463] 10:12:35.121414 exit_group(0) = ?
[pid 25461] 10:12:35.121433 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.121673 <... mmap resumed> ) = 0x7f90831e4000
[pid 25458] 10:12:35.121701 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.121735 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25443] 10:12:35.121826 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25463] 10:12:35.121892 +++ exited with 0 +++
[pid 25461] 10:12:35.121905 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.121936 close(6 <unfinished ...>
[pid 25458] 10:12:35.121959 <... mmap resumed> ) = 0x7f03f1b32000
[pid 25457] 10:12:35.121975 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25463
[pid 25452] 10:12:35.121997 read(14,  <unfinished ...>
[pid 25443] 10:12:35.122021 <... open resumed> ) = 16
[pid 25461] 10:12:35.122049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.122070 <... close resumed> ) = 0
[pid 25458] 10:12:35.122094 mprotect(0x7f03f1b34000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.122130 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25452] 10:12:35.122160 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25443] 10:12:35.122241 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25461] 10:12:35.122278 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.122313 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.122344 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.122360 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0}, 8) = 0
[pid 25452] 10:12:35.122407 read(14,  <unfinished ...>
[pid 25443] 10:12:35.122435 <... lseek resumed> ) = 7
[pid 25461] 10:12:35.122462 <... open resumed> ) = 6
[pid 25460] 10:12:35.122608 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.122635 mmap(0x7f03f1d33000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25457] 10:12:35.122667 getcwd( <unfinished ...>
[pid 25452] 10:12:35.122692 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25443] 10:12:35.122781 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25461] 10:12:35.122821 read(6,  <unfinished ...>
[pid 25460] 10:12:35.122845 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.122878 <... mmap resumed> ) = 0x7f03f1d33000
[pid 25457] 10:12:35.122903 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25452] 10:12:35.122958 read(14,  <unfinished ...>
[pid 25443] 10:12:35.122986 <... ioctl resumed> , 0x7ffd94719280) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25461] 10:12:35.123013 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.123038 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.123055 close(6 <unfinished ...>
[pid 25457] 10:12:35.123077 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.123105 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25443] 10:12:35.123133 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25461] 10:12:35.123165 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.123188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.123218 <... close resumed> ) = 0
[pid 25457] 10:12:35.123245 <... open resumed> ) = 7
[pid 25452] 10:12:35.123263 read(14,  <unfinished ...>
[pid 25443] 10:12:35.123286 <... lseek resumed> ) = 7
[pid 25461] 10:12:35.123312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.123351 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.123372 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.123402 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.123426 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25443] 10:12:35.123506 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.123543 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.123575 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.123609 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.123626 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25452] 10:12:35.123656 read(14,  <unfinished ...>
[pid 25443] 10:12:35.123680 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=7, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.123717 <... mmap resumed> ) = 0x7f2b2595c000
[pid 25460] 10:12:35.123734 <... open resumed> ) = 6
[pid 25458] 10:12:35.123749 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.123780 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.123803 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25443] 10:12:35.123832 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.123865 mprotect(0x7f2b2595f000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.123893 read(6,  <unfinished ...>
[pid 25458] 10:12:35.123916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.123932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25452] 10:12:35.123960 read(14,  <unfinished ...>
[pid 25443] 10:12:35.123984 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.124020 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.124038 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.124058 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.124074 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.124086 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25443] 10:12:35.124152 write(16, "1", 1 <unfinished ...>
[pid 25461] 10:12:35.124181 mmap(0x7f2b25b5e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25460] 10:12:35.124197 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.124206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.124216 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.124225 read(14,  <unfinished ...>
[pid 25443] 10:12:35.124235 <... write resumed> ) = 1
[pid 25461] 10:12:35.124252 <... mmap resumed> ) = 0x7f2b25b5e000
[pid 25460] 10:12:35.124269 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.124290 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.124308 read(7,  <unfinished ...>
[pid 25452] 10:12:35.124320 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25443] 10:12:35.124391 close(16 <unfinished ...>
[pid 25461] 10:12:35.124412 close(6 <unfinished ...>
[pid 25460] 10:12:35.124421 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.124434 <... open resumed> ) = 6
[pid 25457] 10:12:35.124442 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25452] 10:12:35.124458 read(14,  <unfinished ...>
[pid 25443] 10:12:35.124468 <... close resumed> ) = 0
[pid 25461] 10:12:35.124748 <... close resumed> ) = 0
[pid 25460] 10:12:35.124781 <... mmap resumed> ) = 0x7f90833f9000
[pid 25458] 10:12:35.124805 read(6,  <unfinished ...>
[pid 25457] 10:12:35.124830 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25452] 10:12:35.124854 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25443] 10:12:35.124927 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.124971 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.125002 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.125030 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.125059 <... lseek resumed> ) = 1279
[pid 25452] 10:12:35.125076 read(14,  <unfinished ...>
[pid 25443] 10:12:35.125100 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.125194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.125219 <... mmap resumed> ) = 0x7f9082db3000
[pid 25458] 10:12:35.125236 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.125260 read(7,  <unfinished ...>
[pid 25452] 10:12:35.125283 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25443] 10:12:35.125316 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.125353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.125385 mprotect(0x7f9082dc9000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.125413 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.125444 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25452] 10:12:35.125482 brk(0x269c000 <unfinished ...>
[pid 25443] 10:12:35.125510 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.125568 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.125590 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.125606 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.125633 close(7 <unfinished ...>
[pid 25452] 10:12:35.125657 <... brk resumed> ) = 0x269c000
[pid 25443] 10:12:35.125679 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.125719 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.125749 mmap(0x7f9082fc8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25458] 10:12:35.125780 <... mmap resumed> ) = 0x7f03f4bd9000
[pid 25457] 10:12:35.125799 <... close resumed> ) = 0
[pid 25452] 10:12:35.125816 read(14,  <unfinished ...>
[pid 25443] 10:12:35.125840 <... open resumed> ) = 16
[pid 25461] 10:12:35.125866 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.125885 <... mmap resumed> ) = 0x7f9082fc8000
[pid 25458] 10:12:35.125906 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.125936 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.125963 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25443] 10:12:35.126049 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.126086 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.126120 mmap(0x7f9082fca000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.126150 <... mmap resumed> ) = 0x7f03f190f000
[pid 25457] 10:12:35.126167 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.126198 read(14,  <unfinished ...>
[pid 25443] 10:12:35.126226 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25461] 10:12:35.126265 <... open resumed> ) = 6
[pid 25460] 10:12:35.126281 <... mmap resumed> ) = 0x7f9082fca000
[pid 25458] 10:12:35.126302 mprotect(0x7f03f1926000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.126331 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25452] 10:12:35.126364 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25443] 10:12:35.126452 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.126605 read(6,  <unfinished ...>
[pid 25460] 10:12:35.126633 close(6 <unfinished ...>
[pid 25458] 10:12:35.126656 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.126673 <... open resumed> ) = 7
[pid 25452] 10:12:35.126691 read(14,  <unfinished ...>
[pid 25443] 10:12:35.126716 <... mmap resumed> ) = 0x7fdec5ab1000
[pid 25461] 10:12:35.126742 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.126767 <... close resumed> ) = 0
[pid 25458] 10:12:35.126790 mmap(0x7f03f1b26000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25457] 10:12:35.126821 fcntl(7, F_GETFD <unfinished ...>
[pid 25452] 10:12:35.126844 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25443] 10:12:35.126924 read(16,  <unfinished ...>
[pid 25461] 10:12:35.126964 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.126987 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.127018 <... mmap resumed> ) = 0x7f03f1b26000
[pid 25457] 10:12:35.127043 <... fcntl resumed> ) = 0
[pid 25452] 10:12:35.127061 read(14,  <unfinished ...>
[pid 25443] 10:12:35.127085 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25461] 10:12:35.127119 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.127152 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.127179 close(6 <unfinished ...>
[pid 25457] 10:12:35.127202 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.127225 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25443] 10:12:35.127312 read(16,  <unfinished ...>
[pid 25461] 10:12:35.127350 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.127385 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.127425 <... close resumed> ) = 0
[pid 25457] 10:12:35.127463 <... fcntl resumed> ) = 0
[pid 25452] 10:12:35.127562 read(14,  <unfinished ...>
[pid 25443] 10:12:35.127592 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.127620 <... mmap resumed> ) = 0x7f2b25730000
[pid 25460] 10:12:35.127637 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.127655 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.127685 fstat(7,  <unfinished ...>
[pid 25452] 10:12:35.127709 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25443] 10:12:35.127807 close(16 <unfinished ...>
[pid 25461] 10:12:35.127846 mprotect(0x7f2b25759000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.127874 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.127904 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.127922 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370326, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25452] 10:12:35.127961 read(14,  <unfinished ...>
[pid 25443] 10:12:35.127986 <... close resumed> ) = 0
[pid 25461] 10:12:35.128013 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.128029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.128051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.128083 write(7, "2015-12-30 10:12:35 [25457] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMY-0006cP-Ry\n", 92 <unfinished ...>
[pid 25452] 10:12:35.128113 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25449] 10:12:35.128215 <... select resumed> ) = 1 (in [11], left {299, 943386})
[pid 25443] 10:12:35.128241 munmap(0x7fdec5ab1000, 4096 <unfinished ...>
[pid 25461] 10:12:35.128281 mmap(0x7f2b25959000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25460] 10:12:35.128312 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.128344 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.128362 <... write resumed> ) = 92
[pid 25452] 10:12:35.128381 read(14,  <unfinished ...>
[pid 25449] 10:12:35.128406 recvfrom(11,  <unfinished ...>
[pid 25443] 10:12:35.128431 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.128458 <... mmap resumed> ) = 0x7f2b25959000
[pid 25460] 10:12:35.128484 <... open resumed> ) = 6
[pid 25458] 10:12:35.128502 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.128538 chdir("/var/spool/exim" <unfinished ...>
[pid 25452] 10:12:35.128571 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25449] 10:12:35.128644 <... recvfrom resumed> "250-remote.phoenixmarriottmesa.com Hello [50.116.78.207]\r\n250-SIZE 51445760\r\n250-DSN\r\n250 AUTH NTLM LOGIN\r\n", 4096, 0, NULL, NULL) = 107
[pid 25443] 10:12:35.128710 uname( <unfinished ...>
[pid 25461] 10:12:35.128747 mmap(0x7f2b2595b000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.128778 read(6,  <unfinished ...>
[pid 25458] 10:12:35.128802 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.128821 <... chdir resumed> ) = 0
[pid 25452] 10:12:35.128841 read(14,  <unfinished ...>
[pid 25449] 10:12:35.128867 sendto(11, "MAIL FROM:<finest09@fin.finestweddingsites.com> SIZE=3458\r\n", 59, 0, NULL, 0 <unfinished ...>
[pid 25443] 10:12:35.128917 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25461] 10:12:35.129015 <... mmap resumed> ) = 0x7f2b2595b000
[pid 25460] 10:12:35.129043 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.129068 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.129102 setgid(12 <unfinished ...>
[pid 25452] 10:12:35.129125 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25449] 10:12:35.129218 <... sendto resumed> ) = 59
[pid 25443] 10:12:35.129241 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25461] 10:12:35.129283 close(6 <unfinished ...>
[pid 25460] 10:12:35.129307 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.129331 <... open resumed> ) = 6
[pid 25457] 10:12:35.129347 <... setgid resumed> ) = 0
[pid 25452] 10:12:35.129391 read(14,  <unfinished ...>
[pid 25449] 10:12:35.129419 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.129448 <... socket resumed> ) = 16
[pid 25461] 10:12:35.129610 <... close resumed> ) = 0
[pid 25460] 10:12:35.129646 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.129681 read(6,  <unfinished ...>
[pid 25457] 10:12:35.129705 read(6,  <unfinished ...>
[pid 25452] 10:12:35.129733 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25443] 10:12:35.129825 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25461] 10:12:35.129872 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.129911 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.129941 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.129965 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25452] 10:12:35.130028 read(14,  <unfinished ...>
[pid 25443] 10:12:35.130054 <... connect resumed> ) = 0
[pid 25461] 10:12:35.130084 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.130103 <... mmap resumed> ) = 0x7f9082b7c000
[pid 25458] 10:12:35.130120 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.130143 read(6,  <unfinished ...>
[pid 25452] 10:12:35.130167 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25443] 10:12:35.130252 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25461] 10:12:35.130293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.130326 mprotect(0x7f9082b83000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.130354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.130388 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25452] 10:12:35.130457 read(14,  <unfinished ...>
[pid 25443] 10:12:35.130489 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25461] 10:12:35.130520 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.130538 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.130554 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.130586 read(6,  <unfinished ...>
[pid 25452] 10:12:35.130610 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25443] 10:12:35.130759 sendto(16, "\243q\1\0\0\1\0\0\0\0\0\0\10radisson\3com\0\0\17\0\1", 30, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25461] 10:12:35.130832 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.130866 mmap(0x7f9082d83000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25458] 10:12:35.130897 <... mmap resumed> ) = 0x7f03f16cb000
[pid 25457] 10:12:35.130914 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25452] 10:12:35.130979 read(14,  <unfinished ...>
[pid 25443] 10:12:35.131006 <... sendto resumed> ) = 30
[pid 25461] 10:12:35.131032 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.131052 <... mmap resumed> ) = 0x7f9082d83000
[pid 25458] 10:12:35.131075 mprotect(0x7f03f170c000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.131103 read(6,  <unfinished ...>
[pid 25452] 10:12:35.131128 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25443] 10:12:35.131217 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25461] 10:12:35.131240 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.131258 mmap(0x7f9082d85000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.131274 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.131282 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25452] 10:12:35.131331 read(14,  <unfinished ...>
[pid 25461] 10:12:35.131350 <... open resumed> ) = 6
[pid 25460] 10:12:35.131358 <... mmap resumed> ) = 0x7f9082d85000
[pid 25458] 10:12:35.131371 mmap(0x7f03f190c000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25457] 10:12:35.131386 read(6,  <unfinished ...>
[pid 25452] 10:12:35.131396 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25461] 10:12:35.131642 read(6,  <unfinished ...>
[pid 25460] 10:12:35.131676 close(6 <unfinished ...>
[pid 25458] 10:12:35.131700 <... mmap resumed> ) = 0x7f03f190c000
[pid 25457] 10:12:35.131726 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25452] 10:12:35.131807 read(14,  <unfinished ...>
[pid 25461] 10:12:35.131844 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.131868 <... close resumed> ) = 0
[pid 25458] 10:12:35.131890 close(6 <unfinished ...>
[pid 25457] 10:12:35.131914 read(6,  <unfinished ...>
[pid 25452] 10:12:35.131938 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25461] 10:12:35.132061 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.132089 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.132126 <... close resumed> ) = 0
[pid 25457] 10:12:35.132151 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25452] 10:12:35.132245 read(14,  <unfinished ...>
[pid 25461] 10:12:35.132283 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.132317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.132336 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.132366 read(6,  <unfinished ...>
[pid 25452] 10:12:35.132390 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25461] 10:12:35.132470 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.132594 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.132630 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.132648 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25452] 10:12:35.132706 read(14,  <unfinished ...>
[pid 25461] 10:12:35.132743 <... mmap resumed> ) = 0x7f2b29353000
[pid 25460] 10:12:35.132764 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.132782 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.132815 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.132843 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25461] 10:12:35.132928 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.132964 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.132994 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.133012 <... open resumed> ) = 8
[pid 25452] 10:12:35.133029 read(14,  <unfinished ...>
[pid 25461] 10:12:35.133059 <... mmap resumed> ) = 0x7f2b2551a000
[pid 25460] 10:12:35.133076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.133094 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.133124 fstat(8,  <unfinished ...>
[pid 25452] 10:12:35.133147 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.133185 mprotect(0x7f2b2552f000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.133215 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.133246 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.133264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25452] 10:12:35.133300 close(14 <unfinished ...>
[pid 25461] 10:12:35.133334 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.133350 <... open resumed> ) = 6
[pid 25458] 10:12:35.133365 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.133396 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.133422 <... close resumed> ) = 0
[pid 25461] 10:12:35.133445 mmap(0x7f2b2572e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25460] 10:12:35.133479 read(6,  <unfinished ...>
[pid 25458] 10:12:35.133504 <... open resumed> ) = 6
[pid 25457] 10:12:35.133519 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.133536 munmap(0x7f380d422000, 4096 <unfinished ...>
[pid 25461] 10:12:35.133571 <... mmap resumed> ) = 0x7f2b2572e000
[pid 25460] 10:12:35.133597 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.133623 read(6,  <unfinished ...>
[pid 25457] 10:12:35.133647 read(8,  <unfinished ...>
[pid 25452] 10:12:35.133674 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.134444 close(6 <unfinished ...>
[pid 25460] 10:12:35.134578 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.134609 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.134634 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25452] 10:12:35.134663 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.134710 <... close resumed> ) = 0
[pid 25460] 10:12:35.134748 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.134782 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.134806 close(8 <unfinished ...>
[pid 25452] 10:12:35.134830 <... open resumed> ) = 14
[pid 25461] 10:12:35.134854 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.134885 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.134913 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.134943 <... close resumed> ) = 0
[pid 25452] 10:12:35.134959 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.134989 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.135007 <... mmap resumed> ) = 0x7f90828f8000
[pid 25458] 10:12:35.135030 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.135056 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25452] 10:12:35.135084 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.135121 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.135154 mprotect(0x7f908297b000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.135182 <... mmap resumed> ) = 0x7f03f4bd8000
[pid 25457] 10:12:35.135201 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.135283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.135322 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.135341 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.135358 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.135386 read(6,  <unfinished ...>
[pid 25452] 10:12:35.135410 <... mmap resumed> ) = 0x7f380d422000
[pid 25461] 10:12:35.135435 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.135466 mmap(0x7f9082b7a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25458] 10:12:35.135577 <... mmap resumed> ) = 0x7f03f13e4000
[pid 25457] 10:12:35.135596 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25452] 10:12:35.135678 read(14,  <unfinished ...>
[pid 25461] 10:12:35.135744 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.135764 <... mmap resumed> ) = 0x7f9082b7a000
[pid 25458] 10:12:35.135790 mprotect(0x7f03f14bf000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.135821 read(6,  <unfinished ...>
[pid 25452] 10:12:35.135845 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          253348 kB\nCached:           329836 kB\nBuffers:               0 kB\nActive:           297436 kB\nInactive:         467260 kB\nActive(anon):     165060 kB\nInactive(anon):   277604 kB\nActive(file):     132376 kB\nInac"..., 1024) = 588
[pid 25461] 10:12:35.135884 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.135918 close(6 <unfinished ...>
[pid 25458] 10:12:35.135941 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.135957 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25452] 10:12:35.136059 close(14 <unfinished ...>
[pid 25461] 10:12:35.136097 <... open resumed> ) = 6
[pid 25460] 10:12:35.136114 <... close resumed> ) = 0
[pid 25458] 10:12:35.136137 mmap(0x7f03f16bf000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25457] 10:12:35.136168 read(6,  <unfinished ...>
[pid 25452] 10:12:35.136192 <... close resumed> ) = 0
[pid 25461] 10:12:35.136216 read(6,  <unfinished ...>
[pid 25460] 10:12:35.136240 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.136270 <... mmap resumed> ) = 0x7f03f16bf000
[pid 25457] 10:12:35.136295 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25452] 10:12:35.136427 munmap(0x7f380d422000, 4096 <unfinished ...>
[pid 25461] 10:12:35.136470 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.136567 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.136587 close(6 <unfinished ...>
[pid 25457] 10:12:35.136610 read(6,  <unfinished ...>
[pid 25452] 10:12:35.136634 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.137335 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.137368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.137403 <... close resumed> ) = 0
[pid 25457] 10:12:35.137431 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25452] 10:12:35.137606 alarm(300 <unfinished ...>
[pid 25461] 10:12:35.137648 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25460] 10:12:35.137682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.137701 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.137732 read(6,  <unfinished ...>
[pid 25452] 10:12:35.137757 <... alarm resumed> ) = 0
[pid 25461] 10:12:35.137801 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.137835 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.137866 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.137883 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25452] 10:12:35.137918 brk(0x26bf000 <unfinished ...>
[pid 25461] 10:12:35.137953 <... mmap resumed> ) = 0x7f2b2530f000
[pid 25460] 10:12:35.137970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.137989 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.138021 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25452] 10:12:35.138050 <... brk resumed> ) = 0x26bf000
[pid 25461] 10:12:35.138119 mprotect(0x7f2b25319000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.138152 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.138183 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.138200 <... open resumed> ) = 8
[pid 25452] 10:12:35.138218 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2s\263f\373\252j\4\17R\352\f\302T\03621\225\242\242&\\\226\274 \2403(A\231\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25461] 10:12:35.138287 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.138305 <... open resumed> ) = 6
[pid 25458] 10:12:35.138321 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.138351 fstat(8,  <unfinished ...>
[pid 25452] 10:12:35.138375 <... write resumed> ) = 258
[pid 25461] 10:12:35.138401 mmap(0x7f2b25518000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25460] 10:12:35.138433 read(6,  <unfinished ...>
[pid 25458] 10:12:35.138457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.138479 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25452] 10:12:35.138510 read(11,  <unfinished ...>
[pid 25461] 10:12:35.138540 <... mmap resumed> ) = 0x7f2b25518000
[pid 25460] 10:12:35.138566 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.138591 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.138626 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.138659 close(6 <unfinished ...>
[pid 25460] 10:12:35.138682 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.138704 <... open resumed> ) = 6
[pid 25457] 10:12:35.138720 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25461] 10:12:35.138746 <... close resumed> ) = 0
[pid 25460] 10:12:35.138777 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25458] 10:12:35.138814 read(6,  <unfinished ...>
[pid 25457] 10:12:35.138842 read(8,  <unfinished ...>
[pid 25461] 10:12:35.138876 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.138908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.139047 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.139074 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25461] 10:12:35.139112 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.139136 <... mmap resumed> ) = 0x7f90833f8000
[pid 25458] 10:12:35.139157 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.139180 close(8 <unfinished ...>
[pid 25461] 10:12:35.139211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.139243 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.139271 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.139302 <... close resumed> ) = 0
[pid 25461] 10:12:35.139324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.139341 <... mmap resumed> ) = 0x7f90826ea000
[pid 25458] 10:12:35.139357 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.139387 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25461] 10:12:35.139421 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.139451 mprotect(0x7f90826f6000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.139483 <... mmap resumed> ) = 0x7f03f11e0000
[pid 25457] 10:12:35.139499 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.139533 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.139554 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.139571 mprotect(0x7f03f11e3000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.139599 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.139635 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.139666 mmap(0x7f90828f6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25458] 10:12:35.139696 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.139712 <... open resumed> ) = 8
[pid 25461] 10:12:35.139735 <... open resumed> ) = 6
[pid 25460] 10:12:35.139751 <... mmap resumed> ) = 0x7f90828f6000
[pid 25458] 10:12:35.139775 mmap(0x7f03f13e2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25457] 10:12:35.139807 fstat(8,  <unfinished ...>
[pid 25461] 10:12:35.139836 read(6,  <unfinished ...>
[pid 25460] 10:12:35.139860 close(6 <unfinished ...>
[pid 25458] 10:12:35.139882 <... mmap resumed> ) = 0x7f03f13e2000
[pid 25457] 10:12:35.139906 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.139942 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.139965 <... close resumed> ) = 0
[pid 25458] 10:12:35.139995 close(6 <unfinished ...>
[pid 25457] 10:12:35.140022 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.140054 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.140078 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.140111 <... close resumed> ) = 0
[pid 25457] 10:12:35.140135 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25461] 10:12:35.140159 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.140195 <... open resumed> ) = 6
[pid 25458] 10:12:35.140212 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.140241 read(8,  <unfinished ...>
[pid 25461] 10:12:35.140274 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.140306 read(6,  <unfinished ...>
[pid 25458] 10:12:35.140330 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.140347 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.140384 <... mmap resumed> ) = 0x7f2b2510c000
[pid 25460] 10:12:35.140401 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.140420 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.140437 close(8 <unfinished ...>
[pid 25461] 10:12:35.140454 mprotect(0x7f2b2510e000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.140467 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.140644 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.140665 <... close resumed> ) = 0
[pid 25461] 10:12:35.140688 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.140704 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25458] 10:12:35.140735 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.140766 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25461] 10:12:35.140799 mmap(0x7f2b2530d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25460] 10:12:35.140828 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.140855 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.140874 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.140925 <... mmap resumed> ) = 0x7f2b2530d000
[pid 25460] 10:12:35.140953 <... mmap resumed> ) = 0x7f90824c7000
[pid 25458] 10:12:35.140972 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.141004 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.141037 close(6 <unfinished ...>
[pid 25460] 10:12:35.141060 mprotect(0x7f90824e8000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.141087 <... open resumed> ) = 6
[pid 25457] 10:12:35.141102 <... open resumed> ) = 8
[pid 25461] 10:12:35.141125 <... close resumed> ) = 0
[pid 25460] 10:12:35.141149 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.141166 read(6,  <unfinished ...>
[pid 25457] 10:12:35.141189 fstat(8,  <unfinished ...>
[pid 25461] 10:12:35.141218 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.141244 mmap(0x7f90826e8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25458] 10:12:35.141278 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.141302 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.141337 <... mmap resumed> ) = 0x7f2b29352000
[pid 25460] 10:12:35.141369 <... mmap resumed> ) = 0x7f90826e8000
[pid 25458] 10:12:35.141392 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.141415 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.141447 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.141581 close(6 <unfinished ...>
[pid 25458] 10:12:35.141609 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.141641 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25461] 10:12:35.141664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.141683 <... close resumed> ) = 0
[pid 25458] 10:12:35.141706 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.141736 read(8,  <unfinished ...>
[pid 25461] 10:12:35.141770 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.141803 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.141832 <... mmap resumed> ) = 0x7f03f0fb4000
[pid 25457] 10:12:35.141848 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.141883 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.141901 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.141918 mprotect(0x7f03f0fdd000, 2097152, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.141945 close(8 <unfinished ...>
[pid 25461] 10:12:35.141976 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.142006 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.142037 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.142054 <... close resumed> ) = 0
[pid 25461] 10:12:35.142076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.142096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.142113 mmap(0x7f03f11dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25457] 10:12:35.142143 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25461] 10:12:35.142175 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.142205 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.142235 <... mmap resumed> ) = 0x7f03f11dd000
[pid 25457] 10:12:35.142260 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.142359 <... open resumed> ) = 6
[pid 25460] 10:12:35.142381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.142400 mmap(0x7f03f11df000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.142430 read(6,  <unfinished ...>
[pid 25461] 10:12:35.142460 read(6,  <unfinished ...>
[pid 25460] 10:12:35.142561 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.142599 <... mmap resumed> ) = 0x7f03f11df000
[pid 25457] 10:12:35.142626 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25461] 10:12:35.142749 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.142777 <... open resumed> ) = 6
[pid 25458] 10:12:35.142793 close(6 <unfinished ...>
[pid 25457] 10:12:35.142816 read(6,  <unfinished ...>
[pid 25461] 10:12:35.142846 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.142869 read(6,  <unfinished ...>
[pid 25458] 10:12:35.142892 <... close resumed> ) = 0
[pid 25457] 10:12:35.142918 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25461] 10:12:35.143007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.143044 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.143068 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.143099 read(6,  <unfinished ...>
[pid 25461] 10:12:35.143128 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25460] 10:12:35.143159 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.143182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.143199 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.143223 <... mmap resumed> ) = 0x7f2b24eed000
[pid 25460] 10:12:35.143240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.143269 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.143307 read(6,  <unfinished ...>
[pid 25461] 10:12:35.143337 mprotect(0x7f2b24f0a000, 2093056, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.143365 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.143392 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.143409 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.143435 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.143452 <... mmap resumed> ) = 0x7f90822aa000
[pid 25458] 10:12:35.143468 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.143503 close(6 <unfinished ...>
[pid 25461] 10:12:35.143534 mmap(0x7f2b25109000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25460] 10:12:35.143565 mprotect(0x7f90822c1000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.143591 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.143610 <... close resumed> ) = 0
[pid 25461] 10:12:35.143633 <... mmap resumed> ) = 0x7f2b25109000
[pid 25460] 10:12:35.143656 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.143672 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.143704 munmap(0x7f293c0ec000, 4096 <unfinished ...>
[pid 25461] 10:12:35.143737 mmap(0x7f2b2510b000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.143770 mmap(0x7f90824c1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25458] 10:12:35.143802 <... open resumed> ) = 6
[pid 25457] 10:12:35.143819 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.143860 <... mmap resumed> ) = 0x7f2b2510b000
[pid 25460] 10:12:35.143886 <... mmap resumed> ) = 0x7f90824c1000
[pid 25458] 10:12:35.143908 read(6,  <unfinished ...>
[pid 25457] 10:12:35.143932 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f293afa2790},  <unfinished ...>
[pid 25461] 10:12:35.143967 close(6 <unfinished ...>
[pid 25460] 10:12:35.143990 mmap(0x7f90824c3000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.144018 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.144041 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.144069 <... close resumed> ) = 0
[pid 25460] 10:12:35.144116 <... mmap resumed> ) = 0x7f90824c3000
[pid 25458] 10:12:35.144131 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.144142 open("/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25461] 10:12:35.144173 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.144185 close(6 <unfinished ...>
[pid 25458] 10:12:35.144194 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.144215 <... open resumed> ) = 6
[pid 25461] 10:12:35.144229 <... mmap resumed> ) = 0x7f2b29351000
[pid 25460] 10:12:35.144276 <... close resumed> ) = 0
[pid 25458] 10:12:35.144291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.144302 fcntl(6, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.144320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.144330 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.144346 <... mmap resumed> ) = 0x7f03f4bd7000
[pid 25457] 10:12:35.144357 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.144371 <... mmap resumed> ) = 0x7f2b29350000
[pid 25460] 10:12:35.144387 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.144397 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.144412 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.144428 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.144438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.144455 <... mmap resumed> ) = 0x7f03f0d9e000
[pid 25457] 10:12:35.144463 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.144687 <... mmap resumed> ) = 0x7f2b2934e000
[pid 25460] 10:12:35.144717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.144736 mprotect(0x7f03f0db3000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.144765 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25461] 10:12:35.144802 arch_prctl(ARCH_SET_FS, 0x7f2b2934e7c0 <unfinished ...>
[pid 25460] 10:12:35.144826 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.144856 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.144872 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.144894 <... arch_prctl resumed> ) = 0
[pid 25460] 10:12:35.144948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.144970 mmap(0x7f03f0fb2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25457] 10:12:35.145000 fstat(6,  <unfinished ...>
[pid 25461] 10:12:35.145030 mprotect(0x7f2b25109000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.145055 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.145084 <... mmap resumed> ) = 0x7f03f0fb2000
[pid 25457] 10:12:35.145109 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800000, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4059, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25461] 10:12:35.145179 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.145213 <... open resumed> ) = 6
[pid 25458] 10:12:35.145242 close(6 <unfinished ...>
[pid 25457] 10:12:35.145277 open("/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-H", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.145338 mprotect(0x7f2b2530d000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.145367 read(6,  <unfinished ...>
[pid 25458] 10:12:35.145392 <... close resumed> ) = 0
[pid 25457] 10:12:35.145425 <... open resumed> ) = 8
[pid 25461] 10:12:35.145451 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.145548 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.145580 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.145612 fstat(8,  <unfinished ...>
[pid 25461] 10:12:35.145642 mprotect(0x7f2b25518000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.145669 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.145692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.145710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800010, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=976, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25461] 10:12:35.145753 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.145779 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.145809 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.145841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.145874 mprotect(0x7f2b2572e000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.145900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.145925 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.145942 <... mmap resumed> ) = 0x7f293c0ec000
[pid 25461] 10:12:35.145964 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.145994 <... mmap resumed> ) = 0x7f90833f7000
[pid 25458] 10:12:35.146015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.146046 read(8,  <unfinished ...>
[pid 25461] 10:12:35.146079 mprotect(0x7f2b25959000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.146105 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.146132 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.146151 <... read resumed> "1aEJMY-0006cP-Ry-H\nmailnull 47 12\n<>\n1451491954 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 976
[pid 25461] 10:12:35.146213 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.146242 <... mmap resumed> ) = 0x7f9081f36000
[pid 25458] 10:12:35.146260 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.146292 read(8,  <unfinished ...>
[pid 25461] 10:12:35.146321 mprotect(0x7f2b25b5e000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.146347 mprotect(0x7f90820a5000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.146373 <... open resumed> ) = 6
[pid 25457] 10:12:35.146389 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.146413 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.146613 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.146636 read(6,  <unfinished ...>
[pid 25457] 10:12:35.146661 close(8 <unfinished ...>
[pid 25461] 10:12:35.146692 mprotect(0x7f2b25e3b000, 40960, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.146719 mmap(0x7f90822a4000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25458] 10:12:35.146749 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.146774 <... close resumed> ) = 0
[pid 25461] 10:12:35.146796 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.146893 <... mmap resumed> ) = 0x7f90822a4000
[pid 25458] 10:12:35.146921 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.146946 munmap(0x7f293c0ec000, 4096 <unfinished ...>
[pid 25461] 10:12:35.146984 mprotect(0x7f2b26088000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.147011 close(6 <unfinished ...>
[pid 25458] 10:12:35.147034 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25457] 10:12:35.147066 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.147092 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.147121 <... close resumed> ) = 0
[pid 25458] 10:12:35.147146 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.147177 open("/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-J", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.147222 mprotect(0x7f2b262a2000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.147249 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.147279 <... mmap resumed> ) = 0x7f03f0b93000
[pid 25457] 10:12:35.147295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.147323 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.147344 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.147362 mprotect(0x7f03f0b9d000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.147390 open("/var/spool/exim/msglog/Y/1aEJMY-0006cP-Ry", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25461] 10:12:35.147431 mprotect(0x7f2b264af000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.147460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.147578 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.147597 <... open resumed> ) = 8
[pid 25461] 10:12:35.147620 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.147813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.147834 mmap(0x7f03f0d9c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25457] 10:12:35.147865 fcntl(8, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.147894 mprotect(0x7f2b26c9b000, 110592, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.147920 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.147950 <... mmap resumed> ) = 0x7f03f0d9c000
[pid 25457] 10:12:35.147974 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.147999 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.148075 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.148097 close(6 <unfinished ...>
[pid 25457] 10:12:35.148120 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.148150 mprotect(0x7f2b26f27000, 16384, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.148175 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.148208 <... close resumed> ) = 0
[pid 25457] 10:12:35.148233 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.148261 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.148359 <... open resumed> ) = 6
[pid 25458] 10:12:35.148378 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.148408 fchown(8, 47, 12 <unfinished ...>
[pid 25461] 10:12:35.148446 mprotect(0x7f2b272bc000, 16384, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.148472 read(6,  <unfinished ...>
[pid 25458] 10:12:35.148500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.148517 <... fchown resumed> ) = 0
[pid 25461] 10:12:35.148541 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.148562 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.148592 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.148624 fchmod(8, 0640 <unfinished ...>
[pid 25461] 10:12:35.148658 mprotect(0x7f2b274c7000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.148685 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.148708 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.148725 <... fchmod resumed> ) = 0
[pid 25461] 10:12:35.148751 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.148776 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25458] 10:12:35.148808 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.148837 fcntl(8, F_GETFL <unfinished ...>
[pid 25461] 10:12:35.148868 mprotect(0x7f2b276cb000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.148894 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.148921 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.148939 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25461] 10:12:35.148964 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.149687 <... mmap resumed> ) = 0x7f9081ca7000
[pid 25458] 10:12:35.149715 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.149749 fstat(8,  <unfinished ...>
[pid 25461] 10:12:35.149779 mprotect(0x7f2b28423000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.149806 mprotect(0x7f9081d32000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.149834 <... open resumed> ) = 6
[pid 25457] 10:12:35.149850 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800030, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.149887 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.149926 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.149944 read(6,  <unfinished ...>
[pid 25457] 10:12:35.149967 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.150000 mprotect(0x7f2b28858000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.150026 mmap(0x7f9081f32000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25458] 10:12:35.150056 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25457] 10:12:35.150079 <... mmap resumed> ) = 0x7f293c0ec000
[pid 25461] 10:12:35.150102 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.150123 <... mmap resumed> ) = 0x7f9081f32000
[pid 25458] 10:12:35.150144 fstat(6,  <unfinished ...>
[pid 25457] 10:12:35.150168 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25461] 10:12:35.150197 mprotect(0x7f2b28adc000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.150223 mmap(0x7f9081f35000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.150257 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25457] 10:12:35.150289 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.150319 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.150346 <... mmap resumed> ) = 0x7f9081f35000
[pid 25458] 10:12:35.150368 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25457] 10:12:35.150402 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25461] 10:12:35.150436 mprotect(0x7f2b28ce5000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.150462 close(6 <unfinished ...>
[pid 25458] 10:12:35.150561 <... mmap resumed> ) = 0x7f03f0990000
[pid 25457] 10:12:35.150579 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25461] 10:12:35.150619 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.150652 <... close resumed> ) = 0
[pid 25458] 10:12:35.150676 mprotect(0x7f03f0992000, 2093056, PROT_NONE <unfinished ...>
[pid 25457] 10:12:35.150705 pipe( <unfinished ...>
[pid 25461] 10:12:35.150738 mprotect(0x7f2b28f2a000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.150765 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.150795 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.150811 <... pipe resumed> [9, 10]) = 0
[pid 25461] 10:12:35.150834 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.150858 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.150877 mmap(0x7f03f0b91000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25457] 10:12:35.150907 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25461] 10:12:35.150940 mprotect(0x7f2b29144000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.150966 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.150999 <... mmap resumed> ) = 0x7f03f0b91000
[pid 25457] 10:12:35.151023 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f293afa2790}, 8) = 0
[pid 25461] 10:12:35.151054 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.151096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.151115 close(6 <unfinished ...>
[pid 25457] 10:12:35.151138 clone( <unfinished ...>
[pid 25461] 10:12:35.151370 mprotect(0x7f2b29367000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.151398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.151429 <... close resumed> ) = 0
[pid 25461] 10:12:35.151459 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.151538 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.151564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.151592 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f293c0d5a90) = 25464
[pid 25461] 10:12:35.151639 munmap(0x7f2b2935c000, 39387 <unfinished ...>
[pid 25460] 10:12:35.151673 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.151705 <... mmap resumed> ) = 0x7f03f4bd6000
[pid 25457] 10:12:35.151737 close(10 <unfinished ...>
[pid 25461] 10:12:35.151768 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.151785 <... open resumed> ) = 6
[pid 25458] 10:12:35.151801 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.151830 <... close resumed> ) = 0
[pid 25461] 10:12:35.151854 set_tid_address(0x7f2b2934ea90 <unfinished ...>
[pid 25460] 10:12:35.151883 read(6,  <unfinished ...>
[pid 25458] 10:12:35.151907 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.151924 read(9,  <unfinished ...>
[pid 25461] 10:12:35.151951 <... set_tid_address resumed> ) = 25461
[pid 25460] 10:12:35.151966 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.151989 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.152026 set_robust_list(0x7f2b2934eaa0, 24 <unfinished ...>
[pid 25460] 10:12:35.152049 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.152072 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.152093 <... set_robust_list resumed> ) = 0
[pid 25460] 10:12:35.152109 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25458] 10:12:35.152139 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.152173 futex(0x7ffc6a26608c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25460] 10:12:35.152198 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.152226 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.152249 <... futex resumed> ) = 0
[pid 25460] 10:12:35.152265 <... mmap resumed> ) = 0x7f9081aa1000
[pid 25458] 10:12:35.152281 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.152317 futex(0x7ffc6a26608c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f2b2934e7c0 <unfinished ...>
[pid 25460] 10:12:35.152342 mprotect(0x7f9081aa7000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.152368 <... open resumed> ) = 6
[pid 25461] 10:12:35.152389 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25460] 10:12:35.152411 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.152427 read(6,  <unfinished ...>
[pid 25461] 10:12:35.152455 rt_sigaction(SIGRTMIN, {0x7f2b28211c60, [], SA_RESTORER|SA_SIGINFO, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.152560 mmap(0x7f9081ca6000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25458] 10:12:35.152593 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25461] 10:12:35.152623 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.152640 <... mmap resumed> ) = 0x7f9081ca6000
[pid 25458] 10:12:35.152660 fstat(6,  <unfinished ...>
[pid 25461] 10:12:35.152689 rt_sigaction(SIGRT_1, {0x7f2b28211cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.152716 close(6 <unfinished ...>
[pid 25458] 10:12:35.152739 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25461] 10:12:35.152779 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.152797 <... close resumed> ) = 0
[pid 25458] 10:12:35.152818 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25461] 10:12:35.152854 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25460] 10:12:35.152880 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.152909 <... mmap resumed> ) = 0x7f03f0771000
[pid 25461] 10:12:35.152930 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25460] 10:12:35.152956 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.152975 mprotect(0x7f03f078e000, 2093056, PROT_NONE <unfinished ...>
[pid 25461] 10:12:35.153008 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25460] 10:12:35.153031 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.153065 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.153086 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25460] 10:12:35.153140 <... open resumed> ) = 6
[pid 25458] 10:12:35.153158 mmap(0x7f03f098d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25461] 10:12:35.153193 statfs("/selinux",  <unfinished ...>
[pid 25460] 10:12:35.153227 read(6,  <unfinished ...>
[pid 25458] 10:12:35.153250 <... mmap resumed> ) = 0x7f03f098d000
[pid 25461] 10:12:35.153275 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350348, f_bavail=6350348, f_files=1000000, f_ffree=691108, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25460] 10:12:35.153342 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.153374 mmap(0x7f03f098f000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.153416 brk(0 <unfinished ...>
[pid 25460] 10:12:35.153440 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.153463 <... mmap resumed> ) = 0x7f03f098f000
[pid 25461] 10:12:35.153592 <... brk resumed> ) = 0x131a000
[pid 25460] 10:12:35.153617 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.153649 close(6 <unfinished ...>
[pid 25461] 10:12:35.153677 brk(0x133b000 <unfinished ...>
[pid 25460] 10:12:35.153701 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.153727 <... close resumed> ) = 0
[pid 25461] 10:12:35.153782 <... brk resumed> ) = 0x133b000
[pid 25460] 10:12:35.153810 <... mmap resumed> ) = 0x7f90833f6000
[pid 25458] 10:12:35.153830 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.153861 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.153950 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.153980 <... mmap resumed> ) = 0x7f03f4bd5000
[pid 25461] 10:12:35.154037 <... open resumed> ) = 6
[pid 25460] 10:12:35.154067 <... mmap resumed> ) = 0x7f908176b000
[pid 25458] 10:12:35.154090 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.154121 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.154144 mprotect(0x7f9081897000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.154171 <... mmap resumed> ) = 0x7f03f4bd4000
[pid 25461] 10:12:35.154200 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.154232 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.154249 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.154278 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.154303 mmap(0x7f9081a97000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25458] 10:12:35.154332 <... mmap resumed> ) = 0x7f03f4bd2000
[pid 25461] 10:12:35.154358 <... mmap resumed> ) = 0x7f2b29365000
[pid 25460] 10:12:35.154375 <... mmap resumed> ) = 0x7f9081a97000
[pid 25458] 10:12:35.154395 arch_prctl(ARCH_SET_FS, 0x7f03f4bd27c0 <unfinished ...>
[pid 25461] 10:12:35.154423 read(6,  <unfinished ...>
[pid 25460] 10:12:35.154517 mmap(0x7f9081aa0000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.154546 <... arch_prctl resumed> ) = 0
[pid 25461] 10:12:35.154599 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25460] 10:12:35.154629 <... mmap resumed> ) = 0x7f9081aa0000
[pid 25458] 10:12:35.154652 mprotect(0x7f03f098d000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.154685 read(6,  <unfinished ...>
[pid 25460] 10:12:35.154707 close(6 <unfinished ...>
[pid 25458] 10:12:35.154730 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.154754 <... read resumed> "", 1024) = 0
[pid 25460] 10:12:35.154777 <... close resumed> ) = 0
[pid 25458] 10:12:35.154800 mprotect(0x7f03f0b91000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.154833 close(6 <unfinished ...>
[pid 25460] 10:12:35.154859 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.154890 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.154923 <... close resumed> ) = 0
[pid 25460] 10:12:35.154941 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.154958 mprotect(0x7f03f0d9c000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.154988 munmap(0x7f2b29365000, 4096 <unfinished ...>
[pid 25460] 10:12:35.155015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.155047 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.155075 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.155138 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.155159 mprotect(0x7f03f0fb2000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.155190 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25460] 10:12:35.155223 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.155253 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.155285 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.155363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.155385 mprotect(0x7f03f11dd000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.155417 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.155444 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.155587 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.155630 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.155664 <... open resumed> ) = 6
[pid 25458] 10:12:35.155683 mprotect(0x7f03f13e2000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.155718 fstat(2,  <unfinished ...>
[pid 25460] 10:12:35.155742 read(6,  <unfinished ...>
[pid 25458] 10:12:35.155765 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.155874 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25460] 10:12:35.155939 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.155967 mprotect(0x7f03f16bf000, 40960, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.155998 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.156025 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.156048 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.156137 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.156160 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.156192 mprotect(0x7f03f190c000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.156222 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.156249 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.156278 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.156310 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25460] 10:12:35.156331 <... mmap resumed> ) = 0x7f9081567000
[pid 25458] 10:12:35.156347 mprotect(0x7f03f1b26000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.156377 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.156403 mprotect(0x7f9081569000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.156430 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.156455 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25460] 10:12:35.156474 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.156494 mprotect(0x7f03f1d33000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.156525 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.156550 mmap(0x7f9081769000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25458] 10:12:35.156580 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.156762 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.156792 <... mmap resumed> ) = 0x7f9081769000
[pid 25458] 10:12:35.156819 mprotect(0x7f03f251f000, 110592, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.156853 umask(0 <unfinished ...>
[pid 25460] 10:12:35.156875 close(6 <unfinished ...>
[pid 25458] 10:12:35.156898 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.156971 <... umask resumed> ) = 0
[pid 25460] 10:12:35.157025 <... close resumed> ) = 0
[pid 25458] 10:12:35.157049 mprotect(0x7f03f27ab000, 16384, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.157081 geteuid( <unfinished ...>
[pid 25460] 10:12:35.157103 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.157134 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.157224 <... geteuid resumed> ) = 0
[pid 25460] 10:12:35.157247 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.157265 mprotect(0x7f03f2b40000, 16384, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.157296 getuid( <unfinished ...>
[pid 25460] 10:12:35.157320 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.157353 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.157378 <... getuid resumed> ) = 47
[pid 25460] 10:12:35.157397 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.157414 mprotect(0x7f03f2d4b000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.157444 getgid( <unfinished ...>
[pid 25460] 10:12:35.157466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.157639 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.157674 <... getgid resumed> ) = 12
[pid 25460] 10:12:35.157743 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.157766 mprotect(0x7f03f2f4f000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.157798 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25460] 10:12:35.157821 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.157853 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.158379 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25460] 10:12:35.158403 <... open resumed> ) = 6
[pid 25458] 10:12:35.158420 mprotect(0x7f03f3ca7000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.158451 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25460] 10:12:35.158474 read(6,  <unfinished ...>
[pid 25458] 10:12:35.158502 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.158539 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25460] 10:12:35.158561 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.158585 mprotect(0x7f03f40dc000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.158616 getgroups(65536,  <unfinished ...>
[pid 25460] 10:12:35.158639 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.158664 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.158689 <... getgroups resumed> []) = 0
[pid 25460] 10:12:35.158710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.158742 mprotect(0x7f03f4360000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.158773 setgroups(0, [] <unfinished ...>
[pid 25460] 10:12:35.158797 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.158826 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.158851 <... setgroups resumed> ) = 0
[pid 25460] 10:12:35.158871 <... mmap resumed> ) = 0x7f9081364000
[pid 25458] 10:12:35.158888 mprotect(0x7f03f4569000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.158917 getegid( <unfinished ...>
[pid 25460] 10:12:35.158939 mprotect(0x7f9081366000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.158966 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.159000 <... getegid resumed> ) = 12
[pid 25460] 10:12:35.159017 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.159033 mprotect(0x7f03f47ae000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.159063 geteuid( <unfinished ...>
[pid 25460] 10:12:35.159093 mmap(0x7f9081565000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25458] 10:12:35.159122 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.159150 <... geteuid resumed> ) = 0
[pid 25460] 10:12:35.159174 <... mmap resumed> ) = 0x7f9081565000
[pid 25458] 10:12:35.159198 mprotect(0x7f03f49c8000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.159230 geteuid( <unfinished ...>
[pid 25460] 10:12:35.159252 close(6 <unfinished ...>
[pid 25458] 10:12:35.159274 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.159317 <... geteuid resumed> ) = 0
[pid 25460] 10:12:35.159335 <... close resumed> ) = 0
[pid 25458] 10:12:35.159357 mprotect(0x7f03f4beb000, 4096, PROT_READ <unfinished ...>
[pid 25461] 10:12:35.159388 getegid( <unfinished ...>
[pid 25460] 10:12:35.159410 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.159443 <... mprotect resumed> ) = 0
[pid 25461] 10:12:35.159463 <... getegid resumed> ) = 12
[pid 25460] 10:12:35.159594 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.159620 munmap(0x7f03f4be0000, 39387 <unfinished ...>
[pid 25461] 10:12:35.159661 setgid(12 <unfinished ...>
[pid 25460] 10:12:35.159686 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.159718 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.159740 <... setgid resumed> ) = 0
[pid 25460] 10:12:35.159758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.159776 set_tid_address(0x7f03f4bd2a90 <unfinished ...>
[pid 25461] 10:12:35.159803 setuid(0 <unfinished ...>
[pid 25460] 10:12:35.159827 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.159856 <... set_tid_address resumed> ) = 25458
[pid 25461] 10:12:35.159876 <... setuid resumed> ) = 0
[pid 25460] 10:12:35.159917 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.159939 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25461] 10:12:35.159967 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.159996 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.160026 <... set_robust_list resumed> ) = 0
[pid 25461] 10:12:35.160047 <... open resumed> ) = 6
[pid 25460] 10:12:35.160071 <... open resumed> ) = 6
[pid 25458] 10:12:35.160088 futex(0x7ffc7add7d7c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25461] 10:12:35.160117 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.160139 read(6,  <unfinished ...>
[pid 25458] 10:12:35.160162 <... futex resumed> ) = 0
[pid 25461] 10:12:35.160183 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.160216 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.160241 futex(0x7ffc7add7d7c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f03f4bd27c0 <unfinished ...>
[pid 25461] 10:12:35.160270 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.160293 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.160316 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25461] 10:12:35.160343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.160377 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.160406 rt_sigaction(SIGRTMIN, {0x7f03f3a95c60, [], SA_RESTORER|SA_SIGINFO, 0x7f03f3a9f790},  <unfinished ...>
[pid 25461] 10:12:35.160438 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.160465 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.160494 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.160516 <... mmap resumed> ) = 0x7f2b29365000
[pid 25460] 10:12:35.160532 <... mmap resumed> ) = 0x7f90833f5000
[pid 25458] 10:12:35.160551 rt_sigaction(SIGRT_1, {0x7f03f3a95cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f03f3a9f790},  <unfinished ...>
[pid 25461] 10:12:35.160585 read(6,  <unfinished ...>
[pid 25460] 10:12:35.160612 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.160639 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.160660 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25460] 10:12:35.160774 <... mmap resumed> ) = 0x7f9080fd0000
[pid 25458] 10:12:35.160797 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25461] 10:12:35.160829 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25460] 10:12:35.160859 mprotect(0x7f908115a000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.160887 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25461] 10:12:35.160916 <... socket resumed> ) = 7
[pid 25460] 10:12:35.160933 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.160949 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25461] 10:12:35.160976 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25460] 10:12:35.161014 mmap(0x7f908135a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25458] 10:12:35.161046 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25461] 10:12:35.161100 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.161121 <... mmap resumed> ) = 0x7f908135a000
[pid 25458] 10:12:35.161142 statfs("/selinux",  <unfinished ...>
[pid 25461] 10:12:35.161177 close(7 <unfinished ...>
[pid 25460] 10:12:35.161204 mmap(0x7f908135f000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.161232 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350348, f_bavail=6350348, f_files=1000000, f_ffree=691108, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25461] 10:12:35.161298 <... close resumed> ) = 0
[pid 25460] 10:12:35.161308 <... mmap resumed> ) = 0x7f908135f000
[pid 25458] 10:12:35.161322 brk(0 <unfinished ...>
[pid 25461] 10:12:35.161335 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25460] 10:12:35.161347 close(6 <unfinished ...>
[pid 25458] 10:12:35.161356 <... brk resumed> ) = 0x1436000
[pid 25461] 10:12:35.161368 <... socket resumed> ) = 7
[pid 25460] 10:12:35.161376 <... close resumed> ) = 0
[pid 25458] 10:12:35.161391 brk(0x1457000 <unfinished ...>
[pid 25461] 10:12:35.161406 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25460] 10:12:35.161423 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.161439 <... brk resumed> ) = 0x1457000
[pid 25461] 10:12:35.161461 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.161470 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.161665 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.161711 close(7 <unfinished ...>
[pid 25460] 10:12:35.161740 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.161773 <... open resumed> ) = 6
[pid 25461] 10:12:35.161804 <... close resumed> ) = 0
[pid 25460] 10:12:35.161828 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.161847 fstat(6,  <unfinished ...>
[pid 25461] 10:12:35.161875 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.161904 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.161934 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.161969 <... open resumed> ) = 7
[pid 25460] 10:12:35.161988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.162007 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.162039 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.162062 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.162092 <... mmap resumed> ) = 0x7f03f4be9000
[pid 25461] 10:12:35.162113 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25460] 10:12:35.162143 <... open resumed> ) = 6
[pid 25458] 10:12:35.162158 read(6,  <unfinished ...>
[pid 25461] 10:12:35.162206 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.162232 read(6,  <unfinished ...>
[pid 25458] 10:12:35.162255 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25461] 10:12:35.162288 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.162306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.162329 read(6,  <unfinished ...>
[pid 25461] 10:12:35.162356 read(7,  <unfinished ...>
[pid 25460] 10:12:35.162383 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.162405 <... read resumed> "", 1024) = 0
[pid 25461] 10:12:35.162432 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25460] 10:12:35.162469 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25458] 10:12:35.162507 close(6 <unfinished ...>
[pid 25461] 10:12:35.162548 read(7,  <unfinished ...>
[pid 25460] 10:12:35.162573 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.162600 <... close resumed> ) = 0
[pid 25461] 10:12:35.162621 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.162639 <... mmap resumed> ) = 0x7f9080d64000
[pid 25458] 10:12:35.162655 munmap(0x7f03f4be9000, 4096 <unfinished ...>
[pid 25461] 10:12:35.162689 close(7 <unfinished ...>
[pid 25460] 10:12:35.162713 mprotect(0x7f9080dc6000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.162740 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.162803 <... close resumed> ) = 0
[pid 25460] 10:12:35.162823 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.162839 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25461] 10:12:35.162874 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.162901 mmap(0x7f9080fc5000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25458] 10:12:35.162929 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.163006 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.163037 <... mmap resumed> ) = 0x7f9080fc5000
[pid 25458] 10:12:35.163064 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f03f3a9f790},  <unfinished ...>
[pid 25461] 10:12:35.163099 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.163130 close(6 <unfinished ...>
[pid 25458] 10:12:35.163152 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.163181 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.163200 <... close resumed> ) = 0
[pid 25458] 10:12:35.163226 fstat(2,  <unfinished ...>
[pid 25461] 10:12:35.163255 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.163287 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.163315 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25461] 10:12:35.163378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.163388 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.163397 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f03f3a9f790},  <unfinished ...>
[pid 25461] 10:12:35.163414 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.163430 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.163446 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.163461 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.163471 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.163648 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25461] 10:12:35.163688 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.163717 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.163748 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25461] 10:12:35.163772 <... open resumed> ) = 7
[pid 25460] 10:12:35.163789 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.163808 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25461] 10:12:35.163839 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.163862 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.163893 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25461] 10:12:35.163921 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25460] 10:12:35.163951 <... open resumed> ) = 6
[pid 25458] 10:12:35.163967 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f03f3a9f790},  <unfinished ...>
[pid 25461] 10:12:35.163998 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25460] 10:12:35.164024 read(6,  <unfinished ...>
[pid 25458] 10:12:35.164047 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25461] 10:12:35.164078 <... mmap resumed> ) = 0x7f2b29344000
[pid 25460] 10:12:35.164096 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.164119 umask(0 <unfinished ...>
[pid 25461] 10:12:35.164146 close(7 <unfinished ...>
[pid 25460] 10:12:35.164169 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.164191 <... umask resumed> ) = 0
[pid 25461] 10:12:35.164243 <... close resumed> ) = 0
[pid 25460] 10:12:35.164271 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25458] 10:12:35.164302 geteuid( <unfinished ...>
[pid 25461] 10:12:35.164330 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.164361 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.164389 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.164412 <... open resumed> ) = 7
[pid 25460] 10:12:35.164429 <... mmap resumed> ) = 0x7f9080981000
[pid 25458] 10:12:35.164445 getuid( <unfinished ...>
[pid 25461] 10:12:35.164472 read(7,  <unfinished ...>
[pid 25460] 10:12:35.164499 mprotect(0x7f9080b3a000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.164527 <... getuid resumed> ) = 47
[pid 25461] 10:12:35.164551 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.164575 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.164591 getgid( <unfinished ...>
[pid 25461] 10:12:35.164618 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.164641 mmap(0x7f9080d39000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25458] 10:12:35.164671 <... getgid resumed> ) = 12
[pid 25461] 10:12:35.164714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.164749 <... mmap resumed> ) = 0x7f9080d39000
[pid 25458] 10:12:35.164770 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25461] 10:12:35.164799 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25460] 10:12:35.164834 mmap(0x7f9080d60000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.164862 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25461] 10:12:35.164886 <... mmap resumed> ) = 0x7f2b24cdf000
[pid 25460] 10:12:35.164903 <... mmap resumed> ) = 0x7f9080d60000
[pid 25458] 10:12:35.164924 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25461] 10:12:35.164953 mprotect(0x7f2b24ceb000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.164980 close(6 <unfinished ...>
[pid 25458] 10:12:35.165002 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25461] 10:12:35.165027 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.165044 <... close resumed> ) = 0
[pid 25458] 10:12:35.165067 getgroups(65536,  <unfinished ...>
[pid 25461] 10:12:35.165096 mmap(0x7f2b24eeb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25460] 10:12:35.165124 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.165155 <... getgroups resumed> [12]) = 1
[pid 25461] 10:12:35.165182 <... mmap resumed> ) = 0x7f2b24eeb000
[pid 25460] 10:12:35.165207 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.165226 setgroups(0, [] <unfinished ...>
[pid 25461] 10:12:35.165255 close(7 <unfinished ...>
[pid 25460] 10:12:35.165278 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.165306 <... setgroups resumed> ) = 0
[pid 25461] 10:12:35.165323 <... close resumed> ) = 0
[pid 25460] 10:12:35.165349 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.165359 getegid( <unfinished ...>
[pid 25461] 10:12:35.165372 mprotect(0x7f2b24eeb000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.165384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.165400 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.165413 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.165424 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.165435 geteuid( <unfinished ...>
[pid 25461] 10:12:35.165447 munmap(0x7f2b29344000, 39387 <unfinished ...>
[pid 25460] 10:12:35.165461 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.165656 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.165686 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.165712 <... open resumed> ) = 6
[pid 25458] 10:12:35.165729 geteuid( <unfinished ...>
[pid 25461] 10:12:35.165757 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.165786 read(6,  <unfinished ...>
[pid 25458] 10:12:35.165809 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.165829 <... open resumed> ) = 7
[pid 25460] 10:12:35.165850 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.165874 getegid( <unfinished ...>
[pid 25461] 10:12:35.165901 fcntl(7, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.165923 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.165945 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.165968 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25460] 10:12:35.165989 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25458] 10:12:35.166025 setgid(12 <unfinished ...>
[pid 25461] 10:12:35.166054 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.166076 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.166103 <... setgid resumed> ) = 0
[pid 25461] 10:12:35.166126 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.166155 <... mmap resumed> ) = 0x7f90833f4000
[pid 25458] 10:12:35.166174 setuid(0 <unfinished ...>
[pid 25461] 10:12:35.166203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.166229 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.166256 <... setuid resumed> ) = 0
[pid 25461] 10:12:35.166302 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.166323 <... mmap resumed> ) = 0x7f9080754000
[pid 25458] 10:12:35.166339 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.166373 read(7,  <unfinished ...>
[pid 25460] 10:12:35.166399 mprotect(0x7f9080780000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.166428 <... open resumed> ) = 6
[pid 25461] 10:12:35.166464 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.166509 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.166527 fstat(6,  <unfinished ...>
[pid 25461] 10:12:35.166554 close(7 <unfinished ...>
[pid 25460] 10:12:35.166579 mmap(0x7f9080980000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25458] 10:12:35.166609 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25461] 10:12:35.166647 <... close resumed> ) = 0
[pid 25460] 10:12:35.166667 <... mmap resumed> ) = 0x7f9080980000
[pid 25458] 10:12:35.166689 fstat(6,  <unfinished ...>
[pid 25461] 10:12:35.166718 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.166745 close(6 <unfinished ...>
[pid 25458] 10:12:35.166768 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25461] 10:12:35.166801 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.166835 <... close resumed> ) = 0
[pid 25458] 10:12:35.166861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.166893 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25460] 10:12:35.166921 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.166955 <... mmap resumed> ) = 0x7f03f4be9000
[pid 25461] 10:12:35.166976 <... socket resumed> ) = 7
[pid 25460] 10:12:35.166992 <... open resumed> ) = 6
[pid 25458] 10:12:35.167008 read(6,  <unfinished ...>
[pid 25461] 10:12:35.167038 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25460] 10:12:35.167070 read(6,  <unfinished ...>
[pid 25458] 10:12:35.167094 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25461] 10:12:35.167212 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.167237 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.167261 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25461] 10:12:35.167294 close(7 <unfinished ...>
[pid 25460] 10:12:35.167320 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.167340 <... socket resumed> ) = 7
[pid 25461] 10:12:35.167354 <... close resumed> ) = 0
[pid 25460] 10:12:35.167362 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25458] 10:12:35.167383 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25461] 10:12:35.167404 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25460] 10:12:35.167415 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.167430 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.167444 <... socket resumed> ) = 7
[pid 25460] 10:12:35.167452 <... mmap resumed> ) = 0x7f908054f000
[pid 25458] 10:12:35.167460 close(7 <unfinished ...>
[pid 25461] 10:12:35.167653 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25460] 10:12:35.167694 mprotect(0x7f9080554000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.167723 <... close resumed> ) = 0
[pid 25461] 10:12:35.167744 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.167762 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.167778 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25461] 10:12:35.167809 close(7 <unfinished ...>
[pid 25460] 10:12:35.167834 mmap(0x7f9080753000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25458] 10:12:35.167863 <... socket resumed> ) = 7
[pid 25461] 10:12:35.167884 <... close resumed> ) = 0
[pid 25460] 10:12:35.167905 <... mmap resumed> ) = 0x7f9080753000
[pid 25458] 10:12:35.167927 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25461] 10:12:35.167963 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.167993 close(6 <unfinished ...>
[pid 25458] 10:12:35.168015 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.168036 <... open resumed> ) = 7
[pid 25460] 10:12:35.168053 <... close resumed> ) = 0
[pid 25458] 10:12:35.168079 close(7 <unfinished ...>
[pid 25461] 10:12:35.168110 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.168133 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.168163 <... close resumed> ) = 0
[pid 25461] 10:12:35.168189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25460] 10:12:35.168219 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.168237 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.168269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.168295 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.168331 <... open resumed> ) = 7
[pid 25461] 10:12:35.168355 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.168374 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.168391 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.168418 read(7,  <unfinished ...>
[pid 25460] 10:12:35.168444 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.168539 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25461] 10:12:35.168589 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25460] 10:12:35.168627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.168648 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.168680 close(7 <unfinished ...>
[pid 25460] 10:12:35.168705 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.168734 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25461] 10:12:35.168754 <... close resumed> ) = 0
[pid 25460] 10:12:35.168771 <... open resumed> ) = 6
[pid 25458] 10:12:35.168786 read(7,  <unfinished ...>
[pid 25461] 10:12:35.168817 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.168845 read(6,  <unfinished ...>
[pid 25458] 10:12:35.168868 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25461] 10:12:35.168907 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.168941 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.168966 read(7,  <unfinished ...>
[pid 25461] 10:12:35.168994 read(6,  <unfinished ...>
[pid 25460] 10:12:35.169018 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.169040 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.169061 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25460] 10:12:35.169112 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25458] 10:12:35.169146 close(7 <unfinished ...>
[pid 25461] 10:12:35.169175 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.169203 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.169233 <... close resumed> ) = 0
[pid 25461] 10:12:35.169254 <... open resumed> ) = 7
[pid 25460] 10:12:35.169271 <... mmap resumed> ) = 0x7f908034c000
[pid 25458] 10:12:35.169293 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25461] 10:12:35.169325 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.169348 mprotect(0x7f908034e000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.169375 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.169406 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.169436 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.169453 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.169504 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.169552 mmap(0x7f908054d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25458] 10:12:35.169598 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.169622 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.169639 <... mmap resumed> ) = 0x7f908054d000
[pid 25458] 10:12:35.169663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.169703 read(7,  <unfinished ...>
[pid 25460] 10:12:35.169729 close(6 <unfinished ...>
[pid 25458] 10:12:35.169752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.169773 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.169799 <... close resumed> ) = 0
[pid 25458] 10:12:35.169827 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.169865 close(7 <unfinished ...>
[pid 25460] 10:12:35.169890 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.169919 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.169941 <... close resumed> ) = 0
[pid 25460] 10:12:35.169958 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.169975 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.170007 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.170030 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.170048 <... open resumed> ) = 7
[pid 25461] 10:12:35.170061 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.170076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.170086 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.170099 read(6,  <unfinished ...>
[pid 25460] 10:12:35.170110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.170124 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25461] 10:12:35.170148 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25460] 10:12:35.170176 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.170187 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25461] 10:12:35.170204 uname( <unfinished ...>
[pid 25460] 10:12:35.170213 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.170230 <... mmap resumed> ) = 0x7f03f4bc8000
[pid 25461] 10:12:35.170243 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25460] 10:12:35.170279 <... open resumed> ) = 6
[pid 25458] 10:12:35.170288 close(7 <unfinished ...>
[pid 25461] 10:12:35.170302 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.170314 read(6,  <unfinished ...>
[pid 25458] 10:12:35.170324 <... close resumed> ) = 0
[pid 25461] 10:12:35.170345 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790}, 8) = 0
[pid 25460] 10:12:35.170362 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.170375 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.170395 clone( <unfinished ...>
[pid 25460] 10:12:35.170821 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.170849 <... open resumed> ) = 7
[pid 25460] 10:12:35.170871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25458] 10:12:35.170903 read(7,  <unfinished ...>
[pid 25461] 10:12:35.170932 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2b2934ea90) = 25465
[pid 25460] 10:12:35.170973 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.171003 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25461] 10:12:35.171032 wait4(25465,  <unfinished ...>
[pid 25460] 10:12:35.171054 <... mmap resumed> ) = 0x7f90833f3000
[pid 25458] 10:12:35.171073 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.171100 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.171129 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.171164 <... mmap resumed> ) = 0x7f9080129000
[pid 25458] 10:12:35.171182 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25460] 10:12:35.171214 mprotect(0x7f9080140000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.171241 <... mmap resumed> ) = 0x7f03f0563000
[pid 25460] 10:12:35.171260 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.171276 mprotect(0x7f03f056f000, 2097152, PROT_NONE <unfinished ...>
[pid 25460] 10:12:35.171306 mmap(0x7f9080340000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25458] 10:12:35.171335 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.171360 <... mmap resumed> ) = 0x7f9080340000
[pid 25458] 10:12:35.171386 mmap(0x7f03f076f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25460] 10:12:35.171420 close(6 <unfinished ...>
[pid 25458] 10:12:35.171442 <... mmap resumed> ) = 0x7f03f076f000
[pid 25460] 10:12:35.171469 <... close resumed> ) = 0
[pid 25458] 10:12:35.171513 close(7 <unfinished ...>
[pid 25460] 10:12:35.171542 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.171573 <... close resumed> ) = 0
[pid 25460] 10:12:35.171608 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.171628 mprotect(0x7f03f076f000, 4096, PROT_READ <unfinished ...>
[pid 25460] 10:12:35.171658 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.171690 <... mprotect resumed> ) = 0
[pid 25460] 10:12:35.171713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.171731 munmap(0x7f03f4bc8000, 39387 <unfinished ...>
[pid 25460] 10:12:35.171762 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.171792 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.171819 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.171840 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.171872 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.171903 <... open resumed> ) = 7
[pid 25460] 10:12:35.171927 <... open resumed> ) = 6
[pid 25458] 10:12:35.171944 fcntl(7, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.171970 read(6,  <unfinished ...>
[pid 25458] 10:12:35.171993 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25460] 10:12:35.172016 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.172039 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.172066 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.172088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.172119 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.172145 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.172161 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.172175 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25460] 10:12:35.172187 <... mmap resumed> ) = 0x7f907fee5000
[pid 25458] 10:12:35.172195 read(7,  <unfinished ...>
[pid 25460] 10:12:35.172210 mprotect(0x7f907ff26000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.172223 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.172253 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.172261 close(7 <unfinished ...>
[pid 25460] 10:12:35.172274 mmap(0x7f9080126000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25458] 10:12:35.172288 <... close resumed> ) = 0
[pid 25460] 10:12:35.172299 <... mmap resumed> ) = 0x7f9080126000
[pid 25458] 10:12:35.172483 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25460] 10:12:35.172524 close(6 <unfinished ...>
[pid 25458] 10:12:35.172557 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.172603 <... close resumed> ) = 0
[pid 25458] 10:12:35.172634 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:35.172663 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25460] 10:12:35.172690 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.172721 <... socket resumed> ) = 7
[pid 25433] 10:12:35.172737 recvfrom(16,  <unfinished ...>
[pid 25460] 10:12:35.172767 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.172785 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:35.172817 <... recvfrom resumed> "\275w\201\200\0\1\0\2\0\0\0\0\21hillcrestgolfclub\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\7\7\0\22\0\n\3mx1\temailsrvr\300\36\300\f\0\17\0\1\0\0\7\7\0\10\0\24\3mx2\3009", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 89
[pid 25460] 10:12:35.172853 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.172887 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.172903 close(16 <unfinished ...>
[pid 25460] 10:12:35.172936 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.172953 close(7 <unfinished ...>
[pid 25433] 10:12:35.172978 <... close resumed> ) = 0
[pid 25460] 10:12:35.173023 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.173056 <... close resumed> ) = 0
[pid 25433] 10:12:35.173072 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25460] 10:12:35.173104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.173122 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:35.173148 <... socket resumed> ) = 16
[pid 25460] 10:12:35.173169 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.173200 <... socket resumed> ) = 7
[pid 25433] 10:12:35.173216 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25460] 10:12:35.173252 <... open resumed> ) = 6
[pid 25458] 10:12:35.173267 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:35.173297 <... connect resumed> ) = 0
[pid 25460] 10:12:35.173318 read(6,  <unfinished ...>
[pid 25458] 10:12:35.173342 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.173358 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25460] 10:12:35.173390 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.173414 close(7 <unfinished ...>
[pid 25433] 10:12:35.173439 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25460] 10:12:35.173462 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.173490 <... close resumed> ) = 0
[pid 25433] 10:12:35.173512 sendto(16, "=\326\1\0\0\1\0\0\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25460] 10:12:35.173583 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.173626 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.173658 <... sendto resumed> ) = 35
Process 25464 attached
[pid 25460] 10:12:35.173693 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.173737 <... open resumed> ) = 7
[pid 25433] 10:12:35.173755 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25464] 10:12:35.173789 set_robust_list(0x7f293c0d5aa0, 24 <unfinished ...>
[pid 25460] 10:12:35.173812 <... mmap resumed> ) = 0x7f90833f2000
[pid 25458] 10:12:35.173832 fstat(7,  <unfinished ...>
[pid 25464] 10:12:35.173860 <... set_robust_list resumed> ) = 0
[pid 25460] 10:12:35.173874 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.173955 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25464] 10:12:35.173989 close(9 <unfinished ...>
[pid 25460] 10:12:35.174012 <... mmap resumed> ) = 0x7f907fbfe000
[pid 25458] 10:12:35.174027 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25464] 10:12:35.174057 <... close resumed> ) = 0
[pid 25460] 10:12:35.174071 mprotect(0x7f907fcd9000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.174108 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25464] 10:12:35.174130 geteuid( <unfinished ...>
[pid 25460] 10:12:35.174152 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.174168 read(7,  <unfinished ...>
[pid 25464] 10:12:35.174198 <... geteuid resumed> ) = 0
[pid 25460] 10:12:35.174212 mmap(0x7f907fed9000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25458] 10:12:35.174244 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25464] 10:12:35.174281 getegid( <unfinished ...>
[pid 25460] 10:12:35.174304 <... mmap resumed> ) = 0x7f907fed9000
[pid 25458] 10:12:35.174329 close(7 <unfinished ...>
[pid 25464] 10:12:35.174361 <... getegid resumed> ) = 12
[pid 25460] 10:12:35.174375 close(6 <unfinished ...>
[pid 25458] 10:12:35.174402 <... close resumed> ) = 0
[pid 25464] 10:12:35.174423 setgid(494 <unfinished ...>
[pid 25460] 10:12:35.174446 <... close resumed> ) = 0
[pid 25458] 10:12:35.174471 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25464] 10:12:35.174635 <... setgid resumed> ) = 0
[pid 25460] 10:12:35.174651 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.174685 <... munmap resumed> ) = 0
[pid 25464] 10:12:35.174722 setuid(495 <unfinished ...>
[pid 25460] 10:12:35.174748 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.174767 read(6,  <unfinished ...>
[pid 25464] 10:12:35.174795 <... setuid resumed> ) = 0
[pid 25460] 10:12:35.174808 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.174863 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25464] 10:12:35.174929 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.174962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.174980 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25464] 10:12:35.175012 <... open resumed> ) = 9
[pid 25460] 10:12:35.175026 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.175064 <... open resumed> ) = 7
[pid 25464] 10:12:35.175086 fstat(9,  <unfinished ...>
[pid 25460] 10:12:35.175109 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.175127 fstat(7,  <unfinished ...>
[pid 25464] 10:12:35.175154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.175181 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.175258 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25464] 10:12:35.175291 fstat(9,  <unfinished ...>
[pid 25460] 10:12:35.175316 <... open resumed> ) = 6
[pid 25458] 10:12:35.175332 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25464] 10:12:35.175363 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.175388 read(6,  <unfinished ...>
[pid 25458] 10:12:35.175414 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25464] 10:12:35.175435 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.175461 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.175577 read(7,  <unfinished ...>
[pid 25464] 10:12:35.175614 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25460] 10:12:35.175628 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.175653 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25464] 10:12:35.175681 read(9,  <unfinished ...>
[pid 25460] 10:12:35.175710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.175741 close(7 <unfinished ...>
[pid 25464] 10:12:35.175771 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25460] 10:12:35.175788 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.175822 <... close resumed> ) = 0
[pid 25464] 10:12:35.175848 read(9,  <unfinished ...>
[pid 25460] 10:12:35.175876 <... mmap resumed> ) = 0x7f907f9fa000
[pid 25458] 10:12:35.175893 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25464] 10:12:35.175926 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25460] 10:12:35.175944 mprotect(0x7f907f9fd000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.175977 <... munmap resumed> ) = 0
[pid 25464] 10:12:35.176005 close(9 <unfinished ...>
[pid 25460] 10:12:35.176030 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.176047 read(6,  <unfinished ...>
[pid 25464] 10:12:35.176075 <... close resumed> ) = 0
[pid 25460] 10:12:35.176088 mmap(0x7f907fbfc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25458] 10:12:35.176118 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25464] 10:12:35.176160 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25460] 10:12:35.176187 <... mmap resumed> ) = 0x7f907fbfc000
[pid 25458] 10:12:35.176212 uname( <unfinished ...>
[pid 25464] 10:12:35.176241 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.176254 close(6 <unfinished ...>
[pid 25458] 10:12:35.176322 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25464] 10:12:35.176370 brk(0x7bc000 <unfinished ...>
[pid 25460] 10:12:35.176398 <... close resumed> ) = 0
[pid 25458] 10:12:35.176422 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25464] 10:12:35.176456 <... brk resumed> ) = 0x7bc000
[pid 25460] 10:12:35.176470 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.176682 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f03f3a9f790}, 8) = 0
[pid 25464] 10:12:35.176717 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.176749 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.176767 clone( <unfinished ...>
[pid 25464] 10:12:35.176979 <... write resumed> ) = 4
[pid 25460] 10:12:35.176993 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.177028 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25443] 10:12:35.177047 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25460] 10:12:35.177077 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.177096 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25466
[pid 25457] 10:12:35.177137 read(9,  <unfinished ...>
[pid 25443] 10:12:35.177163 recvfrom(16,  <unfinished ...>
[pid 25460] 10:12:35.177194 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.177225 wait4(25466,  <unfinished ...>
[pid 25443] 10:12:35.177247 <... recvfrom resumed> "\243q\201\200\0\1\0\1\0\0\0\0\10radisson\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\16\17\0)\0\n\fradisson-com\4mail\nprotection\7outlook\300\25", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 83
[pid 25460] 10:12:35.177287 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.177307 close(16 <unfinished ...>
[pid 25460] 10:12:35.177340 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.177373 <... close resumed> ) = 0
[pid 25460] 10:12:35.177418 <... open resumed> ) = 6
[pid 25443] 10:12:35.177444 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25460] 10:12:35.177541 read(6,  <unfinished ...>
[pid 25443] 10:12:35.177573 <... socket resumed> ) = 16
[pid 25464] 10:12:35.177595 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.177618 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25443] 10:12:35.177641 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25460] 10:12:35.177675 fstat(6,  <unfinished ...>
[pid 25443] 10:12:35.177699 <... connect resumed> ) = 0
[pid 25460] 10:12:35.177720 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25443] 10:12:35.177752 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25460] 10:12:35.177782 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25443] 10:12:35.177812 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25460] 10:12:35.177835 <... mmap resumed> ) = 0x7f907f7ce000
[pid 25443] 10:12:35.177852 sendto(16, "\7\320\1\0\0\1\0\0\0\0\0\0\fradisson-com\4mail\nprotection\7outlook\3com\0\0\1\0\1", 58, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25460] 10:12:35.177905 mprotect(0x7f907f7f7000, 2097152, PROT_NONE <unfinished ...>
[pid 25443] 10:12:35.177935 <... sendto resumed> ) = 58
[pid 25460] 10:12:35.177956 <... mprotect resumed> ) = 0
[pid 25443] 10:12:35.177972 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25460] 10:12:35.178000 mmap(0x7f907f9f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f907f9f7000
[pid 25460] 10:12:35.178047 mmap(0x7f907f9f9000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f907f9f9000
[pid 25460] 10:12:35.178090 close(6)    = 0
[pid 25460] 10:12:35.178135 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178179 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178221 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178263 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25460] 10:12:35.178304 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.178345 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.178392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90833f1000
[pid 25460] 10:12:35.178432 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f907f5b8000
[pid 25460] 10:12:35.178564 mprotect(0x7f907f5cd000, 2093056, PROT_NONE <unfinished ...>
[pid 25464] 10:12:35.178599 <... write resumed> ) = 4
[pid 25457] 10:12:35.178613 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25460] 10:12:35.178635 <... mprotect resumed> ) = 0
[pid 25457] 10:12:35.178652 read(9,  <unfinished ...>
[pid 25460] 10:12:35.178676 mmap(0x7f907f7cc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f907f7cc000
[pid 25460] 10:12:35.178726 close(6)    = 0
[pid 25460] 10:12:35.178777 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178821 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178863 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.178909 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.178942 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25460] 10:12:35.178965 <... open resumed> ) = 6
[pid 25433] 10:12:35.178981 recvfrom(16,  <unfinished ...>
[pid 25460] 10:12:35.179009 read(6,  <unfinished ...>
[pid 25433] 10:12:35.179032 <... recvfrom resumed> "=\326\201\200\0\1\0\1\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1\21\0\4b\201\271\203", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 51
[pid 25460] 10:12:35.179061 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:35.179085 close(16 <unfinished ...>
[pid 25460] 10:12:35.179115 fstat(6,  <unfinished ...>
[pid 25433] 10:12:35.179138 <... close resumed> ) = 0
[pid 25460] 10:12:35.179187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:35.179222 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25460] 10:12:35.179254 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:35.179283 <... socket resumed> ) = 16
[pid 25460] 10:12:35.179303 <... mmap resumed> ) = 0x7f907f3ad000
[pid 25433] 10:12:35.179337 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25460] 10:12:35.179374 mprotect(0x7f907f3b7000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:35.179402 <... connect resumed> ) = 0
[pid 25460] 10:12:35.179423 <... mprotect resumed> ) = 0
[pid 25433] 10:12:35.179439 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25460] 10:12:35.179468 mmap(0x7f907f5b6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25433] 10:12:35.179581 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25460] 10:12:35.179607 <... mmap resumed> ) = 0x7f907f5b6000
[pid 25433] 10:12:35.179633 sendto(16, "\275\375\1\0\0\1\0\0\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25460] 10:12:35.179689 close(6 <unfinished ...>
[pid 25433] 10:12:35.179714 <... sendto resumed> ) = 35
[pid 25460] 10:12:35.179734 <... close resumed> ) = 0
[pid 25433] 10:12:35.179760 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25460] 10:12:35.179796 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.179839 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.179881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.179922 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25460] 10:12:35.179962 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.180003 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.180051 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f907f1aa000
[pid 25460] 10:12:35.180092 mprotect(0x7f907f1ac000, 2093056, PROT_NONE) = 0
[pid 25460] 10:12:35.180128 mmap(0x7f907f3ab000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f907f3ab000
[pid 25460] 10:12:35.180175 close(6)    = 0
[pid 25460] 10:12:35.180217 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90833f0000
[pid 25460] 10:12:35.180271 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.180314 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.180357 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.180400 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25460] 10:12:35.180439 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25464] 10:12:35.180556 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.180586 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25460] 10:12:35.180634 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f907ef8b000
[pid 25460] 10:12:35.180680 mprotect(0x7f907efa8000, 2093056, PROT_NONE) = 0
[pid 25460] 10:12:35.180718 mmap(0x7f907f1a7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f907f1a7000
[pid 25460] 10:12:35.180762 mmap(0x7f907f1a9000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f907f1a9000
[pid 25460] 10:12:35.180807 close(6)    = 0
[pid 25460] 10:12:35.180873 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90833ef000
[pid 25460] 10:12:35.180945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90833ee000
[pid 25460] 10:12:35.180997 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90833ec000
[pid 25460] 10:12:35.181038 arch_prctl(ARCH_SET_FS, 0x7f90833ec7c0) = 0
[pid 25460] 10:12:35.181103 mprotect(0x7f907f1a7000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181145 mprotect(0x7f907f3ab000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181197 mprotect(0x7f907f5b6000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181241 mprotect(0x7f907f7cc000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181288 mprotect(0x7f907f9f7000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181334 mprotect(0x7f907fbfc000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181465 mprotect(0x7f907fed9000, 40960, PROT_READ) = 0
[pid 25460] 10:12:35.181651 mprotect(0x7f9080126000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181701 mprotect(0x7f9080340000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181741 mprotect(0x7f908054d000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.181960 mprotect(0x7f9080d39000, 110592, PROT_READ) = 0
[pid 25460] 10:12:35.182059 mprotect(0x7f9080fc5000, 16384, PROT_READ) = 0
[pid 25460] 10:12:35.182168 mprotect(0x7f908135a000, 16384, PROT_READ) = 0
[pid 25460] 10:12:35.182211 mprotect(0x7f9081565000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.182255 mprotect(0x7f9081769000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.182903 mprotect(0x7f90824c1000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.182970 mprotect(0x7f90828f6000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183012 mprotect(0x7f9082b7a000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183052 mprotect(0x7f9082d83000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183101 mprotect(0x7f9082fc8000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183145 mprotect(0x7f90831e2000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183203 mprotect(0x7f9083405000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.183241 munmap(0x7f90833fa000, 39387) = 0
[pid 25460] 10:12:35.183291 set_tid_address(0x7f90833eca90 <unfinished ...>
[pid 25449] 10:12:35.183318 <... select resumed> ) = 1 (in [11], left {299, 946152})
[pid 25460] 10:12:35.183346 <... set_tid_address resumed> ) = 25460
[pid 25449] 10:12:35.183363 recvfrom(11,  <unfinished ...>
[pid 25460] 10:12:35.183391 set_robust_list(0x7f90833ecaa0, 24 <unfinished ...>
[pid 25449] 10:12:35.183414 <... recvfrom resumed> "250 2.1.0 Sender OK\r\n", 4096, 0, NULL, NULL) = 21
[pid 25460] 10:12:35.183449 <... set_robust_list resumed> ) = 0
[pid 25449] 10:12:35.183466 sendto(11, "RCPT TO:<salesadmin@phoenixmarriottmesa.com>\r\n", 46, 0, NULL, 0 <unfinished ...>
[pid 25460] 10:12:35.183561 futex(0x7ffe4db6989c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25449] 10:12:35.183587 <... sendto resumed> ) = 46
[pid 25460] 10:12:35.183611 <... futex resumed> ) = 0
[pid 25449] 10:12:35.183628 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25460] 10:12:35.183659 futex(0x7ffe4db6989c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f90833ec7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25460] 10:12:35.183701 rt_sigaction(SIGRTMIN, {0x7f90822afc60, [], SA_RESTORER|SA_SIGINFO, 0x7f90822b9790}, NULL, 8) = 0
[pid 25460] 10:12:35.183739 rt_sigaction(SIGRT_1, {0x7f90822afcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f90822b9790}, NULL, 8) = 0
[pid 25460] 10:12:35.183775 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25460] 10:12:35.183817 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25460] 10:12:35.183887 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350348, f_bavail=6350348, f_files=1000000, f_ffree=691108, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25460] 10:12:35.183977 brk(0)      = 0x1420000
[pid 25460] 10:12:35.184013 brk(0x1441000) = 0x1441000
[pid 25460] 10:12:35.184058 open("/proc/filesystems", O_RDONLY) = 6
[pid 25460] 10:12:35.184112 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.184167 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9083403000
[pid 25460] 10:12:35.184205 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25460] 10:12:35.184282 read(6, "", 1024) = 0
[pid 25460] 10:12:35.184324 close(6)    = 0
[pid 25460] 10:12:35.184364 munmap(0x7f9083403000, 4096) = 0
[pid 25460] 10:12:35.184444 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25464] 10:12:35.184631 <... write resumed> ) = 4
[pid 25460] 10:12:35.184651 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25457] 10:12:35.184680 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25460] 10:12:35.184702 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25457] 10:12:35.184727 read(9,  <unfinished ...>
[pid 25460] 10:12:35.184753 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25460] 10:12:35.184826 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f90822b9790}, NULL, 8) = 0
[pid 25460] 10:12:35.184868 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25460] 10:12:35.184907 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25460] 10:12:35.184945 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790}, NULL, 8) = 0
[pid 25460] 10:12:35.184987 umask(0)    = 022
[pid 25460] 10:12:35.185052 geteuid()   = 0
[pid 25460] 10:12:35.185089 getuid()    = 503
[pid 25460] 10:12:35.185122 getgid()    = 499
[pid 25460] 10:12:35.185167 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25460] 10:12:35.185204 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25460] 10:12:35.185239 getgroups(65536, [500]) = 1
[pid 25460] 10:12:35.185277 setgroups(0, []) = 0
[pid 25460] 10:12:35.185313 getegid()   = 499
[pid 25460] 10:12:35.185346 geteuid()   = 0
[pid 25460] 10:12:35.185382 geteuid()   = 0
[pid 25460] 10:12:35.185413 getegid()   = 499
[pid 25460] 10:12:35.185446 setgid(499) = 0
[pid 25460] 10:12:35.185544 setuid(0)   = 0
[pid 25460] 10:12:35.185611 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25460] 10:12:35.185671 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.185729 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.185782 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9083403000
[pid 25460] 10:12:35.185819 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25460] 10:12:35.185949 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25460] 10:12:35.185993 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.186038 close(7)    = 0
[pid 25460] 10:12:35.186074 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25460] 10:12:35.186109 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.186157 close(7)    = 0
[pid 25460] 10:12:35.186197 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25460] 10:12:35.186239 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25460] 10:12:35.186285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9083402000
[pid 25460] 10:12:35.186322 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25460] 10:12:35.186378 read(7, "", 4096) = 0
[pid 25460] 10:12:35.186413 close(7)    = 0
[pid 25460] 10:12:35.186447 munmap(0x7f9083402000, 4096) = 0
[pid 25460] 10:12:35.186569 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25464] 10:12:35.186624 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25460] 10:12:35.186656 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25464] 10:12:35.186685 <... write resumed> ) = 4
[pid 25460] 10:12:35.186700 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.186733 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25460] 10:12:35.186754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.186772 read(9,  <unfinished ...>
[pid 25460] 10:12:35.186796 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.186835 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25460] 10:12:35.186872 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25460] 10:12:35.186917 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f90833e2000
[pid 25460] 10:12:35.186954 close(7)    = 0
[pid 25460] 10:12:35.186995 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25460] 10:12:35.187035 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25460] 10:12:35.187075 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25460] 10:12:35.187123 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f907ed7d000
[pid 25460] 10:12:35.187164 mprotect(0x7f907ed89000, 2097152, PROT_NONE) = 0
[pid 25460] 10:12:35.187201 mmap(0x7f907ef89000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f907ef89000
[pid 25460] 10:12:35.187247 close(7)    = 0
[pid 25460] 10:12:35.187297 mprotect(0x7f907ef89000, 4096, PROT_READ) = 0
[pid 25460] 10:12:35.187338 munmap(0x7f90833e2000, 39387) = 0
[pid 25460] 10:12:35.187384 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25460] 10:12:35.187428 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25460] 10:12:35.187464 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25464] 10:12:35.187610 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.187636 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25464] 10:12:35.187683 <... write resumed> ) = 4
[pid 25460] 10:12:35.187697 <... mmap resumed> ) = 0x7f9083402000
[pid 25457] 10:12:35.187714 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25460] 10:12:35.187735 read(7,  <unfinished ...>
[pid 25457] 10:12:35.187762 read(9,  <unfinished ...>
[pid 25460] 10:12:35.187786 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.187825 close(7)    = 0
[pid 25460] 10:12:35.187861 munmap(0x7f9083402000, 4096) = 0
[pid 25460] 10:12:35.187914 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25460] 10:12:35.187955 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.187999 close(7)    = 0
[pid 25460] 10:12:35.188034 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25460] 10:12:35.188068 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.188109 close(7)    = 0
[pid 25460] 10:12:35.188147 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25460] 10:12:35.188187 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25460] 10:12:35.188232 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9083402000
[pid 25460] 10:12:35.188269 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25460] 10:12:35.188320 close(7)    = 0
[pid 25460] 10:12:35.188354 munmap(0x7f9083402000, 4096) = 0
[pid 25460] 10:12:35.188407 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25464] 10:12:35.188553 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25460] 10:12:35.188588 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25460] 10:12:35.188635 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.188686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9083402000
[pid 25460] 10:12:35.188723 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.188767 close(7)    = 0
[pid 25460] 10:12:35.188802 munmap(0x7f9083402000, 4096) = 0
[pid 25460] 10:12:35.188845 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25460] 10:12:35.188905 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25460] 10:12:35.188968 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790}, 8) = 0
[pid 25460] 10:12:35.189017 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f90833eca90) = 25467
[pid 25460] 10:12:35.189259 wait4(25467, Process 25465 attached
 <unfinished ...>
[pid 25464] 10:12:35.189318 <... write resumed> ) = 40
[pid 25457] 10:12:35.189332 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25457] 10:12:35.189354 read(9,  <unfinished ...>
[pid 25465] 10:12:35.189399 set_robust_list(0x7f2b2934eaa0, 24 <unfinished ...>
[pid 25464] 10:12:35.189421 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25465] 10:12:35.189456 <... set_robust_list resumed> ) = 0
[pid 25464] 10:12:35.189470 <... write resumed> ) = 4
[pid 25457] 10:12:35.189551 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25457] 10:12:35.189578 wait4(-1,  <unfinished ...>
[pid 25465] 10:12:35.189632 geteuid( <unfinished ...>
[pid 25464] 10:12:35.189653 close(10 <unfinished ...>
[pid 25465] 10:12:35.189683 <... geteuid resumed> ) = 0
[pid 25464] 10:12:35.189697 <... close resumed> ) = 0
[pid 25465] 10:12:35.189732 geteuid( <unfinished ...>
[pid 25464] 10:12:35.189754 exit_group(0) = ?
[pid 25465] 10:12:35.189987 <... geteuid resumed> ) = 0
[pid 25464] 10:12:35.190005 +++ exited with 0 +++
[pid 25457] 10:12:35.190017 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25464
[pid 25457] 10:12:35.190039 close(9)    = 0
[pid 25457] 10:12:35.190075 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0}, 8) = 0
[pid 25457] 10:12:35.190131 brk(0x7bb000) = 0x7bb000
[pid 25457] 10:12:35.190176 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25457] 10:12:35.190229 alarm(60)   = 0
[pid 25457] 10:12:35.190264 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25457] 10:12:35.190303 alarm(0)    = 60
[pid 25457] 10:12:35.190377 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.190428 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25457] 10:12:35.190470 read(10, "cpu  123058 1342391 395132 67343095 2509 0 0 0\ncpu0 123058 1342391 395132 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58328999\nbtime 1450798266\nprocesses 892945\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25457] 10:12:35.190597 close(10)   = 0
[pid 25457] 10:12:35.190683 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.190746 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25457] 10:12:35.190789 fcntl(10, F_GETFD) = 0
[pid 25457] 10:12:35.190822 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25457] 10:12:35.190860 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25457] 10:12:35.190911 close(10)   = 0
[pid 25457] 10:12:35.190961 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.191010 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25457] 10:12:35.191107 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0a4000
[pid 25457] 10:12:35.191260 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25457] 10:12:35.191304 fcntl(10, F_GETFD) = 0
[pid 25457] 10:12:35.191337 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25457] 10:12:35.191375 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.191468 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25457] 10:12:35.191627 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25457] 10:12:35.191697 close(10)   = 0
[pid 25457] 10:12:35.191756 munmap(0x7f293c0a4000, 200704) = 0
[pid 25457] 10:12:35.191823 close(9)    = 0
[pid 25457] 10:12:35.191880 open("/etc/localdomains", O_RDONLY) = 9
[pid 25457] 10:12:35.191926 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.191982 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.192029 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0eb000
[pid 25457] 10:12:35.192067 lseek(9, 0, SEEK_SET) = 0
[pid 25457] 10:12:35.192102 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25457] 10:12:35.192169 stat("/jail_owner", 0x7ffd7b06c190) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.192220 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25457] 10:12:35.192286 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.192338 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25457] 10:12:35.192399 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.192445 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25465] 10:12:35.192610 getegid( <unfinished ...>
[pid 25457] 10:12:35.192637 open("/etc/demouids", O_RDONLY) = 10
[pid 25457] 10:12:35.192677 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.192725 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.192769 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0ea000
[pid 25457] 10:12:35.192805 lseek(10, 0, SEEK_SET) = 0
[pid 25457] 10:12:35.192838 read(10, "", 4096) = 0
[pid 25457] 10:12:35.192880 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25457] 10:12:35.192971 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.193028 open("/etc/userdomains", O_RDONLY) = 11
[pid 25457] 10:12:35.193068 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.193114 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.193158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0e9000
[pid 25457] 10:12:35.193194 lseek(11, 0, SEEK_SET) = 0
[pid 25457] 10:12:35.193227 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25457] 10:12:35.193290 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25457] 10:12:35.193336 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25457] 10:12:35.193384 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f293c0e8000
[pid 25457] 10:12:35.193419 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25457] 10:12:35.193464 close(12)   = 0
[pid 25433] 10:12:35.193586 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25457] 10:12:35.193617 munmap(0x7f293c0e8000, 4096 <unfinished ...>
[pid 25433] 10:12:35.193646 recvfrom(16,  <unfinished ...>
[pid 25457] 10:12:35.193704 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.193743 <... read resumed> "\26\3\1\0005\2\0", 7) = 7
[pid 25433] 10:12:35.193811 <... recvfrom resumed> "\275\375\201\200\0\1\0\1\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\2\t\0\4\255\313\2 ", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 51
[pid 25457] 10:12:35.193846 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25452] 10:12:35.193875 read(11,  <unfinished ...>
[pid 25433] 10:12:35.193899 close(16 <unfinished ...>
[pid 25457] 10:12:35.193931 <... stat resumed> 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.193954 <... read resumed> "\0001\3\1V\204\2t\3028(ra\355`\265Et\\8\361\364\347y\214\326\201\373h\30\213\4\340\5\314\254\0\0009\0\0\t\377\1\0\1\0\0#\0\0", 51) = 51
[pid 25433] 10:12:35.194015 <... close resumed> ) = 0
[pid 25457] 10:12:35.194116 stat("/etc/userdomains",  <unfinished ...>
[pid 25452] 10:12:35.194149 read(11,  <unfinished ...>
[pid 25433] 10:12:35.194173 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25457] 10:12:35.194205 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.194251 <... read resumed> "\26\3\1\n\27", 5) = 5
[pid 25433] 10:12:35.194272 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25457] 10:12:35.194322 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25452] 10:12:35.194355 read(11,  <unfinished ...>
[pid 25433] 10:12:35.194381 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.194414 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25452] 10:12:35.194452 <... read resumed> "\v\0\n\23\0\n\20\0\00560\202\00520\202\4\32\240\3\2\1\2\2\t\0\210\340\207\345T\361\313\3270\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2641\v0\t\6\3U\4\6\23\2US1\0200\16\6\3U\4\10\23\7Arizona1\0230\21\6\3U\4\7\23\nScottsdale1\0320\30\6\3U\4\n\23\21GoDaddy.com, Inc.1-0+\6\3U\4\v\23$http://certs.godaddy.com/repository/1301\6\3U\4\3\23*Go Daddy Secure Certificate Authority - G20\36\27\r151125010838Z\27\r18112"..., 2583) = 2583
[pid 25433] 10:12:35.195150 <... open resumed> ) = 16
[pid 25457] 10:12:35.195190 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25452] 10:12:35.195222 read(11,  <unfinished ...>
[pid 25433] 10:12:35.195247 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.195277 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25452] 10:12:35.195333 <... read resumed> "\26\3\1\2\r", 5) = 5
[pid 25433] 10:12:35.195364 <... ioctl resumed> , 0x7ffc72719d90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.195390 stat("/etc/userdomains",  <unfinished ...>
[pid 25452] 10:12:35.195417 read(11,  <unfinished ...>
[pid 25433] 10:12:35.195441 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.195469 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.195575 <... read resumed> "\f\0\2\t\0\200\370\325\314\350z9a\265\365\313\3104@\305\30V\340\346\372mZ\262\203\20x\310gb\34\244l\250}\177\243\261\257u\2704<i\223t\323i \362\343\232e=\350\360rZ\246\342\322\227u7U\214\342~xOKT\233\357\265X\222{\243\f\213\330\35\254\334\256\223\2{]\316\33\301vp\257}\354\350\21I\253\327\3262\331\270\nc\227\316\274\307\251a\234\3178(\216\243\325#(wC\260No\263\0\1\2\0\200Xq\274m\211y\353\255\276aH\237\262\203\r7\276\207\32\31\376\226ZF\275\316{j\377S9\367)\n\273:\346\231E\323\277\250\211A^;p\331\t\325\301\277\273\326u\v\215\343\5F\0266\264\303\4\21$\251\27\301\252n\314s\200\261\223\352K%\366'\25U\370\272I\212PL\\\22\\+\2\214\264:\213\341\23y\267\355\245\241Ob\0\n\3\301~\342xy\372"..., 525) = 525
[pid 25433] 10:12:35.195706 <... lseek resumed> ) = 0
[pid 25465] 10:12:35.195736 <... getegid resumed> ) = 12
[pid 25457] 10:12:35.195757 stat("/etc/userdomains",  <unfinished ...>
[pid 25452] 10:12:35.195792 read(11,  <unfinished ...>
[pid 25433] 10:12:35.195815 fstat(16, Process 25466 attached
 <unfinished ...>
[pid 25465] 10:12:35.195871 setgid(12 <unfinished ...>
[pid 25457] 10:12:35.195896 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.195935 <... read resumed> "\26\3\1\0\4", 5) = 5
[pid 25433] 10:12:35.195957 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25466] 10:12:35.195993 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25465] 10:12:35.196017 <... setgid resumed> ) = 0
[pid 25457] 10:12:35.196030 stat("/etc/userdomains",  <unfinished ...>
[pid 25452] 10:12:35.196058 read(11,  <unfinished ...>
[pid 25433] 10:12:35.196082 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25466] 10:12:35.196113 <... set_robust_list resumed> ) = 0
[pid 25465] 10:12:35.196126 setuid(47 <unfinished ...>
[pid 25457] 10:12:35.196173 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25452] 10:12:35.196224 <... read resumed> "\16\0\0\0", 4) = 4
[pid 25433] 10:12:35.198014 <... fcntl resumed> ) = 0
[pid 25466] 10:12:35.198064 geteuid( <unfinished ...>
[pid 25465] 10:12:35.198091 <... setuid resumed> ) = 0
[pid 25457] 10:12:35.198105 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25452] 10:12:35.199728 write(11, "\26\3\1\0\206\20\0\0\202\0\200\226.\230\25\23\250\36024\233p\305\303\367k\355\3133R-\374\225\337so\300\277\f\274\256\371w\343\30\265\177\274\251\37\317\332\346\224h_l@\300X\342\206\274\213\30\317X\244\237\333\373\310\264\264\334u$Y\232\305!N\215[\36\247\333\203\346\317 \223&\333\237\30\200\367;]\17%\341\353\33\2763/\321\221\21\254u\376\32\205\275\363\1\323C1<:\314\2263\376\247T\354(00\323\246\26\300\355\24\3\1\0\1\1\26\3\1\0000\"\257FzW\206\373\374\373\303[\2\332\322\226#b\334\251\277\216\376\205\205\23\224\305\232\255\214od\234\334\237\31\335\33K\33\223:[6P\2215\257", 198 <unfinished ...>
[pid 25433] 10:12:35.199785 read(16,  <unfinished ...>
[pid 25466] 10:12:35.199820 <... geteuid resumed> ) = 0
[pid 25465] 10:12:35.199834 brk(0x135c000 <unfinished ...>
[pid 25457] 10:12:35.199869 <... stat resumed> 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.199894 <... write resumed> ) = 198
[pid 25433] 10:12:35.199913 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25466] 10:12:35.200124 geteuid( <unfinished ...>
[pid 25465] 10:12:35.200153 <... brk resumed> ) = 0x135c000
[pid 25457] 10:12:35.200168 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25452] 10:12:35.200563 read(11,  <unfinished ...>
[pid 25433] 10:12:35.200595 close(16 <unfinished ...>
[pid 25466] 10:12:35.200635 <... geteuid resumed> ) = 0
[pid 25457] 10:12:35.200650 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.200697 <... close resumed> ) = 0
[pid 25457] 10:12:35.200741 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.200776 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25457] 10:12:35.200812 <... open resumed> ) = 12
[pid 25433] 10:12:35.200830 <... open resumed> ) = 16
[pid 25457] 10:12:35.200850 fstat(12,  <unfinished ...>
[pid 25433] 10:12:35.200875 alarm(60 <unfinished ...>
[pid 25457] 10:12:35.200903 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.200935 <... alarm resumed> ) = 0
[pid 25457] 10:12:35.200956 fstat(12,  <unfinished ...>
[pid 25433] 10:12:35.200980 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25457] 10:12:35.201011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.201039 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.201058 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.201085 alarm(0 <unfinished ...>
[pid 25457] 10:12:35.201112 <... mmap resumed> ) = 0x7f293c0e8000
[pid 25433] 10:12:35.201129 <... alarm resumed> ) = 60
[pid 25457] 10:12:35.201157 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.201182 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.201218 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.201235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.201256 read(12,  <unfinished ...>
[pid 25433] 10:12:35.201280 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.201314 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.201348 <... open resumed> ) = 17
[pid 25457] 10:12:35.201372 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.201402 read(17,  <unfinished ...>
[pid 25457] 10:12:35.201444 <... open resumed> ) = 13
[pid 25433] 10:12:35.201463 <... read resumed> "cpu  123058 1342391 395132 67343095 2509 0 0 0\ncpu0 123058 1342391 395132 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58329904\nbtime 1450798266\nprocesses 892945\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25457] 10:12:35.201574 fstat(13,  <unfinished ...>
[pid 25433] 10:12:35.201606 close(17 <unfinished ...>
[pid 25457] 10:12:35.201641 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:35.201676 <... close resumed> ) = 0
[pid 25457] 10:12:35.201708 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.201736 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25457] 10:12:35.201769 <... mmap resumed> ) = 0x7f293c0e7000
[pid 25433] 10:12:35.201796 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.201831 read(13,  <unfinished ...>
[pid 25433] 10:12:35.201859 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.201893 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:35.201919 <... open resumed> ) = 17
[pid 25457] 10:12:35.201940 close(13 <unfinished ...>
[pid 25433] 10:12:35.201966 fcntl(17, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.201992 <... close resumed> ) = 0
[pid 25433] 10:12:35.202008 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.202027 munmap(0x7f293c0e7000, 4096 <unfinished ...>
[pid 25433] 10:12:35.202055 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.202082 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.202114 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.202138 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.202165 read(17,  <unfinished ...>
[pid 25457] 10:12:35.202192 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.202235 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25457] 10:12:35.202267 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25433] 10:12:35.202294 close(17 <unfinished ...>
[pid 25457] 10:12:35.202324 <... stat resumed> 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.202346 <... close resumed> ) = 0
[pid 25457] 10:12:35.202371 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.202398 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.202428 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.202462 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.202580 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:35.202620 stat("/var/tmp",  <unfinished ...>
[pid 25457] 10:12:35.202659 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:35.202700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25457] 10:12:35.202750 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.202781 brk(0xa2c000 <unfinished ...>
[pid 25457] 10:12:35.202810 <... stat resumed> 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.202837 <... brk resumed> ) = 0xa2c000
[pid 25457] 10:12:35.202967 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.202998 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.203032 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.203074 <... open resumed> ) = 17
[pid 25457] 10:12:35.203096 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.203122 fcntl(17, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.203148 <... stat resumed> 0x7ffd7b06ef80) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.203170 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.203190 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.203216 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.203242 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.203276 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.203297 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.203324 fstat(17,  <unfinished ...>
[pid 25457] 10:12:35.203351 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.203457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.203589 getuid( <unfinished ...>
[pid 25433] 10:12:35.203624 pread(17,  <unfinished ...>
[pid 25457] 10:12:35.203658 <... getuid resumed> ) = 0
[pid 25433] 10:12:35.203681 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25457] 10:12:35.203728 geteuid( <unfinished ...>
[pid 25433] 10:12:35.203754 pread(17,  <unfinished ...>
[pid 25457] 10:12:35.203782 <... geteuid resumed> ) = 0
[pid 25433] 10:12:35.203801 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25457] 10:12:35.203840 getgid( <unfinished ...>
[pid 25433] 10:12:35.203865 pread(17,  <unfinished ...>
[pid 25457] 10:12:35.203893 <... getgid resumed> ) = 12
[pid 25433] 10:12:35.203911 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25457] 10:12:35.203966 getegid( <unfinished ...>
[pid 25433] 10:12:35.203993 close(17 <unfinished ...>
[pid 25457] 10:12:35.204022 <... getegid resumed> ) = 12
[pid 25433] 10:12:35.204098 <... close resumed> ) = 0
[pid 25457] 10:12:35.204136 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.204172 close(16 <unfinished ...>
[pid 25457] 10:12:35.204203 <... open resumed> ) = 13
[pid 25433] 10:12:35.204221 <... close resumed> ) = 0
[pid 25457] 10:12:35.204250 read(13,  <unfinished ...>
[pid 25433] 10:12:35.204276 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25457] 10:12:35.204303 <... read resumed> "\205\320\t7", 4) = 4
[pid 25433] 10:12:35.204323 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.204344 close(13 <unfinished ...>
[pid 25433] 10:12:35.204369 read(13,  <unfinished ...>
[pid 25457] 10:12:35.204398 <... close resumed> ) = 0
[pid 25433] 10:12:35.204576 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25466] 10:12:35.204698 getegid( <unfinished ...>
[pid 25465] 10:12:35.204728 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25457] 10:12:35.204759 readlink("/proc/self/exe",  <unfinished ...>
[pid 25433] 10:12:35.204803 stat("/jail_owner",  <unfinished ...>
[pid 25466] 10:12:35.204836 <... getegid resumed> ) = 12
[pid 25465] 10:12:35.204850 <... open resumed> ) = 7
[pid 25457] 10:12:35.204869 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25433] 10:12:35.204939 <... stat resumed> 0x7ffc72718770) = -1 ENOENT (No such file or directory)
[pid 25466] 10:12:35.204974 setgid(12 <unfinished ...>
[pid 25465] 10:12:35.204999 fstat(7,  <unfinished ...>
[pid 25457] 10:12:35.205022 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.205046 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25466] 10:12:35.205083 <... setgid resumed> ) = 0
[pid 25465] 10:12:35.205097 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25457] 10:12:35.205127 <... ioctl resumed> , 0x7ffd7b06bde0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.205155 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25466] 10:12:35.205199 setuid(47 <unfinished ...>
[pid 25465] 10:12:35.205223 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25457] 10:12:35.205249 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.205272 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25466] 10:12:35.205308 <... setuid resumed> ) = 0
[pid 25465] 10:12:35.205321 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25457] 10:12:35.206928 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.206967 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25466] 10:12:35.207002 brk(0x1478000 <unfinished ...>
[pid 25465] 10:12:35.207025 read(7,  <unfinished ...>
[pid 25457] 10:12:35.207046 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.207070 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25457] 10:12:35.207110 <... ioctl resumed> , 0x7ffd7b06bde0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.207129 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25457] 10:12:35.207168 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.207192 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25457] 10:12:35.207224 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.207242 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.207267 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.207291 stat("/etc/demouids",  <unfinished ...>
[pid 25457] 10:12:35.207323 <... ioctl resumed> , 0x7ffd7b06bdf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.207340 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.207387 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.207413 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25457] 10:12:35.207444 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.207464 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25466] 10:12:35.207657 <... brk resumed> ) = 0x1478000
[pid 25465] 10:12:35.207679 <... read resumed> "\235\247%\337\356m\200\351\242\35)/1\303\6\264\312\31\323\234\377^\n\325\v\f\3174F\334\356\336\247\342\216n\207\302\276\310\376!8zd\374I\313", 48) = 48
[pid 25457] 10:12:35.208029 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.208074 stat("/etc/userdomains",  <unfinished ...>
[pid 25466] 10:12:35.208108 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25465] 10:12:35.208131 close(7 <unfinished ...>
[pid 25457] 10:12:35.208151 <... open resumed> ) = 13
[pid 25433] 10:12:35.208170 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.208222 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.208249 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25457] 10:12:35.208283 <... ioctl resumed> , 0x7ffd7b06bec0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.208302 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25457] 10:12:35.208341 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.208366 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25457] 10:12:35.208399 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.208418 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25457] 10:12:35.208458 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.208556 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25465] 10:12:35.208604 <... close resumed> ) = 0
[pid 25457] 10:12:35.208626 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.208646 <... open resumed> ) = 16
[pid 25457] 10:12:35.208667 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25433] 10:12:35.208691 fstat(16,  <unfinished ...>
[pid 25457] 10:12:35.208717 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0}, 8) = 0
[pid 25433] 10:12:35.208979 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25457] 10:12:35.209027 brk(0x7dd000 <unfinished ...>
[pid 25433] 10:12:35.209054 fstat(16,  <unfinished ...>
[pid 25457] 10:12:35.209080 <... brk resumed> ) = 0x7dd000
[pid 25433] 10:12:35.209111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25457] 10:12:35.209145 read(13,  <unfinished ...>
[pid 25433] 10:12:35.209168 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.209198 <... read resumed> "", 8192) = 0
[pid 25433] 10:12:35.209221 <... mmap resumed> ) = 0x7fea0f27d000
[pid 25457] 10:12:35.209242 close(13 <unfinished ...>
[pid 25433] 10:12:35.209266 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25457] 10:12:35.209293 <... close resumed> ) = 0
[pid 25433] 10:12:35.209653 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.209688 stat("/etc/exim.pl",  <unfinished ...>
[pid 25433] 10:12:35.209719 read(16,  <unfinished ...>
[pid 25457] 10:12:35.209750 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:35.209782 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25457] 10:12:35.209845 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.209935 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25457] 10:12:35.209975 <... open resumed> ) = 13
[pid 25433] 10:12:35.209994 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4102, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25457] 10:12:35.210046 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.210075 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.210110 <... ioctl resumed> , 0x7ffd7b06bcf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.210129 <... open resumed> ) = 17
[pid 25457] 10:12:35.210151 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.210175 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.210203 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.210242 <... ioctl resumed> , 0x7ffc72715710) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.210268 read(13,  <unfinished ...>
[pid 25433] 10:12:35.210294 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.210335 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25433] 10:12:35.211242 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.211281 brk(0x7fe000 <unfinished ...>
[pid 25433] 10:12:35.211311 fstat(17,  <unfinished ...>
[pid 25457] 10:12:35.211339 <... brk resumed> ) = 0x7fe000
[pid 25433] 10:12:35.211733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4102, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25457] 10:12:35.211784 read(13,  <unfinished ...>
[pid 25433] 10:12:35.211813 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.211840 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25433] 10:12:35.212677 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.212724 brk(0x81f000 <unfinished ...>
[pid 25433] 10:12:35.212755 read(17,  <unfinished ...>
[pid 25457] 10:12:35.212786 <... brk resumed> ) = 0x81f000
[pid 25433] 10:12:35.213207 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4102
[pid 25457] 10:12:35.213897 read(13,  <unfinished ...>
[pid 25433] 10:12:35.213930 read(17, "", 8192) = 0
[pid 25433] 10:12:35.213971 close(17)   = 0
[pid 25433] 10:12:35.214028 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.214103 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25457] 10:12:35.214144 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25433] 10:12:35.214531 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.214597 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.214680 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25433] 10:12:35.214727 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:35.214774 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f27c000
[pid 25433] 10:12:35.214812 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:35.214867 close(17)   = 0
[pid 25433] 10:12:35.214902 munmap(0x7fea0f27c000, 4096) = 0
[pid 25433] 10:12:35.214952 open("/etc/group", O_RDONLY|O_CLOEXEC) = 17
[pid 25433] 10:12:35.214995 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:35.215047 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f27c000
[pid 25433] 10:12:35.215084 read(17, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:35.215135 close(17)   = 0
[pid 25433] 10:12:35.215170 munmap(0x7fea0f27c000, 4096) = 0
[pid 25433] 10:12:35.215214 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.215265 pipe([17, 18]) = 0
[pid 25433] 10:12:35.215303 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25433] 10:12:35.215350 close(15)   = 0
[pid 25433] 10:12:35.215386 munmap(0x7fea0f27e000, 4096) = 0
[pid 25433] 10:12:35.215423 close(14)   = 0
[pid 25433] 10:12:35.215457 munmap(0x7fea0f27f000, 4096Process 25467 attached
) = 0
[pid 25466] 10:12:35.216020 <... open resumed> ) = 7
[pid 25465] 10:12:35.216055 getuid( <unfinished ...>
[pid 25457] 10:12:35.216090 brk(0x840000 <unfinished ...>
[pid 25467] 10:12:35.216121 set_robust_list(0x7f90833ecaa0, 24 <unfinished ...>
[pid 25466] 10:12:35.216145 fstat(7,  <unfinished ...>
[pid 25465] 10:12:35.216167 <... getuid resumed> ) = 47
[pid 25433] 10:12:35.216181 close(9 <unfinished ...>
[pid 25467] 10:12:35.216369 <... set_robust_list resumed> ) = 0
[pid 25466] 10:12:35.216387 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25465] 10:12:35.216443 exit_group(0) = ?
[pid 25457] 10:12:35.216466 <... brk resumed> ) = 0x840000
[pid 25433] 10:12:35.216763 <... close resumed> ) = 0
[pid 25467] 10:12:35.217239 geteuid( <unfinished ...>
[pid 25466] 10:12:35.217273 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25465] 10:12:35.217301 +++ exited with 0 +++
[pid 25461] 10:12:35.217314 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25465
[pid 25457] 10:12:35.217335 read(13,  <unfinished ...>
[pid 25433] 10:12:35.217359 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25467] 10:12:35.217398 <... geteuid resumed> ) = 0
[pid 25466] 10:12:35.217412 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25461] 10:12:35.217437 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25457] 10:12:35.217527 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25433] 10:12:35.217555 <... munmap resumed> ) = 0
[pid 25467] 10:12:35.217843 geteuid( <unfinished ...>
[pid 25466] 10:12:35.217875 read(7,  <unfinished ...>
[pid 25461] 10:12:35.217903 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0}, 8) = 0
[pid 25457] 10:12:35.217949 read(13,  <unfinished ...>
[pid 25433] 10:12:35.217975 close(13 <unfinished ...>
[pid 25467] 10:12:35.218008 <... geteuid resumed> ) = 0
[pid 25466] 10:12:35.218021 <... read resumed> "\355\273\22\364{\26H\5Od)#\356\346\211#\226\263 C\366\33<T|\335\377/\351o\223\23F\371\24\214\266(\237oC\330Bd\323\301\262\343", 48) = 48
[pid 25461] 10:12:35.218050 getcwd( <unfinished ...>
[pid 25457] 10:12:35.218080 <... read resumed> "", 8192) = 0
[pid 25433] 10:12:35.218095 <... close resumed> ) = 0
[pid 25467] 10:12:35.218122 getegid( <unfinished ...>
[pid 25466] 10:12:35.218144 close(7 <unfinished ...>
[pid 25461] 10:12:35.218167 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25457] 10:12:35.218232 close(13 <unfinished ...>
[pid 25433] 10:12:35.218262 munmap(0x7fea0f280000, 4096 <unfinished ...>
[pid 25467] 10:12:35.218298 <... getegid resumed> ) = 499
[pid 25466] 10:12:35.218314 <... close resumed> ) = 0
[pid 25461] 10:12:35.218334 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.218384 <... close resumed> ) = 0
[pid 25433] 10:12:35.218398 <... munmap resumed> ) = 0
[pid 25467] 10:12:35.218443 setgid(12 <unfinished ...>
[pid 25466] 10:12:35.218469 getuid( <unfinished ...>
[pid 25461] 10:12:35.218560 <... open resumed> ) = 7
[pid 25457] 10:12:35.218579 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25433] 10:12:35.218608 close(12 <unfinished ...>
[pid 25467] 10:12:35.218641 <... setgid resumed> ) = 0
[pid 25466] 10:12:35.218654 <... getuid resumed> ) = 47
[pid 25461] 10:12:35.218670 fstat(7,  <unfinished ...>
[pid 25457] 10:12:35.218835 <... stat resumed> 0x7f293a789880) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.218853 <... close resumed> ) = 0
[pid 25467] 10:12:35.218882 setuid(47 <unfinished ...>
[pid 25466] 10:12:35.218907 exit_group(0) = ?
[pid 25461] 10:12:35.218920 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25457] 10:12:35.219175 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25433] 10:12:35.219205 munmap(0x7fea0f281000, 4096 <unfinished ...>
[pid 25467] 10:12:35.219253 <... setuid resumed> ) = 0
[pid 25466] 10:12:35.219267 +++ exited with 0 +++
[pid 25461] 10:12:35.220853 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.220889 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25466
[pid 25457] 10:12:35.220911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:35.220939 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25433] 10:12:35.220963 <... munmap resumed> ) = 0
[pid 25467] 10:12:35.220991 brk(0x1462000 <unfinished ...>
[pid 25461] 10:12:35.221013 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.221042 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25457] 10:12:35.221069 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25443] 10:12:35.221095 recvfrom(16,  <unfinished ...>
[pid 25433] 10:12:35.221121 close(16 <unfinished ...>
[pid 25461] 10:12:35.221154 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.221181 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25457] 10:12:35.221223 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25443] 10:12:35.221252 <... recvfrom resumed> "\7\320\201\200\0\1\0\3\0\0\0\0\fradisson-com\4mail\nprotection\7outlook\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\n\0\4\317.\243\367\300\f\0\1\0\1\0\0\0\n\0\4\317.\243\327\300\f\0\1\0\1\0\0\0\n\0\4\317.\243\252", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 106
[pid 25433] 10:12:35.221292 <... close resumed> ) = 0
[pid 25461] 10:12:35.221318 <... mmap resumed> ) = 0x7f2b29364000
[pid 25458] 10:12:35.221336 getcwd( <unfinished ...>
[pid 25457] 10:12:35.221361 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.221392 close(16 <unfinished ...>
[pid 25433] 10:12:35.221421 munmap(0x7fea0f27d000, 4096 <unfinished ...>
[pid 25461] 10:12:35.221457 read(7,  <unfinished ...>
[pid 25458] 10:12:35.221556 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25457] 10:12:35.221611 <... open resumed> ) = 13
[pid 25443] 10:12:35.221629 <... close resumed> ) = 0
[pid 25433] 10:12:35.221678 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.221706 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25458] 10:12:35.221740 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.221776 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:35.221801 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25433] 10:12:35.221831 close(11 <unfinished ...>
[pid 25461] 10:12:35.221863 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.221887 <... open resumed> ) = 7
[pid 25457] 10:12:35.221903 <... ioctl resumed> , 0x7ffd7b06bcf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:35.221918 <... socket resumed> ) = 16
[pid 25433] 10:12:35.221940 <... close resumed> ) = 0
[pid 25461] 10:12:35.221964 <... lseek resumed> ) = 1279
[pid 25458] 10:12:35.221981 fstat(7,  <unfinished ...>
[pid 25457] 10:12:35.222004 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.222026 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25433] 10:12:35.222055 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25461] 10:12:35.222090 read(7,  <unfinished ...>
[pid 25458] 10:12:35.222114 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25457] 10:12:35.222144 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.222157 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25433] 10:12:35.222204 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.222232 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25458] 10:12:35.222271 fstat(7,  <unfinished ...>
[pid 25457] 10:12:35.222296 read(13,  <unfinished ...>
[pid 25443] 10:12:35.222323 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:35.222349 close(10 <unfinished ...>
[pid 25461] 10:12:35.222381 close(7 <unfinished ...>
[pid 25458] 10:12:35.222405 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25457] 10:12:35.222433 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25443] 10:12:35.222450 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25433] 10:12:35.222896 <... close resumed> ) = 0
[pid 25461] 10:12:35.222933 <... close resumed> ) = 0
[pid 25458] 10:12:35.222951 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.222980 brk(0x861000 <unfinished ...>
[pid 25443] 10:12:35.223004 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:35.223029 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25461] 10:12:35.223065 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25458] 10:12:35.223093 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.223111 <... brk resumed> ) = 0x861000
[pid 25443] 10:12:35.223125 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:35.223306 <... munmap resumed> ) = 0
[pid 25467] 10:12:35.223343 <... brk resumed> ) = 0x1462000
[pid 25461] 10:12:35.223358 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.223551 read(7,  <unfinished ...>
[pid 25457] 10:12:35.223593 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.223627 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:35.223652 clone( <unfinished ...>
[pid 25461] 10:12:35.223960 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25458] 10:12:35.223999 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25457] 10:12:35.224028 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.224044 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25461] 10:12:35.224076 <... open resumed> ) = 7
[pid 25458] 10:12:35.224095 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.224119 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:35.224144 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25468
[pid 25461] 10:12:35.224184 fcntl(7, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.224210 <... lseek resumed> ) = 1279
[pid 25443] 10:12:35.224227 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:35.224249 close(18 <unfinished ...>
[pid 25461] 10:12:35.224285 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.224301 read(7,  <unfinished ...>
[pid 25443] 10:12:35.224325 close(16 <unfinished ...>
[pid 25433] 10:12:35.224354 <... close resumed> ) = 0
[pid 25461] 10:12:35.224376 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.224401 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25443] 10:12:35.224433 <... close resumed> ) = 0
[pid 25433] 10:12:35.224453 read(17,  <unfinished ...>
[pid 25461] 10:12:35.224566 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.224754 close(7 <unfinished ...>
[pid 25443] 10:12:35.224782 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25467] 10:12:35.224965 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25461] 10:12:35.224991 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.225014 <... close resumed> ) = 0
[pid 25457] 10:12:35.225031 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.225052 <... open resumed> ) = 16
[pid 25461] 10:12:35.225078 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370418, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.225113 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25443] 10:12:35.225144 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.225172 write(7, "2015-12-30 10:12:35 [25461] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMX-0006bg-Lo\n", 108 <unfinished ...>
[pid 25458] 10:12:35.225203 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.225231 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.225267 <... write resumed> ) = 108
[pid 25458] 10:12:35.225287 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25443] 10:12:35.225318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.225353 chdir("/var/spool/exim" <unfinished ...>
[pid 25458] 10:12:35.225383 <... open resumed> ) = 7
[pid 25443] 10:12:35.225401 <... mmap resumed> ) = 0x7fdec5ab1000
[pid 25461] 10:12:35.225423 <... chdir resumed> ) = 0
[pid 25458] 10:12:35.225443 fcntl(7, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.225467 read(16,  <unfinished ...>
[pid 25461] 10:12:35.225589 geteuid( <unfinished ...>
[pid 25458] 10:12:35.225615 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.225631 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25461] 10:12:35.225659 <... geteuid resumed> ) = 0
[pid 25458] 10:12:35.225677 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.225701 read(16,  <unfinished ...>
[pid 25461] 10:12:35.225732 getegid( <unfinished ...>
[pid 25458] 10:12:35.225760 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.225777 <... read resumed> "", 1024) = 0
[pid 25461] 10:12:35.225808 <... getegid resumed> ) = 12
[pid 25458] 10:12:35.225839 fstat(7,  <unfinished ...>
[pid 25443] 10:12:35.225871 read(16,  <unfinished ...>
[pid 25461] 10:12:35.225903 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.225933 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370526, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.225965 <... read resumed> "", 1024) = 0
[pid 25461] 10:12:35.225990 <... open resumed> ) = 8
[pid 25458] 10:12:35.226010 write(7, "2015-12-30 10:12:35 [25458] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMY-0006cO-Sq\n", 92 <unfinished ...>
[pid 25443] 10:12:35.226040 close(16 <unfinished ...>
[pid 25461] 10:12:35.226073 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.226097 <... write resumed> ) = 92
[pid 25443] 10:12:35.226115 <... close resumed> ) = 0
[pid 25461] 10:12:35.226138 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.226166 chdir("/var/spool/exim" <unfinished ...>
[pid 25443] 10:12:35.226193 munmap(0x7fdec5ab1000, 4096 <unfinished ...>
[pid 25461] 10:12:35.226230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.226265 <... chdir resumed> ) = 0
[pid 25443] 10:12:35.226284 <... munmap resumed> ) = 0
[pid 25467] 10:12:35.226409 <... open resumed> ) = 7
[pid 25461] 10:12:35.226432 <... mmap resumed> ) = 0x7f2b29364000
[pid 25458] 10:12:35.226458 setgid(12 <unfinished ...>
[pid 25457] 10:12:35.226556 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.226581 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25467] 10:12:35.226619 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.226642 read(8,  <unfinished ...>
[pid 25458] 10:12:35.226669 <... setgid resumed> ) = 0
[pid 25457] 10:12:35.226714 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.226748 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25467] 10:12:35.226805 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25461] 10:12:35.226836 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.226870 read(6,  <unfinished ...>
[pid 25457] 10:12:35.226900 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.226918 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25467] 10:12:35.226955 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25461] 10:12:35.226983 close(8 <unfinished ...>
[pid 25458] 10:12:35.227007 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25457] 10:12:35.227068 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.227097 <... open resumed> ) = 16
[pid 25467] 10:12:35.227124 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25461] 10:12:35.227142 <... close resumed> ) = 0
[pid 25458] 10:12:35.227164 read(6,  <unfinished ...>
[pid 25457] 10:12:35.227196 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.227218 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25467] 10:12:35.227251 read(7,  <unfinished ...>
[pid 25461] 10:12:35.227279 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25458] 10:12:35.227307 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25457] 10:12:35.227375 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.227414 <... ioctl resumed> , 0x7ffd9471ada0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25467] 10:12:35.227441 <... read resumed> "\344\264\232]W\343\20yI\372\tbA\315\254B\22\342F\236/\352\0\21\354\356Md\37\376z\211\30m\232g\10%\326\241\305\2715d\266\313\260D", 48) = 48
[pid 25461] 10:12:35.227458 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.227564 read(6,  <unfinished ...>
[pid 25457] 10:12:35.227601 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.227620 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25467] 10:12:35.227655 close(7 <unfinished ...>
[pid 25461] 10:12:35.227678 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.227711 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25457] 10:12:35.227768 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.227800 <... lseek resumed> ) = 0
[pid 25467] 10:12:35.227826 <... close resumed> ) = 0
[pid 25461] 10:12:35.227840 <... open resumed> ) = 8
[pid 25458] 10:12:35.227874 read(6,  <unfinished ...>
[pid 25457] 10:12:35.227900 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.227921 fstat(16,  <unfinished ...>
[pid 25467] 10:12:35.227953 getuid( <unfinished ...>
[pid 25461] 10:12:35.227975 read(8,  <unfinished ...>
[pid 25458] 10:12:35.227999 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25457] 10:12:35.228057 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.228089 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25467] 10:12:35.228128 <... getuid resumed> ) = 47
[pid 25461] 10:12:35.228142 <... read resumed> "65536\n", 31) = 6
[pid 25458] 10:12:35.228295 read(6,  <unfinished ...>
[pid 25457] 10:12:35.228325 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.228344 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25467] 10:12:35.228379 exit_group(0) = ?
[pid 25461] 10:12:35.228392 close(8 <unfinished ...>
[pid 25458] 10:12:35.228710 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25457] 10:12:35.228795 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.228847 <... fcntl resumed> ) = 0
[pid 25467] 10:12:35.228897 +++ exited with 0 +++
[pid 25461] 10:12:35.228914 <... close resumed> ) = 0
[pid 25460] 10:12:35.228937 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25467
[pid 25458] 10:12:35.228959 read(6,  <unfinished ...>
[pid 25457] 10:12:35.228984 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.229005 read(16,  <unfinished ...>
[pid 25461] 10:12:35.229038 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.229067 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25458] 10:12:35.229095 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25457] 10:12:35.229190 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.229228 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25461] 10:12:35.229453 <... open resumed> ) = 8
[pid 25460] 10:12:35.229552 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, 8) = 0
[pid 25458] 10:12:35.229609 read(6,  <unfinished ...>
[pid 25457] 10:12:35.229645 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.229665 close(16 <unfinished ...>
[pid 25461] 10:12:35.229699 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.229722 getcwd( <unfinished ...>
[pid 25458] 10:12:35.229748 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25457] 10:12:35.229806 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.229843 <... close resumed> ) = 0
[pid 25461] 10:12:35.229891 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25460] 10:12:35.229926 <... getcwd resumed> "/home/finest09/public_html/includes", 16380) = 36
[pid 25458] 10:12:35.229978 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.230012 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.230034 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25461] 10:12:35.230077 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.230104 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.230132 <... open resumed> ) = 8
[pid 25457] 10:12:35.230149 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25443] 10:12:35.230179 <... open resumed> ) = 16
[pid 25461] 10:12:35.230203 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.230220 <... open resumed> ) = 7
[pid 25458] 10:12:35.230237 fstat(8,  <unfinished ...>
[pid 25457] 10:12:35.230260 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.230277 alarm(60 <unfinished ...>
[pid 25461] 10:12:35.230310 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.230338 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.230362 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25457] 10:12:35.230392 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.230423 <... alarm resumed> ) = 0
[pid 25461] 10:12:35.230448 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.230468 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.230585 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.230612 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:35.230648 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25461] 10:12:35.230686 read(8,  <unfinished ...>
[pid 25460] 10:12:35.230713 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.230736 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.230753 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.230784 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.230808 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25460] 10:12:35.230840 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.230868 read(8,  <unfinished ...>
[pid 25457] 10:12:35.230894 <... open resumed> ) = 14
[pid 25443] 10:12:35.230912 alarm(0 <unfinished ...>
[pid 25461] 10:12:35.230944 read(8,  <unfinished ...>
[pid 25460] 10:12:35.230967 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.230993 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25457] 10:12:35.231019 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:35.231045 <... alarm resumed> ) = 60
[pid 25461] 10:12:35.231081 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.231104 <... mmap resumed> ) = 0x7f9083402000
[pid 25458] 10:12:35.231121 close(8 <unfinished ...>
[pid 25457] 10:12:35.231145 <... ioctl resumed> , 0x7ffd7b06b700) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:35.231164 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.231207 close(8 <unfinished ...>
[pid 25460] 10:12:35.231232 read(7,  <unfinished ...>
[pid 25458] 10:12:35.231258 <... close resumed> ) = 0
[pid 25457] 10:12:35.231274 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.231297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.231321 <... close resumed> ) = 0
[pid 25460] 10:12:35.231337 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25458] 10:12:35.231370 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25457] 10:12:35.231400 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.231438 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.231586 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.231617 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.231641 <... munmap resumed> ) = 0
[pid 25457] 10:12:35.231722 read(14,  <unfinished ...>
[pid 25443] 10:12:35.231751 <... open resumed> ) = 17
[pid 25461] 10:12:35.231776 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.231797 <... lseek resumed> ) = 1279
[pid 25458] 10:12:35.231815 read(6,  <unfinished ...>
[pid 25457] 10:12:35.231839 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25443] 10:12:35.232149 read(17,  <unfinished ...>
[pid 25461] 10:12:35.232213 setgroups(1, [12] <unfinished ...>
[pid 25460] 10:12:35.232241 read(7,  <unfinished ...>
[pid 25458] 10:12:35.232265 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25457] 10:12:35.232347 read(14,  <unfinished ...>
[pid 25443] 10:12:35.232379 <... read resumed> "cpu  123058 1342392 395134 67343095 2509 0 0 0\ncpu0 123058 1342392 395134 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58332801\nbtime 1450798266\nprocesses 892946\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25461] 10:12:35.232409 <... setgroups resumed> ) = 0
[pid 25460] 10:12:35.232427 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25458] 10:12:35.232460 read(6,  <unfinished ...>
[pid 25457] 10:12:35.232557 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25443] 10:12:35.233135 close(17 <unfinished ...>
[pid 25461] 10:12:35.233187 setgid(12 <unfinished ...>
[pid 25460] 10:12:35.233212 close(7 <unfinished ...>
[pid 25458] 10:12:35.233237 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25457] 10:12:35.233354 brk(0x882000 <unfinished ...>
[pid 25443] 10:12:35.233385 <... close resumed> ) = 0
[pid 25461] 10:12:35.233425 <... setgid resumed> ) = 0
[pid 25460] 10:12:35.233443 <... close resumed> ) = 0
[pid 25458] 10:12:35.233460 read(6,  <unfinished ...>
[pid 25457] 10:12:35.233544 <... brk resumed> ) = 0x882000
[pid 25443] 10:12:35.233733 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25461] 10:12:35.233783 setuid(47 <unfinished ...>
[pid 25460] 10:12:35.233808 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.233838 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25457] 10:12:35.233951 read(14,  <unfinished ...>
[pid 25443] 10:12:35.233980 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25461] 10:12:35.234023 <... setuid resumed> ) = 0
[pid 25460] 10:12:35.234067 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.234099 read(6,  <unfinished ...>
[pid 25457] 10:12:35.234126 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25443] 10:12:35.234594 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.234652 read(6,  <unfinished ...>
[pid 25460] 10:12:35.234682 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25458] 10:12:35.234715 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25457] 10:12:35.234831 read(14,  <unfinished ...>
[pid 25443] 10:12:35.234866 <... open resumed> ) = 17
[pid 25461] 10:12:35.234892 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25460] 10:12:35.234956 <... open resumed> ) = 7
[pid 25458] 10:12:35.234976 read(6,  <unfinished ...>
[pid 25457] 10:12:35.235000 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:35.235019 fcntl(17, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.235051 read(6,  <unfinished ...>
[pid 25460] 10:12:35.235075 fcntl(7, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.235097 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25457] 10:12:35.235133 close(14 <unfinished ...>
[pid 25443] 10:12:35.235160 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.235184 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25460] 10:12:35.235257 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.235276 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.235306 <... close resumed> ) = 0
[pid 25443] 10:12:35.236089 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.236142 read(6,  <unfinished ...>
[pid 25460] 10:12:35.236169 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.236192 <... open resumed> ) = 8
[pid 25457] 10:12:35.236210 read(13,  <unfinished ...>
[pid 25443] 10:12:35.236235 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.236261 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25460] 10:12:35.236333 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.236364 fstat(8,  <unfinished ...>
[pid 25457] 10:12:35.236392 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25443] 10:12:35.236411 read(17,  <unfinished ...>
[pid 25461] 10:12:35.237208 read(6,  <unfinished ...>
[pid 25460] 10:12:35.237294 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.237321 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25457] 10:12:35.237355 read(13,  <unfinished ...>
[pid 25443] 10:12:35.237381 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25461] 10:12:35.237418 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25460] 10:12:35.237538 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370618, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.237580 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.237610 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25443] 10:12:35.237628 close(17 <unfinished ...>
[pid 25461] 10:12:35.238330 read(6,  <unfinished ...>
[pid 25460] 10:12:35.238362 write(7, "2015-12-30 10:12:35 [25460] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101 <unfinished ...>
[pid 25458] 10:12:35.238394 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.238412 read(13,  <unfinished ...>
[pid 25443] 10:12:35.238438 <... close resumed> ) = 0
[pid 25461] 10:12:35.238469 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25460] 10:12:35.238615 <... write resumed> ) = 101
[pid 25458] 10:12:35.238642 read(8,  <unfinished ...>
[pid 25457] 10:12:35.238671 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25443] 10:12:35.238690 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.239269 read(6,  <unfinished ...>
[pid 25460] 10:12:35.239299 chdir("/var/spool/exim" <unfinished ...>
[pid 25458] 10:12:35.239330 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25457] 10:12:35.239364 brk(0x8a3000 <unfinished ...>
[pid 25443] 10:12:35.239395 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.239430 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25460] 10:12:35.239600 <... chdir resumed> ) = 0
[pid 25458] 10:12:35.239629 close(8 <unfinished ...>
[pid 25457] 10:12:35.239656 <... brk resumed> ) = 0x8a3000
[pid 25443] 10:12:35.239670 stat("/var/tmp",  <unfinished ...>
[pid 25461] 10:12:35.239760 read(6,  <unfinished ...>
[pid 25460] 10:12:35.239787 geteuid( <unfinished ...>
[pid 25458] 10:12:35.239809 <... close resumed> ) = 0
[pid 25457] 10:12:35.239825 read(13,  <unfinished ...>
[pid 25443] 10:12:35.239849 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25461] 10:12:35.239909 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25460] 10:12:35.239965 <... geteuid resumed> ) = 0
[pid 25458] 10:12:35.239985 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25457] 10:12:35.240014 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25443] 10:12:35.240032 brk(0x1e8f000 <unfinished ...>
[pid 25461] 10:12:35.240721 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.240758 getegid( <unfinished ...>
[pid 25458] 10:12:35.240782 <... munmap resumed> ) = 0
[pid 25457] 10:12:35.240810 read(13,  <unfinished ...>
[pid 25443] 10:12:35.240838 <... brk resumed> ) = 0x1e8f000
[pid 25461] 10:12:35.240979 <... open resumed> ) = 8
[pid 25460] 10:12:35.241001 <... getegid resumed> ) = 499
[pid 25458] 10:12:35.241030 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.241062 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25443] 10:12:35.241081 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.241661 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.241689 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.241719 <... open resumed> ) = 8
[pid 25457] 10:12:35.241737 brk(0x8c4000 <unfinished ...>
[pid 25443] 10:12:35.241762 <... open resumed> ) = 17
[pid 25461] 10:12:35.241786 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.241818 <... open resumed> ) = 8
[pid 25458] 10:12:35.241837 fstat(8,  <unfinished ...>
[pid 25457] 10:12:35.241861 <... brk resumed> ) = 0x8c4000
[pid 25443] 10:12:35.241875 fcntl(17, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.242346 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.242379 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.242403 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25457] 10:12:35.242435 read(13,  <unfinished ...>
[pid 25443] 10:12:35.242461 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.242549 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.242575 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.242605 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.242632 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25443] 10:12:35.242650 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.243183 read(8,  <unfinished ...>
[pid 25460] 10:12:35.243215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.243243 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.243260 read(13,  <unfinished ...>
[pid 25443] 10:12:35.243285 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.243311 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.243340 <... mmap resumed> ) = 0x7f9083402000
[pid 25458] 10:12:35.243357 read(8,  <unfinished ...>
[pid 25457] 10:12:35.243385 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25443] 10:12:35.243403 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.243862 close(8 <unfinished ...>
[pid 25460] 10:12:35.243892 read(8,  <unfinished ...>
[pid 25458] 10:12:35.243920 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25457] 10:12:35.243952 brk(0x8e5000 <unfinished ...>
[pid 25443] 10:12:35.243973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25461] 10:12:35.244037 <... close resumed> ) = 0
[pid 25460] 10:12:35.244058 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.244086 close(8 <unfinished ...>
[pid 25457] 10:12:35.244111 <... brk resumed> ) = 0x8e5000
[pid 25443] 10:12:35.244125 pread(17,  <unfinished ...>
[pid 25461] 10:12:35.244418 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.244451 close(8 <unfinished ...>
[pid 25458] 10:12:35.244544 <... close resumed> ) = 0
[pid 25457] 10:12:35.244568 read(13,  <unfinished ...>
[pid 25443] 10:12:35.244589 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25461] 10:12:35.244644 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.244741 <... close resumed> ) = 0
[pid 25458] 10:12:35.244763 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25443] 10:12:35.244792 pread(17,  <unfinished ...>
[pid 25461] 10:12:35.244824 read(6,  <unfinished ...>
[pid 25460] 10:12:35.244848 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.244874 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.244918 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25461] 10:12:35.244968 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25460] 10:12:35.245050 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.245074 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.245105 pread(17,  <unfinished ...>
[pid 25461] 10:12:35.245136 read(6,  <unfinished ...>
[pid 25460] 10:12:35.245161 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.245193 <... open resumed> ) = 8
[pid 25443] 10:12:35.245210 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25461] 10:12:35.245265 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25460] 10:12:35.245379 <... open resumed> ) = 8
[pid 25458] 10:12:35.245401 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.245426 close(17 <unfinished ...>
[pid 25461] 10:12:35.245463 read(6,  <unfinished ...>
[pid 25460] 10:12:35.245578 read(8,  <unfinished ...>
[pid 25458] 10:12:35.245606 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.245638 <... close resumed> ) = 0
[pid 25461] 10:12:35.245681 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25460] 10:12:35.245792 <... read resumed> "65536\n", 31) = 6
[pid 25458] 10:12:35.245814 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.245842 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25443] 10:12:35.245860 close(16 <unfinished ...>
[pid 25461] 10:12:35.246576 read(6,  <unfinished ...>
[pid 25460] 10:12:35.246607 close(8 <unfinished ...>
[pid 25458] 10:12:35.246631 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.246649 read(13,  <unfinished ...>
[pid 25452] 10:12:35.246670 <... read resumed> "\26\3\1\0\312", 5) = 5
[pid 25443] 10:12:35.246692 <... close resumed> ) = 0
[pid 25461] 10:12:35.246728 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25460] 10:12:35.246841 <... close resumed> ) = 0
[pid 25458] 10:12:35.246869 read(8,  <unfinished ...>
[pid 25452] 10:12:35.246897 read(11,  <unfinished ...>
[pid 25443] 10:12:35.246922 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.246955 read(6,  <unfinished ...>
[pid 25460] 10:12:35.246978 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.247008 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25452] 10:12:35.247038 <... read resumed> "\4\0\0\306\0\0\0\0\0\300W)\377\6\33\255^\f\5O\230\253\367\246\310\354=@\234\"4@\261ua\200\352QL\23(\266\303r\255\32B\31R\301\30\254n\274\25\302W8\226\240s\37|qJ\327\265\223\220\277o\322\377\314@\311\367\302\342\224A\363\5\244t\221\367\202\"\331\251\24<\312\311\360\t2\"Y\227\330\261p\262\337\275,\225\2\352\20(\1\246\351\204kl\341\241l\231\322\273i\231\250K`\310\20T\2\n\331\235#\2330v9?j\310\324\313\32z\r\256\231\353\257\215\205a\263\\\304\362\24[\353\3\250+\177x6'\212\350fx\5\225\243\220\210A\237\275\3%#^\363\337\213\21Dbz\212\324\237W\225+;\371", 202) = 202
[pid 25443] 10:12:35.247086 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.247114 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25460] 10:12:35.247152 <... open resumed> ) = 8
[pid 25458] 10:12:35.247180 close(8 <unfinished ...>
[pid 25452] 10:12:35.247206 read(11,  <unfinished ...>
[pid 25443] 10:12:35.247229 read(13,  <unfinished ...>
[pid 25461] 10:12:35.247261 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.247290 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.247313 <... close resumed> ) = 0
[pid 25452] 10:12:35.247328 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25443] 10:12:35.247347 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25461] 10:12:35.247390 <... open resumed> ) = 8
[pid 25460] 10:12:35.247409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:35.247440 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25452] 10:12:35.247469 read(11,  <unfinished ...>
[pid 25443] 10:12:35.247583 stat("/jail_owner",  <unfinished ...>
[pid 25461] 10:12:35.247621 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.247645 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.247671 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.247765 <... read resumed> "\1", 1) = 1
[pid 25443] 10:12:35.247833 <... stat resumed> 0x7ffd94719780) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.247870 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.247903 <... mmap resumed> ) = 0x7f9083402000
[pid 25458] 10:12:35.247920 read(6,  <unfinished ...>
[pid 25452] 10:12:35.247945 read(11,  <unfinished ...>
[pid 25443] 10:12:35.247968 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25461] 10:12:35.248010 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.248036 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.248059 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25452] 10:12:35.248172 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25443] 10:12:35.248194 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25461] 10:12:35.248240 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.248259 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.248279 read(6,  <unfinished ...>
[pid 25452] 10:12:35.248304 read(11,  <unfinished ...>
[pid 25443] 10:12:35.248331 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25461] 10:12:35.248369 read(8,  <unfinished ...>
[pid 25460] 10:12:35.248396 read(8,  <unfinished ...>
[pid 25458] 10:12:35.248422 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25452] 10:12:35.248578 <... read resumed> "b\3235\351\24B1XN#\324\3317/\353\204\264\265e\361wP\243\302\252\367\206QPJ^0/\371O\323*\257\343Q%\373\302\261Y>\243\30", 48) = 48
[pid 25443] 10:12:35.248661 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.248700 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.248733 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:35.248764 read(6,  <unfinished ...>
[pid 25452] 10:12:35.248788 alarm(0 <unfinished ...>
[pid 25443] 10:12:35.248812 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25461] 10:12:35.248854 close(8 <unfinished ...>
[pid 25460] 10:12:35.248880 read(8,  <unfinished ...>
[pid 25458] 10:12:35.248902 <... read resumed> "", 4096) = 0
[pid 25452] 10:12:35.248921 <... alarm resumed> ) = 300
[pid 25443] 10:12:35.248966 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25461] 10:12:35.249014 <... close resumed> ) = 0
[pid 25460] 10:12:35.249031 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:35.249052 read(6,  <unfinished ...>
[pid 25457] 10:12:35.249076 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25452] 10:12:35.249093 write(11, "\27\3\1\0 l6\4\346\0029\303\n\321Qo\350\0\332\352\244%\205\240y\n\245\360OA\200\222ro\351f\327\27\3\1\0@^\306\236\23\274\20\177kC\364\302\16>\304\231\350\253\305w\246\362\312/\237z$q^O\224\225\351\355h4\27AJ@+\241{;\350U\266\304\256\270\221\25}\0040ya\361zzl\214\204\370\300", 106 <unfinished ...>
[pid 25443] 10:12:35.249406 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25461] 10:12:35.249452 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.249584 close(8 <unfinished ...>
[pid 25458] 10:12:35.249618 <... read resumed> "", 4096) = 0
[pid 25457] 10:12:35.249640 brk(0x906000 <unfinished ...>
[pid 25452] 10:12:35.249662 <... write resumed> ) = 106
[pid 25443] 10:12:35.249683 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.249715 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.249748 <... close resumed> ) = 0
[pid 25458] 10:12:35.249768 close(6 <unfinished ...>
[pid 25452] 10:12:35.249792 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.249822 stat("/etc/demouids",  <unfinished ...>
[pid 25461] 10:12:35.249856 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.249885 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.249912 <... close resumed> ) = 0
[pid 25443] 10:12:35.249929 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.249983 <... open resumed> ) = 8
[pid 25460] 10:12:35.250003 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.250023 munmap(0x7f03f4be9000, 4096 <unfinished ...>
[pid 25443] 10:12:35.250051 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.250091 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.250115 setgroups(1, [12] <unfinished ...>
[pid 25458] 10:12:35.250140 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.250180 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.250292 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25460] 10:12:35.250329 <... setgroups resumed> ) = 0
[pid 25458] 10:12:35.250347 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f03f3a9f790},  <unfinished ...>
[pid 25457] 10:12:35.250377 <... brk resumed> ) = 0x906000
[pid 25443] 10:12:35.250392 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.251054 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.251089 setgid(12 <unfinished ...>
[pid 25458] 10:12:35.251115 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25457] 10:12:35.251144 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.251171 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.251230 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.251250 <... setgid resumed> ) = 0
[pid 25458] 10:12:35.251267 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25443] 10:12:35.251304 stat("/home/finest09/etc/finestweddingsites.com", Process 25468 attached
 <unfinished ...>
[pid 25461] 10:12:35.251381 read(8,  <unfinished ...>
[pid 25460] 10:12:35.251411 setuid(47 <unfinished ...>
[pid 25458] 10:12:35.251436 <... open resumed> ) = 6
[pid 25443] 10:12:35.251452 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25468] 10:12:35.251566 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25461] 10:12:35.251596 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25460] 10:12:35.251628 <... setuid resumed> ) = 0
[pid 25458] 10:12:35.251673 fcntl(6, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.251699 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25468] 10:12:35.251737 <... set_robust_list resumed> ) = 0
[pid 25461] 10:12:35.251751 close(8 <unfinished ...>
[pid 25460] 10:12:35.251804 read(6,  <unfinished ...>
[pid 25458] 10:12:35.251831 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.251848 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25468] 10:12:35.251895 close(17 <unfinished ...>
[pid 25461] 10:12:35.251920 <... close resumed> ) = 0
[pid 25460] 10:12:35.251936 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25458] 10:12:35.251996 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.252022 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25468] 10:12:35.252067 <... close resumed> ) = 0
[pid 25461] 10:12:35.252081 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.252121 read(6,  <unfinished ...>
[pid 25458] 10:12:35.252147 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.252162 <... open resumed> ) = 16
[pid 25468] 10:12:35.252187 geteuid( <unfinished ...>
[pid 25461] 10:12:35.252209 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.252251 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25458] 10:12:35.252322 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25443] 10:12:35.252353 fstat(16,  <unfinished ...>
[pid 25468] 10:12:35.252385 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.252399 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.252430 read(6,  <unfinished ...>
[pid 25458] 10:12:35.252454 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.252470 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25468] 10:12:35.252597 getegid( <unfinished ...>
[pid 25461] 10:12:35.252621 <... open resumed> ) = 8
[pid 25460] 10:12:35.252638 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25458] 10:12:35.252697 fstat(6,  <unfinished ...>
[pid 25443] 10:12:35.252722 fstat(16,  <unfinished ...>
[pid 25468] 10:12:35.252752 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.252766 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.252795 read(6,  <unfinished ...>
[pid 25458] 10:12:35.252820 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:35.252857 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25468] 10:12:35.252894 setgid(500 <unfinished ...>
[pid 25461] 10:12:35.252923 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25460] 10:12:35.252951 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25458] 10:12:35.253021 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-H", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.253057 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25468] 10:12:35.253095 <... setgid resumed> ) = 0
[pid 25461] 10:12:35.253109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.253136 read(6,  <unfinished ...>
[pid 25458] 10:12:35.253159 <... open resumed> ) = 8
[pid 25457] 10:12:35.253176 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.253192 <... mmap resumed> ) = 0x7fdec5ab1000
[pid 25468] 10:12:35.253226 setuid(503 <unfinished ...>
[pid 25461] 10:12:35.253250 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.253267 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25458] 10:12:35.253340 fstat(8,  <unfinished ...>
[pid 25457] 10:12:35.253369 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.253396 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25468] 10:12:35.253429 <... setuid resumed> ) = 0
[pid 25461] 10:12:35.253443 read(8,  <unfinished ...>
[pid 25460] 10:12:35.253596 read(6,  <unfinished ...>
[pid 25458] 10:12:35.253623 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800102, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1127, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25457] 10:12:35.253653 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.253672 <... lseek resumed> ) = 0
[pid 25468] 10:12:35.253709 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.253742 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25460] 10:12:35.253772 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25458] 10:12:35.253867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.253899 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.253926 read(16,  <unfinished ...>
[pid 25468] 10:12:35.253962 <... open resumed> ) = 9
[pid 25461] 10:12:35.253975 close(8 <unfinished ...>
[pid 25460] 10:12:35.254009 read(6,  <unfinished ...>
[pid 25458] 10:12:35.254033 <... mmap resumed> ) = 0x7f03f4be9000
[pid 25457] 10:12:35.254050 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.254065 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25468] 10:12:35.254136 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.254166 <... close resumed> ) = 0
[pid 25460] 10:12:35.254183 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25458] 10:12:35.254237 read(8,  <unfinished ...>
[pid 25457] 10:12:35.254268 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.254293 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25468] 10:12:35.254334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.254363 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.254601 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.254641 <... read resumed> "1aEJMY-0006cO-Sq-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1127
[pid 25457] 10:12:35.254698 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.254717 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4102, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25468] 10:12:35.254782 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.254810 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.254897 <... open resumed> ) = 8
[pid 25458] 10:12:35.254917 read(8,  <unfinished ...>
[pid 25457] 10:12:35.254941 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.254967 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25468] 10:12:35.255009 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25461] 10:12:35.255035 read(6,  <unfinished ...>
[pid 25460] 10:12:35.255063 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.255086 <... read resumed> "", 4096) = 0
[pid 25457] 10:12:35.255103 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.255118 <... open resumed> ) = 17
[pid 25468] 10:12:35.255148 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.255176 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25460] 10:12:35.255286 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.255320 close(8 <unfinished ...>
[pid 25457] 10:12:35.255349 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.255376 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25468] 10:12:35.255412 <... mmap resumed> ) = 0x7fea0f284000
[pid 25461] 10:12:35.255428 read(6,  <unfinished ...>
[pid 25460] 10:12:35.255455 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.255569 <... close resumed> ) = 0
[pid 25457] 10:12:35.255593 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.255609 <... ioctl resumed> , 0x7ffd94716720) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25468] 10:12:35.255643 read(9,  <unfinished ...>
[pid 25461] 10:12:35.255681 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25460] 10:12:35.255769 <... mmap resumed> ) = 0x7f9083402000
[pid 25458] 10:12:35.255792 munmap(0x7f03f4be9000, 4096 <unfinished ...>
[pid 25457] 10:12:35.255820 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.255856 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25468] 10:12:35.255890 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25461] 10:12:35.255914 read(6,  <unfinished ...>
[pid 25460] 10:12:35.255940 read(8,  <unfinished ...>
[pid 25458] 10:12:35.255967 <... munmap resumed> ) = 0
[pid 25457] 10:12:35.255987 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.256003 <... lseek resumed> ) = 0
[pid 25468] 10:12:35.256031 read(9,  <unfinished ...>
[pid 25461] 10:12:35.256059 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.256078 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.256105 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-J", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.256142 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.256171 fstat(17,  <unfinished ...>
[pid 25468] 10:12:35.256204 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25461] 10:12:35.256222 read(6,  <unfinished ...>
[pid 25460] 10:12:35.256250 close(8 <unfinished ...>
[pid 25458] 10:12:35.256274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.256296 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.256313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4102, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25468] 10:12:35.256437 close(9 <unfinished ...>
[pid 25461] 10:12:35.256462 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.256574 <... close resumed> ) = 0
[pid 25458] 10:12:35.256601 open("/var/spool/exim/msglog/Y/1aEJMY-0006cO-Sq", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25457] 10:12:35.256639 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.256668 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25468] 10:12:35.256702 <... close resumed> ) = 0
[pid 25461] 10:12:35.256715 close(6 <unfinished ...>
[pid 25460] 10:12:35.256741 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.256768 <... open resumed> ) = 8
[pid 25457] 10:12:35.256785 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.256800 <... fcntl resumed> ) = 0
[pid 25468] 10:12:35.256834 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25461] 10:12:35.256860 <... close resumed> ) = 0
[pid 25460] 10:12:35.256877 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.256958 fcntl(8, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.256985 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.257015 read(17,  <unfinished ...>
[pid 25468] 10:12:35.257049 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.257063 munmap(0x7f2b29365000, 4096 <unfinished ...>
[pid 25460] 10:12:35.257542 read(6,  <unfinished ...>
[pid 25458] 10:12:35.257572 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.257589 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.257605 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4102
[pid 25468] 10:12:35.258397 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.258429 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.258451 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25458] 10:12:35.258585 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.258618 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.258651 read(17,  <unfinished ...>
[pid 25468] 10:12:35.258684 <... lseek resumed> ) = 19
[pid 25461] 10:12:35.258698 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.258738 read(6,  <unfinished ...>
[pid 25458] 10:12:35.258764 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.258790 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.258809 <... read resumed> "", 8192) = 0
[pid 25468] 10:12:35.258842 read(6,  <unfinished ...>
[pid 25461] 10:12:35.258867 <... open resumed> ) = 6
[pid 25460] 10:12:35.258884 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25458] 10:12:35.258987 fchown(8, 47, 12 <unfinished ...>
[pid 25457] 10:12:35.259021 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.259050 close(17 <unfinished ...>
[pid 25468] 10:12:35.259085 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2413) = 1858
[pid 25461] 10:12:35.259103 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.259652 read(6,  <unfinished ...>
[pid 25458] 10:12:35.259680 <... fchown resumed> ) = 0
[pid 25457] 10:12:35.259699 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.259720 <... close resumed> ) = 0
[pid 25468] 10:12:35.259781 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.259825 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.259857 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25458] 10:12:35.259968 fchmod(8, 0640 <unfinished ...>
[pid 25457] 10:12:35.259999 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.260029 stat("/etc/userdomains",  <unfinished ...>
[pid 25468] 10:12:35.260067 <... write resumed> ) = 4
[pid 25461] 10:12:35.260080 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.260109 read(6,  <unfinished ...>
[pid 25458] 10:12:35.260133 <... fchmod resumed> ) = 0
[pid 25457] 10:12:35.260154 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.260170 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.260228 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25468] 10:12:35.260263 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.260288 <... mmap resumed> ) = 0x7f2b29365000
[pid 25460] 10:12:35.260305 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25458] 10:12:35.260404 fcntl(8, F_GETFL <unfinished ...>
[pid 25457] 10:12:35.260431 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.260545 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.260575 read(17,  <unfinished ...>
[pid 25468] 10:12:35.260609 <... write resumed> ) = 4
[pid 25461] 10:12:35.260622 read(6,  <unfinished ...>
[pid 25460] 10:12:35.260651 read(6,  <unfinished ...>
[pid 25458] 10:12:35.260675 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25457] 10:12:35.260693 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:35.260721 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.260772 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25468] 10:12:35.260809 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.260839 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.260866 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25458] 10:12:35.260904 fstat(8,  <unfinished ...>
[pid 25457] 10:12:35.260930 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.260960 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.260987 read(17,  <unfinished ...>
[pid 25468] 10:12:35.261021 <... write resumed> ) = 4
[pid 25461] 10:12:35.261034 close(6 <unfinished ...>
[pid 25460] 10:12:35.261061 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.261088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800124, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25457] 10:12:35.261116 <... open resumed> ) = 14
[pid 25443] 10:12:35.261129 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.261185 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25468] 10:12:35.261221 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25461] 10:12:35.261248 <... close resumed> ) = 0
[pid 25460] 10:12:35.261266 <... open resumed> ) = 8
[pid 25458] 10:12:35.261283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.261317 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:35.261342 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.261371 read(17,  <unfinished ...>
[pid 25468] 10:12:35.261407 <... write resumed> ) = 40
[pid 25461] 10:12:35.261421 munmap(0x7f2b29365000, 4096 <unfinished ...>
[pid 25460] 10:12:35.261451 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.261551 <... mmap resumed> ) = 0x7f03f4be9000
[pid 25457] 10:12:35.261576 <... ioctl resumed> , 0x7ffd7b06b700) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:35.261592 <... open resumed> ) = 17
[pid 25433] 10:12:35.261611 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25468] 10:12:35.261641 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.261666 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.261693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.261724 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.261752 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.261780 fstat(17,  <unfinished ...>
[pid 25433] 10:12:35.261807 read(17,  <unfinished ...>
[pid 25468] 10:12:35.261845 <... write resumed> ) = 4
[pid 25461] 10:12:35.261859 fstat(1,  <unfinished ...>
[pid 25460] 10:12:35.261897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.261953 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.261989 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.262005 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:35.262058 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25468] 10:12:35.262090 close(18 <unfinished ...>
[pid 25461] 10:12:35.262114 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25460] 10:12:35.262154 <... mmap resumed> ) = 0x7f9083402000
[pid 25458] 10:12:35.262174 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25457] 10:12:35.262202 read(14,  <unfinished ...>
[pid 25443] 10:12:35.262226 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.262252 wait4(-1,  <unfinished ...>
[pid 25468] 10:12:35.262283 <... close resumed> ) = 0
[pid 25461] 10:12:35.262296 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.262336 read(8,  <unfinished ...>
[pid 25458] 10:12:35.262363 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.262396 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25443] 10:12:35.262414 <... mmap resumed> ) = 0x7fdec5ab0000
[pid 25468] 10:12:35.262721 exit_group(0) = ?
[pid 25461] 10:12:35.262749 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.263076 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.263121 pipe( <unfinished ...>
[pid 25457] 10:12:35.263152 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.263175 read(17,  <unfinished ...>
[pid 25468] 10:12:35.263224 +++ exited with 0 +++
[pid 25461] 10:12:35.263237 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.263266 close(8 <unfinished ...>
[pid 25458] 10:12:35.263291 <... pipe resumed> [9, 10]) = 0
[pid 25457] 10:12:35.263309 <... lseek resumed> ) = 878
[pid 25443] 10:12:35.263322 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:35.263357 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25468
[pid 25461] 10:12:35.263385 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25460] 10:12:35.263404 <... close resumed> ) = 0
[pid 25458] 10:12:35.263420 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25457] 10:12:35.263446 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.263468 close(17 <unfinished ...>
[pid 25433] 10:12:35.263565 close(17 <unfinished ...>
[pid 25461] 10:12:35.263604 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.263632 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.263660 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f03f3a9f790}, 8) = 0
[pid 25457] 10:12:35.263683 <... lseek resumed> ) = 878
[pid 25443] 10:12:35.263698 <... close resumed> ) = 0
[pid 25433] 10:12:35.263716 <... close resumed> ) = 0
[pid 25461] 10:12:35.263745 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25460] 10:12:35.263773 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.263807 clone( <unfinished ...>
[pid 25457] 10:12:35.264005 close(14 <unfinished ...>
[pid 25443] 10:12:35.264032 munmap(0x7fdec5ab0000, 4096 <unfinished ...>
[pid 25433] 10:12:35.264059 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25461] 10:12:35.264097 fstat(0,  <unfinished ...>
[pid 25460] 10:12:35.264121 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.264150 <... close resumed> ) = 0
[pid 25443] 10:12:35.264164 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.264410 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25461] 10:12:35.264473 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167232, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25460] 10:12:35.264570 <... open resumed> ) = 8
[pid 25458] 10:12:35.264588 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25469
[pid 25457] 10:12:35.264629 read(13,  <unfinished ...>
[pid 25443] 10:12:35.264658 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.264688 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.264723 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.264756 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.264786 close(10 <unfinished ...>
[pid 25457] 10:12:35.264809 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25443] 10:12:35.264834 <... open resumed> ) = 17
[pid 25433] 10:12:35.265330 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.265397 <... mmap resumed> ) = 0x7f2b29365000
[pid 25460] 10:12:35.265420 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:35.265450 <... close resumed> ) = 0
[pid 25457] 10:12:35.265469 brk(0x927000 <unfinished ...>
[pid 25443] 10:12:35.265569 fstat(17,  <unfinished ...>
[pid 25433] 10:12:35.265596 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.265635 read(0,  <unfinished ...>
[pid 25460] 10:12:35.265662 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.265689 read(9,  <unfinished ...>
[pid 25457] 10:12:35.265711 <... brk resumed> ) = 0x927000
[pid 25443] 10:12:35.265725 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:35.265869 <... open resumed> ) = 9
[pid 25461] 10:12:35.265895 <... read resumed> "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3505
[pid 25460] 10:12:35.265966 <... mmap resumed> ) = 0x7f9083402000
[pid 25457] 10:12:35.265989 read(13,  <unfinished ...>
[pid 25443] 10:12:35.266015 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.266043 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.266074 stat("/etc/localtime",  <unfinished ...>
[pid 25460] 10:12:35.266100 read(8,  <unfinished ...>
[pid 25457] 10:12:35.266126 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25443] 10:12:35.266144 <... mmap resumed> ) = 0x7fdec5ab0000
[pid 25433] 10:12:35.267271 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.267331 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.267384 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25457] 10:12:35.267419 brk(0x948000 <unfinished ...>
[pid 25443] 10:12:35.267446 read(17,  <unfinished ...>
[pid 25433] 10:12:35.267529 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.267572 open("/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25460] 10:12:35.267645 close(8 <unfinished ...>
[pid 25457] 10:12:35.267672 <... brk resumed> ) = 0x948000
[pid 25443] 10:12:35.267693 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:35.267829 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.267876 <... open resumed> ) = 6
[pid 25460] 10:12:35.267898 <... close resumed> ) = 0
[pid 25457] 10:12:35.267915 read(13,  <unfinished ...>
[pid 25443] 10:12:35.267941 close(17 <unfinished ...>
[pid 25433] 10:12:35.267966 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.268001 fchown(6, 47, 12 <unfinished ...>
[pid 25460] 10:12:35.268029 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25457] 10:12:35.268057 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25443] 10:12:35.268076 <... close resumed> ) = 0
[pid 25433] 10:12:35.268560 <... mmap resumed> ) = 0x7fea0f284000
[pid 25461] 10:12:35.268596 <... fchown resumed> ) = 0
[pid 25460] 10:12:35.268618 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.268662 munmap(0x7fdec5ab0000, 4096 <unfinished ...>
[pid 25433] 10:12:35.268696 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.268727 fchmod(6, 0640 <unfinished ...>
[pid 25460] 10:12:35.269457 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.269550 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.269580 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.269608 <... fchmod resumed> ) = 0
[pid 25460] 10:12:35.269629 <... open resumed> ) = 8
[pid 25457] 10:12:35.269647 brk(0x969000 <unfinished ...>
[pid 25443] 10:12:35.269668 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.269697 read(9,  <unfinished ...>
[pid 25461] 10:12:35.269731 fcntl(6, F_GETFL <unfinished ...>
[pid 25460] 10:12:35.269755 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.269778 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25433] 10:12:35.269809 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25461] 10:12:35.269854 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25460] 10:12:35.269877 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.269906 pipe( <unfinished ...>
[pid 25433] 10:12:35.269932 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.269965 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.269988 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.270015 <... pipe resumed> [17, 18]) = 0
[pid 25433] 10:12:35.270033 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.270083 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.270114 <... mmap resumed> ) = 0x7f9083402000
[pid 25443] 10:12:35.270132 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:35.270159 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.270191 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.270217 read(8,  <unfinished ...>
[pid 25443] 10:12:35.270244 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25433] 10:12:35.270266 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.270330 <... mmap resumed> ) = 0x7f2b29364000
[pid 25460] 10:12:35.270352 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:35.270382 close(15 <unfinished ...>
[pid 25433] 10:12:35.270409 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25461] 10:12:35.270445 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.270468 close(8 <unfinished ...>
[pid 25443] 10:12:35.270581 <... close resumed> ) = 0
[pid 25433] 10:12:35.270600 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.270631 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.270649 <... close resumed> ) = 0
[pid 25443] 10:12:35.270665 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25433] 10:12:35.270695 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.270730 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25460] 10:12:35.270759 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25443] 10:12:35.270785 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.270803 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.270848 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.270950 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.271040 close(14 <unfinished ...>
[pid 25433] 10:12:35.271070 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.271107 read(0,  <unfinished ...>
[pid 25460] 10:12:35.271130 read(6,  <unfinished ...>
[pid 25443] 10:12:35.271153 <... close resumed> ) = 0
[pid 25433] 10:12:35.271170 <... open resumed> ) = 10
[pid 25461] 10:12:35.271193 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.271211 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25443] 10:12:35.271319 munmap(0x7fdec5ab3000, 4096 <unfinished ...>
[pid 25433] 10:12:35.271349 fstat(10,  <unfinished ...>
[pid 25461] 10:12:35.271379 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.271408 read(6,  <unfinished ...>
[pid 25443] 10:12:35.271432 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.271450 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.271567 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.271589 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25443] 10:12:35.271673 close(9 <unfinished ...>
[pid 25433] 10:12:35.271703 fstat(10,  <unfinished ...>
[pid 25461] 10:12:35.271733 write(6, "1aEJMZ-0006cf-8U-D\n--1451491954-eximdsn-102148205\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a perm"..., 3151 <unfinished ...>
[pid 25460] 10:12:35.271770 read(6,  <unfinished ...>
[pid 25443] 10:12:35.271794 <... close resumed> ) = 0
[pid 25433] 10:12:35.271810 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.271845 <... write resumed> ) = 3151
[pid 25460] 10:12:35.271865 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.271883 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:35.271912 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.271945 fsync(6 <unfinished ...>
[pid 25460] 10:12:35.272005 read(6,  <unfinished ...>
[pid 25443] 10:12:35.272030 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.272049 <... mmap resumed> ) = 0x7fea0f283000
[pid 25460] 10:12:35.272079 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.272144 close(13 <unfinished ...>
[pid 25433] 10:12:35.272170 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.272198 close(6 <unfinished ...>
[pid 25443] 10:12:35.272223 <... close resumed> ) = 0
[pid 25433] 10:12:35.272239 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.272260 <... close resumed> ) = 0
[pid 25443] 10:12:35.272287 munmap(0x7fdec5ab4000, 4096 <unfinished ...>
[pid 25433] 10:12:35.272316 read(10,  <unfinished ...>
[pid 25461] 10:12:35.272352 <... fsync resumed> ) = 0
[pid 25460] 10:12:35.272384 munmap(0x7f9083403000, 4096 <unfinished ...>
[pid 25457] 10:12:35.272412 <... brk resumed> ) = 0x969000
[pid 25443] 10:12:35.272427 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.272725 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25461] 10:12:35.272770 stat("/etc/localtime",  <unfinished ...>
[pid 25460] 10:12:35.272800 <... munmap resumed> ) = 0
[pid 25457] 10:12:35.272821 read(13,  <unfinished ...>
[pid 25443] 10:12:35.272843 close(12 <unfinished ...>
[pid 25433] 10:12:35.272869 read(10,  <unfinished ...>
[pid 25461] 10:12:35.272899 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.272968 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.273001 <... close resumed> ) = 0
[pid 25433] 10:12:35.273018 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.273061 fstat(6,  <unfinished ...>
[pid 25460] 10:12:35.273089 <... open resumed> ) = 6
[pid 25443] 10:12:35.273106 munmap(0x7fdec5ab5000, 4096 <unfinished ...>
[pid 25433] 10:12:35.273133 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.273175 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3151, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.273291 fstat(6,  <unfinished ...>
[pid 25443] 10:12:35.273320 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.273339 <... open resumed> ) = 11
[pid 25461] 10:12:35.273365 brk(0x135c000 <unfinished ...>
[pid 25460] 10:12:35.273396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:35.273432 close(16 <unfinished ...>
[pid 25433] 10:12:35.273464 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.273566 <... brk resumed> ) = 0x135c000
[pid 25460] 10:12:35.273611 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.273640 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25443] 10:12:35.273660 <... close resumed> ) = 0
[pid 25433] 10:12:35.274541 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.274594 getuid( <unfinished ...>
[pid 25460] 10:12:35.274621 <... mmap resumed> ) = 0x7f9083403000
[pid 25443] 10:12:35.274640 munmap(0x7fdec5ab1000, 4096 <unfinished ...>
[pid 25433] 10:12:35.274668 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.274703 <... getuid resumed> ) = 47
[pid 25460] 10:12:35.274722 read(6,  <unfinished ...>
[pid 25443] 10:12:35.274750 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.274768 <... mmap resumed> ) = 0x7fea0f282000
[pid 25461] 10:12:35.274791 geteuid( <unfinished ...>
[pid 25460] 10:12:35.274813 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:35.274845 close(11 <unfinished ...>
[pid 25433] 10:12:35.274871 read(11,  <unfinished ...>
[pid 25461] 10:12:35.274907 <... geteuid resumed> ) = 47
[pid 25460] 10:12:35.274926 close(6 <unfinished ...>
[pid 25443] 10:12:35.274950 <... close resumed> ) = 0
[pid 25433] 10:12:35.274966 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.275003 getgid( <unfinished ...>
[pid 25460] 10:12:35.275026 <... close resumed> ) = 0
[pid 25443] 10:12:35.275042 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25433] 10:12:35.275068 close(11 <unfinished ...>
[pid 25461] 10:12:35.275098 <... getgid resumed> ) = 12
[pid 25460] 10:12:35.275117 munmap(0x7f9083403000, 4096 <unfinished ...>
[pid 25443] 10:12:35.275142 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.275160 <... close resumed> ) = 0
[pid 25461] 10:12:35.275181 getegid( <unfinished ...>
[pid 25460] 10:12:35.275204 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.275235 close(10 <unfinished ...>
[pid 25433] 10:12:35.275263 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25461] 10:12:35.275296 <... getegid resumed> ) = 12
[pid 25460] 10:12:35.275386 fstat(1,  <unfinished ...>
[pid 25443] 10:12:35.275422 <... close resumed> ) = 0
[pid 25433] 10:12:35.275440 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.275550 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.275596 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25443] 10:12:35.275639 munmap(0x7fdec5ab7000, 4096 <unfinished ...>
[pid 25433] 10:12:35.275669 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.275702 <... open resumed> ) = 8
[pid 25460] 10:12:35.275720 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f90822b9790},  <unfinished ...>
[pid 25443] 10:12:35.275748 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.275766 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.275819 read(8,  <unfinished ...>
[pid 25460] 10:12:35.275849 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25443] 10:12:35.275879 clone( <unfinished ...>
[pid 25433] 10:12:35.276164 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25461] 10:12:35.276202 <... read resumed> "2\331\237\244", 4) = 4
[pid 25460] 10:12:35.276222 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25433] 10:12:35.276252 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25461] 10:12:35.276299 close(8 <unfinished ...>
[pid 25460] 10:12:35.276326 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:35.276345 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25470
[pid 25433] 10:12:35.276380 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.276418 <... close resumed> ) = 0
[pid 25460] 10:12:35.276593 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25443] 10:12:35.276630 close(18 <unfinished ...>
[pid 25433] 10:12:35.276654 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.276715 readlink("/proc/self/exe",  <unfinished ...>
[pid 25460] 10:12:35.276772 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:35.276796 <... close resumed> ) = 0
[pid 25433] 10:12:35.276813 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.276851 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25460] 10:12:35.276915 fstat(0,  <unfinished ...>
[pid 25443] 10:12:35.276943 read(17,  <unfinished ...>
[pid 25433] 10:12:35.276966 <... open resumed> ) = 11
[pid 25461] 10:12:35.276987 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.277013 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167227, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25433] 10:12:35.277042 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.277070 <... ioctl resumed> , 0x7ffc6a221320) = -1 EINVAL (Invalid argument)
[pid 25460] 10:12:35.277092 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.277120 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.277162 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.277187 <... mmap resumed> ) = 0x7f9083403000
[pid 25433] 10:12:35.277204 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.277231 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25460] 10:12:35.277252 read(0,  <unfinished ...>
[pid 25433] 10:12:35.277281 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.277315 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.277341 <... read resumed> "To:  gretchen.murry@onehospitalitygroup.com, Jennifer.Gonzales@onehospitalitygroup.com, embassytempe@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.co"..., 4096) = 2145
[pid 25433] 10:12:35.277426 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.277464 <... ioctl resumed> , 0x7ffc6a221320) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.277564 stat("/etc/localtime",  <unfinished ...>
[pid 25433] 10:12:35.277596 <... mmap resumed> ) = 0x7fea0f282000
[pid 25461] 10:12:35.277619 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.277644 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.277690 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.277722 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.277742 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25433] 10:12:35.277804 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.277829 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.277854 <... open resumed> ) = 6
[pid 25433] 10:12:35.277874 read(11,  <unfinished ...>
[pid 25461] 10:12:35.277908 <... ioctl resumed> , 0x7ffc6a221330) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.277927 fchown(6, 47, 12 <unfinished ...>
[pid 25433] 10:12:35.277955 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25461] 10:12:35.278004 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.278032 <... fchown resumed> ) = 0
[pid 25433] 10:12:35.278051 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.278084 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.278105 fchmod(6, 0640 <unfinished ...>
[pid 25433] 10:12:35.278132 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.278174 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.278208 <... fchmod resumed> ) = 0
[pid 25433] 10:12:35.278228 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.278263 <... open resumed> ) = 8
[pid 25460] 10:12:35.278282 fcntl(6, F_GETFL <unfinished ...>
[pid 25433] 10:12:35.278306 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.278359 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.278386 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25433] 10:12:35.278405 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.278439 <... ioctl resumed> , 0x7ffc6a221400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.278458 fstat(6,  <unfinished ...>
[pid 25433] 10:12:35.278559 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.278625 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.278653 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:35.278682 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25461] 10:12:35.278716 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.278735 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.278763 <... stat resumed> 0x7ffc727171c0) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.278793 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.278819 <... mmap resumed> ) = 0x7f9083402000
[pid 25433] 10:12:35.278836 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.278867 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.278887 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.278911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.278956 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25460] 10:12:35.278982 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.278999 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.279033 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2b2821b790}, 8) = 0
[pid 25460] 10:12:35.279058 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25433] 10:12:35.279087 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.279148 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.279181 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.279252 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.279286 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2b2821b790}, 8) = 0
[pid 25460] 10:12:35.279621 read(0,  <unfinished ...>
[pid 25433] 10:12:35.279657 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.279711 read(8,  <unfinished ...>
[pid 25460] 10:12:35.279738 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.279757 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25461] 10:12:35.279790 <... read resumed> "", 8192) = 0
[pid 25460] 10:12:35.279813 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25433] 10:12:35.279848 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25461] 10:12:35.279894 close(8 <unfinished ...>
[pid 25460] 10:12:35.279920 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25433] 10:12:35.279938 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.279971 <... close resumed> ) = 0
[pid 25460] 10:12:35.280158 write(6, "1aEJMZ-0006ce-8t-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877 <unfinished ...>
[pid 25433] 10:12:35.280205 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.280259 brk(0x137d000 <unfinished ...>
[pid 25460] 10:12:35.280288 <... write resumed> ) = 1877
[pid 25433] 10:12:35.280308 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.280338 <... brk resumed> ) = 0x137d000
[pid 25460] 10:12:35.280461 fsync(6 <unfinished ...>
[pid 25433] 10:12:35.280593 <... lseek resumed> ) = 2781
[pid 25461] 10:12:35.280642 stat("/etc/exim.pl",  <unfinished ...>
[pid 25433] 10:12:35.280707 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.280738 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:35.280770 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.280810 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.280845 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.280878 <... open resumed> ) = 8
[pid 25460] 10:12:35.280896 <... fsync resumed> ) = 0
[pid 25433] 10:12:35.280930 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.280977 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.281004 stat("/etc/localtime",  <unfinished ...>
[pid 25433] 10:12:35.281030 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.281064 <... ioctl resumed> , 0x7ffc6a221230) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.281083 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.281149 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.281222 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.281251 fstat(6,  <unfinished ...>
[pid 25433] 10:12:35.281274 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25461] 10:12:35.281309 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.281353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:35.281462 <... stat resumed> 0x7ffc727171c0) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.281578 read(8,  <unfinished ...>
[pid 25460] 10:12:35.281610 brk(0x1462000 <unfinished ...>
[pid 25433] 10:12:35.281635 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.281667 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25460] 10:12:35.282674 <... brk resumed> ) = 0x1462000
[pid 25433] 10:12:35.282732 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.282793 brk(0x139e000 <unfinished ...>
[pid 25460] 10:12:35.282822 getuid( <unfinished ...>
[pid 25433] 10:12:35.282845 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.282937 <... brk resumed> ) = 0x139e000
[pid 25460] 10:12:35.283148 <... getuid resumed> ) = 47
[pid 25433] 10:12:35.283176 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25461] 10:12:35.283244 read(8,  <unfinished ...>
[pid 25460] 10:12:35.283276 geteuid( <unfinished ...>
[pid 25433] 10:12:35.283299 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.283334 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25460] 10:12:35.284265 <... geteuid resumed> ) = 47
[pid 25433] 10:12:35.284301 <... open resumed> ) = 12
[pid 25461] 10:12:35.284329 brk(0x13bf000 <unfinished ...>
[pid 25460] 10:12:35.284357 getgid( <unfinished ...>
[pid 25433] 10:12:35.284380 fstat(12,  <unfinished ...>
[pid 25461] 10:12:35.284408 <... brk resumed> ) = 0x13bf000
[pid 25460] 10:12:35.284779 <... getgid resumed> ) = 12
[pid 25433] 10:12:35.284811 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.284854 read(8,  <unfinished ...>
[pid 25460] 10:12:35.284883 getegid( <unfinished ...>
[pid 25433] 10:12:35.284906 fstat(12,  <unfinished ...>
[pid 25461] 10:12:35.284934 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25460] 10:12:35.285829 <... getegid resumed> ) = 12
[pid 25433] 10:12:35.285924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.285969 brk(0x13e0000 <unfinished ...>
[pid 25460] 10:12:35.285993 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.286031 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.286064 <... open resumed> ) = 8
[pid 25433] 10:12:35.286083 <... mmap resumed> ) = 0x7fea0f281000
[pid 25460] 10:12:35.286104 read(8,  <unfinished ...>
[pid 25433] 10:12:35.286131 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.286158 <... read resumed> "l\250\216\5", 4) = 4
[pid 25433] 10:12:35.286177 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.286198 close(8 <unfinished ...>
[pid 25433] 10:12:35.286245 read(12,  <unfinished ...>
[pid 25460] 10:12:35.286312 <... close resumed> ) = 0
[pid 25433] 10:12:35.286426 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25460] 10:12:35.286472 readlink("/proc/self/exe",  <unfinished ...>
[pid 25433] 10:12:35.286618 stat("/jail_owner",  <unfinished ...>
[pid 25461] 10:12:35.286655 <... brk resumed> ) = 0x13e0000
[pid 25460] 10:12:35.286670 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25457] 10:12:35.286736 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25449] 10:12:35.286779 <... select resumed> ) = 1 (in [11], left {299, 897104})
[pid 25433] 10:12:35.286806 <... stat resumed> 0x7ffc72718770) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.286837 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25449] 10:12:35.286864 recvfrom(11,  <unfinished ...>
[pid 25433] 10:12:35.286889 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25460] 10:12:35.286927 <... ioctl resumed> , 0x7ffe4db24b30) = -1 EINVAL (Invalid argument)
[pid 25449] 10:12:35.286948 <... recvfrom resumed> "250 2.1.5 Recipient OK\r\n", 4096, 0, NULL, NULL) = 24
[pid 25433] 10:12:35.286978 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25461] 10:12:35.287273 read(8,  <unfinished ...>
[pid 25460] 10:12:35.287303 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25449] 10:12:35.287328 sendto(11, "RCPT TO:<rivankovich@phoenixmarriottmesa.com>\r\n", 47, 0, NULL, 0 <unfinished ...>
[pid 25433] 10:12:35.287380 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25460] 10:12:35.287420 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25449] 10:12:35.287443 <... sendto resumed> ) = 47
[pid 25433] 10:12:35.287463 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.287578 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25449] 10:12:35.287611 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25433] 10:12:35.287640 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25460] 10:12:35.287673 <... ioctl resumed> , 0x7ffe4db24b30) = -1 EINVAL (Invalid argument)
[pid 25433] 10:12:35.287692 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25460] 10:12:35.287732 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.287757 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25460] 10:12:35.287790 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25433] 10:12:35.287810 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.287836 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.287868 stat("/etc/demouids",  <unfinished ...>
[pid 25460] 10:12:35.287900 <... ioctl resumed> , 0x7ffe4db24b40) = -1 EINVAL (Invalid argument)
[pid 25433] 10:12:35.287918 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25460] 10:12:35.287962 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.287988 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.288022 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25433] 10:12:35.288044 <... open resumed> ) = 13
[pid 25460] 10:12:35.288066 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.288096 fstat(13,  <unfinished ...>
[pid 25460] 10:12:35.288124 <... open resumed> ) = 8
[pid 25433] 10:12:35.288146 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.288183 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25460] 10:12:35.288474 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.288602 fstat(13,  <unfinished ...>
[pid 25461] 10:12:35.288635 read(8,  <unfinished ...>
[pid 25460] 10:12:35.288656 <... ioctl resumed> , 0x7ffe4db24c10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.288676 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.288692 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25460] 10:12:35.288727 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.288752 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.288783 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.288802 <... mmap resumed> ) = 0x7fea0f280000
[pid 25460] 10:12:35.288823 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.288847 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.288874 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.288892 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.288913 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25433] 10:12:35.288937 read(13,  <unfinished ...>
[pid 25460] 10:12:35.288964 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f90822b9790}, 8) = 0
[pid 25433] 10:12:35.288988 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.289018 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25433] 10:12:35.289048 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25460] 10:12:35.289079 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f90822b9790}, 8) = 0
[pid 25433] 10:12:35.289362 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25460] 10:12:35.289468 read(8,  <unfinished ...>
[pid 25433] 10:12:35.289586 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.289624 <... read resumed> "", 8192) = 0
[pid 25460] 10:12:35.289639 <... read resumed> "", 8192) = 0
[pid 25457] 10:12:35.289666 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.289689 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.289737 close(8 <unfinished ...>
[pid 25460] 10:12:35.289765 close(8 <unfinished ...>
[pid 25433] 10:12:35.289788 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.289817 <... close resumed> ) = 0
[pid 25460] 10:12:35.289851 <... close resumed> ) = 0
[pid 25433] 10:12:35.290038 <... lseek resumed> ) = 353
[pid 25461] 10:12:35.290088 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25460] 10:12:35.290123 brk(0x1483000 <unfinished ...>
[pid 25433] 10:12:35.290148 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.290183 <... stat resumed> 0x7f2b27a02880) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.290205 <... brk resumed> ) = 0x1483000
[pid 25433] 10:12:35.290316 <... open resumed> ) = 14
[pid 25461] 10:12:35.290349 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25460] 10:12:35.290380 stat("/etc/exim.pl",  <unfinished ...>
[pid 25433] 10:12:35.290406 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.290434 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.290466 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:35.290578 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25461] 10:12:35.290615 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25460] 10:12:35.290642 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.290670 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.290686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.290719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25460] 10:12:35.290750 <... open resumed> ) = 8
[pid 25433] 10:12:35.290768 <... mmap resumed> ) = 0x7fea0f27f000
[pid 25461] 10:12:35.290790 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.290819 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.290843 read(14,  <unfinished ...>
[pid 25461] 10:12:35.290876 <... open resumed> ) = 8
[pid 25460] 10:12:35.290894 <... ioctl resumed> , 0x7ffe4db24a40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.290913 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25461] 10:12:35.290945 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.290969 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.290992 close(14 <unfinished ...>
[pid 25461] 10:12:35.291020 <... ioctl resumed> , 0x7ffc6a221230) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.291038 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.291075 <... close resumed> ) = 0
[pid 25461] 10:12:35.291100 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.291129 read(8,  <unfinished ...>
[pid 25433] 10:12:35.291154 munmap(0x7fea0f27f000, 4096 <unfinished ...>
[pid 25461] 10:12:35.291188 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.291222 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25433] 10:12:35.292265 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.292318 read(8,  <unfinished ...>
[pid 25460] 10:12:35.292351 brk(0x14a4000 <unfinished ...>
[pid 25433] 10:12:35.292376 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.292410 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25460] 10:12:35.292908 <... brk resumed> ) = 0x14a4000
[pid 25433] 10:12:35.293150 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.293192 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25460] 10:12:35.293220 read(8,  <unfinished ...>
[pid 25433] 10:12:35.293246 stat("/etc/userdomains",  <unfinished ...>
[pid 25460] 10:12:35.293276 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25433] 10:12:35.294230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25460] 10:12:35.294307 brk(0x14c5000 <unfinished ...>
[pid 25452] 10:12:35.294345 <... select resumed> ) = 1 (in [11], left {299, 956344})
[pid 25433] 10:12:35.294379 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.294423 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.294442 <... brk resumed> ) = 0x14c5000
[pid 25452] 10:12:35.294828 read(11,  <unfinished ...>
[pid 25433] 10:12:35.294867 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.294916 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25460] 10:12:35.294946 read(8,  <unfinished ...>
[pid 25452] 10:12:35.294972 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25433] 10:12:35.294992 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.295026 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.295048 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25452] 10:12:35.295538 read(11,  <unfinished ...>
[pid 25433] 10:12:35.295579 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.295640 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25452] 10:12:35.295676 <... read resumed> "\2206~.\352B\227\225Yp\"_\6{0\17\337\257\271\272?\313\2263\250n.\277l\342\rp", 32) = 32
[pid 25433] 10:12:35.295714 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.295747 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.295766 read(11,  <unfinished ...>
[pid 25433] 10:12:35.295791 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.295837 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25452] 10:12:35.295868 <... read resumed> "\27\3\1\0`", 5) = 5
[pid 25433] 10:12:35.295887 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.295919 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.296359 read(11,  <unfinished ...>
[pid 25433] 10:12:35.296397 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.296451 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25460] 10:12:35.296570 brk(0x14e6000 <unfinished ...>
[pid 25452] 10:12:35.296595 <... read resumed> "$\351\254\4\375\366\22%G\25\221\331y\335\315\275\270g\257\4\273_~\v\307jn\355\242\334\306IVMD\207\0\374\362\212\326XD~j\315\275k\213}\221s,J\274\2626\207H>\326^\322IkRLzY\20Y\260\17\5\16\333\343\321\22</\370|\21Ho\333\324\377\35\v\322\340\251\36\201", 96) = 96
[pid 25433] 10:12:35.296647 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.296684 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.296703 write(11, "\27\3\1\0 \227W~\233.\373\20Y\206\231\372q\31\253,\236\352\367@\2\271\222\25\21|\347\222\f\217\320v\303\27\3\1\0P\215\243z\305\300\202\373B\200\323\177\2129\276V_\206\371\270}\375\253\335\30`\3174\324\336EH2E\206\343\214\264K\320\324\244\311'eBq\236\177\30\373B\"T\335|\356\341*\212\352\333P\27\246\334\345\21\21\224\330tA\241s\215\fG\7\17\273", 122 <unfinished ...>
[pid 25433] 10:12:35.296752 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.296813 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25452] 10:12:35.296848 <... write resumed> ) = 122
[pid 25433] 10:12:35.296868 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25461] 10:12:35.296900 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.296921 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25433] 10:12:35.296951 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.296977 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25433] 10:12:35.297009 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.297040 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.297057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.297096 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25433] 10:12:35.297128 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.297161 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.297188 <... open resumed> ) = 14
[pid 25461] 10:12:35.297210 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25433] 10:12:35.297243 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.297270 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.297287 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.297323 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25433] 10:12:35.297355 fstat(14,  <unfinished ...>
[pid 25461] 10:12:35.297381 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.297401 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.297433 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25433] 10:12:35.297463 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.297601 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.297622 <... mmap resumed> ) = 0x7fea0f27f000
[pid 25461] 10:12:35.297643 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25433] 10:12:35.297675 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.297702 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:35.297732 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.297753 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.297786 read(14,  <unfinished ...>
[pid 25461] 10:12:35.297813 <... open resumed> ) = 9
[pid 25433] 10:12:35.297831 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.297868 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.297898 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.297936 <... ioctl resumed> , 0x7ffc6a220c40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.297955 <... brk resumed> ) = 0x14e6000
[pid 25433] 10:12:35.298215 <... open resumed> ) = 15
[pid 25461] 10:12:35.298249 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.298274 read(8,  <unfinished ...>
[pid 25433] 10:12:35.298295 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.298323 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.298352 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.298390 brk(0x1401000 <unfinished ...>
[pid 25433] 10:12:35.298415 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.298446 <... brk resumed> ) = 0x1401000
[pid 25433] 10:12:35.298551 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25461] 10:12:35.298584 read(9,  <unfinished ...>
[pid 25460] 10:12:35.298621 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25457] 10:12:35.298647 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25433] 10:12:35.298954 read(15, Process 25470 attached
 <unfinished ...>
[pid 25461] 10:12:35.299022 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25460] 10:12:35.299340 read(8,  <unfinished ...>
[pid 25457] 10:12:35.299374 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.299391 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
Process 25469 attached
[pid 25470] 10:12:35.299440 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25461] 10:12:35.299546 read(9,  <unfinished ...>
[pid 25460] 10:12:35.299582 <... read resumed> "", 8192) = 0
[pid 25457] 10:12:35.299597 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.299627 close(15 <unfinished ...>
[pid 25470] 10:12:35.299662 <... set_robust_list resumed> ) = 0
[pid 25469] 10:12:35.299677 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25461] 10:12:35.299726 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25460] 10:12:35.300423 close(8 <unfinished ...>
[pid 25457] 10:12:35.300473 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.300548 <... close resumed> ) = 0
[pid 25470] 10:12:35.300583 close(17 <unfinished ...>
[pid 25469] 10:12:35.300608 <... set_robust_list resumed> ) = 0
[pid 25461] 10:12:35.300622 read(9,  <unfinished ...>
[pid 25460] 10:12:35.300705 <... close resumed> ) = 0
[pid 25457] 10:12:35.300720 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25433] 10:12:35.300773 munmap(0x7fea0f27e000, 4096 <unfinished ...>
[pid 25470] 10:12:35.300813 <... close resumed> ) = 0
[pid 25469] 10:12:35.300827 close(9 <unfinished ...>
[pid 25461] 10:12:35.300860 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25460] 10:12:35.300880 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25457] 10:12:35.300994 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.301011 <... munmap resumed> ) = 0
[pid 25470] 10:12:35.301053 geteuid( <unfinished ...>
[pid 25469] 10:12:35.301078 <... close resumed> ) = 0
[pid 25461] 10:12:35.301092 brk(0x1422000 <unfinished ...>
[pid 25460] 10:12:35.301125 <... stat resumed> 0x7f9081aa0880) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.301140 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.301172 stat("/etc/userdomains",  <unfinished ...>
[pid 25470] 10:12:35.301207 <... geteuid resumed> ) = 0
[pid 25469] 10:12:35.301221 geteuid( <unfinished ...>
[pid 25461] 10:12:35.301244 <... brk resumed> ) = 0x1422000
[pid 25460] 10:12:35.301257 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25457] 10:12:35.301680 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.301700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25470] 10:12:35.301783 getegid( <unfinished ...>
[pid 25469] 10:12:35.301813 <... geteuid resumed> ) = 0
[pid 25461] 10:12:35.301827 read(9,  <unfinished ...>
[pid 25460] 10:12:35.301852 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.301880 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25433] 10:12:35.301914 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25470] 10:12:35.301949 <... getegid resumed> ) = 12
[pid 25469] 10:12:35.301963 getegid( <unfinished ...>
[pid 25461] 10:12:35.301990 <... read resumed> "", 8192) = 0
[pid 25460] 10:12:35.302005 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25457] 10:12:35.302034 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.302049 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25470] 10:12:35.302082 setgid(500 <unfinished ...>
[pid 25469] 10:12:35.302107 <... getegid resumed> ) = 12
[pid 25461] 10:12:35.302120 close(9 <unfinished ...>
[pid 25460] 10:12:35.302149 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.302179 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.302208 stat("/etc/userdomains",  <unfinished ...>
[pid 25470] 10:12:35.302243 <... setgid resumed> ) = 0
[pid 25469] 10:12:35.302256 setgid(494 <unfinished ...>
[pid 25461] 10:12:35.302280 <... close resumed> ) = 0
[pid 25460] 10:12:35.302293 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.303068 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.303089 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25470] 10:12:35.303147 setuid(503 <unfinished ...>
[pid 25469] 10:12:35.303176 <... setgid resumed> ) = 0
[pid 25461] 10:12:35.303190 read(8,  <unfinished ...>
[pid 25460] 10:12:35.303219 <... open resumed> ) = 8
[pid 25457] 10:12:35.303238 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25433] 10:12:35.303268 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25470] 10:12:35.303305 <... setuid resumed> ) = 0
[pid 25469] 10:12:35.303318 setuid(495 <unfinished ...>
[pid 25461] 10:12:35.303377 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25460] 10:12:35.303397 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.304187 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.304209 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25470] 10:12:35.304269 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25469] 10:12:35.304305 <... setuid resumed> ) = 0
[pid 25461] 10:12:35.304325 read(8,  <unfinished ...>
[pid 25460] 10:12:35.304379 <... ioctl resumed> , 0x7ffe4db24a40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.304399 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.304429 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25470] 10:12:35.304464 <... open resumed> ) = 9
[pid 25469] 10:12:35.304537 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.304584 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25460] 10:12:35.304604 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.305294 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.305318 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25470] 10:12:35.305359 fstat(9,  <unfinished ...>
[pid 25469] 10:12:35.305386 <... open resumed> ) = 9
[pid 25461] 10:12:35.305400 read(8,  <unfinished ...>
[pid 25460] 10:12:35.305433 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.305470 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25433] 10:12:35.305562 stat("/etc/userdomains",  <unfinished ...>
[pid 25470] 10:12:35.305600 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25469] 10:12:35.305628 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.305743 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25460] 10:12:35.305762 read(8,  <unfinished ...>
[pid 25457] 10:12:35.306348 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.306369 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25470] 10:12:35.306432 fstat(9,  <unfinished ...>
[pid 25469] 10:12:35.306459 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25461] 10:12:35.306550 read(8,  <unfinished ...>
[pid 25460] 10:12:35.306622 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25457] 10:12:35.307061 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25433] 10:12:35.307108 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25470] 10:12:35.307146 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25469] 10:12:35.307175 fstat(9,  <unfinished ...>
[pid 25461] 10:12:35.307202 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25460] 10:12:35.307227 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.307438 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25433] 10:12:35.307544 <... stat resumed> 0x7ffc7271b560) = -1 ENOENT (No such file or directory)
[pid 25470] 10:12:35.307592 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25469] 10:12:35.307625 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25461] 10:12:35.307653 brk(0x1443000 <unfinished ...>
[pid 25460] 10:12:35.307681 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.307699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.307738 stat("/etc/userdomains",  <unfinished ...>
[pid 25470] 10:12:35.307788 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25469] 10:12:35.307803 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.307832 <... brk resumed> ) = 0x1443000
[pid 25460] 10:12:35.307846 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.308308 <... open resumed> ) = 14
[pid 25433] 10:12:35.308332 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25470] 10:12:35.308384 read(9,  <unfinished ...>
[pid 25469] 10:12:35.308425 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25461] 10:12:35.308442 read(8,  <unfinished ...>
[pid 25460] 10:12:35.308469 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.308561 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25433] 10:12:35.308589 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25470] 10:12:35.308627 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25469] 10:12:35.308646 read(9,  <unfinished ...>
[pid 25461] 10:12:35.308678 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25460] 10:12:35.308697 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.309563 <... ioctl resumed> , 0x7ffd7b06b700) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25433] 10:12:35.309587 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25470] 10:12:35.309695 read(9,  <unfinished ...>
[pid 25469] 10:12:35.309737 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25461] 10:12:35.309766 brk(0x1464000 <unfinished ...>
[pid 25460] 10:12:35.309793 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.309812 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.309835 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25470] 10:12:35.309868 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25469] 10:12:35.309886 read(9,  <unfinished ...>
[pid 25461] 10:12:35.309919 <... brk resumed> ) = 0x1464000
[pid 25460] 10:12:35.309934 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.310107 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.310153 <... lseek resumed> ) = 0
[pid 25470] 10:12:35.310183 close(9 <unfinished ...>
[pid 25469] 10:12:35.310208 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25461] 10:12:35.310228 read(8,  <unfinished ...>
[pid 25460] 10:12:35.310258 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.310281 read(14,  <unfinished ...>
[pid 25433] 10:12:35.310308 read(14,  <unfinished ...>
[pid 25470] 10:12:35.310339 <... close resumed> ) = 0
[pid 25469] 10:12:35.310353 close(9 <unfinished ...>
[pid 25461] 10:12:35.310378 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25460] 10:12:35.310396 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.311047 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25433] 10:12:35.311175 <... read resumed> "", 4096) = 0
[pid 25470] 10:12:35.311236 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25469] 10:12:35.311271 <... close resumed> ) = 0
[pid 25461] 10:12:35.311286 read(8,  <unfinished ...>
[pid 25460] 10:12:35.311316 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.311336 brk(0x98a000 <unfinished ...>
[pid 25433] 10:12:35.311361 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25470] 10:12:35.311400 <... munmap resumed> ) = 0
[pid 25469] 10:12:35.311413 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25461] 10:12:35.311931 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25460] 10:12:35.311955 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.312462 <... brk resumed> ) = 0x98a000
[pid 25433] 10:12:35.313048 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25470] 10:12:35.313125 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25469] 10:12:35.313156 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.313170 brk(0x1485000 <unfinished ...>
[pid 25460] 10:12:35.313239 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.313263 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.313288 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25470] 10:12:35.313328 <... lseek resumed> ) = 19
[pid 25469] 10:12:35.313342 brk(0x1479000 <unfinished ...>
[pid 25460] 10:12:35.313369 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.313401 <... lseek resumed> ) = 4868
[pid 25433] 10:12:35.313417 <... open resumed> ) = 15
[pid 25470] 10:12:35.313442 read(6,  <unfinished ...>
[pid 25469] 10:12:35.313467 <... brk resumed> ) = 0x1479000
[pid 25460] 10:12:35.313581 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.313779 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25433] 10:12:35.313806 fstat(15,  <unfinished ...>
[pid 25470] 10:12:35.313838 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2377) = 1858
[pid 25469] 10:12:35.313858 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.314340 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.314376 <... lseek resumed> ) = 4868
[pid 25433] 10:12:35.314395 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25470] 10:12:35.314438 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25469] 10:12:35.314471 <... lseek resumed> ) = 19
[pid 25460] 10:12:35.314545 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.314583 close(14 <unfinished ...>
[pid 25433] 10:12:35.314614 fstat(15,  <unfinished ...>
[pid 25470] 10:12:35.314653 <... write resumed> ) = 4
[pid 25469] 10:12:35.314667 read(6,  <unfinished ...>
[pid 25460] 10:12:35.314693 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.314725 <... close resumed> ) = 0
[pid 25443] 10:12:35.314760 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25433] 10:12:35.314784 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25470] 10:12:35.314823 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25469] 10:12:35.314851 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2446) = 1858
[pid 25460] 10:12:35.314870 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.315113 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25443] 10:12:35.315145 read(17,  <unfinished ...>
[pid 25433] 10:12:35.315169 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25470] 10:12:35.315207 <... write resumed> ) = 4
[pid 25469] 10:12:35.315220 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.315255 <... brk resumed> ) = 0x1485000
[pid 25460] 10:12:35.315271 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.315453 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.315474 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25433] 10:12:35.315579 <... mmap resumed> ) = 0x7fea0f27e000
[pid 25470] 10:12:35.315614 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25469] 10:12:35.315645 <... write resumed> ) = 4
[pid 25461] 10:12:35.315659 read(8,  <unfinished ...>
[pid 25460] 10:12:35.315682 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.315708 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25457] 10:12:35.315729 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25443] 10:12:35.315758 read(17,  <unfinished ...>
[pid 25433] 10:12:35.315782 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25470] 10:12:35.315817 <... write resumed> ) = 4
[pid 25469] 10:12:35.315831 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25461] 10:12:35.315857 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25460] 10:12:35.315875 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25458] 10:12:35.316570 read(9,  <unfinished ...>
[pid 25457] 10:12:35.316605 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.316631 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.316656 <... lseek resumed> ) = 0
[pid 25470] 10:12:35.316688 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25469] 10:12:35.316715 <... write resumed> ) = 4
[pid 25461] 10:12:35.316731 read(8,  <unfinished ...>
[pid 25460] 10:12:35.316755 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.316773 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25457] 10:12:35.316791 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25443] 10:12:35.316817 read(17,  <unfinished ...>
[pid 25433] 10:12:35.316843 read(15,  <unfinished ...>
[pid 25470] 10:12:35.316877 <... write resumed> ) = 40
[pid 25469] 10:12:35.316890 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.316917 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25458] 10:12:35.316950 read(9,  <unfinished ...>
[pid 25457] 10:12:35.316973 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.316990 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25433] 10:12:35.317009 <... read resumed> "", 4096) = 0
[pid 25470] 10:12:35.317045 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25469] 10:12:35.317072 <... write resumed> ) = 4
[pid 25460] 10:12:35.317086 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.317121 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25457] 10:12:35.317139 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25443] 10:12:35.317165 read(17,  <unfinished ...>
[pid 25433] 10:12:35.317188 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25470] 10:12:35.317226 <... write resumed> ) = 4
[pid 25469] 10:12:35.317239 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25460] 10:12:35.317265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.317298 read(9,  <unfinished ...>
[pid 25457] 10:12:35.317321 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.317342 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.317361 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25470] 10:12:35.317424 close(18 <unfinished ...>
[pid 25469] 10:12:35.317451 <... write resumed> ) = 4
[pid 25460] 10:12:35.317465 <... open resumed> ) = 9
[pid 25458] 10:12:35.317574 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25457] 10:12:35.317603 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25443] 10:12:35.317636 wait4(-1,  <unfinished ...>
[pid 25433] 10:12:35.317661 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25470] 10:12:35.317700 <... close resumed> ) = 0
[pid 25469] 10:12:35.317714 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.317756 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.317781 read(9,  <unfinished ...>
[pid 25457] 10:12:35.317805 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.317823 <... open resumed> ) = 16
[pid 25470] 10:12:35.317849 exit_group(0) = ?
[pid 25469] 10:12:35.317864 <... write resumed> ) = 4
[pid 25460] 10:12:35.318138 <... ioctl resumed> , 0x7ffe4db24450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.318163 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25457] 10:12:35.318182 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25433] 10:12:35.318209 fstat(16,  <unfinished ...>
[pid 25470] 10:12:35.318255 +++ exited with 0 +++
[pid 25469] 10:12:35.318268 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25460] 10:12:35.318293 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.318316 read(9,  <unfinished ...>
[pid 25457] 10:12:35.318343 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.318365 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25470
[pid 25433] 10:12:35.318385 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25469] 10:12:35.318425 <... write resumed> ) = 40
[pid 25460] 10:12:35.318439 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.318472 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25457] 10:12:35.318567 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25443] 10:12:35.318605 close(17 <unfinished ...>
[pid 25433] 10:12:35.318632 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25469] 10:12:35.318669 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25460] 10:12:35.318699 brk(0x1507000 <unfinished ...>
[pid 25458] 10:12:35.318724 read(9,  <unfinished ...>
[pid 25457] 10:12:35.318754 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.318776 <... close resumed> ) = 0
[pid 25433] 10:12:35.318794 <... mmap resumed> ) = 0x7fea0f27d000
[pid 25469] 10:12:35.318822 <... write resumed> ) = 4
[pid 25461] 10:12:35.318835 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25460] 10:12:35.318855 <... brk resumed> ) = 0x1507000
[pid 25458] 10:12:35.319323 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25457] 10:12:35.319356 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25443] 10:12:35.319390 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25433] 10:12:35.319427 read(16,  <unfinished ...>
[pid 25469] 10:12:35.319467 close(10 <unfinished ...>
[pid 25461] 10:12:35.319592 brk(0x14a6000 <unfinished ...>
[pid 25460] 10:12:35.319617 read(9,  <unfinished ...>
[pid 25458] 10:12:35.319651 wait4(-1,  <unfinished ...>
[pid 25457] 10:12:35.319676 <... stat resumed> 0x7ffd7b06b910) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.319698 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25433] 10:12:35.319755 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25469] 10:12:35.319795 <... close resumed> ) = 0
[pid 25460] 10:12:35.319810 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25457] 10:12:35.320129 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25443] 10:12:35.320170 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.320198 close(16 <unfinished ...>
[pid 25469] 10:12:35.320231 exit_group(0) = ?
[pid 25460] 10:12:35.320245 read(9,  <unfinished ...>
[pid 25457] 10:12:35.320469 <... stat resumed> 0x7ffd7b06b9b0) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.320574 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.320624 <... close resumed> ) = 0
[pid 25469] 10:12:35.320665 +++ exited with 0 +++
[pid 25460] 10:12:35.320680 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25458] 10:12:35.321377 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25469
[pid 25457] 10:12:35.321411 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25443] 10:12:35.321446 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.321532 munmap(0x7fea0f27d000, 4096 <unfinished ...>
[pid 25460] 10:12:35.321579 read(9,  <unfinished ...>
[pid 25458] 10:12:35.321605 close(9 <unfinished ...>
[pid 25457] 10:12:35.321632 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25443] 10:12:35.321667 <... open resumed> ) = 9
[pid 25433] 10:12:35.321686 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.321727 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25458] 10:12:35.321827 <... close resumed> ) = 0
[pid 25457] 10:12:35.321851 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.321885 fstat(9,  <unfinished ...>
[pid 25433] 10:12:35.321909 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.321946 brk(0x1528000 <unfinished ...>
[pid 25458] 10:12:35.321971 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25457] 10:12:35.322008 <... open resumed> ) = 14
[pid 25443] 10:12:35.322027 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.322063 <... open resumed> ) = 16
[pid 25461] 10:12:35.322090 <... brk resumed> ) = 0x14a6000
[pid 25460] 10:12:35.322105 <... brk resumed> ) = 0x1528000
[pid 25458] 10:12:35.322833 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25457] 10:12:35.322890 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:35.322922 fstat(9,  <unfinished ...>
[pid 25433] 10:12:35.322946 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.322979 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.323001 read(9,  <unfinished ...>
[pid 25458] 10:12:35.323025 brk(0x1478000 <unfinished ...>
[pid 25457] 10:12:35.323049 <... ioctl resumed> , 0x7ffd7b06b700) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:35.323068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.323100 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25460] 10:12:35.323140 <... read resumed> "", 8192) = 0
[pid 25458] 10:12:35.323160 <... brk resumed> ) = 0x1478000
[pid 25457] 10:12:35.323186 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.323211 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.323238 fstat(16,  <unfinished ...>
[pid 25460] 10:12:35.323269 close(9 <unfinished ...>
[pid 25458] 10:12:35.323294 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25457] 10:12:35.323335 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.323370 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25433] 10:12:35.323390 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25460] 10:12:35.323428 <... close resumed> ) = 0
[pid 25458] 10:12:35.324198 <... open resumed> ) = 9
[pid 25457] 10:12:35.324236 read(14,  <unfinished ...>
[pid 25443] 10:12:35.324266 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.324291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.324327 read(8,  <unfinished ...>
[pid 25458] 10:12:35.324353 alarm(60 <unfinished ...>
[pid 25457] 10:12:35.324378 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25443] 10:12:35.324904 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.324938 <... mmap resumed> ) = 0x7fea0f27d000
[pid 25460] 10:12:35.324966 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25458] 10:12:35.325782 <... alarm resumed> ) = 0
[pid 25457] 10:12:35.325815 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.325850 read(9,  <unfinished ...>
[pid 25433] 10:12:35.325878 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.325911 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.325928 read(8,  <unfinished ...>
[pid 25458] 10:12:35.325955 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25457] 10:12:35.325986 <... lseek resumed> ) = 2366
[pid 25443] 10:12:35.326003 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:35.326043 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.326073 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.326102 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25458] 10:12:35.326120 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.326895 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.326935 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.326964 read(16,  <unfinished ...>
[pid 25461] 10:12:35.327003 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.327019 read(8,  <unfinished ...>
[pid 25458] 10:12:35.327050 alarm(0 <unfinished ...>
[pid 25457] 10:12:35.327074 <... lseek resumed> ) = 2366
[pid 25443] 10:12:35.327091 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.327136 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25461] 10:12:35.327183 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.327209 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25458] 10:12:35.327227 <... alarm resumed> ) = 60
[pid 25457] 10:12:35.327947 close(14 <unfinished ...>
[pid 25443] 10:12:35.327988 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.328018 read(16,  <unfinished ...>
[pid 25461] 10:12:35.328051 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.328067 read(8,  <unfinished ...>
[pid 25458] 10:12:35.328094 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.328131 <... close resumed> ) = 0
[pid 25443] 10:12:35.328458 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.328600 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.328657 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.328690 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25458] 10:12:35.328715 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.328911 read(13,  <unfinished ...>
[pid 25443] 10:12:35.328944 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25433] 10:12:35.328979 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.329021 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.329037 brk(0x1549000 <unfinished ...>
[pid 25458] 10:12:35.329068 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.329104 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:35.329125 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.329150 <... open resumed> ) = 17
[pid 25461] 10:12:35.329177 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.329205 <... brk resumed> ) = 0x1549000
[pid 25458] 10:12:35.329219 <... open resumed> ) = 10
[pid 25457] 10:12:35.329759 close(13 <unfinished ...>
[pid 25443] 10:12:35.329799 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.329829 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.329863 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.329879 read(8,  <unfinished ...>
[pid 25458] 10:12:35.329906 read(10,  <unfinished ...>
[pid 25457] 10:12:35.329952 <... close resumed> ) = 0
[pid 25443] 10:12:35.330138 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.330187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25461] 10:12:35.330227 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.330256 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25458] 10:12:35.330274 <... read resumed> "cpu  123060 1342396 395138 67343095 2509 0 0 0\ncpu0 123060 1342396 395138 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58340873\nbtime 1450798266\nprocesses 892948\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25457] 10:12:35.331140 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.331179 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.331212 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.331250 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.331266 brk(0x156a000 <unfinished ...>
[pid 25458] 10:12:35.331297 close(10 <unfinished ...>
[pid 25457] 10:12:35.331325 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.331343 <... open resumed> ) = 10
[pid 25433] 10:12:35.331360 <... mmap resumed> ) = 0x7fea0f27c000
[pid 25461] 10:12:35.331386 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.331422 <... brk resumed> ) = 0x156a000
[pid 25458] 10:12:35.331436 <... close resumed> ) = 0
[pid 25457] 10:12:35.331733 read(12,  <unfinished ...>
[pid 25443] 10:12:35.331767 fstat(10,  <unfinished ...>
[pid 25433] 10:12:35.331791 read(17,  <unfinished ...>
[pid 25461] 10:12:35.331829 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.331845 read(8,  <unfinished ...>
[pid 25458] 10:12:35.331871 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25457] 10:12:35.331906 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.331954 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.331993 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25461] 10:12:35.332036 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.332067 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25458] 10:12:35.332085 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.332714 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.332759 fstat(10,  <unfinished ...>
[pid 25433] 10:12:35.332783 close(17 <unfinished ...>
[pid 25461] 10:12:35.332818 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.332835 read(8,  <unfinished ...>
[pid 25458] 10:12:35.332866 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.332899 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25443] 10:12:35.332945 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.332976 <... close resumed> ) = 0
[pid 25461] 10:12:35.333002 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.333032 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25458] 10:12:35.333050 <... open resumed> ) = 10
[pid 25457] 10:12:35.333605 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.333650 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.333678 munmap(0x7fea0f27c000, 4096 <unfinished ...>
[pid 25461] 10:12:35.333718 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.333735 brk(0x158b000 <unfinished ...>
[pid 25458] 10:12:35.333760 fcntl(10, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.333784 <... open resumed> ) = 13
[pid 25443] 10:12:35.333801 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25433] 10:12:35.333818 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.333858 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.333891 <... brk resumed> ) = 0x158b000
[pid 25458] 10:12:35.333905 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.334047 fstat(13,  <unfinished ...>
[pid 25443] 10:12:35.334077 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.334101 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.334148 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.334164 read(8,  <unfinished ...>
[pid 25458] 10:12:35.334194 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.334218 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25443] 10:12:35.334252 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.334270 <... open resumed> ) = 17
[pid 25461] 10:12:35.334296 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.334328 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25458] 10:12:35.334346 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.335038 fstat(13,  <unfinished ...>
[pid 25443] 10:12:35.335075 read(10,  <unfinished ...>
[pid 25433] 10:12:35.335104 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.335138 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.335154 read(8,  <unfinished ...>
[pid 25458] 10:12:35.335177 read(10,  <unfinished ...>
[pid 25457] 10:12:35.335205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25443] 10:12:35.335236 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25433] 10:12:35.335262 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25461] 10:12:35.335303 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25460] 10:12:35.335336 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25458] 10:12:35.335354 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25457] 10:12:35.335569 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.335606 read(10,  <unfinished ...>
[pid 25433] 10:12:35.335630 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.335662 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.335678 close(10 <unfinished ...>
[pid 25457] 10:12:35.335709 <... mmap resumed> ) = 0x7f293c0e7000
[pid 25443] 10:12:35.336061 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.336111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25461] 10:12:35.336164 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25460] 10:12:35.336198 brk(0x15ac000 <unfinished ...>
[pid 25458] 10:12:35.336220 <... close resumed> ) = 0
[pid 25457] 10:12:35.336254 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.336280 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.336319 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.336374 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.336400 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.336448 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.336563 <... open resumed> ) = 11
[pid 25433] 10:12:35.336600 <... mmap resumed> ) = 0x7fea0f27c000
[pid 25461] 10:12:35.336641 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.336692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.336724 read(13,  <unfinished ...>
[pid 25443] 10:12:35.336762 fstat(11,  <unfinished ...>
[pid 25433] 10:12:35.336796 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.336839 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.336881 stat("/var/tmp",  <unfinished ...>
[pid 25457] 10:12:35.336932 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.336968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:35.337016 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.337053 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.337100 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25457] 10:12:35.337214 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.337270 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.337316 read(17,  <unfinished ...>
[pid 25461] 10:12:35.337367 <... open resumed> ) = 9
[pid 25460] 10:12:35.337390 <... brk resumed> ) = 0x15ac000
[pid 25458] 10:12:35.337422 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.338111 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25443] 10:12:35.338199 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25433] 10:12:35.338236 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.338308 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.338359 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.338395 <... mmap resumed> ) = 0x7f03f4ba1000
[pid 25457] 10:12:35.338657 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.338720 read(11,  <unfinished ...>
[pid 25433] 10:12:35.338765 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.338822 <... ioctl resumed> , 0x7ffc6a220c40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.338859 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.338926 <... open resumed> ) = 14
[pid 25443] 10:12:35.338958 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:35.339015 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.339102 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.339147 <... open resumed> ) = 10
[pid 25457] 10:12:35.339174 fstat(14,  <unfinished ...>
[pid 25443] 10:12:35.339209 close(11 <unfinished ...>
[pid 25433] 10:12:35.339252 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.339315 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.339342 fcntl(10, F_GETFD <unfinished ...>
[pid 25457] 10:12:35.339427 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.339570 <... close resumed> ) = 0
[pid 25433] 10:12:35.339610 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.339694 read(9,  <unfinished ...>
[pid 25458] 10:12:35.339741 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.339772 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.339817 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25433] 10:12:35.339871 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.339927 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25458] 10:12:35.339957 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.340346 <... mmap resumed> ) = 0x7f293c0e6000
[pid 25443] 10:12:35.340384 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.340436 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.340619 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.340664 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.340693 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.340731 read(14,  <unfinished ...>
[pid 25452] 10:12:35.340784 <... select resumed> ) = 1 (in [11], left {299, 956835})
[pid 25443] 10:12:35.340829 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.340879 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.340943 <... lseek resumed> ) = 878
[pid 25460] 10:12:35.340967 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.341013 fstat(10,  <unfinished ...>
[pid 25457] 10:12:35.341049 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25452] 10:12:35.341095 read(11,  <unfinished ...>
[pid 25443] 10:12:35.341153 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.341234 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.341325 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.341368 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.341393 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25457] 10:12:35.341606 close(14 <unfinished ...>
[pid 25452] 10:12:35.341658 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25443] 10:12:35.341691 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25433] 10:12:35.341745 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.341805 <... lseek resumed> ) = 878
[pid 25460] 10:12:35.341833 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.341950 pread(10,  <unfinished ...>
[pid 25457] 10:12:35.342002 <... close resumed> ) = 0
[pid 25452] 10:12:35.342032 read(11,  <unfinished ...>
[pid 25443] 10:12:35.342072 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25433] 10:12:35.342147 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.342252 close(9 <unfinished ...>
[pid 25460] 10:12:35.342300 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.342325 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25457] 10:12:35.342435 munmap(0x7f293c0e6000, 4096 <unfinished ...>
[pid 25452] 10:12:35.342604 <... read resumed> "\354d9\20\244 \356A\3371\322\310\25\33.\231\301V\356HI\30\365\323|\324\205B\232\212\306x", 32) = 32
[pid 25443] 10:12:35.342662 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.342716 write(8, "2015-12-30 10:12:35 routing failed for finest09@fin.finestweddingsites.com <hillcrestgolfclub@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 179 <unfinished ...>
[pid 25461] 10:12:35.342795 <... close resumed> ) = 0
[pid 25460] 10:12:35.342817 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.343240 pread(10,  <unfinished ...>
[pid 25457] 10:12:35.343284 <... munmap resumed> ) = 0
[pid 25452] 10:12:35.343337 read(11,  <unfinished ...>
[pid 25449] 10:12:35.343384 <... select resumed> ) = 1 (in [11], left {299, 945076})
[pid 25443] 10:12:35.343419 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.343592 <... write resumed> ) = 179
[pid 25461] 10:12:35.343667 read(8,  <unfinished ...>
[pid 25460] 10:12:35.343717 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.343747 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25457] 10:12:35.343827 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.343881 <... read resumed> "\27\3\1\0P", 5) = 5
[pid 25449] 10:12:35.343915 recvfrom(11,  <unfinished ...>
[pid 25443] 10:12:35.343960 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.344008 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.344070 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25460] 10:12:35.344104 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.345178 pread(10,  <unfinished ...>
[pid 25457] 10:12:35.345226 <... open resumed> ) = 14
[pid 25452] 10:12:35.345255 read(11,  <unfinished ...>
[pid 25449] 10:12:35.345295 <... recvfrom resumed> "250 2.1.5 Recipient OK\r\n", 4096, 0, NULL, NULL) = 24
[pid 25443] 10:12:35.345332 <... open resumed> ) = 11
[pid 25433] 10:12:35.345360 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.345442 read(8,  <unfinished ...>
[pid 25460] 10:12:35.345572 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.345619 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25457] 10:12:35.345727 fstat(14,  <unfinished ...>
[pid 25452] 10:12:35.345771 <... read resumed> "\343S\221\3527\2139\\:p\6\2347\212\212\256\300\201\336S\272]\263\373\371eB5\rt\374H\204EL\321\324\2719\225\257\227aO\227\212C\224\307\10\366\t\177\371\356dI\270\"\2124\257\23\247\36\204\fNq\267L\371s\252\214\235\364\264\352`", 80) = 80
[pid 25449] 10:12:35.345839 sendto(11, "DATA\r\n", 6, 0, NULL, 0 <unfinished ...>
[pid 25443] 10:12:35.345912 fstat(11,  <unfinished ...>
[pid 25433] 10:12:35.345950 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.346009 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25460] 10:12:35.346038 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.346283 close(10 <unfinished ...>
[pid 25457] 10:12:35.346325 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25452] 10:12:35.346379 write(11, "\27\3\1\0 \347\360\366\325)n\20\266\314:E\22\3411\21\305\37\37\256\3\222IN\223\20.\256\32\313\305\34\377\27\3\1\0@\377\256j\300\30\264\1B\32BR\231\261jy\217u\360\317H:\217\320\37\210\307uOf\254E\200\307'^\314\316\327=k\326]0j\2371\375\v\246\307\230\216\250\224\234\227\344\345\332)\225\247\2\276", 106 <unfinished ...>
[pid 25449] 10:12:35.346454 <... sendto resumed> ) = 6
[pid 25443] 10:12:35.346486 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.346546 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.346620 brk(0x14c7000 <unfinished ...>
[pid 25460] 10:12:35.346659 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.346682 <... close resumed> ) = 0
[pid 25457] 10:12:35.346751 fstat(14,  <unfinished ...>
[pid 25452] 10:12:35.346791 <... write resumed> ) = 106
[pid 25449] 10:12:35.346820 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.346865 fstat(11,  <unfinished ...>
[pid 25433] 10:12:35.346899 close(7 <unfinished ...>
[pid 25461] 10:12:35.346952 <... brk resumed> ) = 0x14c7000
[pid 25460] 10:12:35.346972 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.348683 munmap(0x7f03f4ba1000, 200704 <unfinished ...>
[pid 25457] 10:12:35.348753 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25452] 10:12:35.348803 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.348846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.348890 <... close resumed> ) = 0
[pid 25461] 10:12:35.348934 read(8,  <unfinished ...>
[pid 25460] 10:12:35.348966 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.348989 <... munmap resumed> ) = 0
[pid 25457] 10:12:35.349039 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.349082 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.349120 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25461] 10:12:35.349193 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25460] 10:12:35.349220 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.349682 close(9 <unfinished ...>
[pid 25457] 10:12:35.349730 <... mmap resumed> ) = 0x7f293c0e6000
[pid 25443] 10:12:35.349758 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25433] 10:12:35.349784 <... open resumed> ) = 7
[pid 25460] 10:12:35.349831 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.349855 <... close resumed> ) = 0
[pid 25457] 10:12:35.349914 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.349954 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.349989 fcntl(7, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.350035 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.350079 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.350122 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.350148 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.350173 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.350208 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.350232 <... open resumed> ) = 9
[pid 25457] 10:12:35.350262 read(14,  <unfinished ...>
[pid 25443] 10:12:35.350303 read(11,  <unfinished ...>
[pid 25433] 10:12:35.350343 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.350389 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.350433 fstat(9,  <unfinished ...>
[pid 25457] 10:12:35.350467 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25443] 10:12:35.350646 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25433] 10:12:35.350728 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.350774 brk(0x14e8000 <unfinished ...>
[pid 25460] 10:12:35.350812 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.350836 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.350898 read(14,  <unfinished ...>
[pid 25443] 10:12:35.350935 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.350976 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.351024 <... brk resumed> ) = 0x14e8000
[pid 25460] 10:12:35.351044 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.351643 fstat(9,  <unfinished ...>
[pid 25457] 10:12:35.351686 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.351735 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.351798 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370719, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.351857 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.351882 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.351928 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.351973 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:35.352015 write(7, "2015-12-30 10:12:35 [25433] 1aEJMY-0006c6-AN ** finest09@fin.finestweddingsites.com <hillcrestgolfclub@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 188 <unfinished ...>
[pid 25460] 10:12:35.352083 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.352127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.352168 <... open resumed> ) = 15
[pid 25443] 10:12:35.352194 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:35.352258 <... write resumed> ) = 188
[pid 25460] 10:12:35.352303 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.352327 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25457] 10:12:35.352360 fstat(15,  <unfinished ...>
[pid 25443] 10:12:35.352396 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.352440 close(16 <unfinished ...>
[pid 25460] 10:12:35.352487 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.352624 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25457] 10:12:35.352673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:35.352719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.352803 <... close resumed> ) = 0
[pid 25460] 10:12:35.352843 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.353602 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.353651 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.353697 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25433] 10:12:35.353743 munmap(0x7fea0f27d000, 4096 <unfinished ...>
[pid 25460] 10:12:35.353799 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.353844 read(9,  <unfinished ...>
[pid 25457] 10:12:35.353884 <... mmap resumed> ) = 0x7f293c0e5000
[pid 25443] 10:12:35.353910 <... stat resumed> 0x7ffd947181d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.353947 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.353987 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.354031 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25457] 10:12:35.354102 read(15,  <unfinished ...>
[pid 25443] 10:12:35.354146 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.354184 close(17 <unfinished ...>
[pid 25460] 10:12:35.354233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.354279 stat("/jail_owner",  <unfinished ...>
[pid 25457] 10:12:35.354318 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25443] 10:12:35.354378 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.354446 <... close resumed> ) = 0
[pid 25460] 10:12:35.354486 <... open resumed> ) = 9
[pid 25458] 10:12:35.354509 <... stat resumed> 0x7ffc7ad93ba0) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.354650 close(15 <unfinished ...>
[pid 25443] 10:12:35.354693 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.354735 munmap(0x7fea0f27c000, 4096 <unfinished ...>
[pid 25460] 10:12:35.354787 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.354826 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25457] 10:12:35.354871 <... close resumed> ) = 0
[pid 25443] 10:12:35.354895 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.354982 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.355026 <... ioctl resumed> , 0x7ffe4db24450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.355051 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25457] 10:12:35.355113 munmap(0x7f293c0e5000, 4096 <unfinished ...>
[pid 25443] 10:12:35.355156 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.355196 close(13 <unfinished ...>
[pid 25460] 10:12:35.355245 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.355280 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25457] 10:12:35.355326 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.355370 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.355437 <... close resumed> ) = 0
[pid 25460] 10:12:35.355475 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.355496 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.355660 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.355714 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25433] 10:12:35.355755 munmap(0x7fea0f280000, 4096 <unfinished ...>
[pid 25460] 10:12:35.355808 read(9,  <unfinished ...>
[pid 25458] 10:12:35.355844 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25457] 10:12:35.355886 <... open resumed> ) = 15
[pid 25443] 10:12:35.355911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25433] 10:12:35.355972 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.356012 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25458] 10:12:35.356041 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25457] 10:12:35.356626 fstat(15,  <unfinished ...>
[pid 25443] 10:12:35.356677 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.356722 close(14 <unfinished ...>
[pid 25460] 10:12:35.356778 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.356815 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25457] 10:12:35.356859 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25443] 10:12:35.356910 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.356981 <... close resumed> ) = 0
[pid 25460] 10:12:35.357021 <... lseek resumed> ) = 878
[pid 25458] 10:12:35.357042 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.357080 fstat(15,  <unfinished ...>
[pid 25443] 10:12:35.357116 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.357627 munmap(0x7fea0f27f000, 4096 <unfinished ...>
[pid 25460] 10:12:35.357685 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.357721 stat("/etc/demouids",  <unfinished ...>
[pid 25457] 10:12:35.357762 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25443] 10:12:35.357808 <... lseek resumed> ) = 2781
[pid 25433] 10:12:35.357869 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.357911 <... lseek resumed> ) = 878
[pid 25458] 10:12:35.357933 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.358009 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.358054 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.358094 close(9 <unfinished ...>
[pid 25460] 10:12:35.358142 close(9 <unfinished ...>
[pid 25458] 10:12:35.358183 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.358227 <... mmap resumed> ) = 0x7f293c0e5000
[pid 25443] 10:12:35.358253 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.358308 <... close resumed> ) = 0
[pid 25460] 10:12:35.358345 <... close resumed> ) = 0
[pid 25458] 10:12:35.358366 <... open resumed> ) = 10
[pid 25457] 10:12:35.358844 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.358894 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:35.358940 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25460] 10:12:35.358995 read(8,  <unfinished ...>
[pid 25458] 10:12:35.359034 fstat(10,  <unfinished ...>
[pid 25457] 10:12:35.359070 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.359095 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:35.359161 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.359202 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25458] 10:12:35.359241 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.360204 read(15,  <unfinished ...>
[pid 25443] 10:12:35.360452 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.360503 close(12 <unfinished ...>
[pid 25461] 10:12:35.360621 read(8,  <unfinished ...>
[pid 25460] 10:12:35.360655 read(8,  <unfinished ...>
[pid 25458] 10:12:35.360693 fstat(10,  <unfinished ...>
[pid 25457] 10:12:35.360729 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.360780 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.360875 <... close resumed> ) = 0
[pid 25460] 10:12:35.360916 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25458] 10:12:35.360945 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25457] 10:12:35.361176 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.361229 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25433] 10:12:35.361278 munmap(0x7fea0f281000, 4096 <unfinished ...>
[pid 25461] 10:12:35.361345 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25460] 10:12:35.361376 brk(0x15cd000 <unfinished ...>
[pid 25458] 10:12:35.361640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25457] 10:12:35.361687 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.361755 <... stat resumed> 0x7ffd947181d0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.361801 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.361845 <... brk resumed> ) = 0x15cd000
[pid 25458] 10:12:35.361869 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25457] 10:12:35.363389 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.363449 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.363487 close(15 <unfinished ...>
[pid 25461] 10:12:35.363601 brk(0x1509000 <unfinished ...>
[pid 25460] 10:12:35.363640 read(8,  <unfinished ...>
[pid 25458] 10:12:35.363682 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25457] 10:12:35.363720 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.363783 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.363862 <... close resumed> ) = 0
[pid 25461] 10:12:35.363902 <... brk resumed> ) = 0x1509000
[pid 25460] 10:12:35.363924 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25458] 10:12:35.364468 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.364887 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.364942 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25433] 10:12:35.364985 munmap(0x7fea0f27e000, 4096 <unfinished ...>
[pid 25460] 10:12:35.365037 brk(0x15ee000 <unfinished ...>
[pid 25458] 10:12:35.365074 read(10,  <unfinished ...>
[pid 25457] 10:12:35.365111 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.365173 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25433] 10:12:35.365267 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.365317 <... brk resumed> ) = 0x15ee000
[pid 25458] 10:12:35.365341 <... read resumed> "", 4096) = 0
[pid 25457] 10:12:35.365818 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.365884 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.365935 close(11 <unfinished ...>
[pid 25458] 10:12:35.365994 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25457] 10:12:35.366050 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.366382 <... open resumed> ) = 12
[pid 25433] 10:12:35.366419 <... close resumed> ) = 0
[pid 25458] 10:12:35.366446 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25457] 10:12:35.366662 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.366701 fstat(12,  <unfinished ...>
[pid 25433] 10:12:35.366726 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25458] 10:12:35.366784 getuid( <unfinished ...>
[pid 25457] 10:12:35.366822 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.366879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.367173 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.367215 <... getuid resumed> ) = 0
[pid 25457] 10:12:35.367237 write(8, "2015-12-30 10:12:35 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25443] 10:12:35.367274 fstat(12,  <unfinished ...>
[pid 25433] 10:12:35.367298 close(10 <unfinished ...>
[pid 25458] 10:12:35.367329 geteuid( <unfinished ...>
[pid 25457] 10:12:35.367352 <... write resumed> ) = 101
[pid 25443] 10:12:35.367379 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.367419 <... close resumed> ) = 0
[pid 25458] 10:12:35.367443 <... geteuid resumed> ) = 0
[pid 25457] 10:12:35.367462 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.367828 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.367878 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25458] 10:12:35.367932 getgid( <unfinished ...>
[pid 25457] 10:12:35.367958 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.368002 <... mmap resumed> ) = 0x7fdec5ab5000
[pid 25433] 10:12:35.368022 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.368061 <... getgid resumed> ) = 12
[pid 25457] 10:12:35.368082 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.368109 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.368133 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25458] 10:12:35.368215 getegid( <unfinished ...>
[pid 25457] 10:12:35.368239 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.368273 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.368571 <... open resumed> ) = 9
[pid 25458] 10:12:35.368604 <... getegid resumed> ) = 12
[pid 25457] 10:12:35.368697 close(7 <unfinished ...>
[pid 25443] 10:12:35.368731 read(12,  <unfinished ...>
[pid 25433] 10:12:35.368780 fcntl(9, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.368830 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.368881 <... close resumed> ) = 0
[pid 25443] 10:12:35.368912 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25433] 10:12:35.368953 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.368979 <... open resumed> ) = 11
[pid 25457] 10:12:35.368998 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25443] 10:12:35.369034 stat("/jail_owner",  <unfinished ...>
[pid 25433] 10:12:35.369060 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.369090 read(11,  <unfinished ...>
[pid 25457] 10:12:35.369114 <... open resumed> ) = 7
[pid 25443] 10:12:35.369130 <... stat resumed> 0x7ffd94719780) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.369155 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.369179 <... read resumed> "onc\314", 4) = 4
[pid 25457] 10:12:35.369199 fcntl(7, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.369565 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25433] 10:12:35.369606 fchown(9, 47, 12 <unfinished ...>
[pid 25458] 10:12:35.369806 close(11 <unfinished ...>
[pid 25457] 10:12:35.369849 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.369878 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25433] 10:12:35.369935 <... fchown resumed> ) = 0
[pid 25458] 10:12:35.369961 <... close resumed> ) = 0
[pid 25457] 10:12:35.370064 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.370094 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25433] 10:12:35.370133 fchmod(9, 0640 <unfinished ...>
[pid 25458] 10:12:35.370166 readlink("/proc/self/exe",  <unfinished ...>
[pid 25457] 10:12:35.370217 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.370234 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.370260 <... fchmod resumed> ) = 0
[pid 25458] 10:12:35.370314 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25457] 10:12:35.370423 fstat(7,  <unfinished ...>
[pid 25443] 10:12:35.370455 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25433] 10:12:35.370556 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25461] 10:12:35.370603 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.370632 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.370658 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5370907, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.370689 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25433] 10:12:35.370723 <... open resumed> ) = 10
[pid 25461] 10:12:35.370761 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.370791 <... ioctl resumed> , 0x7ffc7ad8e130) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.370826 write(7, "2015-12-30 10:12:35 [25457] 1aEJMY-0006cP-Ry ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25443] 10:12:35.371178 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25433] 10:12:35.371214 alarm(60 <unfinished ...>
[pid 25461] 10:12:35.371249 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25460] 10:12:35.371277 read(8,  <unfinished ...>
[pid 25458] 10:12:35.371297 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.371321 <... write resumed> ) = 110
[pid 25443] 10:12:35.371340 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.371363 <... alarm resumed> ) = 0
[pid 25461] 10:12:35.371388 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.371403 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.371430 close(14 <unfinished ...>
[pid 25443] 10:12:35.371458 stat("/etc/demouids",  <unfinished ...>
[pid 25433] 10:12:35.371491 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25461] 10:12:35.371529 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.371556 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.371580 <... close resumed> ) = 0
[pid 25443] 10:12:35.371596 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.371641 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.371668 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.371683 <... ioctl resumed> , 0x7ffc7ad8e130) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.371703 munmap(0x7f293c0e6000, 4096 <unfinished ...>
[pid 25443] 10:12:35.371738 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.371786 alarm(0 <unfinished ...>
[pid 25461] 10:12:35.371840 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.371880 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.371923 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.371949 <... open resumed> ) = 13
[pid 25433] 10:12:35.371967 <... alarm resumed> ) = 60
[pid 25461] 10:12:35.372025 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.372044 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.372069 close(15 <unfinished ...>
[pid 25443] 10:12:35.372095 fstat(13,  <unfinished ...>
[pid 25433] 10:12:35.372118 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25461] 10:12:35.372155 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.372188 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.372213 <... close resumed> ) = 0
[pid 25443] 10:12:35.372230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.372264 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25461] 10:12:35.372305 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.372320 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25458] 10:12:35.372341 <... ioctl resumed> , 0x7ffc7ad8e140) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.372450 munmap(0x7f293c0e5000, 4096 <unfinished ...>
[pid 25443] 10:12:35.372601 fstat(13,  <unfinished ...>
[pid 25433] 10:12:35.372628 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.372671 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25460] 10:12:35.372697 brk(0x160f000 <unfinished ...>
[pid 25458] 10:12:35.372722 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.372757 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.372789 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.372832 <... open resumed> ) = 11
[pid 25461] 10:12:35.372859 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.372875 <... brk resumed> ) = 0x160f000
[pid 25458] 10:12:35.372894 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.373544 close(10 <unfinished ...>
[pid 25443] 10:12:35.373584 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.373614 fcntl(11, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.373646 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.373685 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.373717 <... close resumed> ) = 0
[pid 25443] 10:12:35.373739 <... mmap resumed> ) = 0x7fdec5ab4000
[pid 25433] 10:12:35.373772 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.373811 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.373836 <... open resumed> ) = 11
[pid 25457] 10:12:35.373870 munmap(0x7f293c0ea000, 4096 <unfinished ...>
[pid 25443] 10:12:35.373912 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.373940 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.373971 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.374008 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.374033 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.374051 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.374068 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.374093 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.374108 <... ioctl resumed> , 0x7ffc7ad8e210) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.374131 close(11 <unfinished ...>
[pid 25443] 10:12:35.374156 read(13,  <unfinished ...>
[pid 25433] 10:12:35.374179 read(11,  <unfinished ...>
[pid 25461] 10:12:35.374210 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.374239 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.374262 <... close resumed> ) = 0
[pid 25443] 10:12:35.374278 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.374303 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25461] 10:12:35.374340 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.374356 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.374378 munmap(0x7f293c0e9000, 4096 <unfinished ...>
[pid 25443] 10:12:35.374406 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25433] 10:12:35.374436 close(11 <unfinished ...>
[pid 25461] 10:12:35.374467 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.374577 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25457] 10:12:35.374602 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.374620 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25433] 10:12:35.374690 <... close resumed> ) = 0
[pid 25461] 10:12:35.374723 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.374748 <... fcntl resumed> ) = 0
[pid 25457] 10:12:35.374787 close(9 <unfinished ...>
[pid 25443] 10:12:35.374828 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.374870 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.374923 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.374956 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25457] 10:12:35.374981 <... close resumed> ) = 0
[pid 25443] 10:12:35.374997 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.375034 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.375062 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.375077 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25457] 10:12:35.375334 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25443] 10:12:35.375370 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.375395 stat("/var/tmp",  <unfinished ...>
[pid 25461] 10:12:35.375434 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.375469 brk(0x1499000 <unfinished ...>
[pid 25457] 10:12:35.375565 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.375778 <... lseek resumed> ) = 353
[pid 25433] 10:12:35.375841 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25461] 10:12:35.376057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.376095 <... brk resumed> ) = 0x1499000
[pid 25457] 10:12:35.376128 close(13 <unfinished ...>
[pid 25443] 10:12:35.376157 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.376189 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.376226 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.376259 read(11,  <unfinished ...>
[pid 25457] 10:12:35.376283 <... close resumed> ) = 0
[pid 25443] 10:12:35.376299 <... open resumed> ) = 14
[pid 25433] 10:12:35.376320 <... open resumed> ) = 11
[pid 25461] 10:12:35.376345 <... open resumed> ) = 9
[pid 25458] 10:12:35.376359 <... read resumed> "", 8192) = 0
[pid 25457] 10:12:35.376386 munmap(0x7f293c0e7000, 4096 <unfinished ...>
[pid 25443] 10:12:35.376414 fstat(14,  <unfinished ...>
[pid 25433] 10:12:35.376438 fcntl(11, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.376469 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.376550 close(11 <unfinished ...>
[pid 25457] 10:12:35.376577 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.376720 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25433] 10:12:35.376780 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.376820 <... ioctl resumed> , 0x7ffc6a220c40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.376845 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.376886 <... close resumed> ) = 0
[pid 25457] 10:12:35.377171 close(12 <unfinished ...>
[pid 25443] 10:12:35.377208 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.377237 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.377270 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.377293 stat("/etc/exim.pl",  <unfinished ...>
[pid 25457] 10:12:35.377321 <... close resumed> ) = 0
[pid 25443] 10:12:35.377343 <... mmap resumed> ) = 0x7fdec5ab3000
[pid 25433] 10:12:35.377361 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.377387 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.377401 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.377441 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.377483 munmap(0x7f293c0e8000, 4096 <unfinished ...>
[pid 25443] 10:12:35.377513 read(14,  <unfinished ...>
[pid 25433] 10:12:35.377542 fstat(11,  <unfinished ...>
[pid 25461] 10:12:35.377575 read(9,  <unfinished ...>
[pid 25460] 10:12:35.377600 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.377628 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.377656 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.377691 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25433] 10:12:35.377730 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25461] 10:12:35.377817 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25460] 10:12:35.377850 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.378062 <... open resumed> ) = 11
[pid 25457] 10:12:35.378088 geteuid( <unfinished ...>
[pid 25443] 10:12:35.378113 close(14 <unfinished ...>
[pid 25433] 10:12:35.378138 pread(11,  <unfinished ...>
[pid 25461] 10:12:35.378172 brk(0x152a000 <unfinished ...>
[pid 25460] 10:12:35.378196 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.378222 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.378246 <... geteuid resumed> ) = 0
[pid 25443] 10:12:35.378262 <... close resumed> ) = 0
[pid 25433] 10:12:35.378279 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25461] 10:12:35.378329 <... brk resumed> ) = 0x152a000
[pid 25460] 10:12:35.378348 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.378957 <... ioctl resumed> , 0x7ffc7ad8e040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.378992 getegid( <unfinished ...>
[pid 25443] 10:12:35.379018 munmap(0x7fdec5ab3000, 4096 <unfinished ...>
[pid 25433] 10:12:35.379047 pread(11,  <unfinished ...>
[pid 25461] 10:12:35.379082 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.379106 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.379132 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.379156 <... getegid resumed> ) = 12
[pid 25443] 10:12:35.379176 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.379208 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25461] 10:12:35.379252 <... lseek resumed> ) = 4868
[pid 25460] 10:12:35.379267 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.379285 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.379328 setgid(12 <unfinished ...>
[pid 25443] 10:12:35.379356 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.379383 close(11 <unfinished ...>
[pid 25461] 10:12:35.379418 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.379442 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.379469 read(11,  <unfinished ...>
[pid 25457] 10:12:35.379570 <... setgid resumed> ) = 0
[pid 25443] 10:12:35.379590 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.379615 <... close resumed> ) = 0
[pid 25461] 10:12:35.379661 <... lseek resumed> ) = 4868
[pid 25460] 10:12:35.379678 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.379696 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25457] 10:12:35.380612 setuid(47 <unfinished ...>
[pid 25443] 10:12:35.380655 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.380684 close(10 <unfinished ...>
[pid 25461] 10:12:35.380726 close(9 <unfinished ...>
[pid 25460] 10:12:35.380764 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.380815 brk(0x14ba000 <unfinished ...>
[pid 25457] 10:12:35.380852 <... setuid resumed> ) = 0
[pid 25443] 10:12:35.380887 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.380950 <... close resumed> ) = 0
[pid 25461] 10:12:35.380992 <... close resumed> ) = 0
[pid 25460] 10:12:35.381007 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.381040 <... brk resumed> ) = 0x14ba000
[pid 25457] 10:12:35.381413 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2939ceb6a0},  <unfinished ...>
[pid 25443] 10:12:35.381455 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.381550 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.381592 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25460] 10:12:35.381620 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.381650 read(11,  <unfinished ...>
[pid 25457] 10:12:35.381676 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:35.381708 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.381760 <... open resumed> ) = 10
[pid 25461] 10:12:35.381811 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.381836 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.381864 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25457] 10:12:35.382650 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25443] 10:12:35.382698 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.382730 fstat(10,  <unfinished ...>
[pid 25461] 10:12:35.382789 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25460] 10:12:35.382831 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.382878 brk(0x14db000 <unfinished ...>
[pid 25457] 10:12:35.382917 <... write resumed> ) = 36
[pid 25443] 10:12:35.382940 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.382998 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.383044 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.383061 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.383080 <... brk resumed> ) = 0x14db000
[pid 25457] 10:12:35.383611 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.383655 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.383682 fstat(10,  <unfinished ...>
[pid 25461] 10:12:35.383715 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25460] 10:12:35.383750 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.383798 read(11,  <unfinished ...>
[pid 25457] 10:12:35.383837 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.383897 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.383952 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.383993 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.384009 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.384026 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25457] 10:12:35.384662 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.384705 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.384736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.384798 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25460] 10:12:35.384838 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.384886 brk(0x14fc000 <unfinished ...>
[pid 25457] 10:12:35.384921 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.384958 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.384999 <... mmap resumed> ) = 0x7fea0f284000
[pid 25461] 10:12:35.385028 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.385044 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.385063 <... brk resumed> ) = 0x14fc000
[pid 25457] 10:12:35.385618 close(7 <unfinished ...>
[pid 25443] 10:12:35.385659 stat("/etc/userdomains",  <unfinished ...>
[pid 25433] 10:12:35.385688 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.385722 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25460] 10:12:35.385776 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.385823 read(11,  <unfinished ...>
[pid 25457] 10:12:35.385862 <... close resumed> ) = 0
[pid 25443] 10:12:35.385891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.385957 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.385987 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.386004 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.386021 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25457] 10:12:35.386042 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25443] 10:12:35.386353 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25433] 10:12:35.386386 read(10,  <unfinished ...>
[pid 25461] 10:12:35.386424 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25460] 10:12:35.386451 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.386546 read(11,  <unfinished ...>
[pid 25457] 10:12:35.386575 <... open resumed> ) = 7
[pid 25443] 10:12:35.386593 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.386617 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25461] 10:12:35.386672 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.386691 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.386726 <... read resumed> "", 8192) = 0
[pid 25457] 10:12:35.386755 fcntl(7, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.386801 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.386844 pipe( <unfinished ...>
[pid 25461] 10:12:35.386903 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25460] 10:12:35.386939 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.386971 close(11 <unfinished ...>
[pid 25457] 10:12:35.386994 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.387011 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.387052 <... pipe resumed> [11, 12]) = 0
[pid 25461] 10:12:35.387083 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.387099 <... open resumed> ) = 9
[pid 25458] 10:12:35.387114 <... close resumed> ) = 0
[pid 25457] 10:12:35.387132 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.387179 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.387208 close(10 <unfinished ...>
[pid 25461] 10:12:35.387242 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25460] 10:12:35.387279 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.387303 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25457] 10:12:35.387330 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.387348 <... open resumed> ) = 14
[pid 25433] 10:12:35.387365 <... close resumed> ) = 0
[pid 25461] 10:12:35.387390 <... stat resumed> 0x7ffc6a220e50) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.387406 <... ioctl resumed> , 0x7ffe4db24450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.387425 <... stat resumed> 0x7f03f3286880) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.387442 fstat(7,  <unfinished ...>
[pid 25443] 10:12:35.387471 fstat(14,  <unfinished ...>
[pid 25433] 10:12:35.387576 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25461] 10:12:35.387616 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25460] 10:12:35.387646 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.387669 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25457] 10:12:35.387694 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371017, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.387725 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.387777 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.387823 <... stat resumed> 0x7ffc6a220ef0) = -1 ENOENT (No such file or directory)
[pid 25460] 10:12:35.387847 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.387870 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.387948 write(7, "2015-12-30 10:12:35 [25457] 1aEJMY-0006cP-Ry Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25443] 10:12:35.387983 fstat(14,  <unfinished ...>
[pid 25433] 10:12:35.388007 clone( <unfinished ...>
[pid 25461] 10:12:35.388339 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25460] 10:12:35.388374 read(9,  <unfinished ...>
[pid 25458] 10:12:35.388398 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25457] 10:12:35.388424 <... write resumed> ) = 77
[pid 25443] 10:12:35.388444 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.388551 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25460] 10:12:35.388585 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25458] 10:12:35.388608 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25457] 10:12:35.388862 open("/var/spool/exim/input/Y/hdr.25457", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25443] 10:12:35.388964 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.388995 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25471
[pid 25461] 10:12:35.389044 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.389081 brk(0x1630000 <unfinished ...>
[pid 25458] 10:12:35.389106 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.389134 <... open resumed> ) = 9
[pid 25443] 10:12:35.389150 <... mmap resumed> ) = 0x7fdec5ab3000
[pid 25433] 10:12:35.389168 close(12 <unfinished ...>
[pid 25461] 10:12:35.389200 <... open resumed> ) = 9
[pid 25460] 10:12:35.389213 <... brk resumed> ) = 0x1630000
[pid 25458] 10:12:35.389231 <... open resumed> ) = 11
[pid 25457] 10:12:35.389776 fchown(9, 47, 12 <unfinished ...>
[pid 25443] 10:12:35.389834 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.389874 <... close resumed> ) = 0
[pid 25461] 10:12:35.389922 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25460] 10:12:35.389955 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.389979 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.390003 <... fchown resumed> ) = 0
[pid 25452] 10:12:35.390025 <... select resumed> ) = 1 (in [11], left {299, 959476})
[pid 25443] 10:12:35.390056 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.390074 read(11,  <unfinished ...>
[pid 25461] 10:12:35.390106 <... ioctl resumed> , 0x7ffc6a220c40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25460] 10:12:35.390122 <... lseek resumed> ) = 4868
[pid 25458] 10:12:35.390138 <... ioctl resumed> , 0x7ffc7ad8e040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.390158 fchmod(9, 0640 <unfinished ...>
[pid 25452] 10:12:35.390185 read(11,  <unfinished ...>
[pid 25443] 10:12:35.390210 read(14,  <unfinished ...>
[pid 25461] 10:12:35.390243 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.390266 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.390289 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.390311 <... fchmod resumed> ) = 0
[pid 25452] 10:12:35.390328 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25443] 10:12:35.390348 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.390389 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.390406 <... lseek resumed> ) = 4868
[pid 25458] 10:12:35.390437 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.390482 fcntl(9, F_GETFL <unfinished ...>
[pid 25452] 10:12:35.390511 read(11,  <unfinished ...>
[pid 25443] 10:12:35.390536 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.390577 read(9,  <unfinished ...>
[pid 25460] 10:12:35.390602 close(9 <unfinished ...>
[pid 25458] 10:12:35.390627 read(11,  <unfinished ...>
[pid 25457] 10:12:35.390657 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25452] 10:12:35.390677 <... read resumed> "n\205\202\250<\377\177\366\215u\20\246r~\366Z\251\303C\345\337\247\231\304t8\255\260\345\347\322\313", 32) = 32
[pid 25443] 10:12:35.390706 <... open resumed> ) = 15
[pid 25461] 10:12:35.390738 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25460] 10:12:35.391213 <... close resumed> ) = 0
[pid 25458] 10:12:35.391241 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25457] 10:12:35.391641 fstat(9,  <unfinished ...>
[pid 25452] 10:12:35.391686 read(11,  <unfinished ...>
[pid 25443] 10:12:35.391713 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.391759 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.391801 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.391844 brk(0x151d000 <unfinished ...>
[pid 25457] 10:12:35.391886 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800130, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25452] 10:12:35.391931 <... read resumed> "\27\3\1\0P", 5) = 5
[pid 25443] 10:12:35.391951 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.391990 <... lseek resumed> ) = 2366
[pid 25460] 10:12:35.392004 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.392023 <... brk resumed> ) = 0x151d000
[pid 25457] 10:12:35.392219 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.392256 read(11,  <unfinished ...>
[pid 25443] 10:12:35.392283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.392319 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.392343 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.392372 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.392398 <... mmap resumed> ) = 0x7f293c0eb000
[pid 25452] 10:12:35.392415 <... read resumed> "F\321\273E\304\272\365\351>\v\355[\222\210\302O\0\370d\203{QcL\234\20\216\3601\373\\\f\"\321\371\310\360\201Nm\207z\217\201C\330$\364\22Z\273\314\322\315\256\10\224&B\234\230\365\322\25@\33\236\260\251\246r\307<\37\261\266\247\223\322\6", 80) = 80
[pid 25443] 10:12:35.392451 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25461] 10:12:35.392484 <... lseek resumed> ) = 2366
[pid 25460] 10:12:35.392499 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.392519 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.392542 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25452] 10:12:35.392566 write(11, "\27\3\1\0 \242<f4\234\36\206\373\260\25\225\351/!\352\355]\333\225\224\314\272spNy\233\264\340\271cX\27\3\1\0 \1\334\331\355\255xl\360e\324\313\16\247\36\370\344R\4t+\322\222N\252\303Cc\376h7|@", 74 <unfinished ...>
[pid 25443] 10:12:35.392618 read(15,  <unfinished ...>
[pid 25461] 10:12:35.392657 close(9 <unfinished ...>
[pid 25460] 10:12:35.392682 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.392708 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.392739 <... lseek resumed> ) = 0
[pid 25452] 10:12:35.392795 <... write resumed> ) = 74
[pid 25443] 10:12:35.392827 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.392869 <... close resumed> ) = 0
[pid 25460] 10:12:35.392884 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.393240 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.393276 write(9, "1aEJMY-0006cP-Ry-H\nmailnull 47 12\n<>\n1451491954 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491955\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25452] 10:12:35.393319 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25443] 10:12:35.393355 close(15 <unfinished ...>
[pid 25461] 10:12:35.393389 read(8,  <unfinished ...>
[pid 25460] 10:12:35.393413 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.393439 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.393466 <... write resumed> ) = 268
[pid 25443] 10:12:35.393594 <... close resumed> ) = 0
[pid 25461] 10:12:35.393625 <... read resumed> "", 8192) = 0
[pid 25460] 10:12:35.393640 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.393660 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.393683 fstat(9,  <unfinished ...>
[pid 25443] 10:12:35.393707 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25461] 10:12:35.393754 close(8 <unfinished ...>
[pid 25460] 10:12:35.393794 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.393832 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.393859 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800130, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.393896 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.393937 <... close resumed> ) = 0
[pid 25460] 10:12:35.393953 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.394165 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.394197 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMY-0006cP-Ry\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:34 -0600\n074  X-Failed-Recipients: info@evrc.net,\n  finest09@fin.finestweddingsites.com\n"..., 708 <unfinished ...>
[pid 25443] 10:12:35.394232 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.394266 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.394296 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.394322 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.394353 <... write resumed> ) = 708
[pid 25443] 10:12:35.394374 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.394430 <... open resumed> ) = 8
[pid 25460] 10:12:35.394446 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.394465 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.394493 fsync(9 <unfinished ...>
[pid 25443] 10:12:35.394565 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25461] 10:12:35.394611 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.394719 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.394749 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25443] 10:12:35.394778 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.394809 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25460] 10:12:35.394837 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.394854 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.394880 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.394921 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.394948 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.394979 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.395008 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.395024 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.395067 <... mmap resumed> ) = 0x7f2b29363000
[pid 25460] 10:12:35.395083 <... stat resumed> 0x7ffe4db24660) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.395100 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.395122 fstat(9,  <unfinished ...>
[pid 25443] 10:12:35.395146 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25461] 10:12:35.395183 read(8,  <unfinished ...>
[pid 25460] 10:12:35.395210 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.395239 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.395268 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800130, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=976, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.395296 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25461] 10:12:35.395344 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.395361 <... stat resumed> 0x7ffe4db24700) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.395368 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.395380 close(9 <unfinished ...>
[pid 25443] 10:12:35.395392 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25458] 10:12:35.395409 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.395425 <... close resumed> ) = 0
[pid 25443] 10:12:35.395433 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.395451 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.395461 munmap(0x7f293c0eb000, 4096 <unfinished ...>
[pid 25443] 10:12:35.395639 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.395683 close(8 <unfinished ...>
[pid 25460] 10:12:35.395708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.395738 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.395767 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.395790 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.395843 <... close resumed> ) = 0
[pid 25460] 10:12:35.395860 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25458] 10:12:35.395894 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.395920 rename("/var/spool/exim/input/Y/hdr.25457", "/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-H" <unfinished ...>
[pid 25443] 10:12:35.396010 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25461] 10:12:35.396047 munmap(0x7f2b29363000, 4096 <unfinished ...>
[pid 25460] 10:12:35.396073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.396106 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25457] 10:12:35.396136 <... rename resumed> ) = 0
[pid 25443] 10:12:35.396155 <... stat resumed> 0x7ffd9471c570) = -1 ENOENT (No such file or directory)
[pid 25461] 10:12:35.396185 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.396200 <... open resumed> ) = 9
[pid 25458] 10:12:35.396261 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25457] 10:12:35.396288 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25443] 10:12:35.396320 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.396354 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.396377 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.396402 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25457] 10:12:35.396433 <... open resumed> ) = 9
[pid 25443] 10:12:35.396449 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.396567 <... lseek resumed> ) = 19
[pid 25460] 10:12:35.396589 <... ioctl resumed> , 0x7ffe4db24450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.396608 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25457] 10:12:35.396642 fsync(9 <unfinished ...>
[pid 25443] 10:12:35.396668 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.396703 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.396731 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.396754 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25457] 10:12:35.396786 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.396802 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.396898 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.396919 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.396935 <... open resumed> ) = 12
[pid 25457] 10:12:35.396972 close(9 <unfinished ...>
[pid 25443] 10:12:35.397002 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.397033 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.397061 read(9,  <unfinished ...>
[pid 25458] 10:12:35.397087 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25457] 10:12:35.397111 <... close resumed> ) = 0
[pid 25443] 10:12:35.397128 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.397153 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.397168 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25458] 10:12:35.397194 <... ioctl resumed> , 0x7ffc7ad8da50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25457] 10:12:35.397746 close(8 <unfinished ...>
[pid 25443] 10:12:35.397787 read(14,  <unfinished ...>
[pid 25461] 10:12:35.397822 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.397851 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.397875 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25457] 10:12:35.397898 <... close resumed> ) = 0
[pid 25443] 10:12:35.397915 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.397963 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.397983 <... lseek resumed> ) = 2366
[pid 25458] 10:12:35.398000 <... lseek resumed> ) = 0
[pid 25457] 10:12:35.398041 munmap(0x7f293c0ec000, 4096 <unfinished ...>
[pid 25443] 10:12:35.398075 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.398113 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.398140 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.398163 read(12,  <unfinished ...>
[pid 25457] 10:12:35.398188 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.398213 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.398265 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.398281 <... lseek resumed> ) = 2366
[pid 25458] 10:12:35.398297 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25457] 10:12:35.398619 unlink("/var/spool/exim/input/Y/1aEJMY-0006cP-Ry-J" <unfinished ...>
[pid 25443] 10:12:35.398663 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.398702 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.398733 close(9 <unfinished ...>
[pid 25458] 10:12:35.398759 read(12,  <unfinished ...>
[pid 25457] 10:12:35.398785 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.398812 <... open resumed> ) = 15
[pid 25461] 10:12:35.398839 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.398854 <... close resumed> ) = 0
[pid 25458] 10:12:35.398873 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25457] 10:12:35.399833 close(6 <unfinished ...>
[pid 25449] 10:12:35.399880 <... select resumed> ) = 1 (in [11], left {299, 948056})
[pid 25443] 10:12:35.399906 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.399942 alarm(300 <unfinished ...>
[pid 25460] 10:12:35.399967 read(8,  <unfinished ...>
[pid 25458] 10:12:35.399991 brk(0x153e000 <unfinished ...>
[pid 25457] 10:12:35.400016 <... close resumed> ) = 0
[pid 25449] 10:12:35.400166 recvfrom(11,  <unfinished ...>
[pid 25443] 10:12:35.400198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.400243 <... alarm resumed> ) = 0
[pid 25460] 10:12:35.400264 <... read resumed> "", 8192) = 0
[pid 25458] 10:12:35.400281 <... brk resumed> ) = 0x153e000
[pid 25457] 10:12:35.400471 exit_group(0) = ?
[pid 25449] 10:12:35.401087 <... recvfrom resumed> "354 Start mail input; end with <CRLF>.<CRLF>\r\n", 4096, 0, NULL, NULL) = 46
[pid 25443] 10:12:35.401138 fstat(15,  <unfinished ...>
[pid 25461] 10:12:35.401236 alarm(0 <unfinished ...>
[pid 25460] 10:12:35.401261 close(8 <unfinished ...>
[pid 25458] 10:12:35.401285 read(12,  <unfinished ...>
[pid 25457] 10:12:35.401311 +++ exited with 0 +++
[pid 25449] 10:12:35.401324 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.401350 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.401389 <... alarm resumed> ) = 300
[pid 25460] 10:12:35.401404 <... close resumed> ) = 0
[pid 25458] 10:12:35.401419 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25449] 10:12:35.402071 <... lseek resumed> ) = 19
[pid 25443] 10:12:35.402103 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.402144 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.402235 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.402270 read(12,  <unfinished ...>
[pid 25449] 10:12:35.402295 read(6,  <unfinished ...>
[pid 25443] 10:12:35.402326 <... mmap resumed> ) = 0x7fdec5ab2000
[pid 25461] 10:12:35.402353 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.402368 <... open resumed> ) = 8
[pid 25458] 10:12:35.402384 <... read resumed> "", 8192) = 0
[pid 25449] 10:12:35.402406 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25443] 10:12:35.402439 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.402561 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.402593 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.402616 close(12 <unfinished ...>
[pid 25449] 10:12:35.402641 read(6,  <unfinished ...>
[pid 25443] 10:12:35.402664 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.402690 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.402704 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.402738 <... close resumed> ) = 0
[pid 25449] 10:12:35.403429 <... read resumed> "", 8192) = 0
[pid 25443] 10:12:35.403464 read(15,  <unfinished ...>
[pid 25461] 10:12:35.403560 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.403591 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.403619 read(11,  <unfinished ...>
[pid 25449] 10:12:35.403644 alarm(300 <unfinished ...>
[pid 25443] 10:12:35.403669 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.403705 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.403722 <... mmap resumed> ) = 0x7f9083401000
[pid 25458] 10:12:35.403744 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25449] 10:12:35.403772 <... alarm resumed> ) = 0
[pid 25443] 10:12:35.404480 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25461] 10:12:35.404533 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.404562 read(8,  <unfinished ...>
[pid 25458] 10:12:35.404589 read(11,  <unfinished ...>
[pid 25449] 10:12:35.404614 write(11, "Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\r\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\r\n\tid 1aEJMX-0006bl-RX; Wed, 30 Dec 2015 10:12:33 -0600\r\nTo:  salesadmin@phoenixmarriottmesa.com, rivankovich@phoenixmarriot"..., 3168 <unfinished ...>
[pid 25443] 10:12:35.404685 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25461] 10:12:35.404746 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.404763 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.404785 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25449] 10:12:35.404811 <... write resumed> ) = 3168
[pid 25443] 10:12:35.405567 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.405623 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f2b2821b790},  <unfinished ...>
[pid 25460] 10:12:35.405653 close(8 <unfinished ...>
[pid 25458] 10:12:35.405678 read(11,  <unfinished ...>
[pid 25449] 10:12:35.405703 alarm(0 <unfinished ...>
[pid 25443] 10:12:35.405728 <... open resumed> ) = 16
[pid 25461] 10:12:35.405753 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25460] 10:12:35.405768 <... close resumed> ) = 0
[pid 25458] 10:12:35.405785 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25449] 10:12:35.405806 <... alarm resumed> ) = 300
[pid 25443] 10:12:35.406323 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.406369 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.406400 munmap(0x7f9083401000, 4096 <unfinished ...>
[pid 25458] 10:12:35.406429 brk(0x155f000 <unfinished ...>
[pid 25449] 10:12:35.406454 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25443] 10:12:35.406543 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25461] 10:12:35.406585 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0}, 8) = 0
[pid 25460] 10:12:35.406604 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.406620 <... brk resumed> ) = 0x155f000
[pid 25443] 10:12:35.406686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.406806 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.406837 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.406862 read(11,  <unfinished ...>
[pid 25443] 10:12:35.406893 <... mmap resumed> ) = 0x7fdec5ab1000
[pid 25461] 10:12:35.406919 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0}, 8) = 0
[pid 25460] 10:12:35.406937 <... lseek resumed> ) = 19
[pid 25458] 10:12:35.406960 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25443] 10:12:35.406982 read(16,  <unfinished ...>
[pid 25461] 10:12:35.407579 stat("/etc/localtime",  <unfinished ...>
[pid 25460] 10:12:35.407613 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.407656 read(11,  <unfinished ...>
[pid 25443] 10:12:35.407699 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25461] 10:12:35.407746 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.407778 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.407807 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25443] 10:12:35.407829 close(16 <unfinished ...>
[pid 25461] 10:12:35.408333 open("/var/spool/exim/input/Z/hdr.25461", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25460] 10:12:35.408410 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.408443 brk(0x1580000 <unfinished ...>
[pid 25443] 10:12:35.408468 <... close resumed> ) = 0
[pid 25461] 10:12:35.408579 <... open resumed> ) = 8
[pid 25460] 10:12:35.408596 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.408613 <... brk resumed> ) = 0x1580000
[pid 25443] 10:12:35.408629 munmap(0x7fdec5ab1000, 4096 <unfinished ...>
[pid 25461] 10:12:35.409177 fchown(8, 47, 12 <unfinished ...>
[pid 25460] 10:12:35.409211 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.409241 read(11,  <unfinished ...>
[pid 25443] 10:12:35.409266 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.409309 <... fchown resumed> ) = 0
[pid 25460] 10:12:35.409326 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.409342 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25443] 10:12:35.409364 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.409981 fchmod(8, 0640 <unfinished ...>
[pid 25460] 10:12:35.410012 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.410041 read(11,  <unfinished ...>
[pid 25443] 10:12:35.410066 <... open resumed> ) = 16
[pid 25461] 10:12:35.410091 <... fchmod resumed> ) = 0
[pid 25460] 10:12:35.410105 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.410122 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25443] 10:12:35.410149 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.410574 fcntl(8, F_GETFL <unfinished ...>
[pid 25460] 10:12:35.410604 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.410633 brk(0x15a1000 <unfinished ...>
[pid 25443] 10:12:35.410656 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25461] 10:12:35.410699 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25460] 10:12:35.410731 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.410754 <... brk resumed> ) = 0x15a1000
[pid 25443] 10:12:35.410787 fstat(16,  <unfinished ...>
[pid 25461] 10:12:35.411132 fstat(8,  <unfinished ...>
[pid 25460] 10:12:35.411159 alarm(300 <unfinished ...>
[pid 25458] 10:12:35.411184 read(11,  <unfinished ...>
[pid 25443] 10:12:35.411205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25461] 10:12:35.411242 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.411271 <... alarm resumed> ) = 0
[pid 25443] 10:12:35.411285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.411317 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.411342 <... mmap resumed> ) = 0x7fdec5ab1000
[pid 25461] 10:12:35.411363 <... mmap resumed> ) = 0x7f2b29363000
[pid 25443] 10:12:35.411380 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.411407 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.411430 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.411450 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.411489 read(16,  <unfinished ...>
[pid 25461] 10:12:35.411524 write(8, "1aEJMZ-0006cf-8U-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25443] 10:12:35.411563 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25461] 10:12:35.411601 <... write resumed> ) = 268
[pid 25443] 10:12:35.411619 read(16,  <unfinished ...>
[pid 25461] 10:12:35.411646 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.411669 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.411703 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.411747 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.411806 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMZ-0006cf-8U\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:35 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691 <unfinished ...>
[pid 25443] 10:12:35.411853 <... open resumed> ) = 17
[pid 25461] 10:12:35.411905 <... write resumed> ) = 691
[pid 25460] 10:12:35.411930 alarm(0 <unfinished ...>
[pid 25458] 10:12:35.411954 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25443] 10:12:35.411978 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.412617 fsync(8 <unfinished ...>
[pid 25460] 10:12:35.412693 <... alarm resumed> ) = 300
[pid 25443] 10:12:35.412710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25443] 10:12:35.412843 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab0000
[pid 25443] 10:12:35.412891 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25460] 10:12:35.412986 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25443] 10:12:35.413021 close(17 <unfinished ...>
[pid 25461] 10:12:35.413051 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.413068 <... close resumed> ) = 0
[pid 25461] 10:12:35.413088 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.413111 munmap(0x7fdec5ab0000, 4096 <unfinished ...>
[pid 25461] 10:12:35.413142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.413173 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.413205 close(8 <unfinished ...>
[pid 25443] 10:12:35.413232 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25461] 10:12:35.413266 <... close resumed> ) = 0
[pid 25443] 10:12:35.413283 <... open resumed> ) = 17
[pid 25461] 10:12:35.413303 munmap(0x7f2b29363000, 4096 <unfinished ...>
[pid 25443] 10:12:35.413330 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.413357 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.413379 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25461] 10:12:35.413416 rename("/var/spool/exim/input/Z/hdr.25461", "/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-H" <unfinished ...>
[pid 25443] 10:12:35.413473 fstat(17,  <unfinished ...>
[pid 25461] 10:12:35.413583 <... rename resumed> ) = 0
[pid 25460] 10:12:35.413603 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25443] 10:12:35.413617 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25461] 10:12:35.413650 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25443] 10:12:35.413681 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25461] 10:12:35.413712 <... open resumed> ) = 8
[pid 25443] 10:12:35.413731 <... mmap resumed> ) = 0x7fdec5ab0000
[pid 25461] 10:12:35.413764 fsync(8 <unfinished ...>
[pid 25443] 10:12:35.413810 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25461] 10:12:35.413859 <... fsync resumed> ) = 0
[pid 25460] 10:12:35.413887 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25443] 10:12:35.413921 <... lseek resumed> ) = 0
[pid 25461] 10:12:35.413943 close(8 <unfinished ...>
[pid 25443] 10:12:35.413968 read(17,  <unfinished ...>
[pid 25461] 10:12:35.413995 <... close resumed> ) = 0
[pid 25443] 10:12:35.414013 <... read resumed> "", 4096) = 0
[pid 25461] 10:12:35.414054 fstat(6,  <unfinished ...>
[pid 25443] 10:12:35.414081 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.414113 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3151, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.414155 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.414201 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cf-8U", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25443] 10:12:35.414280 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.414313 <... open resumed> ) = 8
[pid 25443] 10:12:35.414330 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.414373 fcntl(8, F_GETFL <unfinished ...>
[pid 25443] 10:12:35.414401 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.414431 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25443] 10:12:35.414450 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.414566 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.414597 stat("/etc/userdomains",  <unfinished ...>
[pid 25461] 10:12:35.414628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064866, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.414656 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25461] 10:12:35.414699 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.414732 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.414948 <... mmap resumed> ) = 0x7f2b29363000
[pid 25443] 10:12:35.414971 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.415025 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.415043 read(11,  <unfinished ...>
[pid 25461] 10:12:35.415077 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25460] 10:12:35.415101 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25443] 10:12:35.415128 write(8, "2015-12-30 10:12:35 routing failed for finest09@fin.finestweddingsites.com <radissonphx-north@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 179 <unfinished ...>
[pid 25461] 10:12:35.415168 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.415187 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.415201 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25443] 10:12:35.415221 <... write resumed> ) = 179
[pid 25461] 10:12:35.415462 stat("/etc/localtime",  <unfinished ...>
[pid 25460] 10:12:35.415577 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25458] 10:12:35.415606 brk(0x15c2000 <unfinished ...>
[pid 25443] 10:12:35.415627 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.415659 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.415698 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25443] 10:12:35.415714 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.415759 write(8, "2015-12-30 10:12:35 Received from <> R=1aEJMX-0006bg-Lo U=mailnull P=local S=3774 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142 <unfinished ...>
[pid 25443] 10:12:35.415797 stat("/etc/localtime",  <unfinished ...>
[pid 25461] 10:12:35.415828 <... write resumed> ) = 142
[pid 25443] 10:12:35.415845 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25461] 10:12:35.415880 close(8 <unfinished ...>
[pid 25443] 10:12:35.415906 close(7 <unfinished ...>
[pid 25461] 10:12:35.415934 <... close resumed> ) = 0
[pid 25443] 10:12:35.415951 <... close resumed> ) = 0
[pid 25461] 10:12:35.415973 munmap(0x7f2b29363000, 4096 <unfinished ...>
[pid 25443] 10:12:35.416003 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25461] 10:12:35.416041 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.416061 <... open resumed> ) = 7
[pid 25461] 10:12:35.416081 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.416107 fcntl(7, F_GETFD <unfinished ...>
[pid 25461] 10:12:35.416134 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.416170 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.416195 stat("/etc/localtime",  <unfinished ...>
[pid 25460] 10:12:35.416226 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f90822b9790},  <unfinished ...>
[pid 25443] 10:12:35.416253 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25461] 10:12:35.416283 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25460] 10:12:35.416314 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.416335 <... brk resumed> ) = 0x15c2000
[pid 25443] 10:12:35.416349 <... fcntl resumed> ) = 0
[pid 25461] 10:12:35.416916 close(7 <unfinished ...>
[pid 25460] 10:12:35.416961 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25443] 10:12:35.416993 fstat(7,  <unfinished ...>
[pid 25461] 10:12:35.417032 <... close resumed> ) = 0
[pid 25460] 10:12:35.417054 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, 8) = 0
[pid 25443] 10:12:35.417076 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371094, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25461] 10:12:35.417112 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25460] 10:12:35.417144 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25443] 10:12:35.417178 write(7, "2015-12-30 10:12:35 [25443] 1aEJMY-0006cE-He ** finest09@fin.finestweddingsites.com <radissonphx-north@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 188 <unfinished ...>
[pid 25461] 10:12:35.417216 <... open resumed> ) = 7
[pid 25460] 10:12:35.417233 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, 8) = 0
[pid 25443] 10:12:35.417259 <... write resumed> ) = 188
[pid 25461] 10:12:35.417284 fcntl(7, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.417308 stat("/etc/localtime",  <unfinished ...>
[pid 25443] 10:12:35.417334 close(16 <unfinished ...>
[pid 25461] 10:12:35.417363 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.417380 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:35.417421 <... close resumed> ) = 0
[pid 25461] 10:12:35.417444 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.417469 open("/var/spool/exim/input/Z/hdr.25460", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25443] 10:12:35.417527 munmap(0x7fdec5ab1000, 4096 <unfinished ...>
[pid 25461] 10:12:35.417564 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.417582 <... open resumed> ) = 8
[pid 25443] 10:12:35.417599 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.417622 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.417646 fchown(8, 47, 12 <unfinished ...>
[pid 25443] 10:12:35.417673 close(17 <unfinished ...>
[pid 25461] 10:12:35.417702 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371282, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.417737 <... fchown resumed> ) = 0
[pid 25443] 10:12:35.417763 <... close resumed> ) = 0
[pid 25461] 10:12:35.417800 write(7, "2015-12-30 10:12:35 [25461] 1aEJMZ-0006cf-8U <= <> R=1aEJMX-0006bg-Lo U=mailnull P=local S=3774 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204 <unfinished ...>
[pid 25460] 10:12:35.417846 fchmod(8, 0640 <unfinished ...>
[pid 25443] 10:12:35.417893 munmap(0x7fdec5ab0000, 4096 <unfinished ...>
[pid 25461] 10:12:35.418068 <... write resumed> ) = 204
[pid 25460] 10:12:35.418090 <... fchmod resumed> ) = 0
[pid 25458] 10:12:35.418108 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.418131 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.418154 close(6 <unfinished ...>
[pid 25460] 10:12:35.418182 fcntl(8, F_GETFL <unfinished ...>
[pid 25443] 10:12:35.418206 close(13 <unfinished ...>
[pid 25461] 10:12:35.418235 <... close resumed> ) = 0
[pid 25460] 10:12:35.418252 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25443] 10:12:35.418280 <... close resumed> ) = 0
[pid 25461] 10:12:35.418301 munmap(0x7f2b29364000, 4096 <unfinished ...>
[pid 25460] 10:12:35.418332 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.418355 munmap(0x7fdec5ab4000, 4096 <unfinished ...>
[pid 25461] 10:12:35.418386 <... munmap resumed> ) = 0
[pid 25460] 10:12:35.418404 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.418434 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.418467 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.418607 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.418638 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.418655 close(14 <unfinished ...>
[pid 25461] 10:12:35.418697 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0}, 8) = 0
[pid 25460] 10:12:35.418722 <... mmap resumed> ) = 0x7f9083401000
[pid 25458] 10:12:35.418750 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.418795 <... close resumed> ) = 0
[pid 25461] 10:12:35.418832 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0},  <unfinished ...>
[pid 25460] 10:12:35.418879 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.418916 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.418932 munmap(0x7fdec5ab3000, 4096 <unfinished ...>
[pid 25461] 10:12:35.418971 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f2b26f646a0}, 8) = 0
[pid 25460] 10:12:35.418993 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.419026 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.419054 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.419079 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.419118 write(8, "1aEJMZ-0006ce-8t-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 481 <unfinished ...>
[pid 25458] 10:12:35.419155 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.419170 close(9 <unfinished ...>
[pid 25461] 10:12:35.419203 <... open resumed> ) = 6
[pid 25460] 10:12:35.419222 <... write resumed> ) = 481
[pid 25458] 10:12:35.419240 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.419265 <... close resumed> ) = 0
[pid 25461] 10:12:35.419287 read(6,  <unfinished ...>
[pid 25460] 10:12:35.419317 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.419340 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.419354 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25461] 10:12:35.419395 <... read resumed> "0.18 0.08 0.01 3/250 25471\n", 40) = 27
[pid 25460] 10:12:35.419414 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=481, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.419449 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.419478 <... munmap resumed> ) = 0
[pid 25461] 10:12:35.419503 close(6 <unfinished ...>
[pid 25460] 10:12:35.419534 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006ce-8t; Wed, 30 Dec 2015 10:12:35 -0600\n124T To:  gretchen.murry@onehospitalitygroup.com, Jennifer.Gonzal"..., 607 <unfinished ...>
[pid 25458] 10:12:35.419565 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.419580 close(12 <unfinished ...>
[pid 25461] 10:12:35.419613 <... close resumed> ) = 0
[pid 25460] 10:12:35.419641 <... write resumed> ) = 607
[pid 25458] 10:12:35.419659 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.419685 <... close resumed> ) = 0
[pid 25461] 10:12:35.419707 clone( <unfinished ...>
[pid 25460] 10:12:35.420052 fsync(8 <unfinished ...>
[pid 25458] 10:12:35.420106 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.420123 munmap(0x7fdec5ab5000, 4096) = 0
[pid 25461] 10:12:35.420210 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2b2934ea90) = 25472
[pid 25443] 10:12:35.420463 close(15 <unfinished ...>
[pid 25461] 10:12:35.420610 exit_group(0) = ?
[pid 25460] 10:12:35.420926 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.420960 <... close resumed> ) = 0
[pid 25461] 10:12:35.421007 +++ exited with 0 +++
[pid 25460] 10:12:35.421027 fstat(8,  <unfinished ...>
[pid 25443] 10:12:35.421052 munmap(0x7fdec5ab2000, 4096 <unfinished ...>
[pid 25404] 10:12:35.421077 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25461
[pid 25460] 10:12:35.421106 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1088, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.421137 <... munmap resumed> ) = 0
[pid 25404] 10:12:35.421155 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0},  <unfinished ...>
[pid 25460] 10:12:35.421187 close(8 <unfinished ...>
[pid 25443] 10:12:35.421213 close(11 <unfinished ...>
[pid 25404] 10:12:35.421237 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb365eb96a0}, 8) = 0
[pid 25460] 10:12:35.421278 <... close resumed> ) = 0
[pid 25443] 10:12:35.421297 <... close resumed> ) = 0
[pid 25404] 10:12:35.421314 write(8, "2015-12-30 10:12:34 embassyphxnorth@finestweddingsites.com: children all complete\n", 82 <unfinished ...>
[pid 25460] 10:12:35.421352 munmap(0x7f9083401000, 4096 <unfinished ...>
[pid 25443] 10:12:35.421380 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25404] 10:12:35.421405 <... write resumed> ) = 82
[pid 25460] 10:12:35.421430 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.421452 <... munmap resumed> ) = 0
[pid 25404] 10:12:35.421470 open("/var/spool/exim/input/X/hdr.25404", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25460] 10:12:35.421651 rename("/var/spool/exim/input/Z/hdr.25460", "/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-H" <unfinished ...>
[pid 25458] 10:12:35.421703 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.421727 close(10 <unfinished ...>
[pid 25404] 10:12:35.421765 <... open resumed> ) = 10
[pid 25460] 10:12:35.421824 <... rename resumed> ) = 0
[pid 25458] 10:12:35.421853 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.421879 <... close resumed> ) = 0
[pid 25404] 10:12:35.421905 fchown(10, 47, 12 <unfinished ...>
[pid 25460] 10:12:35.421947 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25443] 10:12:35.421979 munmap(0x7fdec5ab7000, 4096 <unfinished ...>
[pid 25404] 10:12:35.422006 <... fchown resumed> ) = 0
[pid 25460] 10:12:35.422027 <... open resumed> ) = 8
[pid 25443] 10:12:35.422043 <... munmap resumed> ) = 0
[pid 25404] 10:12:35.422068 fchmod(10, 0640 <unfinished ...>
[pid 25460] 10:12:35.422100 fsync(8 <unfinished ...>
[pid 25443] 10:12:35.422124 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25404] 10:12:35.422176 <... fchmod resumed> ) = 0
[pid 25460] 10:12:35.422199 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.422217 <... open resumed> ) = 9
[pid 25404] 10:12:35.422234 fcntl(10, F_GETFL <unfinished ...>
[pid 25460] 10:12:35.422262 close(8 <unfinished ...>
[pid 25443] 10:12:35.422286 fcntl(9, F_GETFD <unfinished ...>
[pid 25404] 10:12:35.422308 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25460] 10:12:35.422335 <... close resumed> ) = 0
[pid 25443] 10:12:35.422357 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.422374 fstat(10,  <unfinished ...>
[pid 25460] 10:12:35.422402 fstat(6,  <unfinished ...>
[pid 25443] 10:12:35.422425 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25404] 10:12:35.422448 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.422545 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25443] 10:12:35.422600 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.422619 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.422653 open("/var/spool/exim/msglog/Z/1aEJMZ-0006ce-8t", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25443] 10:12:35.422706 fchown(9, 47, 12 <unfinished ...>
[pid 25404] 10:12:35.422745 <... mmap resumed> ) = 0x7fb3682b9000
Process 25471 attached
[pid 25460] 10:12:35.422822 <... open resumed> ) = 8
[pid 25458] 10:12:35.422876 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.422924 <... fchown resumed> ) = 0
[pid 25404] 10:12:35.422943 lseek(10, 0, SEEK_CUR <unfinished ...>
[pid 25471] 10:12:35.422975 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25460] 10:12:35.422997 fcntl(8, F_GETFL <unfinished ...>
[pid 25458] 10:12:35.423020 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.423035 fchmod(9, 0640 <unfinished ...>
[pid 25404] 10:12:35.423068 <... lseek resumed> ) = 0
[pid 25471] 10:12:35.423106 <... set_robust_list resumed> ) = 0
[pid 25460] 10:12:35.423122 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25458] 10:12:35.423222 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.423255 <... fchmod resumed> ) = 0
[pid 25404] 10:12:35.423297 write(10, "1aEJMX-0006bg-Lo-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 716 <unfinished ...>
[pid 25471] 10:12:35.423346 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25460] 10:12:35.423372 fstat(8,  <unfinished ...>
[pid 25458] 10:12:35.423396 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.423411 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25404] 10:12:35.423448 <... write resumed> ) = 716
[pid 25471] 10:12:35.423474 <... setrlimit resumed> ) = 0
[pid 25460] 10:12:35.423558 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064876, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.423703 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.423742 <... open resumed> ) = 10
[pid 25404] 10:12:35.423774 fstat(10,  <unfinished ...>
[pid 25471] 10:12:35.423824 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.423873 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.423914 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.423931 alarm(60 <unfinished ...>
[pid 25404] 10:12:35.423962 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=716, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25471] 10:12:35.424005 <... open resumed> ) = 10
[pid 25460] 10:12:35.424020 <... mmap resumed> ) = 0x7f9083401000
[pid 25458] 10:12:35.424047 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.424078 <... alarm resumed> ) = 0
[pid 25404] 10:12:35.424095 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bg-Lo; Wed, 30 Dec 2015 10:12:33 -0600\n068T To:  kay.olesen2@hilton.com, embassyphxnorth@finestweddingsi"..., 551 <unfinished ...>
[pid 25471] 10:12:35.424138 fstat(10,  <unfinished ...>
[pid 25460] 10:12:35.424161 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.424185 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.424199 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25404] 10:12:35.424230 <... write resumed> ) = 551
[pid 25471] 10:12:35.424261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25460] 10:12:35.424289 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.424322 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.424356 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.424373 fsync(10 <unfinished ...>
[pid 25471] 10:12:35.424432 fstat(10,  <unfinished ...>
[pid 25460] 10:12:35.424457 stat("/etc/localtime",  <unfinished ...>
[pid 25458] 10:12:35.424567 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.424577 alarm(0 <unfinished ...>
[pid 25471] 10:12:35.424599 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25460] 10:12:35.424617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.424646 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25443] 10:12:35.424654 <... alarm resumed> ) = 60
[pid 25471] 10:12:35.424731 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.424789 write(8, "2015-12-30 10:12:35 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2426 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148 <unfinished ...>
[pid 25458] 10:12:35.424843 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.424866 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25471] 10:12:35.424934 <... mmap resumed> ) = 0x7fea0f284000
[pid 25460] 10:12:35.424950 <... write resumed> ) = 148
[pid 25458] 10:12:35.424971 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25443] 10:12:35.425001 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:35.425036 <... fsync resumed> ) = 0
[pid 25471] 10:12:35.425062 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.425085 close(8 <unfinished ...>
[pid 25458] 10:12:35.425110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25443] 10:12:35.425136 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25404] 10:12:35.425171 fstat(10,  <unfinished ...>
[pid 25471] 10:12:35.425203 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.425216 <... close resumed> ) = 0
[pid 25458] 10:12:35.425236 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.425267 <... open resumed> ) = 11
[pid 25404] 10:12:35.425284 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1267, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25471] 10:12:35.425325 read(10,  <unfinished ...>
[pid 25460] 10:12:35.425353 munmap(0x7f9083401000, 4096 <unfinished ...>
[pid 25458] 10:12:35.425382 <... open resumed> ) = 12
[pid 25443] 10:12:35.425396 fcntl(11, F_GETFD <unfinished ...>
[pid 25404] 10:12:35.425424 close(10 <unfinished ...>
[pid 25471] 10:12:35.425456 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25460] 10:12:35.425474 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.425542 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25443] 10:12:35.425573 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.425590 <... close resumed> ) = 0
[pid 25471] 10:12:35.425614 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25460] 10:12:35.425646 stat("/etc/localtime",  <unfinished ...>
[pid 25458] 10:12:35.425672 <... ioctl resumed> , 0x7ffc7ad8da50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25443] 10:12:35.425687 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25404] 10:12:35.425713 munmap(0x7fb3682b9000, 4096 <unfinished ...>
[pid 25471] 10:12:35.425760 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25460] 10:12:35.425804 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.425884 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.425931 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.425960 <... munmap resumed> ) = 0
[pid 25471] 10:12:35.425992 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25460] 10:12:35.426025 stat("/etc/localtime",  <unfinished ...>
[pid 25458] 10:12:35.426052 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.426065 read(11,  <unfinished ...>
[pid 25404] 10:12:35.426116 rename("/var/spool/exim/input/X/hdr.25404", "/var/spool/exim/input/X/1aEJMX-0006bg-Lo-H" <unfinished ...>
[pid 25471] 10:12:35.426201 <... open resumed> ) = 13
[pid 25460] 10:12:35.426216 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.426252 read(12,  <unfinished ...>
[pid 25443] 10:12:35.426276 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25404] 10:12:35.426299 <... rename resumed> ) = 0
[pid 25471] 10:12:35.426318 fstat(13,  <unfinished ...>
[pid 25460] 10:12:35.426325 close(7 <unfinished ...>
[pid 25458] 10:12:35.426338 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25443] 10:12:35.426346 close(11 <unfinished ...>
[pid 25404] 10:12:35.426747 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25471] 10:12:35.426820 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25460] 10:12:35.426869 <... close resumed> ) = 0
[pid 25458] 10:12:35.426905 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.426935 <... close resumed> ) = 0
[pid 25404] 10:12:35.426960 <... open resumed> ) = 10
[pid 25471] 10:12:35.426987 fstat(13,  <unfinished ...>
[pid 25460] 10:12:35.427010 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25458] 10:12:35.427043 <... lseek resumed> ) = 878
[pid 25443] 10:12:35.427056 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25404] 10:12:35.427086 fsync(10 <unfinished ...>
[pid 25471] 10:12:35.427118 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25460] 10:12:35.427144 <... open resumed> ) = 7
[pid 25458] 10:12:35.427163 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25443] 10:12:35.427186 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25404] 10:12:35.427205 <... fsync resumed> ) = 0
[pid 25471] 10:12:35.427229 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25460] 10:12:35.427256 fcntl(7, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.427280 <... lseek resumed> ) = 878
[pid 25443] 10:12:35.427293 stat("/var/tmp",  <unfinished ...>
[pid 25404] 10:12:35.427327 close(10 <unfinished ...>
[pid 25471] 10:12:35.427360 <... mmap resumed> ) = 0x7fea0f283000
[pid 25460] 10:12:35.427374 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.427393 close(12 <unfinished ...>
[pid 25443] 10:12:35.427416 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25404] 10:12:35.427606 <... close resumed> ) = 0
[pid 25471] 10:12:35.427645 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25460] 10:12:35.427671 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.427695 <... close resumed> ) = 0
[pid 25443] 10:12:35.427708 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25404] 10:12:35.428025 unlink("/var/spool/exim/msglog/X/1aEJMX-0006bg-Lo" <unfinished ...>
[pid 25471] 10:12:35.428081 <... lseek resumed> ) = 0
[pid 25460] 10:12:35.428096 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.428117 read(11,  <unfinished ...>
[pid 25443] 10:12:35.428143 <... open resumed> ) = 11
[pid 25404] 10:12:35.428160 <... unlink resumed> ) = 0
[pid 25471] 10:12:35.428186 read(13,  <unfinished ...>
[pid 25460] 10:12:35.428212 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.428236 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25443] 10:12:35.428255 fcntl(11, F_GETFD <unfinished ...>
[pid 25404] 10:12:35.428848 unlink("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-D" <unfinished ...>
[pid 25471] 10:12:35.428979 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25460] 10:12:35.429007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371486, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.429050 brk(0x15e3000 <unfinished ...>
[pid 25443] 10:12:35.429076 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.429093 <... unlink resumed> ) = 0
[pid 25471] 10:12:35.429119 read(13,  <unfinished ...>
[pid 25460] 10:12:35.429144 write(7, "2015-12-30 10:12:35 [25460] 1aEJMZ-0006ce-8t <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2426 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for gretchen.murry@onehospitalitygroup.com Jennifer"..., 360 <unfinished ...>
[pid 25458] 10:12:35.429177 <... brk resumed> ) = 0x15e3000
[pid 25443] 10:12:35.429191 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25404] 10:12:35.429323 unlink("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-H" <unfinished ...>
[pid 25471] 10:12:35.429393 <... read resumed> "", 4096) = 0
[pid 25460] 10:12:35.429409 <... write resumed> ) = 360
[pid 25458] 10:12:35.429461 read(11,  <unfinished ...>
[pid 25443] 10:12:35.429557 <... fcntl resumed> ) = 0
[pid 25404] 10:12:35.429578 <... unlink resumed> ) = 0
[pid 25471] 10:12:35.429613 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25460] 10:12:35.429645 close(6 <unfinished ...>
[pid 25458] 10:12:35.429673 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25443] 10:12:35.429691 fstat(11,  <unfinished ...>
[pid 25404] 10:12:35.430812 stat("/etc/localtime",  <unfinished ...>
[pid 25471] 10:12:35.430879 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25460] 10:12:35.430907 <... close resumed> ) = 0
[pid 25458] 10:12:35.430932 brk(0x1604000 <unfinished ...>
[pid 25443] 10:12:35.430957 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25404] 10:12:35.431007 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25471] 10:12:35.431058 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25460] 10:12:35.431089 munmap(0x7f9083402000, 4096 <unfinished ...>
[pid 25458] 10:12:35.431119 <... brk resumed> ) = 0x1604000
[pid 25443] 10:12:35.431132 pread(11,  <unfinished ...>
[pid 25404] 10:12:35.431276 stat("/etc/localtime",  <unfinished ...>
[pid 25471] 10:12:35.431319 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25460] 10:12:35.431337 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.431358 read(11,  <unfinished ...>
[pid 25443] 10:12:35.431383 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25404] 10:12:35.431424 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25471] 10:12:35.431556 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25460] 10:12:35.431592 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25458] 10:12:35.431619 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25443] 10:12:35.431638 pread(11,  <unfinished ...>
[pid 25404] 10:12:35.431803 close(7 <unfinished ...>
[pid 25471] 10:12:35.431894 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fea0e13b790}, 8) = 0
[pid 25460] 10:12:35.431922 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, 8) = 0
[pid 25443] 10:12:35.431945 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25404] 10:12:35.431977 <... close resumed> ) = 0
[pid 25460] 10:12:35.432005 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f90810026a0},  <unfinished ...>
[pid 25443] 10:12:35.432033 close(11 <unfinished ...>
[pid 25404] 10:12:35.432058 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25460] 10:12:35.432095 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f90810026a0}, 8) = 0
[pid 25443] 10:12:35.432116 <... close resumed> ) = 0
[pid 25404] 10:12:35.432151 <... open resumed> ) = 7
[pid 25460] 10:12:35.432176 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.432213 close(10 <unfinished ...>
[pid 25404] 10:12:35.432240 fcntl(7, F_GETFD <unfinished ...>
[pid 25460] 10:12:35.432268 <... open resumed> ) = 6
[pid 25443] 10:12:35.432286 <... close resumed> ) = 0
[pid 25404] 10:12:35.432315 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.432338 read(6,  <unfinished ...>
[pid 25443] 10:12:35.432370 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25404] 10:12:35.432398 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25460] 10:12:35.432427 <... read resumed> "0.18 0.08 0.01 5/250 25472\n", 40) = 27
[pid 25443] 10:12:35.432445 <... open resumed> ) = 10
[pid 25404] 10:12:35.432462 <... fcntl resumed> ) = 0
[pid 25460] 10:12:35.432558 close(6 <unfinished ...>
[pid 25443] 10:12:35.432593 fstat(10,  <unfinished ...>
[pid 25404] 10:12:35.432617 fstat(7,  <unfinished ...>
[pid 25460] 10:12:35.432646 <... close resumed> ) = 0
[pid 25443] 10:12:35.432673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:35.432708 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371846, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25460] 10:12:35.432752 clone( <unfinished ...>
[pid 25443] 10:12:35.433084 fstat(10,  <unfinished ...>
[pid 25404] 10:12:35.433110 write(7, "2015-12-30 10:12:35 [25404] 1aEJMX-0006bg-Lo Completed QT=2s\n", 61 <unfinished ...>
[pid 25443] 10:12:35.433147 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25404] 10:12:35.433182 <... write resumed> ) = 61
[pid 25460] 10:12:35.433208 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f90833eca90) = 25473
[pid 25443] 10:12:35.433461 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25404] 10:12:35.433500 close(8 <unfinished ...>
[pid 25460] 10:12:35.433551 exit_group(0) = ?
[pid 25443] 10:12:35.433840 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25404] 10:12:35.433873 <... close resumed> ) = 0
[pid 25471] 10:12:35.434577 close(11 <unfinished ...>
[pid 25460] 10:12:35.434613 +++ exited with 0 +++
[pid 25443] 10:12:35.434627 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25404] 10:12:35.434653 munmap(0x7fb3682ba000, 4096 <unfinished ...>
[pid 25389] 10:12:35.434683 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25460
[pid 25443] 10:12:35.434712 <... lseek resumed> ) = 0
[pid 25404] 10:12:35.434735 <... munmap resumed> ) = 0
[pid 25389] 10:12:35.434763 munmap(0x7ff3d4f3d000, 4096 <unfinished ...>
[pid 25471] 10:12:35.434824 <... close resumed> ) = 0
[pid 25443] 10:12:35.434839 read(10,  <unfinished ...>
[pid 25404] 10:12:35.434868 close(9 <unfinished ...>
[pid 25389] 10:12:35.434896 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.435022 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25404] 10:12:35.435074 <... close resumed> ) = 0
[pid 25389] 10:12:35.435097 pipe2( <unfinished ...>
[pid 25443] 10:12:35.435133 pipe( <unfinished ...>
[pid 25404] 10:12:35.435159 unlink("/var/spool/exim/input/X/1aEJMX-0006bg-Lo-J" <unfinished ...>
[pid 25389] 10:12:35.435222 <... pipe2 resumed> [5, 6], O_CLOEXEC) = 0
[pid 25443] 10:12:35.435250 <... pipe resumed> [11, 12]) = 0
[pid 25404] 10:12:35.435270 <... unlink resumed> ) = 0
[pid 25389] 10:12:35.435298 clone( <unfinished ...>
[pid 25452] 10:12:35.435792 <... select resumed> ) = 1 (in [11], left {299, 958059})
[pid 25443] 10:12:35.435823 close(10 <unfinished ...>
[pid 25404] 10:12:35.435850 close(6 <unfinished ...>
[pid 25452] 10:12:35.435905 read(11,  <unfinished ...>
[pid 25443] 10:12:35.435932 <... close resumed> ) = 0
[pid 25404] 10:12:35.435950 <... close resumed> ) = 0
[pid 25389] 10:12:35.436124 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25474
[pid 25452] 10:12:35.436171 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25443] 10:12:35.436195 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25404] 10:12:35.436224 exit_group(0) = ?
[pid 25389] 10:12:35.436990 close(5 <unfinished ...>
[pid 25452] 10:12:35.437092 read(11,  <unfinished ...>
[pid 25443] 10:12:35.437119 <... munmap resumed> ) = 0
[pid 25404] 10:12:35.437139 +++ exited with 0 +++
[pid 25389] 10:12:35.437152 <... close resumed> ) = 0
[pid 25452] 10:12:35.437185 <... read resumed> "\332\345w\332'd\314\1\241 ~\275\363\211/\345\2645\305T<h]\264<\233\302E\333V<\317", 32) = 32
[pid 25443] 10:12:35.437529 clone( <unfinished ...>
[pid 25389] 10:12:35.437858 fcntl(6, F_SETFD, 0 <unfinished ...>
[pid 25471] 10:12:35.437902 fcntl(12, F_GETFD <unfinished ...>
[pid 25452] 10:12:35.437934 read(11,  <unfinished ...>
[pid 25389] 10:12:35.437986 <... fcntl resumed> ) = 0
[pid 25471] 10:12:35.438018 <... fcntl resumed> ) = 0
[pid 25452] 10:12:35.438033 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25443] 10:12:35.438054 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25475
[pid 25389] 10:12:35.438090 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.438123 read(11,  <unfinished ...>
[pid 25443] 10:12:35.438148 close(12 <unfinished ...>
[pid 25389] 10:12:35.438178 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167520, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25452] 10:12:35.438216 <... read resumed> "'\260)N\321\322\302kp\207\344\24aQ\2767\250\223u\205wM\1\37\17\346\341\3412\3!\326\373\0\254L\273\272\205\23r\366{\200\216\362.~", 48) = 48
[pid 25443] 10:12:35.438262 <... close resumed> ) = 0
[pid 25389] 10:12:35.438283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.438317 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.438342 read(11,  <unfinished ...>
[pid 25389] 10:12:35.438365 <... mmap resumed> ) = 0x7ff3d4f3d000
[pid 25452] 10:12:35.438394 <... lseek resumed> ) = 19
[pid 25389] 10:12:35.438413 write(6, "To:  VHuerta@ncghotels.com, aepperson@ncghotels.com, SCarroll@ncghotels.com, courtyardavondale@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFro"..., 2139 <unfinished ...>
[pid 25452] 10:12:35.438447 read(6,  <unfinished ...>
[pid 25389] 10:12:35.438482 <... write resumed> ) = 2139
[pid 25452] 10:12:35.438504 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25389] 10:12:35.438535 close(6 <unfinished ...>
[pid 25452] 10:12:35.438565 read(6,  <unfinished ...>
[pid 25389] 10:12:35.438588 <... close resumed> ) = 0
[pid 25452] 10:12:35.438609 <... read resumed> "", 8192) = 0
[pid 25389] 10:12:35.438626 wait4(25474,  <unfinished ...>
[pid 25452] 10:12:35.438652 alarm(300)  = 0
[pid 25452] 10:12:35.438709 write(11, "\27\3\1\0 \26\366\n=:\370]\25\302\231e\360@,\327\2268\344\361m\252x\25\363#i\26\374\204\211\257\307\27\3\1\f@vj\272&\355\244&\261\362f\324a$5\257\337\200\346t\331vO\357<L\2728\373\7\3350\315\333=\373\35\331U\376\245\347v\223\323\23I\305&\347*\34#\373n#k\360\214\324\261>\267@\tA\"\20\325\fm?\376\3328\0\220\306?z\364\271\224]=\205ds\250\240\346\250{eZ\321\202\7\252\0223\"\356\233\376S_ \350\222\16\371\234\02470#\306\230\363\204!\206\1\25\302\320c\251\361\225\254\3\200\356\272\7\36\371\f^\257\253)\232\0l{,*\242X`\224SO\6\361\0265\314j{\346_K\277\263\246a\346v\0y\314\3566\372\306\236\335\261;\337\231/\20\251_h\25c\224+c\263\3-\1773!\350)X\4\315\371\321\206\376>\310U \320"..., 3178) = 3178
[pid 25452] 10:12:35.438831 alarm(0)    = 300
[pid 25452] 10:12:35.438890 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25471] 10:12:35.439217 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.439242 brk(0x1625000 <unfinished ...>
[pid 25471] 10:12:35.439271 <... fcntl resumed> ) = 0
[pid 25471] 10:12:35.439310 geteuid()   = 0
[pid 25471] 10:12:35.439350 getegid()   = 12
[pid 25471] 10:12:35.439387 setgid(500) = 0
[pid 25471] 10:12:35.439423 setuid(503) = 0
[pid 25471] 10:12:35.439459 chdir("/")  = 0
[pid 25471] 10:12:35.439600 geteuid()   = 503
[pid 25471] 10:12:35.439638 getegid()   = 500
[pid 25471] 10:12:35.439693 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom", {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25458] 10:12:35.439778 <... brk resumed> ) = 0x1625000
[pid 25471] 10:12:35.439984 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom") = 0
[pid 25471] 10:12:35.440051 stat("tmp", {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25471] 10:12:35.440113 stat("new", {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25471] 10:12:35.440164 stat("cur", {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25471] 10:12:35.440277 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25471] 10:12:35.440331 read(11, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2929
[pid 25471] 10:12:35.440434 stat("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", 0x7ffc7271b760) = -1 ENOENT (No such file or directory)
[pid 25471] 10:12:35.440571 open("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25458] 10:12:35.440743 read(11,  <unfinished ...>
[pid 25471] 10:12:35.440801 chown("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", 503, 500) = 0
[pid 25471] 10:12:35.440859 chmod("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", 0660) = 0
[pid 25471] 10:12:35.440902 chown("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", 503, 500) = 0
[pid 25471] 10:12:35.440943 chmod("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", 0660) = 0
[pid 25471] 10:12:35.441014 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:35.441071 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25471] 10:12:35.441539 lseek(6, 19, SEEK_SET) = 19
[pid 25471] 10:12:35.441593 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25471] 10:12:35.441651 read(6, "", 8192) = 0
[pid 25471] 10:12:35.441690 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:35 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2558) = 2558
[pid 25471] 10:12:35.441744 fsync(14 <unfinished ...>
[pid 25458] 10:12:35.442411 stat("/usr/local/cpanel/Errno.pmc", Process 25472 attached
 <unfinished ...>
[pid 25472] 10:12:35.442540 set_robust_list(0x7f2b2934eaa0, 24) = 0
[pid 25472] 10:12:35.442604 close(0 <unfinished ...>
[pid 25471] 10:12:35.442638 <... fsync resumed> ) = 0
[pid 25471] 10:12:35.442660 lseek(11, 0, SEEK_END) = 2929
[pid 25471] 10:12:35.442697 write(11, "2558 1\n", 7) = 7
[pid 25471] 10:12:35.442741 close(11)   = 0
[pid 25471] 10:12:35.442781 fstat(14, {st_dev=makedev(144, 4215), st_ino=122016468, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2558, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25471] 10:12:35.442833 close(14)   = 0
[pid 25471] 10:12:35.442883 rename("tmp/1451491955.H440424P25471.fin.finestweddingsites.com", "new/1451491955.H440424P25471.fin.finestweddingsites.com,S=2558") = 0
[pid 25471] 10:12:35.442960 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443003 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443031 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443063 write(12, "\376\t\0\0", 4) = 4
[pid 25433] 10:12:35.443101 <... read resumed> "\376\t\0\0", 4) = 4
[pid 25433] 10:12:35.443122 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443151 write(12, "\0\0\20\0", 4) = 4
[pid 25433] 10:12:35.443186 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25433] 10:12:35.443206 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443235 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443269 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443289 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443319 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443353 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443373 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443402 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443436 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443456 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443559 write(12, "\260s~\0\0\0\0\0", 8) = 8
[pid 25433] 10:12:35.443599 <... read resumed> "\260s~\0\0\0\0\0", 8) = 8
[pid 25433] 10:12:35.443620 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443649 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443684 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443704 read(11,  <unfinished ...>
[pid 25471] 10:12:35.443733 write(12, "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443767 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25433] 10:12:35.443788 close(11)   = 0
[pid 25433] 10:12:35.443833 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55) = 55
[pid 25433] 10:12:35.443890 fsync(9 <unfinished ...>
[pid 25471] 10:12:35.443948 close(12)   = 0
[pid 25471] 10:12:35.444038 close(10)   = 0
[pid 25471] 10:12:35.444077 munmap(0x7fea0f284000, 4096) = 0
[pid 25471] 10:12:35.444126 close(13)   = 0
[pid 25471] 10:12:35.444173 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25433] 10:12:35.444198 <... fsync resumed> ) = 0
[pid 25433] 10:12:35.444217 wait4(-1,  <unfinished ...>
[pid 25471] 10:12:35.444250 <... munmap resumed> ) = 0
[pid 25471] 10:12:35.444747 exit_group(0) = ?
[pid 25471] 10:12:35.445068 +++ exited with 0 +++
[pid 25433] 10:12:35.445086 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25471
[pid 25433] 10:12:35.445141 open("/etc/userdomains", O_RDONLY) = 10
[pid 25433] 10:12:35.445188 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.445241 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:35.445288 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea0f284000
[pid 25433] 10:12:35.445328 lseek(10, 0, SEEK_SET) = 0
[pid 25433] 10:12:35.445365 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:35.445431 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com", 0x7ffc7271a4b0) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.445549 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.445622 write(8, "2015-12-30 10:12:35 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25433] 10:12:35.445682 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.445750 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.445814 close(7)    = 0
[pid 25433] 10:12:35.445854 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25433] 10:12:35.445900 fcntl(7, F_GETFD) = 0
[pid 25433] 10:12:35.445934 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25433] 10:12:35.445967 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5371907, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:35.446013 write(7, "2015-12-30 10:12:35 [25433] 1aEJMY-0006c6-AN => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2558 QT=1s DT=0s\n", 232) = 232
[pid 25433] 10:12:35.446061 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25433] 10:12:35.446107 alarm(60)   = 0
[pid 25433] 10:12:35.446142 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25433] 10:12:35.446181 alarm(0)    = 60
[pid 25433] 10:12:35.446267 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:35.446327 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25433] 10:12:35.446370 fcntl(12, F_GETFD) = 0
[pid 25433] 10:12:35.446406 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25433] 10:12:35.446440 read(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25472] 10:12:35.446577 <... close resumed> ) = 0
[pid 25458] 10:12:35.446598 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.446616 close(12)   = 0
[pid 25433] 10:12:35.446657 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.446701 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25433] 10:12:35.446841 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25433] 10:12:35.446887 fcntl(12, F_GETFD) = 0
[pid 25433] 10:12:35.446920 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25433] 10:12:35.446953 fstat(12, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:35.447015 pread(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25433] 10:12:35.447079 pread(12, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25433] 10:12:35.447133 close(12)   = 0
[pid 25433] 10:12:35.447183 close(11)   = 0
[pid 25433] 10:12:35.447241 pipe([11, 12]) = 0
[pid 25433] 10:12:35.447283 close(10)   = 0
[pid 25433] 10:12:35.447318 munmap(0x7fea0f284000, 4096) = 0
[pid 25433] 10:12:35.447361 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25476
[pid 25433] 10:12:35.447671 close(12)   = 0
[pid 25433] 10:12:35.447708 read(11,  <unfinished ...>
[pid 25472] 10:12:35.447742 close(1 <unfinished ...>
[pid 25458] 10:12:35.447764 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.447800 <... close resumed> ) = 0
[pid 25458] 10:12:35.447814 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.447844 close(2 <unfinished ...>
[pid 25458] 10:12:35.447866 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.447901 <... close resumed> ) = 0
[pid 25458] 10:12:35.447914 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.447992 setsid( <unfinished ...>
[pid 25458] 10:12:35.448039 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.448103 <... setsid resumed> ) = 25472
[pid 25458] 10:12:35.448117 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448150 fstat(0,  <unfinished ...>
[pid 25458] 10:12:35.448173 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.448206 <... fstat resumed> 0x7ffc6a225770) = -1 EBADF (Bad file descriptor)
[pid 25458] 10:12:35.448221 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448247 open("/dev/null", O_RDWR <unfinished ...>
[pid 25458] 10:12:35.448271 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.448312 <... open resumed> ) = 0
[pid 25458] 10:12:35.448326 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448354 fstat(1,  <unfinished ...>
[pid 25458] 10:12:35.448376 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.448419 <... fstat resumed> 0x7ffc6a225770) = -1 EBADF (Bad file descriptor)
[pid 25458] 10:12:35.448433 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448463 dup2(0, 1 <unfinished ...>
[pid 25458] 10:12:35.448489 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.448526 <... dup2 resumed> ) = 1
[pid 25458] 10:12:35.448543 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448585 fstat(2,  <unfinished ...>
[pid 25458] 10:12:35.448621 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.448676 <... fstat resumed> 0x7ffc6a225770) = -1 EBADF (Bad file descriptor)
[pid 25458] 10:12:35.448692 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448722 dup2(0, 2 <unfinished ...>
[pid 25458] 10:12:35.448748 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.448785 <... dup2 resumed> ) = 2
[pid 25458] 10:12:35.448798 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448824 geteuid( <unfinished ...>
[pid 25458] 10:12:35.448845 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.448883 <... geteuid resumed> ) = 47
[pid 25458] 10:12:35.448896 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.448928 fstat(0,  <unfinished ...>
[pid 25458] 10:12:35.448951 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.448988 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25458] 10:12:35.449016 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.449052 fstat(1,  <unfinished ...>
[pid 25458] 10:12:35.449073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.449111 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25458] 10:12:35.449137 <... open resumed> ) = 12
[pid 25472] 10:12:35.449161 fstat(2,  <unfinished ...>
[pid 25458] 10:12:35.449182 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.449214 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25458] 10:12:35.449239 <... ioctl resumed> , 0x7ffc7ad8da50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.449269 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMZ-0006cf-8U"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25458] 10:12:35.449348 lseek(12, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.450119 <... execve resumed> ) = 0
[pid 25472] 10:12:35.450192 brk(0 <unfinished ...>
[pid 25458] 10:12:35.450219 read(12,  <unfinished ...>
[pid 25472] 10:12:35.450252 <... brk resumed> ) = 0x271f000
[pid 25458] 10:12:35.450266 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25472] 10:12:35.450394 fcntl(0, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.450422 brk(0x1646000 <unfinished ...>
[pid 25472] 10:12:35.450454 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.450469 <... brk resumed> ) = 0x1646000
[pid 25472] 10:12:35.451089 fcntl(1, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.451127 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25472] 10:12:35.451160 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.451174 <... lseek resumed> ) = 4868
[pid 25472] 10:12:35.451198 fcntl(2, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.451219 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.451248 <... fcntl resumed> ) = 0
[pid 25458] 10:12:35.451261 <... lseek resumed> ) = 4868
[pid 25472] 10:12:35.451289 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25458] 10:12:35.451316 close(12 <unfinished ...>
[pid 25472] 10:12:35.451351 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.451366 <... close resumed> ) = 0
[pid 25472] 10:12:35.451418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.451446 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.451584 <... mmap resumed> ) = 0x7ff101088000
[pid 25458] 10:12:35.451602 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.451641 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25458] 10:12:35.451668 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.451705 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.451720 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.451775 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.451814 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.451877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.451900 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.451932 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.451955 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.451988 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452002 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.452027 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.452050 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.452086 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452106 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.452130 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25458] 10:12:35.452151 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.452185 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452200 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.452225 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.452248 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.452288 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452302 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.452324 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.452346 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.452386 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452400 <... stat resumed> 0x7ffc7ad8dc60) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.452425 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.452447 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", Process 25473 attached
 <unfinished ...>
[pid 25472] 10:12:35.452583 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452602 <... stat resumed> 0x7ffc7ad8dd00) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.452641 set_robust_list(0x7f90833ecaa0, 24 <unfinished ...>
[pid 25472] 10:12:35.452665 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25458] 10:12:35.452687 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:35.452733 <... set_robust_list resumed> ) = 0
[pid 25472] 10:12:35.452755 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25458] 10:12:35.452832 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25473] 10:12:35.452889 close(0 <unfinished ...>
[pid 25472] 10:12:35.452920 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.452970 <... close resumed> ) = 0
[pid 25472] 10:12:35.452984 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.452998 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.453039 close(1 <unfinished ...>
[pid 25472] 10:12:35.453062 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.453083 <... open resumed> ) = 12
[pid 25473] 10:12:35.453117 <... close resumed> ) = 0
[pid 25472] 10:12:35.453132 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.453147 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.453181 close(2 <unfinished ...>
[pid 25472] 10:12:35.453202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.453225 <... ioctl resumed> , 0x7ffc7ad8da50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.453265 <... close resumed> ) = 0
[pid 25472] 10:12:35.453279 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.453294 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.453378 setsid( <unfinished ...>
[pid 25472] 10:12:35.453399 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25458] 10:12:35.453421 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.453467 <... setsid resumed> ) = 25473
[pid 25472] 10:12:35.453562 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.453580 read(12,  <unfinished ...>
[pid 25473] 10:12:35.453621 fstat(0,  <unfinished ...>
[pid 25472] 10:12:35.453642 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.453665 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25473] 10:12:35.454132 <... fstat resumed> 0x7ffe4db28f80) = -1 EBADF (Bad file descriptor)
[pid 25472] 10:12:35.454162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.454179 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25473] 10:12:35.454226 open("/dev/null", O_RDWR <unfinished ...>
[pid 25472] 10:12:35.454252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.454274 <... lseek resumed> ) = 2366
[pid 25473] 10:12:35.454311 <... open resumed> ) = 0
[pid 25472] 10:12:35.454327 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.454342 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.454377 fstat(1,  <unfinished ...>
[pid 25472] 10:12:35.454397 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.454420 <... lseek resumed> ) = 2366
[pid 25473] 10:12:35.454452 <... fstat resumed> 0x7ffe4db28f80) = -1 EBADF (Bad file descriptor)
[pid 25472] 10:12:35.454468 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.454486 close(12 <unfinished ...>
[pid 25473] 10:12:35.454528 dup2(0, 1 <unfinished ...>
[pid 25472] 10:12:35.454552 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25458] 10:12:35.454573 <... close resumed> ) = 0
[pid 25473] 10:12:35.454892 <... dup2 resumed> ) = 1
[pid 25472] 10:12:35.454916 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.454946 read(11, Process 25474 attached
 <unfinished ...>
[pid 25473] 10:12:35.455004 fstat(2,  <unfinished ...>
[pid 25472] 10:12:35.455025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.455048 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.455101 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25473] 10:12:35.455126 <... fstat resumed> 0x7ffe4db28f80) = -1 EBADF (Bad file descriptor)
[pid 25472] 10:12:35.455141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.455155 close(11 <unfinished ...>
[pid 25474] 10:12:35.455193 <... set_robust_list resumed> ) = 0
[pid 25473] 10:12:35.455207 dup2(0, 2 <unfinished ...>
[pid 25472] 10:12:35.455227 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25458] 10:12:35.455248 <... close resumed> ) = 0
[pid 25474] 10:12:35.455572 close(6 <unfinished ...>
[pid 25473] 10:12:35.455611 <... dup2 resumed> ) = 2
[pid 25472] 10:12:35.455626 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.455642 stat("/etc/userdomains",  <unfinished ...>
[pid 25474] 10:12:35.455686 <... close resumed> ) = 0
[pid 25473] 10:12:35.455700 geteuid( <unfinished ...>
[pid 25472] 10:12:35.455720 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.455742 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.455800 dup2(5, 0 <unfinished ...>
[pid 25473] 10:12:35.455824 <... geteuid resumed> ) = 47
[pid 25472] 10:12:35.455838 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.455852 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.455903 <... dup2 resumed> ) = 0
[pid 25473] 10:12:35.455917 fstat(0,  <unfinished ...>
[pid 25472] 10:12:35.455936 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25458] 10:12:35.455958 <... open resumed> ) = 11
[pid 25474] 10:12:35.455991 close(5 <unfinished ...>
[pid 25473] 10:12:35.456011 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25472] 10:12:35.456039 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.456053 fstat(11, Process 25475 attached
 <unfinished ...>
[pid 25474] 10:12:35.456125 <... close resumed> ) = 0
[pid 25473] 10:12:35.456141 fstat(1,  <unfinished ...>
[pid 25472] 10:12:35.456171 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.456201 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25475] 10:12:35.456233 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25474] 10:12:35.456261 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25473] 10:12:35.456942 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25472] 10:12:35.456981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25475] 10:12:35.457007 <... set_robust_list resumed> ) = 0
[pid 25473] 10:12:35.457025 fstat(2,  <unfinished ...>
[pid 25458] 10:12:35.457123 fstat(11,  <unfinished ...>
[pid 25475] 10:12:35.457153 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25474] 10:12:35.457179 <... execve resumed> ) = 0
[pid 25473] 10:12:35.457193 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25472] 10:12:35.457219 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25475] 10:12:35.457245 <... setrlimit resumed> ) = 0
[pid 25458] 10:12:35.457259 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25475] 10:12:35.457426 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.457454 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMZ-0006ce-8t"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25472] 10:12:35.457640 <... stat resumed> 0x7ffdc181fbb0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.457663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25475] 10:12:35.458221 <... open resumed> ) = 10
[pid 25474] 10:12:35.458238 brk(0 <unfinished ...>
[pid 25472] 10:12:35.458271 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.458302 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25475] 10:12:35.458323 fstat(10,  <unfinished ...>
[pid 25474] 10:12:35.458348 <... brk resumed> ) = 0x1edb000
[pid 25473] 10:12:35.458362 <... execve resumed> ) = 0
[pid 25472] 10:12:35.458394 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25475] 10:12:35.458430 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.458462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.458625 brk(0 <unfinished ...>
[pid 25458] 10:12:35.458662 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25475] 10:12:35.458709 fstat(10,  <unfinished ...>
[pid 25474] 10:12:35.458746 <... mmap resumed> ) = 0x7f5314366000
[pid 25473] 10:12:35.458765 <... brk resumed> ) = 0xee2000
[pid 25472] 10:12:35.458791 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25475] 10:12:35.458831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.458859 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25473] 10:12:35.458890 fcntl(0, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.458912 <... lseek resumed> ) = 0
[pid 25475] 10:12:35.458932 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.458962 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.458976 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.458999 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25475] 10:12:35.459033 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25474] 10:12:35.459051 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.459082 fcntl(1, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.459104 read(11,  <unfinished ...>
[pid 25475] 10:12:35.459136 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.459159 <... open resumed> ) = 5
[pid 25473] 10:12:35.459172 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.459187 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25475] 10:12:35.459221 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.459235 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.459261 fcntl(2, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.459282 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25475] 10:12:35.459306 read(10,  <unfinished ...>
[pid 25474] 10:12:35.459365 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:35.459395 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.459410 <... open resumed> ) = 6
[pid 25475] 10:12:35.459436 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25474] 10:12:35.459462 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.459539 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25458] 10:12:35.459570 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25475] 10:12:35.459605 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25474] 10:12:35.459637 <... mmap resumed> ) = 0x7f531435c000
[pid 25473] 10:12:35.459651 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.459667 fstat(6,  <unfinished ...>
[pid 25475] 10:12:35.459712 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25474] 10:12:35.459748 close(5 <unfinished ...>
[pid 25473] 10:12:35.459823 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.459867 <... open resumed> ) = 12
[pid 25475] 10:12:35.459898 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.459942 <... close resumed> ) = 0
[pid 25473] 10:12:35.459957 <... mmap resumed> ) = 0x7f7c15caa000
[pid 25472] 10:12:35.459983 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25475] 10:12:35.460031 <... open resumed> ) = 13
[pid 25474] 10:12:35.460050 open("/lib64/libtinfo.so.5", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.460083 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25458] 10:12:35.460110 fstat(12,  <unfinished ...>
[pid 25475] 10:12:35.460139 fstat(13,  <unfinished ...>
[pid 25474] 10:12:35.460161 <... open resumed> ) = 5
[pid 25473] 10:12:35.460174 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.460190 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25475] 10:12:35.460233 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25474] 10:12:35.460260 read(5,  <unfinished ...>
[pid 25473] 10:12:35.460288 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.460319 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25475] 10:12:35.460348 fstat(13,  <unfinished ...>
[pid 25474] 10:12:35.460354 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.460364 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.460369 <... mmap resumed> ) = 0x7ff10107e000
[pid 25475] 10:12:35.460396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25474] 10:12:35.460411 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.460416 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.460423 close(6 <unfinished ...>
[pid 25458] 10:12:35.460428 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25475] 10:12:35.460459 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.460466 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.460704 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.460724 <... close resumed> ) = 0
[pid 25458] 10:12:35.460748 <... mmap resumed> ) = 0x7f03f4be5000
[pid 25475] 10:12:35.460795 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25474] 10:12:35.460821 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.460866 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.460910 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25475] 10:12:35.460949 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.460973 <... mmap resumed> ) = 0x7f5313f27000
[pid 25473] 10:12:35.460987 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.461002 read(12,  <unfinished ...>
[pid 25475] 10:12:35.461037 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.461051 mprotect(0x7f5313f44000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.461080 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25472] 10:12:35.461107 <... open resumed> ) = 6
[pid 25475] 10:12:35.461127 read(13,  <unfinished ...>
[pid 25474] 10:12:35.461154 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.461168 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.461184 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25475] 10:12:35.461210 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25474] 10:12:35.461242 mmap(0x7f5314143000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000 <unfinished ...>
[pid 25473] 10:12:35.461279 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.461309 read(6,  <unfinished ...>
[pid 25475] 10:12:35.461339 read(13,  <unfinished ...>
[pid 25474] 10:12:35.461361 <... mmap resumed> ) = 0x7f5314143000
[pid 25473] 10:12:35.461375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.461395 close(12 <unfinished ...>
[pid 25475] 10:12:35.461427 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.461442 mmap(0x7f5314147000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.461580 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.461610 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25475] 10:12:35.461643 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25474] 10:12:35.461677 <... mmap resumed> ) = 0x7f5314147000
[pid 25473] 10:12:35.461692 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.461709 <... close resumed> ) = 0
[pid 25475] 10:12:35.461733 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25474] 10:12:35.461763 close(5 <unfinished ...>
[pid 25473] 10:12:35.461805 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.461848 fstat(6,  <unfinished ...>
[pid 25475] 10:12:35.461895 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25474] 10:12:35.461929 <... close resumed> ) = 0
[pid 25473] 10:12:35.461943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.461971 munmap(0x7f03f4be5000, 4096 <unfinished ...>
[pid 25475] 10:12:35.462006 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25474] 10:12:35.462023 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.462055 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25472] 10:12:35.462081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25475] 10:12:35.462114 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25474] 10:12:35.462144 <... open resumed> ) = 5
[pid 25473] 10:12:35.462157 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25458] 10:12:35.462184 <... munmap resumed> ) = 0
[pid 25475] 10:12:35.462205 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fdec496f790}, 8) = 0
[pid 25474] 10:12:35.462246 read(5,  <unfinished ...>
[pid 25473] 10:12:35.462275 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.462310 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25475] 10:12:35.462343 close(11 <unfinished ...>
[pid 25474] 10:12:35.462366 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.462386 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.462403 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25475] 10:12:35.462437 <... close resumed> ) = 0
[pid 25474] 10:12:35.462451 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.462478 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.462507 <... mmap resumed> ) = 0x7ff100c50000
[pid 25475] 10:12:35.462527 fcntl(12, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.462553 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.462584 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.462602 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25475] 10:12:35.462635 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.462660 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.462688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.462718 mprotect(0x7ff100c66000, 2097152, PROT_NONE <unfinished ...>
[pid 25475] 10:12:35.462767 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.462804 <... mmap resumed> ) = 0x7f5313d23000
[pid 25473] 10:12:35.462826 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.462855 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25475] 10:12:35.462906 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.462922 mprotect(0x7f5313d25000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.462967 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25472] 10:12:35.462998 <... mprotect resumed> ) = 0
[pid 25475] 10:12:35.463018 geteuid( <unfinished ...>
[pid 25474] 10:12:35.463042 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.463055 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.463071 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25475] 10:12:35.463102 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.463108 mmap(0x7f5313f25000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000 <unfinished ...>
[pid 25473] 10:12:35.463116 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.463123 mmap(0x7ff100e66000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25475] 10:12:35.463223 getegid( <unfinished ...>
[pid 25474] 10:12:35.463230 <... mmap resumed> ) = 0x7f5313f25000
[pid 25473] 10:12:35.463235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.463241 <... mmap resumed> ) = 0x7ff100e66000
[pid 25458] 10:12:35.463246 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25475] 10:12:35.463289 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.463296 close(5 <unfinished ...>
[pid 25473] 10:12:35.463301 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.463308 mmap(0x7ff100e68000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.463315 <... open resumed> ) = 12
[pid 25475] 10:12:35.463349 setgid(500 <unfinished ...>
[pid 25474] 10:12:35.463355 <... close resumed> ) = 0
[pid 25473] 10:12:35.463360 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.463366 <... mmap resumed> ) = 0x7ff100e68000
[pid 25458] 10:12:35.463371 fstat(12,  <unfinished ...>
[pid 25475] 10:12:35.463405 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.463411 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.463418 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.463425 close(6 <unfinished ...>
[pid 25458] 10:12:35.463430 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
Process 25476 attached
[pid 25475] 10:12:35.463703 setuid(503 <unfinished ...>
[pid 25474] 10:12:35.463734 <... open resumed> ) = 5
[pid 25473] 10:12:35.463756 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.463786 <... close resumed> ) = 0
[pid 25458] 10:12:35.463830 fstat(12,  <unfinished ...>
[pid 25476] 10:12:35.463895 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25475] 10:12:35.463925 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.463939 read(5,  <unfinished ...>
[pid 25473] 10:12:35.463964 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25472] 10:12:35.463993 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.464029 <... set_robust_list resumed> ) = 0
[pid 25475] 10:12:35.464043 chdir("/" <unfinished ...>
[pid 25474] 10:12:35.464147 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.464168 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.464197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25476] 10:12:35.464232 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25475] 10:12:35.464259 <... chdir resumed> ) = 0
[pid 25474] 10:12:35.464272 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.464309 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.464341 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25476] 10:12:35.464363 <... setrlimit resumed> ) = 0
[pid 25475] 10:12:35.464379 geteuid( <unfinished ...>
[pid 25474] 10:12:35.464556 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.464618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.464638 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25476] 10:12:35.464674 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25475] 10:12:35.464702 <... geteuid resumed> ) = 503
[pid 25474] 10:12:35.464716 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.464753 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.464798 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.464846 <... open resumed> ) = 10
[pid 25475] 10:12:35.464861 getegid( <unfinished ...>
[pid 25474] 10:12:35.464892 <... mmap resumed> ) = 0x7f531435b000
[pid 25473] 10:12:35.464911 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.464935 <... mmap resumed> ) = 0x7f03f4be5000
[pid 25476] 10:12:35.464958 fstat(10,  <unfinished ...>
[pid 25475] 10:12:35.464983 <... getegid resumed> ) = 500
[pid 25474] 10:12:35.464997 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.465046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.465076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25476] 10:12:35.465098 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25475] 10:12:35.465127 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25474] 10:12:35.465173 <... mmap resumed> ) = 0x7f531398f000
[pid 25473] 10:12:35.465187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.465203 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25476] 10:12:35.465234 fstat(10,  <unfinished ...>
[pid 25475] 10:12:35.465256 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25474] 10:12:35.465282 mprotect(0x7f5313b19000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.465310 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25472] 10:12:35.465338 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.465373 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25475] 10:12:35.465400 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25474] 10:12:35.465429 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.465442 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.465458 <... lseek resumed> ) = 0
[pid 25476] 10:12:35.465484 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25475] 10:12:35.465514 <... chdir resumed> ) = 0
[pid 25474] 10:12:35.465530 mmap(0x7f5313d19000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25473] 10:12:35.465562 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.465591 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25476] 10:12:35.465613 <... mmap resumed> ) = 0x7fea0f284000
[pid 25475] 10:12:35.465633 stat("tmp",  <unfinished ...>
[pid 25474] 10:12:35.465664 <... mmap resumed> ) = 0x7f5313d19000
[pid 25473] 10:12:35.465678 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.465698 read(12,  <unfinished ...>
[pid 25476] 10:12:35.465733 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25475] 10:12:35.465756 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.465781 mmap(0x7f5313d1e000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.465810 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25472] 10:12:35.465837 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.465875 <... lseek resumed> ) = 0
[pid 25475] 10:12:35.465894 stat("new",  <unfinished ...>
[pid 25474] 10:12:35.465923 <... mmap resumed> ) = 0x7f5313d1e000
[pid 25473] 10:12:35.465938 <... stat resumed> 0x7ffdac37f120) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.465960 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25476] 10:12:35.465989 read(10,  <unfinished ...>
[pid 25475] 10:12:35.466024 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.466050 close(5 <unfinished ...>
[pid 25473] 10:12:35.466075 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.466104 <... open resumed> ) = 6
[pid 25476] 10:12:35.466122 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25475] 10:12:35.466130 stat("cur",  <unfinished ...>
[pid 25474] 10:12:35.466137 <... close resumed> ) = 0
[pid 25473] 10:12:35.466142 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.466147 read(12,  <unfinished ...>
[pid 25476] 10:12:35.466238 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25475] 10:12:35.466247 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25474] 10:12:35.466263 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.466270 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25472] 10:12:35.466276 read(6,  <unfinished ...>
[pid 25458] 10:12:35.466281 <... read resumed> "", 4096) = 0
[pid 25476] 10:12:35.466453 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25475] 10:12:35.466474 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.466708 <... mmap resumed> ) = 0x7f531435a000
[pid 25473] 10:12:35.466724 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.466760 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.466784 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25476] 10:12:35.466823 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25475] 10:12:35.466851 <... open resumed> ) = 11
[pid 25474] 10:12:35.466865 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.466900 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.466927 fstat(6,  <unfinished ...>
[pid 25476] 10:12:35.466958 <... open resumed> ) = 13
[pid 25475] 10:12:35.466971 read(11,  <unfinished ...>
[pid 25474] 10:12:35.466997 <... mmap resumed> ) = 0x7f5314359000
[pid 25473] 10:12:35.467011 <... open resumed> ) = 6
[pid 25458] 10:12:35.467028 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2936, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25476] 10:12:35.467064 fstat(13,  <unfinished ...>
[pid 25475] 10:12:35.467120 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2936
[pid 25474] 10:12:35.467140 arch_prctl(ARCH_SET_FS, 0x7f531435a700 <unfinished ...>
[pid 25473] 10:12:35.467222 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.467245 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25476] 10:12:35.467279 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25475] 10:12:35.467306 stat("tmp/1451491955.H467202P25475.fin.finestweddingsites.com",  <unfinished ...>
[pid 25474] 10:12:35.467343 <... arch_prctl resumed> ) = 0
[pid 25473] 10:12:35.467358 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.467471 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.467598 fstat(13,  <unfinished ...>
[pid 25475] 10:12:35.467621 <... stat resumed> 0x7ffd9471c770) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.467637 mprotect(0x7f5313d19000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.467667 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.467693 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25476] 10:12:35.467731 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25475] 10:12:35.467759 open("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25474] 10:12:35.467815 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.467832 <... mmap resumed> ) = 0x7f7c15ca0000
[pid 25472] 10:12:35.467853 <... mmap resumed> ) = 0x7ff10107d000
[pid 25458] 10:12:35.467875 <... open resumed> ) = 13
[pid 25476] 10:12:35.467897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25475] 10:12:35.467928 <... open resumed> ) = 14
[pid 25474] 10:12:35.467942 mprotect(0x7f5313f25000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.467982 close(6 <unfinished ...>
[pid 25472] 10:12:35.468022 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25476] 10:12:35.468073 <... mmap resumed> ) = 0x7fea0f283000
[pid 25475] 10:12:35.468088 chown("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25474] 10:12:35.468128 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.468142 <... close resumed> ) = 0
[pid 25472] 10:12:35.468208 <... mmap resumed> ) = 0x7ff100a37000
[pid 25458] 10:12:35.468237 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25476] 10:12:35.468271 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25475] 10:12:35.468293 <... chown resumed> ) = 0
[pid 25474] 10:12:35.468307 mprotect(0x7f5314367000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.468339 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.468370 mprotect(0x7ff100a4d000, 2093056, PROT_NONE <unfinished ...>
[pid 25476] 10:12:35.468406 <... lseek resumed> ) = 0
[pid 25475] 10:12:35.468420 chmod("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25474] 10:12:35.468452 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.468466 <... open resumed> ) = 6
[pid 25472] 10:12:35.468578 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.468600 <... ioctl resumed> , 0x7ffc7ad90b40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25476] 10:12:35.468624 read(13,  <unfinished ...>
[pid 25475] 10:12:35.468653 <... chmod resumed> ) = 0
[pid 25474] 10:12:35.468668 munmap(0x7f531435c000, 39387 <unfinished ...>
[pid 25473] 10:12:35.468698 read(6,  <unfinished ...>
[pid 25472] 10:12:35.468722 mmap(0x7ff100c4c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25476] 10:12:35.468783 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25475] 10:12:35.468813 chown("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25474] 10:12:35.468901 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.468923 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.468976 <... mmap resumed> ) = 0x7ff100c4c000
[pid 25458] 10:12:35.469002 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25476] 10:12:35.469033 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25475] 10:12:35.469061 <... chown resumed> ) = 0
[pid 25474] 10:12:35.469075 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.469099 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.469121 mmap(0x7ff100c4e000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25476] 10:12:35.469159 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25475] 10:12:35.469175 chmod("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25474] 10:12:35.469205 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.469223 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.469260 <... mmap resumed> ) = 0x7ff100c4e000
[pid 25458] 10:12:35.469285 <... lseek resumed> ) = 0
[pid 25476] 10:12:35.469308 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25475] 10:12:35.469349 <... chmod resumed> ) = 0
[pid 25474] 10:12:35.469363 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25473] 10:12:35.469431 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.469459 close(6 <unfinished ...>
[pid 25476] 10:12:35.469570 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25475] 10:12:35.469590 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.469618 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25473] 10:12:35.469632 <... mmap resumed> ) = 0x7f7c15872000
[pid 25472] 10:12:35.469654 <... close resumed> ) = 0
[pid 25458] 10:12:35.469679 fstat(13,  <unfinished ...>
[pid 25476] 10:12:35.469710 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25475] 10:12:35.469743 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.469788 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.469859 mprotect(0x7f7c15888000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.469886 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.469927 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fea0e13b790}, 8) = 0
[pid 25475] 10:12:35.469944 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.469976 <... ioctl resumed> , 0x7fff5c611910) = -1 EINVAL (Invalid argument)
[pid 25473] 10:12:35.469992 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.470034 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.470054 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2936, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25476] 10:12:35.470088 close(11 <unfinished ...>
[pid 25475] 10:12:35.470113 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.470126 brk(0 <unfinished ...>
[pid 25473] 10:12:35.470149 mmap(0x7f7c15a88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25472] 10:12:35.470178 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.470221 <... close resumed> ) = 0
[pid 25475] 10:12:35.470234 read(6,  <unfinished ...>
[pid 25474] 10:12:35.470263 <... brk resumed> ) = 0x1edb000
[pid 25473] 10:12:35.470279 <... mmap resumed> ) = 0x7f7c15a88000
[pid 25472] 10:12:35.470335 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.470361 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25476] 10:12:35.470392 fcntl(12, F_GETFD <unfinished ...>
[pid 25475] 10:12:35.470414 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25474] 10:12:35.470431 brk(0x1efc000 <unfinished ...>
[pid 25473] 10:12:35.470465 mmap(0x7f7c15a8a000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.470497 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.470537 <... fcntl resumed> ) = 0
[pid 25475] 10:12:35.470553 read(6,  <unfinished ...>
[pid 25474] 10:12:35.470577 <... brk resumed> ) = 0x1efc000
[pid 25473] 10:12:35.470591 <... mmap resumed> ) = 0x7f7c15a8a000
[pid 25472] 10:12:35.470626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.470661 <... fcntl resumed> ) = 0
[pid 25476] 10:12:35.470685 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25475] 10:12:35.470725 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.470740 getuid( <unfinished ...>
[pid 25473] 10:12:35.470763 close(6 <unfinished ...>
[pid 25472] 10:12:35.470785 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.470826 <... fcntl resumed> ) = 0
[pid 25475] 10:12:35.470839 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:35 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2522 <unfinished ...>
[pid 25474] 10:12:35.470892 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.470908 <... close resumed> ) = 0
[pid 25472] 10:12:35.470925 <... open resumed> ) = 6
[pid 25458] 10:12:35.470950 read(13,  <unfinished ...>
[pid 25476] 10:12:35.470981 geteuid( <unfinished ...>
[pid 25475] 10:12:35.471003 <... write resumed> ) = 2522
[pid 25474] 10:12:35.471016 getgid( <unfinished ...>
[pid 25473] 10:12:35.471043 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.471071 read(6,  <unfinished ...>
[pid 25476] 10:12:35.471104 <... geteuid resumed> ) = 0
[pid 25475] 10:12:35.471117 fsync(14 <unfinished ...>
[pid 25474] 10:12:35.471178 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.471197 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.471216 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.471251 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2936
[pid 25476] 10:12:35.471350 getegid( <unfinished ...>
[pid 25474] 10:12:35.471933 geteuid( <unfinished ...>
[pid 25473] 10:12:35.471958 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.471991 fstat(6,  <unfinished ...>
[pid 25476] 10:12:35.472025 <... getegid resumed> ) = 12
[pid 25475] 10:12:35.472040 <... fsync resumed> ) = 0
[pid 25474] 10:12:35.472057 <... geteuid resumed> ) = 503
[pid 25473] 10:12:35.472076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.472094 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.472129 read(13,  <unfinished ...>
[pid 25476] 10:12:35.472160 setgid(500 <unfinished ...>
[pid 25475] 10:12:35.472182 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25474] 10:12:35.472204 getegid( <unfinished ...>
[pid 25473] 10:12:35.472225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.472253 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25476] 10:12:35.472291 <... setgid resumed> ) = 0
[pid 25475] 10:12:35.472305 <... lseek resumed> ) = 2936
[pid 25474] 10:12:35.472320 <... getegid resumed> ) = 500
[pid 25473] 10:12:35.472335 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.472367 <... mmap resumed> ) = 0x7ff100800000
[pid 25458] 10:12:35.472390 <... read resumed> "", 8192) = 0
[pid 25476] 10:12:35.472412 setuid(503 <unfinished ...>
[pid 25475] 10:12:35.472461 write(11, "2522 1\n", 7 <unfinished ...>
[pid 25474] 10:12:35.472576 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.472601 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.472632 mprotect(0x7ff100807000, 2097152, PROT_NONE <unfinished ...>
[pid 25476] 10:12:35.472669 <... setuid resumed> ) = 0
[pid 25475] 10:12:35.472684 <... write resumed> ) = 7
[pid 25474] 10:12:35.472699 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.472720 <... open resumed> ) = 6
[pid 25472] 10:12:35.472778 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.472799 close(13 <unfinished ...>
[pid 25476] 10:12:35.472831 chdir("/" <unfinished ...>
[pid 25475] 10:12:35.472856 close(11 <unfinished ...>
[pid 25474] 10:12:35.472879 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.472914 read(6,  <unfinished ...>
[pid 25472] 10:12:35.472937 mmap(0x7ff100a07000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25476] 10:12:35.472978 <... chdir resumed> ) = 0
[pid 25475] 10:12:35.472992 <... close resumed> ) = 0
[pid 25474] 10:12:35.473018 <... open resumed> ) = 5
[pid 25473] 10:12:35.473037 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.473066 <... mmap resumed> ) = 0x7ff100a07000
[pid 25458] 10:12:35.473090 <... close resumed> ) = 0
[pid 25476] 10:12:35.473111 geteuid( <unfinished ...>
[pid 25475] 10:12:35.473187 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.473285 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.473309 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.473332 mmap(0x7ff100a09000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25476] 10:12:35.473371 <... geteuid resumed> ) = 503
[pid 25475] 10:12:35.473385 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016470, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2522, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.473415 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:35.473442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.473470 <... mmap resumed> ) = 0x7ff100a09000
[pid 25458] 10:12:35.473509 stat("/etc/userdomains",  <unfinished ...>
[pid 25476] 10:12:35.473545 getegid( <unfinished ...>
[pid 25475] 10:12:35.473568 close(14 <unfinished ...>
[pid 25474] 10:12:35.473592 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.473617 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.473641 close(6 <unfinished ...>
[pid 25476] 10:12:35.473673 <... getegid resumed> ) = 500
[pid 25475] 10:12:35.473686 <... close resumed> ) = 0
[pid 25474] 10:12:35.473722 <... mmap resumed> ) = 0x7f5314365000
[pid 25473] 10:12:35.473772 <... mmap resumed> ) = 0x7f7c15c9f000
[pid 25472] 10:12:35.473804 <... close resumed> ) = 0
[pid 25458] 10:12:35.473845 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25476] 10:12:35.473902 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25475] 10:12:35.473964 rename("tmp/1451491955.H467202P25475.fin.finestweddingsites.com", "new/1451491955.H467202P25475.fin.finestweddingsites.com,S=2522" <unfinished ...>
[pid 25474] 10:12:35.474018 read(5,  <unfinished ...>
[pid 25473] 10:12:35.474074 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.474103 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.474144 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25475] 10:12:35.474171 <... rename resumed> ) = 0
[pid 25474] 10:12:35.474187 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          253152 kB\nCached:           330564 kB\nBuffers:               0 kB\nActive:           297620 kB\nInactive:         467296 kB\nActive(anon):     164552 kB\nInactive(anon):   277604 kB\nActive(file):     133068 kB\nInac"..., 1024) = 588
[pid 25473] 10:12:35.474209 <... mmap resumed> ) = 0x7f7c15659000
[pid 25472] 10:12:35.474240 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.474260 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25476] 10:12:35.474296 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25475] 10:12:35.474321 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.474351 close(5 <unfinished ...>
[pid 25473] 10:12:35.474377 mprotect(0x7f7c1566f000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.474403 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.474447 <... chdir resumed> ) = 0
[pid 25475] 10:12:35.474460 <... write resumed> ) = 4
[pid 25474] 10:12:35.474580 <... close resumed> ) = 0
[pid 25473] 10:12:35.474601 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.474617 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.474636 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.474663 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.474709 stat("tmp",  <unfinished ...>
[pid 25475] 10:12:35.474746 write(12, "\332\t\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.474791 munmap(0x7f5314365000, 4096 <unfinished ...>
[pid 25473] 10:12:35.474831 mmap(0x7f7c1586e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25472] 10:12:35.474882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.474929 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.474961 read(11,  <unfinished ...>
[pid 25476] 10:12:35.475001 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25475] 10:12:35.475029 <... write resumed> ) = 4
[pid 25474] 10:12:35.475044 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.475059 <... mmap resumed> ) = 0x7f7c1586e000
[pid 25472] 10:12:35.475121 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.475144 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.475170 <... read resumed> "\332\t\0\0", 4) = 4
[pid 25476] 10:12:35.475233 stat("new",  <unfinished ...>
[pid 25475] 10:12:35.475262 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25474] 10:12:35.475287 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.475313 mmap(0x7f7c15870000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.475342 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.475374 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.475402 read(11,  <unfinished ...>
[pid 25476] 10:12:35.475436 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25475] 10:12:35.475461 <... write resumed> ) = 4
[pid 25474] 10:12:35.475481 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:35.475500 <... mmap resumed> ) = 0x7f7c15870000
[pid 25472] 10:12:35.475524 <... open resumed> ) = 6
[pid 25458] 10:12:35.475542 <... open resumed> ) = 13
[pid 25443] 10:12:35.475557 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25476] 10:12:35.475590 stat("cur",  <unfinished ...>
[pid 25475] 10:12:35.475616 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.475640 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.475664 close(6 <unfinished ...>
[pid 25472] 10:12:35.475687 read(6,  <unfinished ...>
[pid 25458] 10:12:35.475710 fstat(13,  <unfinished ...>
[pid 25443] 10:12:35.475736 read(11,  <unfinished ...>
[pid 25476] 10:12:35.475794 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25475] 10:12:35.475831 <... write resumed> ) = 4
[pid 25474] 10:12:35.475914 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.475952 <... close resumed> ) = 0
[pid 25472] 10:12:35.475987 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.476020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.476049 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.476077 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25475] 10:12:35.476109 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.476134 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.476159 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.476194 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.476218 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.476244 read(11,  <unfinished ...>
[pid 25476] 10:12:35.476278 <... open resumed> ) = 11
[pid 25475] 10:12:35.476291 <... write resumed> ) = 4
[pid 25474] 10:12:35.476308 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:35.476326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.476345 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.476372 <... mmap resumed> ) = 0x7f03f4be4000
[pid 25443] 10:12:35.476381 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.476401 read(11,  <unfinished ...>
[pid 25475] 10:12:35.476407 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.476413 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.476421 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.476440 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.476453 read(13,  <unfinished ...>
[pid 25443] 10:12:35.476466 read(11,  <unfinished ...>
[pid 25473] 10:12:35.476664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25476] 10:12:35.476685 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4102
[pid 25475] 10:12:35.476704 <... write resumed> ) = 4
[pid 25474] 10:12:35.476840 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0}, 8) = 0
[pid 25472] 10:12:35.476876 <... mmap resumed> ) = 0x7ff10057c000
[pid 25458] 10:12:35.476902 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:35.476935 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.476964 stat("tmp/1451491955.H476826P25476.fin.finestweddingsites.com",  <unfinished ...>
[pid 25475] 10:12:35.476996 write(12, "\260\243\304\1\0\0\0\0", 8 <unfinished ...>
[pid 25474] 10:12:35.477021 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.477046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.477077 mprotect(0x7ff1005ff000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.477103 close(13 <unfinished ...>
[pid 25443] 10:12:35.477128 read(11,  <unfinished ...>
[pid 25476] 10:12:35.477161 <... stat resumed> 0x7ffc7271b760) = -1 ENOENT (No such file or directory)
[pid 25475] 10:12:35.477175 <... write resumed> ) = 8
[pid 25474] 10:12:35.477193 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:35.477211 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.477234 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.477251 <... close resumed> ) = 0
[pid 25443] 10:12:35.477266 <... read resumed> "\260\243\304\1\0\0\0\0", 8) = 8
[pid 25476] 10:12:35.477294 open("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25475] 10:12:35.477349 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.477377 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.477407 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.477438 mmap(0x7ff1007fe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25458] 10:12:35.477469 munmap(0x7f03f4be4000, 4096 <unfinished ...>
[pid 25443] 10:12:35.477500 read(11,  <unfinished ...>
[pid 25476] 10:12:35.477535 <... open resumed> ) = 14
[pid 25475] 10:12:35.477550 <... write resumed> ) = 4
[pid 25474] 10:12:35.477574 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.477596 <... open resumed> ) = 6
[pid 25472] 10:12:35.477612 <... mmap resumed> ) = 0x7ff1007fe000
[pid 25458] 10:12:35.477638 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.477666 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.477697 chown("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25475] 10:12:35.477730 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.477758 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.477781 read(6,  <unfinished ...>
[pid 25472] 10:12:35.477804 close(6 <unfinished ...>
[pid 25458] 10:12:35.477826 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.477852 read(11,  <unfinished ...>
[pid 25476] 10:12:35.477886 <... chown resumed> ) = 0
[pid 25475] 10:12:35.477899 <... write resumed> ) = 4
[pid 25474] 10:12:35.477920 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.477943 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.477966 <... close resumed> ) = 0
[pid 25458] 10:12:35.477989 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.478019 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.478047 chmod("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25475] 10:12:35.478075 close(12 <unfinished ...>
[pid 25474] 10:12:35.478099 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.478126 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.478149 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.478179 pipe( <unfinished ...>
[pid 25443] 10:12:35.478206 close(11 <unfinished ...>
[pid 25476] 10:12:35.478242 <... chmod resumed> ) = 0
[pid 25475] 10:12:35.478256 <... close resumed> ) = 0
[pid 25474] 10:12:35.478275 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.478299 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.478329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.478347 <... pipe resumed> [13, 14]) = 0
[pid 25443] 10:12:35.478364 <... close resumed> ) = 0
[pid 25476] 10:12:35.478399 chown("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25475] 10:12:35.478427 close(10 <unfinished ...>
[pid 25474] 10:12:35.478439 uname( <unfinished ...>
[pid 25473] 10:12:35.478447 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.478460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.478638 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25443] 10:12:35.478669 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25476] 10:12:35.478716 <... chown resumed> ) = 0
[pid 25475] 10:12:35.478730 <... close resumed> ) = 0
[pid 25474] 10:12:35.478749 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25473] 10:12:35.478818 <... mmap resumed> ) = 0x7f7c15422000
[pid 25472] 10:12:35.478838 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.478856 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25443] 10:12:35.478877 <... write resumed> ) = 55
[pid 25476] 10:12:35.478910 chmod("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25475] 10:12:35.478940 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25474] 10:12:35.478970 getcwd( <unfinished ...>
[pid 25473] 10:12:35.478995 mprotect(0x7f7c15429000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.479021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.479051 close(10 <unfinished ...>
[pid 25443] 10:12:35.479077 fsync(9 <unfinished ...>
[pid 25476] 10:12:35.479149 <... chmod resumed> ) = 0
[pid 25475] 10:12:35.479164 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.479233 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25473] 10:12:35.479295 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.479313 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.479333 <... close resumed> ) = 0
[pid 25476] 10:12:35.479360 stat("/etc/localtime",  <unfinished ...>
[pid 25475] 10:12:35.479390 close(13 <unfinished ...>
[pid 25474] 10:12:35.479426 getpid( <unfinished ...>
[pid 25473] 10:12:35.479465 mmap(0x7f7c15629000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25472] 10:12:35.479581 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.479616 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25476] 10:12:35.479654 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25475] 10:12:35.479682 <... close resumed> ) = 0
[pid 25474] 10:12:35.479734 <... getpid resumed> ) = 25474
[pid 25473] 10:12:35.479766 <... mmap resumed> ) = 0x7f7c15629000
[pid 25472] 10:12:35.479788 <... open resumed> ) = 6
[pid 25458] 10:12:35.479805 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.479822 <... fsync resumed> ) = 0
[pid 25476] 10:12:35.479849 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25475] 10:12:35.479873 munmap(0x7fdec5ab7000, 4096 <unfinished ...>
[pid 25474] 10:12:35.479899 getppid( <unfinished ...>
[pid 25473] 10:12:35.479922 mmap(0x7f7c1562b000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.479949 read(6,  <unfinished ...>
[pid 25458] 10:12:35.479972 close(11 <unfinished ...>
[pid 25443] 10:12:35.479996 wait4(-1,  <unfinished ...>
[pid 25476] 10:12:35.480028 <... lseek resumed> ) = 19
[pid 25475] 10:12:35.480041 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.480429 <... getppid resumed> ) = 25389
[pid 25473] 10:12:35.480462 <... mmap resumed> ) = 0x7f7c1562b000
[pid 25472] 10:12:35.480488 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.480523 <... close resumed> ) = 0
[pid 25476] 10:12:35.480549 read(6,  <unfinished ...>
[pid 25475] 10:12:35.480579 exit_group(0) = ?
[pid 25474] 10:12:35.480911 stat(".",  <unfinished ...>
[pid 25473] 10:12:35.480952 close(6 <unfinished ...>
[pid 25472] 10:12:35.480989 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.481025 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25476] 10:12:35.481081 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25475] 10:12:35.481100 +++ exited with 0 +++
[pid 25474] 10:12:35.481123 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25473] 10:12:35.481162 <... close resumed> ) = 0
[pid 25472] 10:12:35.481184 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25458] 10:12:35.481215 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.481232 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25475
[pid 25476] 10:12:35.481290 read(6,  <unfinished ...>
[pid 25474] 10:12:35.481316 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.481346 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.481377 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.481404 close(12 <unfinished ...>
[pid 25443] 10:12:35.481428 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25476] 10:12:35.481465 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.481594 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.481634 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.481653 <... mmap resumed> ) = 0x7ff10107c000
[pid 25458] 10:12:35.481674 <... close resumed> ) = 0
[pid 25443] 10:12:35.481690 <... open resumed> ) = 10
[pid 25476] 10:12:35.481716 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:35 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2558 <unfinished ...>
[pid 25474] 10:12:35.481767 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.481816 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.481864 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.481910 munmap(0x7f03f4be5000, 4096 <unfinished ...>
[pid 25443] 10:12:35.481945 fstat(10,  <unfinished ...>
[pid 25476] 10:12:35.481979 <... write resumed> ) = 2558
[pid 25474] 10:12:35.481993 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.482029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.482047 <... mmap resumed> ) = 0x7ff10036e000
[pid 25458] 10:12:35.482063 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.482080 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25476] 10:12:35.482122 fsync(14 <unfinished ...>
[pid 25474] 10:12:35.482171 geteuid( <unfinished ...>
[pid 25473] 10:12:35.482198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.482271 mprotect(0x7ff10037a000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.482300 close(9 <unfinished ...>
[pid 25443] 10:12:35.482327 fstat(10,  <unfinished ...>
[pid 25474] 10:12:35.482360 <... geteuid resumed> ) = 503
[pid 25473] 10:12:35.482376 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.482395 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.482416 <... close resumed> ) = 0
[pid 25443] 10:12:35.482433 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25476] 10:12:35.482470 <... fsync resumed> ) = 0
[pid 25474] 10:12:35.482562 getegid( <unfinished ...>
[pid 25473] 10:12:35.482595 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.482627 mmap(0x7ff10057a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25458] 10:12:35.482656 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25443] 10:12:35.482682 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25476] 10:12:35.482718 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25474] 10:12:35.482749 <... getegid resumed> ) = 500
[pid 25473] 10:12:35.482777 <... open resumed> ) = 6
[pid 25472] 10:12:35.482802 <... mmap resumed> ) = 0x7ff10057a000
[pid 25458] 10:12:35.482837 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.482870 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25476] 10:12:35.482911 <... lseek resumed> ) = 4102
[pid 25474] 10:12:35.482928 getuid( <unfinished ...>
[pid 25473] 10:12:35.482953 read(6,  <unfinished ...>
[pid 25472] 10:12:35.482976 close(6 <unfinished ...>
[pid 25458] 10:12:35.482998 clone( <unfinished ...>
[pid 25443] 10:12:35.483247 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25476] 10:12:35.483282 write(11, "2558 1\n", 7 <unfinished ...>
[pid 25474] 10:12:35.483312 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.483328 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.483352 <... close resumed> ) = 0
[pid 25443] 10:12:35.483378 <... lseek resumed> ) = 0
[pid 25476] 10:12:35.483406 <... write resumed> ) = 7
[pid 25474] 10:12:35.483420 getgid( <unfinished ...>
[pid 25473] 10:12:35.483445 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.483468 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.483567 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25477
[pid 25443] 10:12:35.483604 read(10,  <unfinished ...>
[pid 25476] 10:12:35.483649 close(11 <unfinished ...>
[pid 25474] 10:12:35.483673 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.483690 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.483722 <... open resumed> ) = 6
[pid 25458] 10:12:35.483747 close(14 <unfinished ...>
[pid 25443] 10:12:35.483787 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25476] 10:12:35.483865 <... close resumed> ) = 0
[pid 25474] 10:12:35.483891 access("/bin/sh", X_OK <unfinished ...>
[pid 25473] 10:12:35.483937 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.483965 read(6,  <unfinished ...>
[pid 25458] 10:12:35.483989 <... close resumed> ) = 0
[pid 25443] 10:12:35.484005 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25476] 10:12:35.484044 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.484066 <... access resumed> ) = 0
[pid 25473] 10:12:35.484082 <... mmap resumed> ) = 0x7f7c1519e000
[pid 25472] 10:12:35.484099 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.484122 read(13,  <unfinished ...>
[pid 25443] 10:12:35.484144 <... stat resumed> 0x7ffd9471b4c0) = -1 ENOENT (No such file or directory)
[pid 25476] 10:12:35.484188 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179008, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2558, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.484217 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.484247 mprotect(0x7f7c15221000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.484274 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.484297 <... select resumed> ) = 1 (in [11], left {599, 954762})
[pid 25443] 10:12:35.484325 stat("/etc/localtime",  <unfinished ...>
[pid 25476] 10:12:35.484361 close(14 <unfinished ...>
[pid 25474] 10:12:35.484391 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.484420 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.484437 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25452] 10:12:35.484467 read(11,  <unfinished ...>
[pid 25443] 10:12:35.484581 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25476] 10:12:35.484638 <... close resumed> ) = 0
[pid 25474] 10:12:35.484655 geteuid( <unfinished ...>
[pid 25473] 10:12:35.484694 mmap(0x7f7c15420000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25472] 10:12:35.484735 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.484781 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25443] 10:12:35.484813 write(8, "2015-12-30 10:12:35 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25476] 10:12:35.484882 rename("tmp/1451491955.H476826P25476.fin.finestweddingsites.com", "new/1451491955.H476826P25476.fin.finestweddingsites.com,S=2558" <unfinished ...>
[pid 25474] 10:12:35.484957 <... geteuid resumed> ) = 503
[pid 25473] 10:12:35.484976 <... mmap resumed> ) = 0x7f7c15420000
[pid 25472] 10:12:35.485002 <... mmap resumed> ) = 0x7ff10014b000
[pid 25452] 10:12:35.485021 read(11,  <unfinished ...>
[pid 25443] 10:12:35.485046 <... write resumed> ) = 132
[pid 25476] 10:12:35.485081 <... rename resumed> ) = 0
[pid 25474] 10:12:35.485101 getegid( <unfinished ...>
[pid 25473] 10:12:35.485123 close(6 <unfinished ...>
[pid 25472] 10:12:35.485146 mprotect(0x7ff10016c000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.485173 <... read resumed> "\260\327\32\341O\0050\306ei0\324F!u\274\346\240\355+\331\303\216\262\307\21w\305\270\5G\354", 32) = 32
[pid 25443] 10:12:35.485202 stat("/etc/localtime",  <unfinished ...>
[pid 25476] 10:12:35.485238 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.485270 <... getegid resumed> ) = 500
[pid 25473] 10:12:35.485286 <... close resumed> ) = 0
[pid 25472] 10:12:35.485309 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.485326 read(11,  <unfinished ...>
[pid 25443] 10:12:35.485350 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25476] 10:12:35.485400 <... write resumed> ) = 4
[pid 25474] 10:12:35.485419 getuid( <unfinished ...>
[pid 25473] 10:12:35.485441 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.485472 mmap(0x7ff10036c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25452] 10:12:35.485506 <... read resumed> "\27\3\1\0@", 5) = 5
[pid 25443] 10:12:35.485526 stat("/etc/localtime",  <unfinished ...>
[pid 25433] 10:12:35.485554 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.485587 write(12, "\376\t\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.485614 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.485630 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.485648 <... mmap resumed> ) = 0x7ff10036c000
[pid 25452] 10:12:35.485669 read(11,  <unfinished ...>
[pid 25443] 10:12:35.485695 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25433] 10:12:35.485728 read(11,  <unfinished ...>
[pid 25476] 10:12:35.485794 <... write resumed> ) = 4
[pid 25474] 10:12:35.485820 getgid( <unfinished ...>
[pid 25473] 10:12:35.485854 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.485906 close(6 <unfinished ...>
[pid 25452] 10:12:35.485936 <... read resumed> "\301\215m\n4<\251\351x\340\312\224\0058:kz2(\373([\313\220>\7\204\203o\245!h\245\35\32\0\221uq\33\333\304\310y~N\371\223?\361\314\234\235\5\363\303\237\276\334\360!\341\311\332", 64) = 64
[pid 25443] 10:12:35.485968 close(7 <unfinished ...>
[pid 25433] 10:12:35.485995 <... read resumed> "\376\t\0\0", 4) = 4
[pid 25476] 10:12:35.486023 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.486049 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.486065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.486088 <... close resumed> ) = 0
[pid 25452] 10:12:35.486112 write(9, "tracy.thompson@hilton.com\n", 26 <unfinished ...>
[pid 25443] 10:12:35.486145 <... close resumed> ) = 0
[pid 25433] 10:12:35.486165 read(11,  <unfinished ...>
[pid 25476] 10:12:35.486199 <... write resumed> ) = 4
[pid 25474] 10:12:35.486215 access("/bin/sh", R_OK <unfinished ...>
[pid 25473] 10:12:35.486244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.486274 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.486302 <... write resumed> ) = 26
[pid 25443] 10:12:35.486319 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25433] 10:12:35.486353 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25476] 10:12:35.486381 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.486406 <... access resumed> ) = 0
[pid 25473] 10:12:35.486422 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.486442 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.486459 fsync(9 <unfinished ...>
[pid 25443] 10:12:35.486683 <... open resumed> ) = 7
[pid 25433] 10:12:35.486704 read(11,  <unfinished ...>
[pid 25476] 10:12:35.486746 <... write resumed> ) = 4
[pid 25474] 10:12:35.486775 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.486838 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.486869 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.486902 fcntl(7, F_GETFD <unfinished ...>
[pid 25433] 10:12:35.486926 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.486953 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.486978 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.487021 <... open resumed> ) = 6
[pid 25472] 10:12:35.487049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.487075 <... fsync resumed> ) = 0
[pid 25443] 10:12:35.487102 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.487120 read(11,  <unfinished ...>
[pid 25476] 10:12:35.487154 <... write resumed> ) = 4
[pid 25474] 10:12:35.487170 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.487196 read(6,  <unfinished ...>
[pid 25472] 10:12:35.487219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.487249 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR <unfinished ...>
[pid 25443] 10:12:35.487293 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.487319 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.487347 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.487371 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.487399 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.487422 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.487441 <... open resumed> ) = 14
[pid 25443] 10:12:35.487463 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.487485 read(11,  <unfinished ...>
[pid 25476] 10:12:35.487520 <... write resumed> ) = 4
[pid 25474] 10:12:35.487536 geteuid( <unfinished ...>
[pid 25473] 10:12:35.487559 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.487581 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.487613 alarm(60 <unfinished ...>
[pid 25443] 10:12:35.487638 fstat(7,  <unfinished ...>
[pid 25433] 10:12:35.487661 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.487688 write(12, "\260s~\0\0\0\0\0", 8 <unfinished ...>
[pid 25474] 10:12:35.487717 <... geteuid resumed> ) = 503
[pid 25473] 10:12:35.487737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25472] 10:12:35.487785 <... open resumed> ) = 6
[pid 25452] 10:12:35.487811 <... alarm resumed> ) = 0
[pid 25443] 10:12:35.487830 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5372139, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:35.487859 read(11,  <unfinished ...>
[pid 25476] 10:12:35.487893 <... write resumed> ) = 8
[pid 25474] 10:12:35.487909 getegid( <unfinished ...>
[pid 25473] 10:12:35.487932 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.487960 read(6,  <unfinished ...>
[pid 25452] 10:12:35.487984 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25443] 10:12:35.488013 write(7, "2015-12-30 10:12:35 [25443] 1aEJMY-0006cE-He => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2522 QT=1s DT=0s\n", 232 <unfinished ...>
[pid 25433] 10:12:35.488046 <... read resumed> "\260s~\0\0\0\0\0", 8) = 8
[pid 25476] 10:12:35.488075 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.488100 <... getegid resumed> ) = 500
[pid 25473] 10:12:35.488116 <... mmap resumed> ) = 0x7f7c15c9e000
[pid 25472] 10:12:35.488144 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.488169 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.488185 <... write resumed> ) = 232
[pid 25433] 10:12:35.488210 read(11,  <unfinished ...>
[pid 25476] 10:12:35.488246 <... write resumed> ) = 4
[pid 25474] 10:12:35.488262 getuid( <unfinished ...>
[pid 25473] 10:12:35.488285 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.488312 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.488332 alarm(0 <unfinished ...>
[pid 25443] 10:12:35.488342 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25433] 10:12:35.488361 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.488381 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.488391 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.488399 <... mmap resumed> ) = 0x7f7c14f90000
[pid 25472] 10:12:35.488408 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25452] 10:12:35.488427 <... alarm resumed> ) = 60
[pid 25443] 10:12:35.488454 <... open resumed> ) = 11
[pid 25433] 10:12:35.488463 read(11,  <unfinished ...>
[pid 25476] 10:12:35.488664 <... write resumed> ) = 4
[pid 25474] 10:12:35.488684 getgid( <unfinished ...>
[pid 25473] 10:12:35.488708 mprotect(0x7f7c14f9c000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.488737 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.488766 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.488803 alarm(60 <unfinished ...>
[pid 25433] 10:12:35.488828 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25476] 10:12:35.488856 close(12 <unfinished ...>
[pid 25474] 10:12:35.488880 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.488896 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.488912 <... mmap resumed> ) = 0x7ff0fff2e000
[pid 25452] 10:12:35.488928 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.488945 <... alarm resumed> ) = 0
[pid 25433] 10:12:35.488961 close(11 <unfinished ...>
[pid 25476] 10:12:35.488998 <... close resumed> ) = 0
[pid 25474] 10:12:35.489016 access("/bin/sh", X_OK <unfinished ...>
[pid 25473] 10:12:35.489045 mmap(0x7f7c1519c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25472] 10:12:35.489075 mprotect(0x7ff0fff45000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.489102 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.489139 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25433] 10:12:35.489167 <... close resumed> ) = 0
[pid 25476] 10:12:35.489204 close(10 <unfinished ...>
[pid 25474] 10:12:35.489231 <... access resumed> ) = 0
[pid 25473] 10:12:35.489248 <... mmap resumed> ) = 0x7f7c1519c000
[pid 25472] 10:12:35.489273 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.489290 <... open resumed> ) = 15
[pid 25443] 10:12:35.489307 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.489323 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25476] 10:12:35.489365 <... close resumed> ) = 0
[pid 25474] 10:12:35.489382 stat("/bin/sh",  <unfinished ...>
[pid 25473] 10:12:35.489409 close(6 <unfinished ...>
[pid 25472] 10:12:35.489431 mmap(0x7ff100145000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25452] 10:12:35.489461 read(15,  <unfinished ...>
[pid 25443] 10:12:35.489514 alarm(0 <unfinished ...>
[pid 25433] 10:12:35.489538 <... write resumed> ) = 28
[pid 25476] 10:12:35.489567 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25474] 10:12:35.489595 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25473] 10:12:35.489624 <... close resumed> ) = 0
[pid 25472] 10:12:35.489648 <... mmap resumed> ) = 0x7ff100145000
[pid 25452] 10:12:35.489670 <... read resumed> "cpu  123062 1342401 395147 67343095 2509 0 0 0\ncpu0 123062 1342401 395147 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58355539\nbtime 1450798266\nprocesses 892955\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25443] 10:12:35.489692 <... alarm resumed> ) = 60
[pid 25433] 10:12:35.489759 fsync(9 <unfinished ...>
[pid 25476] 10:12:35.489811 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.489840 geteuid( <unfinished ...>
[pid 25473] 10:12:35.489990 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.490028 mmap(0x7ff100147000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.490064 close(15 <unfinished ...>
[pid 25443] 10:12:35.490092 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25476] 10:12:35.490133 close(13 <unfinished ...>
[pid 25474] 10:12:35.490161 <... geteuid resumed> ) = 503
[pid 25473] 10:12:35.490177 <... open resumed> ) = 6
[pid 25472] 10:12:35.490200 <... mmap resumed> ) = 0x7ff100147000
[pid 25452] 10:12:35.490221 <... close resumed> ) = 0
[pid 25443] 10:12:35.490250 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:35.490284 <... fsync resumed> ) = 0
[pid 25476] 10:12:35.490313 <... close resumed> ) = 0
[pid 25474] 10:12:35.490331 getegid( <unfinished ...>
[pid 25473] 10:12:35.490353 read(6,  <unfinished ...>
[pid 25472] 10:12:35.490376 close(6 <unfinished ...>
[pid 25452] 10:12:35.490399 stat("/var/spool/exim/db/wait-remote_smtp",  <unfinished ...>
[pid 25443] 10:12:35.490428 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.490458 wait4(-1,  <unfinished ...>
[pid 25476] 10:12:35.490571 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25474] 10:12:35.490602 <... getegid resumed> ) = 500
[pid 25473] 10:12:35.490618 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.490642 <... close resumed> ) = 0
[pid 25452] 10:12:35.490667 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25443] 10:12:35.490701 <... open resumed> ) = 12
[pid 25476] 10:12:35.490727 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.491144 getuid( <unfinished ...>
[pid 25473] 10:12:35.491172 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.491196 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.491226 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR <unfinished ...>
[pid 25443] 10:12:35.491257 fcntl(12, F_GETFD <unfinished ...>
[pid 25476] 10:12:35.491290 exit_group(0) = ?
[pid 25474] 10:12:35.491653 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.491678 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25472] 10:12:35.491712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.491730 <... open resumed> ) = 15
[pid 25443] 10:12:35.491746 <... fcntl resumed> ) = 0
[pid 25476] 10:12:35.491783 +++ exited with 0 +++
[pid 25474] 10:12:35.491797 getgid( <unfinished ...>
[pid 25473] 10:12:35.491831 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.491876 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.491922 fcntl(15, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.491957 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.491982 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25476
[pid 25474] 10:12:35.492048 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.492069 <... mmap resumed> ) = 0x7f7c14d6d000
[pid 25472] 10:12:35.492087 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.492104 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.492120 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.492137 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.492182 access("/bin/sh", R_OK <unfinished ...>
[pid 25473] 10:12:35.492211 mprotect(0x7f7c14d8e000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.492239 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.492269 fcntl(15, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.492293 read(12,  <unfinished ...>
[pid 25433] 10:12:35.492317 <... open resumed> ) = 10
[pid 25474] 10:12:35.492343 <... access resumed> ) = 0
[pid 25473] 10:12:35.492378 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.492395 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.492415 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.492432 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25433] 10:12:35.492459 fstat(10,  <unfinished ...>
[pid 25474] 10:12:35.492497 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.492529 mmap(0x7f7c14f8e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25472] 10:12:35.492561 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.492591 read(15,  <unfinished ...>
[pid 25443] 10:12:35.492614 close(12 <unfinished ...>
[pid 25433] 10:12:35.492639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.492682 <... socket resumed> ) = 5
[pid 25473] 10:12:35.492701 <... mmap resumed> ) = 0x7f7c14f8e000
[pid 25472] 10:12:35.492723 <... open resumed> ) = 6
[pid 25452] 10:12:35.492749 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25443] 10:12:35.492789 <... close resumed> ) = 0
[pid 25433] 10:12:35.492825 fstat(10,  <unfinished ...>
[pid 25474] 10:12:35.492862 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.492900 close(6 <unfinished ...>
[pid 25472] 10:12:35.492923 read(6,  <unfinished ...>
[pid 25452] 10:12:35.492946 close(15 <unfinished ...>
[pid 25443] 10:12:35.492971 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.492999 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.493037 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.493063 <... close resumed> ) = 0
[pid 25472] 10:12:35.493098 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.493141 <... close resumed> ) = 0
[pid 25443] 10:12:35.493169 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:35.493189 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.493225 close(5 <unfinished ...>
[pid 25473] 10:12:35.493252 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.493282 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.493306 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.493332 stat("/var/tmp",  <unfinished ...>
[pid 25433] 10:12:35.493361 <... mmap resumed> ) = 0x7fea0f284000
[pid 25474] 10:12:35.493388 <... close resumed> ) = 0
[pid 25473] 10:12:35.493404 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.493419 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25452] 10:12:35.493439 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.493449 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25433] 10:12:35.493720 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.493788 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.493832 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.493884 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.493926 stat("/var/tmp",  <unfinished ...>
[pid 25443] 10:12:35.493955 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.493986 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.494013 <... socket resumed> ) = 5
[pid 25473] 10:12:35.494030 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.494047 <... mmap resumed> ) = 0x7ff10107b000
[pid 25452] 10:12:35.494068 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25443] 10:12:35.494111 <... open resumed> ) = 12
[pid 25433] 10:12:35.494130 read(10,  <unfinished ...>
[pid 25474] 10:12:35.494166 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.494199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.494230 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.494258 brk(0x26fd000 <unfinished ...>
[pid 25443] 10:12:35.494283 fcntl(12, F_GETFD <unfinished ...>
[pid 25433] 10:12:35.494306 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25474] 10:12:35.494364 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.494386 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.494405 <... mmap resumed> ) = 0x7ff0ffbba000
[pid 25452] 10:12:35.494422 <... brk resumed> ) = 0x26fd000
[pid 25443] 10:12:35.494537 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.494559 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25474] 10:12:35.494599 close(5 <unfinished ...>
[pid 25473] 10:12:35.494626 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.494657 mprotect(0x7ff0ffd29000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.494685 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0 <unfinished ...>
[pid 25443] 10:12:35.494718 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.494752 <... stat resumed> 0x7ffc7271a4b0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.494811 <... close resumed> ) = 0
[pid 25473] 10:12:35.494844 <... open resumed> ) = 6
[pid 25472] 10:12:35.494863 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.494879 <... open resumed> ) = 15
[pid 25443] 10:12:35.494895 <... fcntl resumed> ) = 0
[pid 25433] 10:12:35.494912 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.494948 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.494978 read(6,  <unfinished ...>
[pid 25472] 10:12:35.495001 mmap(0x7ff0fff28000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25452] 10:12:35.495031 fcntl(15, F_GETFD <unfinished ...>
[pid 25443] 10:12:35.495054 fstat(12,  <unfinished ...>
[pid 25433] 10:12:35.495077 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.495137 <... open resumed> ) = 5
[pid 25473] 10:12:35.495171 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.495202 <... mmap resumed> ) = 0x7ff0fff28000
[pid 25452] 10:12:35.495228 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.495246 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25433] 10:12:35.495291 write(8, "2015-12-30 10:12:35 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25474] 10:12:35.495336 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.495359 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.495383 close(6 <unfinished ...>
[pid 25452] 10:12:35.495406 fcntl(15, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.495429 pread(12,  <unfinished ...>
[pid 25433] 10:12:35.495455 <... write resumed> ) = 126
[pid 25474] 10:12:35.495607 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25473] 10:12:35.495648 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.495677 <... close resumed> ) = 0
[pid 25452] 10:12:35.495702 <... fcntl resumed> ) = 0
[pid 25443] 10:12:35.495720 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25433] 10:12:35.495769 write(8, "2015-12-30 10:12:35 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25474] 10:12:35.495812 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.495840 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.495868 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.495898 fstat(15,  <unfinished ...>
[pid 25443] 10:12:35.495922 pread(12,  <unfinished ...>
[pid 25433] 10:12:35.495947 <... write resumed> ) = 77
[pid 25474] 10:12:35.495985 <... mmap resumed> ) = 0x7f5314365000
[pid 25473] 10:12:35.496004 <... mmap resumed> ) = 0x7f7c14b50000
[pid 25472] 10:12:35.496021 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.496038 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25443] 10:12:35.496076 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25433] 10:12:35.496109 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.496147 read(5,  <unfinished ...>
[pid 25473] 10:12:35.496174 mprotect(0x7f7c14b67000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.496202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.496235 pread(15,  <unfinished ...>
[pid 25443] 10:12:35.496260 close(12 <unfinished ...>
[pid 25433] 10:12:35.496285 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.496335 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25473] 10:12:35.496373 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.496390 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.496408 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25443] 10:12:35.496446 <... close resumed> ) = 0
[pid 25433] 10:12:35.496588 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.496633 read(5,  <unfinished ...>
[pid 25473] 10:12:35.496657 mmap(0x7f7c14d67000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25472] 10:12:35.496688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.496720 pread(15,  <unfinished ...>
[pid 25443] 10:12:35.496744 close(11 <unfinished ...>
[pid 25433] 10:12:35.496772 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.496814 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:35.496833 <... mmap resumed> ) = 0x7f7c14d67000
[pid 25472] 10:12:35.496855 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.496875 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25443] 10:12:35.496909 <... close resumed> ) = 0
[pid 25433] 10:12:35.496951 close(7 <unfinished ...>
[pid 25474] 10:12:35.496988 close(5 <unfinished ...>
[pid 25473] 10:12:35.497012 mmap(0x7f7c14d69000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.497040 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.497074 close(15 <unfinished ...>
[pid 25443] 10:12:35.497099 pipe( <unfinished ...>
[pid 25433] 10:12:35.497126 <... close resumed> ) = 0
[pid 25474] 10:12:35.497154 <... close resumed> ) = 0
[pid 25473] 10:12:35.497171 <... mmap resumed> ) = 0x7f7c14d69000
[pid 25472] 10:12:35.497193 <... open resumed> ) = 6
[pid 25452] 10:12:35.497211 <... close resumed> ) = 0
[pid 25443] 10:12:35.497239 <... pipe resumed> [11, 12]) = 0
[pid 25433] 10:12:35.497261 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.497305 munmap(0x7f5314365000, 4096 <unfinished ...>
[pid 25473] 10:12:35.497352 close(6 <unfinished ...>
[pid 25472] 10:12:35.497377 read(6,  <unfinished ...>
[pid 25452] 10:12:35.497400 close(14 <unfinished ...>
[pid 25443] 10:12:35.497427 close(10 <unfinished ...>
[pid 25433] 10:12:35.497451 <... open resumed> ) = 7
[pid 25474] 10:12:35.497559 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.497594 <... close resumed> ) = 0
[pid 25472] 10:12:35.497619 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.497645 <... close resumed> ) = 0
[pid 25443] 10:12:35.497675 <... close resumed> ) = 0
[pid 25433] 10:12:35.497692 fcntl(7, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.497725 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.497755 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.497784 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.497808 write(11, "\27\3\1\0 \315\335\23\252\32\200#-\250\347\10\372%f@\310,\tA~T\327\r\257\317^\n)\340v#\366\27\3\1\0 \260^\243\221\300]\342)NY3W\35\224R`\25\350l\213\277E<\277[-\357II\303\224\314", 74 <unfinished ...>
[pid 25443] 10:12:35.497859 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25433] 10:12:35.497889 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.497915 <... open resumed> ) = 5
[pid 25473] 10:12:35.497932 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.497949 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25452] 10:12:35.497980 <... write resumed> ) = 74
[pid 25443] 10:12:35.498006 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.498026 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.498059 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.498082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.498114 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.498143 write(11, "\25\3\1\0 0`\210\23\225vE\210Y\376\372\177\34\312cB\315U\322\332;x;M\231\22\375\27\247V^\337", 37 <unfinished ...>
[pid 25443] 10:12:35.498185 clone( <unfinished ...>
[pid 25433] 10:12:35.498468 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.498560 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:35.498596 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.498614 <... mmap resumed> ) = 0x7ff0ff92b000
[pid 25452] 10:12:35.498630 <... write resumed> ) = 37
[pid 25433] 10:12:35.498679 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.498714 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.498740 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.498771 mprotect(0x7ff0ff9b6000, 2097152, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.498799 close(11 <unfinished ...>
[pid 25443] 10:12:35.498847 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25478
[pid 25433] 10:12:35.498884 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5372371, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.498926 <... mmap resumed> ) = 0x7f531435c000
[pid 25473] 10:12:35.498943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.498962 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.498979 <... close resumed> ) = 0
[pid 25443] 10:12:35.499009 close(12 <unfinished ...>
[pid 25433] 10:12:35.499034 write(7, "2015-12-30 10:12:35 [25433] 1aEJMY-0006c6-AN => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2558 QT=1s "..., 262 <unfinished ...>
[pid 25474] 10:12:35.499076 close(5 <unfinished ...>
[pid 25473] 10:12:35.499100 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.499129 mmap(0x7ff0ffbb6000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25452] 10:12:35.499161 close(13 <unfinished ...>
[pid 25443] 10:12:35.499186 <... close resumed> ) = 0
[pid 25433] 10:12:35.499204 <... write resumed> ) = 262
[pid 25474] 10:12:35.499271 <... close resumed> ) = 0
[pid 25473] 10:12:35.499304 <... open resumed> ) = 6
[pid 25472] 10:12:35.499324 <... mmap resumed> ) = 0x7ff0ffbb6000
[pid 25452] 10:12:35.499366 <... close resumed> ) = 0
[pid 25443] 10:12:35.499398 read(11,  <unfinished ...>
[pid 25433] 10:12:35.499435 pipe( <unfinished ...>
[pid 25474] 10:12:35.499474 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.499579 read(6,  <unfinished ...>
[pid 25472] 10:12:35.499604 mmap(0x7ff0ffbb9000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25452] 10:12:35.499633 munmap(0x7f380d423000, 4096 <unfinished ...>
[pid 25433] 10:12:35.499660 <... pipe resumed> [11, 12]) = 0
[pid 25474] 10:12:35.499686 <... open resumed> ) = 5
[pid 25473] 10:12:35.499702 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.499726 <... mmap resumed> ) = 0x7ff0ffbb9000
[pid 25452] 10:12:35.499751 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.499772 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25474] 10:12:35.499804 read(5,  <unfinished ...>
[pid 25473] 10:12:35.499828 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.499851 close(6 <unfinished ...>
[pid 25452] 10:12:35.499873 close(10 <unfinished ...>
[pid 25433] 10:12:35.499897 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.499922 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.499946 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.499976 <... close resumed> ) = 0
[pid 25452] 10:12:35.500000 <... close resumed> ) = 0
[pid 25433] 10:12:35.500017 close(10 <unfinished ...>
[pid 25474] 10:12:35.500049 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.500072 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.500098 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.500128 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25433] 10:12:35.500154 <... close resumed> ) = 0
[pid 25474] 10:12:35.500177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.500212 <... mmap resumed> ) = 0x7f7c15c9d000
[pid 25472] 10:12:35.500232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.500251 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.500277 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25474] 10:12:35.500314 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.500342 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.500369 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.500407 write(12, "S000004!\f\0\0", 11 <unfinished ...>
[pid 25433] 10:12:35.500442 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.500472 <... mmap resumed> ) = 0x7f5313781000
[pid 25473] 10:12:35.500496 <... mmap resumed> ) = 0x7f7c147dc000
[pid 25472] 10:12:35.500513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.500533 <... write resumed> ) = 11
[pid 25433] 10:12:35.500555 clone( <unfinished ...>
[pid 25425] 10:12:35.500886 <... select resumed> ) = 1 (in [11], left {59, 315468})
[pid 25474] 10:12:35.500922 mprotect(0x7f531378d000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.500952 mprotect(0x7f7c1494b000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.500979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.501010 write(12, "X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0", 87 <unfinished ...>
[pid 25425] 10:12:35.501038 read(11,  <unfinished ...>
[pid 25474] 10:12:35.501075 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.501092 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.501108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.501128 <... write resumed> ) = 87
[pid 25433] 10:12:35.501197 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25479
[pid 25425] 10:12:35.501253 <... read resumed> "S000004!\f\0\0X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0", 16384) = 98
[pid 25474] 10:12:35.501302 mmap(0x7f531398d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25473] 10:12:35.501337 mmap(0x7f7c14b4a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25472] 10:12:35.501366 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.501399 write(12, "X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 1900 <unfinished ...>
[pid 25433] 10:12:35.501428 close(12 <unfinished ...>
[pid 25425] 10:12:35.501451 wait4(-1,  <unfinished ...>
[pid 25474] 10:12:35.501608 <... mmap resumed> ) = 0x7f531398d000
[pid 25473] 10:12:35.501637 <... mmap resumed> ) = 0x7f7c14b4a000
[pid 25472] 10:12:35.501664 <... open resumed> ) = 6
[pid 25452] 10:12:35.501681 <... write resumed> ) = 1900
[pid 25433] 10:12:35.501701 <... close resumed> ) = 0
[pid 25425] 10:12:35.501748 <... wait4 resumed> 0x7fffbdaad0c0, WNOHANG, NULL) = 0
[pid 25474] 10:12:35.501799 close(5 <unfinished ...>
[pid 25473] 10:12:35.501834 close(6 <unfinished ...>
[pid 25472] 10:12:35.501859 read(6,  <unfinished ...>
[pid 25452] 10:12:35.501883 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25433] 10:12:35.501909 pipe( <unfinished ...>
[pid 25425] 10:12:35.501935 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25474] 10:12:35.501973 <... close resumed> ) = 0
[pid 25473] 10:12:35.502010 <... close resumed> ) = 0
[pid 25472] 10:12:35.502035 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25452] 10:12:35.502059 <... write resumed> ) = 9
[pid 25433] 10:12:35.502078 <... pipe resumed> [10, 12]) = 0
[pid 25425] 10:12:35.502097 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25474] 10:12:35.502132 mprotect(0x7f531398d000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.502159 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.502190 fstat(6,  <unfinished ...>
[pid 25452] 10:12:35.502213 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25433] 10:12:35.502238 fcntl(10, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25425] 10:12:35.502262 read(11,  <unfinished ...>
[pid 25474] 10:12:35.502294 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.502314 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.502332 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25452] 10:12:35.502368 <... write resumed> ) = 11
[pid 25433] 10:12:35.502388 <... fcntl resumed> ) = 0
[pid 25425] 10:12:35.502413 <... read resumed> "X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 16384) = 1920
[pid 25474] 10:12:35.502812 munmap(0x7f531435c000, 39387 <unfinished ...>
[pid 25473] 10:12:35.502852 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.502888 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25452] 10:12:35.502918 write(12, "R000128\3T:mx1.hilton.iphmx.com:68.232.143.144/NULL\0\0\0\0\0\1\0\0\0H=mx1.hilton.iphmx.com [68.232.143.144]: 250 ok:  Message 17700811 accepted\0", 135 <unfinished ...>
[pid 25433] 10:12:35.502945 clone( <unfinished ...>
[pid 25425] 10:12:35.503179 wait4(-1,  <unfinished ...>
[pid 25474] 10:12:35.503214 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.503239 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.503259 <... mmap resumed> ) = 0x7ff0ff725000
[pid 25452] 10:12:35.503276 <... write resumed> ) = 135
[pid 25425] 10:12:35.503298 <... wait4 resumed> 0x7fffbdaad0c0, WNOHANG, NULL) = 0
[pid 25474] 10:12:35.503326 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.503357 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.503387 mprotect(0x7ff0ff72b000, 2093056, PROT_NONE <unfinished ...>
[pid 25452] 10:12:35.503415 write(12, "A000089\0=\0\0\1\0\0\0\0\0\0\001250 ok:  Message 17700811 accepted\0\0mx1.hilton.iphmx.com\00068.232.143.144\0\31\0\0\0000", 96 <unfinished ...>
[pid 25433] 10:12:35.503441 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25480
[pid 25425] 10:12:35.503479 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25474] 10:12:35.503523 <... open resumed> ) = 5
[pid 25473] 10:12:35.503543 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.503563 <... mprotect resumed> ) = 0
[pid 25452] 10:12:35.503580 <... write resumed> ) = 96
[pid 25433] 10:12:35.503599 close(12 <unfinished ...>
[pid 25425] 10:12:35.503623 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25474] 10:12:35.503652 fcntl(5, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.503676 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.503708 mmap(0x7ff0ff92a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25452] 10:12:35.503741 write(12, "I00002050.116.78.207\00051198\0", 27 <unfinished ...>
[pid 25433] 10:12:35.503768 <... close resumed> ) = 0
[pid 25425] 10:12:35.503805 read(11,  <unfinished ...>
[pid 25474] 10:12:35.503841 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25473] 10:12:35.503863 <... open resumed> ) = 6
[pid 25472] 10:12:35.503885 <... mmap resumed> ) = 0x7ff0ff92a000
[pid 25452] 10:12:35.503906 <... write resumed> ) = 27
[pid 25433] 10:12:35.503926 wait4(-1,  <unfinished ...>
[pid 25425] 10:12:35.503949 <... read resumed> "R000128\3T:mx1.hilton.iphmx.com:68.232.143.144/NULL\0\0\0\0\0\1\0\0\0H=mx1.hilton.iphmx.com [68.232.143.144]: 250 ok:  Message 17700811 accepted\0A000089\0=\0\0\1\0\0\0\0\0\0\001250 ok:  Message 17700811 accepted\0\0mx1.hilton.iphmx.com\00068.232.143.144\0\31\0\0\0000I00002050.116.78.207\0005119"..., 16384) = 258
[pid 25474] 10:12:35.503984 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.504009 read(6,  <unfinished ...>
[pid 25472] 10:12:35.504032 close(6 <unfinished ...>
[pid 25452] 10:12:35.504054 write(12, "Z0000010", 8 <unfinished ...>
[pid 25433] 10:12:35.504079 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25425] 10:12:35.504108 wait4(-1,  <unfinished ...>
[pid 25474] 10:12:35.504143 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25473] 10:12:35.504172 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.504196 <... close resumed> ) = 0
[pid 25452] 10:12:35.504220 <... write resumed> ) = 8
[pid 25433] 10:12:35.504237 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25425] 10:12:35.504266 <... wait4 resumed> 0x7fffbdaad0c0, WNOHANG, NULL) = 0
[pid 25474] 10:12:35.504291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.504320 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.504343 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.504374 close(12 <unfinished ...>
[pid 25425] 10:12:35.504397 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25474] 10:12:35.504432 <... mmap resumed> ) = 0x7f5314365000
[pid 25473] 10:12:35.504450 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25472] 10:12:35.504596 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25452] 10:12:35.504621 <... close resumed> ) = 0
[pid 25425] 10:12:35.504984 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25474] 10:12:35.505018 read(5,  <unfinished ...>
[pid 25473] 10:12:35.505048 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.505076 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25452] 10:12:35.505111 exit_group(0) = ?
[pid 25425] 10:12:35.505682 read(11,  <unfinished ...>
[pid 25474] 10:12:35.505746 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:35.505796 <... mmap resumed> ) = 0x7f7c1454d000
[pid 25472] 10:12:35.505815 <... open resumed> ) = 6
[pid 25452] 10:12:35.505831 +++ exited with 0 +++
[pid 25425] 10:12:35.505843 <... read resumed> "Z0000010", 16384) = 8
[pid 25474] 10:12:35.505932 close(5 <unfinished ...>
[pid 25473] 10:12:35.505966 mprotect(0x7f7c145d8000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.505995 read(6,  <unfinished ...>
[pid 25425] 10:12:35.506019 close(11 <unfinished ...>
[pid 25474] 10:12:35.506052 <... close resumed> ) = 0
[pid 25473] 10:12:35.506069 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.506085 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.506110 <... close resumed> ) = 0
[pid 25474] 10:12:35.506133 munmap(0x7f5314365000, 4096 <unfinished ...>
[pid 25473] 10:12:35.506160 mmap(0x7f7c147d8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25472] 10:12:35.506191 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.506214 wait4(25452,  <unfinished ...>
[pid 25474] 10:12:35.506252 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.506311 <... mmap resumed> ) = 0x7f7c147d8000
[pid 25472] 10:12:35.506337 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25425] 10:12:35.506370 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25452
[pid 25474] 10:12:35.506410 getpgrp( <unfinished ...>
[pid 25473] 10:12:35.506436 mmap(0x7f7c147db000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.506466 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:35.506570 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.506607 <... getpgrp resumed> ) = 29163
[pid 25473] 10:12:35.506625 <... mmap resumed> ) = 0x7f7c147db000
[pid 25472] 10:12:35.506648 <... mmap resumed> ) = 0x7ff10107a000
[pid 25425] 10:12:35.506669 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.506721 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.506773 close(6 <unfinished ...>
[pid 25472] 10:12:35.506812 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.506854 write(8, "2015-12-30 10:12:35 tracy.thompson@hilton.com: remote_smtp transport succeeded\n", 79 <unfinished ...>
[pid 25474] 10:12:35.506918 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.506949 <... close resumed> ) = 0
[pid 25472] 10:12:35.506976 <... mmap resumed> ) = 0x7ff0ff3ef000
[pid 25425] 10:12:35.506993 <... write resumed> ) = 79
[pid 25474] 10:12:35.507033 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25473] 10:12:35.507061 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.507092 mprotect(0x7ff0ff51b000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.507120 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.507152 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25473] 10:12:35.507231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.507254 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.507271 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.507325 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.507351 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.507387 mmap(0x7ff0ff71b000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25425] 10:12:35.507420 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.507453 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.507485 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.507505 <... mmap resumed> ) = 0x7ff0ff71b000
[pid 25425] 10:12:35.507526 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.507569 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.507594 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.507624 mmap(0x7ff0ff724000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:35.507653 close(7 <unfinished ...>
[pid 25474] 10:12:35.507685 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.507713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.507739 <... mmap resumed> ) = 0x7ff0ff724000
[pid 25425] 10:12:35.507778 <... close resumed> ) = 0
[pid 25474] 10:12:35.507818 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25473] 10:12:35.507844 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.507878 close(6 <unfinished ...>
[pid 25425] 10:12:35.507901 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.507951 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25473] 10:12:35.508047 <... open resumed> ) = 6
[pid 25472] 10:12:35.508070 <... close resumed> ) = 0
[pid 25425] 10:12:35.508094 <... open resumed> ) = 7
[pid 25474] 10:12:35.508126 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.508156 read(6,  <unfinished ...>
[pid 25472] 10:12:35.508179 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.508210 fcntl(7, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.508240 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.508259 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.508283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.508301 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.508323 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.508349 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.508372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.508409 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.508440 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.508457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25472] 10:12:35.508621 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.508642 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.508667 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0},  <unfinished ...>
[pid 25473] 10:12:35.508697 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.508729 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.508783 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.508828 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f53139c16a0}, 8) = 0
[pid 25473] 10:12:35.508853 <... mmap resumed> ) = 0x7f7c14347000
[pid 25472] 10:12:35.508870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.508891 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5372633, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
Process 25477 attached
[pid 25474] 10:12:35.508988 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25473] 10:12:35.509256 mprotect(0x7f7c1434d000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.509288 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.509321 write(7, "2015-12-30 10:12:35 [25425] 1aEJMY-0006bs-1f => tracy.thompson@hilton.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3105 H=mx1.hilton.iphmx.com [68.232.143.144]:25 X=TLSv1"..., 394 <unfinished ...>
[pid 25473] 10:12:35.509371 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.509389 <... open resumed> ) = 6
[pid 25425] 10:12:35.509405 <... write resumed> ) = 394
[pid 25474] 10:12:35.509606 <... execve resumed> ) = 0
[pid 25473] 10:12:35.509647 mmap(0x7f7c1454c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25472] 10:12:35.509682 read(6,  <unfinished ...>
[pid 25425] 10:12:35.509706 geteuid( <unfinished ...>
[pid 25477] 10:12:35.509745 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25474] 10:12:35.509790 brk(0 <unfinished ...>
[pid 25473] 10:12:35.509826 <... mmap resumed> ) = 0x7f7c1454c000
[pid 25472] 10:12:35.509858 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.509895 <... geteuid resumed> ) = 0
[pid 25477] 10:12:35.509928 <... set_robust_list resumed> ) = 0
[pid 25474] 10:12:35.509944 <... brk resumed> ) = 0x114d000
[pid 25473] 10:12:35.509962 close(6 <unfinished ...>
[pid 25472] 10:12:35.509986 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.510010 getegid( <unfinished ...>
[pid 25474] 10:12:35.510038 fcntl(0, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.510062 <... close resumed> ) = 0
[pid 25472] 10:12:35.510084 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:35.510117 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.510143 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.510161 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.510192 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.510223 setgid(12 <unfinished ...>
[pid 25474] 10:12:35.510253 fcntl(1, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.510277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.510295 <... mmap resumed> ) = 0x7ff0ff1eb000
[pid 25425] 10:12:35.510311 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.510334 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.510350 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.510383 mprotect(0x7ff0ff1ed000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.510411 setuid(47 <unfinished ...>
[pid 25474] 10:12:35.510442 fcntl(2, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.510465 <... open resumed> ) = 6
[pid 25472] 10:12:35.510486 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.510502 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.510530 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.510552 read(6,  <unfinished ...>
[pid 25472] 10:12:35.510576 mmap(0x7ff0ff3ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25425] 10:12:35.510606 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25474] 10:12:35.510640 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25473] 10:12:35.510671 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.510701 <... mmap resumed> ) = 0x7ff0ff3ed000
[pid 25425] 10:12:35.510729 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25474] 10:12:35.510788 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.510834 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.510879 close(6 <unfinished ...>
[pid 25425] 10:12:35.510916 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25474] 10:12:35.510964 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.510992 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.511023 <... close resumed> ) = 0
[pid 25425] 10:12:35.511047 <... open resumed> ) = 10
[pid 25474] 10:12:35.511070 <... mmap resumed> ) = 0x7f1105401000
[pid 25473] 10:12:35.511093 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.511122 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.511154 alarm(60 <unfinished ...>
[pid 25474] 10:12:35.511187 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25473] 10:12:35.511218 <... mmap resumed> ) = 0x7f7c15c9c000
[pid 25472] 10:12:35.511239 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.511259 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.511282 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.511306 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.511335 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.511368 fcntl(10, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25474] 10:12:35.511405 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.511436 <... mmap resumed> ) = 0x7f7c14011000
[pid 25472] 10:12:35.511452 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.511470 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.511613 <... open resumed> ) = 5
[pid 25473] 10:12:35.511635 mprotect(0x7f7c1413d000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.511663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.511695 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.511725 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.511763 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.511828 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.511865 <... alarm resumed> ) = 60
[pid 25477] 10:12:35.511927 close(13 <unfinished ...>
[pid 25474] 10:12:35.511953 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:35.511984 mmap(0x7f7c1433d000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25472] 10:12:35.512015 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.512048 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.512091 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.512119 <... mmap resumed> ) = 0x7f7c1433d000
[pid 25472] 10:12:35.512140 <... open resumed> ) = 6
[pid 25425] 10:12:35.512157 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.512187 <... mmap resumed> ) = 0x7f11053f7000
[pid 25473] 10:12:35.512204 mmap(0x7f7c14346000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.512233 read(6,  <unfinished ...>
[pid 25425] 10:12:35.512257 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.512301 close(5 <unfinished ...>
[pid 25473] 10:12:35.512325 <... mmap resumed> ) = 0x7f7c14346000
[pid 25472] 10:12:35.512347 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.512374 <... open resumed> ) = 11
[pid 25474] 10:12:35.512399 <... close resumed> ) = 0
[pid 25473] 10:12:35.512425 close(6 <unfinished ...>
[pid 25472] 10:12:35.512449 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.512473 read(11,  <unfinished ...>
[pid 25477] 10:12:35.512603 <... close resumed> ) = 0
[pid 25474] 10:12:35.512619 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.512651 <... close resumed> ) = 0
[pid 25472] 10:12:35.512674 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:35.512707 <... read resumed> "cpu  123062 1342402 395148 67343095 2509 0 0 0\ncpu0 123062 1342402 395148 67343095 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58358669\nbtime 1450798266\nprocesses 892958\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25474] 10:12:35.512740 <... open resumed> ) = 5
[pid 25473] 10:12:35.512813 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.512859 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.512893 close(11 <unfinished ...>
[pid 25477] 10:12:35.512933 geteuid( <unfinished ...>
[pid 25474] 10:12:35.512954 read(5,  <unfinished ...>
[pid 25473] 10:12:35.512982 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.513001 <... mmap resumed> ) = 0x7ff0fefe8000
[pid 25425] 10:12:35.513019 <... close resumed> ) = 0
[pid 25474] 10:12:35.513060 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.513090 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.513123 mprotect(0x7ff0fefea000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.513153 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25474] 10:12:35.513190 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.513213 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.513230 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.513246 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25474] 10:12:35.513299 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.513332 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.513363 mmap(0x7ff0ff1e9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25425] 10:12:35.513394 open("/var/spool/exim/db/retry", O_RDWR <unfinished ...>
[pid 25474] 10:12:35.513433 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.513460 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.513479 <... mmap resumed> ) = 0x7ff0ff1e9000
[pid 25425] 10:12:35.513509 <... open resumed> ) = 11
[pid 25474] 10:12:35.513534 <... mmap resumed> ) = 0x7f1104e4f000
[pid 25473] 10:12:35.513551 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.513582 close(6 <unfinished ...>
[pid 25425] 10:12:35.513605 fcntl(11, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.513638 mprotect(0x7f1104fd9000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.513671 <... open resumed> ) = 6
[pid 25472] 10:12:35.513687 <... close resumed> ) = 0
[pid 25425] 10:12:35.513711 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.513735 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.513760 read(6,  <unfinished ...>
[pid 25472] 10:12:35.513784 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.513814 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.513844 mmap(0x7f11051d9000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25473] 10:12:35.513874 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.513898 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.513916 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.513940 <... mmap resumed> ) = 0x7f11051d9000
[pid 25473] 10:12:35.513961 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.513989 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.514021 read(11,  <unfinished ...>
[pid 25474] 10:12:35.514051 mmap(0x7f11051de000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.514079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.514111 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.514121 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25474] 10:12:35.514149 <... mmap resumed> ) = 0x7f11051de000
[pid 25473] 10:12:35.514165 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.514182 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.514198 close(11 <unfinished ...>
[pid 25474] 10:12:35.514216 close(5 <unfinished ...>
[pid 25473] 10:12:35.514224 <... mmap resumed> ) = 0x7f7c13e0d000
[pid 25472] 10:12:35.514232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.514243 <... close resumed> ) = 0
[pid 25474] 10:12:35.514262 <... close resumed> ) = 0
[pid 25473] 10:12:35.514283 mprotect(0x7f7c13e0f000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.514297 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.514312 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.514330 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.514342 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.514351 <... open resumed> ) = 6
[pid 25425] 10:12:35.514359 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.514375 <... mmap resumed> ) = 0x7f11053f6000
[pid 25473] 10:12:35.514388 mmap(0x7f7c1400f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25472] 10:12:35.514401 read(6,  <unfinished ...>
[pid 25425] 10:12:35.514411 stat("/var/tmp",  <unfinished ...>
[pid 25474] 10:12:35.514432 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.514443 <... mmap resumed> ) = 0x7f7c1400f000
[pid 25472] 10:12:35.514458 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.514472 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25474] 10:12:35.514611 <... mmap resumed> ) = 0x7f11053f5000
[pid 25473] 10:12:35.514626 close(6 <unfinished ...>
[pid 25472] 10:12:35.514636 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.514645 open("/var/spool/exim/db/retry", O_RDWR|O_CREAT, 0 <unfinished ...>
[pid 25474] 10:12:35.514692 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.514708 <... close resumed> ) = 0
[pid 25472] 10:12:35.514723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25425] 10:12:35.514763 <... open resumed> ) = 11
[pid 25474] 10:12:35.514780 <... mmap resumed> ) = 0x7f11053f4000
[pid 25473] 10:12:35.514792 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.514808 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:35.514819 fcntl(11, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.514834 arch_prctl(ARCH_SET_FS, 0x7f11053f5700 <unfinished ...>
[pid 25473] 10:12:35.514844 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.514853 <... mmap resumed> ) = 0x7ff101079000
[pid 25425] 10:12:35.514864 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.514879 <... arch_prctl resumed> ) = 0
[pid 25473] 10:12:35.515132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.515172 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.515202 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.515232 mprotect(0x7f11051d9000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.515258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.515276 <... mmap resumed> ) = 0x7ff0fec54000
[pid 25425] 10:12:35.515293 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.515316 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.515340 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.515371 mprotect(0x7ff0fedde000, 2097152, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.515399 fstat(11,  <unfinished ...>
[pid 25474] 10:12:35.515428 mprotect(0x7f1105402000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.515453 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.515471 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.515488 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-09:56:30, st_ctime=2015/12/30-09:56:30}) = 0
[pid 25474] 10:12:35.515540 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.515550 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.515567 mmap(0x7ff0fefde000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25425] 10:12:35.515583 pread(11,  <unfinished ...>
[pid 25474] 10:12:35.515600 munmap(0x7f11053f7000, 39387 <unfinished ...>
[pid 25473] 10:12:35.515613 <... open resumed> ) = 6
[pid 25472] 10:12:35.515621 <... mmap resumed> ) = 0x7ff0fefde000
[pid 25425] 10:12:35.515634 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25474] 10:12:35.515695 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.515735 read(6,  <unfinished ...>
[pid 25472] 10:12:35.515902 mmap(0x7ff0fefe3000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:35.515953 pread(11,  <unfinished ...>
[pid 25477] 10:12:35.515990 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.516004 getuid( <unfinished ...>
[pid 25473] 10:12:35.516027 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.516051 <... mmap resumed> ) = 0x7ff0fefe3000
[pid 25425] 10:12:35.516074 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\10\0\n\r\0\r\306\17\22\17\346\16 \16\375\r\212\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25474] 10:12:35.516148 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.516171 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.516196 close(6 <unfinished ...>
[pid 25425] 10:12:35.516219 pwrite(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0 <unfinished ...>
[pid 25474] 10:12:35.516263 getgid( <unfinished ...>
[pid 25473] 10:12:35.516285 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.516317 <... close resumed> ) = 0
[pid 25425] 10:12:35.516342 <... pwrite resumed> ) = 4096
[pid 25474] 10:12:35.516367 <... getgid resumed> ) = 500
[pid 25473] 10:12:35.516385 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.516415 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.516446 pwrite(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192 <unfinished ...>
[pid 25474] 10:12:35.516485 getegid( <unfinished ...>
[pid 25473] 10:12:35.516521 <... mmap resumed> ) = 0x7f7c13c0a000
[pid 25472] 10:12:35.516540 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.516558 <... pwrite resumed> ) = 4096
[pid 25474] 10:12:35.516585 <... getegid resumed> ) = 499
[pid 25473] 10:12:35.516603 mprotect(0x7f7c13c0c000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.516630 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.516664 fdatasync(11 <unfinished ...>
[pid 25474] 10:12:35.516737 getppid( <unfinished ...>
[pid 25473] 10:12:35.516897 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.516922 <... open resumed> ) = -1 ENOENT (No such file or directory)
Process 25479 attached
Process 25478 attached
[pid 25477] 10:12:35.516976 getegid( <unfinished ...>
[pid 25474] 10:12:35.516998 <... getppid resumed> ) = 25389
[pid 25473] 10:12:35.517017 mmap(0x7f7c13e0b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25472] 10:12:35.517047 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.517079 <... fdatasync resumed> ) = 0
[pid 25474] 10:12:35.517105 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25473] 10:12:35.517137 <... mmap resumed> ) = 0x7f7c13e0b000
[pid 25472] 10:12:35.517162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.517183 close(11 <unfinished ...>
[pid 25474] 10:12:35.517215 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25473] 10:12:35.517290 close(6 <unfinished ...>
[pid 25472] 10:12:35.517318 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.517351 <... close resumed> ) = 0
[pid 25474] 10:12:35.517385 brk(0 <unfinished ...>
[pid 25473] 10:12:35.517411 <... close resumed> ) = 0
[pid 25472] 10:12:35.517433 <... open resumed> ) = 6
[pid 25425] 10:12:35.517450 open("/var/spool/exim/db/retry", O_RDWR <unfinished ...>
[pid 25474] 10:12:35.517488 <... brk resumed> ) = 0x114d000
[pid 25473] 10:12:35.517508 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.517540 read(6,  <unfinished ...>
[pid 25425] 10:12:35.517563 <... open resumed> ) = 11
[pid 25474] 10:12:35.517591 brk(0x116e000 <unfinished ...>
[pid 25473] 10:12:35.517655 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.517673 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.517722 fcntl(11, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.517824 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25478] 10:12:35.517849 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25477] 10:12:35.517872 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.517905 <... brk resumed> ) = 0x116e000
[pid 25473] 10:12:35.517944 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.517979 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.518002 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.518029 <... set_robust_list resumed> ) = 0
[pid 25478] 10:12:35.518050 <... set_robust_list resumed> ) = 0
[pid 25477] 10:12:35.518092 setgid(500 <unfinished ...>
[pid 25474] 10:12:35.518192 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.518224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.518241 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25425] 10:12:35.518273 fcntl(11, F_SETFD, FD_CLOEXECProcess 25480 attached
 <unfinished ...>
[pid 25479] 10:12:35.518332 fcntl(12, F_GETFD <unfinished ...>
[pid 25478] 10:12:35.518356 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25477] 10:12:35.518382 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.518395 <... socket resumed> ) = 5
[pid 25473] 10:12:35.518413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.518444 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.518473 <... fcntl resumed> ) = 0
[pid 25480] 10:12:35.518504 set_robust_list(0x7fea0f26eaa0, 24 <unfinished ...>
[pid 25479] 10:12:35.518528 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.518542 <... setrlimit resumed> ) = 0
[pid 25477] 10:12:35.518557 setuid(503 <unfinished ...>
[pid 25474] 10:12:35.519035 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.519078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.519099 <... mmap resumed> ) = 0x7ff0fe9e8000
[pid 25425] 10:12:35.519117 fdatasync(11 <unfinished ...>
[pid 25480] 10:12:35.519154 <... set_robust_list resumed> ) = 0
[pid 25479] 10:12:35.519168 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.519222 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25477] 10:12:35.519253 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.519267 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.519310 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.519342 mprotect(0x7ff0fea4a000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.519374 <... fdatasync resumed> ) = 0
[pid 25480] 10:12:35.519404 fcntl(12, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.519429 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.519442 <... open resumed> ) = 10
[pid 25477] 10:12:35.519460 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.519505 close(5 <unfinished ...>
[pid 25473] 10:12:35.519534 <... open resumed> ) = 6
[pid 25472] 10:12:35.519550 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.519566 close(11 <unfinished ...>
[pid 25480] 10:12:35.519606 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.519620 close(6 <unfinished ...>
[pid 25478] 10:12:35.519644 fstat(10,  <unfinished ...>
[pid 25477] 10:12:35.519666 <... open resumed> ) = 9
[pid 25474] 10:12:35.519679 <... close resumed> ) = 0
[pid 25473] 10:12:35.519703 read(6,  <unfinished ...>
[pid 25472] 10:12:35.519727 mmap(0x7ff0fec49000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25425] 10:12:35.519828 <... close resumed> ) = 0
[pid 25480] 10:12:35.519872 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.519898 <... close resumed> ) = 0
[pid 25478] 10:12:35.519912 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25477] 10:12:35.519963 fstat(9,  <unfinished ...>
[pid 25474] 10:12:35.520004 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.520032 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.520056 <... mmap resumed> ) = 0x7ff0fec49000
[pid 25425] 10:12:35.520081 close(10 <unfinished ...>
[pid 25480] 10:12:35.520122 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.520136 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25478] 10:12:35.520175 fstat(10,  <unfinished ...>
[pid 25477] 10:12:35.520198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25474] 10:12:35.520224 <... socket resumed> ) = 5
[pid 25473] 10:12:35.520307 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.520334 close(6 <unfinished ...>
[pid 25425] 10:12:35.520356 <... close resumed> ) = 0
[pid 25480] 10:12:35.520390 close(11 <unfinished ...>
[pid 25479] 10:12:35.520414 <... open resumed> ) = 6
[pid 25478] 10:12:35.520427 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25477] 10:12:35.520460 brk(0x1667000 <unfinished ...>
[pid 25474] 10:12:35.520488 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.520530 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.520560 <... close resumed> ) = 0
[pid 25425] 10:12:35.520586 stat("/etc/localtime",  <unfinished ...>
[pid 25480] 10:12:35.520626 <... close resumed> ) = 0
[pid 25479] 10:12:35.520639 fcntl(6, F_GETFD <unfinished ...>
[pid 25478] 10:12:35.520663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25477] 10:12:35.520689 <... brk resumed> ) = 0x1667000
[pid 25474] 10:12:35.520703 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.520866 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.520901 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.520933 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25480] 10:12:35.520981 close(6 <unfinished ...>
[pid 25479] 10:12:35.521009 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.521022 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25477] 10:12:35.521038 fstat(9,  <unfinished ...>
[pid 25474] 10:12:35.521063 close(5 <unfinished ...>
[pid 25473] 10:12:35.521089 <... mmap resumed> ) = 0x7f7c15c9b000
[pid 25472] 10:12:35.521109 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.521127 pipe( <unfinished ...>
[pid 25480] 10:12:35.521167 <... close resumed> ) = 0
[pid 25479] 10:12:35.521181 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.521227 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25477] 10:12:35.521251 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25474] 10:12:35.521276 <... close resumed> ) = 0
[pid 25473] 10:12:35.521305 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.521366 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.521402 <... pipe resumed> [10, 11]) = 0
[pid 25480] 10:12:35.521432 open("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25479] 10:12:35.521464 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.521479 <... lseek resumed> ) = 0
[pid 25477] 10:12:35.521535 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.521578 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.521609 <... mmap resumed> ) = 0x7f7c13876000
[pid 25472] 10:12:35.521626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.521643 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25480] 10:12:35.521684 <... open resumed> ) = 6
[pid 25479] 10:12:35.521697 geteuid( <unfinished ...>
[pid 25478] 10:12:35.521727 read(10,  <unfinished ...>
[pid 25477] 10:12:35.521832 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25474] 10:12:35.521851 <... open resumed> ) = 5
[pid 25473] 10:12:35.521876 mprotect(0x7f7c13a00000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.521905 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.521936 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25480] 10:12:35.521987 fcntl(6, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.522014 <... geteuid resumed> ) = 0
[pid 25478] 10:12:35.522034 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25477] 10:12:35.522055 read(9,  <unfinished ...>
[pid 25474] 10:12:35.522137 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.522184 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.522201 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:35.522220 clone( <unfinished ...>
[pid 25480] 10:12:35.522646 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.522663 getegid( <unfinished ...>
[pid 25478] 10:12:35.522687 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25477] 10:12:35.522719 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25474] 10:12:35.522737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25473] 10:12:35.522776 mmap(0x7f7c13c00000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25472] 10:12:35.522808 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.522854 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.522878 <... getegid resumed> ) = 12
[pid 25478] 10:12:35.522891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25477] 10:12:35.522922 read(9,  <unfinished ...>
[pid 25474] 10:12:35.523002 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.523032 <... mmap resumed> ) = 0x7f7c13c00000
[pid 25472] 10:12:35.523053 <... open resumed> ) = 6
[pid 25425] 10:12:35.523069 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f380d40ea90) = 25481
[pid 25480] 10:12:35.523118 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.523134 setgid(12 <unfinished ...>
[pid 25478] 10:12:35.523214 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25477] 10:12:35.523245 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25474] 10:12:35.523264 <... mmap resumed> ) = 0x7f1105400000
[pid 25473] 10:12:35.523285 mmap(0x7f7c13c05000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.523314 read(6,  <unfinished ...>
[pid 25425] 10:12:35.523340 close(10 <unfinished ...>
[pid 25480] 10:12:35.523377 geteuid( <unfinished ...>
[pid 25479] 10:12:35.523398 <... setgid resumed> ) = 0
[pid 25478] 10:12:35.523411 <... open resumed> ) = 13
[pid 25477] 10:12:35.523426 close(9 <unfinished ...>
[pid 25474] 10:12:35.523453 read(5,  <unfinished ...>
[pid 25473] 10:12:35.523484 <... mmap resumed> ) = 0x7f7c13c05000
[pid 25472] 10:12:35.523509 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25425] 10:12:35.523544 <... close resumed> ) = 0
[pid 25480] 10:12:35.523575 <... geteuid resumed> ) = 0
[pid 25479] 10:12:35.523589 setuid(47 <unfinished ...>
[pid 25478] 10:12:35.523614 fstat(13,  <unfinished ...>
[pid 25477] 10:12:35.523636 <... close resumed> ) = 0
[pid 25474] 10:12:35.523649 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25473] 10:12:35.523688 close(6 <unfinished ...>
[pid 25472] 10:12:35.523712 fstat(6,  <unfinished ...>
[pid 25425] 10:12:35.523734 fcntl(11, F_GETFL <unfinished ...>
[pid 25480] 10:12:35.523927 getegid( <unfinished ...>
[pid 25479] 10:12:35.523952 <... setuid resumed> ) = 0
[pid 25478] 10:12:35.523983 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25477] 10:12:35.524016 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25474] 10:12:35.524049 read(5,  <unfinished ...>
[pid 25473] 10:12:35.524073 <... close resumed> ) = 0
[pid 25472] 10:12:35.524097 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25425] 10:12:35.524128 <... fcntl resumed> ) = 0x1 (flags O_WRONLY)
[pid 25480] 10:12:35.524169 <... getegid resumed> ) = 12
[pid 25479] 10:12:35.524185 close(11 <unfinished ...>
[pid 25478] 10:12:35.524211 fstat(13,  <unfinished ...>
[pid 25477] 10:12:35.524234 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.524247 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:35.524686 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.524728 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25425] 10:12:35.524825 fstat(11,  <unfinished ...>
[pid 25480] 10:12:35.524867 setgid(12 <unfinished ...>
[pid 25479] 10:12:35.524891 <... close resumed> ) = 0
[pid 25478] 10:12:35.524904 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25477] 10:12:35.525171 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.525204 close(5 <unfinished ...>
[pid 25473] 10:12:35.525231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.525249 <... mmap resumed> ) = 0x7ff0fe605000
[pid 25425] 10:12:35.525266 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167601, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25480] 10:12:35.525309 <... setgid resumed> ) = 0
[pid 25479] 10:12:35.525323 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25478] 10:12:35.525354 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25477] 10:12:35.525381 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.525395 <... close resumed> ) = 0
[pid 25473] 10:12:35.525413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.525445 mprotect(0x7ff0fe7be000, 2093056, PROT_NONE <unfinished ...>
[pid 25425] 10:12:35.525480 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.525521 setuid(47 <unfinished ...>
[pid 25479] 10:12:35.525544 <... socket resumed> ) = 10
[pid 25478] 10:12:35.525558 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25477] 10:12:35.525573 read(6,  <unfinished ...>
[pid 25474] 10:12:35.525599 munmap(0x7f1105400000, 4096 <unfinished ...>
[pid 25473] 10:12:35.525627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.525645 <... mprotect resumed> ) = 0
[pid 25425] 10:12:35.525661 <... mmap resumed> ) = 0x7f380d424000
[pid 25480] 10:12:35.525689 <... setuid resumed> ) = 0
[pid 25479] 10:12:35.525705 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25478] 10:12:35.525739 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25477] 10:12:35.525834 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2446) = 1858
[pid 25474] 10:12:35.525854 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.526354 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.526395 mmap(0x7ff0fe9bd000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25425] 10:12:35.526439 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25480] 10:12:35.526480 close(10 <unfinished ...>
[pid 25479] 10:12:35.526515 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25478] 10:12:35.526530 <... lseek resumed> ) = 0
[pid 25477] 10:12:35.526546 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.526581 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.526611 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.526630 <... mmap resumed> ) = 0x7ff0fe9bd000
[pid 25425] 10:12:35.526652 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25480] 10:12:35.526823 <... close resumed> ) = 0
[pid 25479] 10:12:35.526846 close(10 <unfinished ...>
[pid 25478] 10:12:35.527056 read(13,  <unfinished ...>
[pid 25477] 10:12:35.527085 <... write resumed> ) = 4
[pid 25474] 10:12:35.527099 <... open resumed> ) = 5
[pid 25473] 10:12:35.527117 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.527149 mmap(0x7ff0fe9e4000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.527180 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25425] 10:12:35.527200 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.527237 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25479] 10:12:35.527263 <... close resumed> ) = 0
[pid 25478] 10:12:35.527277 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25477] 10:12:35.527300 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.527361 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.527385 <... open resumed> ) = 6
[pid 25472] 10:12:35.527401 <... mmap resumed> ) = 0x7ff0fe9e4000
[pid 25458] 10:12:35.527422 read(13,  <unfinished ...>
[pid 25425] 10:12:35.527447 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124785512, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25480] 10:12:35.527493 <... socket resumed> ) = 10
[pid 25479] 10:12:35.527510 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25478] 10:12:35.527543 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25477] 10:12:35.527575 <... write resumed> ) = 4
[pid 25474] 10:12:35.527588 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:35.527618 read(6,  <unfinished ...>
[pid 25472] 10:12:35.527642 close(6 <unfinished ...>
[pid 25458] 10:12:35.527665 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25425] 10:12:35.527682 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1050 <unfinished ...>
[pid 25480] 10:12:35.527724 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25479] 10:12:35.527839 <... socket resumed> ) = 10
[pid 25478] 10:12:35.527866 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25477] 10:12:35.527888 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.527927 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.527954 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.527978 <... close resumed> ) = 0
[pid 25458] 10:12:35.528030 read(13,  <unfinished ...>
[pid 25425] 10:12:35.528056 <... write resumed> ) = 1050
[pid 25480] 10:12:35.528102 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25479] 10:12:35.528120 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25478] 10:12:35.528154 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25477] 10:12:35.528181 <... write resumed> ) = 4
[pid 25474] 10:12:35.528194 <... mmap resumed> ) = 0x7f11053f7000
[pid 25473] 10:12:35.528212 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.528235 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.528265 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:35.528284 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25480] 10:12:35.528323 close(10 <unfinished ...>
[pid 25479] 10:12:35.528348 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25478] 10:12:35.528363 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25477] 10:12:35.528381 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25474] 10:12:35.528407 close(5 <unfinished ...>
[pid 25473] 10:12:35.528429 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25472] 10:12:35.528459 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.528477 read(13,  <unfinished ...>
[pid 25425] 10:12:35.528505 <... lseek resumed> ) = 19
[pid 25480] 10:12:35.528535 <... close resumed> ) = 0
[pid 25479] 10:12:35.528549 close(10 <unfinished ...>
[pid 25478] 10:12:35.528578 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0},  <unfinished ...>
[pid 25477] 10:12:35.528605 <... write resumed> ) = 40
[pid 25474] 10:12:35.528625 <... close resumed> ) = 0
[pid 25473] 10:12:35.528654 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.528684 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.528718 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25425] 10:12:35.528737 read(6,  <unfinished ...>
[pid 25480] 10:12:35.528892 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25479] 10:12:35.528927 <... close resumed> ) = 0
[pid 25478] 10:12:35.528945 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fdec496f790}, 8) = 0
[pid 25477] 10:12:35.529009 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.529041 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.529074 <... mmap resumed> ) = 0x7f7c1360a000
[pid 25472] 10:12:35.529091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.529108 read(13,  <unfinished ...>
[pid 25425] 10:12:35.529131 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25480] 10:12:35.529173 <... socket resumed> ) = 10
[pid 25479] 10:12:35.529188 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.529218 close(11 <unfinished ...>
[pid 25477] 10:12:35.529240 <... write resumed> ) = 4
[pid 25474] 10:12:35.529254 <... open resumed> ) = 5
[pid 25473] 10:12:35.529271 mprotect(0x7f7c1366c000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.529298 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.529329 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25425] 10:12:35.529348 read(6,  <unfinished ...>
[pid 25480] 10:12:35.529384 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25479] 10:12:35.529416 <... open resumed> ) = 10
[pid 25478] 10:12:35.529430 <... close resumed> ) = 0
[pid 25477] 10:12:35.529452 close(14 <unfinished ...>
[pid 25474] 10:12:35.529477 read(5,  <unfinished ...>
[pid 25473] 10:12:35.529503 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.529520 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.529539 wait4(-1,  <unfinished ...>
[pid 25425] 10:12:35.529561 <... read resumed> "", 8192) = 0
[pid 25480] 10:12:35.529590 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25479] 10:12:35.529605 fstat(10,  <unfinished ...>
[pid 25478] 10:12:35.529629 fcntl(12, F_GETFD <unfinished ...>
[pid 25477] 10:12:35.529651 <... close resumed> ) = 0
[pid 25474] 10:12:35.529664 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.529699 mmap(0x7f7c1386b000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25472] 10:12:35.529734 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25425] 10:12:35.529854 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006bs-1f; Wed, 30 Dec 2015 10:12:34 -0600\nTo:  tracy.thompson"..., 2424 <unfinished ...>
[pid 25480] 10:12:35.529912 close(10 <unfinished ...>
[pid 25479] 10:12:35.529939 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25478] 10:12:35.529973 <... fcntl resumed> ) = 0
[pid 25477] 10:12:35.529990 exit_group(0) = ?
[pid 25474] 10:12:35.530285 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.530315 <... mmap resumed> ) = 0x7f7c1386b000
[pid 25472] 10:12:35.530340 <... open resumed> ) = 6
[pid 25425] 10:12:35.530358 <... write resumed> ) = 2424
[pid 25480] 10:12:35.530403 <... close resumed> ) = 0
[pid 25479] 10:12:35.530418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25478] 10:12:35.530486 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25477] 10:12:35.530516 +++ exited with 0 +++
[pid 25474] 10:12:35.530529 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.530566 close(6 <unfinished ...>
[pid 25472] 10:12:35.530590 read(6,  <unfinished ...>
[pid 25458] 10:12:35.530613 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25477
[pid 25425] 10:12:35.530632 write(11, "\n--1451491955-eximdsn-823055473--\n", 34 <unfinished ...>
[pid 25480] 10:12:35.530669 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.530697 <... mmap resumed> ) = 0x7fea0f284000
[pid 25478] 10:12:35.530711 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.530727 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25473] 10:12:35.530849 <... close resumed> ) = 0
[pid 25472] 10:12:35.530881 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.530938 close(13 <unfinished ...>
[pid 25425] 10:12:35.530967 <... write resumed> ) = 34
[pid 25480] 10:12:35.530996 <... open resumed> ) = 10
[pid 25479] 10:12:35.531010 read(10,  <unfinished ...>
[pid 25478] 10:12:35.531047 geteuid( <unfinished ...>
[pid 25474] 10:12:35.531069 <... mmap resumed> ) = 0x7f1104c41000
[pid 25473] 10:12:35.531086 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.531137 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.531161 <... close resumed> ) = 0
[pid 25425] 10:12:35.531177 close(11 <unfinished ...>
[pid 25480] 10:12:35.531211 fstat(10,  <unfinished ...>
[pid 25479] 10:12:35.531234 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25478] 10:12:35.531252 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.531295 mprotect(0x7f1104c4d000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.531326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.531344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25458] 10:12:35.531381 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25425] 10:12:35.531409 <... close resumed> ) = 0
[pid 25480] 10:12:35.531437 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25479] 10:12:35.531464 close(10 <unfinished ...>
[pid 25478] 10:12:35.531491 getegid( <unfinished ...>
[pid 25474] 10:12:35.531516 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.531532 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.531564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.531591 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25425] 10:12:35.531633 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25480] 10:12:35.531676 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.531703 <... close resumed> ) = 0
[pid 25478] 10:12:35.531718 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.531734 mmap(0x7f1104e4d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25473] 10:12:35.531858 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.531879 <... mmap resumed> ) = 0x7ff101078000
[pid 25458] 10:12:35.531916 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:35.531950 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.531987 <... mmap resumed> ) = 0x7fea0f284000
[pid 25479] 10:12:35.532011 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25478] 10:12:35.532039 setgid(500 <unfinished ...>
[pid 25474] 10:12:35.532062 <... mmap resumed> ) = 0x7f1104e4d000
[pid 25473] 10:12:35.532086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.532122 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.532152 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:35.532194 wait4(25481,  <unfinished ...>
[pid 25480] 10:12:35.532230 read(10,  <unfinished ...>
[pid 25479] 10:12:35.532258 <... munmap resumed> ) = 0
[pid 25478] 10:12:35.532272 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.532328 close(5 <unfinished ...>
[pid 25473] 10:12:35.532357 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.532376 <... mmap resumed> ) = 0x7ff0fe3d8000
[pid 25458] 10:12:35.532393 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.532433 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25479] 10:12:35.532451 stat("/etc/mailips",  <unfinished ...>
[pid 25478] 10:12:35.532508 setuid(503 <unfinished ...>
[pid 25474] 10:12:35.532532 <... close resumed> ) = 0
[pid 25473] 10:12:35.532563 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.532598 mprotect(0x7ff0fe404000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.532625 <... open resumed> ) = 9
[pid 25480] 10:12:35.532653 close(10 <unfinished ...>
[pid 25479] 10:12:35.532679 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25478] 10:12:35.532712 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.532827 mprotect(0x7f1104e4d000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.532876 <... open resumed> ) = 6
[pid 25472] 10:12:35.532897 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.532916 fstat(9,  <unfinished ...>
[pid 25480] 10:12:35.532960 <... close resumed> ) = 0
[pid 25479] 10:12:35.532973 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25478] 10:12:35.533003 chdir("/" <unfinished ...>
[pid 25474] 10:12:35.533027 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.533047 read(6,  <unfinished ...>
[pid 25472] 10:12:35.533071 mmap(0x7ff0fe604000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25458] 10:12:35.533100 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.533144 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25479] 10:12:35.533171 <... open resumed> ) = 10
[pid 25478] 10:12:35.533185 <... chdir resumed> ) = 0
[pid 25474] 10:12:35.533203 munmap(0x7f11053f7000, 39387 <unfinished ...>
[pid 25473] 10:12:35.533246 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.533270 <... mmap resumed> ) = 0x7ff0fe604000
[pid 25458] 10:12:35.533290 fstat(9,  <unfinished ...>
[pid 25480] 10:12:35.533325 <... munmap resumed> ) = 0
[pid 25479] 10:12:35.533338 fstat(10,  <unfinished ...>
[pid 25478] 10:12:35.533403 geteuid( <unfinished ...>
[pid 25474] 10:12:35.533426 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.533448 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.533472 close(6 <unfinished ...>
[pid 25458] 10:12:35.533498 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.533537 stat("/etc/mailips",  <unfinished ...>
[pid 25479] 10:12:35.533563 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25478] 10:12:35.533588 <... geteuid resumed> ) = 503
[pid 25474] 10:12:35.533615 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.533648 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25472] 10:12:35.533677 <... close resumed> ) = 0
[pid 25458] 10:12:35.533701 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.533820 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.533859 fstat(10,  <unfinished ...>
[pid 25478] 10:12:35.533921 getegid( <unfinished ...>
[pid 25474] 10:12:35.533944 <... open resumed> ) = 5
[pid 25473] 10:12:35.533964 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.534000 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.534035 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25480] 10:12:35.534085 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.534116 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25478] 10:12:35.534142 <... getegid resumed> ) = 500
[pid 25474] 10:12:35.534157 fcntl(5, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.534206 <... mmap resumed> ) = 0x7f7c13227000
[pid 25472] 10:12:35.534223 <... open resumed> ) = 6
[pid 25458] 10:12:35.534239 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25480] 10:12:35.534273 <... open resumed> ) = 10
[pid 25479] 10:12:35.534286 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25478] 10:12:35.534317 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25474] 10:12:35.534348 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25473] 10:12:35.534387 mprotect(0x7f7c133e0000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.534419 read(6,  <unfinished ...>
[pid 25458] 10:12:35.534443 <... lseek resumed> ) = 0
[pid 25480] 10:12:35.534471 fstat(10,  <unfinished ...>
[pid 25479] 10:12:35.534495 <... mmap resumed> ) = 0x7fea0f284000
[pid 25478] 10:12:35.534511 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25474] 10:12:35.534541 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.534566 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.534582 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.534605 read(9,  <unfinished ...>
[pid 25480] 10:12:35.534643 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.534668 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25478] 10:12:35.534704 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25474] 10:12:35.534733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:35.534861 mmap(0x7f7c135df000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25472] 10:12:35.534899 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.534927 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25480] 10:12:35.534979 fstat(10,  <unfinished ...>
[pid 25479] 10:12:35.535007 <... lseek resumed> ) = 0
[pid 25478] 10:12:35.535020 <... chdir resumed> ) = 0
[pid 25474] 10:12:35.535036 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.535071 <... mmap resumed> ) = 0x7f7c135df000
[pid 25472] 10:12:35.535092 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25458] 10:12:35.535124 stat("/etc/userdomains",  <unfinished ...>
[pid 25480] 10:12:35.535185 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.535212 read(10,  <unfinished ...>
[pid 25478] 10:12:35.535236 stat("tmp",  <unfinished ...>
[pid 25474] 10:12:35.535263 <... mmap resumed> ) = 0x7f1105400000
[pid 25473] 10:12:35.535280 mmap(0x7f7c13606000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.535313 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.535346 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.535396 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.535424 <... read resumed> "", 4096) = 0
[pid 25478] 10:12:35.535438 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.535482 read(5,  <unfinished ...>
[pid 25473] 10:12:35.535518 <... mmap resumed> ) = 0x7f7c13606000
[pid 25472] 10:12:35.535541 <... mmap resumed> ) = 0x7ff0fe1d3000
[pid 25458] 10:12:35.535559 stat("/etc/userdomains",  <unfinished ...>
[pid 25480] 10:12:35.535597 <... mmap resumed> ) = 0x7fea0f284000
[pid 25479] 10:12:35.535610 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25478] 10:12:35.535636 stat("new",  <unfinished ...>
[pid 25474] 10:12:35.535662 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:35.535699 close(6 <unfinished ...>
[pid 25472] 10:12:35.535723 mprotect(0x7ff0fe1d8000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.535842 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.535931 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.535961 <... lseek resumed> ) = 0
[pid 25478] 10:12:35.535975 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.536003 close(5 <unfinished ...>
[pid 25473] 10:12:35.536030 <... close resumed> ) = 0
[pid 25472] 10:12:35.536055 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.536072 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25480] 10:12:35.536138 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.536153 read(10,  <unfinished ...>
[pid 25478] 10:12:35.536178 stat("cur",  <unfinished ...>
[pid 25474] 10:12:35.536203 <... close resumed> ) = 0
[pid 25473] 10:12:35.536226 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.536258 mmap(0x7ff0fe3d7000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25458] 10:12:35.536288 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.536329 read(10,  <unfinished ...>
[pid 25479] 10:12:35.536363 <... read resumed> "", 4096) = 0
[pid 25478] 10:12:35.536378 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25474] 10:12:35.536590 munmap(0x7f1105400000, 4096 <unfinished ...>
[pid 25473] 10:12:35.536694 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.536714 <... mmap resumed> ) = 0x7ff0fe3d7000
[pid 25458] 10:12:35.536735 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25480] 10:12:35.536848 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.536863 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.536911 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.536944 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.536968 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.537027 close(6 <unfinished ...>
[pid 25458] 10:12:35.537052 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25480] 10:12:35.537103 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.537134 <... open resumed> ) = 11
[pid 25478] 10:12:35.537148 <... open resumed> ) = 11
[pid 25474] 10:12:35.537165 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.537199 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.537217 <... close resumed> ) = 0
[pid 25458] 10:12:35.537244 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.537285 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.537299 fstat(11,  <unfinished ...>
[pid 25478] 10:12:35.537328 read(11,  <unfinished ...>
[pid 25474] 10:12:35.537352 <... socket resumed> ) = 5
[pid 25473] 10:12:35.537370 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.537399 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.537428 <... open resumed> ) = 10
[pid 25480] 10:12:35.537455 read(10,  <unfinished ...>
[pid 25479] 10:12:35.537477 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25478] 10:12:35.537509 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4109
[pid 25474] 10:12:35.537528 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.537640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.537660 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.537678 fstat(10,  <unfinished ...>
[pid 25480] 10:12:35.537711 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.537725 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25478] 10:12:35.537949 stat("tmp/1451491955.H537609P25478.fin.finestweddingsites.com",  <unfinished ...>
[pid 25474] 10:12:35.537986 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.538005 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.538037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.538069 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25480] 10:12:35.538138 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.538168 <... mmap resumed> ) = 0x7fea0f283000
[pid 25478] 10:12:35.538186 <... stat resumed> 0x7ffd9471c770) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.538206 close(5 <unfinished ...>
[pid 25473] 10:12:35.538232 <... open resumed> ) = 6
[pid 25472] 10:12:35.538248 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.538267 fstat(10,  <unfinished ...>
[pid 25480] 10:12:35.538301 <... open resumed> ) = 11
[pid 25479] 10:12:35.538314 read(11,  <unfinished ...>
[pid 25478] 10:12:35.538346 open("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25474] 10:12:35.538411 <... close resumed> ) = 0
[pid 25473] 10:12:35.538433 read(6,  <unfinished ...>
[pid 25472] 10:12:35.538457 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.538487 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25480] 10:12:35.538532 fstat(11,  <unfinished ...>
[pid 25479] 10:12:35.538556 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25478] 10:12:35.538593 <... open resumed> ) = 14
[pid 25474] 10:12:35.538626 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25473] 10:12:35.538659 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.538687 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.538707 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.538869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25479] 10:12:35.538903 close(11 <unfinished ...>
[pid 25478] 10:12:35.538931 chown("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25474] 10:12:35.538963 <... socket resumed> ) = 5
[pid 25473] 10:12:35.538980 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.539003 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.539032 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25480] 10:12:35.539086 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.539116 <... close resumed> ) = 0
[pid 25478] 10:12:35.539132 <... chown resumed> ) = 0
[pid 25474] 10:12:35.539153 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25473] 10:12:35.539187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25472] 10:12:35.539217 <... open resumed> ) = 6
[pid 25458] 10:12:35.539233 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25480] 10:12:35.539267 <... mmap resumed> ) = 0x7fea0f283000
[pid 25479] 10:12:35.539284 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25478] 10:12:35.539311 chmod("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25474] 10:12:35.539341 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.539358 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.539385 read(6,  <unfinished ...>
[pid 25458] 10:12:35.539408 <... lseek resumed> ) = 0
[pid 25480] 10:12:35.539435 read(11,  <unfinished ...>
[pid 25479] 10:12:35.539463 <... munmap resumed> ) = 0
[pid 25478] 10:12:35.539510 <... chmod resumed> ) = 0
[pid 25474] 10:12:35.539530 close(5 <unfinished ...>
[pid 25473] 10:12:35.539556 <... mmap resumed> ) = 0x7f7c15c9a000
[pid 25472] 10:12:35.539577 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.539602 read(10,  <unfinished ...>
[pid 25480] 10:12:35.539639 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25479] 10:12:35.539670 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.539699 chown("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25474] 10:12:35.539729 <... close resumed> ) = 0
[pid 25473] 10:12:35.539754 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.539787 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.539810 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25480] 10:12:35.539864 close(11 <unfinished ...>
[pid 25479] 10:12:35.539894 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25478] 10:12:35.540032 <... chown resumed> ) = 0
[pid 25474] 10:12:35.540057 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.540088 <... mmap resumed> ) = 0x7f7c12ffa000
[pid 25472] 10:12:35.540104 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25458] 10:12:35.540135 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25480] 10:12:35.540298 <... close resumed> ) = 0
[pid 25479] 10:12:35.540323 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25478] 10:12:35.540349 chmod("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25474] 10:12:35.540379 <... open resumed> ) = 5
[pid 25473] 10:12:35.540398 mprotect(0x7f7c13026000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.540426 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.540457 <... open resumed> ) = 11
[pid 25480] 10:12:35.540486 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25479] 10:12:35.540524 <... lseek resumed> ) = 0
[pid 25478] 10:12:35.540541 <... chmod resumed> ) = 0
[pid 25474] 10:12:35.540590 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.540622 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.540638 <... mmap resumed> ) = 0x7ff0fdfd0000
[pid 25458] 10:12:35.540655 fstat(11,  <unfinished ...>
[pid 25480] 10:12:35.540696 <... munmap resumed> ) = 0
[pid 25479] 10:12:35.540788 read(10,  <unfinished ...>
[pid 25478] 10:12:35.540821 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.540849 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25473] 10:12:35.540883 mmap(0x7f7c13226000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25472] 10:12:35.540914 mprotect(0x7ff0fdfd2000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.540943 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25480] 10:12:35.540983 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.541012 <... read resumed> "", 4096) = 0
[pid 25478] 10:12:35.541050 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.541118 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.541147 <... mmap resumed> ) = 0x7f7c13226000
[pid 25472] 10:12:35.541169 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.541186 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.541225 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25479] 10:12:35.541326 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25478] 10:12:35.541356 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.541380 <... mmap resumed> ) = 0x7f1105400000
[pid 25473] 10:12:35.541397 close(6 <unfinished ...>
[pid 25472] 10:12:35.541420 mmap(0x7ff0fe1d1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25458] 10:12:35.541448 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25480] 10:12:35.541476 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.541503 <... lseek resumed> ) = 0
[pid 25478] 10:12:35.541519 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.541536 read(5,  <unfinished ...>
[pid 25473] 10:12:35.541563 <... close resumed> ) = 0
[pid 25472] 10:12:35.541587 <... mmap resumed> ) = 0x7ff0fe1d1000
[pid 25458] 10:12:35.541611 read(11,  <unfinished ...>
[pid 25480] 10:12:35.541650 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.541667 read(10,  <unfinished ...>
[pid 25478] 10:12:35.541690 read(6,  <unfinished ...>
[pid 25474] 10:12:35.541717 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:35.541769 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.541807 close(6 <unfinished ...>
[pid 25458] 10:12:35.541830 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25480] 10:12:35.541871 read(10,  <unfinished ...>
[pid 25479] 10:12:35.541895 <... read resumed> "", 4096) = 0
[pid 25478] 10:12:35.541957 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25474] 10:12:35.541996 close(5 <unfinished ...>
[pid 25473] 10:12:35.542024 <... open resumed> ) = 6
[pid 25472] 10:12:35.542040 <... close resumed> ) = 0
[pid 25458] 10:12:35.542065 close(11 <unfinished ...>
[pid 25480] 10:12:35.542101 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.542121 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25478] 10:12:35.542159 read(6,  <unfinished ...>
[pid 25474] 10:12:35.542182 <... close resumed> ) = 0
[pid 25473] 10:12:35.542198 read(6,  <unfinished ...>
[pid 25472] 10:12:35.542222 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.542251 <... close resumed> ) = 0
[pid 25480] 10:12:35.542277 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.542301 <... open resumed> ) = 11
[pid 25478] 10:12:35.542317 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.542335 munmap(0x7f1105400000, 4096 <unfinished ...>
[pid 25473] 10:12:35.542363 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.542386 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.542404 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25480] 10:12:35.542441 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.542458 alarm(60 <unfinished ...>
[pid 25478] 10:12:35.542483 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:35 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2522 <unfinished ...>
[pid 25474] 10:12:35.542522 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.542546 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.542570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.542608 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.542685 read(10,  <unfinished ...>
[pid 25479] 10:12:35.542698 <... alarm resumed> ) = 0
[pid 25478] 10:12:35.542707 <... write resumed> ) = 2522
[pid 25474] 10:12:35.542716 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.542730 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25472] 10:12:35.542914 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.542933 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.542980 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.543042 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25478] 10:12:35.543078 fsync(14 <unfinished ...>
[pid 25474] 10:12:35.543152 <... open resumed> ) = 5
[pid 25473] 10:12:35.543172 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.543292 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.543325 <... open resumed> ) = 11
[pid 25480] 10:12:35.543352 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25479] 10:12:35.543386 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.543405 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.543428 <... mmap resumed> ) = 0x7f7c12df5000
[pid 25472] 10:12:35.543445 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.543464 fstat(11,  <unfinished ...>
[pid 25480] 10:12:35.543508 <... open resumed> ) = 11
[pid 25479] 10:12:35.543529 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.543553 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:35.543582 mprotect(0x7f7c12dfa000, 2093056, PROT_NONE <unfinished ...>
[pid 25478] 10:12:35.543611 <... fsync resumed> ) = 0
[pid 25472] 10:12:35.543629 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.543662 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.543707 alarm(60 <unfinished ...>
[pid 25479] 10:12:35.543732 <... alarm resumed> ) = 60
[pid 25478] 10:12:35.543891 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25474] 10:12:35.543922 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.543949 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.543965 <... open resumed> ) = 6
[pid 25458] 10:12:35.543981 fstat(11,  <unfinished ...>
[pid 25480] 10:12:35.544014 <... alarm resumed> ) = 0
[pid 25479] 10:12:35.544031 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25478] 10:12:35.544060 <... lseek resumed> ) = 4109
[pid 25474] 10:12:35.544076 <... mmap resumed> ) = 0x7f1105400000
[pid 25473] 10:12:35.544093 mmap(0x7f7c12ff9000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25472] 10:12:35.544123 read(6,  <unfinished ...>
[pid 25458] 10:12:35.544146 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.544186 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25479] 10:12:35.544214 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25478] 10:12:35.544254 write(11, "2522 1\n", 7 <unfinished ...>
[pid 25474] 10:12:35.544287 read(5,  <unfinished ...>
[pid 25473] 10:12:35.544313 <... mmap resumed> ) = 0x7f7c12ff9000
[pid 25472] 10:12:35.544334 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.544363 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.544400 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.544419 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25478] 10:12:35.544451 <... write resumed> ) = 7
[pid 25474] 10:12:35.544468 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:35.544504 close(6 <unfinished ...>
[pid 25472] 10:12:35.544530 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.544553 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25480] 10:12:35.544580 alarm(0 <unfinished ...>
[pid 25479] 10:12:35.544603 <... open resumed> ) = 13
[pid 25478] 10:12:35.544620 close(11 <unfinished ...>
[pid 25474] 10:12:35.544644 close(5 <unfinished ...>
[pid 25473] 10:12:35.544668 <... close resumed> ) = 0
[pid 25472] 10:12:35.544694 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25458] 10:12:35.544725 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25480] 10:12:35.544855 <... alarm resumed> ) = 60
[pid 25479] 10:12:35.544931 fcntl(13, F_GETFD <unfinished ...>
[pid 25478] 10:12:35.544959 <... close resumed> ) = 0
[pid 25474] 10:12:35.544982 <... close resumed> ) = 0
[pid 25473] 10:12:35.545000 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.545031 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.545057 <... lseek resumed> ) = 0
[pid 25480] 10:12:35.545104 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25479] 10:12:35.545138 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.545155 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.545177 munmap(0x7f1105400000, 4096 <unfinished ...>
[pid 25473] 10:12:35.545205 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.545223 <... mmap resumed> ) = 0x7ff101077000
[pid 25458] 10:12:35.545243 read(11,  <unfinished ...>
[pid 25480] 10:12:35.545281 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25479] 10:12:35.545318 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.545345 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179010, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2522, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.545373 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.545404 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.545437 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.545467 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25480] 10:12:35.545513 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.545548 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.545573 close(14 <unfinished ...>
[pid 25474] 10:12:35.545599 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25473] 10:12:35.545640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.545658 <... mmap resumed> ) = 0x7ff0fddad000
[pid 25458] 10:12:35.545678 stat("/jail_owner",  <unfinished ...>
[pid 25480] 10:12:35.545716 <... open resumed> ) = 13
[pid 25479] 10:12:35.545732 read(13,  <unfinished ...>
[pid 25478] 10:12:35.545836 <... close resumed> ) = 0
[pid 25474] 10:12:35.545869 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25473] 10:12:35.545897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.545929 mprotect(0x7ff0fddc4000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.545957 <... stat resumed> 0x7ffc7ad93ba0) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.545991 fcntl(13, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.546017 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25478] 10:12:35.546045 rename("tmp/1451491955.H537609P25478.fin.finestweddingsites.com", "new/1451491955.H537609P25478.fin.finestweddingsites.com,S=2522" <unfinished ...>
[pid 25474] 10:12:35.546100 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25473] 10:12:35.546130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.546149 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.546166 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25480] 10:12:35.546207 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.546224 close(13 <unfinished ...>
[pid 25478] 10:12:35.546247 <... rename resumed> ) = 0
[pid 25474] 10:12:35.546266 <... readlink resumed> 0x7ffda29d3810, 4095) = -1 EINVAL (Invalid argument)
[pid 25473] 10:12:35.546291 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.546334 mmap(0x7ff0fdfc4000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25458] 10:12:35.546390 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
Process 25481 attached
[pid 25480] 10:12:35.546453 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.546495 <... close resumed> ) = 0
[pid 25478] 10:12:35.546522 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.546576 getcwd( <unfinished ...>
[pid 25473] 10:12:35.546603 <... open resumed> ) = 6
[pid 25472] 10:12:35.546619 <... mmap resumed> ) = 0x7ff0fdfc4000
[pid 25458] 10:12:35.546645 stat("/usr/local/cpanel/3rdparty/mailman/lists/theviewsatsuperstition_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25481] 10:12:35.546693 set_robust_list(0x7f380d40eaa0, 24 <unfinished ...>
[pid 25480] 10:12:35.546716 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.546735 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25478] 10:12:35.546845 <... write resumed> ) = 4
[pid 25474] 10:12:35.546866 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25473] 10:12:35.546893 read(6,  <unfinished ...>
[pid 25472] 10:12:35.546937 close(6 <unfinished ...>
[pid 25458] 10:12:35.546961 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.546986 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25481] 10:12:35.547023 <... set_robust_list resumed> ) = 0
[pid 25480] 10:12:35.547044 read(13,  <unfinished ...>
[pid 25479] 10:12:35.547095 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25478] 10:12:35.547162 write(12, "\332\t\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.547192 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25473] 10:12:35.547220 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.547243 <... close resumed> ) = 0
[pid 25458] 10:12:35.547283 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25443] 10:12:35.547313 read(11,  <unfinished ...>
[pid 25481] 10:12:35.547355 close(0 <unfinished ...>
[pid 25480] 10:12:35.547378 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25479] 10:12:35.547404 stat("/var/tmp",  <unfinished ...>
[pid 25478] 10:12:35.547434 <... write resumed> ) = 4
[pid 25474] 10:12:35.547450 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25473] 10:12:35.547481 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.547505 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.547534 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25443] 10:12:35.547568 <... read resumed> "\332\t\0\0", 4) = 4
[pid 25481] 10:12:35.547601 <... close resumed> ) = 0
[pid 25480] 10:12:35.547615 close(13 <unfinished ...>
[pid 25479] 10:12:35.547700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25478] 10:12:35.548004 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.548043 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.548073 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25472] 10:12:35.548103 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.548122 stat("/usr/local/cpanel/3rdparty/mailman/lists/theviewsatsuperstition/config.pck",  <unfinished ...>
[pid 25443] 10:12:35.548153 read(11,  <unfinished ...>
[pid 25481] 10:12:35.548191 dup2(10, 0 <unfinished ...>
[pid 25480] 10:12:35.548214 <... close resumed> ) = 0
[pid 25479] 10:12:35.548240 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25478] 10:12:35.548271 <... write resumed> ) = 4
[pid 25474] 10:12:35.548287 <... open resumed> ) = 5
[pid 25473] 10:12:35.548311 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.548342 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.548375 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25443] 10:12:35.548398 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25481] 10:12:35.548431 <... dup2 resumed> ) = 0
[pid 25480] 10:12:35.548445 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.548473 <... open resumed> ) = 13
[pid 25478] 10:12:35.548489 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.548513 fstat(5,  <unfinished ...>
[pid 25473] 10:12:35.548535 <... mmap resumed> ) = 0x7f7c12bf2000
[pid 25472] 10:12:35.548551 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.548568 stat("/etc/demouids",  <unfinished ...>
[pid 25443] 10:12:35.548594 read(11,  <unfinished ...>
[pid 25481] 10:12:35.548630 close(10 <unfinished ...>
[pid 25480] 10:12:35.548652 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25479] 10:12:35.548670 fcntl(13, F_GETFD <unfinished ...>
[pid 25478] 10:12:35.548693 <... write resumed> ) = 4
[pid 25474] 10:12:35.548708 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25473] 10:12:35.548736 mprotect(0x7f7c12bf4000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.548770 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.548801 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.548845 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25481] 10:12:35.548899 <... close resumed> ) = 0
[pid 25480] 10:12:35.548927 stat("/var/tmp",  <unfinished ...>
[pid 25479] 10:12:35.548969 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.548993 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.549056 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.549095 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.549119 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.549146 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25443] 10:12:35.549187 read(11,  <unfinished ...>
[pid 25481] 10:12:35.549273 close(11 <unfinished ...>
[pid 25480] 10:12:35.549308 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25479] 10:12:35.549548 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25478] 10:12:35.549590 <... write resumed> ) = 4
[pid 25474] 10:12:35.549613 <... mmap resumed> ) = 0x7f1105400000
[pid 25473] 10:12:35.549637 mmap(0x7f7c12df3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25472] 10:12:35.549681 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.549726 <... open resumed> ) = 12
[pid 25443] 10:12:35.549903 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25481] 10:12:35.549958 <... close resumed> ) = 0
[pid 25480] 10:12:35.549978 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.550042 <... fcntl resumed> ) = 0
[pid 25478] 10:12:35.550066 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.550129 read(5,  <unfinished ...>
[pid 25473] 10:12:35.550173 <... mmap resumed> ) = 0x7f7c12df3000
[pid 25472] 10:12:35.550206 <... open resumed> ) = 6
[pid 25458] 10:12:35.550237 fstat(12,  <unfinished ...>
[pid 25443] 10:12:35.550271 read(11,  <unfinished ...>
[pid 25481] 10:12:35.550328 fstat(0,  <unfinished ...>
[pid 25480] 10:12:35.550360 <... open resumed> ) = 13
[pid 25479] 10:12:35.550383 fstat(13,  <unfinished ...>
[pid 25478] 10:12:35.550415 <... write resumed> ) = 4
[pid 25474] 10:12:35.550437 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25473] 10:12:35.550468 close(6 <unfinished ...>
[pid 25472] 10:12:35.550501 read(6,  <unfinished ...>
[pid 25458] 10:12:35.550535 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.550582 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25481] 10:12:35.550628 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167601, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25480] 10:12:35.550667 fcntl(13, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.550706 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25478] 10:12:35.550862 write(12, "\260\243\304\1\0\0\0\0", 8 <unfinished ...>
[pid 25474] 10:12:35.550908 read(5,  <unfinished ...>
[pid 25473] 10:12:35.550943 <... close resumed> ) = 0
[pid 25472] 10:12:35.550977 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.551037 fstat(12,  <unfinished ...>
[pid 25443] 10:12:35.551073 read(11,  <unfinished ...>
[pid 25481] 10:12:35.551128 fstat(1,  <unfinished ...>
[pid 25480] 10:12:35.551161 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.551184 pread(13,  <unfinished ...>
[pid 25478] 10:12:35.551218 <... write resumed> ) = 8
[pid 25474] 10:12:35.551241 <... read resumed> "", 1024) = 0
[pid 25473] 10:12:35.551272 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.551315 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.551350 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.551392 <... read resumed> "\260\243\304\1\0\0\0\0", 8) = 8
[pid 25481] 10:12:35.551443 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25480] 10:12:35.551482 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.551520 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25478] 10:12:35.551593 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.551634 setregid(499, 499 <unfinished ...>
[pid 25473] 10:12:35.551668 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.551693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.551736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.551875 read(11,  <unfinished ...>
[pid 25481] 10:12:35.551935 fstat(2,  <unfinished ...>
[pid 25480] 10:12:35.551990 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.552016 pread(13,  <unfinished ...>
[pid 25478] 10:12:35.552051 <... write resumed> ) = 4
[pid 25474] 10:12:35.552073 <... setregid resumed> ) = 0
[pid 25473] 10:12:35.552099 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.552149 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.552192 <... mmap resumed> ) = 0x7f03f4be5000
[pid 25443] 10:12:35.552216 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25481] 10:12:35.552263 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25480] 10:12:35.552303 fstat(13,  <unfinished ...>
[pid 25479] 10:12:35.552348 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25478] 10:12:35.552398 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25474] 10:12:35.552437 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25473] 10:12:35.552876 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.552906 <... mmap resumed> ) = 0x7ff0fdb69000
[pid 25458] 10:12:35.552931 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.552965 read(11,  <unfinished ...>
[pid 25481] 10:12:35.553021 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMY-0006bs-1f"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25480] 10:12:35.553639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25479] 10:12:35.553721 pread(13,  <unfinished ...>
[pid 25478] 10:12:35.553858 <... write resumed> ) = 4
[pid 25473] 10:12:35.553886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.553936 mprotect(0x7ff0fdbaa000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.554000 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.554028 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25480] 10:12:35.554077 pread(13,  <unfinished ...>
[pid 25479] 10:12:35.554113 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25478] 10:12:35.554164 close(12 <unfinished ...>
[pid 25474] 10:12:35.554201 <... execve resumed> ) = 0
[pid 25473] 10:12:35.554242 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.554272 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.554295 read(12,  <unfinished ...>
[pid 25443] 10:12:35.554328 close(11 <unfinished ...>
[pid 25481] 10:12:35.554386 <... execve resumed> ) = 0
[pid 25480] 10:12:35.554407 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25479] 10:12:35.554490 close(13 <unfinished ...>
[pid 25478] 10:12:35.554532 <... close resumed> ) = 0
[pid 25474] 10:12:35.554557 brk(0 <unfinished ...>
[pid 25473] 10:12:35.554589 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.554633 mmap(0x7ff0fddaa000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25458] 10:12:35.554676 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.554711 <... close resumed> ) = 0
[pid 25481] 10:12:35.554857 brk(0 <unfinished ...>
[pid 25480] 10:12:35.554898 pread(13,  <unfinished ...>
[pid 25479] 10:12:35.554933 <... close resumed> ) = 0
[pid 25478] 10:12:35.554983 close(10 <unfinished ...>
[pid 25474] 10:12:35.555020 <... brk resumed> ) = 0x24a0000
[pid 25473] 10:12:35.555058 <... open resumed> ) = 6
[pid 25472] 10:12:35.555083 <... mmap resumed> ) = 0x7ff0fddaa000
[pid 25458] 10:12:35.555116 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25443] 10:12:35.555159 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25481] 10:12:35.555225 <... brk resumed> ) = 0x1b1d000
[pid 25480] 10:12:35.555245 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25479] 10:12:35.555297 close(11 <unfinished ...>
[pid 25478] 10:12:35.555343 <... close resumed> ) = 0
[pid 25474] 10:12:35.555366 fcntl(0, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.555399 read(6,  <unfinished ...>
[pid 25472] 10:12:35.555432 close(6 <unfinished ...>
[pid 25458] 10:12:35.555464 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25443] 10:12:35.555629 <... write resumed> ) = 28
[pid 25481] 10:12:35.555687 fcntl(0, F_GETFD <unfinished ...>
[pid 25480] 10:12:35.555721 pread(13,  <unfinished ...>
[pid 25479] 10:12:35.555843 <... close resumed> ) = 0
[pid 25478] 10:12:35.555898 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25474] 10:12:35.555949 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.555973 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.556007 <... close resumed> ) = 0
[pid 25458] 10:12:35.556068 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.556110 fsync(9 <unfinished ...>
[pid 25481] 10:12:35.556183 <... fcntl resumed> ) = 0
[pid 25480] 10:12:35.556211 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25479] 10:12:35.556303 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25478] 10:12:35.556351 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.556381 fcntl(1, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.556417 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.556450 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.556501 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.556592 fcntl(1, F_GETFD <unfinished ...>
[pid 25480] 10:12:35.556628 close(13 <unfinished ...>
[pid 25479] 10:12:35.556663 <... socket resumed> ) = 11
[pid 25478] 10:12:35.556694 close(13 <unfinished ...>
[pid 25474] 10:12:35.556730 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.556843 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25472] 10:12:35.556896 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.556922 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.556964 <... fsync resumed> ) = 0
[pid 25481] 10:12:35.557008 <... fcntl resumed> ) = 0
[pid 25480] 10:12:35.557028 <... close resumed> ) = 0
[pid 25479] 10:12:35.557106 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25478] 10:12:35.557151 <... close resumed> ) = 0
[pid 25474] 10:12:35.557174 fcntl(2, F_GETFD <unfinished ...>
[pid 25473] 10:12:35.557207 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.557245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.557376 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.557434 wait4(-1,  <unfinished ...>
[pid 25481] 10:12:35.557499 fcntl(2, F_GETFD <unfinished ...>
[pid 25480] 10:12:35.557538 close(11 <unfinished ...>
[pid 25479] 10:12:35.557581 <... setsockopt resumed> ) = 0
[pid 25478] 10:12:35.557621 munmap(0x7fdec5ab7000, 4096 <unfinished ...>
[pid 25474] 10:12:35.557671 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.557702 <... mmap resumed> ) = 0x7f7c15c99000
[pid 25472] 10:12:35.557731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.557762 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25481] 10:12:35.557823 <... fcntl resumed> ) = 0
[pid 25480] 10:12:35.557842 <... close resumed> ) = 0
[pid 25479] 10:12:35.557933 alarm(300 <unfinished ...>
[pid 25478] 10:12:35.557973 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.558449 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25473] 10:12:35.558500 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.558543 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.558589 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25481] 10:12:35.558683 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25480] 10:12:35.558828 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25479] 10:12:35.558880 <... alarm resumed> ) = 0
[pid 25478] 10:12:35.558915 exit_group(0) = ?
[pid 25474] 10:12:35.559340 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.559399 <... mmap resumed> ) = 0x7f7c129cf000
[pid 25472] 10:12:35.559430 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.559459 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.559545 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.559568 <... socket resumed> ) = 11
[pid 25479] 10:12:35.559625 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("98.129.185.131")}, 16 <unfinished ...>
[pid 25478] 10:12:35.559807 +++ exited with 0 +++
[pid 25474] 10:12:35.559834 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.559878 mprotect(0x7f7c129e6000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.559929 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.559982 <... open resumed> ) = 13
[pid 25443] 10:12:35.560010 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25478
[pid 25481] 10:12:35.560123 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.560170 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25474] 10:12:35.560214 <... mmap resumed> ) = 0x7f84e3f52000
[pid 25473] 10:12:35.560257 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.560285 <... open resumed> ) = 6
[pid 25458] 10:12:35.560310 fstat(13,  <unfinished ...>
[pid 25443] 10:12:35.560343 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.560403 <... mmap resumed> ) = 0x7f04ce1d5000
[pid 25480] 10:12:35.560426 <... setsockopt resumed> ) = 0
[pid 25474] 10:12:35.560482 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25473] 10:12:35.560529 mmap(0x7f7c12be6000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25472] 10:12:35.560653 read(6,  <unfinished ...>
[pid 25458] 10:12:35.560691 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.560732 <... open resumed> ) = 10
[pid 25481] 10:12:35.560834 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25480] 10:12:35.560872 alarm(300 <unfinished ...>
[pid 25474] 10:12:35.560898 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.560925 <... mmap resumed> ) = 0x7f7c12be6000
[pid 25472] 10:12:35.560959 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.560988 fstat(13,  <unfinished ...>
[pid 25443] 10:12:35.561012 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.561046 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.561061 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.561096 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.561128 close(6 <unfinished ...>
[pid 25472] 10:12:35.561150 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.561173 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25443] 10:12:35.561203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.561247 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.561278 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("98.129.185.131")}, 16 <unfinished ...>
[pid 25474] 10:12:35.561336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.561355 <... close resumed> ) = 0
[pid 25472] 10:12:35.561397 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.561430 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.561460 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.561493 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.561514 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.561545 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.561574 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.561600 <... mmap resumed> ) = 0x7f03f4be4000
[pid 25443] 10:12:35.561616 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.561656 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.561682 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.561701 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.561718 <... mmap resumed> ) = 0x7ff101076000
[pid 25458] 10:12:35.561738 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25443] 10:12:35.561761 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.561796 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.561810 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.561840 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.562001 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.562034 <... lseek resumed> ) = 0
[pid 25443] 10:12:35.562051 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25481] 10:12:35.562078 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.562107 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.562124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.562141 <... mmap resumed> ) = 0x7ff0fd882000
[pid 25458] 10:12:35.562157 read(13,  <unfinished ...>
[pid 25443] 10:12:35.562184 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.562216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.562230 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25473] 10:12:35.562258 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.562286 mprotect(0x7ff0fd95d000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.562314 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25443] 10:12:35.562340 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.562367 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25474] 10:12:35.562393 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.562410 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.562429 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.562445 read(13,  <unfinished ...>
[pid 25443] 10:12:35.562468 read(10,  <unfinished ...>
[pid 25481] 10:12:35.562504 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.562582 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.562615 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.562647 mmap(0x7ff0fdb5d000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25458] 10:12:35.562677 <... read resumed> "", 4096) = 0
[pid 25443] 10:12:35.562716 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25481] 10:12:35.562773 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.562806 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.562824 <... open resumed> ) = 6
[pid 25472] 10:12:35.562840 <... mmap resumed> ) = 0x7ff0fdb5d000
[pid 25458] 10:12:35.562865 stat("/etc/userdomains",  <unfinished ...>
[pid 25443] 10:12:35.562893 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.562931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.562945 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.562974 read(6,  <unfinished ...>
[pid 25472] 10:12:35.562997 close(6 <unfinished ...>
[pid 25458] 10:12:35.563019 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25443] 10:12:35.563065 <... stat resumed> 0x7ffd9471b4c0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.563110 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.563140 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.563158 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.563181 <... close resumed> ) = 0
[pid 25458] 10:12:35.563207 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.563237 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.563271 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.563286 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.563316 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.563339 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.563367 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.563403 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.563455 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.563485 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.563502 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.563539 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.563557 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.563584 write(8, "2015-12-30 10:12:35 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25481] 10:12:35.563626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.563640 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25473] 10:12:35.563669 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.563700 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.563733 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.563791 <... write resumed> ) = 126
[pid 25481] 10:12:35.563829 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25474] 10:12:35.563858 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25473] 10:12:35.563884 <... mmap resumed> ) = 0x7f7c1278b000
[pid 25472] 10:12:35.563893 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.563902 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25443] 10:12:35.563917 write(8, "2015-12-30 10:12:35 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25481] 10:12:35.563940 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25474] 10:12:35.563955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.563974 mprotect(0x7f7c127cc000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.563988 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.564002 <... open resumed> ) = 14
[pid 25443] 10:12:35.564011 <... write resumed> ) = 77
[pid 25481] 10:12:35.564040 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.564048 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.564065 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.564073 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.564083 fstat(14,  <unfinished ...>
[pid 25443] 10:12:35.564092 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.564112 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.564118 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.564133 mmap(0x7f7c129cc000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25472] 10:12:35.564149 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.564165 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25443] 10:12:35.564183 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.564219 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.564227 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.564242 <... mmap resumed> ) = 0x7f7c129cc000
[pid 25472] 10:12:35.564259 <... open resumed> ) = 6
[pid 25458] 10:12:35.564268 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25443] 10:12:35.564280 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.564300 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.564306 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.564322 close(6 <unfinished ...>
[pid 25472] 10:12:35.564331 read(6,  <unfinished ...>
[pid 25458] 10:12:35.564340 <... mmap resumed> ) = 0x7f03f4be3000
[pid 25443] 10:12:35.564349 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.564379 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.564388 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.564403 <... close resumed> ) = 0
[pid 25472] 10:12:35.564419 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.564432 read(14,  <unfinished ...>
[pid 25443] 10:12:35.564444 close(7 <unfinished ...>
[pid 25481] 10:12:35.564464 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.564471 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25473] 10:12:35.564486 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.564500 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.564774 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25443] 10:12:35.564810 <... close resumed> ) = 0
[pid 25481] 10:12:35.564840 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25474] 10:12:35.564870 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.564888 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.564905 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.564935 close(14 <unfinished ...>
[pid 25443] 10:12:35.564959 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.565003 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.565018 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.565051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.565081 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.565112 <... close resumed> ) = 0
[pid 25443] 10:12:35.565128 <... open resumed> ) = 7
[pid 25481] 10:12:35.565153 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.565183 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.565200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.565216 <... mmap resumed> ) = 0x7ff0fd67e000
[pid 25458] 10:12:35.565232 munmap(0x7f03f4be3000, 4096 <unfinished ...>
[pid 25443] 10:12:35.565260 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.565292 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.565306 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.565336 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.565365 mprotect(0x7ff0fd681000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.565391 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.565416 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.565443 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.565477 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.565495 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.565517 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.565534 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25443] 10:12:35.565560 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.565592 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.565606 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.565639 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.565668 mmap(0x7ff0fd880000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25458] 10:12:35.565697 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25443] 10:12:35.565726 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.565752 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.565782 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.565801 <... open resumed> ) = 6
[pid 25472] 10:12:35.565817 <... mmap resumed> ) = 0x7ff0fd880000
[pid 25458] 10:12:35.565842 pipe( <unfinished ...>
[pid 25443] 10:12:35.565871 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.565903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.565917 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25473] 10:12:35.565949 read(6,  <unfinished ...>
[pid 25472] 10:12:35.565972 close(6 <unfinished ...>
[pid 25458] 10:12:35.565994 <... pipe resumed> [14, 15]) = 0
[pid 25443] 10:12:35.566011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373027, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.566049 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25474] 10:12:35.566078 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.566105 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.566125 <... close resumed> ) = 0
[pid 25458] 10:12:35.566140 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25443] 10:12:35.566155 write(7, "2015-12-30 10:12:35 [25443] 1aEJMY-0006cE-He => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2522 QT=1s "..., 262 <unfinished ...>
[pid 25481] 10:12:35.566183 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25474] 10:12:35.566201 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.566216 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.566225 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.566239 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25443] 10:12:35.566251 <... write resumed> ) = 262
[pid 25481] 10:12:35.566307 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.566324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.566333 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.566353 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.566362 close(12 <unfinished ...>
[pid 25443] 10:12:35.566372 pipe( <unfinished ...>
[pid 25481] 10:12:35.566393 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.566401 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.566414 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.566426 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.566442 <... close resumed> ) = 0
[pid 25443] 10:12:35.566450 <... pipe resumed> [11, 12]) = 0
[pid 25481] 10:12:35.566468 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.566482 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.566490 <... mmap resumed> ) = 0x7f7c15c98000
[pid 25472] 10:12:35.566502 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.566716 munmap(0x7f03f4be5000, 4096 <unfinished ...>
[pid 25443] 10:12:35.566751 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25481] 10:12:35.566786 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.566804 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.566834 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.566863 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.566892 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.566910 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.566936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.566966 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.566982 <... mmap resumed> ) = 0x7f7c124a4000
[pid 25472] 10:12:35.566998 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.567016 close(9 <unfinished ...>
[pid 25443] 10:12:35.567041 close(10 <unfinished ...>
[pid 25481] 10:12:35.567073 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.567090 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25473] 10:12:35.567117 mprotect(0x7f7c1257f000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.567144 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.567175 <... close resumed> ) = 0
[pid 25443] 10:12:35.567191 <... close resumed> ) = 0
[pid 25481] 10:12:35.567215 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25474] 10:12:35.567249 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.567266 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.567282 <... open resumed> ) = 6
[pid 25458] 10:12:35.567298 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25443] 10:12:35.567325 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25481] 10:12:35.567361 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.567379 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.567408 mmap(0x7f7c1277f000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25472] 10:12:35.567437 read(6,  <unfinished ...>
[pid 25458] 10:12:35.567461 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.567479 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.567570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.567609 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.567627 <... mmap resumed> ) = 0x7f7c1277f000
[pid 25472] 10:12:35.567652 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.567678 close(11 <unfinished ...>
[pid 25443] 10:12:35.567703 clone( <unfinished ...>
[pid 25481] 10:12:35.567954 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.567973 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25473] 10:12:35.568001 close(6 <unfinished ...>
[pid 25472] 10:12:35.568024 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.568046 <... close resumed> ) = 0
[pid 25481] 10:12:35.568072 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25474] 10:12:35.568100 <... stat resumed> 0x7fff65a60790) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.568116 <... close resumed> ) = 0
[pid 25472] 10:12:35.568141 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.568173 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25443] 10:12:35.568201 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25482
[pid 25481] 10:12:35.568245 <... stat resumed> 0x7ffeeb1bcb10) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.568265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.568296 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.568324 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.568353 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.568370 close(12 <unfinished ...>
[pid 25481] 10:12:35.568402 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.568431 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.568448 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.568464 <... mmap resumed> ) = 0x7ff0fd452000
[pid 25458] 10:12:35.568480 close(13 <unfinished ...>
[pid 25443] 10:12:35.568504 <... close resumed> ) = 0
[pid 25481] 10:12:35.568560 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.568581 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25473] 10:12:35.568620 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.568650 mprotect(0x7ff0fd47b000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.568677 <... close resumed> ) = 0
[pid 25443] 10:12:35.568693 wait4(-1,  <unfinished ...>
[pid 25481] 10:12:35.568727 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25479] 10:12:35.568754 <... connect resumed> ) = 0
[pid 25474] 10:12:35.568770 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.568801 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.568819 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.568835 munmap(0x7f03f4be4000, 4096 <unfinished ...>
[pid 25443] 10:12:35.568861 <... wait4 resumed> 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25481] 10:12:35.568900 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25479] 10:12:35.568932 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.568956 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.568984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.569015 mmap(0x7ff0fd67b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25458] 10:12:35.569045 <... munmap resumed> ) = 0
[pid 25443] 10:12:35.569062 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25481] 10:12:35.569101 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.569129 <... alarm resumed> ) = 300
[pid 25474] 10:12:35.569151 <... open resumed> ) = 6
[pid 25473] 10:12:35.569167 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.569185 <... mmap resumed> ) = 0x7ff0fd67b000
[pid 25458] 10:12:35.569206 close(10 <unfinished ...>
[pid 25481] 10:12:35.569240 <... open resumed> ) = 6
[pid 25479] 10:12:35.569256 getsockname(11,  <unfinished ...>
[pid 25474] 10:12:35.569279 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.569301 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.569330 mmap(0x7ff0fd67d000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.569358 <... close resumed> ) = 0
[pid 25481] 10:12:35.569384 fstat(6,  <unfinished ...>
[pid 25479] 10:12:35.569408 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(52768), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25474] 10:12:35.569438 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:35.569471 <... open resumed> ) = 6
[pid 25472] 10:12:35.569480 <... mmap resumed> ) = 0x7ff0fd67d000
[pid 25458] 10:12:35.569493 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25481] 10:12:35.569668 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25480] 10:12:35.569700 <... connect resumed> ) = 0
[pid 25479] 10:12:35.569717 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25474] 10:12:35.569744 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.569776 read(6,  <unfinished ...>
[pid 25472] 10:12:35.569799 close(6 <unfinished ...>
[pid 25458] 10:12:35.569821 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.569850 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.569876 alarm(0 <unfinished ...>
[pid 25479] 10:12:35.569899 <... setsockopt resumed> ) = 0
[pid 25474] 10:12:35.569919 <... mmap resumed> ) = 0x7f84e3f48000
[pid 25473] 10:12:35.569936 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.569960 <... close resumed> ) = 0
[pid 25458] 10:12:35.569986 clone( <unfinished ...>
[pid 25481] 10:12:35.570262 <... mmap resumed> ) = 0x7f04ce1cb000
[pid 25480] 10:12:35.570280 <... alarm resumed> ) = 300
[pid 25479] 10:12:35.570302 stat("/etc/mailhelo",  <unfinished ...>
[pid 25474] 10:12:35.570330 close(6 <unfinished ...>
[pid 25473] 10:12:35.570352 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.570376 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.570418 close(6 <unfinished ...>
[pid 25480] 10:12:35.570440 getsockname(11,  <unfinished ...>
[pid 25479] 10:12:35.570463 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.570501 <... close resumed> ) = 0
[pid 25473] 10:12:35.570593 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.570627 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.570645 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25483
[pid 25481] 10:12:35.570691 <... close resumed> ) = 0
[pid 25480] 10:12:35.570718 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(52769), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25479] 10:12:35.570747 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.570777 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.570808 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.570838 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.570876 close(15 <unfinished ...>
[pid 25481] 10:12:35.570916 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.570946 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25479] 10:12:35.570973 <... open resumed> ) = 13
[pid 25474] 10:12:35.570991 <... open resumed> ) = 6
[pid 25473] 10:12:35.571007 <... mmap resumed> ) = 0x7f7c122a0000
[pid 25472] 10:12:35.571023 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.571040 <... close resumed> ) = 0
[pid 25481] 10:12:35.571067 <... open resumed> ) = 6
[pid 25480] 10:12:35.571083 <... setsockopt resumed> ) = 0
[pid 25479] 10:12:35.571103 fstat(13,  <unfinished ...>
[pid 25474] 10:12:35.571126 read(6,  <unfinished ...>
[pid 25473] 10:12:35.571149 mprotect(0x7f7c122a3000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.571176 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.571213 read(14,  <unfinished ...>
[pid 25481] 10:12:35.571245 read(6,  <unfinished ...>
[pid 25480] 10:12:35.571268 stat("/etc/mailhelo",  <unfinished ...>
[pid 25479] 10:12:35.571294 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.571326 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.571352 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.571369 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.571398 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.571422 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.571459 fstat(13,  <unfinished ...>
[pid 25474] 10:12:35.571485 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.571608 mmap(0x7f7c124a2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25472] 10:12:35.571646 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.571689 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.571713 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.571740 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25474] 10:12:35.571769 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.571798 <... mmap resumed> ) = 0x7f7c124a2000
[pid 25472] 10:12:35.571823 <... open resumed> ) = 6
[pid 25481] 10:12:35.571851 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.571880 <... open resumed> ) = 13
[pid 25479] 10:12:35.571897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.571924 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.571950 close(6 <unfinished ...>
[pid 25472] 10:12:35.571972 read(6,  <unfinished ...>
[pid 25481] 10:12:35.572005 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.572030 fstat(13,  <unfinished ...>
[pid 25479] 10:12:35.572059 <... mmap resumed> ) = 0x7fea0f283000
[pid 25474] 10:12:35.572076 <... mmap resumed> ) = 0x7f84e3b1a000
[pid 25473] 10:12:35.572092 <... close resumed> ) = 0
[pid 25472] 10:12:35.572115 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25481] 10:12:35.572148 <... mmap resumed> ) = 0x7f04cdd9d000
[pid 25480] 10:12:35.572165 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.572196 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.572219 mprotect(0x7f84e3b30000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.572247 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.572276 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.572308 mprotect(0x7f04cddb3000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.572335 fstat(13,  <unfinished ...>
[pid 25479] 10:12:35.572358 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.572374 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.572390 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.572407 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25481] 10:12:35.572444 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.572461 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.572488 read(13,  <unfinished ...>
[pid 25474] 10:12:35.572515 mmap(0x7f84e3d30000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25473] 10:12:35.572545 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.572585 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.572631 mmap(0x7f04cdfb3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25480] 10:12:35.572660 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.572686 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.572713 <... mmap resumed> ) = 0x7f84e3d30000
[pid 25473] 10:12:35.572736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.572754 <... mmap resumed> ) = 0x7ff101075000
[pid 25481] 10:12:35.572782 <... mmap resumed> ) = 0x7f04cdfb3000
[pid 25480] 10:12:35.572803 <... mmap resumed> ) = 0x7fea0f283000
[pid 25479] 10:12:35.572821 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.572843 mmap(0x7f84e3d32000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.572870 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.572898 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25481] 10:12:35.572923 mmap(0x7f04cdfb5000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.572935 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.572945 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.572953 <... mmap resumed> ) = 0x7f84e3d32000
[pid 25473] 10:12:35.572966 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.572978 <... mmap resumed> ) = 0x7ff0fd23c000
[pid 25481] 10:12:35.572994 <... mmap resumed> ) = 0x7f04cdfb5000
[pid 25480] 10:12:35.573007 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.573016 read(13,  <unfinished ...>
[pid 25474] 10:12:35.573025 close(6 <unfinished ...>
[pid 25473] 10:12:35.573033 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.573048 mprotect(0x7ff0fd251000, 2093056, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.573069 close(6 <unfinished ...>
[pid 25480] 10:12:35.573078 read(13,  <unfinished ...>
[pid 25479] 10:12:35.573087 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.573151 <... close resumed> ) = 0
[pid 25473] 10:12:35.573168 <... open resumed> ) = 6
[pid 25472] 10:12:35.573176 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.573194 <... close resumed> ) = 0
[pid 25480] 10:12:35.573208 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.573224 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.573233 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.573248 read(6,  <unfinished ...>
[pid 25472] 10:12:35.573258 mmap(0x7ff0fd450000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25481] 10:12:35.573281 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.573492 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.573522 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.573539 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.573557 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.573581 <... mmap resumed> ) = 0x7ff0fd450000
[pid 25481] 10:12:35.573617 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.573637 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.573654 read(13,  <unfinished ...>
[pid 25474] 10:12:35.573678 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.573709 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.573732 close(6 <unfinished ...>
[pid 25481] 10:12:35.573764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.573795 read(13,  <unfinished ...>
[pid 25479] 10:12:35.573818 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.573837 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.573855 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.573886 <... close resumed> ) = 0
[pid 25481] 10:12:35.573929 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.573949 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.574006 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.574035 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.574073 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.574103 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.574143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.574172 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25479] 10:12:35.574195 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.574213 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.574234 <... mmap resumed> ) = 0x7f7c12074000
[pid 25472] 10:12:35.574251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.574277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.574296 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.574313 read(13,  <unfinished ...>
[pid 25474] 10:12:35.574337 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.574369 mprotect(0x7f7c1209d000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.574398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.574439 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.574467 read(13,  <unfinished ...>
[pid 25479] 10:12:35.574490 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.574600 <... open resumed> ) = 6
[pid 25473] 10:12:35.574623 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.574640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.574666 <... open resumed> ) = 6
[pid 25480] 10:12:35.574682 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.574701 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.574731 read(6,  <unfinished ...>
[pid 25473] 10:12:35.574755 mmap(0x7f7c1229d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25472] 10:12:35.574787 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.574829 read(6,  <unfinished ...>
[pid 25480] 10:12:35.574859 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.574883 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.574907 <... mmap resumed> ) = 0x7f7c1229d000
[pid 25472] 10:12:35.574928 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.574955 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.574978 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.574995 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.575018 mmap(0x7f7c1229f000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.575046 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.575086 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.575109 read(13,  <unfinished ...>
[pid 25474] 10:12:35.575131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.575166 <... mmap resumed> ) = 0x7f7c1229f000
[pid 25472] 10:12:35.575188 <... open resumed> ) = 6
[pid 25481] 10:12:35.575213 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.575242 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.575272 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.575300 close(6 <unfinished ...>
[pid 25472] 10:12:35.575326 read(6,  <unfinished ...>
[pid 25481] 10:12:35.575359 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.575384 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.575412 <... mmap resumed> ) = 0x7f84e3f47000
[pid 25473] 10:12:35.575433 <... close resumed> ) = 0
[pid 25472] 10:12:35.575459 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25481] 10:12:35.575489 <... mmap resumed> ) = 0x7f04ce1ca000
[pid 25474] 10:12:35.575610 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.575645 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.575676 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.575706 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.575732 <... mmap resumed> ) = 0x7f84e3901000
[pid 25473] 10:12:35.575748 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.575765 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25481] 10:12:35.575802 <... mmap resumed> ) = 0x7f04cdb84000
[pid 25474] 10:12:35.575819 mprotect(0x7f84e3917000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.575847 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.575878 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25481] 10:12:35.575914 mprotect(0x7f04cdb9a000, 2093056, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.575940 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.575956 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.575973 <... mmap resumed> ) = 0x7ff0fd031000
[pid 25481] 10:12:35.575995 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.576011 mmap(0x7f84e3b16000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25473] 10:12:35.576041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.576070 mprotect(0x7ff0fd03b000, 2093056, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.576102 mmap(0x7f04cdd99000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25474] 10:12:35.576130 <... mmap resumed> ) = 0x7f84e3b16000
[pid 25473] 10:12:35.576156 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.576175 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.576198 <... mmap resumed> ) = 0x7f04cdd99000
[pid 25474] 10:12:35.576218 mmap(0x7f84e3b18000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.576246 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.576276 mmap(0x7ff0fd23a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25481] 10:12:35.576312 mmap(0x7f04cdd9b000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.576339 <... mmap resumed> ) = 0x7f84e3b18000
[pid 25473] 10:12:35.576361 <... open resumed> ) = 6
[pid 25472] 10:12:35.576379 <... mmap resumed> ) = 0x7ff0fd23a000
[pid 25481] 10:12:35.576414 <... mmap resumed> ) = 0x7f04cdd9b000
[pid 25474] 10:12:35.576438 close(6 <unfinished ...>
[pid 25473] 10:12:35.576467 read(6,  <unfinished ...>
[pid 25472] 10:12:35.576490 close(6 <unfinished ...>
[pid 25481] 10:12:35.576608 close(6 <unfinished ...>
[pid 25474] 10:12:35.576634 <... close resumed> ) = 0
[pid 25473] 10:12:35.576656 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.576681 <... close resumed> ) = 0
[pid 25481] 10:12:35.576712 <... close resumed> ) = 0
[pid 25474] 10:12:35.576735 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.576766 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.576789 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.576824 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.576852 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.576869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25472] 10:12:35.576899 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.576923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.576940 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.576971 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.576997 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.577034 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.577063 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.577080 <... mmap resumed> ) = 0x7f7c15c97000
[pid 25472] 10:12:35.577101 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.577125 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.577142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.577171 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.577200 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.577241 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.577270 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.577291 <... mmap resumed> ) = 0x7f7c11e5e000
[pid 25472] 10:12:35.577309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.577334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.577355 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.577386 mprotect(0x7f7c11e73000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.577413 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.577449 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.577478 <... open resumed> ) = 6
[pid 25473] 10:12:35.577493 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.577588 <... open resumed> ) = 6
[pid 25481] 10:12:35.577618 <... open resumed> ) = 6
[pid 25479] 10:12:35.577635 <... select resumed> ) = 1 (in [11], left {299, 997135})
[pid 25474] 10:12:35.577660 read(6,  <unfinished ...>
[pid 25473] 10:12:35.577684 mmap(0x7f7c12072000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25472] 10:12:35.577714 read(6,  <unfinished ...>
[pid 25481] 10:12:35.577745 read(6,  <unfinished ...>
[pid 25479] 10:12:35.577768 recvfrom(11,  <unfinished ...>
[pid 25474] 10:12:35.577792 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.577818 <... mmap resumed> ) = 0x7f7c12072000
[pid 25472] 10:12:35.577849 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25481] 10:12:35.577883 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25479] 10:12:35.577907 <... recvfrom resumed> "220 mx1.emailsrvr.com ESMTP - VA Code Section 18.2-152.3:1 forbids sending spam through this system\r\n", 4096, 0, NULL, NULL) = 101
[pid 25474] 10:12:35.577944 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.577970 close(6 <unfinished ...>
[pid 25472] 10:12:35.577992 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.578024 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.578047 <... select resumed> ) = 1 (in [11], left {299, 997489})
[pid 25479] 10:12:35.578070 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25474] 10:12:35.578117 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.578155 <... close resumed> ) = 0
[pid 25472] 10:12:35.578189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25481] 10:12:35.578232 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.578262 recvfrom(11,  <unfinished ...>
[pid 25479] 10:12:35.578287 <... sendto resumed> ) = 33
[pid 25474] 10:12:35.578303 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.578332 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.578362 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25481] 10:12:35.578401 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.578427 <... recvfrom resumed> "220 mx1.emailsrvr.com ESMTP - VA Code Section 18.2-152.3:1 forbids sending spam through this system\r\n", 4096, 0, NULL, NULL) = 101
[pid 25479] 10:12:35.578457 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.578488 <... mmap resumed> ) = 0x7f84e36ca000
[pid 25473] 10:12:35.578504 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.578647 <... mmap resumed> ) = 0x7ff0fce2e000
[pid 25481] 10:12:35.578675 <... mmap resumed> ) = 0x7f04cd94d000
[pid 25480] 10:12:35.578692 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25474] 10:12:35.578736 mprotect(0x7f84e36d1000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.578765 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.578798 mprotect(0x7ff0fce30000, 2093056, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.578832 mprotect(0x7f04cd954000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.578859 <... sendto resumed> ) = 33
[pid 25474] 10:12:35.578876 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.578891 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.578908 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.578931 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.578947 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.578975 mmap(0x7f84e38d1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25473] 10:12:35.579004 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.579033 mmap(0x7ff0fd02f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25481] 10:12:35.579067 mmap(0x7f04cdb54000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25474] 10:12:35.579095 <... mmap resumed> ) = 0x7f84e38d1000
[pid 25473] 10:12:35.579116 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.579135 <... mmap resumed> ) = 0x7ff0fd02f000
[pid 25481] 10:12:35.579165 <... mmap resumed> ) = 0x7f04cdb54000
[pid 25474] 10:12:35.579188 mmap(0x7f84e38d3000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.579216 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.579246 close(6 <unfinished ...>
[pid 25481] 10:12:35.579275 mmap(0x7f04cdb56000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.579302 <... mmap resumed> ) = 0x7f84e38d3000
[pid 25473] 10:12:35.579328 <... open resumed> ) = 6
[pid 25472] 10:12:35.579348 <... close resumed> ) = 0
[pid 25481] 10:12:35.579378 <... mmap resumed> ) = 0x7f04cdb56000
[pid 25474] 10:12:35.579400 close(6 <unfinished ...>
[pid 25473] 10:12:35.579424 read(6,  <unfinished ...>
[pid 25472] 10:12:35.579447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.579479 close(6 <unfinished ...>
[pid 25474] 10:12:35.579502 <... close resumed> ) = 0
[pid 25473] 10:12:35.579601 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.579635 <... mmap resumed> ) = 0x7ff101074000
[pid 25481] 10:12:35.579681 <... close resumed> ) = 0
[pid 25474] 10:12:35.579706 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.579737 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.579760 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.579795 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.579822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.579840 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.579871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.579894 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.579911 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.579942 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.579971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.580008 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.580038 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.580054 <... mmap resumed> ) = 0x7f7c11c53000
[pid 25472] 10:12:35.580071 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.580094 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.580111 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.580141 mprotect(0x7f7c11c5d000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.580167 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.580203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.580232 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.580250 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.580267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.580291 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.580309 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.580341 mmap(0x7f7c11e5c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25472] 10:12:35.580375 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.580411 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.580438 <... open resumed> ) = 6
[pid 25473] 10:12:35.580454 <... mmap resumed> ) = 0x7f7c11e5c000
[pid 25472] 10:12:35.580478 <... open resumed> ) = 6
[pid 25481] 10:12:35.580502 <... open resumed> ) = 6
[pid 25474] 10:12:35.580604 read(6,  <unfinished ...>
[pid 25473] 10:12:35.580633 close(6 <unfinished ...>
[pid 25472] 10:12:35.580658 read(6,  <unfinished ...>
[pid 25481] 10:12:35.580696 read(6,  <unfinished ...>
[pid 25474] 10:12:35.580720 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.580744 <... close resumed> ) = 0
[pid 25472] 10:12:35.580769 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25481] 10:12:35.580799 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.580822 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.580845 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.580873 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.580903 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.580925 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.580955 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.580972 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25481] 10:12:35.581008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25474] 10:12:35.581037 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.581065 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.581096 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25481] 10:12:35.581136 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.581162 <... mmap resumed> ) = 0x7f84e3446000
[pid 25473] 10:12:35.581178 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.581195 <... mmap resumed> ) = 0x7ff0fcc0f000
[pid 25481] 10:12:35.581217 <... mmap resumed> ) = 0x7f04cd6c9000
[pid 25474] 10:12:35.581234 mprotect(0x7f84e34c9000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.581261 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.581289 mprotect(0x7ff0fcc2c000, 2093056, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.581322 mprotect(0x7f04cd74c000, 2093056, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.581350 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.581366 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.581384 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.581406 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.581422 mmap(0x7f84e36c8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25473] 10:12:35.581450 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.581480 mmap(0x7ff0fce2b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25481] 10:12:35.581629 mmap(0x7f04cd94b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25474] 10:12:35.581661 <... mmap resumed> ) = 0x7f84e36c8000
[pid 25473] 10:12:35.581686 <... open resumed> ) = 6
[pid 25472] 10:12:35.581705 <... mmap resumed> ) = 0x7ff0fce2b000
[pid 25481] 10:12:35.581731 <... mmap resumed> ) = 0x7f04cd94b000
[pid 25474] 10:12:35.581755 close(6 <unfinished ...>
[pid 25473] 10:12:35.581779 read(6,  <unfinished ...>
[pid 25472] 10:12:35.581802 mmap(0x7ff0fce2d000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.581837 close(6 <unfinished ...>
[pid 25474] 10:12:35.581859 <... close resumed> ) = 0
[pid 25473] 10:12:35.581881 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.581906 <... mmap resumed> ) = 0x7ff0fce2d000
[pid 25481] 10:12:35.581934 <... close resumed> ) = 0
[pid 25474] 10:12:35.581957 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.581988 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.582011 close(6 <unfinished ...>
[pid 25481] 10:12:35.582039 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.582067 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.582084 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25472] 10:12:35.582115 <... close resumed> ) = 0
[pid 25481] 10:12:35.582172 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.582192 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.582223 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.582253 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.582290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.582321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.582338 <... mmap resumed> ) = 0x7f7c11a50000
[pid 25472] 10:12:35.582354 <... mmap resumed> ) = 0x7ff101073000
[pid 25481] 10:12:35.582415 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.582434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.582464 mprotect(0x7f7c11a52000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.582491 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.582527 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.582557 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.582575 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.582591 <... mmap resumed> ) = 0x7ff101072000
[pid 25481] 10:12:35.582622 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.582644 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.582674 mmap(0x7f7c11c51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25472] 10:12:35.582704 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.582736 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.582764 <... open resumed> ) = 6
[pid 25473] 10:12:35.582780 <... mmap resumed> ) = 0x7f7c11c51000
[pid 25472] 10:12:35.582804 <... mmap resumed> ) = 0x7ff101070000
[pid 25481] 10:12:35.582832 <... open resumed> ) = 6
[pid 25474] 10:12:35.582849 read(6,  <unfinished ...>
[pid 25473] 10:12:35.582873 close(6 <unfinished ...>
[pid 25472] 10:12:35.582895 arch_prctl(ARCH_SET_FS, 0x7ff1010707c0 <unfinished ...>
[pid 25481] 10:12:35.582925 read(6,  <unfinished ...>
[pid 25474] 10:12:35.582949 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.582971 <... close resumed> ) = 0
[pid 25472] 10:12:35.582994 <... arch_prctl resumed> ) = 0
[pid 25481] 10:12:35.583056 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.583080 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.583103 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.583129 mprotect(0x7ff0fce2b000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.583162 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.583186 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25473] 10:12:35.583213 <... mmap resumed> ) = 0x7f7c15c96000
[pid 25472] 10:12:35.583237 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.583256 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25474] 10:12:35.583276 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.583287 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.583302 mprotect(0x7ff0fd02f000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.583319 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.583330 <... mmap resumed> ) = 0x7f84e3f46000
[pid 25473] 10:12:35.583344 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.583354 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.583384 <... mmap resumed> ) = 0x7f04ce1c9000
[pid 25474] 10:12:35.583396 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.583408 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.583424 mprotect(0x7ff0fd23a000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.583442 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.583453 <... mmap resumed> ) = 0x7f84e3238000
[pid 25473] 10:12:35.583461 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.583470 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.583492 <... mmap resumed> ) = 0x7f04cd4bb000
[pid 25474] 10:12:35.583501 mprotect(0x7f84e3244000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.583716 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.583750 mprotect(0x7ff0fd450000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.583783 mprotect(0x7f04cd4c7000, 2097152, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.583809 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.583825 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.583843 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.583879 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.583897 mmap(0x7f84e3444000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25473] 10:12:35.583926 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.583955 mprotect(0x7ff0fd67b000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.583987 mmap(0x7f04cd6c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25474] 10:12:35.584014 <... mmap resumed> ) = 0x7f84e3444000
[pid 25473] 10:12:35.584039 <... open resumed> ) = 6
[pid 25472] 10:12:35.584057 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.584089 <... mmap resumed> ) = 0x7f04cd6c7000
[pid 25474] 10:12:35.584114 close(6 <unfinished ...>
[pid 25473] 10:12:35.584138 read(6,  <unfinished ...>
[pid 25472] 10:12:35.584161 mprotect(0x7ff0fd880000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.584193 close(6 <unfinished ...>
[pid 25474] 10:12:35.584215 <... close resumed> ) = 0
[pid 25473] 10:12:35.584237 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.584262 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.584394 <... close resumed> ) = 0
[pid 25474] 10:12:35.584424 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.584459 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.584482 mprotect(0x7ff0fdb5d000, 40960, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.584580 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.584615 <... open resumed> ) = 6
[pid 25473] 10:12:35.584631 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25472] 10:12:35.584662 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.584768 <... open resumed> ) = 6
[pid 25474] 10:12:35.584787 read(6,  <unfinished ...>
[pid 25473] 10:12:35.584810 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.584839 mprotect(0x7ff0fddaa000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.584871 read(6,  <unfinished ...>
[pid 25474] 10:12:35.584894 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.584918 <... mmap resumed> ) = 0x7f7c11831000
[pid 25472] 10:12:35.584934 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.584968 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.584992 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.585015 mprotect(0x7f7c1184e000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.585041 mprotect(0x7ff0fdfc4000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.585073 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.585096 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25473] 10:12:35.585126 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.585142 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.585167 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25474] 10:12:35.585197 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.585224 mmap(0x7f7c11a4d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25472] 10:12:35.585254 mprotect(0x7ff0fe1d1000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.585286 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.585314 <... mmap resumed> ) = 0x7f84e3015000
[pid 25473] 10:12:35.585330 <... mmap resumed> ) = 0x7f7c11a4d000
[pid 25472] 10:12:35.585356 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.585643 <... mmap resumed> ) = 0x7f04cd298000
[pid 25474] 10:12:35.585667 mprotect(0x7f84e3036000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.585694 mmap(0x7f7c11a4f000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.585724 mprotect(0x7ff0fe9bd000, 110592, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.585757 mprotect(0x7f04cd2b9000, 2097152, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.585782 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.585798 <... mmap resumed> ) = 0x7f7c11a4f000
[pid 25472] 10:12:35.585819 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.585908 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.585926 mmap(0x7f84e3236000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25473] 10:12:35.585955 close(6 <unfinished ...>
[pid 25472] 10:12:35.585977 mprotect(0x7ff0fec49000, 16384, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.586009 mmap(0x7f04cd4b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25474] 10:12:35.586035 <... mmap resumed> ) = 0x7f84e3236000
[pid 25473] 10:12:35.586055 <... close resumed> ) = 0
[pid 25472] 10:12:35.586104 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.586209 <... mmap resumed> ) = 0x7f04cd4b9000
[pid 25474] 10:12:35.586233 close(6 <unfinished ...>
[pid 25473] 10:12:35.586257 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.586283 mprotect(0x7ff0fefde000, 16384, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.586327 close(6 <unfinished ...>
[pid 25474] 10:12:35.586351 <... close resumed> ) = 0
[pid 25473] 10:12:35.586374 <... mmap resumed> ) = 0x7f7c15c95000
[pid 25472] 10:12:35.586426 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.586454 <... close resumed> ) = 0
[pid 25474] 10:12:35.586478 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.586579 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.586611 mprotect(0x7ff0ff1e9000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.586645 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.586675 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.586694 <... mmap resumed> ) = 0x7f7c15c94000
[pid 25472] 10:12:35.586719 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.586751 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.586769 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.586801 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.586826 mprotect(0x7ff0ff3ed000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.586858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.586889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.586906 <... mmap resumed> ) = 0x7f7c15c92000
[pid 25472] 10:12:35.586937 <... mprotect resumed> ) = 0
Process 25483 attached
[pid 25481] 10:12:35.587643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.587685 <... select resumed> ) = 1 (in [11], left {299, 991399})
[pid 25479] 10:12:35.587709 <... select resumed> ) = 1 (in [11], left {299, 990908})
[pid 25474] 10:12:35.587728 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.587760 arch_prctl(ARCH_SET_FS, 0x7f7c15c927c0 <unfinished ...>
[pid 25472] 10:12:35.587783 mprotect(0x7ff100145000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.587820 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25481] 10:12:35.587843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.587882 recvfrom(11,  <unfinished ...>
[pid 25479] 10:12:35.587907 recvfrom(11,  <unfinished ...>
[pid 25474] 10:12:35.587930 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.587949 <... arch_prctl resumed> ) = 0
[pid 25472] 10:12:35.587995 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.588043 <... set_robust_list resumed> ) = 0
[pid 25481] 10:12:35.588058 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.588100 <... recvfrom resumed> "250-smtp48.gate.dfw1a.rsapps.net says EHLO to 50.116.78.207:52769\r\n250-ENHANCEDSTATUSCODES\r\n250-STARTTLS\r\n250-8BITMIME\r\n250-SIZE 75000000\r\n250 PIPELINING\r\n", 4096, 0, NULL, NULL) = 155
[pid 25479] 10:12:35.588149 <... recvfrom resumed> "250-smtp48.gate.dfw1a.rsapps.net says EHLO to 50.116.78.207:52768\r\n250-ENHANCEDSTATUSCODES\r\n250-STARTTLS\r\n250-PIPELINING\r\n250-SIZE 75000000\r\n250 8BITMIME\r\n", 4096, 0, NULL, NULL) = 155
[pid 25474] 10:12:35.588186 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.588219 mprotect(0x7f7c11a4d000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.588245 mprotect(0x7ff10057a000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.588282 close(14 <unfinished ...>
[pid 25481] 10:12:35.588304 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.588333 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0 <unfinished ...>
[pid 25479] 10:12:35.588380 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0 <unfinished ...>
[pid 25474] 10:12:35.588420 <... open resumed> ) = 6
[pid 25473] 10:12:35.588437 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.588458 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.588491 <... close resumed> ) = 0
[pid 25481] 10:12:35.588589 <... open resumed> ) = 6
[pid 25480] 10:12:35.588614 <... sendto resumed> ) = 10
[pid 25479] 10:12:35.588635 <... sendto resumed> ) = 10
[pid 25474] 10:12:35.588655 read(6,  <unfinished ...>
[pid 25473] 10:12:35.588680 mprotect(0x7f7c11c51000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.588705 mprotect(0x7ff1007fe000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.588741 geteuid( <unfinished ...>
[pid 25481] 10:12:35.588763 read(6,  <unfinished ...>
[pid 25480] 10:12:35.588786 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25479] 10:12:35.588814 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.588839 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.588862 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.588891 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.588920 <... geteuid resumed> ) = 0
[pid 25481] 10:12:35.588935 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.588959 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.588983 mprotect(0x7f7c11e5c000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.589008 mprotect(0x7ff100a07000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.589046 getegid( <unfinished ...>
[pid 25481] 10:12:35.589068 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.589091 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.589122 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.589145 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.589184 <... getegid resumed> ) = 12
[pid 25481] 10:12:35.589199 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25474] 10:12:35.589234 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.589263 mprotect(0x7f7c12072000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.589288 mprotect(0x7ff100c4c000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.589322 setgid(500 <unfinished ...>
[pid 25481] 10:12:35.589345 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.589370 <... mmap resumed> ) = 0x7f84e2df8000
[pid 25473] 10:12:35.589386 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.589413 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.589445 <... setgid resumed> ) = 0
[pid 25481] 10:12:35.589459 <... mmap resumed> ) = 0x7f04cd07b000
[pid 25474] 10:12:35.589478 mprotect(0x7f84e2e0f000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.589505 mprotect(0x7f7c1229d000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.589619 mprotect(0x7ff100e66000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.589664 setuid(503 <unfinished ...>
[pid 25481] 10:12:35.589689 mprotect(0x7f04cd092000, 2097152, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.589715 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.589731 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.589756 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.589804 <... setuid resumed> ) = 0
[pid 25481] 10:12:35.589819 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.589867 mmap(0x7f84e300f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25473] 10:12:35.589901 mprotect(0x7f7c124a2000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.589927 mprotect(0x7ff101089000, 4096, PROT_READ <unfinished ...>
[pid 25483] 10:12:35.589960 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.589991 mmap(0x7f04cd292000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25474] 10:12:35.590020 <... mmap resumed> ) = 0x7f84e300f000
[pid 25473] 10:12:35.590041 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.590147 <... mprotect resumed> ) = 0
[pid 25483] 10:12:35.590174 <... open resumed> ) = 9
[pid 25481] 10:12:35.590187 <... mmap resumed> ) = 0x7f04cd292000
[pid 25474] 10:12:35.590223 mmap(0x7f84e3011000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.590254 mprotect(0x7f7c1277f000, 40960, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.590280 munmap(0x7ff10107e000, 39387Process 25482 attached
 <unfinished ...>
[pid 25483] 10:12:35.590329 fstat(9,  <unfinished ...>
[pid 25481] 10:12:35.590368 mmap(0x7f04cd294000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.590398 <... mmap resumed> ) = 0x7f84e3011000
[pid 25473] 10:12:35.590419 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.590567 <... munmap resumed> ) = 0
[pid 25483] 10:12:35.590600 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25482] 10:12:35.590644 set_robust_list(0x7fdec5aa2aa0, 24 <unfinished ...>
[pid 25481] 10:12:35.590694 <... mmap resumed> ) = 0x7f04cd294000
[pid 25474] 10:12:35.590716 close(6 <unfinished ...>
[pid 25473] 10:12:35.590740 mprotect(0x7f7c129cc000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.590765 set_tid_address(0x7ff101070a90 <unfinished ...>
[pid 25483] 10:12:35.590797 brk(0x1667000 <unfinished ...>
[pid 25482] 10:12:35.590825 <... set_robust_list resumed> ) = 0
[pid 25481] 10:12:35.590843 close(6 <unfinished ...>
[pid 25474] 10:12:35.590893 <... close resumed> ) = 0
[pid 25473] 10:12:35.590916 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.590943 <... set_tid_address resumed> ) = 25472
[pid 25483] 10:12:35.590970 <... brk resumed> ) = 0x1667000
[pid 25482] 10:12:35.590984 fcntl(12, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.591236 <... close resumed> ) = 0
[pid 25474] 10:12:35.591263 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.591296 mprotect(0x7f7c12be6000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.591325 set_robust_list(0x7ff101070aa0, 24 <unfinished ...>
[pid 25483] 10:12:35.591358 fstat(9,  <unfinished ...>
[pid 25482] 10:12:35.591382 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.591396 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.591427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.591445 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.591466 <... set_robust_list resumed> ) = 0
[pid 25483] 10:12:35.591571 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25482] 10:12:35.591613 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.591648 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.591670 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.591703 mprotect(0x7f7c12df3000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.591730 futex(0x7ffdc18204ac, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25483] 10:12:35.591763 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.591790 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.591804 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.591839 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.591856 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.592046 <... futex resumed> ) = 0
[pid 25483] 10:12:35.592073 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25482] 10:12:35.592088 close(6 <unfinished ...>
[pid 25481] 10:12:35.592112 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.592130 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.592159 mprotect(0x7f7c135df000, 110592, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.592185 futex(0x7ffdc18204ac, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7ff1010707c0 <unfinished ...>
[pid 25483] 10:12:35.592218 read(9,  <unfinished ...>
[pid 25482] 10:12:35.592251 <... close resumed> ) = 0
[pid 25481] 10:12:35.592265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.592321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.592340 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.592415 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25483] 10:12:35.592447 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25482] 10:12:35.592473 open("/var/spool/exim/input/Y/1aEJMY-0006cE-He-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.592582 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.592614 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.592647 mprotect(0x7f7c1386b000, 16384, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.592680 rt_sigaction(SIGRTMIN, {0x7ff0fff33c60, [], SA_RESTORER|SA_SIGINFO, 0x7ff0fff3d790},  <unfinished ...>
[pid 25483] 10:12:35.592719 read(9,  <unfinished ...>
[pid 25482] 10:12:35.592746 <... open resumed> ) = 6
[pid 25481] 10:12:35.592760 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.592799 <... open resumed> ) = 6
[pid 25473] 10:12:35.592815 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.592901 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25483] 10:12:35.592930 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25482] 10:12:35.592949 fcntl(6, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.592976 <... open resumed> ) = 6
[pid 25474] 10:12:35.592992 read(6,  <unfinished ...>
[pid 25473] 10:12:35.593015 mprotect(0x7f7c13c00000, 16384, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.593040 rt_sigaction(SIGRT_1, {0x7ff0fff33cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7ff0fff3d790},  <unfinished ...>
[pid 25483] 10:12:35.593076 close(9 <unfinished ...>
[pid 25482] 10:12:35.593100 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.593113 read(6,  <unfinished ...>
[pid 25474] 10:12:35.593138 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.593161 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.593180 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25483] 10:12:35.593205 <... close resumed> ) = 0
[pid 25482] 10:12:35.593219 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.593243 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.593265 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.593288 mprotect(0x7f7c13e0b000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.593312 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25483] 10:12:35.593349 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25482] 10:12:35.593375 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.593389 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.593449 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25473] 10:12:35.593486 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.593592 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25483] 10:12:35.593641 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.593658 geteuid( <unfinished ...>
[pid 25481] 10:12:35.594080 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25474] 10:12:35.594115 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.594144 mprotect(0x7f7c1400f000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.594170 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25483] 10:12:35.594203 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.594228 <... geteuid resumed> ) = 0
[pid 25481] 10:12:35.594242 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.594269 <... mmap resumed> ) = 0x7f84e3f45000
[pid 25473] 10:12:35.594289 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.594900 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25483] 10:12:35.594975 <... lseek resumed> ) = 19
[pid 25482] 10:12:35.594993 getegid( <unfinished ...>
[pid 25481] 10:12:35.595017 <... mmap resumed> ) = 0x7f04ce1c8000
[pid 25474] 10:12:35.595037 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.595066 mprotect(0x7f7c14d67000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.595092 statfs("/selinux",  <unfinished ...>
[pid 25483] 10:12:35.595135 read(6,  <unfinished ...>
[pid 25482] 10:12:35.595158 <... getegid resumed> ) = 12
[pid 25481] 10:12:35.595172 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.595202 <... mmap resumed> ) = 0x7f84e2a84000
[pid 25473] 10:12:35.595218 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.595250 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350341, f_bavail=6350341, f_files=1000000, f_ffree=691100, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25483] 10:12:35.595326 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2446) = 1858
[pid 25482] 10:12:35.595348 setgid(12 <unfinished ...>
[pid 25481] 10:12:35.595828 <... mmap resumed> ) = 0x7f04ccd07000
[pid 25474] 10:12:35.595847 mprotect(0x7f84e2bf3000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.595876 mprotect(0x7f7c1519c000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.595901 brk(0 <unfinished ...>
[pid 25483] 10:12:35.595933 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25482] 10:12:35.595964 <... setgid resumed> ) = 0
[pid 25481] 10:12:35.595978 mprotect(0x7f04cce76000, 2093056, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.596006 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.596022 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.596042 <... brk resumed> ) = 0x271f000
[pid 25483] 10:12:35.596070 <... write resumed> ) = 4
[pid 25482] 10:12:35.596083 setuid(47 <unfinished ...>
[pid 25481] 10:12:35.596108 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.596124 mmap(0x7f84e2df2000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25473] 10:12:35.596153 mprotect(0x7f7c15420000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.596179 brk(0x2740000 <unfinished ...>
[pid 25458] 10:12:35.596202 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25483] 10:12:35.596231 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25482] 10:12:35.596255 <... setuid resumed> ) = 0
[pid 25481] 10:12:35.596268 mmap(0x7f04cd075000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25474] 10:12:35.596305 <... mmap resumed> ) = 0x7f84e2df2000
[pid 25473] 10:12:35.596330 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.596353 <... brk resumed> ) = 0x2740000
[pid 25458] 10:12:35.596380 read(14,  <unfinished ...>
[pid 25483] 10:12:35.596415 <... write resumed> ) = 4
[pid 25482] 10:12:35.596429 close(11 <unfinished ...>
[pid 25481] 10:12:35.596452 <... mmap resumed> ) = 0x7f04cd075000
[pid 25474] 10:12:35.596476 close(6 <unfinished ...>
[pid 25473] 10:12:35.596589 mprotect(0x7f7c15629000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.596623 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.596662 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25483] 10:12:35.596693 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25482] 10:12:35.596719 <... close resumed> ) = 0
[pid 25481] 10:12:35.596732 close(6 <unfinished ...>
[pid 25480] 10:12:35.596926 <... select resumed> ) = 1 (in [11], left {299, 992310})
[pid 25474] 10:12:35.596948 <... close resumed> ) = 0
[pid 25473] 10:12:35.596971 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.597003 <... open resumed> ) = 6
[pid 25458] 10:12:35.597031 read(14,  <unfinished ...>
[pid 25483] 10:12:35.597066 <... write resumed> ) = 4
[pid 25482] 10:12:35.597080 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.597111 <... close resumed> ) = 0
[pid 25480] 10:12:35.597135 recvfrom(11,  <unfinished ...>
[pid 25474] 10:12:35.597160 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.597190 mprotect(0x7f7c1586e000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.597217 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.597240 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25483] 10:12:35.597279 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25482] 10:12:35.597306 <... socket resumed> ) = 10
[pid 25481] 10:12:35.597319 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.597349 <... recvfrom resumed> "220 continue\r\n", 4096, 0, NULL, NULL) = 14
[pid 25479] 10:12:35.599339 <... select resumed> ) = 1 (in [11], left {299, 991572})
[pid 25474] 10:12:35.599375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.599395 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.599420 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:35.599453 read(14,  <unfinished ...>
[pid 25483] 10:12:35.599495 <... write resumed> ) = 40
[pid 25482] 10:12:35.599513 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.599555 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.599574 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25479] 10:12:35.599616 recvfrom(11,  <unfinished ...>
[pid 25474] 10:12:35.599644 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.599681 mprotect(0x7f7c15a88000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.599708 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.599735 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25483] 10:12:35.599768 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25482] 10:12:35.599794 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.599808 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.599841 <... open resumed> ) = 14
[pid 25479] 10:12:35.599867 <... recvfrom resumed> "220 continue\r\n", 4096, 0, NULL, NULL) = 14
[pid 25474] 10:12:35.601788 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.601821 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.601864 <... mmap resumed> ) = 0x7ff101087000
[pid 25458] 10:12:35.601884 read(14,  <unfinished ...>
[pid 25483] 10:12:35.601923 <... write resumed> ) = 4
[pid 25482] 10:12:35.601937 close(10 <unfinished ...>
[pid 25481] 10:12:35.601966 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.601984 fstat(14,  <unfinished ...>
[pid 25479] 10:12:35.602008 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25474] 10:12:35.602038 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.602069 mprotect(0x7f7c15cab000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.602096 read(6,  <unfinished ...>
[pid 25458] 10:12:35.602187 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25483] 10:12:35.602219 close(15 <unfinished ...>
[pid 25482] 10:12:35.602243 <... close resumed> ) = 0
[pid 25481] 10:12:35.602257 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.602291 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25479] 10:12:35.602326 <... open resumed> ) = 14
[pid 25474] 10:12:35.602346 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.602366 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.602382 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25458] 10:12:35.602410 wait4(-1,  <unfinished ...>
[pid 25483] 10:12:35.602445 <... close resumed> ) = 0
[pid 25482] 10:12:35.602459 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.602497 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.602521 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25479] 10:12:35.602549 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.602571 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.602604 munmap(0x7f7c15ca0000, 39387 <unfinished ...>
[pid 25472] 10:12:35.602634 read(6,  <unfinished ...>
[pid 25483] 10:12:35.602669 exit_group(0) = ?
[pid 25482] 10:12:35.602682 <... socket resumed> ) = 10
[pid 25481] 10:12:35.602959 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.603001 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25479] 10:12:35.603023 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25474] 10:12:35.603057 <... open resumed> ) = 6
[pid 25473] 10:12:35.603073 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.603089 <... read resumed> "", 1024) = 0
[pid 25483] 10:12:35.603137 +++ exited with 0 +++
[pid 25482] 10:12:35.603151 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.603183 <... open resumed> ) = 6
[pid 25480] 10:12:35.603201 read(14,  <unfinished ...>
[pid 25479] 10:12:35.603229 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25474] 10:12:35.603254 read(6,  <unfinished ...>
[pid 25473] 10:12:35.603277 set_tid_address(0x7f7c15c92a90 <unfinished ...>
[pid 25472] 10:12:35.603300 close(6 <unfinished ...>
[pid 25458] 10:12:35.603327 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25483
[pid 25482] 10:12:35.603357 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.603377 read(6,  <unfinished ...>
[pid 25480] 10:12:35.603403 <... read resumed> "\256f,\250)=\320Z\343\253\v\3033vgH\n3\354\345r\"\273\275\251{\345:\367E`v]f\235\365OM\364\23\275\311m\322\246\35nm", 48) = 48
[pid 25479] 10:12:35.603424 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25474] 10:12:35.603446 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.603470 <... set_tid_address resumed> ) = 25473
[pid 25472] 10:12:35.603485 <... close resumed> ) = 0
[pid 25458] 10:12:35.603501 close(14 <unfinished ...>
[pid 25482] 10:12:35.603655 close(10 <unfinished ...>
[pid 25481] 10:12:35.603682 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.603707 close(14 <unfinished ...>
[pid 25479] 10:12:35.603730 read(14,  <unfinished ...>
[pid 25474] 10:12:35.603756 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.603779 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25472] 10:12:35.603801 munmap(0x7ff101087000, 4096 <unfinished ...>
[pid 25458] 10:12:35.603828 <... close resumed> ) = 0
[pid 25482] 10:12:35.603860 <... close resumed> ) = 0
[pid 25481] 10:12:35.603879 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.603949 <... close resumed> ) = 0
[pid 25479] 10:12:35.603983 <... read resumed> "\326|@I\320z\25\360\214c\251a\256\250\204\rKE\263e\246o\317]\363|f\355\26>\336!\3561t\201\217\2024\232\231\\\356C\304\316\204\240", 48) = 48
[pid 25474] 10:12:35.604005 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25473] 10:12:35.604037 <... set_robust_list resumed> ) = 0
[pid 25472] 10:12:35.604053 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.604118 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25482] 10:12:35.604162 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.604193 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25480] 10:12:35.604224 getuid( <unfinished ...>
[pid 25479] 10:12:35.604247 close(14 <unfinished ...>
[pid 25474] 10:12:35.604271 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.604300 futex(0x7ffdac37fa1c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25472] 10:12:35.604324 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25458] 10:12:35.604367 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25482] 10:12:35.604423 <... open resumed> ) = 10
[pid 25481] 10:12:35.604440 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.604484 <... getuid resumed> ) = 47
[pid 25479] 10:12:35.609897 <... close resumed> ) = 0
[pid 25474] 10:12:35.609946 <... mmap resumed> ) = 0x7f84e27f5000
[pid 25473] 10:12:35.609967 <... futex resumed> ) = 0
[pid 25472] 10:12:35.609984 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.610068 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.610432 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.610461 <... mmap resumed> ) = 0x7f04cca78000
[pid 25479] 10:12:35.610478 getuid( <unfinished ...>
[pid 25474] 10:12:35.610500 mprotect(0x7f84e2880000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.610578 futex(0x7ffdac37fa1c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f7c15c927c0 <unfinished ...>
[pid 25472] 10:12:35.610605 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff0fff3d790},  <unfinished ...>
[pid 25458] 10:12:35.610633 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.610692 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.610722 mprotect(0x7f04ccb03000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.610753 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.610777 <... getuid resumed> ) = 47
[pid 25474] 10:12:35.616447 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.616476 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25472] 10:12:35.616501 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.616533 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.616577 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.616606 <... mprotect resumed> ) = 0
[pid 25479] 10:12:35.616623 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.616645 mmap(0x7f84e2a80000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25473] 10:12:35.616676 rt_sigaction(SIGRTMIN, {0x7f7c14b55c60, [], SA_RESTORER|SA_SIGINFO, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.616704 fstat(2,  <unfinished ...>
[pid 25458] 10:12:35.616727 <... open resumed> ) = 9
[pid 25482] 10:12:35.616753 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25481] 10:12:35.616768 mmap(0x7f04ccd03000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25474] 10:12:35.616797 <... mmap resumed> ) = 0x7f84e2a80000
[pid 25473] 10:12:35.616818 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.616839 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25458] 10:12:35.616911 fstat(9,  <unfinished ...>
[pid 25481] 10:12:35.616951 <... mmap resumed> ) = 0x7f04ccd03000
[pid 25474] 10:12:35.616972 mmap(0x7f84e2a83000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.617001 rt_sigaction(SIGRT_1, {0x7f7c14b55cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.617029 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff0fff3d790},  <unfinished ...>
[pid 25458] 10:12:35.617056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.617103 mmap(0x7f04ccd06000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.617134 <... mmap resumed> ) = 0x7f84e2a83000
[pid 25473] 10:12:35.617156 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.617174 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.617194 fstat(9,  <unfinished ...>
[pid 25481] 10:12:35.617225 <... mmap resumed> ) = 0x7f04ccd06000
[pid 25474] 10:12:35.617246 close(6 <unfinished ...>
[pid 25473] 10:12:35.617270 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25472] 10:12:35.617296 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25458] 10:12:35.617322 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.617357 close(6 <unfinished ...>
[pid 25474] 10:12:35.617380 <... close resumed> ) = 0
[pid 25473] 10:12:35.617404 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25472] 10:12:35.617433 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25458] 10:12:35.617452 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.617486 <... close resumed> ) = 0
[pid 25474] 10:12:35.617590 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.617630 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25472] 10:12:35.617653 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25458] 10:12:35.617679 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25481] 10:12:35.617704 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.617733 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.617751 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25472] 10:12:35.617808 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25458] 10:12:35.617833 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.617872 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.617890 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.617925 statfs("/selinux",  <unfinished ...>
[pid 25472] 10:12:35.617957 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff0fff3d790},  <unfinished ...>
[pid 25458] 10:12:35.617983 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.618007 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.618039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.618055 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350341, f_bavail=6350341, f_files=1000000, f_ffree=691100, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25472] 10:12:35.618121 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:35.618151 read(9,  <unfinished ...>
[pid 25481] 10:12:35.618187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.618205 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.618235 brk(0 <unfinished ...>
[pid 25472] 10:12:35.618257 umask(0 <unfinished ...>
[pid 25458] 10:12:35.618279 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25481] 10:12:35.618326 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.618366 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.618386 <... brk resumed> ) = 0xee2000
[pid 25472] 10:12:35.618403 <... umask resumed> ) = 0
[pid 25458] 10:12:35.618461 stat("/etc/userdomains",  <unfinished ...>
[pid 25481] 10:12:35.618498 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.618522 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.618555 brk(0xf03000 <unfinished ...>
[pid 25472] 10:12:35.618579 geteuid( <unfinished ...>
[pid 25458] 10:12:35.618601 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.618650 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.618682 <... open resumed> ) = 6
[pid 25473] 10:12:35.618698 <... brk resumed> ) = 0xf03000
[pid 25472] 10:12:35.618724 <... geteuid resumed> ) = 0
[pid 25458] 10:12:35.618743 stat("/etc/userdomains",  <unfinished ...>
[pid 25481] 10:12:35.618777 <... open resumed> ) = 6
[pid 25474] 10:12:35.618793 read(6,  <unfinished ...>
[pid 25473] 10:12:35.618816 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.618850 getuid( <unfinished ...>
[pid 25458] 10:12:35.618872 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.618942 read(6,  <unfinished ...>
[pid 25474] 10:12:35.618970 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.618994 <... open resumed> ) = 6
[pid 25472] 10:12:35.619021 <... getuid resumed> ) = 47
[pid 25458] 10:12:35.619042 stat("/home/finest09/etc/finestweddingsites.com/theviewsatsuperstition/filter",  <unfinished ...>
[pid 25481] 10:12:35.619084 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.619107 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.619130 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.619153 getgid( <unfinished ...>
[pid 25458] 10:12:35.619175 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.619206 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.619230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25473] 10:12:35.619258 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.619278 <... getgid resumed> ) = 12
[pid 25458] 10:12:35.619313 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.619335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25474] 10:12:35.619354 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.619369 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.619381 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25458] 10:12:35.619389 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25481] 10:12:35.619425 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25474] 10:12:35.619439 <... mmap resumed> ) = 0x7f84e25ef000
[pid 25473] 10:12:35.619447 <... mmap resumed> ) = 0x7f7c15ca9000
[pid 25472] 10:12:35.619456 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25458] 10:12:35.619466 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.619488 <... mmap resumed> ) = 0x7f04cc872000
[pid 25474] 10:12:35.619496 mprotect(0x7f84e25f5000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.619683 read(6,  <unfinished ...>
[pid 25472] 10:12:35.619771 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25458] 10:12:35.619795 <... open resumed> ) = 10
[pid 25481] 10:12:35.619820 mprotect(0x7f04cc878000, 2093056, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.619848 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.619863 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25472] 10:12:35.619893 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25458] 10:12:35.619914 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.619946 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.619962 mmap(0x7f84e27f4000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25473] 10:12:35.619993 read(6,  <unfinished ...>
[pid 25472] 10:12:35.620016 getgroups(65536,  <unfinished ...>
[pid 25458] 10:12:35.620042 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25481] 10:12:35.620081 mmap(0x7f04cca77000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25474] 10:12:35.620110 <... mmap resumed> ) = 0x7f84e27f4000
[pid 25473] 10:12:35.620131 <... read resumed> "", 1024) = 0
[pid 25472] 10:12:35.620156 <... getgroups resumed> [12]) = 1
[pid 25458] 10:12:35.620179 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.620211 <... mmap resumed> ) = 0x7f04cca77000
[pid 25474] 10:12:35.620231 close(6 <unfinished ...>
[pid 25473] 10:12:35.620254 close(6 <unfinished ...>
[pid 25472] 10:12:35.620280 setgroups(0, [] <unfinished ...>
[pid 25458] 10:12:35.620305 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25481] 10:12:35.620343 close(6 <unfinished ...>
[pid 25474] 10:12:35.620366 <... close resumed> ) = 0
[pid 25473] 10:12:35.620388 <... close resumed> ) = 0
[pid 25472] 10:12:35.620405 <... setgroups resumed> ) = 0
[pid 25458] 10:12:35.620428 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.620463 <... close resumed> ) = 0
[pid 25474] 10:12:35.620498 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.620645 munmap(0x7f7c15ca9000, 4096 <unfinished ...>
[pid 25472] 10:12:35.620675 getegid( <unfinished ...>
[pid 25458] 10:12:35.620698 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25481] 10:12:35.620722 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.620753 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.620770 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.620838 <... getegid resumed> ) = 12
[pid 25458] 10:12:35.620858 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.620889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.620907 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.620941 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25472] 10:12:35.620972 geteuid( <unfinished ...>
[pid 25458] 10:12:35.620995 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.621019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.621051 <... open resumed> ) = 6
[pid 25473] 10:12:35.621066 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.621145 <... geteuid resumed> ) = 0
[pid 25458] 10:12:35.621170 read(10,  <unfinished ...>
[pid 25481] 10:12:35.621205 <... open resumed> ) = 6
[pid 25474] 10:12:35.621221 read(6,  <unfinished ...>
[pid 25473] 10:12:35.621244 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.621271 geteuid( <unfinished ...>
[pid 25458] 10:12:35.621293 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25481] 10:12:35.621326 read(6,  <unfinished ...>
[pid 25474] 10:12:35.621353 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.621376 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.621401 <... geteuid resumed> ) = 0
[pid 25458] 10:12:35.621418 read(10,  <unfinished ...>
[pid 25481] 10:12:35.621449 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.621472 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.621494 fstat(2,  <unfinished ...>
[pid 25472] 10:12:35.621616 getegid( <unfinished ...>
[pid 25458] 10:12:35.621641 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.621689 read(10,  <unfinished ...>
[pid 25481] 10:12:35.621721 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.621750 <... open resumed> ) = 14
[pid 25479] 10:12:35.621764 <... open resumed> ) = 14
[pid 25474] 10:12:35.621789 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.621828 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25472] 10:12:35.621885 <... getegid resumed> ) = 12
[pid 25458] 10:12:35.621907 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.621950 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25481] 10:12:35.621968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25480] 10:12:35.622028 fstat(14,  <unfinished ...>
[pid 25479] 10:12:35.622052 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.622074 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.622101 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.622129 setgid(12 <unfinished ...>
[pid 25458] 10:12:35.622152 <... open resumed> ) = 11
[pid 25482] 10:12:35.622182 close(10 <unfinished ...>
[pid 25481] 10:12:35.622208 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.622234 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25479] 10:12:35.622261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.622288 <... mmap resumed> ) = 0x7f84e3f44000
[pid 25473] 10:12:35.622311 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.622332 <... setgid resumed> ) = 0
[pid 25458] 10:12:35.622351 fstat(11,  <unfinished ...>
[pid 25482] 10:12:35.622386 <... close resumed> ) = 0
[pid 25481] 10:12:35.622399 <... mmap resumed> ) = 0x7f04ce1c7000
[pid 25480] 10:12:35.622421 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.622447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.622471 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.622498 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25472] 10:12:35.622530 setuid(0 <unfinished ...>
[pid 25458] 10:12:35.622554 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25482] 10:12:35.622594 munmap(0x7fdec5ab8000, 4096 <unfinished ...>
[pid 25481] 10:12:35.622621 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.622648 <... mmap resumed> ) = 0x7fea0f282000
[pid 25479] 10:12:35.622667 <... mmap resumed> ) = 0x7fea0f282000
[pid 25474] 10:12:35.622683 <... mmap resumed> ) = 0x7f84e22b9000
[pid 25473] 10:12:35.622702 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25472] 10:12:35.622722 <... setuid resumed> ) = 0
[pid 25458] 10:12:35.622766 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.622808 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.622822 <... mmap resumed> ) = 0x7f04cc53c000
[pid 25480] 10:12:35.622885 read(14,  <unfinished ...>
[pid 25479] 10:12:35.622914 read(14,  <unfinished ...>
[pid 25474] 10:12:35.622940 mprotect(0x7f84e23e5000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.622968 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25472] 10:12:35.622995 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.623024 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25482] 10:12:35.623053 stat("/etc/mailips",  <unfinished ...>
[pid 25481] 10:12:35.623078 mprotect(0x7f04cc668000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.623104 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25479] 10:12:35.623119 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25474] 10:12:35.623126 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.623159 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25472] 10:12:35.623171 <... open resumed> ) = 6
[pid 25458] 10:12:35.623196 read(11,  <unfinished ...>
[pid 25482] 10:12:35.623221 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.623238 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.623270 read(14,  <unfinished ...>
[pid 25479] 10:12:35.623277 read(14,  <unfinished ...>
[pid 25474] 10:12:35.623283 mmap(0x7f84e25e5000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25473] 10:12:35.623307 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.623319 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.623328 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25482] 10:12:35.623361 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.623369 mmap(0x7f04cc868000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25480] 10:12:35.623389 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25479] 10:12:35.623397 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25474] 10:12:35.623404 <... mmap resumed> ) = 0x7f84e25e5000
[pid 25473] 10:12:35.623795 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.623831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25458] 10:12:35.623869 close(11 <unfinished ...>
[pid 25482] 10:12:35.623909 <... open resumed> ) = 10
[pid 25481] 10:12:35.623923 <... mmap resumed> ) = 0x7f04cc868000
[pid 25480] 10:12:35.623948 read(14,  <unfinished ...>
[pid 25479] 10:12:35.623973 read(14,  <unfinished ...>
[pid 25474] 10:12:35.623995 mmap(0x7f84e25ee000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.624025 umask(0 <unfinished ...>
[pid 25472] 10:12:35.624047 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.624070 <... close resumed> ) = 0
[pid 25482] 10:12:35.624097 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.624120 mmap(0x7f04cc871000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.624147 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25479] 10:12:35.624166 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25474] 10:12:35.624195 <... mmap resumed> ) = 0x7f84e25ee000
[pid 25473] 10:12:35.624226 <... umask resumed> ) = 0
[pid 25472] 10:12:35.624277 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25458] 10:12:35.624309 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25482] 10:12:35.624350 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.624376 <... mmap resumed> ) = 0x7f04cc871000
[pid 25480] 10:12:35.624409 read(14,  <unfinished ...>
[pid 25479] 10:12:35.624435 read(14,  <unfinished ...>
[pid 25474] 10:12:35.624457 close(6 <unfinished ...>
[pid 25473] 10:12:35.624480 geteuid( <unfinished ...>
[pid 25472] 10:12:35.624501 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.624531 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.624575 fstat(10,  <unfinished ...>
[pid 25481] 10:12:35.624601 close(6 <unfinished ...>
[pid 25480] 10:12:35.624625 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25479] 10:12:35.624643 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25474] 10:12:35.624727 <... close resumed> ) = 0
[pid 25473] 10:12:35.624810 <... geteuid resumed> ) = 0
[pid 25472] 10:12:35.624832 <... mmap resumed> ) = 0x7ff101087000
[pid 25458] 10:12:35.624849 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.624888 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.624925 <... close resumed> ) = 0
[pid 25480] 10:12:35.624949 read(14,  <unfinished ...>
[pid 25479] 10:12:35.624974 read(14,  <unfinished ...>
[pid 25474] 10:12:35.624996 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.625027 getuid( <unfinished ...>
[pid 25472] 10:12:35.625048 read(6,  <unfinished ...>
[pid 25458] 10:12:35.625075 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.625132 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.625162 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.625192 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25479] 10:12:35.625211 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25474] 10:12:35.625241 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.625270 <... getuid resumed> ) = 47
[pid 25472] 10:12:35.625289 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25458] 10:12:35.625406 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25482] 10:12:35.625436 <... mmap resumed> ) = 0x7fdec5ab8000
[pid 25481] 10:12:35.625442 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.625455 read(14,  <unfinished ...>
[pid 25479] 10:12:35.625461 read(14,  <unfinished ...>
[pid 25474] 10:12:35.625466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.625489 getgid( <unfinished ...>
[pid 25472] 10:12:35.625498 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.625682 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25482] 10:12:35.625741 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.625767 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.625799 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25479] 10:12:35.625817 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25474] 10:12:35.625896 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.625975 <... getgid resumed> ) = 12
[pid 25472] 10:12:35.626018 <... socket resumed> ) = 7
[pid 25458] 10:12:35.626036 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25482] 10:12:35.626077 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.626094 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.626111 read(14,  <unfinished ...>
[pid 25479] 10:12:35.626134 read(14,  <unfinished ...>
[pid 25474] 10:12:35.626157 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.626187 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25472] 10:12:35.626209 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.626245 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.626313 read(10,  <unfinished ...>
[pid 25481] 10:12:35.626342 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.626372 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25479] 10:12:35.626390 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25474] 10:12:35.626469 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.626630 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25472] 10:12:35.626662 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.626682 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.626726 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.626762 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.626785 read(14,  <unfinished ...>
[pid 25479] 10:12:35.626809 read(14,  <unfinished ...>
[pid 25474] 10:12:35.626831 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.626863 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25472] 10:12:35.626885 close(7 <unfinished ...>
[pid 25458] 10:12:35.626911 <... open resumed> ) = 11
[pid 25482] 10:12:35.626940 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.626963 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.626992 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25479] 10:12:35.627009 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25474] 10:12:35.627085 <... open resumed> ) = 6
[pid 25473] 10:12:35.627154 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25472] 10:12:35.627178 <... close resumed> ) = 0
[pid 25458] 10:12:35.627194 fstat(11,  <unfinished ...>
[pid 25482] 10:12:35.627230 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.627246 <... open resumed> ) = 6
[pid 25480] 10:12:35.627262 read(14,  <unfinished ...>
[pid 25479] 10:12:35.627285 read(14,  <unfinished ...>
[pid 25474] 10:12:35.627314 read(6,  <unfinished ...>
[pid 25473] 10:12:35.627337 getgroups(65536,  <unfinished ...>
[pid 25472] 10:12:35.627360 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.627389 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.627434 read(10,  <unfinished ...>
[pid 25481] 10:12:35.627458 read(6,  <unfinished ...>
[pid 25480] 10:12:35.627481 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25479] 10:12:35.627499 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25474] 10:12:35.627608 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.627645 <... getgroups resumed> [12]) = 1
[pid 25472] 10:12:35.627668 <... socket resumed> ) = 7
[pid 25458] 10:12:35.627685 fstat(11,  <unfinished ...>
[pid 25482] 10:12:35.627720 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.627920 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.627952 read(14,  <unfinished ...>
[pid 25479] 10:12:35.627976 read(14,  <unfinished ...>
[pid 25474] 10:12:35.627999 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.628021 setgroups(0, [] <unfinished ...>
[pid 25472] 10:12:35.628044 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.628077 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.628119 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.628148 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.628171 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25479] 10:12:35.628189 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25474] 10:12:35.628272 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.628357 <... setgroups resumed> ) = 0
[pid 25472] 10:12:35.628379 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.628397 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.628437 <... open resumed> ) = 11
[pid 25481] 10:12:35.628456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.628488 read(14,  <unfinished ...>
[pid 25479] 10:12:35.628613 read(14,  <unfinished ...>
[pid 25474] 10:12:35.628642 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.628673 getegid( <unfinished ...>
[pid 25472] 10:12:35.628695 close(7 <unfinished ...>
[pid 25458] 10:12:35.628720 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25482] 10:12:35.628750 fstat(11,  <unfinished ...>
[pid 25481] 10:12:35.628773 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.628800 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25479] 10:12:35.628819 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25474] 10:12:35.628906 <... mmap resumed> ) = 0x7f84e20b5000
[pid 25473] 10:12:35.628985 <... getegid resumed> ) = 12
[pid 25472] 10:12:35.629002 <... close resumed> ) = 0
[pid 25458] 10:12:35.629026 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.629063 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.629093 <... mmap resumed> ) = 0x7f04cc338000
[pid 25480] 10:12:35.629110 read(14,  <unfinished ...>
[pid 25479] 10:12:35.629133 read(14,  <unfinished ...>
[pid 25474] 10:12:35.629155 mprotect(0x7f84e20b7000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.629183 geteuid( <unfinished ...>
[pid 25472] 10:12:35.629205 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.629234 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.629263 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.629290 mprotect(0x7f04cc33a000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.629316 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25479] 10:12:35.629335 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25474] 10:12:35.629407 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.629475 <... geteuid resumed> ) = 0
[pid 25472] 10:12:35.629505 <... open resumed> ) = 7
[pid 25458] 10:12:35.629603 read(11,  <unfinished ...>
[pid 25482] 10:12:35.629645 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25481] 10:12:35.629662 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.629678 read(14,  <unfinished ...>
[pid 25479] 10:12:35.629701 read(14,  <unfinished ...>
[pid 25474] 10:12:35.629723 mmap(0x7f84e22b7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25473] 10:12:35.629753 geteuid( <unfinished ...>
[pid 25472] 10:12:35.629775 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.629798 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25482] 10:12:35.629841 read(11,  <unfinished ...>
[pid 25481] 10:12:35.629877 mmap(0x7f04cc53a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25480] 10:12:35.629912 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25479] 10:12:35.629932 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25474] 10:12:35.630000 <... mmap resumed> ) = 0x7f84e22b7000
[pid 25473] 10:12:35.630074 <... geteuid resumed> ) = 0
[pid 25472] 10:12:35.630095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25458] 10:12:35.630125 read(11,  <unfinished ...>
[pid 25482] 10:12:35.630161 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.630192 <... mmap resumed> ) = 0x7f04cc53a000
[pid 25480] 10:12:35.630217 read(14,  <unfinished ...>
[pid 25479] 10:12:35.630242 read(14,  <unfinished ...>
[pid 25474] 10:12:35.630264 close(6 <unfinished ...>
[pid 25473] 10:12:35.630287 getegid( <unfinished ...>
[pid 25472] 10:12:35.630308 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.630334 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.630375 close(11 <unfinished ...>
[pid 25481] 10:12:35.630402 close(6 <unfinished ...>
[pid 25480] 10:12:35.630424 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25479] 10:12:35.630442 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25474] 10:12:35.630511 <... close resumed> ) = 0
[pid 25473] 10:12:35.630579 <... getegid resumed> ) = 12
[pid 25472] 10:12:35.630604 <... mmap resumed> ) = 0x7ff101086000
[pid 25458] 10:12:35.630622 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.630663 <... close resumed> ) = 0
[pid 25481] 10:12:35.630684 <... close resumed> ) = 0
[pid 25480] 10:12:35.630707 read(14,  <unfinished ...>
[pid 25479] 10:12:35.630731 read(14,  <unfinished ...>
[pid 25474] 10:12:35.630753 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.630784 setgid(12 <unfinished ...>
[pid 25472] 10:12:35.630807 read(7,  <unfinished ...>
[pid 25458] 10:12:35.630838 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.630898 munmap(0x7fdec5ab7000, 4096 <unfinished ...>
[pid 25481] 10:12:35.630933 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.630964 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25479] 10:12:35.630981 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25474] 10:12:35.631009 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.631037 <... setgid resumed> ) = 0
[pid 25472] 10:12:35.631056 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25458] 10:12:35.631087 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25482] 10:12:35.631115 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.631146 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.631157 read(14,  <unfinished ...>
[pid 25479] 10:12:35.631163 read(14,  <unfinished ...>
[pid 25474] 10:12:35.631168 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.631191 setuid(0 <unfinished ...>
[pid 25472] 10:12:35.631201 read(7,  <unfinished ...>
[pid 25458] 10:12:35.631210 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25482] 10:12:35.631255 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.631270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.631286 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25479] 10:12:35.631294 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25474] 10:12:35.631300 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.631461 <... setuid resumed> ) = 0
[pid 25472] 10:12:35.631498 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:35.631685 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25482] 10:12:35.631735 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25481] 10:12:35.631871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.631898 read(14,  <unfinished ...>
[pid 25479] 10:12:35.631923 read(14,  <unfinished ...>
[pid 25474] 10:12:35.631945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.631977 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.632005 close(7 <unfinished ...>
[pid 25458] 10:12:35.632030 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.632103 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.632132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.632163 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25479] 10:12:35.632181 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25474] 10:12:35.632254 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.632323 <... open resumed> ) = 6
[pid 25472] 10:12:35.632360 <... close resumed> ) = 0
[pid 25458] 10:12:35.632382 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.632421 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.632438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.632457 read(14,  <unfinished ...>
[pid 25479] 10:12:35.632481 read(14,  <unfinished ...>
[pid 25474] 10:12:35.632504 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.632607 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.632631 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25458] 10:12:35.632659 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.632718 read(10,  <unfinished ...>
[pid 25481] 10:12:35.632744 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.632773 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25479] 10:12:35.632791 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25474] 10:12:35.632822 <... open resumed> ) = 6
[pid 25473] 10:12:35.632849 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25472] 10:12:35.632883 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.632914 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25482] 10:12:35.632956 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.632976 <... open resumed> ) = 6
[pid 25480] 10:12:35.632992 read(14,  <unfinished ...>
[pid 25479] 10:12:35.633021 read(14,  <unfinished ...>
[pid 25474] 10:12:35.633043 read(6,  <unfinished ...>
[pid 25473] 10:12:35.633066 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.633088 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.633118 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.633179 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.633206 read(6,  <unfinished ...>
[pid 25480] 10:12:35.633228 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25479] 10:12:35.633246 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25474] 10:12:35.633315 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.633387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25472] 10:12:35.633418 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.633435 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.633473 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.633490 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.633618 read(14,  <unfinished ...>
[pid 25479] 10:12:35.633648 read(14,  <unfinished ...>
[pid 25474] 10:12:35.633670 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.633692 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.633719 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.633752 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.633802 read(10,  <unfinished ...>
[pid 25481] 10:12:35.633828 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.633850 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25479] 10:12:35.633878 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25474] 10:12:35.634010 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.634097 <... mmap resumed> ) = 0x7f7c15ca9000
[pid 25472] 10:12:35.634117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.634135 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.634176 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.634219 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.634252 read(14,  <unfinished ...>
[pid 25479] 10:12:35.634277 read(14,  <unfinished ...>
[pid 25474] 10:12:35.634299 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.634330 read(6,  <unfinished ...>
[pid 25472] 10:12:35.634357 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.634388 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.634491 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25481] 10:12:35.634543 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.634572 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25479] 10:12:35.634591 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25474] 10:12:35.634665 <... mmap resumed> ) = 0x7f84e1eb2000
[pid 25473] 10:12:35.634732 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25472] 10:12:35.634853 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.634879 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.634916 <... open resumed> ) = 11
[pid 25481] 10:12:35.634932 <... mmap resumed> ) = 0x7f04cc135000
[pid 25480] 10:12:35.634949 read(14,  <unfinished ...>
[pid 25479] 10:12:35.634972 read(14,  <unfinished ...>
[pid 25474] 10:12:35.634995 mprotect(0x7f84e1eb4000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.635022 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25472] 10:12:35.635050 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.635079 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.635108 alarm(60 <unfinished ...>
[pid 25481] 10:12:35.635133 mprotect(0x7f04cc137000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.635167 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25479] 10:12:35.635185 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25474] 10:12:35.635254 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.635316 <... socket resumed> ) = 7
[pid 25472] 10:12:35.635335 <... open resumed> ) = 7
[pid 25458] 10:12:35.635351 read(10,  <unfinished ...>
[pid 25482] 10:12:35.635389 <... alarm resumed> ) = 0
[pid 25481] 10:12:35.635405 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.635421 read(14,  <unfinished ...>
[pid 25479] 10:12:35.635444 read(14,  <unfinished ...>
[pid 25474] 10:12:35.635466 mmap(0x7f84e20b3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25473] 10:12:35.635497 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25472] 10:12:35.635644 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.635669 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25482] 10:12:35.635708 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25481] 10:12:35.635738 mmap(0x7f04cc336000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25480] 10:12:35.635767 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25479] 10:12:35.635785 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25474] 10:12:35.635812 <... mmap resumed> ) = 0x7f84e20b3000
[pid 25473] 10:12:35.635845 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.635865 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25458] 10:12:35.635895 read(10,  <unfinished ...>
[pid 25482] 10:12:35.635930 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.635946 <... mmap resumed> ) = 0x7f04cc336000
[pid 25480] 10:12:35.635969 read(14,  <unfinished ...>
[pid 25479] 10:12:35.635993 read(14,  <unfinished ...>
[pid 25474] 10:12:35.636015 close(6 <unfinished ...>
[pid 25473] 10:12:35.636037 close(7 <unfinished ...>
[pid 25472] 10:12:35.636063 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25458] 10:12:35.636089 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.636145 alarm(0 <unfinished ...>
[pid 25481] 10:12:35.636174 close(6 <unfinished ...>
[pid 25480] 10:12:35.636197 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25479] 10:12:35.636220 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25474] 10:12:35.636295 <... close resumed> ) = 0
[pid 25473] 10:12:35.636392 <... close resumed> ) = 0
[pid 25472] 10:12:35.636415 <... mmap resumed> ) = 0x7ff101066000
[pid 25458] 10:12:35.636432 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.636474 <... alarm resumed> ) = 60
[pid 25481] 10:12:35.636644 <... close resumed> ) = 0
[pid 25480] 10:12:35.636675 read(14,  <unfinished ...>
[pid 25479] 10:12:35.636701 read(14,  <unfinished ...>
[pid 25474] 10:12:35.636723 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.636754 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25472] 10:12:35.636781 close(7 <unfinished ...>
[pid 25458] 10:12:35.636803 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25482] 10:12:35.636857 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25481] 10:12:35.636889 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.636918 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25479] 10:12:35.636935 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25474] 10:12:35.637003 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.637066 <... socket resumed> ) = 7
[pid 25472] 10:12:35.637085 <... close resumed> ) = 0
[pid 25458] 10:12:35.637111 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.637153 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.637194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.637214 read(14,  <unfinished ...>
[pid 25479] 10:12:35.637238 read(14,  <unfinished ...>
[pid 25474] 10:12:35.637260 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.637291 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25472] 10:12:35.637326 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.637357 <... open resumed> ) = 12
[pid 25482] 10:12:35.637387 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.637417 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.637458 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25479] 10:12:35.637477 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25474] 10:12:35.637589 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.637622 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.637640 <... open resumed> ) = 7
[pid 25458] 10:12:35.637657 fstat(12,  <unfinished ...>
[pid 25482] 10:12:35.637692 <... open resumed> ) = 13
[pid 25481] 10:12:35.637708 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.637724 read(14,  <unfinished ...>
[pid 25479] 10:12:35.637747 read(14,  <unfinished ...>
[pid 25474] 10:12:35.637769 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.637800 close(7 <unfinished ...>
[pid 25472] 10:12:35.637826 read(7,  <unfinished ...>
[pid 25458] 10:12:35.637849 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25482] 10:12:35.637893 fcntl(13, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.637917 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.637945 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25479] 10:12:35.637962 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25474] 10:12:35.638035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.638105 <... close resumed> ) = 0
[pid 25472] 10:12:35.638130 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.638155 fstat(12,  <unfinished ...>
[pid 25482] 10:12:35.638191 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.638207 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.638225 read(14,  <unfinished ...>
[pid 25479] 10:12:35.638248 read(14,  <unfinished ...>
[pid 25474] 10:12:35.638270 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.638301 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.638328 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.638350 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25482] 10:12:35.638391 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.638415 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.638443 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25479] 10:12:35.638465 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25474] 10:12:35.638642 <... open resumed> ) = 6
[pid 25473] 10:12:35.638715 <... open resumed> ) = 7
[pid 25472] 10:12:35.638737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25458] 10:12:35.638772 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.638813 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.638832 <... open resumed> ) = 6
[pid 25480] 10:12:35.638848 read(14,  <unfinished ...>
[pid 25479] 10:12:35.638871 read(14,  <unfinished ...>
[pid 25474] 10:12:35.638893 read(6,  <unfinished ...>
[pid 25473] 10:12:35.638916 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.638938 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25458] 10:12:35.638970 <... mmap resumed> ) = 0x7f03f4be5000
[pid 25482] 10:12:35.638998 read(13,  <unfinished ...>
[pid 25481] 10:12:35.639022 read(6,  <unfinished ...>
[pid 25480] 10:12:35.639044 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25479] 10:12:35.639062 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25474] 10:12:35.639089 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.639122 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25472] 10:12:35.639150 <... mmap resumed> ) = 0x7ff0fca01000
[pid 25458] 10:12:35.639166 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.639201 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25481] 10:12:35.639229 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.639259 read(14,  <unfinished ...>
[pid 25479] 10:12:35.639283 read(14,  <unfinished ...>
[pid 25474] 10:12:35.639305 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.639327 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.639355 mprotect(0x7ff0fca0d000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.639382 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.639410 close(13 <unfinished ...>
[pid 25481] 10:12:35.639435 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.639458 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25479] 10:12:35.639475 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25474] 10:12:35.639703 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:35.639742 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.639759 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.639775 read(12,  <unfinished ...>
[pid 25482] 10:12:35.639811 <... close resumed> ) = 0
[pid 25481] 10:12:35.639842 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25480] 10:12:35.639874 read(14,  <unfinished ...>
[pid 25479] 10:12:35.639898 read(14,  <unfinished ...>
[pid 25474] 10:12:35.639922 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.639948 read(7,  <unfinished ...>
[pid 25472] 10:12:35.639975 mmap(0x7ff0fcc0d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25458] 10:12:35.640006 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.640042 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.640073 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.640099 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25479] 10:12:35.640117 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25474] 10:12:35.640236 <... mmap resumed> ) = 0x7f84e3f43000
[pid 25473] 10:12:35.640260 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25472] 10:12:35.640298 <... mmap resumed> ) = 0x7ff0fcc0d000
[pid 25458] 10:12:35.640325 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.640373 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.640392 <... mmap resumed> ) = 0x7f04ce1c6000
[pid 25480] 10:12:35.640415 read(14,  <unfinished ...>
[pid 25479] 10:12:35.640439 read(14,  <unfinished ...>
[pid 25474] 10:12:35.640463 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.640491 read(7,  <unfinished ...>
[pid 25472] 10:12:35.640592 close(7 <unfinished ...>
[pid 25458] 10:12:35.640617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25482] 10:12:35.640677 stat("/var/tmp",  <unfinished ...>
[pid 25481] 10:12:35.640712 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.640740 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25479] 10:12:35.640758 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25474] 10:12:35.640794 <... mmap resumed> ) = 0x7f84e1b1e000
[pid 25473] 10:12:35.640811 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.640828 <... close resumed> ) = 0
[pid 25458] 10:12:35.640866 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.640910 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25481] 10:12:35.641122 <... mmap resumed> ) = 0x7f04cbda1000
[pid 25480] 10:12:35.641144 read(14,  <unfinished ...>
[pid 25479] 10:12:35.641169 read(14,  <unfinished ...>
[pid 25474] 10:12:35.641192 mprotect(0x7f84e1ca8000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.641219 close(7 <unfinished ...>
[pid 25472] 10:12:35.641243 mprotect(0x7ff0fcc0d000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:35.641269 <... open resumed> ) = 13
[pid 25482] 10:12:35.641298 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.641331 mprotect(0x7f04cbf2b000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.641358 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25479] 10:12:35.641434 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25474] 10:12:35.641504 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.641609 <... close resumed> ) = 0
[pid 25472] 10:12:35.641626 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.641646 fstat(13,  <unfinished ...>
[pid 25482] 10:12:35.641682 <... open resumed> ) = 13
[pid 25481] 10:12:35.641698 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.641714 read(14,  <unfinished ...>
[pid 25479] 10:12:35.641738 read(14,  <unfinished ...>
[pid 25474] 10:12:35.641761 mmap(0x7f84e1ea8000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25473] 10:12:35.641793 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.641827 munmap(0x7ff101066000, 39387 <unfinished ...>
[pid 25458] 10:12:35.641854 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25482] 10:12:35.641896 fcntl(13, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.641919 mmap(0x7f04cc12b000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25480] 10:12:35.641947 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25479] 10:12:35.642017 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25474] 10:12:35.642082 <... mmap resumed> ) = 0x7f84e1ea8000
[pid 25473] 10:12:35.642106 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.642137 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.642164 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.642204 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.642221 <... mmap resumed> ) = 0x7f04cc12b000
[pid 25480] 10:12:35.642245 read(14,  <unfinished ...>
[pid 25479] 10:12:35.642281 read(14,  <unfinished ...>
[pid 25474] 10:12:35.642304 mmap(0x7f84e1ead000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.642335 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.642366 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.642393 <... mmap resumed> ) = 0x7f03f4be4000
[pid 25482] 10:12:35.642422 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.642446 mmap(0x7f04cc130000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.642473 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25479] 10:12:35.642662 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25474] 10:12:35.642748 <... mmap resumed> ) = 0x7f84e1ead000
[pid 25473] 10:12:35.642774 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.642794 <... open resumed> ) = 7
[pid 25458] 10:12:35.642815 read(13,  <unfinished ...>
[pid 25482] 10:12:35.642856 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.642874 <... mmap resumed> ) = 0x7f04cc130000
[pid 25480] 10:12:35.642895 read(14,  <unfinished ...>
[pid 25479] 10:12:35.642920 read(14,  <unfinished ...>
[pid 25474] 10:12:35.642943 close(6 <unfinished ...>
[pid 25473] 10:12:35.642965 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.642998 fcntl(7, F_GETFD <unfinished ...>
[pid 25458] 10:12:35.643021 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25482] 10:12:35.643069 fstat(13,  <unfinished ...>
[pid 25481] 10:12:35.643094 close(6 <unfinished ...>
[pid 25480] 10:12:35.643116 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25479] 10:12:35.643195 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25474] 10:12:35.643271 <... close resumed> ) = 0
[pid 25473] 10:12:35.643298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.643319 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25458] 10:12:35.643340 close(13 <unfinished ...>
[pid 25482] 10:12:35.643378 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.643440 <... close resumed> ) = 0
[pid 25480] 10:12:35.643468 read(14,  <unfinished ...>
[pid 25479] 10:12:35.643493 read(14,  <unfinished ...>
[pid 25474] 10:12:35.643593 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.643627 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.643656 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.643678 <... close resumed> ) = 0
[pid 25482] 10:12:35.643706 pread(13,  <unfinished ...>
[pid 25481] 10:12:35.643731 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.643759 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25479] 10:12:35.643790 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25474] 10:12:35.643818 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.643835 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.643852 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.643880 munmap(0x7f03f4be4000, 4096 <unfinished ...>
[pid 25482] 10:12:35.643922 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25481] 10:12:35.643973 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.643994 read(14,  <unfinished ...>
[pid 25479] 10:12:35.644019 read(14,  <unfinished ...>
[pid 25474] 10:12:35.644042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.644080 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.644109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.644136 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.644190 pread(13,  <unfinished ...>
[pid 25481] 10:12:35.644219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.644252 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25479] 10:12:35.644342 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25474] 10:12:35.644427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.644448 <... open resumed> ) = 7
[pid 25472] 10:12:35.644464 <... mmap resumed> ) = 0x7ff101086000
[pid 25458] 10:12:35.644481 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.644605 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25481] 10:12:35.644647 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.644668 read(14,  <unfinished ...>
[pid 25479] 10:12:35.644692 read(14,  <unfinished ...>
[pid 25474] 10:12:35.644715 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.644745 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.644768 read(7,  <unfinished ...>
[pid 25458] 10:12:35.644795 <... open resumed> ) = 13
[pid 25482] 10:12:35.644824 close(13 <unfinished ...>
[pid 25481] 10:12:35.644848 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.644877 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25479] 10:12:35.644964 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25474] 10:12:35.645046 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.645067 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25472] 10:12:35.645097 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.645142 fstat(13,  <unfinished ...>
[pid 25482] 10:12:35.645179 <... close resumed> ) = 0
[pid 25481] 10:12:35.645223 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.645246 read(14,  <unfinished ...>
[pid 25479] 10:12:35.645271 read(14,  <unfinished ...>
[pid 25474] 10:12:35.645294 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.645327 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25472] 10:12:35.645354 close(7 <unfinished ...>
[pid 25458] 10:12:35.645378 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.645422 close(11 <unfinished ...>
[pid 25481] 10:12:35.645452 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.645482 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25479] 10:12:35.645651 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25474] 10:12:35.645742 <... open resumed> ) = 6
[pid 25473] 10:12:35.645761 <... mmap resumed> ) = 0x7f7c15c88000
[pid 25472] 10:12:35.645778 <... close resumed> ) = 0
[pid 25458] 10:12:35.645794 fstat(13,  <unfinished ...>
[pid 25482] 10:12:35.645829 <... close resumed> ) = 0
[pid 25481] 10:12:35.645870 <... open resumed> ) = 6
[pid 25480] 10:12:35.645889 read(14,  <unfinished ...>
[pid 25479] 10:12:35.645914 read(14,  <unfinished ...>
[pid 25474] 10:12:35.645936 read(6,  <unfinished ...>
[pid 25473] 10:12:35.645959 close(7 <unfinished ...>
[pid 25472] 10:12:35.645981 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25458] 10:12:35.646009 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.646051 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25481] 10:12:35.646080 read(6,  <unfinished ...>
[pid 25480] 10:12:35.646103 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25479] 10:12:35.646134 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25474] 10:12:35.646163 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.646186 <... close resumed> ) = 0
[pid 25472] 10:12:35.646212 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.646256 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.646298 <... socket resumed> ) = 11
[pid 25481] 10:12:35.646323 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.646347 read(14,  <unfinished ...>
[pid 25479] 10:12:35.646371 read(14,  <unfinished ...>
[pid 25474] 10:12:35.646394 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.646418 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.646450 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.646477 <... mmap resumed> ) = 0x7f03f4be4000
[pid 25482] 10:12:35.646579 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25481] 10:12:35.646615 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.646639 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25479] 10:12:35.646713 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25474] 10:12:35.646782 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25473] 10:12:35.646816 <... open resumed> ) = 7
[pid 25472] 10:12:35.646832 <... socket resumed> ) = 7
[pid 25458] 10:12:35.646847 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.646883 <... setsockopt resumed> ) = 0
[pid 25481] 10:12:35.646912 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25480] 10:12:35.646943 read(14,  <unfinished ...>
[pid 25479] 10:12:35.646968 read(14,  <unfinished ...>
[pid 25474] 10:12:35.646991 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.647020 read(7,  <unfinished ...>
[pid 25472] 10:12:35.647043 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.647077 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.647106 alarm(300 <unfinished ...>
[pid 25481] 10:12:35.647131 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.647158 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25479] 10:12:35.647238 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25474] 10:12:35.647326 <... mmap resumed> ) = 0x7f84e18b2000
[pid 25473] 10:12:35.647348 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25472] 10:12:35.647372 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.647390 read(13,  <unfinished ...>
[pid 25482] 10:12:35.647429 <... alarm resumed> ) = 0
[pid 25481] 10:12:35.647452 <... mmap resumed> ) = 0x7f04cbb35000
[pid 25480] 10:12:35.647469 read(14,  <unfinished ...>
[pid 25479] 10:12:35.647492 read(14,  <unfinished ...>
[pid 25474] 10:12:35.647607 mprotect(0x7f84e1914000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.647637 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.647660 close(7 <unfinished ...>
[pid 25458] 10:12:35.647687 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25482] 10:12:35.647725 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("207.46.163.215")}, 16 <unfinished ...>
[pid 25481] 10:12:35.647804 mprotect(0x7f04cbb97000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.647834 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25479] 10:12:35.647910 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25474] 10:12:35.647981 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.648061 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25472] 10:12:35.648102 <... close resumed> ) = 0
[pid 25458] 10:12:35.648120 read(13,  <unfinished ...>
[pid 25481] 10:12:35.648154 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.648171 read(14,  <unfinished ...>
[pid 25479] 10:12:35.648195 read(14,  <unfinished ...>
[pid 25474] 10:12:35.648218 mmap(0x7f84e1b13000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25473] 10:12:35.648249 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25472] 10:12:35.648281 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25458] 10:12:35.648308 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.648347 mmap(0x7f04cbd96000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25480] 10:12:35.648381 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25479] 10:12:35.648452 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25474] 10:12:35.648595 <... mmap resumed> ) = 0x7f84e1b13000
[pid 25473] 10:12:35.648628 <... mmap resumed> ) = 0x7f7c11623000
[pid 25472] 10:12:35.648648 <... socket resumed> ) = 7
[pid 25458] 10:12:35.648664 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25481] 10:12:35.648706 <... mmap resumed> ) = 0x7f04cbd96000
[pid 25480] 10:12:35.648730 read(14,  <unfinished ...>
[pid 25479] 10:12:35.648756 read(14,  <unfinished ...>
[pid 25474] 10:12:35.648779 close(6 <unfinished ...>
[pid 25473] 10:12:35.648802 mprotect(0x7f7c1162f000, 2097152, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.648833 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25458] 10:12:35.648872 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25481] 10:12:35.648930 close(6 <unfinished ...>
[pid 25480] 10:12:35.648956 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25479] 10:12:35.649037 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25474] 10:12:35.649114 <... close resumed> ) = 0
[pid 25473] 10:12:35.649144 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.649161 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.649178 stat("/usr/local/cpanel/3rdparty/mailman/lists/terri_theviewsatsuperstition.com/config.pck",  <unfinished ...>
[pid 25481] 10:12:35.649222 <... close resumed> ) = 0
[pid 25480] 10:12:35.649248 read(14,  <unfinished ...>
[pid 25479] 10:12:35.649274 read(14,  <unfinished ...>
[pid 25474] 10:12:35.649297 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.649327 mmap(0x7f7c1182f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25472] 10:12:35.649360 close(7 <unfinished ...>
[pid 25458] 10:12:35.649389 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.649428 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.649460 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25479] 10:12:35.649490 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25474] 10:12:35.649593 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.649617 <... mmap resumed> ) = 0x7f7c1182f000
[pid 25472] 10:12:35.649644 <... close resumed> ) = 0
[pid 25458] 10:12:35.649668 stat("/etc/demouids",  <unfinished ...>
[pid 25481] 10:12:35.649708 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.649725 read(14,  <unfinished ...>
[pid 25479] 10:12:35.649750 read(14,  <unfinished ...>
[pid 25474] 10:12:35.649772 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.649816 close(7 <unfinished ...>
[pid 25472] 10:12:35.649845 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.649879 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.649939 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.649973 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25479] 10:12:35.650005 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25474] 10:12:35.650034 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.650052 <... close resumed> ) = 0
[pid 25472] 10:12:35.650089 <... open resumed> ) = 7
[pid 25458] 10:12:35.650109 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.650147 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.650164 read(14,  <unfinished ...>
[pid 25479] 10:12:35.650188 read(14,  <unfinished ...>
[pid 25474] 10:12:35.650211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.650241 mprotect(0x7f7c1182f000, 4096, PROT_READ <unfinished ...>
[pid 25472] 10:12:35.650267 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.650290 <... open resumed> ) = 14
[pid 25481] 10:12:35.650317 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.650347 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25479] 10:12:35.650444 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25474] 10:12:35.650619 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.650647 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.650667 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:35.650697 fstat(14,  <unfinished ...>
[pid 25481] 10:12:35.650732 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.650750 read(14,  <unfinished ...>
[pid 25479] 10:12:35.650774 read(14,  <unfinished ...>
[pid 25474] 10:12:35.650797 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.650832 munmap(0x7f7c15c88000, 39387 <unfinished ...>
[pid 25472] 10:12:35.650867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.650898 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.650951 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.650983 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25479] 10:12:35.651060 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25474] 10:12:35.651134 <... open resumed> ) = 6
[pid 25473] 10:12:35.651153 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.651177 <... mmap resumed> ) = 0x7ff101086000
[pid 25458] 10:12:35.651195 fstat(14,  <unfinished ...>
[pid 25481] 10:12:35.651230 <... open resumed> ) = 6
[pid 25480] 10:12:35.651245 read(14,  <unfinished ...>
[pid 25479] 10:12:35.651269 read(14,  <unfinished ...>
[pid 25474] 10:12:35.651292 read(6,  <unfinished ...>
[pid 25473] 10:12:35.651314 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.651342 read(7,  <unfinished ...>
[pid 25458] 10:12:35.651368 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.651407 read(6,  <unfinished ...>
[pid 25480] 10:12:35.651430 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25479] 10:12:35.651501 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25474] 10:12:35.651651 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.651680 <... open resumed> ) = 7
[pid 25472] 10:12:35.651702 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:35.651736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.651775 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.651804 read(14,  <unfinished ...>
[pid 25479] 10:12:35.651833 read(14,  <unfinished ...>
[pid 25474] 10:12:35.651861 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.651889 fcntl(7, F_GETFD <unfinished ...>
[pid 25472] 10:12:35.651917 close(7 <unfinished ...>
[pid 25458] 10:12:35.651942 <... mmap resumed> ) = 0x7f03f4be3000
[pid 25481] 10:12:35.651969 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.651993 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25479] 10:12:35.652076 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25474] 10:12:35.652155 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25473] 10:12:35.652190 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25472] 10:12:35.652211 <... close resumed> ) = 0
[pid 25458] 10:12:35.652229 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.652264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25480] 10:12:35.652294 read(14,  <unfinished ...>
[pid 25479] 10:12:35.652320 read(14,  <unfinished ...>
[pid 25474] 10:12:35.652344 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.652374 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.652397 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25458] 10:12:35.652425 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.652455 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.652483 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25479] 10:12:35.652668 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25474] 10:12:35.652755 <... mmap resumed> ) = 0x7f84e14cf000
[pid 25473] 10:12:35.652775 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.652805 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.652852 read(14,  <unfinished ...>
[pid 25481] 10:12:35.652897 <... mmap resumed> ) = 0x7f04cb752000
[pid 25480] 10:12:35.652918 read(14,  <unfinished ...>
[pid 25479] 10:12:35.652943 read(14,  <unfinished ...>
[pid 25474] 10:12:35.652966 mprotect(0x7f84e1688000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.652993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.653020 read(6,  <unfinished ...>
[pid 25458] 10:12:35.653045 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.653080 mprotect(0x7f04cb90b000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.653116 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25479] 10:12:35.653201 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25474] 10:12:35.653280 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.653299 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.653316 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25458] 10:12:35.653374 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25481] 10:12:35.653419 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.653436 read(14,  <unfinished ...>
[pid 25479] 10:12:35.653461 read(14,  <unfinished ...>
[pid 25474] 10:12:35.653485 mmap(0x7f84e1887000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25473] 10:12:35.653593 read(7,  <unfinished ...>
[pid 25472] 10:12:35.653623 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.653653 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25481] 10:12:35.653830 mmap(0x7f04cbb0a000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25480] 10:12:35.653879 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25479] 10:12:35.653961 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25474] 10:12:35.654032 <... mmap resumed> ) = 0x7f84e1887000
[pid 25473] 10:12:35.654057 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.654096 <... open resumed> ) = 7
[pid 25458] 10:12:35.654115 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.654156 <... mmap resumed> ) = 0x7f04cbb0a000
[pid 25480] 10:12:35.654177 read(14,  <unfinished ...>
[pid 25479] 10:12:35.654202 read(14,  <unfinished ...>
[pid 25474] 10:12:35.654225 mmap(0x7f84e18ae000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.654254 close(7 <unfinished ...>
[pid 25472] 10:12:35.654278 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.654300 <... open resumed> ) = 15
[pid 25481] 10:12:35.654330 mmap(0x7f04cbb31000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.654359 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25479] 10:12:35.654397 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25474] 10:12:35.654426 <... mmap resumed> ) = 0x7f84e18ae000
[pid 25473] 10:12:35.654450 <... close resumed> ) = 0
[pid 25472] 10:12:35.654467 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.654496 fstat(15,  <unfinished ...>
[pid 25481] 10:12:35.654613 <... mmap resumed> ) = 0x7f04cbb31000
[pid 25480] 10:12:35.654637 read(14,  <unfinished ...>
[pid 25479] 10:12:35.654664 read(14,  <unfinished ...>
[pid 25474] 10:12:35.654687 close(6 <unfinished ...>
[pid 25473] 10:12:35.654709 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.654737 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.654762 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.654806 close(6 <unfinished ...>
[pid 25480] 10:12:35.654835 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25479] 10:12:35.654923 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25474] 10:12:35.654996 <... close resumed> ) = 0
[pid 25473] 10:12:35.655025 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.655063 <... mmap resumed> ) = 0x7ff101086000
[pid 25458] 10:12:35.655083 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.655121 <... close resumed> ) = 0
[pid 25480] 10:12:35.655146 read(14,  <unfinished ...>
[pid 25479] 10:12:35.655171 read(14,  <unfinished ...>
[pid 25474] 10:12:35.655194 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.655225 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25472] 10:12:35.655252 read(7,  <unfinished ...>
[pid 25458] 10:12:35.655278 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25481] 10:12:35.655305 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.655335 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25479] 10:12:35.655403 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25474] 10:12:35.655467 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.655489 <... socket resumed> ) = 7
[pid 25472] 10:12:35.655585 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.655623 read(15,  <unfinished ...>
[pid 25481] 10:12:35.655663 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.655680 brk(0xa4d000 <unfinished ...>
[pid 25479] 10:12:35.655706 brk(0xa4d000 <unfinished ...>
[pid 25474] 10:12:35.655729 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.655761 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25472] 10:12:35.655795 close(7 <unfinished ...>
[pid 25458] 10:12:35.655819 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.655864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.655904 <... brk resumed> ) = 0xa4d000
[pid 25479] 10:12:35.655940 <... brk resumed> ) = 0xa4d000
[pid 25474] 10:12:35.655970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.655988 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.656005 <... close resumed> ) = 0
[pid 25458] 10:12:35.656021 close(15 <unfinished ...>
[pid 25481] 10:12:35.656055 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.656072 read(14,  <unfinished ...>
[pid 25479] 10:12:35.656096 read(14,  <unfinished ...>
[pid 25474] 10:12:35.656119 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.656147 close(7 <unfinished ...>
[pid 25472] 10:12:35.656172 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25458] 10:12:35.656200 <... close resumed> ) = 0
[pid 25481] 10:12:35.656225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.656254 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25479] 10:12:35.656332 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25474] 10:12:35.656409 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.656432 <... close resumed> ) = 0
[pid 25472] 10:12:35.656449 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.656474 munmap(0x7f03f4be2000, 4096 <unfinished ...>
[pid 25481] 10:12:35.656588 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.656614 read(14,  <unfinished ...>
[pid 25479] 10:12:35.656639 read(14,  <unfinished ...>
[pid 25474] 10:12:35.656662 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.656695 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25472] 10:12:35.656721 read(6,  <unfinished ...>
[pid 25458] 10:12:35.656745 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.656819 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.656865 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25479] 10:12:35.656957 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25474] 10:12:35.657024 <... open resumed> ) = 6
[pid 25473] 10:12:35.657043 <... socket resumed> ) = 7
[pid 25472] 10:12:35.657059 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25458] 10:12:35.657100 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25481] 10:12:35.657141 <... open resumed> ) = 6
[pid 25480] 10:12:35.657157 read(14,  <unfinished ...>
[pid 25479] 10:12:35.657182 read(14,  <unfinished ...>
[pid 25474] 10:12:35.657205 read(6,  <unfinished ...>
[pid 25473] 10:12:35.657227 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25472] 10:12:35.657259 uname( <unfinished ...>
[pid 25458] 10:12:35.657283 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25481] 10:12:35.657340 read(6,  <unfinished ...>
[pid 25480] 10:12:35.657367 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25479] 10:12:35.657446 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25474] 10:12:35.657604 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.657636 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.657655 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25458] 10:12:35.657711 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.657756 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.657779 read(14,  <unfinished ...>
[pid 25479] 10:12:35.657804 read(14,  <unfinished ...>
[pid 25474] 10:12:35.657834 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.657862 close(7 <unfinished ...>
[pid 25472] 10:12:35.657895 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25458] 10:12:35.657925 <... open resumed> ) = 15
[pid 25481] 10:12:35.657953 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.657977 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25479] 10:12:35.658056 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25474] 10:12:35.658131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25473] 10:12:35.658165 <... close resumed> ) = 0
[pid 25472] 10:12:35.658193 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff0fff3d790}, 8) = 0
[pid 25458] 10:12:35.658227 fstat(15,  <unfinished ...>
[pid 25481] 10:12:35.658264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25480] 10:12:35.658293 read(14,  <unfinished ...>
[pid 25479] 10:12:35.658318 read(14,  <unfinished ...>
[pid 25474] 10:12:35.658343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.658370 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.658398 clone( <unfinished ...>
[pid 25458] 10:12:35.658723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.658775 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.658804 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25479] 10:12:35.658886 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25474] 10:12:35.658962 <... mmap resumed> ) = 0x7f84e3f42000
[pid 25473] 10:12:35.658985 <... open resumed> ) = 7
[pid 25458] 10:12:35.659004 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.659041 <... mmap resumed> ) = 0x7f04ce1c5000
[pid 25480] 10:12:35.659061 read(14,  <unfinished ...>
[pid 25479] 10:12:35.659086 read(14,  <unfinished ...>
[pid 25474] 10:12:35.659109 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.659138 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.659161 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff101070a90) = 25484
[pid 25458] 10:12:35.659203 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25481] 10:12:35.659232 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.659261 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25479] 10:12:35.659341 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25474] 10:12:35.659413 <... mmap resumed> ) = 0x7f84e12a2000
[pid 25473] 10:12:35.659436 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.659465 wait4(25484,  <unfinished ...>
[pid 25458] 10:12:35.659488 read(15,  <unfinished ...>
[pid 25481] 10:12:35.659604 <... mmap resumed> ) = 0x7f04cb525000
[pid 25480] 10:12:35.659623 read(14,  <unfinished ...>
[pid 25479] 10:12:35.659648 read(14,  <unfinished ...>
[pid 25474] 10:12:35.659671 mprotect(0x7f84e12ce000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.659699 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.659724 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25481] 10:12:35.659762 mprotect(0x7f04cb551000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.659790 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25479] 10:12:35.659879 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25474] 10:12:35.659966 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.659987 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25458] 10:12:35.660004 close(15 <unfinished ...>
[pid 25481] 10:12:35.660038 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.660055 read(14,  <unfinished ...>
[pid 25479] 10:12:35.660078 read(14,  <unfinished ...>
[pid 25474] 10:12:35.660101 mmap(0x7f84e14ce000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25473] 10:12:35.660130 read(7,  <unfinished ...>
[pid 25458] 10:12:35.660157 <... close resumed> ) = 0
[pid 25481] 10:12:35.660182 mmap(0x7f04cb751000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25480] 10:12:35.660210 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25479] 10:12:35.660286 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25474] 10:12:35.660358 <... mmap resumed> ) = 0x7f84e14ce000
[pid 25473] 10:12:35.660383 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:35.660426 munmap(0x7f03f4be2000, 4096 <unfinished ...>
[pid 25481] 10:12:35.660468 <... mmap resumed> ) = 0x7f04cb751000
[pid 25480] 10:12:35.660488 read(14,  <unfinished ...>
[pid 25479] 10:12:35.660592 read(14,  <unfinished ...>
[pid 25474] 10:12:35.660619 close(6 <unfinished ...>
[pid 25473] 10:12:35.660642 close(7 <unfinished ...>
[pid 25458] 10:12:35.660667 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.660704 close(6 <unfinished ...>
[pid 25480] 10:12:35.660732 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25479] 10:12:35.660809 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25474] 10:12:35.660902 <... close resumed> ) = 0
[pid 25473] 10:12:35.660936 <... close resumed> ) = 0
[pid 25458] 10:12:35.660954 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.660994 <... close resumed> ) = 0
[pid 25480] 10:12:35.661017 read(14,  <unfinished ...>
[pid 25479] 10:12:35.661043 read(14,  <unfinished ...>
[pid 25474] 10:12:35.661066 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.661099 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.661126 <... open resumed> ) = 15
[pid 25481] 10:12:35.661152 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.661183 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25479] 10:12:35.661258 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25474] 10:12:35.661332 <... open resumed> ) = 6
[pid 25473] 10:12:35.661351 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.661387 fstat(15,  <unfinished ...>
[pid 25481] 10:12:35.661423 <... open resumed> ) = 6
[pid 25480] 10:12:35.661440 read(14,  <unfinished ...>
[pid 25479] 10:12:35.661464 read(14,  <unfinished ...>
[pid 25474] 10:12:35.661487 read(6,  <unfinished ...>
[pid 25473] 10:12:35.661578 read(6,  <unfinished ...>
[pid 25458] 10:12:35.661608 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.661648 read(6,  <unfinished ...>
[pid 25480] 10:12:35.661672 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25479] 10:12:35.661704 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25474] 10:12:35.661740 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.661764 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25458] 10:12:35.661827 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.661881 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.661976 read(14,  <unfinished ...>
[pid 25479] 10:12:35.662008 read(14,  <unfinished ...>
[pid 25474] 10:12:35.662032 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.662054 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:35.662084 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25481] 10:12:35.662110 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.662134 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25479] 10:12:35.662217 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25474] 10:12:35.662295 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25473] 10:12:35.662330 <... open resumed> ) = 7
[pid 25458] 10:12:35.662347 read(15,  <unfinished ...>
[pid 25481] 10:12:35.662384 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25480] 10:12:35.662417 read(14,  <unfinished ...>
[pid 25479] 10:12:35.662442 read(14,  <unfinished ...>
[pid 25474] 10:12:35.662465 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.662496 fstat(7,  <unfinished ...>
[pid 25458] 10:12:35.662590 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25481] 10:12:35.662629 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.662665 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25479] 10:12:35.662759 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25474] 10:12:35.662855 <... mmap resumed> ) = 0x7f84e109d000
[pid 25473] 10:12:35.662879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:35.662918 close(15 <unfinished ...>
[pid 25481] 10:12:35.662956 <... mmap resumed> ) = 0x7f04cb320000
[pid 25480] 10:12:35.662973 read(14,  <unfinished ...>
[pid 25479] 10:12:35.662997 read(14,  <unfinished ...>
[pid 25474] 10:12:35.663020 mprotect(0x7f84e10a2000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.663047 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.663073 <... close resumed> ) = 0
[pid 25481] 10:12:35.663098 mprotect(0x7f04cb325000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.663124 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25479] 10:12:35.663154 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25474] 10:12:35.663181 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.663197 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25458] 10:12:35.663214 munmap(0x7f03f4be2000, 4096 <unfinished ...>
[pid 25481] 10:12:35.663250 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.663266 read(14,  <unfinished ...>
[pid 25479] 10:12:35.663290 read(14,  <unfinished ...>
[pid 25474] 10:12:35.663312 mmap(0x7f84e12a1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25473] 10:12:35.663340 read(7,  <unfinished ...>
[pid 25458] 10:12:35.663366 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.663489 mmap(0x7f04cb524000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25480] 10:12:35.663610 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25479] 10:12:35.663698 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25474] 10:12:35.663777 <... mmap resumed> ) = 0x7f84e12a1000
[pid 25473] 10:12:35.663808 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:35.663839 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.663893 <... mmap resumed> ) = 0x7f04cb524000
[pid 25480] 10:12:35.663918 read(14,  <unfinished ...>
[pid 25479] 10:12:35.663944 read(14,  <unfinished ...>
[pid 25474] 10:12:35.663967 close(6 <unfinished ...>
[pid 25473] 10:12:35.663989 close(7 <unfinished ...>
[pid 25458] 10:12:35.664013 <... open resumed> ) = 15
[pid 25481] 10:12:35.664039 close(6 <unfinished ...>
[pid 25480] 10:12:35.664063 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25479] 10:12:35.664094 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25474] 10:12:35.664122 <... close resumed> ) = 0
[pid 25473] 10:12:35.664152 <... close resumed> ) = 0
[pid 25458] 10:12:35.664170 fstat(15,  <unfinished ...>
[pid 25481] 10:12:35.664202 <... close resumed> ) = 0
[pid 25480] 10:12:35.664228 read(14,  <unfinished ...>
[pid 25479] 10:12:35.664253 read(14,  <unfinished ...>
[pid 25474] 10:12:35.664276 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.664306 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25458] 10:12:35.664333 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.664377 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.664407 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25479] 10:12:35.664580 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25474] 10:12:35.664686 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.664708 <... munmap resumed> ) = 0
[pid 25458] 10:12:35.664734 fstat(15,  <unfinished ...>
[pid 25481] 10:12:35.664770 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.664788 read(14,  <unfinished ...>
[pid 25479] 10:12:35.664813 read(14,  <unfinished ...>
[pid 25474] 10:12:35.664840 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.664885 read(6,  <unfinished ...>
[pid 25458] 10:12:35.664914 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.664958 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.664990 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25479] 10:12:35.665072 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25474] 10:12:35.665155 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.665176 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25458] 10:12:35.665216 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.665255 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.665273 read(14,  <unfinished ...>
[pid 25479] 10:12:35.665298 read(14,  <unfinished ...>
[pid 25474] 10:12:35.665321 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.665352 uname( <unfinished ...>
[pid 25458] 10:12:35.665374 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25481] 10:12:35.665400 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.665429 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25479] 10:12:35.665593 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25474] 10:12:35.665682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.665707 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25458] 10:12:35.665758 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.665795 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.665814 read(14,  <unfinished ...>
[pid 25479] 10:12:35.665845 read(14,  <unfinished ...>
[pid 25474] 10:12:35.665874 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.665908 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25458] 10:12:35.665941 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.665967 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.665996 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25479] 10:12:35.666087 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25474] 10:12:35.666173 <... open resumed> ) = 6
[pid 25473] 10:12:35.666192 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7c14b5f790}, 8) = 0
[pid 25458] 10:12:35.666221 read(15,  <unfinished ...>
[pid 25481] 10:12:35.666259 <... open resumed> ) = 6
[pid 25480] 10:12:35.666275 read(14,  <unfinished ...>
[pid 25479] 10:12:35.666299 read(14,  <unfinished ...>
[pid 25474] 10:12:35.666322 read(6,  <unfinished ...>
[pid 25473] 10:12:35.666345 clone( <unfinished ...>
[pid 25458] 10:12:35.666638 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25481] 10:12:35.666680 read(6,  <unfinished ...>
[pid 25480] 10:12:35.666706 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25479] 10:12:35.666793 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25474] 10:12:35.666886 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.666917 read(15,  <unfinished ...>
[pid 25481] 10:12:35.666951 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.666973 read(14,  <unfinished ...>
[pid 25479] 10:12:35.666998 read(14,  <unfinished ...>
[pid 25474] 10:12:35.667021 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.667044 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25485
[pid 25458] 10:12:35.667086 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.667182 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.667214 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25479] 10:12:35.667304 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25474] 10:12:35.667389 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25473] 10:12:35.667425 wait4(25485,  <unfinished ...>
[pid 25458] 10:12:35.667450 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.667482 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25480] 10:12:35.667594 read(14,  <unfinished ...>
[pid 25479] 10:12:35.667625 read(14,  <unfinished ...>
[pid 25474] 10:12:35.667649 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.667681 <... lseek resumed> ) = 353
[pid 25481] 10:12:35.667716 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.667746 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25479] 10:12:35.667825 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25474] 10:12:35.667897 <... mmap resumed> ) = 0x7f84e0e9a000
[pid 25458] 10:12:35.667917 read(9,  <unfinished ...>
[pid 25481] 10:12:35.667949 <... mmap resumed> ) = 0x7f04cb11d000
[pid 25480] 10:12:35.667965 read(14,  <unfinished ...>
[pid 25479] 10:12:35.667989 read(14,  <unfinished ...>
[pid 25474] 10:12:35.668012 mprotect(0x7f84e0e9c000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.668039 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.668085 mprotect(0x7f04cb11f000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.668117 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25479] 10:12:35.668188 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25474] 10:12:35.668256 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.668276 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.668310 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.668326 read(14,  <unfinished ...>
[pid 25479] 10:12:35.668351 read(14,  <unfinished ...>
[pid 25474] 10:12:35.668374 mmap(0x7f84e109b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25458] 10:12:35.668404 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.668429 mmap(0x7f04cb31e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25480] 10:12:35.668457 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25479] 10:12:35.668599 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25474] 10:12:35.668667 <... mmap resumed> ) = 0x7f84e109b000
[pid 25458] 10:12:35.668699 read(9,  <unfinished ...>
[pid 25481] 10:12:35.668734 <... mmap resumed> ) = 0x7f04cb31e000
[pid 25480] 10:12:35.668758 brk(0xa6e000 <unfinished ...>
[pid 25479] 10:12:35.668784 brk(0xa6e000 <unfinished ...>
[pid 25474] 10:12:35.668808 close(6 <unfinished ...>
[pid 25458] 10:12:35.668830 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25481] 10:12:35.668894 close(6 <unfinished ...>
[pid 25480] 10:12:35.668924 <... brk resumed> ) = 0xa6e000
[pid 25479] 10:12:35.668954 <... brk resumed> ) = 0xa6e000
[pid 25474] 10:12:35.668988 <... close resumed> ) = 0
[pid 25458] 10:12:35.669015 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.669058 <... close resumed> ) = 0
[pid 25480] 10:12:35.669084 read(14,  <unfinished ...>
[pid 25479] 10:12:35.669110 read(14,  <unfinished ...>
[pid 25474] 10:12:35.669134 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.669169 <... stat resumed> 0x7f03f3286880) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.669216 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.669251 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25479] 10:12:35.669325 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25474] 10:12:35.669395 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.669416 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25481] 10:12:35.669452 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.669470 read(14,  <unfinished ...>
[pid 25479] 10:12:35.669495 read(14,  <unfinished ...>
[pid 25474] 10:12:35.669599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.669635 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.669699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.669737 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25479] 10:12:35.669816 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25474] 10:12:35.669907 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.669935 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.669979 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.669997 read(14,  <unfinished ...>
[pid 25479] 10:12:35.670022 read(14,  <unfinished ...>
[pid 25474] 10:12:35.670046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.670076 <... open resumed> ) = 16
[pid 25481] 10:12:35.670107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.670139 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25479] 10:12:35.670220 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25474] 10:12:35.670305 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.670328 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.670363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.670381 read(14,  <unfinished ...>
[pid 25479] 10:12:35.670406 read(14,  <unfinished ...>
[pid 25474] 10:12:35.670429 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.670463 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.670489 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.670604 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25479] 10:12:35.670638 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25474] 10:12:35.670666 <... open resumed> ) = 6
[pid 25458] 10:12:35.670683 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.670714 <... open resumed> ) = 6
[pid 25480] 10:12:35.670730 read(14,  <unfinished ...>
[pid 25479] 10:12:35.670755 read(14,  <unfinished ...>
[pid 25474] 10:12:35.670778 read(6,  <unfinished ...>
[pid 25458] 10:12:35.670801 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.670830 read(6,  <unfinished ...>
[pid 25480] 10:12:35.670862 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25479] 10:12:35.670947 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25474] 10:12:35.671022 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.671048 fstat(16,  <unfinished ...>
[pid 25481] 10:12:35.671080 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.671103 read(14,  <unfinished ...>
[pid 25479] 10:12:35.671127 read(14,  <unfinished ...>
[pid 25474] 10:12:35.671150 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.671173 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25481] 10:12:35.671216 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.671240 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25479] 10:12:35.671310 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25474] 10:12:35.671380 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25458] 10:12:35.671415 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.671448 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25480] 10:12:35.671478 read(14,  <unfinished ...>
[pid 25479] 10:12:35.671503 read(14,  <unfinished ...>
[pid 25474] 10:12:35.671633 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.671663 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.671690 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.671717 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25479] 10:12:35.671790 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25474] 10:12:35.671868 <... mmap resumed> ) = 0x7f84e3f41000
[pid 25458] 10:12:35.671895 fstat(16,  <unfinished ...>
[pid 25481] 10:12:35.671935 <... mmap resumed> ) = 0x7f04ce1c4000
[pid 25480] 10:12:35.671955 read(14,  <unfinished ...>
[pid 25479] 10:12:35.671980 read(14,  <unfinished ...>
[pid 25474] 10:12:35.672004 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.672033 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25481] 10:12:35.672087 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.672119 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25479] 10:12:35.672187 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25474] 10:12:35.672258 <... mmap resumed> ) = 0x7f84e0c77000
[pid 25458] 10:12:35.672277 read(16,  <unfinished ...>
[pid 25481] 10:12:35.672310 <... mmap resumed> ) = 0x7f04caefa000
[pid 25480] 10:12:35.672326 read(14,  <unfinished ...>
[pid 25479] 10:12:35.672350 read(14,  <unfinished ...>
[pid 25474] 10:12:35.672373 mprotect(0x7f84e0c8e000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.672401 <... read resumed> "0", 8192) = 1
[pid 25481] 10:12:35.672429 mprotect(0x7f04caf11000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.672458 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25479] 10:12:35.672618 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25474] 10:12:35.672698 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.672718 read(16,  <unfinished ...>
[pid 25481] 10:12:35.672752 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.672768 read(14,  <unfinished ...>
[pid 25479] 10:12:35.672793 read(14,  <unfinished ...>
[pid 25474] 10:12:35.672823 mmap(0x7f84e0e8e000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25458] 10:12:35.672859 <... read resumed> "", 8192) = 0
[pid 25481] 10:12:35.672894 mmap(0x7f04cb111000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25480] 10:12:35.672929 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25479] 10:12:35.673001 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25474] 10:12:35.673070 <... mmap resumed> ) = 0x7f84e0e8e000
[pid 25458] 10:12:35.673099 close(16 <unfinished ...>
[pid 25481] 10:12:35.673135 <... mmap resumed> ) = 0x7f04cb111000
[pid 25480] 10:12:35.673159 read(14,  <unfinished ...>
[pid 25479] 10:12:35.673185 read(14,  <unfinished ...>
[pid 25474] 10:12:35.673208 close(6 <unfinished ...>
[pid 25458] 10:12:35.673231 <... close resumed> ) = 0
[pid 25481] 10:12:35.673319 close(6 <unfinished ...>
[pid 25480] 10:12:35.673351 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25479] 10:12:35.673423 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25474] 10:12:35.673489 <... close resumed> ) = 0
[pid 25458] 10:12:35.673607 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.673655 <... close resumed> ) = 0
[pid 25480] 10:12:35.673695 read(14,  <unfinished ...>
[pid 25479] 10:12:35.673722 read(14,  <unfinished ...>
[pid 25474] 10:12:35.673745 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.673776 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25481] 10:12:35.673846 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.673886 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25479] 10:12:35.673924 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25474] 10:12:35.673955 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.673973 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.674007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.674025 read(14,  <unfinished ...>
[pid 25479] 10:12:35.674049 read(14,  <unfinished ...>
[pid 25474] 10:12:35.674072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.674104 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.674152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.674187 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25479] 10:12:35.674287 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25474] 10:12:35.674381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.674402 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.674438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.674457 read(14,  <unfinished ...>
[pid 25479] 10:12:35.674482 read(14,  <unfinished ...>
[pid 25474] 10:12:35.674505 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.674625 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.674669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.674700 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25479] 10:12:35.674776 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25474] 10:12:35.674862 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.674887 close(7 <unfinished ...>
[pid 25481] 10:12:35.674931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.674951 read(14,  <unfinished ...>
[pid 25479] 10:12:35.674976 read(14,  <unfinished ...>
[pid 25474] 10:12:35.674999 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.675031 <... close resumed> ) = 0
[pid 25481] 10:12:35.675058 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.675088 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25479] 10:12:35.675168 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25474] 10:12:35.675245 <... open resumed> ) = 6
[pid 25458] 10:12:35.675264 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.675307 <... open resumed> ) = 6
[pid 25480] 10:12:35.675323 read(14,  <unfinished ...>
[pid 25479] 10:12:35.675348 read(14,  <unfinished ...>
[pid 25474] 10:12:35.675372 read(6,  <unfinished ...>
[pid 25458] 10:12:35.675395 <... open resumed> ) = 7
[pid 25481] 10:12:35.675419 read(6,  <unfinished ...>
[pid 25480] 10:12:35.675442 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25479] 10:12:35.675597 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25474] 10:12:35.675681 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.675708 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.675740 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.675763 read(14,  <unfinished ...>
[pid 25479] 10:12:35.675788 read(14,  <unfinished ...>
[pid 25474] 10:12:35.675810 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.675836 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.675866 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.675891 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25479] 10:12:35.675965 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25474] 10:12:35.676031 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.676066 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.676098 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25480] 10:12:35.676128 read(14,  <unfinished ...>
[pid 25479] 10:12:35.676152 read(14,  <unfinished ...>
[pid 25474] 10:12:35.676175 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.676205 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.676229 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.676256 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25479] 10:12:35.676348 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25474] 10:12:35.676434 <... mmap resumed> ) = 0x7f84e0a33000
[pid 25458] 10:12:35.676456 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.676502 <... mmap resumed> ) = 0x7f04cacb6000
[pid 25480] 10:12:35.676624 read(14,  <unfinished ...>
[pid 25479] 10:12:35.676651 read(14,  <unfinished ...>
[pid 25474] 10:12:35.676674 mprotect(0x7f84e0a74000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.676704 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373289, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.676743 mprotect(0x7f04cacf7000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.676770 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25479] 10:12:35.676799 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25474] 10:12:35.676826 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.676842 write(7, "2015-12-30 10:12:35 [25458] 1aEJMY-0006cO-Sq SMTP connection outbound 1451491955 1aEJMY-0006cO-Sq finestweddingsites.com terri@theviewsatsuperstition.com\n", 154 <unfinished ...>
[pid 25481] 10:12:35.676880 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.676896 read(14,  <unfinished ...>
[pid 25479] 10:12:35.676920 read(14,  <unfinished ...>
[pid 25474] 10:12:35.676947 mmap(0x7f84e0c74000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25458] 10:12:35.676978 <... write resumed> ) = 154
[pid 25481] 10:12:35.677046 mmap(0x7f04caef7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25480] 10:12:35.677082 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25479] 10:12:35.677161 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25474] 10:12:35.677233 <... mmap resumed> ) = 0x7f84e0c74000
[pid 25458] 10:12:35.677262 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25481] 10:12:35.677388 <... mmap resumed> ) = 0x7f04caef7000
[pid 25480] 10:12:35.677421 read(14,  <unfinished ...>
[pid 25479] 10:12:35.677448 read(14,  <unfinished ...>
[pid 25474] 10:12:35.677472 close(6 <unfinished ...>
[pid 25458] 10:12:35.677495 <... open resumed> ) = 16
[pid 25481] 10:12:35.677526 close(6 <unfinished ...>
[pid 25480] 10:12:35.677551 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25479] 10:12:35.677582 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25474] 10:12:35.677610 <... close resumed> ) = 0
[pid 25458] 10:12:35.677635 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25481] 10:12:35.677668 <... close resumed> ) = 0
[pid 25480] 10:12:35.677695 read(14,  <unfinished ...>
[pid 25479] 10:12:35.677720 read(14,  <unfinished ...>
[pid 25474] 10:12:35.677744 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.677775 <... lseek resumed> ) = 8
[pid 25481] 10:12:35.677800 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.677830 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25479] 10:12:35.677905 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25474] 10:12:35.677977 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.677999 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.678033 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.678050 read(14,  <unfinished ...>
[pid 25479] 10:12:35.678074 read(14,  <unfinished ...>
[pid 25474] 10:12:35.678097 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.678130 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.678162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.678194 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25479] 10:12:35.678224 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25474] 10:12:35.678253 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.678270 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.678301 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.678321 read(14,  <unfinished ...>
[pid 25479] 10:12:35.678345 read(14,  <unfinished ...>
[pid 25474] 10:12:35.678368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.678398 <... lseek resumed> ) = 8
[pid 25481] 10:12:35.678423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.678453 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25479] 10:12:35.678633 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25474] 10:12:35.678713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.678737 fstat(16,  <unfinished ...>
[pid 25481] 10:12:35.678778 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.678801 read(14,  <unfinished ...>
[pid 25479] 10:12:35.678827 read(14,  <unfinished ...>
[pid 25474] 10:12:35.678851 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.678884 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=8, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.678923 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.678953 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25479] 10:12:35.679035 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25474] 10:12:35.679114 <... open resumed> ) = 6
[pid 25458] 10:12:35.679133 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.679165 <... open resumed> ) = 6
[pid 25480] 10:12:35.679181 read(14,  <unfinished ...>
[pid 25479] 10:12:35.679205 read(14,  <unfinished ...>
[pid 25474] 10:12:35.679228 read(6,  <unfinished ...>
[pid 25458] 10:12:35.679251 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.679285 read(6,  <unfinished ...>
[pid 25480] 10:12:35.679311 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25479] 10:12:35.679351 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25474] 10:12:35.679382 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.679405 write(16, "1", 1 <unfinished ...>
[pid 25481] 10:12:35.679444 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.679467 read(14,  <unfinished ...>
[pid 25479] 10:12:35.679491 read(14,  <unfinished ...>
[pid 25474] 10:12:35.679615 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.679642 <... write resumed> ) = 1
[pid 25481] 10:12:35.679667 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.679691 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25479] 10:12:35.679786 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25474] 10:12:35.679891 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.679933 close(16 <unfinished ...>
[pid 25481] 10:12:35.679968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25480] 10:12:35.679998 read(14,  <unfinished ...>
[pid 25479] 10:12:35.680022 read(14,  <unfinished ...>
[pid 25474] 10:12:35.680045 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:35.680072 <... close resumed> ) = 0
[pid 25481] 10:12:35.680120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.680152 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25479] 10:12:35.680233 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25474] 10:12:35.680305 <... mmap resumed> ) = 0x7f84e3f40000
[pid 25458] 10:12:35.680328 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.680368 <... mmap resumed> ) = 0x7f04ce1c3000
[pid 25480] 10:12:35.680392 brk(0xa8f000 <unfinished ...>
[pid 25479] 10:12:35.680417 brk(0xa8f000 <unfinished ...>
[pid 25474] 10:12:35.680441 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.680470 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.680504 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.680615 <... brk resumed> ) = 0xa8f000
[pid 25479] 10:12:35.680652 <... brk resumed> ) = 0xa8f000
[pid 25474] 10:12:35.680684 <... mmap resumed> ) = 0x7f84e074c000
[pid 25458] 10:12:35.680702 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25481] 10:12:35.680738 <... mmap resumed> ) = 0x7f04ca9cf000
[pid 25480] 10:12:35.680755 read(14,  <unfinished ...>
[pid 25479] 10:12:35.680779 read(14,  <unfinished ...>
[pid 25474] 10:12:35.680806 mprotect(0x7f84e0827000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.680839 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.680897 mprotect(0x7f04caaaa000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.680929 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25479] 10:12:35.681017 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25474] 10:12:35.681099 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.681118 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.681157 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.681173 read(14,  <unfinished ...>
[pid 25479] 10:12:35.681197 read(14,  <unfinished ...>
[pid 25474] 10:12:35.681220 mmap(0x7f84e0a27000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25458] 10:12:35.681250 <... open resumed> ) = 16
[pid 25481] 10:12:35.681275 mmap(0x7f04cacaa000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25480] 10:12:35.681304 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25479] 10:12:35.681401 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25474] 10:12:35.681494 <... mmap resumed> ) = 0x7f84e0a27000
[pid 25458] 10:12:35.681601 fstat(16,  <unfinished ...>
[pid 25481] 10:12:35.681639 <... mmap resumed> ) = 0x7f04cacaa000
[pid 25480] 10:12:35.681664 read(14,  <unfinished ...>
[pid 25479] 10:12:35.681690 read(14,  <unfinished ...>
[pid 25474] 10:12:35.681713 close(6 <unfinished ...>
[pid 25458] 10:12:35.681741 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25481] 10:12:35.681780 close(6 <unfinished ...>
[pid 25480] 10:12:35.681803 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25479] 10:12:35.681835 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25474] 10:12:35.681865 <... close resumed> ) = 0
[pid 25458] 10:12:35.681890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.681926 <... close resumed> ) = 0
[pid 25480] 10:12:35.681951 read(14,  <unfinished ...>
[pid 25479] 10:12:35.681976 read(14,  <unfinished ...>
[pid 25474] 10:12:35.681999 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.682030 <... mmap resumed> ) = 0x7f03f4be1000
[pid 25481] 10:12:35.682054 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.682083 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25479] 10:12:35.682158 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25474] 10:12:35.682230 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.682251 read(16,  <unfinished ...>
[pid 25481] 10:12:35.682287 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.682304 read(14,  <unfinished ...>
[pid 25479] 10:12:35.682330 read(14,  <unfinished ...>
[pid 25474] 10:12:35.682353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.682385 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25481] 10:12:35.682418 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.682451 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25479] 10:12:35.682619 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25474] 10:12:35.682705 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.682726 read(16,  <unfinished ...>
[pid 25481] 10:12:35.682758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.682776 read(14,  <unfinished ...>
[pid 25479] 10:12:35.682806 read(14,  <unfinished ...>
[pid 25474] 10:12:35.682828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.682859 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.682884 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.682914 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25479] 10:12:35.682945 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25474] 10:12:35.682975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.682995 close(16 <unfinished ...>
[pid 25481] 10:12:35.683028 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.683047 read(14,  <unfinished ...>
[pid 25479] 10:12:35.683071 read(14,  <unfinished ...>
[pid 25474] 10:12:35.683094 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.683124 <... close resumed> ) = 0
[pid 25481] 10:12:35.683149 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.683177 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25479] 10:12:35.683292 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25474] 10:12:35.683403 <... open resumed> ) = 6
[pid 25458] 10:12:35.683423 munmap(0x7f03f4be1000, 4096 <unfinished ...>
[pid 25481] 10:12:35.683461 <... open resumed> ) = 6
[pid 25480] 10:12:35.683478 read(14,  <unfinished ...>
[pid 25479] 10:12:35.683502 read(14,  <unfinished ...>
[pid 25474] 10:12:35.683603 read(6,  <unfinished ...>
[pid 25458] 10:12:35.683628 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.683653 read(6,  <unfinished ...>
[pid 25480] 10:12:35.683677 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25479] 10:12:35.683711 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25474] 10:12:35.683741 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:35.683764 uname( <unfinished ...>
[pid 25481] 10:12:35.683794 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.683821 read(14,  <unfinished ...>
[pid 25479] 10:12:35.683846 read(14,  <unfinished ...>
[pid 25474] 10:12:35.683869 fstat(6,  <unfinished ...>
[pid 25458] 10:12:35.683891 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25481] 10:12:35.683989 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.684019 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25479] 10:12:35.684105 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25474] 10:12:35.684189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:35.684225 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25481] 10:12:35.684264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25480] 10:12:35.684295 read(14,  <unfinished ...>
[pid 25479] 10:12:35.684319 read(14,  <unfinished ...>
[pid 25474] 10:12:35.684342 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:35.684373 <... socket resumed> ) = 16
[pid 25481] 10:12:35.684405 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.684439 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25479] 10:12:35.684618 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25474] 10:12:35.684700 <... mmap resumed> ) = 0x7f84e0548000
[pid 25458] 10:12:35.684720 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25481] 10:12:35.684778 <... mmap resumed> ) = 0x7f04ca7cb000
[pid 25480] 10:12:35.684798 read(14,  <unfinished ...>
[pid 25479] 10:12:35.684823 read(14,  <unfinished ...>
[pid 25474] 10:12:35.684846 mprotect(0x7f84e054b000, 2093056, PROT_NONE <unfinished ...>
[pid 25458] 10:12:35.684873 <... connect resumed> ) = 0
[pid 25481] 10:12:35.684902 mprotect(0x7f04ca7ce000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.684930 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25479] 10:12:35.684966 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25474] 10:12:35.684993 <... mprotect resumed> ) = 0
[pid 25458] 10:12:35.685010 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25481] 10:12:35.685044 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.685061 read(14,  <unfinished ...>
[pid 25479] 10:12:35.685085 read(14,  <unfinished ...>
[pid 25474] 10:12:35.685107 mmap(0x7f84e074a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25458] 10:12:35.685137 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25481] 10:12:35.685165 mmap(0x7f04ca9cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25480] 10:12:35.685194 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25479] 10:12:35.685269 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25474] 10:12:35.685342 <... mmap resumed> ) = 0x7f84e074a000
[pid 25458] 10:12:35.685373 sendto(16, "\326\36\1\0\0\1\0\0\0\0\0\0\26theviewsatsuperstition\3com\0\0\17\0\1", 44, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25481] 10:12:35.685441 <... mmap resumed> ) = 0x7f04ca9cd000
[pid 25480] 10:12:35.685468 read(14,  <unfinished ...>
[pid 25479] 10:12:35.685495 read(14,  <unfinished ...>
[pid 25474] 10:12:35.685607 close(6 <unfinished ...>
[pid 25458] 10:12:35.685632 <... sendto resumed> ) = 44
Process 25484 attached
[pid 25481] 10:12:35.685670 close(6 <unfinished ...>
[pid 25480] 10:12:35.685709 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25479] 10:12:35.685741 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25474] 10:12:35.685779 <... close resumed> ) = 0
[pid 25458] 10:12:35.685804 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25484] 10:12:35.685841 set_robust_list(0x7ff101070aa0, 24 <unfinished ...>
[pid 25482] 10:12:35.685865 <... connect resumed> ) = 0
[pid 25481] 10:12:35.685882 <... close resumed> ) = 0
[pid 25480] 10:12:35.685906 read(14,  <unfinished ...>
[pid 25479] 10:12:35.685938 read(14,  <unfinished ...>
[pid 25474] 10:12:35.685965 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.686006 <... set_robust_list resumed> ) = 0
[pid 25482] 10:12:35.686020 alarm(0 <unfinished ...>
[pid 25481] 10:12:35.686070 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.686100 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25479] 10:12:35.686179 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25474] 10:12:35.686253 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.686283 geteuid( <unfinished ...>
[pid 25482] 10:12:35.686307 <... alarm resumed> ) = 300
[pid 25481] 10:12:35.686332 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.686350 read(14,  <unfinished ...>
[pid 25479] 10:12:35.686374 read(14,  <unfinished ...>
[pid 25474] 10:12:35.686398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.686440 <... geteuid resumed> ) = 0
[pid 25482] 10:12:35.686454 getsockname(11,  <unfinished ...>
[pid 25481] 10:12:35.686486 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.686602 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25479] 10:12:35.686637 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25474] 10:12:35.686667 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.686694 geteuid( <unfinished ...>
[pid 25482] 10:12:35.686716 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(41115), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25481] 10:12:35.686748 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.686768 read(14,  <unfinished ...>
[pid 25479] 10:12:35.686793 read(14,  <unfinished ...>
[pid 25474] 10:12:35.686815 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.686865 <... geteuid resumed> ) = 0
[pid 25482] 10:12:35.686879 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25481] 10:12:35.686916 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.686947 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25479] 10:12:35.687027 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25474] 10:12:35.687104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.687136 getegid( <unfinished ...>
[pid 25482] 10:12:35.687159 <... setsockopt resumed> ) = 0
[pid 25481] 10:12:35.687187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.687206 read(14,  <unfinished ...>
[pid 25479] 10:12:35.687231 read(14,  <unfinished ...>
[pid 25474] 10:12:35.687254 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.687296 <... getegid resumed> ) = 12
[pid 25482] 10:12:35.687310 stat("/etc/mailhelo",  <unfinished ...>
[pid 25481] 10:12:35.687353 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.687389 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25479] 10:12:35.687464 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25474] 10:12:35.687621 <... open resumed> ) = 6
Process 25485 attached
[pid 25484] 10:12:35.687667 setgid(12 <unfinished ...>
[pid 25482] 10:12:35.687706 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.687748 <... open resumed> ) = 6
[pid 25480] 10:12:35.687766 read(14,  <unfinished ...>
[pid 25479] 10:12:35.687790 read(14,  <unfinished ...>
[pid 25474] 10:12:35.687813 read(6,  <unfinished ...>
[pid 25485] 10:12:35.687858 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25484] 10:12:35.687884 <... setgid resumed> ) = 0
[pid 25482] 10:12:35.687898 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.687935 read(6,  <unfinished ...>
[pid 25480] 10:12:35.687959 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25479] 10:12:35.688027 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25474] 10:12:35.688096 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25485] 10:12:35.688133 <... set_robust_list resumed> ) = 0
[pid 25484] 10:12:35.688147 setuid(47 <unfinished ...>
[pid 25482] 10:12:35.688196 <... open resumed> ) = 13
[pid 25481] 10:12:35.688214 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.688237 read(14,  <unfinished ...>
[pid 25479] 10:12:35.688261 read(14,  <unfinished ...>
[pid 25474] 10:12:35.688283 fstat(6,  <unfinished ...>
[pid 25485] 10:12:35.688316 geteuid( <unfinished ...>
[pid 25484] 10:12:35.688338 <... setuid resumed> ) = 0
[pid 25482] 10:12:35.688353 fstat(13,  <unfinished ...>
[pid 25481] 10:12:35.690017 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.690044 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25479] 10:12:35.690084 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25474] 10:12:35.690116 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25485] 10:12:35.690158 <... geteuid resumed> ) = 0
[pid 25484] 10:12:35.690173 brk(0x2761000 <unfinished ...>
[pid 25482] 10:12:35.690203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.690236 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25480] 10:12:35.690267 read(14,  <unfinished ...>
[pid 25479] 10:12:35.690291 read(14,  <unfinished ...>
[pid 25474] 10:12:35.690317 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25485] 10:12:35.690357 geteuid( <unfinished ...>
[pid 25482] 10:12:35.690380 fstat(13,  <unfinished ...>
[pid 25481] 10:12:35.690403 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.690430 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25479] 10:12:35.690589 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25474] 10:12:35.690680 <... mmap resumed> ) = 0x7f84e031c000
[pid 25485] 10:12:35.690711 <... geteuid resumed> ) = 0
[pid 25482] 10:12:35.690725 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:35.690756 <... mmap resumed> ) = 0x7f04ca59f000
[pid 25480] 10:12:35.690773 read(14,  <unfinished ...>
[pid 25479] 10:12:35.690798 read(14,  <unfinished ...>
[pid 25474] 10:12:35.690820 mprotect(0x7f84e0345000, 2097152, PROT_NONE <unfinished ...>
[pid 25485] 10:12:35.690857 getegid( <unfinished ...>
[pid 25482] 10:12:35.690878 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.690905 mprotect(0x7f04ca5c8000, 2097152, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.690932 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25479] 10:12:35.691003 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25474] 10:12:35.691079 <... mprotect resumed> ) = 0
[pid 25485] 10:12:35.691171 <... getegid resumed> ) = 12
[pid 25482] 10:12:35.691190 <... mmap resumed> ) = 0x7fdec5ab7000
[pid 25481] 10:12:35.691214 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.691231 read(14,  <unfinished ...>
[pid 25479] 10:12:35.691256 read(14,  <unfinished ...>
[pid 25474] 10:12:35.691278 mmap(0x7f84e0545000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25485] 10:12:35.691322 setgid(12 <unfinished ...>
[pid 25482] 10:12:35.691345 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.691368 mmap(0x7f04ca7c8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25480] 10:12:35.691397 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25479] 10:12:35.691472 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25474] 10:12:35.691635 <... mmap resumed> ) = 0x7f84e0545000
[pid 25485] 10:12:35.691693 <... setgid resumed> ) = 0
[pid 25482] 10:12:35.691721 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.691760 <... mmap resumed> ) = 0x7f04ca7c8000
[pid 25480] 10:12:35.691796 read(14,  <unfinished ...>
[pid 25479] 10:12:35.691836 read(14,  <unfinished ...>
[pid 25474] 10:12:35.691871 mmap(0x7f84e0547000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25485] 10:12:35.691929 setuid(47 <unfinished ...>
[pid 25482] 10:12:35.691965 read(13,  <unfinished ...>
[pid 25481] 10:12:35.692001 mmap(0x7f04ca7ca000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.692043 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25479] 10:12:35.692168 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25474] 10:12:35.692291 <... mmap resumed> ) = 0x7f84e0547000
[pid 25485] 10:12:35.692345 <... setuid resumed> ) = 0
[pid 25482] 10:12:35.692373 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.694399 <... mmap resumed> ) = 0x7f04ca7ca000
[pid 25480] 10:12:35.694439 read(14,  <unfinished ...>
[pid 25479] 10:12:35.694469 read(14,  <unfinished ...>
[pid 25474] 10:12:35.694493 close(6 <unfinished ...>
[pid 25485] 10:12:35.694531 brk(0xf24000 <unfinished ...>
[pid 25482] 10:12:35.694552 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.694593 close(6 <unfinished ...>
[pid 25480] 10:12:35.694621 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25479] 10:12:35.694730 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25474] 10:12:35.694860 <... close resumed> ) = 0
[pid 25482] 10:12:35.694925 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.694959 <... close resumed> ) = 0
[pid 25480] 10:12:35.694992 read(14,  <unfinished ...>
[pid 25479] 10:12:35.695019 read(14,  <unfinished ...>
[pid 25474] 10:12:35.695042 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.695083 read(13,  <unfinished ...>
[pid 25481] 10:12:35.695107 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.695136 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25479] 10:12:35.695211 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25474] 10:12:35.695282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.695312 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.695391 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.695417 read(14,  <unfinished ...>
[pid 25479] 10:12:35.695442 read(14,  <unfinished ...>
[pid 25474] 10:12:35.695466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.695582 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.695613 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.695646 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25479] 10:12:35.695721 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25474] 10:12:35.695795 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.695826 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.695844 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.695861 read(14,  <unfinished ...>
[pid 25479] 10:12:35.695885 read(14,  <unfinished ...>
[pid 25474] 10:12:35.695907 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.695945 read(13,  <unfinished ...>
[pid 25481] 10:12:35.695968 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.695996 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25479] 10:12:35.696064 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25474] 10:12:35.696131 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.696161 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.696182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.696206 read(14,  <unfinished ...>
[pid 25479] 10:12:35.696231 read(14,  <unfinished ...>
[pid 25474] 10:12:35.696254 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.696294 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.696320 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.696349 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25479] 10:12:35.696377 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25474] 10:12:35.696403 <... open resumed> ) = 6
[pid 25482] 10:12:35.696427 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.696444 <... open resumed> ) = 6
[pid 25480] 10:12:35.696459 read(14,  <unfinished ...>
[pid 25479] 10:12:35.696483 read(14,  <unfinished ...>
[pid 25474] 10:12:35.696581 read(6,  <unfinished ...>
[pid 25482] 10:12:35.696626 read(13,  <unfinished ...>
[pid 25481] 10:12:35.696650 read(6,  <unfinished ...>
[pid 25480] 10:12:35.696673 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25479] 10:12:35.696750 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25474] 10:12:35.696827 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25484] 10:12:35.696864 <... brk resumed> ) = 0x2761000
[pid 25482] 10:12:35.696879 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.697306 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.697337 read(14,  <unfinished ...>
[pid 25479] 10:12:35.697364 read(14,  <unfinished ...>
[pid 25474] 10:12:35.697387 fstat(6,  <unfinished ...>
[pid 25484] 10:12:35.697422 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25482] 10:12:35.697451 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25481] 10:12:35.697487 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.697579 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25479] 10:12:35.697621 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25474] 10:12:35.697651 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25481] 10:12:35.697691 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25480] 10:12:35.697721 brk(0xab0000 <unfinished ...>
[pid 25479] 10:12:35.697747 brk(0xab0000 <unfinished ...>
[pid 25474] 10:12:35.697773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.697807 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.697833 <... brk resumed> ) = 0xab0000
[pid 25479] 10:12:35.697902 <... brk resumed> ) = 0xab0000
[pid 25474] 10:12:35.697966 <... mmap resumed> ) = 0x7f84e3f3f000
[pid 25481] 10:12:35.697995 <... mmap resumed> ) = 0x7f04ce1c2000
[pid 25480] 10:12:35.698016 read(14,  <unfinished ...>
[pid 25479] 10:12:35.698041 read(14,  <unfinished ...>
[pid 25474] 10:12:35.698063 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25481] 10:12:35.698101 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.698129 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25479] 10:12:35.698159 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25474] 10:12:35.698187 <... mmap resumed> ) = 0x7f84e0106000
[pid 25481] 10:12:35.698210 <... mmap resumed> ) = 0x7f04ca389000
[pid 25480] 10:12:35.698226 read(14,  <unfinished ...>
[pid 25479] 10:12:35.698250 read(14,  <unfinished ...>
[pid 25474] 10:12:35.698272 mprotect(0x7f84e011b000, 2093056, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.698306 mprotect(0x7f04ca39e000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.698333 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25479] 10:12:35.698407 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25474] 10:12:35.698480 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.698589 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.698614 read(14,  <unfinished ...>
[pid 25479] 10:12:35.698639 read(14,  <unfinished ...>
[pid 25474] 10:12:35.698662 mmap(0x7f84e031a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25481] 10:12:35.698699 mmap(0x7f04ca59d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25480] 10:12:35.698746 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25479] 10:12:35.698782 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25474] 10:12:35.698816 <... mmap resumed> ) = 0x7f84e031a000
[pid 25484] 10:12:35.698856 <... open resumed> ) = 7
[pid 25481] 10:12:35.698873 <... mmap resumed> ) = 0x7f04ca59d000
[pid 25480] 10:12:35.698909 read(14,  <unfinished ...>
[pid 25479] 10:12:35.698935 read(14,  <unfinished ...>
[pid 25474] 10:12:35.698958 close(6 <unfinished ...>
[pid 25484] 10:12:35.698988 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.699010 close(6 <unfinished ...>
[pid 25480] 10:12:35.699033 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25479] 10:12:35.699110 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25474] 10:12:35.699183 <... close resumed> ) = 0
[pid 25484] 10:12:35.699231 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25481] 10:12:35.699262 <... close resumed> ) = 0
[pid 25480] 10:12:35.699302 read(14,  <unfinished ...>
[pid 25479] 10:12:35.699329 read(14,  <unfinished ...>
[pid 25474] 10:12:35.699351 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.699390 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25481] 10:12:35.699416 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.699445 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25479] 10:12:35.699598 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25474] 10:12:35.699678 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.699709 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25481] 10:12:35.699726 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.699751 read(14,  <unfinished ...>
[pid 25479] 10:12:35.699779 read(14,  <unfinished ...>
[pid 25474] 10:12:35.699802 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.699843 read(7,  <unfinished ...>
[pid 25481] 10:12:35.699871 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.699901 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25479] 10:12:35.699994 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25474] 10:12:35.700078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.700108 <... read resumed> "\314\317\263J\310P\261c\374sQ&\324H{I\2\350s\237\f\201\3532\226\315H\201\224\370\360]\22\353\261^\354%\203\205h\2224\204{h\216\250", 48) = 48
[pid 25481] 10:12:35.700126 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.700147 read(14,  <unfinished ...>
[pid 25479] 10:12:35.700171 read(14,  <unfinished ...>
[pid 25474] 10:12:35.700194 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25484] 10:12:35.700231 close(7 <unfinished ...>
[pid 25481] 10:12:35.700254 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.700283 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25479] 10:12:35.700362 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25474] 10:12:35.700441 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25484] 10:12:35.700472 <... close resumed> ) = 0
[pid 25481] 10:12:35.700491 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.700605 read(14,  <unfinished ...>
[pid 25479] 10:12:35.700637 read(14,  <unfinished ...>
[pid 25474] 10:12:35.700660 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25485] 10:12:35.700702 <... brk resumed> ) = 0xf24000
[pid 25484] 10:12:35.700716 getuid( <unfinished ...>
[pid 25481] 10:12:35.701075 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.701109 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25479] 10:12:35.701142 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25474] 10:12:35.701171 <... open resumed> ) = 6
[pid 25485] 10:12:35.701197 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25484] 10:12:35.701221 <... getuid resumed> ) = 47
[pid 25481] 10:12:35.701234 <... open resumed> ) = 6
[pid 25480] 10:12:35.701392 read(14,  <unfinished ...>
[pid 25479] 10:12:35.701423 read(14,  <unfinished ...>
[pid 25474] 10:12:35.701446 read(6,  <unfinished ...>
[pid 25484] 10:12:35.701477 exit_group(0) = ?
[pid 25481] 10:12:35.701491 read(6,  <unfinished ...>
[pid 25480] 10:12:35.701833 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25479] 10:12:35.701940 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25474] 10:12:35.702032 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25484] 10:12:35.702083 +++ exited with 0 +++
[pid 25481] 10:12:35.702097 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.702120 read(14,  <unfinished ...>
[pid 25479] 10:12:35.702145 read(14,  <unfinished ...>
[pid 25474] 10:12:35.702168 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.702190 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25484
[pid 25481] 10:12:35.702218 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.702241 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25479] 10:12:35.702270 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25474] 10:12:35.702298 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25472] 10:12:35.702330 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25481] 10:12:35.702368 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25480] 10:12:35.702401 read(14,  <unfinished ...>
[pid 25479] 10:12:35.702437 read(14,  <unfinished ...>
[pid 25474] 10:12:35.702462 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25472] 10:12:35.702493 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0}, 8) = 0
[pid 25481] 10:12:35.702628 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.702673 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25479] 10:12:35.702776 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25474] 10:12:35.702864 <... mmap resumed> ) = 0x7f84dfefb000
[pid 25472] 10:12:35.702885 getcwd( <unfinished ...>
[pid 25485] 10:12:35.702920 <... open resumed> ) = 7
[pid 25481] 10:12:35.702934 <... mmap resumed> ) = 0x7f04ca17e000
[pid 25480] 10:12:35.702958 read(14,  <unfinished ...>
[pid 25479] 10:12:35.702983 read(14,  <unfinished ...>
[pid 25474] 10:12:35.703006 mprotect(0x7f84dff05000, 2093056, PROT_NONE <unfinished ...>
[pid 25472] 10:12:35.703034 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25485] 10:12:35.703095 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.703122 mprotect(0x7f04ca188000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.703148 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25479] 10:12:35.703178 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25474] 10:12:35.703205 <... mprotect resumed> ) = 0
[pid 25472] 10:12:35.703221 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25485] 10:12:35.703259 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25481] 10:12:35.703287 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.703309 read(14,  <unfinished ...>
[pid 25479] 10:12:35.703334 read(14,  <unfinished ...>
[pid 25474] 10:12:35.703358 mmap(0x7f84e0104000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25472] 10:12:35.703388 <... open resumed> ) = 7
[pid 25485] 10:12:35.703414 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25481] 10:12:35.703439 mmap(0x7f04ca387000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25480] 10:12:35.703467 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25479] 10:12:35.703629 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25474] 10:12:35.703707 <... mmap resumed> ) = 0x7f84e0104000
[pid 25472] 10:12:35.703736 fstat(7,  <unfinished ...>
[pid 25485] 10:12:35.703775 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25481] 10:12:35.703793 <... mmap resumed> ) = 0x7f04ca387000
[pid 25480] 10:12:35.703822 read(14,  <unfinished ...>
[pid 25479] 10:12:35.703856 read(14,  <unfinished ...>
[pid 25474] 10:12:35.703880 close(6 <unfinished ...>
[pid 25472] 10:12:35.703902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25485] 10:12:35.703941 read(7,  <unfinished ...>
[pid 25481] 10:12:35.703974 close(6 <unfinished ...>
[pid 25480] 10:12:35.703997 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25479] 10:12:35.704028 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25474] 10:12:35.704060 <... close resumed> ) = 0
[pid 25472] 10:12:35.704090 fstat(7,  <unfinished ...>
[pid 25485] 10:12:35.704125 <... read resumed> "m\302\356\321\16\327b\233D:E\373,T\360~\240nN\34\206\303,\232\371\6(\312`\7\5\36\230\37\275:J\24\220?>\t%W\254\241\313^", 48) = 48
[pid 25481] 10:12:35.704142 <... close resumed> ) = 0
[pid 25480] 10:12:35.704170 read(14,  <unfinished ...>
[pid 25479] 10:12:35.704195 read(14,  <unfinished ...>
[pid 25474] 10:12:35.704218 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.704248 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25485] 10:12:35.704285 close(7 <unfinished ...>
[pid 25481] 10:12:35.704307 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.704336 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25479] 10:12:35.704413 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25474] 10:12:35.704485 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.704583 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25485] 10:12:35.704627 <... close resumed> ) = 0
[pid 25481] 10:12:35.704641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.704678 read(14,  <unfinished ...>
[pid 25479] 10:12:35.704704 read(14,  <unfinished ...>
[pid 25474] 10:12:35.704726 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.704761 <... mmap resumed> ) = 0x7ff101086000
[pid 25485] 10:12:35.704789 getuid( <unfinished ...>
[pid 25481] 10:12:35.704812 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.704847 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25479] 10:12:35.704884 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25474] 10:12:35.704921 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.704940 read(7,  <unfinished ...>
[pid 25485] 10:12:35.704977 <... getuid resumed> ) = 47
[pid 25481] 10:12:35.704996 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.705146 read(14,  <unfinished ...>
[pid 25479] 10:12:35.705175 read(14,  <unfinished ...>
[pid 25474] 10:12:35.705198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.705228 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25485] 10:12:35.705264 exit_group(0) = ?
[pid 25481] 10:12:35.705278 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.705596 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25479] 10:12:35.705681 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25474] 10:12:35.705756 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.705782 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25485] 10:12:35.705839 +++ exited with 0 +++
[pid 25481] 10:12:35.705852 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.705875 read(14,  <unfinished ...>
[pid 25479] 10:12:35.705904 read(14,  <unfinished ...>
[pid 25474] 10:12:35.705927 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.705959 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25485
[pid 25472] 10:12:35.705981 <... lseek resumed> ) = 1279
[pid 25481] 10:12:35.706007 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.706036 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25479] 10:12:35.706119 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25474] 10:12:35.706199 <... open resumed> ) = 6
[pid 25473] 10:12:35.706218 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25472] 10:12:35.706246 read(7,  <unfinished ...>
[pid 25481] 10:12:35.706279 <... open resumed> ) = 6
[pid 25480] 10:12:35.706295 read(14,  <unfinished ...>
[pid 25479] 10:12:35.706318 read(14,  <unfinished ...>
[pid 25474] 10:12:35.706340 read(6,  <unfinished ...>
[pid 25473] 10:12:35.706364 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25472] 10:12:35.706406 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25481] 10:12:35.706456 read(6,  <unfinished ...>
[pid 25480] 10:12:35.706482 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25479] 10:12:35.706591 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25474] 10:12:35.706626 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.706650 getcwd( <unfinished ...>
[pid 25472] 10:12:35.706675 close(7 <unfinished ...>
[pid 25481] 10:12:35.706708 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.706731 read(14,  <unfinished ...>
[pid 25479] 10:12:35.706755 read(14,  <unfinished ...>
[pid 25474] 10:12:35.706781 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.706804 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25472] 10:12:35.706862 <... close resumed> ) = 0
[pid 25481] 10:12:35.706895 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.706923 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25479] 10:12:35.707006 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25474] 10:12:35.707085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25473] 10:12:35.707121 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.707156 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.707194 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25480] 10:12:35.707225 read(14,  <unfinished ...>
[pid 25479] 10:12:35.707249 read(14,  <unfinished ...>
[pid 25474] 10:12:35.707271 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.707304 <... open resumed> ) = 7
[pid 25472] 10:12:35.707320 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.707361 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.707395 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25479] 10:12:35.707426 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25474] 10:12:35.707455 <... mmap resumed> ) = 0x7f84dfcf8000
[pid 25473] 10:12:35.707472 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.707495 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.707651 <... mmap resumed> ) = 0x7f04c9f7b000
[pid 25480] 10:12:35.707669 read(14,  <unfinished ...>
[pid 25479] 10:12:35.707693 read(14,  <unfinished ...>
[pid 25474] 10:12:35.707716 mprotect(0x7f84dfcfa000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.707742 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25472] 10:12:35.707776 <... open resumed> ) = 7
[pid 25481] 10:12:35.707807 mprotect(0x7f04c9f7d000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.707839 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25479] 10:12:35.707932 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25474] 10:12:35.708015 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.708034 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.708057 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.708089 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.708105 read(14,  <unfinished ...>
[pid 25479] 10:12:35.708129 read(14,  <unfinished ...>
[pid 25474] 10:12:35.708151 mmap(0x7f84dfef9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25473] 10:12:35.708180 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25472] 10:12:35.708210 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.708234 mmap(0x7f04ca17c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25480] 10:12:35.708262 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25479] 10:12:35.708344 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25474] 10:12:35.708420 <... mmap resumed> ) = 0x7f84dfef9000
[pid 25473] 10:12:35.708447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.708476 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.708585 <... mmap resumed> ) = 0x7f04ca17c000
[pid 25480] 10:12:35.708615 read(14,  <unfinished ...>
[pid 25479] 10:12:35.708642 read(14,  <unfinished ...>
[pid 25474] 10:12:35.708664 close(6 <unfinished ...>
[pid 25473] 10:12:35.708686 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.708703 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.708728 close(6 <unfinished ...>
[pid 25480] 10:12:35.708751 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25479] 10:12:35.708839 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25474] 10:12:35.708931 <... close resumed> ) = 0
[pid 25473] 10:12:35.708959 read(7,  <unfinished ...>
[pid 25472] 10:12:35.708987 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.709019 <... close resumed> ) = 0
[pid 25480] 10:12:35.709042 read(14,  <unfinished ...>
[pid 25479] 10:12:35.709067 read(14,  <unfinished ...>
[pid 25474] 10:12:35.709090 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.709117 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25472] 10:12:35.709145 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373443, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.709187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.709213 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25479] 10:12:35.709293 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25474] 10:12:35.709377 <... mmap resumed> ) = 0x7f84e3f3e000
[pid 25473] 10:12:35.709412 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.709440 write(7, "2015-12-30 10:12:35 [25472] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMZ-0006cf-8U\n", 92 <unfinished ...>
[pid 25481] 10:12:35.709480 <... mmap resumed> ) = 0x7f04ce1c1000
[pid 25480] 10:12:35.709590 read(14,  <unfinished ...>
[pid 25479] 10:12:35.709621 read(14,  <unfinished ...>
[pid 25474] 10:12:35.709644 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.709675 <... lseek resumed> ) = 1279
[pid 25472] 10:12:35.709692 <... write resumed> ) = 92
[pid 25481] 10:12:35.709721 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.709751 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25479] 10:12:35.709786 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25474] 10:12:35.709821 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.709841 read(7,  <unfinished ...>
[pid 25472] 10:12:35.709867 chdir("/var/spool/exim" <unfinished ...>
[pid 25481] 10:12:35.709911 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.709931 read(14,  <unfinished ...>
[pid 25479] 10:12:35.709956 read(14,  <unfinished ...>
[pid 25474] 10:12:35.709978 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.710010 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25472] 10:12:35.710041 <... chdir resumed> ) = 0
[pid 25481] 10:12:35.710072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.710176 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25479] 10:12:35.710258 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25474] 10:12:35.710333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.710354 close(7 <unfinished ...>
[pid 25472] 10:12:35.710378 setgid(12 <unfinished ...>
[pid 25481] 10:12:35.710416 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.710434 read(14,  <unfinished ...>
[pid 25479] 10:12:35.710459 read(14,  <unfinished ...>
[pid 25474] 10:12:35.710482 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.710567 <... close resumed> ) = 0
[pid 25472] 10:12:35.710587 <... setgid resumed> ) = 0
[pid 25481] 10:12:35.710641 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.710678 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25479] 10:12:35.710766 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25474] 10:12:35.710861 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.710890 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.710922 read(6,  <unfinished ...>
[pid 25481] 10:12:35.710960 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.710980 read(14,  <unfinished ...>
[pid 25479] 10:12:35.711004 read(14,  <unfinished ...>
[pid 25474] 10:12:35.711026 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.711055 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.711084 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25481] 10:12:35.711159 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.711190 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25479] 10:12:35.711274 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25474] 10:12:35.711354 <... open resumed> ) = 6
[pid 25473] 10:12:35.711375 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25472] 10:12:35.711407 read(6,  <unfinished ...>
[pid 25481] 10:12:35.711440 <... open resumed> ) = 6
[pid 25480] 10:12:35.711456 read(14,  <unfinished ...>
[pid 25479] 10:12:35.711479 read(14,  <unfinished ...>
[pid 25474] 10:12:35.711502 read(6,  <unfinished ...>
[pid 25473] 10:12:35.711606 <... open resumed> ) = 7
[pid 25472] 10:12:35.711626 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25481] 10:12:35.711704 read(6,  <unfinished ...>
[pid 25480] 10:12:35.711731 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25479] 10:12:35.711802 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25474] 10:12:35.711889 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:35.711921 fcntl(7, F_GETFD <unfinished ...>
[pid 25472] 10:12:35.711945 read(6,  <unfinished ...>
[pid 25481] 10:12:35.711978 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25480] 10:12:35.712001 brk(0xad1000 <unfinished ...>
[pid 25479] 10:12:35.712025 brk(0xad1000 <unfinished ...>
[pid 25474] 10:12:35.712048 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.712070 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.712086 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25481] 10:12:35.712153 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.712178 <... brk resumed> ) = 0xad1000
[pid 25479] 10:12:35.712216 <... brk resumed> ) = 0xad1000
[pid 25474] 10:12:35.712252 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25473] 10:12:35.712286 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.712310 read(6,  <unfinished ...>
[pid 25481] 10:12:35.712343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25480] 10:12:35.712372 read(14,  <unfinished ...>
[pid 25479] 10:12:35.712396 read(14,  <unfinished ...>
[pid 25474] 10:12:35.712419 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:35.712450 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.712466 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25481] 10:12:35.712639 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25480] 10:12:35.712677 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25479] 10:12:35.712709 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25474] 10:12:35.712745 <... mmap resumed> ) = 0x7f84dfad9000
[pid 25473] 10:12:35.712762 fstat(7,  <unfinished ...>
[pid 25472] 10:12:35.712785 read(6,  <unfinished ...>
[pid 25481] 10:12:35.712822 <... mmap resumed> ) = 0x7f04c9d5c000
[pid 25480] 10:12:35.712844 read(14,  <unfinished ...>
[pid 25479] 10:12:35.712871 read(14,  <unfinished ...>
[pid 25474] 10:12:35.712898 mprotect(0x7f84dfaf6000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:35.712927 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373535, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.712959 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25481] 10:12:35.713045 mprotect(0x7f04c9d79000, 2093056, PROT_NONE <unfinished ...>
[pid 25480] 10:12:35.713076 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25479] 10:12:35.713161 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25474] 10:12:35.713239 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.713259 write(7, "2015-12-30 10:12:35 [25473] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMZ-0006ce-8t\n", 92 <unfinished ...>
[pid 25472] 10:12:35.713289 read(6,  <unfinished ...>
[pid 25481] 10:12:35.713323 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.713341 read(14,  <unfinished ...>
[pid 25479] 10:12:35.713366 read(14,  <unfinished ...>
[pid 25474] 10:12:35.713388 mmap(0x7f84dfcf5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25473] 10:12:35.713420 <... write resumed> ) = 92
[pid 25472] 10:12:35.713440 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25481] 10:12:35.713628 mmap(0x7f04c9f78000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25480] 10:12:35.713669 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25479] 10:12:35.713748 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25474] 10:12:35.713830 <... mmap resumed> ) = 0x7f84dfcf5000
[pid 25473] 10:12:35.713858 chdir("/var/spool/exim" <unfinished ...>
[pid 25472] 10:12:35.713894 read(6,  <unfinished ...>
[pid 25481] 10:12:35.713933 <... mmap resumed> ) = 0x7f04c9f78000
[pid 25480] 10:12:35.713960 read(14,  <unfinished ...>
[pid 25479] 10:12:35.713985 read(14,  <unfinished ...>
[pid 25474] 10:12:35.714008 mmap(0x7f84dfcf7000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.714036 <... chdir resumed> ) = 0
[pid 25472] 10:12:35.714055 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25481] 10:12:35.714121 mmap(0x7f04c9f7a000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.714154 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25479] 10:12:35.714226 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25474] 10:12:35.714294 <... mmap resumed> ) = 0x7f84dfcf7000
[pid 25473] 10:12:35.714320 setgid(12 <unfinished ...>
[pid 25472] 10:12:35.714345 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.714384 <... mmap resumed> ) = 0x7f04c9f7a000
[pid 25480] 10:12:35.714405 read(14,  <unfinished ...>
[pid 25479] 10:12:35.714430 read(14,  <unfinished ...>
[pid 25474] 10:12:35.714455 close(6 <unfinished ...>
[pid 25473] 10:12:35.714477 <... setgid resumed> ) = 0
[pid 25472] 10:12:35.714595 <... open resumed> ) = 8
[pid 25481] 10:12:35.714631 close(6 <unfinished ...>
[pid 25480] 10:12:35.714655 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25479] 10:12:35.714685 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25474] 10:12:35.714713 <... close resumed> ) = 0
[pid 25473] 10:12:35.714766 read(6,  <unfinished ...>
[pid 25472] 10:12:35.714795 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.714832 <... close resumed> ) = 0
[pid 25480] 10:12:35.714886 read(14,  <unfinished ...>
[pid 25479] 10:12:35.714913 read(14,  <unfinished ...>
[pid 25474] 10:12:35.714935 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.714962 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25472] 10:12:35.715028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.715073 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.715101 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25479] 10:12:35.715183 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25474] 10:12:35.715252 <... mmap resumed> ) = 0x7f84e3f3d000
[pid 25473] 10:12:35.715313 read(6,  <unfinished ...>
[pid 25472] 10:12:35.715342 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.715377 <... mmap resumed> ) = 0x7f04ce1c0000
[pid 25480] 10:12:35.715430 read(14,  <unfinished ...>
[pid 25479] 10:12:35.715455 read(14,  <unfinished ...>
[pid 25474] 10:12:35.715477 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.715502 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25472] 10:12:35.715652 <... mmap resumed> ) = 0x7ff101086000
[pid 25481] 10:12:35.715683 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.715711 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25479] 10:12:35.715785 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25474] 10:12:35.715863 <... mmap resumed> ) = 0x7f84e3f3c000
[pid 25473] 10:12:35.715895 read(6,  <unfinished ...>
[pid 25472] 10:12:35.715921 read(8,  <unfinished ...>
[pid 25481] 10:12:35.715957 <... mmap resumed> ) = 0x7f04ce1bf000
[pid 25480] 10:12:35.715983 read(14,  <unfinished ...>
[pid 25479] 10:12:35.716007 read(14,  <unfinished ...>
[pid 25474] 10:12:35.716030 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.716055 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25472] 10:12:35.716114 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.716155 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.716188 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25479] 10:12:35.716221 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25474] 10:12:35.716251 <... mmap resumed> ) = 0x7f84e3f3a000
[pid 25473] 10:12:35.716280 read(6,  <unfinished ...>
[pid 25472] 10:12:35.716304 close(8 <unfinished ...>
[pid 25481] 10:12:35.716340 <... mmap resumed> ) = 0x7f04ce1bd000
[pid 25480] 10:12:35.716362 read(14,  <unfinished ...>
[pid 25479] 10:12:35.716386 read(14,  <unfinished ...>
[pid 25474] 10:12:35.716408 arch_prctl(ARCH_SET_FS, 0x7f84e3f3a7c0 <unfinished ...>
[pid 25473] 10:12:35.716432 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25472] 10:12:35.716490 <... close resumed> ) = 0
[pid 25481] 10:12:35.716595 arch_prctl(ARCH_SET_FS, 0x7f04ce1bd7c0 <unfinished ...>
[pid 25480] 10:12:35.716626 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25479] 10:12:35.716776 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25474] 10:12:35.716923 <... arch_prctl resumed> ) = 0
[pid 25473] 10:12:35.716984 read(6,  <unfinished ...>
[pid 25472] 10:12:35.717011 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.717049 <... arch_prctl resumed> ) = 0
[pid 25480] 10:12:35.717096 read(14,  <unfinished ...>
[pid 25479] 10:12:35.717121 read(14,  <unfinished ...>
[pid 25474] 10:12:35.717143 mprotect(0x7f84dfcf5000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.717169 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25472] 10:12:35.717246 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.717342 mprotect(0x7f04c9f78000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.717372 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25479] 10:12:35.717404 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25474] 10:12:35.717432 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.717454 read(6,  <unfinished ...>
[pid 25472] 10:12:35.717479 read(6,  <unfinished ...>
[pid 25481] 10:12:35.717580 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.717605 read(14,  <unfinished ...>
[pid 25479] 10:12:35.717630 read(14,  <unfinished ...>
[pid 25474] 10:12:35.717652 mprotect(0x7f84dfef9000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.717680 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25472] 10:12:35.717775 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25481] 10:12:35.717878 mprotect(0x7f04ca17c000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.717909 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25479] 10:12:35.718003 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25474] 10:12:35.718089 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.718126 read(6,  <unfinished ...>
[pid 25472] 10:12:35.718152 read(6,  <unfinished ...>
[pid 25481] 10:12:35.718185 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.718216 read(14,  <unfinished ...>
[pid 25479] 10:12:35.718241 read(14,  <unfinished ...>
[pid 25474] 10:12:35.718264 mprotect(0x7f84e0104000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.718291 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25472] 10:12:35.718347 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25481] 10:12:35.718470 mprotect(0x7f04ca387000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.718501 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25479] 10:12:35.718678 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25474] 10:12:35.718769 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.718797 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.718828 read(6,  <unfinished ...>
[pid 25481] 10:12:35.718862 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.718886 read(14,  <unfinished ...>
[pid 25479] 10:12:35.718911 read(14,  <unfinished ...>
[pid 25474] 10:12:35.718933 mprotect(0x7f84e031a000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.718960 <... open resumed> ) = 8
[pid 25472] 10:12:35.718977 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25481] 10:12:35.719096 mprotect(0x7f04ca59d000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.719127 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25479] 10:12:35.719219 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25474] 10:12:35.719314 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.719348 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.719373 read(6,  <unfinished ...>
[pid 25481] 10:12:35.719407 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.719434 read(14,  <unfinished ...>
[pid 25479] 10:12:35.719460 read(14,  <unfinished ...>
[pid 25474] 10:12:35.719483 mprotect(0x7f84e0545000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.719574 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.719611 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25481] 10:12:35.719726 mprotect(0x7f04ca7c8000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.719758 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25479] 10:12:35.719851 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25474] 10:12:35.719940 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.719971 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.719999 read(6,  <unfinished ...>
[pid 25481] 10:12:35.720033 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.720058 read(14,  <unfinished ...>
[pid 25479] 10:12:35.720084 read(14,  <unfinished ...>
[pid 25474] 10:12:35.720106 mprotect(0x7f84e074a000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.720132 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.720149 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25481] 10:12:35.720193 mprotect(0x7f04ca9cd000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.720222 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25479] 10:12:35.720258 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25474] 10:12:35.720291 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.720414 read(8,  <unfinished ...>
[pid 25472] 10:12:35.720444 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.720482 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.720664 read(14,  <unfinished ...>
[pid 25479] 10:12:35.720695 read(14,  <unfinished ...>
[pid 25474] 10:12:35.720718 mprotect(0x7f84e0a27000, 40960, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.720745 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.720779 <... open resumed> ) = 8
[pid 25481] 10:12:35.720807 mprotect(0x7f04cacaa000, 40960, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.720834 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25479] 10:12:35.720926 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25474] 10:12:35.721012 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.721114 close(8 <unfinished ...>
[pid 25472] 10:12:35.721141 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.721174 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.721260 read(14,  <unfinished ...>
[pid 25479] 10:12:35.721287 read(14,  <unfinished ...>
[pid 25474] 10:12:35.721310 mprotect(0x7f84e0c74000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.721337 <... close resumed> ) = 0
[pid 25472] 10:12:35.721353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.721392 mprotect(0x7f04caef7000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.721418 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25479] 10:12:35.721570 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25474] 10:12:35.721668 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.721702 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.721732 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.721769 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.721796 read(14,  <unfinished ...>
[pid 25479] 10:12:35.721822 read(14,  <unfinished ...>
[pid 25474] 10:12:35.721844 mprotect(0x7f84e0e8e000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.721870 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.721953 <... mmap resumed> ) = 0x7ff101086000
[pid 25481] 10:12:35.721983 mprotect(0x7f04cb111000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.722009 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25479] 10:12:35.722095 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25474] 10:12:35.722176 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.722200 read(6,  <unfinished ...>
[pid 25472] 10:12:35.722225 read(8,  <unfinished ...>
[pid 25481] 10:12:35.722260 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.722281 read(14,  <unfinished ...>
[pid 25479] 10:12:35.722313 read(14,  <unfinished ...>
[pid 25474] 10:12:35.722336 mprotect(0x7f84e109b000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.722362 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25472] 10:12:35.722443 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.722491 mprotect(0x7f04cb31e000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.722594 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25479] 10:12:35.722687 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25474] 10:12:35.722773 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.722983 read(6,  <unfinished ...>
[pid 25472] 10:12:35.723011 close(8 <unfinished ...>
[pid 25481] 10:12:35.723045 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.723233 read(14,  <unfinished ...>
[pid 25479] 10:12:35.723260 read(14,  <unfinished ...>
[pid 25474] 10:12:35.723282 mprotect(0x7f84e1887000, 110592, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.723309 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25472] 10:12:35.723417 <... close resumed> ) = 0
[pid 25481] 10:12:35.723448 mprotect(0x7f04cbb0a000, 110592, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.723475 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25479] 10:12:35.723638 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25474] 10:12:35.723722 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.723810 read(6,  <unfinished ...>
[pid 25472] 10:12:35.723837 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.723928 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.724008 read(14,  <unfinished ...>
[pid 25479] 10:12:35.724035 read(14,  <unfinished ...>
[pid 25474] 10:12:35.724059 mprotect(0x7f84e1b13000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.724086 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25472] 10:12:35.724202 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.724244 mprotect(0x7f04cbd96000, 16384, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.724273 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25479] 10:12:35.724368 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25474] 10:12:35.724452 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.724625 read(6,  <unfinished ...>
[pid 25472] 10:12:35.724659 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.724701 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.724786 read(14,  <unfinished ...>
[pid 25479] 10:12:35.724814 read(14,  <unfinished ...>
[pid 25474] 10:12:35.724836 mprotect(0x7f84e1ea8000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.724864 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25472] 10:12:35.724972 <... open resumed> ) = 8
[pid 25481] 10:12:35.725004 mprotect(0x7f04cc12b000, 16384, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.725032 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25479] 10:12:35.725061 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25474] 10:12:35.725089 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.725109 read(6,  <unfinished ...>
[pid 25472] 10:12:35.725133 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.725165 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.725185 read(14,  <unfinished ...>
[pid 25479] 10:12:35.725210 read(14,  <unfinished ...>
[pid 25474] 10:12:35.725232 mprotect(0x7f84e20b3000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.725258 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25472] 10:12:35.725293 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.725335 mprotect(0x7f04cc336000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.725365 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25479] 10:12:35.725444 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25474] 10:12:35.725602 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.725635 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.725674 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.725719 <... select resumed> ) = 1 (in [11], left {299, 971801})
[pid 25481] 10:12:35.725748 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.725773 read(14,  <unfinished ...>
[pid 25479] 10:12:35.725798 read(14,  <unfinished ...>
[pid 25474] 10:12:35.725821 mprotect(0x7f84e22b7000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.725848 <... open resumed> ) = 8
[pid 25472] 10:12:35.725864 <... mmap resumed> ) = 0x7ff101086000
[pid 25482] 10:12:35.725892 recvfrom(11,  <unfinished ...>
[pid 25481] 10:12:35.725917 mprotect(0x7f04cc53a000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.725943 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25479] 10:12:35.725974 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25474] 10:12:35.726002 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.726691 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.726725 read(8,  <unfinished ...>
[pid 25482] 10:12:35.726763 <... recvfrom resumed> "220 BL2FFO11FD026.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Wed, 30 Dec 2015 16:12:35 +0000\r\n", 4096, 0, NULL, NULL) = 117
[pid 25481] 10:12:35.726801 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.727333 read(14,  <unfinished ...>
[pid 25479] 10:12:35.727364 read(14,  <unfinished ...>
[pid 25474] 10:12:35.727387 mprotect(0x7f84e300f000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.727413 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.727444 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25482] 10:12:35.727484 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25481] 10:12:35.727576 mprotect(0x7f04cd292000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.727605 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25479] 10:12:35.727697 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25474] 10:12:35.727779 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.727820 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.727849 close(8 <unfinished ...>
[pid 25482] 10:12:35.727885 <... sendto resumed> ) = 33
[pid 25481] 10:12:35.727903 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.727937 read(14,  <unfinished ...>
[pid 25479] 10:12:35.727962 read(14,  <unfinished ...>
[pid 25474] 10:12:35.727985 mprotect(0x7f84e3444000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.728011 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.728028 <... close resumed> ) = 0
[pid 25482] 10:12:35.728060 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25481] 10:12:35.728089 mprotect(0x7f04cd6c7000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.728114 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25479] 10:12:35.728196 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25474] 10:12:35.728275 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.728300 read(8,  <unfinished ...>
[pid 25472] 10:12:35.728327 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.728366 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.728387 read(14,  <unfinished ...>
[pid 25479] 10:12:35.728412 read(14,  <unfinished ...>
[pid 25474] 10:12:35.728435 mprotect(0x7f84e36c8000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.728462 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.728492 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.728629 mprotect(0x7f04cd94b000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.728670 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25479] 10:12:35.728738 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25474] 10:12:35.728800 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.728824 close(8 <unfinished ...>
[pid 25472] 10:12:35.728849 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.728887 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.728909 brk(0xaf2000 <unfinished ...>
[pid 25479] 10:12:35.728934 brk(0xaf2000 <unfinished ...>
[pid 25474] 10:12:35.728957 mprotect(0x7f84e38d1000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.728983 <... close resumed> ) = 0
[pid 25472] 10:12:35.728999 <... open resumed> ) = 8
[pid 25481] 10:12:35.729024 mprotect(0x7f04cdb54000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.729050 <... brk resumed> ) = 0xaf2000
[pid 25479] 10:12:35.729079 <... brk resumed> ) = 0xaf2000
[pid 25474] 10:12:35.729107 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.729139 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.729168 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.729200 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.729229 read(14,  <unfinished ...>
[pid 25479] 10:12:35.729254 read(14,  <unfinished ...>
[pid 25474] 10:12:35.729277 mprotect(0x7f84e3b16000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.729303 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.729331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.729373 mprotect(0x7f04cdd99000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.729400 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25479] 10:12:35.729437 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25474] 10:12:35.729469 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.729494 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.729614 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.729657 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.729685 read(14,  <unfinished ...>
[pid 25479] 10:12:35.729710 read(14,  <unfinished ...>
[pid 25474] 10:12:35.729733 mprotect(0x7f84e3d30000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.729759 <... open resumed> ) = 8
[pid 25472] 10:12:35.729776 <... mmap resumed> ) = 0x7ff101086000
[pid 25481] 10:12:35.729802 mprotect(0x7f04cdfb3000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.729828 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25479] 10:12:35.729906 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25474] 10:12:35.729979 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.730026 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.730051 read(8,  <unfinished ...>
[pid 25481] 10:12:35.730086 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.730124 read(14,  <unfinished ...>
[pid 25479] 10:12:35.730149 read(14,  <unfinished ...>
[pid 25474] 10:12:35.730171 mprotect(0x7f84e3f53000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:35.730198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.730227 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25481] 10:12:35.730265 mprotect(0x7f04ce1d6000, 4096, PROT_READ <unfinished ...>
[pid 25480] 10:12:35.730292 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25479] 10:12:35.730379 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25474] 10:12:35.730463 <... mprotect resumed> ) = 0
[pid 25473] 10:12:35.730484 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.730619 close(8 <unfinished ...>
[pid 25481] 10:12:35.730668 <... mprotect resumed> ) = 0
[pid 25480] 10:12:35.730686 read(14,  <unfinished ...>
[pid 25479] 10:12:35.730711 read(14,  <unfinished ...>
[pid 25474] 10:12:35.730739 munmap(0x7f84e3f48000, 39387 <unfinished ...>
[pid 25473] 10:12:35.730768 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.730785 <... close resumed> ) = 0
[pid 25481] 10:12:35.730810 munmap(0x7f04ce1cb000, 39387 <unfinished ...>
[pid 25480] 10:12:35.730838 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25479] 10:12:35.730916 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25474] 10:12:35.730990 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.731010 read(8,  <unfinished ...>
[pid 25472] 10:12:35.731037 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.731074 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.731091 read(14,  <unfinished ...>
[pid 25479] 10:12:35.731114 read(14,  <unfinished ...>
[pid 25474] 10:12:35.731136 set_tid_address(0x7f84e3f3aa90 <unfinished ...>
[pid 25473] 10:12:35.731159 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25472] 10:12:35.731189 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.731292 set_tid_address(0x7f04ce1bda90 <unfinished ...>
[pid 25480] 10:12:35.731319 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25479] 10:12:35.731409 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25474] 10:12:35.731497 <... set_tid_address resumed> ) = 25474
[pid 25473] 10:12:35.731590 close(8 <unfinished ...>
[pid 25472] 10:12:35.731623 read(6,  <unfinished ...>
[pid 25481] 10:12:35.731664 <... set_tid_address resumed> ) = 25481
[pid 25480] 10:12:35.731682 read(14,  <unfinished ...>
[pid 25479] 10:12:35.731706 read(14,  <unfinished ...>
[pid 25474] 10:12:35.731728 set_robust_list(0x7f84e3f3aaa0, 24 <unfinished ...>
[pid 25473] 10:12:35.731751 <... close resumed> ) = 0
[pid 25472] 10:12:35.731766 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25481] 10:12:35.731892 set_robust_list(0x7f04ce1bdaa0, 24 <unfinished ...>
[pid 25480] 10:12:35.731919 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25479] 10:12:35.732017 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25474] 10:12:35.732109 <... set_robust_list resumed> ) = 0
[pid 25473] 10:12:35.732137 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.732166 read(6,  <unfinished ...>
[pid 25481] 10:12:35.732200 <... set_robust_list resumed> ) = 0
[pid 25480] 10:12:35.732216 read(14,  <unfinished ...>
[pid 25479] 10:12:35.732239 read(14,  <unfinished ...>
[pid 25474] 10:12:35.732261 futex(0x7fff65a6108c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25473] 10:12:35.732286 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.732328 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25481] 10:12:35.732430 futex(0x7ffeeb1bd40c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25480] 10:12:35.732460 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25479] 10:12:35.732657 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25474] 10:12:35.732765 <... futex resumed> ) = 0
[pid 25473] 10:12:35.732784 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.732814 read(6,  <unfinished ...>
[pid 25481] 10:12:35.732847 <... futex resumed> ) = 0
[pid 25480] 10:12:35.732863 read(14,  <unfinished ...>
[pid 25479] 10:12:35.732886 read(14,  <unfinished ...>
[pid 25474] 10:12:35.732908 futex(0x7fff65a6108c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f84e3f3a7c0 <unfinished ...>
[pid 25473] 10:12:35.732932 <... open resumed> ) = 8
[pid 25472] 10:12:35.732949 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.732976 futex(0x7ffeeb1bd40c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f04ce1bd7c0 <unfinished ...>
[pid 25480] 10:12:35.733001 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25479] 10:12:35.733072 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25474] 10:12:35.733140 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25473] 10:12:35.733168 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.733192 read(6,  <unfinished ...>
[pid 25481] 10:12:35.733224 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25480] 10:12:35.733245 read(14,  <unfinished ...>
[pid 25479] 10:12:35.733270 read(14,  <unfinished ...>
[pid 25474] 10:12:35.733292 rt_sigaction(SIGRTMIN, {0x7f84e2dfdc60, [], SA_RESTORER|SA_SIGINFO, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.733321 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.733351 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.733380 rt_sigaction(SIGRTMIN, {0x7f04cd080c60, [], SA_RESTORER|SA_SIGINFO, 0x7f04cd08a790},  <unfinished ...>
[pid 25480] 10:12:35.733407 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25479] 10:12:35.733503 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25474] 10:12:35.733688 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:35.733711 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.733739 close(6 <unfinished ...>
[pid 25481] 10:12:35.733773 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25480] 10:12:35.733790 read(14,  <unfinished ...>
[pid 25479] 10:12:35.733814 read(14,  <unfinished ...>
[pid 25474] 10:12:35.733837 rt_sigaction(SIGRT_1, {0x7f84e2dfdcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.733865 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25472] 10:12:35.733882 <... close resumed> ) = 0
[pid 25481] 10:12:35.733908 rt_sigaction(SIGRT_1, {0x7f04cd080cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f04cd08a790},  <unfinished ...>
[pid 25480] 10:12:35.733934 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25479] 10:12:35.734020 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25474] 10:12:35.734103 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:35.734123 read(8,  <unfinished ...>
[pid 25472] 10:12:35.734149 munmap(0x7ff101087000, 4096 <unfinished ...>
[pid 25481] 10:12:35.734187 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25480] 10:12:35.734203 read(14,  <unfinished ...>
[pid 25479] 10:12:35.734227 read(14,  <unfinished ...>
[pid 25474] 10:12:35.734249 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25473] 10:12:35.734275 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25472] 10:12:35.734304 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.734349 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25480] 10:12:35.734379 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25479] 10:12:35.734464 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25474] 10:12:35.734641 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25473] 10:12:35.734683 close(8 <unfinished ...>
[pid 25472] 10:12:35.734711 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff0fff3d790},  <unfinished ...>
[pid 25481] 10:12:35.734748 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25480] 10:12:35.734773 read(14,  <unfinished ...>
[pid 25479] 10:12:35.734798 read(14,  <unfinished ...>
[pid 25474] 10:12:35.734820 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25473] 10:12:35.734843 <... close resumed> ) = 0
[pid 25472] 10:12:35.734865 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.734902 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25480] 10:12:35.734927 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25479] 10:12:35.735071 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25474] 10:12:35.735212 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25473] 10:12:35.735271 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.735302 open("/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.735353 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25480] 10:12:35.735403 read(14,  <unfinished ...>
[pid 25479] 10:12:35.735430 read(14,  <unfinished ...>
[pid 25474] 10:12:35.735453 statfs("/selinux",  <unfinished ...>
[pid 25473] 10:12:35.735484 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.735650 <... open resumed> ) = 6
[pid 25481] 10:12:35.735685 statfs("/selinux",  <unfinished ...>
[pid 25480] 10:12:35.735716 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25479] 10:12:35.735820 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25474] 10:12:35.735911 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350341, f_bavail=6350341, f_files=1000000, f_ffree=691100, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25473] 10:12:35.735982 read(6,  <unfinished ...>
[pid 25472] 10:12:35.736010 fcntl(6, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.736043 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350341, f_bavail=6350341, f_files=1000000, f_ffree=691100, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25480] 10:12:35.736106 read(14,  <unfinished ...>
[pid 25479] 10:12:35.736134 read(14,  <unfinished ...>
[pid 25474] 10:12:35.736157 brk(0 <unfinished ...>
[pid 25473] 10:12:35.736179 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25472] 10:12:35.736296 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.736343 brk(0 <unfinished ...>
[pid 25480] 10:12:35.736369 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25479] 10:12:35.736464 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25474] 10:12:35.736623 <... brk resumed> ) = 0x24a0000
[pid 25473] 10:12:35.736653 read(6,  <unfinished ...>
[pid 25472] 10:12:35.736679 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.736712 <... brk resumed> ) = 0x1b1d000
[pid 25480] 10:12:35.736729 read(14,  <unfinished ...>
[pid 25479] 10:12:35.736753 read(14,  <unfinished ...>
[pid 25474] 10:12:35.736775 brk(0x24c1000 <unfinished ...>
[pid 25473] 10:12:35.736799 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25472] 10:12:35.736887 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.736918 brk(0x1b3e000 <unfinished ...>
[pid 25480] 10:12:35.736944 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25479] 10:12:35.737069 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25474] 10:12:35.737179 <... brk resumed> ) = 0x24c1000
[pid 25473] 10:12:35.737209 read(6,  <unfinished ...>
[pid 25472] 10:12:35.737234 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25481] 10:12:35.737272 <... brk resumed> ) = 0x1b3e000
[pid 25480] 10:12:35.737299 read(14,  <unfinished ...>
[pid 25479] 10:12:35.737324 read(14,  <unfinished ...>
[pid 25474] 10:12:35.737347 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.737386 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.737405 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.737430 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.737460 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25479] 10:12:35.737600 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25474] 10:12:35.737672 <... open resumed> ) = 6
[pid 25473] 10:12:35.737704 read(6,  <unfinished ...>
[pid 25472] 10:12:35.737729 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.737761 <... open resumed> ) = 6
[pid 25480] 10:12:35.737788 read(14,  <unfinished ...>
[pid 25479] 10:12:35.737817 read(14,  <unfinished ...>
[pid 25474] 10:12:35.737844 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.737867 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.737887 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064846, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3151, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.737935 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.737961 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25479] 10:12:35.738037 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25474] 10:12:35.738121 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:35.738155 close(6 <unfinished ...>
[pid 25472] 10:12:35.738181 open("/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-H", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.738224 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25480] 10:12:35.738253 read(14,  <unfinished ...>
[pid 25479] 10:12:35.738277 read(14,  <unfinished ...>
[pid 25474] 10:12:35.738299 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.738325 <... close resumed> ) = 0
[pid 25472] 10:12:35.738342 <... open resumed> ) = 8
[pid 25481] 10:12:35.738370 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25480] 10:12:35.738396 <... read resumed> "", 4096) = 0
[pid 25479] 10:12:35.738426 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.738449 <... mmap resumed> ) = 0x7f84e3f51000
[pid 25473] 10:12:35.738467 munmap(0x7f7c15ca9000, 4096 <unfinished ...>
[pid 25472] 10:12:35.738496 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.738609 <... mmap resumed> ) = 0x7f04ce1d4000
[pid 25480] 10:12:35.738629 close(14 <unfinished ...>
[pid 25479] 10:12:35.738654 close(14 <unfinished ...>
[pid 25474] 10:12:35.738677 read(6,  <unfinished ...>
[pid 25473] 10:12:35.738768 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.738803 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.738845 read(6,  <unfinished ...>
[pid 25480] 10:12:35.738887 <... close resumed> ) = 0
[pid 25479] 10:12:35.738904 <... close resumed> ) = 0
[pid 25474] 10:12:35.738920 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25473] 10:12:35.738948 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f7c14b5f790},  <unfinished ...>
[pid 25472] 10:12:35.738976 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.739011 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25480] 10:12:35.739039 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25479] 10:12:35.739068 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25474] 10:12:35.739094 read(6,  <unfinished ...>
[pid 25473] 10:12:35.739116 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.739141 <... mmap resumed> ) = 0x7ff101087000
[pid 25481] 10:12:35.739169 read(6,  <unfinished ...>
[pid 25480] 10:12:35.739193 <... munmap resumed> ) = 0
[pid 25479] 10:12:35.740016 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.740828 <... read resumed> "", 1024) = 0
[pid 25473] 10:12:35.740864 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25472] 10:12:35.740902 read(8,  <unfinished ...>
[pid 25481] 10:12:35.740940 <... read resumed> "", 1024) = 0
[pid 25480] 10:12:35.740963 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.740997 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.741025 close(6 <unfinished ...>
[pid 25473] 10:12:35.741055 <... open resumed> ) = 6
[pid 25472] 10:12:35.741072 <... read resumed> "1aEJMZ-0006cf-8U-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 959
[pid 25481] 10:12:35.741136 close(6 <unfinished ...>
[pid 25480] 10:12:35.741166 <... open resumed> ) = 14
[pid 25479] 10:12:35.741183 <... open resumed> ) = 14
[pid 25474] 10:12:35.741199 <... close resumed> ) = 0
[pid 25473] 10:12:35.741215 fcntl(6, F_GETFD <unfinished ...>
[pid 25472] 10:12:35.741237 read(8,  <unfinished ...>
[pid 25481] 10:12:35.741268 <... close resumed> ) = 0
[pid 25480] 10:12:35.741284 fstat(14,  <unfinished ...>
[pid 25479] 10:12:35.741307 fstat(14,  <unfinished ...>
[pid 25474] 10:12:35.741328 munmap(0x7f84e3f51000, 4096 <unfinished ...>
[pid 25473] 10:12:35.741357 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.741374 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.741400 munmap(0x7f04ce1d4000, 4096 <unfinished ...>
[pid 25480] 10:12:35.741426 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25479] 10:12:35.741456 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.741483 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.741616 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.741648 close(8 <unfinished ...>
[pid 25481] 10:12:35.741682 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.741747 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.741778 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.741803 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25473] 10:12:35.741837 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.741853 <... close resumed> ) = 0
[pid 25481] 10:12:35.741878 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25480] 10:12:35.741907 <... mmap resumed> ) = 0x7fea0f282000
[pid 25479] 10:12:35.741924 <... mmap resumed> ) = 0x7fea0f282000
[pid 25474] 10:12:35.741940 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.742022 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25472] 10:12:35.742054 munmap(0x7ff101087000, 4096 <unfinished ...>
[pid 25481] 10:12:35.742091 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.742166 read(14,  <unfinished ...>
[pid 25479] 10:12:35.742224 read(14,  <unfinished ...>
[pid 25474] 10:12:35.742257 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.742285 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.742301 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.742330 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25480] 10:12:35.742358 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          246736 kB\nCached:           331356 kB\nBuffers:               0 kB\nActive:           303124 kB\nInactive:         467400 kB\nActive(anon):     169368 kB\nInactive(anon):   277604 kB\nActive(file):     133756 kB\nInac"..., 1024) = 588
[pid 25479] 10:12:35.742387 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          246728 kB\nCached:           331356 kB\nBuffers:               0 kB\nActive:           303124 kB\nInactive:         467400 kB\nActive(anon):     169368 kB\nInactive(anon):   277604 kB\nActive(file):     133756 kB\nInac"..., 1024) = 588
[pid 25474] 10:12:35.742422 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:35.742452 fstat(6,  <unfinished ...>
[pid 25472] 10:12:35.742483 open("/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-J", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.742600 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25480] 10:12:35.742628 close(14 <unfinished ...>
[pid 25479] 10:12:35.742654 close(14 <unfinished ...>
[pid 25474] 10:12:35.742679 fstat(2,  <unfinished ...>
[pid 25473] 10:12:35.742702 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.742739 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.742772 fstat(2,  <unfinished ...>
[pid 25480] 10:12:35.742796 <... close resumed> ) = 0
[pid 25479] 10:12:35.742812 <... close resumed> ) = 0
[pid 25474] 10:12:35.742828 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25473] 10:12:35.742886 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-H", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.742921 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cf-8U", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25481] 10:12:35.742965 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25480] 10:12:35.743022 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25479] 10:12:35.743053 munmap(0x7fea0f282000, 4096 <unfinished ...>
[pid 25474] 10:12:35.743079 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.743106 <... open resumed> ) = 8
[pid 25472] 10:12:35.743123 <... open resumed> ) = 8
[pid 25481] 10:12:35.743148 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f04cd08a790},  <unfinished ...>
[pid 25480] 10:12:35.743175 <... munmap resumed> ) = 0
[pid 25479] 10:12:35.743961 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.744689 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:35.744721 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.744747 fcntl(8, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.744780 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25480] 10:12:35.744800 alarm(300 <unfinished ...>
[pid 25479] 10:12:35.744826 alarm(300 <unfinished ...>
[pid 25474] 10:12:35.744848 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25473] 10:12:35.744876 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1088, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.744906 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.744931 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25480] 10:12:35.744958 <... alarm resumed> ) = 0
[pid 25479] 10:12:35.744992 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.745022 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:35.745042 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.745070 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.745103 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25480] 10:12:35.745125 brk(0xb15000 <unfinished ...>
[pid 25479] 10:12:35.745150 brk(0xb15000 <unfinished ...>
[pid 25474] 10:12:35.745173 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25473] 10:12:35.745199 <... mmap resumed> ) = 0x7f7c15ca9000
[pid 25472] 10:12:35.745223 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.745253 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25480] 10:12:35.745280 <... brk resumed> ) = 0xb15000
[pid 25479] 10:12:35.745344 <... brk resumed> ) = 0xb15000
[pid 25474] 10:12:35.745396 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25473] 10:12:35.745419 read(8,  <unfinished ...>
[pid 25472] 10:12:35.745446 fchown(8, 47, 12 <unfinished ...>
[pid 25481] 10:12:35.745487 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25480] 10:12:35.745567 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2s\262\265\275\326f#\370\360\251E\320n\305eR\375\206B*/ U\362}\216c\v6\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25479] 10:12:35.745624 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2s\317\24\24ao\241\235\323\330\221\4\v]\231\305co\231\272\261\361*%\315\264{!\303\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25474] 10:12:35.745671 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.745698 <... read resumed> "1aEJMZ-0006ce-8t-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1088
[pid 25472] 10:12:35.745751 <... fchown resumed> ) = 0
[pid 25481] 10:12:35.745782 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25480] 10:12:35.745810 <... write resumed> ) = 258
[pid 25479] 10:12:35.745830 <... write resumed> ) = 258
[pid 25474] 10:12:35.745848 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:35.745874 read(8,  <unfinished ...>
[pid 25472] 10:12:35.745898 fchmod(8, 0640 <unfinished ...>
[pid 25481] 10:12:35.745934 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25480] 10:12:35.745959 read(11,  <unfinished ...>
[pid 25479] 10:12:35.745984 read(11,  <unfinished ...>
[pid 25474] 10:12:35.746005 umask(0 <unfinished ...>
[pid 25473] 10:12:35.746027 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.746045 <... fchmod resumed> ) = 0
[pid 25481] 10:12:35.746071 umask(0 <unfinished ...>
[pid 25474] 10:12:35.746094 <... umask resumed> ) = 022
[pid 25473] 10:12:35.746148 close(8 <unfinished ...>
[pid 25472] 10:12:35.746175 fcntl(8, F_GETFL <unfinished ...>
[pid 25481] 10:12:35.746204 <... umask resumed> ) = 0
[pid 25474] 10:12:35.746252 geteuid( <unfinished ...>
[pid 25473] 10:12:35.746277 <... close resumed> ) = 0
[pid 25472] 10:12:35.746293 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25481] 10:12:35.746318 geteuid( <unfinished ...>
[pid 25474] 10:12:35.746342 <... geteuid resumed> ) = 0
[pid 25473] 10:12:35.746359 munmap(0x7f7c15ca9000, 4096 <unfinished ...>
[pid 25472] 10:12:35.746387 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.746417 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.746434 getuid( <unfinished ...>
[pid 25473] 10:12:35.746457 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.746481 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064866, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.746598 getuid( <unfinished ...>
[pid 25474] 10:12:35.746626 <... getuid resumed> ) = 503
[pid 25473] 10:12:35.746645 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-J", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.746685 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.746726 <... getuid resumed> ) = 47
[pid 25474] 10:12:35.746745 getgid( <unfinished ...>
[pid 25473] 10:12:35.746767 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.746790 <... mmap resumed> ) = 0x7ff101087000
[pid 25481] 10:12:35.746814 getgid( <unfinished ...>
[pid 25474] 10:12:35.746837 <... getgid resumed> ) = 499
[pid 25473] 10:12:35.746868 open("/var/spool/exim/msglog/Z/1aEJMZ-0006ce-8t", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25472] 10:12:35.746905 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.746936 <... getgid resumed> ) = 12
[pid 25474] 10:12:35.747002 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25473] 10:12:35.747029 <... open resumed> ) = 8
[pid 25472] 10:12:35.747045 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.747073 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25474] 10:12:35.747097 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25473] 10:12:35.747116 fcntl(8, F_GETFD <unfinished ...>
[pid 25472] 10:12:35.747138 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25481] 10:12:35.747171 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25474] 10:12:35.747189 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25473] 10:12:35.747211 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.747226 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25481] 10:12:35.747265 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25474] 10:12:35.747290 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25473] 10:12:35.747310 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.747333 pipe( <unfinished ...>
[pid 25481] 10:12:35.747365 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25474] 10:12:35.747385 getgroups(65536,  <unfinished ...>
[pid 25473] 10:12:35.747408 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.747427 <... pipe resumed> [9, 10]) = 0
[pid 25481] 10:12:35.747453 getgroups(65536,  <unfinished ...>
[pid 25474] 10:12:35.747476 <... getgroups resumed> [500]) = 1
[pid 25473] 10:12:35.747498 fchown(8, 47, 12 <unfinished ...>
[pid 25472] 10:12:35.747605 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25481] 10:12:35.747642 <... getgroups resumed> []) = 0
[pid 25474] 10:12:35.747664 setgroups(0, [] <unfinished ...>
[pid 25473] 10:12:35.747689 <... fchown resumed> ) = 0
[pid 25472] 10:12:35.747707 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff0fff3d790}, 8) = 0
[pid 25481] 10:12:35.747736 setgroups(0, [] <unfinished ...>
[pid 25474] 10:12:35.747759 <... setgroups resumed> ) = 0
[pid 25473] 10:12:35.747777 fchmod(8, 0640 <unfinished ...>
[pid 25472] 10:12:35.747803 clone( <unfinished ...>
[pid 25481] 10:12:35.748052 <... setgroups resumed> ) = 0
[pid 25474] 10:12:35.748072 getegid( <unfinished ...>
[pid 25473] 10:12:35.748096 <... fchmod resumed> ) = 0
[pid 25481] 10:12:35.748122 getegid( <unfinished ...>
[pid 25474] 10:12:35.748146 <... getegid resumed> ) = 499
[pid 25473] 10:12:35.748162 fcntl(8, F_GETFL <unfinished ...>
[pid 25472] 10:12:35.748185 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff101070a90) = 25486
[pid 25481] 10:12:35.748238 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.748258 geteuid( <unfinished ...>
[pid 25473] 10:12:35.748280 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25472] 10:12:35.748298 close(10 <unfinished ...>
[pid 25481] 10:12:35.748328 geteuid( <unfinished ...>
[pid 25474] 10:12:35.748351 <... geteuid resumed> ) = 0
[pid 25473] 10:12:35.748373 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.748397 <... close resumed> ) = 0
[pid 25481] 10:12:35.748421 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.748444 geteuid( <unfinished ...>
[pid 25473] 10:12:35.748467 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064876, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.748498 read(9,  <unfinished ...>
[pid 25481] 10:12:35.748591 geteuid( <unfinished ...>
[pid 25474] 10:12:35.748617 <... geteuid resumed> ) = 0
[pid 25473] 10:12:35.748634 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.748666 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.748683 getegid( <unfinished ...>
[pid 25473] 10:12:35.748705 <... mmap resumed> ) = 0x7f7c15ca9000
[pid 25481] 10:12:35.748727 getegid( <unfinished ...>
[pid 25474] 10:12:35.748750 <... getegid resumed> ) = 499
[pid 25473] 10:12:35.748769 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.748798 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.748817 setgid(499 <unfinished ...>
[pid 25473] 10:12:35.748846 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.748881 setgid(12 <unfinished ...>
[pid 25474] 10:12:35.748906 <... setgid resumed> ) = 0
[pid 25473] 10:12:35.748925 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25481] 10:12:35.748957 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.748976 setuid(0 <unfinished ...>
[pid 25473] 10:12:35.749000 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25481] 10:12:35.749038 setuid(0 <unfinished ...>
[pid 25474] 10:12:35.749064 <... setuid resumed> ) = 0
[pid 25473] 10:12:35.749109 pipe( <unfinished ...>
[pid 25481] 10:12:35.749144 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.749183 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.749217 <... pipe resumed> [9, 10]) = 0
[pid 25481] 10:12:35.749240 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.749269 <... open resumed> ) = 6
[pid 25473] 10:12:35.749305 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25481] 10:12:35.749341 <... open resumed> ) = 6
[pid 25474] 10:12:35.749365 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.749390 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7c14b5f790}, 8) = 0
[pid 25481] 10:12:35.749420 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.749445 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.749478 clone( <unfinished ...>
[pid 25481] 10:12:35.749783 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25474] 10:12:35.749821 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.749853 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.749876 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.749911 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25487
[pid 25481] 10:12:35.749958 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25474] 10:12:35.749988 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.750015 close(10 <unfinished ...>
[pid 25481] 10:12:35.750042 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.750067 <... mmap resumed> ) = 0x7f84e3f51000
[pid 25473] 10:12:35.750084 <... close resumed> ) = 0
[pid 25481] 10:12:35.750106 <... mmap resumed> ) = 0x7f04ce1d4000
[pid 25474] 10:12:35.750123 read(6,  <unfinished ...>
[pid 25473] 10:12:35.750151 read(9,  <unfinished ...>
[pid 25481] 10:12:35.750177 read(6,  <unfinished ...>
[pid 25474] 10:12:35.750204 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25481] 10:12:35.750326 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25474] 10:12:35.750442 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.750484 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25474] 10:12:35.750579 <... socket resumed> ) = 7
[pid 25481] 10:12:35.750603 <... socket resumed> ) = 7
[pid 25474] 10:12:35.750620 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.750662 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25474] 10:12:35.750692 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.750713 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.750730 close(7 <unfinished ...>
[pid 25481] 10:12:35.750759 close(7 <unfinished ...>
[pid 25474] 10:12:35.750785 <... close resumed> ) = 0
[pid 25481] 10:12:35.750804 <... close resumed> ) = 0
[pid 25474] 10:12:35.750821 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.750850 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25474] 10:12:35.750875 <... socket resumed> ) = 7
[pid 25481] 10:12:35.750894 <... socket resumed> ) = 7
[pid 25474] 10:12:35.750910 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.750944 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25474] 10:12:35.750973 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.750993 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.751010 close(7 <unfinished ...>
[pid 25481] 10:12:35.751038 close(7 <unfinished ...>
[pid 25474] 10:12:35.751062 <... close resumed> ) = 0
[pid 25481] 10:12:35.751089 <... close resumed> ) = 0
[pid 25474] 10:12:35.751112 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.751146 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.751174 <... open resumed> ) = 7
[pid 25481] 10:12:35.751196 <... open resumed> ) = 7
[pid 25474] 10:12:35.751214 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.751247 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.751270 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25481] 10:12:35.751304 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25474] 10:12:35.751334 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.751364 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.751389 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.751410 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.751427 read(7,  <unfinished ...>
[pid 25481] 10:12:35.751457 read(7,  <unfinished ...>
[pid 25474] 10:12:35.751483 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25481] 10:12:35.751597 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25474] 10:12:35.751641 read(7,  <unfinished ...>
[pid 25481] 10:12:35.751670 read(7,  <unfinished ...>
[pid 25474] 10:12:35.751693 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.751714 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.751732 close(7 <unfinished ...>
[pid 25481] 10:12:35.751760 close(7 <unfinished ...>
[pid 25474] 10:12:35.751783 <... close resumed> ) = 0
[pid 25481] 10:12:35.751802 <... close resumed> ) = 0
[pid 25474] 10:12:35.751818 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.751850 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.751875 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.751909 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.751939 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.751979 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.752007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.752028 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.752045 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.752086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.752116 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.752135 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.752152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.752185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.752213 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.752233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.752250 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.752282 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.752310 <... open resumed> ) = 7
[pid 25481] 10:12:35.752330 <... open resumed> ) = 7
[pid 25474] 10:12:35.752346 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.752379 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.752402 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25481] 10:12:35.752441 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25474] 10:12:35.752475 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25481] 10:12:35.752582 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25474] 10:12:35.752616 <... mmap resumed> ) = 0x7f84e3f30000
[pid 25481] 10:12:35.752637 <... mmap resumed> ) = 0x7f04ce1b3000
[pid 25474] 10:12:35.752654 close(7 <unfinished ...>
[pid 25481] 10:12:35.752680 close(7 <unfinished ...>
[pid 25474] 10:12:35.752702 <... close resumed> ) = 0
[pid 25481] 10:12:35.752732 <... close resumed> ) = 0
[pid 25474] 10:12:35.752757 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.752794 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.752822 <... open resumed> ) = 7
[pid 25481] 10:12:35.752841 <... open resumed> ) = 7
[pid 25474] 10:12:35.752857 read(7,  <unfinished ...>
[pid 25481] 10:12:35.752884 read(7,  <unfinished ...>
[pid 25474] 10:12:35.752907 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25481] 10:12:35.752934 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25474] 10:12:35.752957 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.752984 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.753007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25481] 10:12:35.753044 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25474] 10:12:35.753076 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25481] 10:12:35.753112 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25474] 10:12:35.753142 <... mmap resumed> ) = 0x7f84df8cb000
[pid 25481] 10:12:35.753162 <... mmap resumed> ) = 0x7f04c9b4e000
[pid 25474] 10:12:35.753178 mprotect(0x7f84df8d7000, 2097152, PROT_NONE <unfinished ...>
[pid 25481] 10:12:35.753209 mprotect(0x7f04c9b5a000, 2097152, PROT_NONE <unfinished ...>
[pid 25474] 10:12:35.753235 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.753254 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.753275 mmap(0x7f84dfad7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25481] 10:12:35.753308 mmap(0x7f04c9d5a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25474] 10:12:35.753336 <... mmap resumed> ) = 0x7f84dfad7000
[pid 25481] 10:12:35.753364 <... mmap resumed> ) = 0x7f04c9d5a000
[pid 25474] 10:12:35.753390 close(7 <unfinished ...>
[pid 25481] 10:12:35.753418 close(7 <unfinished ...>
[pid 25474] 10:12:35.753441 <... close resumed> ) = 0
[pid 25481] 10:12:35.753482 <... close resumed> ) = 0
[pid 25474] 10:12:35.753594 mprotect(0x7f84dfad7000, 4096, PROT_READ <unfinished ...>
[pid 25481] 10:12:35.753631 mprotect(0x7f04c9d5a000, 4096, PROT_READ <unfinished ...>
[pid 25474] 10:12:35.753657 <... mprotect resumed> ) = 0
[pid 25481] 10:12:35.753680 <... mprotect resumed> ) = 0
[pid 25474] 10:12:35.753699 munmap(0x7f84e3f30000, 39387 <unfinished ...>
[pid 25481] 10:12:35.753731 munmap(0x7f04ce1b3000, 39387 <unfinished ...>
[pid 25474] 10:12:35.753757 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.753785 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.753809 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.753851 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.753882 <... open resumed> ) = 7
[pid 25481] 10:12:35.753912 <... open resumed> ) = 7
[pid 25474] 10:12:35.753937 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.753964 fcntl(7, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.753987 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25481] 10:12:35.754010 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25474] 10:12:35.754029 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.754056 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.754079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.754111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.754139 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.754169 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.754223 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.754247 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25480] 10:12:35.754263 <... read resumed> "\26\3\1\0Q\2\0", 7) = 7
[pid 25474] 10:12:35.754311 read(7,  <unfinished ...>
[pid 25481] 10:12:35.754349 read(7,  <unfinished ...>
[pid 25480] 10:12:35.754376 read(11,  <unfinished ...>
[pid 25474] 10:12:35.754400 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.754443 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25480] 10:12:35.754482 <... read resumed> "\0M\3\1V\204\2s\177h\346s\206U\33\267x\235\213}\340\215\365\37t\270\274%\367d\321\342\32\36\332\371 \10\246\224\242\323\270\204\272+\275\311{\345\326\2304\237\30\367\350\222\274\347\374\220M8N\316\374\363-\0005\0\0\5\377\1\0\1\0", 79) = 79
[pid 25474] 10:12:35.754636 close(7 <unfinished ...>
[pid 25481] 10:12:35.754676 close(7 <unfinished ...>
[pid 25480] 10:12:35.754700 read(11,  <unfinished ...>
[pid 25479] 10:12:35.754731 <... read resumed> "\26\3\1\0Q\2\0", 7) = 7
[pid 25474] 10:12:35.754774 <... close resumed> ) = 0
[pid 25481] 10:12:35.754800 <... close resumed> ) = 0
[pid 25480] 10:12:35.754817 <... read resumed> "\26\3\1\f\226", 5) = 5
[pid 25479] 10:12:35.754840 read(11,  <unfinished ...>
[pid 25474] 10:12:35.754869 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.754907 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25480] 10:12:35.754937 read(11,  <unfinished ...>
[pid 25479] 10:12:35.754966 <... read resumed> "\0M\3\1V\204\2s\36\345\225\337K\264\31/\242dh\336>\30\261\214\366\333+\231,\24\244\372.\220\332\213 |\370\371q\241\301\245\34\252\2\331\33\205\232\370AB>/\256*g\31\2\210\26L\365\20\302\230\356\0005\0\0\5\377\1\0\1\0", 79) = 79
[pid 25474] 10:12:35.755015 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.755061 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.755098 <... read resumed> "\v\0\f\222\0\f\217\0\5,0\202\5(0\202\4\20\240\3\2\1\2\2\3\22~90\r\6\t*\206H\206\367\r\1\1\5\5\0000<1\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16GeoTrust, Inc.1\0240\22\6\3U\4\3\23\vRapidSSL CA0\36\27\r140428174333Z\27\r180430071225Z0\201\3001)0'\6\3U\4\5\23 6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp1\0230\21\6\3U\4\v\23\nGT21850092110/\6\3U\4\v\23(See www.rapidssl.com/resources/cps (c)141"..., 3222) = 3222
[pid 25479] 10:12:35.755862 read(11,  <unfinished ...>
[pid 25474] 10:12:35.755910 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.755948 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25480] 10:12:35.755974 read(11,  <unfinished ...>
[pid 25479] 10:12:35.755998 <... read resumed> "\26\3\1\f\226", 5) = 5
[pid 25474] 10:12:35.756018 <... socket resumed> ) = 7
[pid 25481] 10:12:35.756041 <... socket resumed> ) = 7
[pid 25480] 10:12:35.756057 <... read resumed> "\26\3\1;\304", 5) = 5
[pid 25479] 10:12:35.756075 read(11,  <unfinished ...>
[pid 25474] 10:12:35.756104 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.756143 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25480] 10:12:35.756173 read(11,  <unfinished ...>
[pid 25479] 10:12:35.756198 <... read resumed> "\v\0\f\222\0\f\217\0\5,0\202\5(0\202\4\20\240\3\2\1\2\2\3\22~90\r\6\t*\206H\206\367\r\1\1\5\5\0000<1\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16GeoTrust, Inc.1\0240\22\6\3U\4\3\23\vRapidSSL CA0\36\27\r140428174333Z\27\r180430071225Z0\201\3001)0'\6\3U\4\5\23 6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp1\0230\21\6\3U\4\v\23\nGT21850092110/\6\3U\4\v\23(See www.rapidssl.com/resources/cps (c)141"..., 3222) = 3222
[pid 25474] 10:12:35.756903 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.756946 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.756965 <... read resumed> "\r\0;\274\2\1\2;\267\0a0_1\v0\t\6\3U\4\6\23\2US1 0\36\6\3U\4\n\23\27RSA Data Security, Inc.1.0,\6\3U\4\v\23%Secure Server Certification Authority\0G0E1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1\0340\32\6\3U\4\3\23\23GTE CyberTrust Root\0w0u1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1'0%\6\3U\4\v\23\36GTE CyberTrust Soluti"..., 15300) = 778
[pid 25479] 10:12:35.756990 read(11,  <unfinished ...>
[pid 25474] 10:12:35.757015 close(7 <unfinished ...>
[pid 25481] 10:12:35.757049 close(7 <unfinished ...>
[pid 25480] 10:12:35.757073 read(11,  <unfinished ...>
[pid 25479] 10:12:35.757096 <... read resumed> "\26\3\1;\304", 5) = 5
[pid 25474] 10:12:35.757114 <... close resumed> ) = 0
[pid 25481] 10:12:35.757136 <... close resumed> ) = 0
[pid 25479] 10:12:35.757152 read(11,  <unfinished ...>
[pid 25474] 10:12:35.757176 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25481] 10:12:35.757208 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25479] 10:12:35.757233 <... read resumed> "\r\0;\274\2\1\2;\267\0a0_1\v0\t\6\3U\4\6\23\2US1 0\36\6\3U\4\n\23\27RSA Data Security, Inc.1.0,\6\3U\4\v\23%Secure Server Certification Authority\0G0E1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1\0340\32\6\3U\4\3\23\23GTE CyberTrust Root\0w0u1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1'0%\6\3U\4\v\23\36GTE CyberTrust Soluti"..., 15300) = 778
[pid 25474] 10:12:35.757261 <... socket resumed> ) = 7
[pid 25481] 10:12:35.757283 <... socket resumed> ) = 7
[pid 25479] 10:12:35.757299 read(11,  <unfinished ...>
[pid 25474] 10:12:35.757321 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25481] 10:12:35.757356 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25474] 10:12:35.757386 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.757406 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.757423 close(7 <unfinished ...>
[pid 25481] 10:12:35.757453 close(7 <unfinished ...>
[pid 25474] 10:12:35.757477 <... close resumed> ) = 0
[pid 25481] 10:12:35.757502 <... close resumed> ) = 0
[pid 25474] 10:12:35.757593 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.757632 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.757660 <... open resumed> ) = 7
[pid 25481] 10:12:35.757681 <... open resumed> ) = 7
[pid 25474] 10:12:35.757699 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.757726 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.757749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.757782 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25474] 10:12:35.757810 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.757845 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.757876 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.757900 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.757923 read(7,  <unfinished ...>
[pid 25481] 10:12:35.757955 read(7,  <unfinished ...>
[pid 25474] 10:12:35.757981 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25481] 10:12:35.758018 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25474] 10:12:35.758051 close(7 <unfinished ...>
[pid 25481] 10:12:35.758081 close(7 <unfinished ...>
[pid 25474] 10:12:35.758104 <... close resumed> ) = 0
[pid 25481] 10:12:35.758123 <... close resumed> ) = 0
[pid 25474] 10:12:35.758140 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.758171 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.758196 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.758233 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.758268 read(6,  <unfinished ...>
[pid 25481] 10:12:35.758298 read(6,  <unfinished ...>
[pid 25474] 10:12:35.758322 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25481] 10:12:35.758385 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25474] 10:12:35.758442 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.758480 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.758583 <... open resumed> ) = 7
[pid 25481] 10:12:35.758611 <... open resumed> ) = 7
[pid 25474] 10:12:35.758630 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.758657 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.758680 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.758713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.758741 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.758772 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.758796 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.758816 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.758837 read(7,  <unfinished ...>
[pid 25481] 10:12:35.758875 read(7,  <unfinished ...>
[pid 25474] 10:12:35.758910 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.758939 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.758963 close(7 <unfinished ...>
[pid 25481] 10:12:35.758991 close(7 <unfinished ...>
[pid 25474] 10:12:35.759014 <... close resumed> ) = 0
[pid 25481] 10:12:35.759033 <... close resumed> ) = 0
[pid 25474] 10:12:35.759050 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.759080 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.759105 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.759132 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.759157 read(6,  <unfinished ...>
[pid 25481] 10:12:35.759185 read(6,  <unfinished ...>
[pid 25474] 10:12:35.759208 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25481] 10:12:35.759249 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25474] 10:12:35.759288 uname( <unfinished ...>
[pid 25481] 10:12:35.759317 uname( <unfinished ...>
[pid 25474] 10:12:35.759342 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25481] 10:12:35.759391 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25474] 10:12:35.759445 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25481] 10:12:35.759482 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.759585 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790}, 8) = 0
[pid 25481] 10:12:35.759624 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790}, 8) = 0
[pid 25474] 10:12:35.759652 clone( <unfinished ...>
[pid 25481] 10:12:35.759875 clone( <unfinished ...>
[pid 25474] 10:12:35.760112 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f84e3f3aa90) = 25488
[pid 25481] 10:12:35.760159 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f04ce1bda90) = 25489
[pid 25474] 10:12:35.760206 wait4(25488,  <unfinished ...>
[pid 25481] 10:12:35.760234 wait4(25489, Process 25487 attached
 <unfinished ...>
[pid 25487] 10:12:35.760295 set_robust_list(0x7f7c15c92aa0, 24) = 0
[pid 25487] 10:12:35.760379 close(9)    = 0
[pid 25487] 10:12:35.760424 geteuid()   = 0
[pid 25487] 10:12:35.760461 getegid()   = 12
[pid 25487] 10:12:35.760497 setgid(494) = 0
[pid 25487] 10:12:35.760593 setuid(495) = 0
[pid 25487] 10:12:35.760652 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25487] 10:12:35.760703 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25487] 10:12:35.760791 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25487] 10:12:35.760849 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca8000
[pid 25487] 10:12:35.760898 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25487] 10:12:35.760953 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25487] 10:12:35.761001 close(9)    = 0
[pid 25487] 10:12:35.761038 munmap(0x7f7c15ca8000, 4096) = 0
[pid 25487] 10:12:35.761119 brk(0xf25000) = 0xf25000
[pid 25487] 10:12:35.761311 lseek(6, 19, SEEK_SET) = 19
[pid 25487] 10:12:35.761362 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2426) = 1858
[pid 25487] 10:12:35.761696 write(10, "\2\0\0\0", 4) = 4
[pid 25473] 10:12:35.761744 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25473] 10:12:35.761767 read(9,  <unfinished ...>
[pid 25487] 10:12:35.761795 write(10, "\1\0\0\0", 4) = 4
[pid 25473] 10:12:35.761834 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25473] 10:12:35.761856 read(9,  <unfinished ...>
[pid 25487] 10:12:35.761891 write(10, "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.761926 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.761947 read(9,  <unfinished ...>
[pid 25487] 10:12:35.761975 write(10, "\377\377\377\377", 4) = 4
[pid 25473] 10:12:35.762009 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25473] 10:12:35.762030 read(9,  <unfinished ...>
[pid 25487] 10:12:35.762065 write(10, "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.762099 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.762120 read(9,  <unfinished ...>
[pid 25487] 10:12:35.762149 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25473] 10:12:35.762222 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25480] 10:12:35.762250 <... read resumed> " Town1\0320\30\6\3U\4\n\23\21Thawte Consulting1(0&\6\3U\4\v\23\37Certification Services Division1$0\"\6\3U\4\3\23\33Thawte Personal Freemail CA1+0)\6\t*\206H\206\367\r\1\t\1\26\34personal-freemail@thawte.com\0\3070\201\3041\v0\t\6\3U\4\6\23\2ZA1\0250\23\6\3U\4\10\23\fWestern Cape1\0220\20\6\3U\4\7\23\tCape Town1\0350\33\6\3U\4\n\23\24Thawte Consulting cc1(0&\6\3"..., 14522) = 2896
[pid 25473] 10:12:35.762275 read(9,  <unfinished ...>
[pid 25480] 10:12:35.762300 read(11,  <unfinished ...>
[pid 25487] 10:12:35.762331 write(10, "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.762369 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:35.762391 wait4(-1,  <unfinished ...>
[pid 25487] 10:12:35.762419 close(10)   = 0
[pid 25487] 10:12:35.762463 exit_group(0) = ?
[pid 25480] 10:12:35.762695 <... read resumed> "k1\0270\25\6\3U\4\n\23\16ValiCert, Inc.1503\6\3U\4\v\23,ValiCert Class 3 Policy Validation Authority1!0\37\6\3U\4\3\23\30http://www.valicert.com/1 0\36\6\t*\206H\206\367\r\1\t\1\26\21info@valicert.com\0\3150\201\3121\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16VeriSign, Inc.1\0370\35\6\3U\4\v\23\26VeriSign Trust Network1:08\6\3U\4\v\0231(c) 1999 VeriSign, "..., 11626) = 4344
[pid 25480] 10:12:35.762730 read(11,  <unfinished ...>
[pid 25487] 10:12:35.762809 +++ exited with 0 +++
[pid 25473] 10:12:35.762823 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25487
[pid 25473] 10:12:35.762844 close(9)    = 0
[pid 25473] 10:12:35.762880 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25473] 10:12:35.762938 brk(0xf24000) = 0xf24000
[pid 25473] 10:12:35.762982 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25473] 10:12:35.763031 alarm(60)   = 0
[pid 25473] 10:12:35.763066 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25473] 10:12:35.763103 alarm(0)    = 60
[pid 25473] 10:12:35.763178 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.763229 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25473] 10:12:35.763276 read(10, "cpu  123065 1342409 395163 67343096 2509 0 0 0\ncpu0 123065 1342409 395163 67343096 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58388485\nbtime 1450798266\nprocesses 892967\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25473] 10:12:35.763334 close(10)   = 0
[pid 25473] 10:12:35.763421 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:35.763488 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25473] 10:12:35.763600 fcntl(10, F_GETFD <unfinished ...>
[pid 25479] 10:12:35.763648 <... read resumed> " Town1\0320\30\6\3U\4\n\23\21Thawte Consulting1(0&\6\3U\4\v\23\37Certification Services Division1$0\"\6\3U\4\3\23\33Thawte Personal Freemail CA1+0)\6\t*\206H\206\367\r\1\t\1\26\34personal-freemail@thawte.com\0\3070\201\3041\v0\t\6\3U\4\6\23\2ZA1\0250\23\6\3U\4\10\23\fWestern Cape1\0220\20\6\3U\4\7\23\tCape Town1\0350\33\6\3U\4\n\23\24Thawte Consulting cc1(0&\6\3"..., 14522) = 1448
[pid 25479] 10:12:35.763676 read(11,  <unfinished ...>
[pid 25473] 10:12:35.763706 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.763725 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:35.763763 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25479] 10:12:35.763866 <... read resumed> "2 Public Primary Certification Authority\0a0_1\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16VeriSign, Inc.1705\6\3U\4\v\23.Class 3 Public Primary Certification Authority\0\3040\201\3011\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16VeriSign, Inc.1<0:\6\3U\4\v\0233Class 1 Public Primary Certification Authority - G21:08\6\3U\4\v\0231("..., 13074) = 5792
[pid 25473] 10:12:35.763893 close(10 <unfinished ...>
[pid 25479] 10:12:35.763922 read(11,  <unfinished ...>
[pid 25473] 10:12:35.763945 <... close resumed> ) = 0
[pid 25473] 10:12:35.763980 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.764024 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25473] 10:12:35.764191 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15c61000
[pid 25473] 10:12:35.764353 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25473] 10:12:35.764402 fcntl(10, F_GETFD) = 0
[pid 25473] 10:12:35.764436 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:35.764474 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:35.764609 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25473] 10:12:35.764702 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25473] 10:12:35.764764 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25473] 10:12:35.764840 close(10)   = 0
[pid 25473] 10:12:35.764903 munmap(0x7f7c15c61000, 200704) = 0
[pid 25473] 10:12:35.764973 close(9)    = 0
[pid 25473] 10:12:35.765032 open("/etc/localdomains", O_RDONLY) = 9
[pid 25473] 10:12:35.765079 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:35.765141 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:35.765190 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca8000
[pid 25473] 10:12:35.765230 lseek(9, 0, SEEK_SET) = 0
[pid 25473] 10:12:35.765265 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25473] 10:12:35.765333 stat("/jail_owner", 0x7ffdac33b840) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.765386 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25473] 10:12:35.765455 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.765582 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25473] 10:12:35.765650 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.765704 <... select resumed> ) = 1 (in [11], left {299, 962379})
[pid 25473] 10:12:35.765729 stat("/etc/demouids",  <unfinished ...>
[pid 25482] 10:12:35.765754 recvfrom(11, "250-BL2FFO11FD026.mail.protection.outlook.com Hello [50.116.78.207]\r\n250-SIZE 157286400\r\n250-PIPELINING\r\n250-DSN\r\n250-ENHANCEDSTATUSCODES\r\n250-STARTTLS\r\n250-8BITMIME\r\n250-BINARYMIME\r\n250 CHUNKING\r\n", 4096, 0, NULL, NULL) = 197
[pid 25482] 10:12:35.765819 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25482] 10:12:35.765877 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25473] 10:12:35.765917 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:35.765968 open("/etc/demouids", O_RDONLY) = 10
[pid 25473] 10:12:35.766012 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:35.766062 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:35.766108 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca7000
[pid 25473] 10:12:35.766146 lseek(10, 0, SEEK_SET) = 0
[pid 25473] 10:12:35.766181 read(10, "", 4096) = 0
[pid 25473] 10:12:35.766225 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25473] 10:12:35.766401 getuid()    = 0
[pid 25473] 10:12:35.766446 geteuid()   = 0
[pid 25473] 10:12:35.766483 getgid()    = 12
[pid 25473] 10:12:35.766591 getegid()   = 12
[pid 25473] 10:12:35.766696 open("/dev/urandom", O_RDONLY) = 11
[pid 25473] 10:12:35.766748 read(11, "wR\332h", 4) = 4
[pid 25473] 10:12:35.766789 close(11)   = 0
[pid 25473] 10:12:35.766906 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25473] 10:12:35.767023 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335dd0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.767072 lseek(0, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.767112 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335dd0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.767150 lseek(1, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.767186 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335de0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.767224 lseek(2, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.767262 open("/dev/null", O_RDONLY) = 11
[pid 25473] 10:12:35.767307 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335eb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.767346 lseek(11, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.767383 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:35.767421 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25473] 10:12:35.767753 brk(0xf45000) = 0xf45000
[pid 25473] 10:12:35.767810 read(11, "", 8192) = 0
[pid 25473] 10:12:35.767858 close(11)   = 0
[pid 25473] 10:12:35.768170 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.768238 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25473] 10:12:35.768281 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335ce0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.768322 lseek(11, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.768384 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25473] 10:12:35.769296 brk(0xf66000) = 0xf66000
[pid 25473] 10:12:35.769780 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25480] 10:12:35.770677 <... read resumed> "Root CAs1301\6\3U\4\3\23*beTRUSTed Root CA - Entrust Implementation\0d0b1\0220\20\6\3U\4\n\23\tbeTRUSTed1\0330\31\6\3U\4\v\23\22beTRUSTed Root CAs1/0-\6\3U\4\3\23&beTRUSTed Root CA - RSA Implementation\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc1\0350\33\6\3U\4\v\23\24RSA Security 2048 V3\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc"..., 7282) = 5792
[pid 25473] 10:12:35.770720 brk(0xf87000 <unfinished ...>
[pid 25480] 10:12:35.770748 read(11,  <unfinished ...>
[pid 25473] 10:12:35.770781 <... brk resumed> ) = 0xf87000
[pid 25480] 10:12:35.771255 <... read resumed> "ces Inc1-0+\6\3U\4\3\23$XRamp Global Certification Authority\0e0c1\v0\t\6\3U\4\6\23\2US1!0\37\6\3U\4\n\23\30The Go Daddy Group, Inc.110/\6\3U\4\v\23(Go Daddy Class 2 Certification Authority\0j0h1\v0\t\6\3U\4\6\23\2US1%0#\6\3U\4\n\23\34Starfield Technologies, Inc.1200\6\3U\4\v\23)Starfield Class 2 Certification "..., 1490) = 1490
[pid 25473] 10:12:35.772066 read(11,  <unfinished ...>
[pid 25480] 10:12:35.772105 brk(0xb36000) = 0xb36000
[pid 25480] 10:12:35.773126 write(11, "\26\3\1\0\7\v\0\0\3\0\0\0\26\3\1\1\6\20\0\1\2\1\0\fj\340Ki\324\350M\3\272\367]F\302\242\222\201h\201\0365\24\327\364\255\6\265\322\25j9\240\243\346\351\32\353y58s\275\316\277\353wZ\256m\273-,|x\\\326\270I\310\vx\273m\374'\36\246\247\360\310T\330\332\f\200\250\326\\\\\362>\17Pon\373\217\262\241/\272ax\277\374\241\344\350\204Y\1\373\371V\277\345(\236\260\323\225{\302\316\32\376\f\23\233\274\35\vq\326:\344\222z\312\36\305.\fUx\377\317\201H\371\305E\204\2024\247d\25\312I\301\360&E\272\235\311?\332\20\212\5R\251\321J)\327\333\357m\277\236\36q\303v\243R\276p\340\3353\331\317\0162\253+1{\377\212\317\343\237\253P\276\224\213D\223\371Rx\354T\f\20\\\324\227\30M \202\22s~\204\r\235\240<\177Pwi\373V\201"..., 338 <unfinished ...>
[pid 25479] 10:12:35.773178 <... read resumed> "Root CAs1301\6\3U\4\3\23*beTRUSTed Root CA - Entrust Implementation\0d0b1\0220\20\6\3U\4\n\23\tbeTRUSTed1\0330\31\6\3U\4\v\23\22beTRUSTed Root CAs1/0-\6\3U\4\3\23&beTRUSTed Root CA - RSA Implementation\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc1\0350\33\6\3U\4\v\23\24RSA Security 2048 V3\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc"..., 7282) = 1448
[pid 25479] 10:12:35.773206 read(11, "\22Greater Manchester1\0200\16\6\3U\4\7\f\7Salford1\0320\30\6\3U\4\n\f\21Comodo CA Limited1$0\"\6\3U\4\3\f\33Secure Certificate Services\0\2010\1771\v0\t\6\3U\4\6\23\2GB1\0330\31\6\3U\4\10\f\22Greater Manchester1\0200\16\6\3U\4\7\f\7Salford1\0320\30\6\3U\4\n\f\21Comodo CA Limited1%0#\6\3U\4\3\f\34Trusted Certificate Services\1 0\202\1\0341\v0\t\6\3U\4\6\23\2ES1\0220"..., 5834) = 5834
[pid 25479] 10:12:35.774010 brk(0xb36000) = 0xb36000
[pid 25480] 10:12:35.775019 <... write resumed> ) = 338
[pid 25479] 10:12:35.775046 write(11, "\26\3\1\0\7\v\0\0\3\0\0\0\26\3\1\1\6\20\0\1\2\1\0\2213\26092j\v\313n&\31^\2\362\2625\317l\201\211\3322\5W\320\305jl*\245\201\36\377\342\357\n\265\216^a\213!P\240\343\\.\34\212]\23\233j\250\313\203^\326\r\2237vL\36\344\213k\366P0\"l\25\7\341-\230_s+\n4\201\r9\247\251\360=\265\4\247\230y3\300\27\31\17\307\360\342\303\3020\352E\252\236\306\263<J\242\307\256\335\3N\\-\303\nR\360<\310\212\316\215\267\377\35!\252\331\241g\277X\364\201\302\234\241\2067\17k\313yx\347\226\255)\34\363\27\273[Q\31503_\351\313\0\265\300\r\304Aj\255\233\301\327\24$\230B\36@\242W\276}1k\276\377tP\326t\216\341\265\342\212{\177ot'L\323\4\352\3633\226\200\320Jl{\356\n\25\227Nb0\23>\231\323\237p'"..., 338 <unfinished ...>
[pid 25473] 10:12:35.775080 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25480] 10:12:35.775831 read(11,  <unfinished ...>
[pid 25479] 10:12:35.775873 <... write resumed> ) = 338
[pid 25473] 10:12:35.775893 brk(0xfa8000 <unfinished ...>
[pid 25479] 10:12:35.775937 read(11,  <unfinished ...>
[pid 25473] 10:12:35.775959 <... brk resumed> ) = 0xfa8000
[pid 25473] 10:12:35.776403 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25473] 10:12:35.776779 read(11, "", 8192) = 0
[pid 25473] 10:12:35.776835 close(11)   = 0
[pid 25473] 10:12:35.776902 stat("/usr/share/amavis/amavis-filter", 0x7f7c14346880) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.776958 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.777014 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.777071 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25473] 10:12:35.777114 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac335ce0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.777154 lseek(11, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.777210 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25473] 10:12:35.777503 brk(0xfc9000) = 0xfc9000
[pid 25473] 10:12:35.777789 stat("/etc/exim/perl/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.777851 stat("/etc/exim/perl/warnings.pm", 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.777905 stat("/usr/local/cpanel/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.777950 stat("/usr/local/cpanel/warnings.pm", 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.777993 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778042 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778086 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778129 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778172 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778216 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778259 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.778301 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.778358 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25473] 10:12:35.778404 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdac3356f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.778442 lseek(12, 0, SEEK_CUR) = 0
[pid 25473] 10:12:35.778499 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
Process 25486 attached
[pid 25486] 10:12:35.778876 set_robust_list(0x7ff101070aa0, 24) = 0
[pid 25486] 10:12:35.778980 close(9)    = 0
[pid 25486] 10:12:35.779027 geteuid()   = 0
[pid 25486] 10:12:35.779062 getegid()   = 12
[pid 25486] 10:12:35.779098 setgid(494) = 0
[pid 25486] 10:12:35.779133 setuid(495) = 0
[pid 25486] 10:12:35.779192 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25486] 10:12:35.779243 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.779378 read(12,  <unfinished ...>
[pid 25486] 10:12:35.779460 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25486] 10:12:35.779565 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101086000
[pid 25486] 10:12:35.779614 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25486] 10:12:35.779663 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25473] 10:12:35.779712 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25486] 10:12:35.779740 close(9)    = 0
[pid 25486] 10:12:35.779837 munmap(0x7ff101086000, 4096) = 0
[pid 25486] 10:12:35.779930 brk(0x2762000 <unfinished ...>
[pid 25473] 10:12:35.780464 brk(0xfea000 <unfinished ...>
[pid 25486] 10:12:35.780499 <... brk resumed> ) = 0x2762000
[pid 25486] 10:12:35.780686 write(10, "\2\0\0\0", 4) = 4
[pid 25472] 10:12:35.780736 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25472] 10:12:35.780759 read(9,  <unfinished ...>
[pid 25486] 10:12:35.780788 write(10, "\1\0\0\0", 4) = 4
[pid 25472] 10:12:35.780822 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25472] 10:12:35.780846 read(9,  <unfinished ...>
[pid 25486] 10:12:35.780882 write(10, "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.780917 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.780937 read(9,  <unfinished ...>
[pid 25486] 10:12:35.780966 write(10, "\377\377\377\377", 4) = 4
[pid 25472] 10:12:35.781000 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25472] 10:12:35.781021 read(9,  <unfinished ...>
[pid 25486] 10:12:35.781049 write(10, "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.781083 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.781103 read(9,  <unfinished ...>
[pid 25486] 10:12:35.781131 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25472] 10:12:35.781170 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25472] 10:12:35.781191 read(9,  <unfinished ...>
[pid 25486] 10:12:35.781220 write(10, "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.781254 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25472] 10:12:35.781277 wait4(-1,  <unfinished ...>
[pid 25486] 10:12:35.781306 close(10)   = 0
[pid 25486] 10:12:35.781351 exit_group(0) = ?
[pid 25486] 10:12:35.781649 +++ exited with 0 +++
[pid 25472] 10:12:35.781670 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25486
[pid 25472] 10:12:35.781694 close(9)    = 0
[pid 25472] 10:12:35.781733 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0}, 8) = 0
[pid 25472] 10:12:35.781792 brk(0x2761000) = 0x2761000
[pid 25472] 10:12:35.781840 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25472] 10:12:35.781893 alarm(60)   = 0
[pid 25472] 10:12:35.781929 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25472] 10:12:35.781968 alarm(0)    = 60
[pid 25472] 10:12:35.782041 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.782092 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25472] 10:12:35.782144 read(10, "cpu  123066 1342410 395164 67343096 2509 0 0 0\ncpu0 123066 1342410 395164 67343096 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58389827\nbtime 1450798266\nprocesses 892967\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25472] 10:12:35.782203 close(10)   = 0
[pid 25472] 10:12:35.782288 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.782352 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25472] 10:12:35.782395 fcntl(10, F_GETFD) = 0
[pid 25472] 10:12:35.782428 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25472] 10:12:35.782468 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25472] 10:12:35.782586 close(10)   = 0
[pid 25472] 10:12:35.782643 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.782687 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25472] 10:12:35.782787 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff10103f000
[pid 25472] 10:12:35.782936 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25472] 10:12:35.782981 fcntl(10, F_GETFD) = 0
[pid 25472] 10:12:35.783014 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25472] 10:12:35.783050 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.783129 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25472] 10:12:35.783214 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25472] 10:12:35.783281 close(10)   = 0
[pid 25472] 10:12:35.783342 munmap(0x7ff10103f000, 200704) = 0
[pid 25472] 10:12:35.783410 close(9)    = 0
[pid 25472] 10:12:35.783467 open("/etc/localdomains", O_RDONLY) = 9
[pid 25472] 10:12:35.783580 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.783649 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.783697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101086000
[pid 25472] 10:12:35.783736 lseek(9, 0, SEEK_SET) = 0
[pid 25472] 10:12:35.783771 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25472] 10:12:35.783838 stat("/jail_owner", 0x7ffdc17dc2d0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.783889 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25472] 10:12:35.783955 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.784004 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25472] 10:12:35.784059 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.784103 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.784169 open("/etc/demouids", O_RDONLY) = 10
[pid 25472] 10:12:35.784211 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.784259 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.784304 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101085000
[pid 25472] 10:12:35.784344 lseek(10, 0, SEEK_SET) = 0
[pid 25472] 10:12:35.784399 read(10, Process 25489 attached
Process 25488 attached
 <unfinished ...>
[pid 25473] 10:12:35.784486 <... brk resumed> ) = 0xfea000
[pid 25472] 10:12:35.784503 <... read resumed> "", 4096) = 0
[pid 25489] 10:12:35.784802 set_robust_list(0x7f04ce1bdaa0, 24 <unfinished ...>
[pid 25488] 10:12:35.784830 set_robust_list(0x7f84e3f3aaa0, 24 <unfinished ...>
[pid 25473] 10:12:35.784852 read(12,  <unfinished ...>
[pid 25472] 10:12:35.784872 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25489] 10:12:35.784907 <... set_robust_list resumed> ) = 0
[pid 25488] 10:12:35.784921 <... set_robust_list resumed> ) = 0
[pid 25472] 10:12:35.784957 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25489] 10:12:35.785055 geteuid( <unfinished ...>
[pid 25488] 10:12:35.785082 geteuid( <unfinished ...>
[pid 25472] 10:12:35.785104 stat("/etc/userdomains",  <unfinished ...>
[pid 25489] 10:12:35.785135 <... geteuid resumed> ) = 0
[pid 25488] 10:12:35.785154 <... geteuid resumed> ) = 0
[pid 25472] 10:12:35.785175 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25489] 10:12:35.785229 geteuid( <unfinished ...>
[pid 25488] 10:12:35.785254 geteuid( <unfinished ...>
[pid 25473] 10:12:35.785275 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25472] 10:12:35.785293 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25489] 10:12:35.785605 <... geteuid resumed> ) = 0
[pid 25488] 10:12:35.785621 <... geteuid resumed> ) = 0
[pid 25472] 10:12:35.785638 <... open resumed> ) = 11
[pid 25489] 10:12:35.785662 getegid( <unfinished ...>
[pid 25488] 10:12:35.785684 getegid( <unfinished ...>
[pid 25472] 10:12:35.785705 fstat(11,  <unfinished ...>
[pid 25489] 10:12:35.785733 <... getegid resumed> ) = 12
[pid 25488] 10:12:35.785746 <... getegid resumed> ) = 499
[pid 25472] 10:12:35.785764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25489] 10:12:35.785808 setgid(12 <unfinished ...>
[pid 25488] 10:12:35.785837 setgid(12 <unfinished ...>
[pid 25472] 10:12:35.785865 fstat(11,  <unfinished ...>
[pid 25489] 10:12:35.785898 <... setgid resumed> ) = 0
[pid 25488] 10:12:35.785915 <... setgid resumed> ) = 0
[pid 25472] 10:12:35.785932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25489] 10:12:35.785968 setuid(47 <unfinished ...>
[pid 25488] 10:12:35.785991 setuid(47 <unfinished ...>
[pid 25472] 10:12:35.786013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25489] 10:12:35.786046 <... setuid resumed> ) = 0
[pid 25488] 10:12:35.786059 <... setuid resumed> ) = 0
[pid 25472] 10:12:35.786572 <... mmap resumed> ) = 0x7ff101084000
[pid 25472] 10:12:35.786604 lseek(11, 0, SEEK_SET) = 0
[pid 25472] 10:12:35.786640 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25472] 10:12:35.786708 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25472] 10:12:35.786756 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.786804 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101083000
[pid 25480] 10:12:35.787864 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25473] 10:12:35.787895 read(12,  <unfinished ...>
[pid 25480] 10:12:35.787927 read(11,  <unfinished ...>
[pid 25472] 10:12:35.787954 read(12,  <unfinished ...>
[pid 25480] 10:12:35.787986 <... read resumed> "\1", 1) = 1
[pid 25472] 10:12:35.788047 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25480] 10:12:35.788083 read(11,  <unfinished ...>
[pid 25472] 10:12:35.788116 close(12 <unfinished ...>
[pid 25480] 10:12:35.788145 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25472] 10:12:35.788164 <... close resumed> ) = 0
[pid 25480] 10:12:35.788184 read(11,  <unfinished ...>
[pid 25472] 10:12:35.788208 munmap(0x7ff101083000, 4096 <unfinished ...>
[pid 25480] 10:12:35.788240 <... read resumed> "\205\t9\376\33\37/\204\3433^\316\331\375\213aZs9\347\376#\347cT\202\335\231\347Gh\277\4\270\221\213i\361\246\r(\260\30\267t\0F\303", 48) = 48
[pid 25472] 10:12:35.788301 <... munmap resumed> ) = 0
[pid 25480] 10:12:35.788348 alarm(0 <unfinished ...>
[pid 25472] 10:12:35.788376 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25480] 10:12:35.788407 <... alarm resumed> ) = 300
[pid 25472] 10:12:35.788454 <... stat resumed> 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.788486 write(11, "\27\3\1\0 \16\321)\t\31\337\235]\36Uj\212Xaf\207\250g\5\305#\335\30W\325\243\334ia\272E\367\27\3\1\0@\313D\370\370\323\371\5\314\244\\\25\351\233[+\226D\240\310l1\270\212\264\322\366\313\204\177a\351\224 f\377N\r\235\277D\240bN%\372\265\366\306\16r\315\202\37p\317\327\313\275\305\0305\306t\307", 106 <unfinished ...>
[pid 25472] 10:12:35.788597 stat("/etc/userdomains",  <unfinished ...>
[pid 25480] 10:12:35.788630 <... write resumed> ) = 106
[pid 25472] 10:12:35.788652 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25480] 10:12:35.788704 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25472] 10:12:35.788737 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25472] 10:12:35.788799 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25473] 10:12:35.789897 <... read resumed> "", 8192) = 0
[pid 25472] 10:12:35.789921 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:35.789950 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25472] 10:12:35.789979 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:35.790019 recvfrom(16,  <unfinished ...>
[pid 25472] 10:12:35.790051 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:35.790076 <... recvfrom resumed> "\326\36\201\200\0\1\0\1\0\0\0\0\26theviewsatsuperstition\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\4\257\0\4\0\0\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 60
[pid 25472] 10:12:35.790118 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:35.790156 close(16 <unfinished ...>
[pid 25472] 10:12:35.790192 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:35.790218 <... close resumed> ) = 0
[pid 25472] 10:12:35.790269 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:35.790322 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25472] 10:12:35.790358 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25458] 10:12:35.790391 <... socket resumed> ) = 16
[pid 25472] 10:12:35.790412 <... stat resumed> 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.790435 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25472] 10:12:35.790475 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:35.790503 <... connect resumed> ) = 0
[pid 25473] 10:12:35.790862 close(12 <unfinished ...>
[pid 25472] 10:12:35.790887 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:35.790926 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25472] 10:12:35.790958 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.790987 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25472] 10:12:35.791009 <... open resumed> ) = 12
[pid 25458] 10:12:35.791026 sendto(16, "\26{\1\0\0\1\0\0\0\0\0\0\26theviewsatsuperstition\3com\0\0\1\0\1", 44, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25472] 10:12:35.791088 fstat(12,  <unfinished ...>
[pid 25458] 10:12:35.791112 <... sendto resumed> ) = 44
[pid 25472] 10:12:35.791132 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:35.791164 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25472] 10:12:35.791194 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25472] 10:12:35.791238 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101083000
[pid 25472] 10:12:35.791275 lseek(12, 0, SEEK_SET) = 0
[pid 25472] 10:12:35.791308 read(12, "", 4096) = 0
[pid 25472] 10:12:35.791358 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25472] 10:12:35.791404 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.791453 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101082000
[pid 25472] 10:12:35.791491 read(13,  <unfinished ...>
[pid 25479] 10:12:35.791599 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25472] 10:12:35.791623 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25479] 10:12:35.791654 read(11,  <unfinished ...>
[pid 25472] 10:12:35.791678 close(13 <unfinished ...>
[pid 25479] 10:12:35.791707 <... read resumed> "\1", 1) = 1
[pid 25472] 10:12:35.791760 <... close resumed> ) = 0
[pid 25479] 10:12:35.791784 read(11,  <unfinished ...>
[pid 25472] 10:12:35.791809 munmap(0x7ff101082000, 4096 <unfinished ...>
[pid 25479] 10:12:35.791840 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25472] 10:12:35.791859 <... munmap resumed> ) = 0
[pid 25479] 10:12:35.791895 read(11,  <unfinished ...>
[pid 25472] 10:12:35.791976 stat("/etc/userdomains",  <unfinished ...>
[pid 25479] 10:12:35.792010 <... read resumed> "m\n\322\312*G\316\321~r9\337:\266\274\264a\306\5\3768\t\377\211F\36\3\265\342\212\v\237\222|\16@\6\24_\354\307P\345XL\344\240\271", 48) = 48
[pid 25472] 10:12:35.792069 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.792130 alarm(0 <unfinished ...>
[pid 25472] 10:12:35.792157 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25479] 10:12:35.792187 <... alarm resumed> ) = 300
[pid 25472] 10:12:35.792230 <... stat resumed> 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25479] 10:12:35.792260 write(11, "\27\3\1\0 \f\3131^=\234pa\351+\25'd\0252e\334\201y~\37\311?!r\234<\31<(\27\225\27\3\1\0@oq\370q\257\247\273\224E\32\200\352\325\314\342]~b\366\5 H\320S\372hz\1\241g\303j\33\"6QRP8\243\347\262\324\233R_\6\t\357&\314\340\n\20\35t\227\302\335\335POf\266", 106 <unfinished ...>
[pid 25472] 10:12:35.792314 stat("/etc/userdomains",  <unfinished ...>
[pid 25479] 10:12:35.792346 <... write resumed> ) = 106
[pid 25472] 10:12:35.792366 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25479] 10:12:35.792406 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25472] 10:12:35.792437 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25472] 10:12:35.792499 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.792618 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.792681 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffdc17df0c0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.792725 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.792778 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25472] 10:12:35.792911 getuid()    = 0
[pid 25472] 10:12:35.792951 geteuid()   = 0
[pid 25472] 10:12:35.792986 getgid()    = 12
[pid 25472] 10:12:35.793019 getegid()   = 12
[pid 25472] 10:12:35.793116 open("/dev/urandom", O_RDONLY) = 13
[pid 25472] 10:12:35.793165 read(13, "\323`\302\222", 4) = 4
[pid 25472] 10:12:35.793205 close(13)   = 0
[pid 25472] 10:12:35.793319 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25472] 10:12:35.793432 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc17dbf20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.793476 lseek(0, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.793577 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc17dbf20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.793621 lseek(1, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.793655 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc17dbf30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.793690 lseek(2, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.793726 open("/dev/null", O_RDONLY) = 13
[pid 25472] 10:12:35.793769 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc17dc000) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.793810 lseek(13, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.793846 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25472] 10:12:35.793881 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0}, 8) = 0
[pid 25472] 10:12:35.794153 brk(0x2783000) = 0x2783000
[pid 25472] 10:12:35.794208 read(13, "", 8192) = 0
[pid 25472] 10:12:35.794249 close(13)   = 0
[pid 25472] 10:12:35.794643 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25472] 10:12:35.794724 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25472] 10:12:35.794766 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc17dbe30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.794804 lseek(13, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.794859 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25472] 10:12:35.795771 brk(0x27a4000) = 0x27a4000
[pid 25472] 10:12:35.796155 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25480] 10:12:35.797031 <... select resumed> ) = 1 (in [11], left {299, 991896})
[pid 25472] 10:12:35.797076 brk(0x27c5000 <unfinished ...>
[pid 25480] 10:12:35.797104 read(11, "\27\3\1\0\260", 5) = 5
[pid 25480] 10:12:35.797147 read(11,  <unfinished ...>
[pid 25472] 10:12:35.797173 <... brk resumed> ) = 0x27c5000
[pid 25480] 10:12:35.797572 <... read resumed> "gF\210R\345a-\230\206\245\6w\3?\4\365\232\256dj\36r\342^V\302\352\27o\361Z&\242\231,;SPyZi\334\200\370\324\330Ja\234\360s(\224\245\23ur_\25\337\360|\217@8\346\333\363\223!\366\6_\222\1\205G\361@\301B\257\24T\313\213e\2\2}\354\244\256\271 \3;\346\224\20<\275Z\36\341\271\2326,\340p\232\372\226\333!\250\315\256z\245X\231;\34\210\362\26\214\252\314\2%/s\30y\n\363\237T\354A\216V\332f\2251\317\25\25\236\276m\n|\203\321z\7\263=\325\327\2\326rlr\307(\0174e\274", 176) = 176
[pid 25480] 10:12:35.797651 write(11, "\27\3\1\0 H\355\247\274\262\t!\351\263\353}\223\371\215B\3\262d\277\364\336~\233w0n\260J\326\376\331\274\27\3\1\0\220\33\tk\241\345\n)\232\346\334\343\220yL\5O\232V\343G\311\225g\272\371\335\212\244#5O\357\251\337\366\363\367z\270\1\332}\256\316s\260\344>\251\310\355\30I\21\224\242\"\321\216\202\4A;\377+o\316@=\376>\363\2\372\210\323\360\233\314+r\333\"\362\320\251\0#\3279\257\221T\257\250?\33\224\236\302\244\360\207\25\314\255j>V\307\337Xn\222oQ\354\27\212Dt\213u\201\341-\n\250\257h_\376\320\233H\257k\374\374\261\17\327\30\33", 186) = 186
[pid 25480] 10:12:35.797724 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25489] 10:12:35.798751 brk(0x1b5f000 <unfinished ...>
[pid 25488] 10:12:35.798781 brk(0x24e2000 <unfinished ...>
[pid 25473] 10:12:35.798805 <... close resumed> ) = 0
[pid 25472] 10:12:35.798822 read(13,  <unfinished ...>
[pid 25489] 10:12:35.799642 <... brk resumed> ) = 0x1b5f000
[pid 25488] 10:12:35.799663 <... brk resumed> ) = 0x24e2000
[pid 25473] 10:12:35.800071 read(11,  <unfinished ...>
[pid 25489] 10:12:35.800445 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25488] 10:12:35.800486 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25472] 10:12:35.800567 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25489] 10:12:35.800604 <... open resumed> ) = 7
[pid 25488] 10:12:35.801301 <... open resumed> ) = 7
[pid 25473] 10:12:35.801337 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25489] 10:12:35.801374 fstat(7,  <unfinished ...>
[pid 25488] 10:12:35.802210 fstat(7,  <unfinished ...>
[pid 25479] 10:12:35.802239 <... select resumed> ) = 1 (in [11], left {299, 991134})
[pid 25472] 10:12:35.802268 brk(0x27e6000 <unfinished ...>
[pid 25489] 10:12:35.802301 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25488] 10:12:35.802330 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25479] 10:12:35.802364 read(11,  <unfinished ...>
[pid 25473] 10:12:35.802395 read(11,  <unfinished ...>
[pid 25489] 10:12:35.802426 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25488] 10:12:35.802454 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25479] 10:12:35.802478 <... read resumed> "\27\3\1\0\260", 5) = 5
[pid 25472] 10:12:35.802498 <... brk resumed> ) = 0x27e6000
[pid 25489] 10:12:35.802574 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25488] 10:12:35.803065 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25479] 10:12:35.803100 read(11,  <unfinished ...>
[pid 25473] 10:12:35.803135 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25489] 10:12:35.803163 read(7,  <unfinished ...>
[pid 25488] 10:12:35.803600 read(7,  <unfinished ...>
[pid 25482] 10:12:35.803634 <... select resumed> ) = 1 (in [11], left {299, 963065})
[pid 25479] 10:12:35.803658 <... read resumed> "\345!\273lU\3576\356\266\333\33\254\255O\254\267D*\275K\4\264\346@\37Voo\305d\236\241\226\374V!|cv@\214\0069\322s6\17y\206;\2776!\26\10\332\256\323}\34\327\2729}\200\205\342\37\372\34\367`:\210\244\305]\376\20\371n\2619\t/\272x\251i\306k\252\341(uY\373\223\246\5\374D\377a\2310\341\323\242\233\316\216\245\262\3504MT\224<\372\221\352\254Yq\206\27\25t\241\25\371\302\227h2e\341\306\306\tz\330(T\246\327\2bF\1\36\215-C\21\23n\307P\314\343{\257F\254\226\1sSw\275\3018\211", 176) = 176
[pid 25472] 10:12:35.803720 read(13,  <unfinished ...>
[pid 25489] 10:12:35.803756 <... read resumed> "\201\275\363l\221\343/Sq\20\222\25\37\354J\0T\0\16G\352\30<\30a=\233\6p\232\320\0243\33\275\5x4\347L\275\265\267\0008\v\217\366", 48) = 48
[pid 25488] 10:12:35.803774 <... read resumed> "\7\335(=jSd\251\345kV%\n\356\250\10:\342I\373\33)\263N\0167\237\3766'\372\323`6\273\03325sE\217\245\374\334\"\352\270x", 48) = 48
[pid 25482] 10:12:35.803794 recvfrom(11,  <unfinished ...>
[pid 25479] 10:12:35.803829 write(11, "\27\3\1\0 \27\3618\365\212\300\324\302\\b\345s\3060\217\233\23\241\254a)v\210u])H\315\34[\264|\27\3\1\0\200\374\363\10R\211\26+\24\277u-\322n\v\2619\233\221R\25\374B\205f(\3\235\247\311|\323\33\233\345t9n\n\243\312\3It\251\3160\372\356\322\203\274\341#\250\317\3432.\24\316\251\321KZ\25.6\370\7\337\301\372\322\254$\17\375\2\200\355\326\214\251\271\275\262h4'\304\240\320\332K\3\357Hm|\375\253C\325\3728\2515r\321\201N\242G\377\231\341\326\230\257(\374^\344x6m\255\23", 170 <unfinished ...>
[pid 25489] 10:12:35.803894 close(7 <unfinished ...>
[pid 25488] 10:12:35.803919 close(7 <unfinished ...>
[pid 25482] 10:12:35.803948 <... recvfrom resumed> "220 2.0.0 SMTP server ready\r\n", 4096, 0, NULL, NULL) = 29
[pid 25479] 10:12:35.805930 <... write resumed> ) = 170
[pid 25472] 10:12:35.805966 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25489] 10:12:35.805997 <... close resumed> ) = 0
[pid 25488] 10:12:35.806287 <... close resumed> ) = 0
[pid 25482] 10:12:35.806331 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25480] 10:12:35.806386 <... select resumed> ) = 1 (in [11], left {299, 991821})
[pid 25479] 10:12:35.806410 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25489] 10:12:35.806567 getuid( <unfinished ...>
[pid 25488] 10:12:35.806602 getuid( <unfinished ...>
[pid 25482] 10:12:35.806625 <... open resumed> ) = 14
[pid 25480] 10:12:35.806646 read(11,  <unfinished ...>
[pid 25472] 10:12:35.806671 read(13,  <unfinished ...>
[pid 25489] 10:12:35.806701 <... getuid resumed> ) = 47
[pid 25488] 10:12:35.806714 <... getuid resumed> ) = 47
[pid 25482] 10:12:35.806875 fstat(14,  <unfinished ...>
[pid 25480] 10:12:35.807405 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25489] 10:12:35.807451 exit_group(0) = ?
[pid 25488] 10:12:35.807469 exit_group(0) = ?
[pid 25482] 10:12:35.807769 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25480] 10:12:35.808026 read(11,  <unfinished ...>
[pid 25473] 10:12:35.808057 read(11,  <unfinished ...>
[pid 25472] 10:12:35.808077 <... read resumed> "", 8192) = 0
[pid 25489] 10:12:35.808133 +++ exited with 0 +++
[pid 25488] 10:12:35.808146 +++ exited with 0 +++
[pid 25482] 10:12:35.808157 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25481] 10:12:35.808184 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25489
[pid 25480] 10:12:35.808205 <... read resumed> "\271\301<\374v<e\2544\223\242v\37n\227t}\361\2150\332\322\265.x{\227\210\34\25\26169\3451\31<\311\362\300k\270ZD\364.\336L", 48) = 48
[pid 25474] 10:12:35.808234 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25488
[pid 25472] 10:12:35.808256 close(13 <unfinished ...>
[pid 25482] 10:12:35.808288 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25481] 10:12:35.808310 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25480] 10:12:35.808341 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.808369 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25482] 10:12:35.808402 read(14,  <unfinished ...>
[pid 25481] 10:12:35.808429 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0}, 8) = 0
[pid 25474] 10:12:35.808475 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0}, 8) = 0
[pid 25472] 10:12:35.808584 <... close resumed> ) = 0
[pid 25482] 10:12:35.808611 <... read resumed> ")\0\214\2738\251Z\206\0002\375Ea\231\322nUr\204\200\272\347\256\3210>\257\3\335\213f\353c\361\0\202\3a\262\231\372\346ILx\16\26\257", 48) = 48
[pid 25481] 10:12:35.808658 getcwd( <unfinished ...>
[pid 25474] 10:12:35.808687 getcwd( <unfinished ...>
[pid 25482] 10:12:35.808717 close(14 <unfinished ...>
[pid 25481] 10:12:35.808740 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25474] 10:12:35.808796 <... getcwd resumed> "/home/finest09/public_html/includes", 16380) = 36
[pid 25472] 10:12:35.808867 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25482] 10:12:35.808926 <... close resumed> ) = 0
[pid 25481] 10:12:35.808970 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.809026 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.809080 getuid( <unfinished ...>
[pid 25481] 10:12:35.809118 <... open resumed> ) = 7
[pid 25474] 10:12:35.809147 <... open resumed> ) = 7
[pid 25472] 10:12:35.809175 <... stat resumed> 0x7ff0ff724880) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.809209 <... getuid resumed> ) = 47
[pid 25481] 10:12:35.814493 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.814567 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.814605 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25479] 10:12:35.814645 <... select resumed> ) = 1 (in [11], left {299, 993893})
[pid 25474] 10:12:35.814672 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:35.814702 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25472] 10:12:35.814721 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25481] 10:12:35.815365 fstat(7,  <unfinished ...>
[pid 25479] 10:12:35.815393 read(11,  <unfinished ...>
[pid 25474] 10:12:35.815419 fstat(7,  <unfinished ...>
[pid 25473] 10:12:35.815442 brk(0x100b000 <unfinished ...>
[pid 25481] 10:12:35.815472 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25479] 10:12:35.815504 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25474] 10:12:35.815531 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25472] 10:12:35.815562 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25481] 10:12:35.815593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:35.815624 read(11,  <unfinished ...>
[pid 25474] 10:12:35.815649 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.815680 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25479] 10:12:35.815697 <... read resumed> "\230\247\345K\4\344\312!\370\225\10\3435@zXO\342\225\204:^\7w0\375\24\344\352\247\364-\204\245\321\345t(A\365\221\250I\321\215e\345\350", 48) = 48
[pid 25474] 10:12:35.815729 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.815752 read(7,  <unfinished ...>
[pid 25479] 10:12:35.815782 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.815812 read(7,  <unfinished ...>
[pid 25481] 10:12:35.815845 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25474] 10:12:35.815883 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25481] 10:12:35.815914 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.815940 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.815966 <... lseek resumed> ) = 1279
[pid 25474] 10:12:35.815983 <... lseek resumed> ) = 1279
[pid 25481] 10:12:35.816003 read(7,  <unfinished ...>
[pid 25474] 10:12:35.816027 read(7,  <unfinished ...>
[pid 25481] 10:12:35.816053 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25474] 10:12:35.816086 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25481] 10:12:35.816166 close(7 <unfinished ...>
[pid 25474] 10:12:35.816211 close(7 <unfinished ...>
[pid 25481] 10:12:35.816240 <... close resumed> ) = 0
[pid 25474] 10:12:35.816257 <... close resumed> ) = 0
[pid 25481] 10:12:35.816276 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.816306 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.816336 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.816373 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.816412 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.816454 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.816487 <... open resumed> ) = 7
[pid 25474] 10:12:35.816506 <... open resumed> ) = 7
[pid 25481] 10:12:35.816533 fcntl(7, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.816560 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.816586 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.816608 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.816629 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.816654 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.816680 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.816696 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.816716 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.816739 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.816765 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373627, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.816803 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373627, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.816836 write(7, "2015-12-30 10:12:35 [25481] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMY-0006bs-1f\n", 108 <unfinished ...>
[pid 25474] 10:12:35.817079 write(7, "2015-12-30 10:12:35 [25474] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101 <unfinished ...>
[pid 25481] 10:12:35.817127 <... write resumed> ) = 108
[pid 25474] 10:12:35.817150 <... write resumed> ) = 101
[pid 25481] 10:12:35.817173 chdir("/var/spool/exim" <unfinished ...>
[pid 25474] 10:12:35.817206 chdir("/var/spool/exim" <unfinished ...>
[pid 25481] 10:12:35.817236 <... chdir resumed> ) = 0
[pid 25474] 10:12:35.817255 <... chdir resumed> ) = 0
[pid 25481] 10:12:35.817278 geteuid( <unfinished ...>
[pid 25474] 10:12:35.817303 geteuid( <unfinished ...>
[pid 25481] 10:12:35.817329 <... geteuid resumed> ) = 0
[pid 25474] 10:12:35.817345 <... geteuid resumed> ) = 0
[pid 25481] 10:12:35.817364 getegid( <unfinished ...>
[pid 25474] 10:12:35.817387 getegid( <unfinished ...>
[pid 25481] 10:12:35.817412 <... getegid resumed> ) = 12
[pid 25474] 10:12:35.817442 <... getegid resumed> ) = 499
[pid 25481] 10:12:35.817475 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.817509 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.818864 <... open resumed> ) = 8
[pid 25474] 10:12:35.818900 <... open resumed> ) = 8
[pid 25473] 10:12:35.818929 <... brk resumed> ) = 0x100b000
[pid 25472] 10:12:35.818952 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25481] 10:12:35.819084 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.819110 fstat(8,  <unfinished ...>
[pid 25473] 10:12:35.819132 read(11,  <unfinished ...>
[pid 25481] 10:12:35.819163 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.819195 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.819222 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25481] 10:12:35.819251 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.819286 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:35.819311 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25481] 10:12:35.819341 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.819629 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25472] 10:12:35.819665 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.819710 read(8,  <unfinished ...>
[pid 25474] 10:12:35.819750 read(8,  <unfinished ...>
[pid 25481] 10:12:35.819786 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.819817 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.819849 close(8 <unfinished ...>
[pid 25474] 10:12:35.819875 close(8 <unfinished ...>
[pid 25481] 10:12:35.819903 <... close resumed> ) = 0
[pid 25474] 10:12:35.819919 <... close resumed> ) = 0
[pid 25481] 10:12:35.819938 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.819967 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.819996 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.820017 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.820041 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.820076 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.820107 <... open resumed> ) = 8
[pid 25474] 10:12:35.820123 <... open resumed> ) = 8
[pid 25481] 10:12:35.820142 read(8,  <unfinished ...>
[pid 25474] 10:12:35.820166 read(8,  <unfinished ...>
[pid 25481] 10:12:35.820193 <... read resumed> "65536\n", 31) = 6
[pid 25474] 10:12:35.820211 <... read resumed> "65536\n", 31) = 6
[pid 25481] 10:12:35.820231 close(8 <unfinished ...>
[pid 25474] 10:12:35.820254 close(8 <unfinished ...>
[pid 25481] 10:12:35.820280 <... close resumed> ) = 0
[pid 25474] 10:12:35.820303 <... close resumed> ) = 0
[pid 25481] 10:12:35.820328 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.820359 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.820857 <... open resumed> ) = 8
[pid 25474] 10:12:35.820887 <... open resumed> ) = 8
[pid 25472] 10:12:35.820911 <... open resumed> ) = 13
[pid 25481] 10:12:35.820938 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.820963 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.820986 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.821016 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25474] 10:12:35.821048 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.821075 <... ioctl resumed> , 0x7ffdc17dbe30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.821100 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.821128 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.821153 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.821181 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.821198 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25472] 10:12:35.821214 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.821262 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.821290 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.821319 read(13,  <unfinished ...>
[pid 25481] 10:12:35.821350 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.821370 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.821389 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25481] 10:12:35.821793 read(8,  <unfinished ...>
[pid 25474] 10:12:35.821984 read(8,  <unfinished ...>
[pid 25472] 10:12:35.822022 brk(0x2807000 <unfinished ...>
[pid 25481] 10:12:35.822054 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25474] 10:12:35.822089 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:35.822120 read(11,  <unfinished ...>
[pid 25481] 10:12:35.822146 read(8,  <unfinished ...>
[pid 25474] 10:12:35.822170 read(8,  <unfinished ...>
[pid 25472] 10:12:35.822192 <... brk resumed> ) = 0x2807000
[pid 25481] 10:12:35.822210 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.822232 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.822255 close(8 <unfinished ...>
[pid 25474] 10:12:35.822282 close(8 <unfinished ...>
[pid 25481] 10:12:35.822309 <... close resumed> ) = 0
[pid 25474] 10:12:35.822325 <... close resumed> ) = 0
[pid 25481] 10:12:35.822345 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.822375 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.822404 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.822425 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.822450 setgroups(1, [12] <unfinished ...>
[pid 25474] 10:12:35.822480 setgroups(1, [12] <unfinished ...>
[pid 25481] 10:12:35.822509 <... setgroups resumed> ) = 0
[pid 25474] 10:12:35.822593 <... setgroups resumed> ) = 0
[pid 25481] 10:12:35.823575 setgid(12 <unfinished ...>
[pid 25474] 10:12:35.823613 setgid(12 <unfinished ...>
[pid 25473] 10:12:35.823637 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25472] 10:12:35.823656 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.824173 <... setgid resumed> ) = 0
[pid 25474] 10:12:35.824196 <... setgid resumed> ) = 0
[pid 25473] 10:12:35.824213 brk(0x102c000 <unfinished ...>
[pid 25481] 10:12:35.824240 setuid(47 <unfinished ...>
[pid 25474] 10:12:35.824265 setuid(47 <unfinished ...>
[pid 25472] 10:12:35.824287 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.824307 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.824360 <... setuid resumed> ) = 0
[pid 25481] 10:12:35.824410 read(6,  <unfinished ...>
[pid 25474] 10:12:35.824443 read(6,  <unfinished ...>
[pid 25481] 10:12:35.824473 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25474] 10:12:35.824607 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25481] 10:12:35.824720 read(6,  <unfinished ...>
[pid 25474] 10:12:35.824757 read(6,  <unfinished ...>
[pid 25481] 10:12:35.824790 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25474] 10:12:35.824863 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25481] 10:12:35.824938 read(6,  <unfinished ...>
[pid 25474] 10:12:35.824966 read(6,  <unfinished ...>
[pid 25472] 10:12:35.824989 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25481] 10:12:35.825021 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25474] 10:12:35.825079 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25472] 10:12:35.825137 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.825166 read(6,  <unfinished ...>
[pid 25474] 10:12:35.825191 read(6,  <unfinished ...>
[pid 25472] 10:12:35.825215 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.825250 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25474] 10:12:35.825311 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25472] 10:12:35.825372 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.825397 read(6,  <unfinished ...>
[pid 25474] 10:12:35.825422 read(6,  <unfinished ...>
[pid 25472] 10:12:35.825445 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25481] 10:12:35.825479 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25474] 10:12:35.825669 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25472] 10:12:35.825755 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.825791 read(6,  <unfinished ...>
[pid 25474] 10:12:35.825819 read(6,  <unfinished ...>
[pid 25472] 10:12:35.825843 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.825884 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25474] 10:12:35.825989 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25472] 10:12:35.826087 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.826116 read(6,  <unfinished ...>
[pid 25474] 10:12:35.826142 read(6,  <unfinished ...>
[pid 25472] 10:12:35.826165 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25481] 10:12:35.826202 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25474] 10:12:35.826255 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25472] 10:12:35.826308 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.826337 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.826375 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.826404 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.826440 <... open resumed> ) = 8
[pid 25474] 10:12:35.826461 <... open resumed> ) = 8
[pid 25473] 10:12:35.826478 <... brk resumed> ) = 0x102c000
[pid 25472] 10:12:35.826492 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.826845 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.826885 fstat(8,  <unfinished ...>
[pid 25472] 10:12:35.826910 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25481] 10:12:35.826946 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.826978 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.827007 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.827033 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.827063 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.827087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.827125 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.827142 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25472] 10:12:35.827158 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.827180 read(8,  <unfinished ...>
[pid 25474] 10:12:35.827208 read(8,  <unfinished ...>
[pid 25472] 10:12:35.827234 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25481] 10:12:35.827269 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.827303 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.827331 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.827357 close(8 <unfinished ...>
[pid 25474] 10:12:35.827384 close(8 <unfinished ...>
[pid 25472] 10:12:35.827407 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25481] 10:12:35.827442 <... close resumed> ) = 0
[pid 25474] 10:12:35.827460 <... close resumed> ) = 0
[pid 25472] 10:12:35.827606 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.827638 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.827669 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25472] 10:12:35.828393 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25482] 10:12:35.828433 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.828457 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.828645 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.828735 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25481] 10:12:35.828780 read(6,  <unfinished ...>
[pid 25474] 10:12:35.828807 read(6,  <unfinished ...>
[pid 25472] 10:12:35.828830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.829070 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25474] 10:12:35.829165 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25472] 10:12:35.829251 <... open resumed> ) = 14
[pid 25481] 10:12:35.829282 read(6,  <unfinished ...>
[pid 25474] 10:12:35.829309 read(6,  <unfinished ...>
[pid 25473] 10:12:35.829332 read(11,  <unfinished ...>
[pid 25472] 10:12:35.829352 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.829386 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25474] 10:12:35.829491 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25472] 10:12:35.829668 <... ioctl resumed> , 0x7ffdc17db840) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.829703 read(6,  <unfinished ...>
[pid 25474] 10:12:35.829730 read(6,  <unfinished ...>
[pid 25472] 10:12:35.829753 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.829782 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25474] 10:12:35.829898 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25472] 10:12:35.830009 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.830065 read(6,  <unfinished ...>
[pid 25474] 10:12:35.830094 read(6,  <unfinished ...>
[pid 25472] 10:12:35.830118 read(14,  <unfinished ...>
[pid 25481] 10:12:35.830148 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25474] 10:12:35.830249 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25472] 10:12:35.830351 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25481] 10:12:35.830755 read(6,  <unfinished ...>
[pid 25474] 10:12:35.830799 read(6,  <unfinished ...>
[pid 25472] 10:12:35.830823 read(14,  <unfinished ...>
[pid 25481] 10:12:35.830855 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25474] 10:12:35.830901 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25473] 10:12:35.830960 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25472] 10:12:35.830990 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25481] 10:12:35.832218 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.832269 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.832298 read(11,  <unfinished ...>
[pid 25472] 10:12:35.832319 brk(0x2828000 <unfinished ...>
[pid 25481] 10:12:35.832345 <... open resumed> ) = 8
[pid 25474] 10:12:35.832363 <... open resumed> ) = 8
[pid 25481] 10:12:35.832385 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.832409 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.832435 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.832475 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25481] 10:12:35.832508 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.832596 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.832630 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.832648 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25472] 10:12:35.832664 <... brk resumed> ) = 0x2828000
[pid 25481] 10:12:35.832681 read(8,  <unfinished ...>
[pid 25474] 10:12:35.832710 read(8,  <unfinished ...>
[pid 25481] 10:12:35.832739 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.832772 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25481] 10:12:35.832807 close(8 <unfinished ...>
[pid 25474] 10:12:35.832833 close(8 <unfinished ...>
[pid 25481] 10:12:35.833024 <... close resumed> ) = 0
[pid 25474] 10:12:35.833064 <... close resumed> ) = 0
[pid 25481] 10:12:35.833087 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.833117 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25481] 10:12:35.833146 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.833175 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.833208 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.833243 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.833274 <... open resumed> ) = 8
[pid 25474] 10:12:35.833291 <... open resumed> ) = 8
[pid 25481] 10:12:35.833312 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.833338 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.833364 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25474] 10:12:35.833394 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25481] 10:12:35.833425 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.833453 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.833481 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.833498 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.833518 read(8,  <unfinished ...>
[pid 25474] 10:12:35.833694 read(8,  <unfinished ...>
[pid 25482] 10:12:35.833729 <... open resumed> ) = 14
[pid 25481] 10:12:35.833743 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25474] 10:12:35.833795 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25472] 10:12:35.833835 read(14,  <unfinished ...>
[pid 25482] 10:12:35.833867 fstat(14,  <unfinished ...>
[pid 25481] 10:12:35.833891 close(8 <unfinished ...>
[pid 25474] 10:12:35.833917 close(8 <unfinished ...>
[pid 25472] 10:12:35.833941 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25482] 10:12:35.834335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.834384 <... close resumed> ) = 0
[pid 25474] 10:12:35.834405 <... close resumed> ) = 0
[pid 25472] 10:12:35.834422 read(14,  <unfinished ...>
[pid 25482] 10:12:35.834451 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.834478 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.834516 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25473] 10:12:35.834639 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25482] 10:12:35.834668 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25481] 10:12:35.835041 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.835103 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.835152 <... read resumed> "", 8192) = 0
[pid 25482] 10:12:35.835179 read(14,  <unfinished ...>
[pid 25481] 10:12:35.835213 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.835245 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.835272 brk(0x104d000 <unfinished ...>
[pid 25482] 10:12:35.835300 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25481] 10:12:35.835318 <... open resumed> ) = 8
[pid 25474] 10:12:35.835351 <... open resumed> ) = 8
[pid 25472] 10:12:35.835369 close(14 <unfinished ...>
[pid 25482] 10:12:35.835399 read(14,  <unfinished ...>
[pid 25481] 10:12:35.835422 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.835446 fstat(8,  <unfinished ...>
[pid 25482] 10:12:35.835476 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25481] 10:12:35.835494 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25474] 10:12:35.835695 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.835733 <... close resumed> ) = 0
[pid 25482] 10:12:35.835753 read(14,  <unfinished ...>
[pid 25481] 10:12:35.836593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.836633 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.836675 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25481] 10:12:35.836696 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.836728 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25472] 10:12:35.836745 read(13,  <unfinished ...>
[pid 25482] 10:12:35.836776 read(14,  <unfinished ...>
[pid 25481] 10:12:35.836800 read(8,  <unfinished ...>
[pid 25474] 10:12:35.836827 read(8,  <unfinished ...>
[pid 25482] 10:12:35.836859 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25481] 10:12:35.836878 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25474] 10:12:35.836982 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25472] 10:12:35.837043 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25482] 10:12:35.837083 read(14,  <unfinished ...>
[pid 25481] 10:12:35.837956 close(8 <unfinished ...>
[pid 25474] 10:12:35.837990 close(8 <unfinished ...>
[pid 25473] 10:12:35.838015 <... brk resumed> ) = 0x104d000
[pid 25482] 10:12:35.838037 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25481] 10:12:35.838309 <... close resumed> ) = 0
[pid 25474] 10:12:35.838367 <... close resumed> ) = 0
[pid 25472] 10:12:35.838398 read(13,  <unfinished ...>
[pid 25482] 10:12:35.838447 read(14,  <unfinished ...>
[pid 25481] 10:12:35.838475 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.838504 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25482] 10:12:35.838594 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25481] 10:12:35.838616 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.838781 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.838877 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25482] 10:12:35.838907 read(14,  <unfinished ...>
[pid 25481] 10:12:35.839693 read(6,  <unfinished ...>
[pid 25474] 10:12:35.839725 read(6,  <unfinished ...>
[pid 25482] 10:12:35.839757 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25481] 10:12:35.839789 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25474] 10:12:35.840009 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25472] 10:12:35.840233 read(13,  <unfinished ...>
[pid 25482] 10:12:35.840277 read(14,  <unfinished ...>
[pid 25481] 10:12:35.840302 read(6,  <unfinished ...>
[pid 25474] 10:12:35.840327 read(6,  <unfinished ...>
[pid 25473] 10:12:35.840350 read(11,  <unfinished ...>
[pid 25482] 10:12:35.840379 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25481] 10:12:35.840399 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25474] 10:12:35.840637 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25472] 10:12:35.840738 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25482] 10:12:35.840767 read(14,  <unfinished ...>
[pid 25481] 10:12:35.841352 read(6,  <unfinished ...>
[pid 25474] 10:12:35.841381 read(6,  <unfinished ...>
[pid 25482] 10:12:35.841413 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25481] 10:12:35.841433 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.841466 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:35.841485 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25472] 10:12:35.841503 brk(0x2849000 <unfinished ...>
[pid 25482] 10:12:35.842234 read(14,  <unfinished ...>
[pid 25481] 10:12:35.842265 read(6,  <unfinished ...>
[pid 25474] 10:12:35.842290 read(6,  <unfinished ...>
[pid 25473] 10:12:35.842316 read(11,  <unfinished ...>
[pid 25482] 10:12:35.842344 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25481] 10:12:35.842365 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.842507 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.842636 <... brk resumed> ) = 0x2849000
[pid 25482] 10:12:35.842679 read(14,  <unfinished ...>
[pid 25481] 10:12:35.842791 close(6 <unfinished ...>
[pid 25474] 10:12:35.842832 close(6 <unfinished ...>
[pid 25482] 10:12:35.842879 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25481] 10:12:35.842911 <... close resumed> ) = 0
[pid 25474] 10:12:35.843030 <... close resumed> ) = 0
[pid 25472] 10:12:35.843068 read(13,  <unfinished ...>
[pid 25482] 10:12:35.843121 read(14,  <unfinished ...>
[pid 25481] 10:12:35.843161 munmap(0x7f04ce1d4000, 4096 <unfinished ...>
[pid 25474] 10:12:35.843205 munmap(0x7f84e3f51000, 4096 <unfinished ...>
[pid 25482] 10:12:35.843240 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25481] 10:12:35.843259 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.843347 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.843373 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25482] 10:12:35.843399 read(14,  <unfinished ...>
[pid 25481] 10:12:35.844111 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.844151 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.844187 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25481] 10:12:35.844206 <... open resumed> ) = 6
[pid 25474] 10:12:35.844282 <... open resumed> ) = 6
[pid 25472] 10:12:35.844303 read(13,  <unfinished ...>
[pid 25482] 10:12:35.844334 read(14,  <unfinished ...>
[pid 25481] 10:12:35.844358 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.844382 fstat(6,  <unfinished ...>
[pid 25482] 10:12:35.844411 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25481] 10:12:35.844429 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.844511 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.844621 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25482] 10:12:35.844647 read(14,  <unfinished ...>
[pid 25481] 10:12:35.845155 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.845191 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.845225 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25481] 10:12:35.845251 <... mmap resumed> ) = 0x7f04ce1d4000
[pid 25474] 10:12:35.845282 <... mmap resumed> ) = 0x7f84e3f51000
[pid 25472] 10:12:35.845300 brk(0x286a000 <unfinished ...>
[pid 25482] 10:12:35.845330 read(14,  <unfinished ...>
[pid 25481] 10:12:35.845354 read(6,  <unfinished ...>
[pid 25474] 10:12:35.845381 read(6,  <unfinished ...>
[pid 25482] 10:12:35.845413 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25481] 10:12:35.845431 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.845628 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.845675 <... brk resumed> ) = 0x286a000
[pid 25482] 10:12:35.845701 read(14,  <unfinished ...>
[pid 25481] 10:12:35.846171 close(6 <unfinished ...>
[pid 25474] 10:12:35.846202 close(6 <unfinished ...>
[pid 25482] 10:12:35.846234 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25481] 10:12:35.846254 <... close resumed> ) = 0
[pid 25474] 10:12:35.846328 <... close resumed> ) = 0
[pid 25472] 10:12:35.846349 read(13,  <unfinished ...>
[pid 25482] 10:12:35.846380 read(14,  <unfinished ...>
[pid 25481] 10:12:35.846404 munmap(0x7f04ce1d4000, 4096 <unfinished ...>
[pid 25474] 10:12:35.846440 munmap(0x7f84e3f51000, 4096 <unfinished ...>
[pid 25482] 10:12:35.846473 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25481] 10:12:35.846492 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.846606 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.846651 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25472] 10:12:35.846838 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25482] 10:12:35.847117 read(14,  <unfinished ...>
[pid 25481] 10:12:35.847744 fstat(1,  <unfinished ...>
[pid 25474] 10:12:35.847781 fstat(1,  <unfinished ...>
[pid 25473] 10:12:35.847806 brk(0x106e000 <unfinished ...>
[pid 25482] 10:12:35.847834 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25481] 10:12:35.847861 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25474] 10:12:35.847969 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25472] 10:12:35.848020 read(13,  <unfinished ...>
[pid 25482] 10:12:35.848054 read(14,  <unfinished ...>
[pid 25481] 10:12:35.848079 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.848109 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f84e2e07790},  <unfinished ...>
[pid 25482] 10:12:35.848141 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25481] 10:12:35.848159 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.848250 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25472] 10:12:35.848282 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25482] 10:12:35.848850 read(14,  <unfinished ...>
[pid 25481] 10:12:35.848889 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.848921 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25472] 10:12:35.848952 brk(0x288b000 <unfinished ...>
[pid 25482] 10:12:35.848980 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25481] 10:12:35.849001 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25474] 10:12:35.849083 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:35.849105 <... brk resumed> ) = 0x106e000
[pid 25482] 10:12:35.849126 read(14,  <unfinished ...>
[pid 25481] 10:12:35.849603 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.849639 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25472] 10:12:35.849667 <... brk resumed> ) = 0x288b000
[pid 25482] 10:12:35.849687 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25481] 10:12:35.849987 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25474] 10:12:35.850079 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25482] 10:12:35.850114 read(14,  <unfinished ...>
[pid 25481] 10:12:35.850142 fstat(0,  <unfinished ...>
[pid 25474] 10:12:35.850166 fstat(0,  <unfinished ...>
[pid 25472] 10:12:35.850189 read(13,  <unfinished ...>
[pid 25482] 10:12:35.850214 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25481] 10:12:35.850241 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167601, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.850273 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167520, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.850304 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.850335 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.850365 <... mmap resumed> ) = 0x7f04ce1d4000
[pid 25474] 10:12:35.850382 <... mmap resumed> ) = 0x7f84e3f51000
[pid 25481] 10:12:35.850402 read(0,  <unfinished ...>
[pid 25474] 10:12:35.850429 read(0,  <unfinished ...>
[pid 25481] 10:12:35.850459 <... read resumed> "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3508
[pid 25474] 10:12:35.850604 <... read resumed> "To:  VHuerta@ncghotels.com, aepperson@ncghotels.com, SCarroll@ncghotels.com, courtyardavondale@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFro"..., 4096) = 2139
[pid 25481] 10:12:35.850703 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.850737 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.850767 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.850820 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.850870 open("/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25474] 10:12:35.850952 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25481] 10:12:35.851007 <... open resumed> ) = 6
[pid 25474] 10:12:35.851030 <... open resumed> ) = 6
[pid 25481] 10:12:35.851053 fchown(6, 47, 12 <unfinished ...>
[pid 25474] 10:12:35.851084 fchown(6, 47, 12 <unfinished ...>
[pid 25481] 10:12:35.851113 <... fchown resumed> ) = 0
[pid 25474] 10:12:35.851132 <... fchown resumed> ) = 0
[pid 25481] 10:12:35.851153 fchmod(6, 0640 <unfinished ...>
[pid 25474] 10:12:35.851180 fchmod(6, 0640 <unfinished ...>
[pid 25481] 10:12:35.851208 <... fchmod resumed> ) = 0
[pid 25474] 10:12:35.851227 <... fchmod resumed> ) = 0
[pid 25481] 10:12:35.851249 fcntl(6, F_GETFL <unfinished ...>
[pid 25474] 10:12:35.851274 fcntl(6, F_GETFL <unfinished ...>
[pid 25481] 10:12:35.851299 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25474] 10:12:35.851318 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25481] 10:12:35.851340 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.851364 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.851390 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.851419 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.851457 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.851487 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.851515 <... mmap resumed> ) = 0x7f04ce1d3000
[pid 25474] 10:12:35.851624 <... mmap resumed> ) = 0x7f84e3f50000
[pid 25481] 10:12:35.851649 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.851674 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.851700 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.851717 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.851736 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25474] 10:12:35.851766 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25481] 10:12:35.851800 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.851900 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.851973 read(0,  <unfinished ...>
[pid 25474] 10:12:35.851998 read(0,  <unfinished ...>
[pid 25481] 10:12:35.852024 <... read resumed> "", 4096) = 0
[pid 25474] 10:12:35.852041 <... read resumed> "", 4096) = 0
[pid 25481] 10:12:35.852062 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.852090 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.852120 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.852137 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.852157 write(6, "1aEJMZ-0006cz-RM-D\n--1451491955-eximdsn-823055473\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a perm"..., 3154 <unfinished ...>
[pid 25474] 10:12:35.852195 write(6, "1aEJMZ-0006cs-RM-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877 <unfinished ...>
[pid 25481] 10:12:35.852232 <... write resumed> ) = 3154
[pid 25474] 10:12:35.852251 <... write resumed> ) = 1877
[pid 25481] 10:12:35.852272 fsync(6 <unfinished ...>
[pid 25474] 10:12:35.852349 fsync(6 <unfinished ...>
[pid 25482] 10:12:35.852837 read(14,  <unfinished ...>
[pid 25481] 10:12:35.852866 <... fsync resumed> ) = 0
[pid 25474] 10:12:35.852905 <... fsync resumed> ) = 0
[pid 25473] 10:12:35.852936 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25472] 10:12:35.852969 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25482] 10:12:35.852994 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25481] 10:12:35.853583 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.853694 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:35.853722 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.853745 read(14,  <unfinished ...>
[pid 25481] 10:12:35.853773 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.853858 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.853942 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25481] 10:12:35.853966 fstat(6,  <unfinished ...>
[pid 25480] 10:12:35.854046 <... select resumed> ) = 1 (in [11], left {299, 954572})
[pid 25474] 10:12:35.854219 fstat(6,  <unfinished ...>
[pid 25473] 10:12:35.854251 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.854288 read(14,  <unfinished ...>
[pid 25481] 10:12:35.854311 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25480] 10:12:35.854443 read(11,  <unfinished ...>
[pid 25474] 10:12:35.854476 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.854652 read(13,  <unfinished ...>
[pid 25482] 10:12:35.854696 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25481] 10:12:35.854716 brk(0x1b5f000 <unfinished ...>
[pid 25480] 10:12:35.854756 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25474] 10:12:35.854780 brk(0x24e2000 <unfinished ...>
[pid 25473] 10:12:35.854806 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.854828 read(14,  <unfinished ...>
[pid 25481] 10:12:35.854859 <... brk resumed> ) = 0x1b5f000
[pid 25480] 10:12:35.854903 read(11,  <unfinished ...>
[pid 25474] 10:12:35.854935 <... brk resumed> ) = 0x24e2000
[pid 25482] 10:12:35.854983 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25481] 10:12:35.855004 getuid( <unfinished ...>
[pid 25480] 10:12:35.855088 <... read resumed> "\207\306\344h\206\322\221\0037\2\336|\f\336\200\0210\364\241\322e\36j\342\16\345yW\327%W\312\3103g\251\344\231\232\235\264KtJ\33\303\223\243", 48) = 48
[pid 25474] 10:12:35.855122 getuid( <unfinished ...>
[pid 25473] 10:12:35.855146 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25472] 10:12:35.855172 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25482] 10:12:35.855197 read(14,  <unfinished ...>
[pid 25481] 10:12:35.855483 <... getuid resumed> ) = 47
[pid 25480] 10:12:35.855507 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.855621 <... getuid resumed> ) = 47
[pid 25473] 10:12:35.855645 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.855670 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25481] 10:12:35.855703 geteuid( <unfinished ...>
[pid 25480] 10:12:35.855796 <... select resumed> ) = 1 (in [11], left {299, 999998})
[pid 25474] 10:12:35.855822 geteuid( <unfinished ...>
[pid 25472] 10:12:35.855845 brk(0x28ac000 <unfinished ...>
[pid 25482] 10:12:35.855874 read(14,  <unfinished ...>
[pid 25481] 10:12:35.855899 <... geteuid resumed> ) = 47
[pid 25480] 10:12:35.855918 read(11,  <unfinished ...>
[pid 25474] 10:12:35.855943 <... geteuid resumed> ) = 47
[pid 25473] 10:12:35.855961 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.855993 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25481] 10:12:35.856011 getgid( <unfinished ...>
[pid 25480] 10:12:35.856045 <... read resumed> "\27\3\1\0@", 5) = 5
[pid 25474] 10:12:35.856063 getgid( <unfinished ...>
[pid 25482] 10:12:35.856093 read(14,  <unfinished ...>
[pid 25481] 10:12:35.856116 <... getgid resumed> ) = 12
[pid 25480] 10:12:35.856134 read(11,  <unfinished ...>
[pid 25474] 10:12:35.856158 <... getgid resumed> ) = 12
[pid 25473] 10:12:35.856176 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.856197 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25481] 10:12:35.856234 getegid( <unfinished ...>
[pid 25480] 10:12:35.856354 <... read resumed> "\336.\17\0\212\7\360\35\36\262b\260f\227.!g\301\344w\275\367s\357\312X\313\263\310\310\nO\230\250iSXX\310\333\30TB(\23%\364\220\233\365\234\267'k\310\341\37\27\17\243\267\362\250-", 64) = 64
[pid 25474] 10:12:35.856404 getegid( <unfinished ...>
[pid 25482] 10:12:35.856440 read(14,  <unfinished ...>
[pid 25481] 10:12:35.856468 <... getegid resumed> ) = 12
[pid 25480] 10:12:35.856636 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.856676 <... getegid resumed> ) = 12
[pid 25473] 10:12:35.856753 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25472] 10:12:35.856788 <... brk resumed> ) = 0x28ac000
[pid 25482] 10:12:35.856811 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25481] 10:12:35.857347 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25480] 10:12:35.857462 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.857482 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.857639 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.857684 read(14,  <unfinished ...>
[pid 25481] 10:12:35.857728 <... open resumed> ) = 8
[pid 25480] 10:12:35.857756 read(6,  <unfinished ...>
[pid 25474] 10:12:35.857804 <... open resumed> ) = 8
[pid 25472] 10:12:35.857834 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25482] 10:12:35.857883 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25481] 10:12:35.857913 read(8,  <unfinished ...>
[pid 25480] 10:12:35.857969 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25474] 10:12:35.858023 read(8,  <unfinished ...>
[pid 25473] 10:12:35.858065 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.858117 read(14,  <unfinished ...>
[pid 25481] 10:12:35.858156 <... read resumed> "^\313H\227", 4) = 4
[pid 25480] 10:12:35.858189 read(6,  <unfinished ...>
[pid 25474] 10:12:35.858226 <... read resumed> "\7\306\351\3", 4) = 4
[pid 25482] 10:12:35.858270 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25481] 10:12:35.858301 close(8 <unfinished ...>
[pid 25480] 10:12:35.858443 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.858476 close(8 <unfinished ...>
[pid 25473] 10:12:35.858514 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.858642 read(14,  <unfinished ...>
[pid 25481] 10:12:35.858696 <... close resumed> ) = 0
[pid 25480] 10:12:35.858843 alarm(300 <unfinished ...>
[pid 25474] 10:12:35.858890 <... close resumed> ) = 0
[pid 25482] 10:12:35.859023 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25481] 10:12:35.859061 readlink("/proc/self/exe",  <unfinished ...>
[pid 25480] 10:12:35.859457 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.859589 readlink("/proc/self/exe",  <unfinished ...>
[pid 25473] 10:12:35.859660 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25482] 10:12:35.859735 read(14,  <unfinished ...>
[pid 25481] 10:12:35.859839 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25480] 10:12:35.859946 write(11, "\27\3\1\0 \0{\217\324x\344+0\316\34*\351\201\261y\317\275\303\n|\213;w\6b\325V\30\343\237s\374\27\3\1\fp\7L\350l\"Y\33\33\322g\316\253\20L?\265jQp\307kp\201\331\326\235\213X\203\226\236\2512N\3074\254\244\352\2528N\2709g|\357\343fgil`\237+mc\236\237{\225\300\310)\4\361_\276\350\353]5\351\177\317\315_\226\230\212\240\315\244M\214\340E?\233\224\212\321\350er\250\344lNJ\272\305\311\304#\370\262/\17\\\337\v\357\37\270\230\335z\373T\225\224R\201\336\237\304j#\37?\245f\273/\254\f\36a>*\374\"\200AG\345dS\253|:\275\252\375\316\264Ni\232N9\352\263\35\314\37\200\345\201\352\10\246\275\37e\350\366\314,7\245q\356\363\357\3317\330.\310\247\306\35|\5\2S\332\3406\374/\341\305\\\210\237\304\2\1\355\323\243"..., 3226 <unfinished ...>
[pid 25474] 10:12:35.860056 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25482] 10:12:35.860160 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25481] 10:12:35.860197 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25480] 10:12:35.860364 <... write resumed> ) = 3226
[pid 25474] 10:12:35.860395 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.860434 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.860458 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.860499 read(14,  <unfinished ...>
[pid 25481] 10:12:35.860629 <... ioctl resumed> , 0x7ffeeb1786a0) = -1 EINVAL (Invalid argument)
[pid 25480] 10:12:35.860667 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.860706 <... ioctl resumed> , 0x7fff65a1c320) = -1 EINVAL (Invalid argument)
[pid 25473] 10:12:35.860738 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.860815 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25481] 10:12:35.860848 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25480] 10:12:35.860994 <... alarm resumed> ) = 300
[pid 25474] 10:12:35.861027 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.861066 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.861123 read(14,  <unfinished ...>
[pid 25481] 10:12:35.861160 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25480] 10:12:35.861195 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25474] 10:12:35.861245 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25473] 10:12:35.861279 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.861314 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25481] 10:12:35.861354 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.861411 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.861449 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.861484 read(14,  <unfinished ...>
[pid 25481] 10:12:35.861626 <... ioctl resumed> , 0x7ffeeb1786a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.861661 <... ioctl resumed> , 0x7fff65a1c320) = -1 EINVAL (Invalid argument)
[pid 25473] 10:12:35.861692 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25482] 10:12:35.861749 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25481] 10:12:35.861780 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.861944 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.861982 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25482] 10:12:35.862035 read(14,  <unfinished ...>
[pid 25481] 10:12:35.862072 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.862104 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25473] 10:12:35.862137 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.862173 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25481] 10:12:35.862207 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.862368 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.862411 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.862456 read(14,  <unfinished ...>
[pid 25481] 10:12:35.862507 <... ioctl resumed> , 0x7ffeeb1786b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.862629 <... ioctl resumed> , 0x7fff65a1c330) = -1 EINVAL (Invalid argument)
[pid 25473] 10:12:35.862661 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.862723 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25481] 10:12:35.862765 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25479] 10:12:35.862925 <... select resumed> ) = 1 (in [11], left {299, 953334})
[pid 25474] 10:12:35.862966 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.863004 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25482] 10:12:35.863057 read(14,  <unfinished ...>
[pid 25481] 10:12:35.863093 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.863128 read(11,  <unfinished ...>
[pid 25474] 10:12:35.863167 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25473] 10:12:35.863201 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.863239 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25481] 10:12:35.863279 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.863350 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25474] 10:12:35.863383 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.863428 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.863476 read(14,  <unfinished ...>
[pid 25481] 10:12:35.863628 <... open resumed> ) = 8
[pid 25479] 10:12:35.863673 read(11,  <unfinished ...>
[pid 25474] 10:12:35.863715 <... open resumed> ) = 8
[pid 25473] 10:12:35.863744 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.863800 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25482] 10:12:35.863852 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25481] 10:12:35.863883 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25479] 10:12:35.864025 <... read resumed> "Q\355\25P&\300\225@\3419\264\177\226\316'oJ\1\250_\210\231\311\207T(\3774\325Ud|\210\n\241\233\350!\301[\241o:#\320\17\346\375", 48) = 48
[pid 25474] 10:12:35.864071 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.864112 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.864135 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.864180 recvfrom(16,  <unfinished ...>
[pid 25482] 10:12:35.864239 read(14,  <unfinished ...>
[pid 25481] 10:12:35.864283 <... ioctl resumed> , 0x7ffeeb178780) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25479] 10:12:35.864315 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25474] 10:12:35.864363 <... ioctl resumed> , 0x7fff65a1c400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.864391 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25472] 10:12:35.864437 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.864464 <... recvfrom resumed> "\26{\201\200\0\1\0\1\0\0\0\0\26theviewsatsuperstition\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\4\260\0\4\242\325\373\252", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 60
[pid 25482] 10:12:35.864632 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25481] 10:12:35.864784 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25479] 10:12:35.864839 <... select resumed> ) = 1 (in [11], left {299, 999998})
[pid 25474] 10:12:35.864875 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.864913 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.864937 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.864987 close(16 <unfinished ...>
[pid 25482] 10:12:35.865049 read(14,  <unfinished ...>
[pid 25481] 10:12:35.865088 <... lseek resumed> ) = 0
[pid 25479] 10:12:35.865118 read(11,  <unfinished ...>
[pid 25474] 10:12:35.865157 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.865187 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25472] 10:12:35.865232 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.865258 <... close resumed> ) = 0
[pid 25482] 10:12:35.865343 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25481] 10:12:35.865378 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25479] 10:12:35.865612 <... read resumed> "\27\3\1\0@", 5) = 5
[pid 25474] 10:12:35.865653 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:35.865697 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.865724 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.865776 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25482] 10:12:35.865840 read(14,  <unfinished ...>
[pid 25481] 10:12:35.865878 <... fcntl resumed> ) = 0
[pid 25479] 10:12:35.865909 read(11,  <unfinished ...>
[pid 25474] 10:12:35.865950 <... fcntl resumed> ) = 0
[pid 25473] 10:12:35.865979 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25472] 10:12:35.866026 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.866052 <... socket resumed> ) = 16
[pid 25482] 10:12:35.866100 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25481] 10:12:35.866130 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25479] 10:12:35.866257 <... read resumed> "9\3126I\6\375\313\235V\34#\345V\252\325A\370 H/B\21\311\315.\332\365\366\265.\355\246$N\337\306\363q\253\347\300\27\365\3277\35313\223\201\366\360\36?\273%>\356\34\270>\6\301\216", 64) = 64
[pid 25474] 10:12:35.866322 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25473] 10:12:35.866367 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.866412 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.866463 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25482] 10:12:35.866929 read(14,  <unfinished ...>
[pid 25481] 10:12:35.866981 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f04cd08a790}, 8) = 0
[pid 25479] 10:12:35.867026 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.867067 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f84e2e07790}, 8) = 0
[pid 25473] 10:12:35.867105 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.867157 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.867191 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25482] 10:12:35.867255 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25481] 10:12:35.867288 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25479] 10:12:35.867442 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.867471 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25473] 10:12:35.867518 <... open resumed> ) = 12
[pid 25472] 10:12:35.867634 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.867696 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25482] 10:12:35.867756 read(14,  <unfinished ...>
[pid 25481] 10:12:35.867795 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f04cd08a790}, 8) = 0
[pid 25479] 10:12:35.868212 read(6,  <unfinished ...>
[pid 25474] 10:12:35.868271 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f84e2e07790}, 8) = 0
[pid 25473] 10:12:35.868738 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.868795 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.868822 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25482] 10:12:35.868885 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25481] 10:12:35.868920 read(8,  <unfinished ...>
[pid 25479] 10:12:35.868975 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25474] 10:12:35.869020 read(8,  <unfinished ...>
[pid 25473] 10:12:35.869057 <... ioctl resumed> , 0x7ffdac3356f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.869080 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.869131 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25482] 10:12:35.869187 read(14,  <unfinished ...>
[pid 25481] 10:12:35.869225 <... read resumed> "", 8192) = 0
[pid 25479] 10:12:35.869366 read(6,  <unfinished ...>
[pid 25474] 10:12:35.869407 <... read resumed> "", 8192) = 0
[pid 25473] 10:12:35.869440 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.869477 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.869503 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25482] 10:12:35.869665 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25481] 10:12:35.869703 close(8 <unfinished ...>
[pid 25479] 10:12:35.869768 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.869797 close(8 <unfinished ...>
[pid 25473] 10:12:35.869833 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.869855 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.869951 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25482] 10:12:35.870010 read(14,  <unfinished ...>
[pid 25481] 10:12:35.870048 <... close resumed> ) = 0
[pid 25479] 10:12:35.870339 alarm(300 <unfinished ...>
[pid 25474] 10:12:35.870391 <... close resumed> ) = 0
[pid 25473] 10:12:35.870740 read(12,  <unfinished ...>
[pid 25472] 10:12:35.870793 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.870820 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25482] 10:12:35.870879 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25481] 10:12:35.870912 brk(0x1b80000 <unfinished ...>
[pid 25479] 10:12:35.871093 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.871156 brk(0x2503000 <unfinished ...>
[pid 25473] 10:12:35.871199 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25472] 10:12:35.871230 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.871699 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25482] 10:12:35.871763 read(14,  <unfinished ...>
[pid 25481] 10:12:35.871804 <... brk resumed> ) = 0x1b80000
[pid 25479] 10:12:35.871977 write(11, "\27\3\1\0 \244{\330\307!6W\313B\302\23\307K?\7\32'~xcc\327\30W\7\340\10BP\351\3129\27\3\1\fpK\257\363\312\247h\204\204\6\310Te38Xd\273+\23\317F\324^\230\\<\370\351\331\312F\272Iv\343\237\344^\317!\354b\335\343\347'\332\2\275\375\323\245W\252^\330\212\4F\217L\30\344\231\363\327\236\336\25\306\234&n\215pd\361d\347l\330\257Z\21719\0075\205$\27\25\312s\22'v`5\f\303\242\273q\0075\225e\35\241\331\312\314\373\244\33-\2p\246\10\321p\361\270c\304\216\311vJ#\317$N\243~,\24A\374\331\217\r\324\350\226\24\35\234\26w\346\256Lvl\16Mff\373Ep\16\276*1\237;v\374\226\347\364V\302\267\307S\374~/[\376\207,\234\321\330\t\355\216\253$\216t<\353\330\345\204\5b3\310\253>Kc]/\360b"..., 3226 <unfinished ...>
[pid 25474] 10:12:35.872091 <... brk resumed> ) = 0x2503000
[pid 25473] 10:12:35.872245 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25472] 10:12:35.872291 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.872317 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25482] 10:12:35.872381 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25481] 10:12:35.872414 stat("/etc/exim.pl",  <unfinished ...>
[pid 25479] 10:12:35.872667 <... write resumed> ) = 3226
[pid 25474] 10:12:35.872698 stat("/etc/exim.pl",  <unfinished ...>
[pid 25473] 10:12:35.872744 <... lseek resumed> ) = 878
[pid 25472] 10:12:35.872767 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25458] 10:12:35.872817 close(16 <unfinished ...>
[pid 25482] 10:12:35.872883 read(14,  <unfinished ...>
[pid 25481] 10:12:35.872921 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25479] 10:12:35.872976 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.873013 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25473] 10:12:35.873069 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.873106 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.873132 <... close resumed> ) = 0
[pid 25482] 10:12:35.873182 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25481] 10:12:35.873214 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25479] 10:12:35.873359 <... alarm resumed> ) = 300
[pid 25474] 10:12:35.873389 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.873434 <... lseek resumed> ) = 878
[pid 25472] 10:12:35.873455 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25458] 10:12:35.873503 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.873703 read(14,  <unfinished ...>
[pid 25481] 10:12:35.873745 <... open resumed> ) = 8
[pid 25479] 10:12:35.873777 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25474] 10:12:35.873825 <... open resumed> ) = 8
[pid 25473] 10:12:35.873853 close(12 <unfinished ...>
[pid 25472] 10:12:35.873890 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.873936 <... open resumed> ) = 16
[pid 25482] 10:12:35.873988 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25481] 10:12:35.874021 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.874186 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.874226 <... close resumed> ) = 0
[pid 25472] 10:12:35.874248 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.874763 fstat(16,  <unfinished ...>
[pid 25482] 10:12:35.874826 read(14,  <unfinished ...>
[pid 25481] 10:12:35.874865 <... ioctl resumed> , 0x7ffeeb1785b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.874897 <... ioctl resumed> , 0x7fff65a1c230) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.874927 read(11,  <unfinished ...>
[pid 25472] 10:12:35.874967 <... open resumed> ) = 14
[pid 25458] 10:12:35.874990 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.875060 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25481] 10:12:35.875093 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.875252 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.875291 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25472] 10:12:35.875331 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.876238 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.876306 read(14,  <unfinished ...>
[pid 25481] 10:12:35.876350 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.876408 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.876469 brk(0x108f000 <unfinished ...>
[pid 25472] 10:12:35.876512 <... ioctl resumed> , 0x7ffdc17db840) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.876613 <... mmap resumed> ) = 0x7f03f4be1000
[pid 25482] 10:12:35.876666 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25481] 10:12:35.876702 read(8,  <unfinished ...>
[pid 25474] 10:12:35.876871 read(8,  <unfinished ...>
[pid 25473] 10:12:35.876912 <... brk resumed> ) = 0x108f000
[pid 25472] 10:12:35.876935 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.877142 read(16,  <unfinished ...>
[pid 25482] 10:12:35.877227 read(14,  <unfinished ...>
[pid 25481] 10:12:35.877266 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25474] 10:12:35.879056 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25473] 10:12:35.880717 read(11,  <unfinished ...>
[pid 25472] 10:12:35.880785 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.880813 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25482] 10:12:35.880914 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25481] 10:12:35.880950 brk(0x1ba1000 <unfinished ...>
[pid 25474] 10:12:35.881092 brk(0x2524000 <unfinished ...>
[pid 25473] 10:12:35.881132 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25472] 10:12:35.881163 read(14,  <unfinished ...>
[pid 25458] 10:12:35.882985 read(16,  <unfinished ...>
[pid 25482] 10:12:35.883058 read(14,  <unfinished ...>
[pid 25481] 10:12:35.883100 <... brk resumed> ) = 0x1ba1000
[pid 25474] 10:12:35.883528 <... brk resumed> ) = 0x2524000
[pid 25473] 10:12:35.883794 brk(0x10b0000 <unfinished ...>
[pid 25472] 10:12:35.883835 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25458] 10:12:35.883859 <... read resumed> "", 1024) = 0
[pid 25482] 10:12:35.884115 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25481] 10:12:35.884152 read(8,  <unfinished ...>
[pid 25474] 10:12:35.884197 read(8,  <unfinished ...>
[pid 25473] 10:12:35.884222 <... brk resumed> ) = 0x10b0000
[pid 25472] 10:12:35.884236 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.884391 read(16,  <unfinished ...>
[pid 25482] 10:12:35.884432 read(14,  <unfinished ...>
[pid 25481] 10:12:35.884456 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25474] 10:12:35.885378 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25473] 10:12:35.886369 read(11,  <unfinished ...>
[pid 25472] 10:12:35.886412 <... lseek resumed> ) = 878
[pid 25458] 10:12:35.886429 <... read resumed> "", 1024) = 0
[pid 25482] 10:12:35.886467 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25481] 10:12:35.886491 brk(0x1bc2000 <unfinished ...>
[pid 25474] 10:12:35.886587 brk(0x2545000 <unfinished ...>
[pid 25473] 10:12:35.886613 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25472] 10:12:35.886632 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.887785 close(16 <unfinished ...>
[pid 25482] 10:12:35.887836 read(14,  <unfinished ...>
[pid 25481] 10:12:35.887862 <... brk resumed> ) = 0x1bc2000
[pid 25474] 10:12:35.887877 <... brk resumed> ) = 0x2545000
[pid 25473] 10:12:35.888598 brk(0x10d1000 <unfinished ...>
[pid 25472] 10:12:35.888636 <... lseek resumed> ) = 878
[pid 25458] 10:12:35.888651 <... close resumed> ) = 0
[pid 25482] 10:12:35.888681 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25481] 10:12:35.888702 read(8,  <unfinished ...>
[pid 25474] 10:12:35.888801 read(8,  <unfinished ...>
[pid 25472] 10:12:35.888830 close(14 <unfinished ...>
[pid 25458] 10:12:35.888855 munmap(0x7f03f4be1000, 4096 <unfinished ...>
[pid 25482] 10:12:35.888895 read(14,  <unfinished ...>
[pid 25481] 10:12:35.888920 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25474] 10:12:35.888940 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25473] 10:12:35.889771 <... brk resumed> ) = 0x10d1000
[pid 25472] 10:12:35.890700 <... close resumed> ) = 0
[pid 25458] 10:12:35.890957 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.891333 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25481] 10:12:35.891377 brk(0x1be3000 <unfinished ...>
[pid 25474] 10:12:35.891534 brk(0x2566000 <unfinished ...>
[pid 25473] 10:12:35.891561 read(11,  <unfinished ...>
[pid 25472] 10:12:35.891587 read(13,  <unfinished ...>
[pid 25458] 10:12:35.891615 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25482] 10:12:35.891660 read(14,  <unfinished ...>
[pid 25481] 10:12:35.891684 <... brk resumed> ) = 0x1be3000
[pid 25474] 10:12:35.891699 <... brk resumed> ) = 0x2566000
[pid 25472] 10:12:35.891968 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25458] 10:12:35.892248 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25482] 10:12:35.892870 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25481] 10:12:35.892903 read(8,  <unfinished ...>
[pid 25474] 10:12:35.892988 read(8,  <unfinished ...>
[pid 25472] 10:12:35.893014 brk(0x28cd000 <unfinished ...>
[pid 25458] 10:12:35.893038 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.893080 brk(0x1eb0000 <unfinished ...>
[pid 25481] 10:12:35.893104 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25474] 10:12:35.893122 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25473] 10:12:35.893770 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25472] 10:12:35.893807 <... brk resumed> ) = 0x28cd000
[pid 25458] 10:12:35.894650 <... open resumed> ) = 16
[pid 25482] 10:12:35.894802 <... brk resumed> ) = 0x1eb0000
[pid 25481] 10:12:35.894825 read(8,  <unfinished ...>
[pid 25474] 10:12:35.894872 read(8,  <unfinished ...>
[pid 25473] 10:12:35.894896 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.894919 read(13,  <unfinished ...>
[pid 25458] 10:12:35.894944 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25482] 10:12:35.894979 read(14,  <unfinished ...>
[pid 25481] 10:12:35.895003 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.895018 <... read resumed> "", 8192) = 0
[pid 25472] 10:12:35.895037 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25458] 10:12:35.895060 <... ioctl resumed> , 0x7ffc7ad951c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:35.896196 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25481] 10:12:35.896238 close(8 <unfinished ...>
[pid 25474] 10:12:35.896356 close(8 <unfinished ...>
[pid 25472] 10:12:35.896385 brk(0x28ee000 <unfinished ...>
[pid 25458] 10:12:35.896410 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.896443 read(14,  <unfinished ...>
[pid 25481] 10:12:35.896519 <... close resumed> ) = 0
[pid 25474] 10:12:35.896537 <... close resumed> ) = 0
[pid 25472] 10:12:35.896576 <... brk resumed> ) = 0x28ee000
[pid 25458] 10:12:35.896615 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.896737 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25481] 10:12:35.896764 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25474] 10:12:35.896863 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25472] 10:12:35.896890 read(13,  <unfinished ...>
[pid 25458] 10:12:35.896915 fstat(16,  <unfinished ...>
[pid 25482] 10:12:35.896947 read(14,  <unfinished ...>
[pid 25481] 10:12:35.896970 <... stat resumed> 0x7f04cc871880) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.896987 <... stat resumed> 0x7f84e25ee880) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.897007 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25458] 10:12:35.897031 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25482] 10:12:35.898130 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25481] 10:12:35.898162 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25474] 10:12:35.898260 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25472] 10:12:35.898288 brk(0x290f000 <unfinished ...>
[pid 25458] 10:12:35.898312 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.898348 read(14,  <unfinished ...>
[pid 25481] 10:12:35.898372 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25474] 10:12:35.898401 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25472] 10:12:35.898431 <... brk resumed> ) = 0x290f000
[pid 25458] 10:12:35.898449 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.898781 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25481] 10:12:35.898812 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25474] 10:12:35.898905 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25472] 10:12:35.898939 read(13,  <unfinished ...>
[pid 25458] 10:12:35.898965 read(16,  <unfinished ...>
[pid 25482] 10:12:35.898998 read(14,  <unfinished ...>
[pid 25481] 10:12:35.899021 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25474] 10:12:35.899049 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25472] 10:12:35.899079 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25458] 10:12:35.899100 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25482] 10:12:35.900197 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25481] 10:12:35.900233 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.900340 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.900370 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.900393 close(16 <unfinished ...>
[pid 25482] 10:12:35.900425 read(14,  <unfinished ...>
[pid 25481] 10:12:35.900445 <... open resumed> ) = 8
[pid 25474] 10:12:35.900545 <... open resumed> ) = 8
[pid 25458] 10:12:35.900566 <... close resumed> ) = 0
[pid 25482] 10:12:35.900639 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25481] 10:12:35.900669 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.900697 lseek(13, 0, SEEK_SET) = 0
[pid 25458] 10:12:35.900733 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25458] 10:12:35.900777 read(13, "", 4096) = 0
[pid 25458] 10:12:35.900819 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:35.900891 stat("/usr/local/cpanel/3rdparty/mailman/lists/paula_wagthedogmedia.com/config.pck", 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.900947 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:35.901023 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:35.901154 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25458] 10:12:35.901315 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com", 0x7f03f3286880) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.901382 stat("/etc/email_send_limits", {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:35.901448 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY) = 16
[pid 25482] 10:12:35.901684 read(14,  <unfinished ...>
[pid 25481] 10:12:35.901719 <... ioctl resumed> , 0x7ffeeb1785b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.901736 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.901762 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.901777 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.901794 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25482] 10:12:35.901829 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25481] 10:12:35.901900 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.901992 <... ioctl resumed> , 0x7fff65a1c230) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.902009 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.902039 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.902064 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:35.902092 read(14,  <unfinished ...>
[pid 25481] 10:12:35.902116 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.902129 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.902180 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.902196 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.902219 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.902259 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25481] 10:12:35.902277 read(8,  <unfinished ...>
[pid 25474] 10:12:35.902367 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.902382 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.902438 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.902527 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.902560 read(14,  <unfinished ...>
[pid 25481] 10:12:35.902590 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25474] 10:12:35.902614 read(8,  <unfinished ...>
[pid 25473] 10:12:35.903080 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.903101 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.903126 fstat(16,  <unfinished ...>
[pid 25482] 10:12:35.903163 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25481] 10:12:35.903183 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.903223 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25473] 10:12:35.903241 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.903800 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.903832 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25482] 10:12:35.903874 read(14,  <unfinished ...>
[pid 25481] 10:12:35.903899 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.903916 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.903943 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.903957 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.903977 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.904018 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25481] 10:12:35.904037 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.904132 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.904148 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.904178 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.904202 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.904231 read(14,  <unfinished ...>
[pid 25481] 10:12:35.904255 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.904270 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.904300 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.904314 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.904330 fstat(16,  <unfinished ...>
[pid 25482] 10:12:35.904364 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25481] 10:12:35.904383 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.904492 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.904509 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.904540 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.904565 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25482] 10:12:35.904621 read(14,  <unfinished ...>
[pid 25481] 10:12:35.904648 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.904672 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.904706 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.904721 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.904741 read(16,  <unfinished ...>
[pid 25482] 10:12:35.904780 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25481] 10:12:35.904799 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.904847 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.904863 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.904900 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.904928 <... read resumed> "0", 8192) = 1
[pid 25482] 10:12:35.904957 read(14,  <unfinished ...>
[pid 25481] 10:12:35.904981 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.904996 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.905027 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.905042 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.905059 read(16,  <unfinished ...>
[pid 25482] 10:12:35.905093 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25481] 10:12:35.905110 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.905205 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.905221 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.905256 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.905284 <... read resumed> "", 8192) = 0
[pid 25482] 10:12:35.905315 read(14,  <unfinished ...>
[pid 25481] 10:12:35.905338 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.905345 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.905352 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.905357 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.905363 close(16 <unfinished ...>
[pid 25482] 10:12:35.905378 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25458] 10:12:35.905386 <... close resumed> ) = 0
[pid 25458] 10:12:35.905455 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.905719 read(14,  <unfinished ...>
[pid 25481] 10:12:35.905748 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.905780 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.905795 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.905832 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.905859 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25482] 10:12:35.905915 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25481] 10:12:35.905936 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.906034 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.906073 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.906089 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.906105 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.906142 read(14,  <unfinished ...>
[pid 25481] 10:12:35.906164 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.906193 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.906207 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.906241 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.906268 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.906316 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25481] 10:12:35.906336 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.906415 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.906450 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.906545 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.906570 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.906612 read(14,  <unfinished ...>
[pid 25481] 10:12:35.906635 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.906664 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.906679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.906711 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:35.906738 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.906780 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25481] 10:12:35.906806 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.906886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.906923 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.906939 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.906955 close(7 <unfinished ...>
[pid 25482] 10:12:35.906992 read(14,  <unfinished ...>
[pid 25481] 10:12:35.907015 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.907045 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.907066 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.907095 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:35.907122 <... close resumed> ) = 0
[pid 25482] 10:12:35.907151 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25481] 10:12:35.907170 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.907254 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.907289 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.907318 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25458] 10:12:35.907348 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25482] 10:12:35.907398 read(14,  <unfinished ...>
[pid 25481] 10:12:35.907422 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.907451 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.907550 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.907585 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.907615 <... open resumed> ) = 7
[pid 25482] 10:12:35.907641 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25481] 10:12:35.907659 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.907747 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.907786 <... open resumed> ) = 12
[pid 25472] 10:12:35.907799 <... open resumed> ) = 14
[pid 25458] 10:12:35.907818 fcntl(7, F_GETFD <unfinished ...>
[pid 25482] 10:12:35.907855 read(14,  <unfinished ...>
[pid 25481] 10:12:35.907879 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25474] 10:12:35.907908 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.907929 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.907960 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:35.907982 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.908007 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25481] 10:12:35.908025 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.908110 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25473] 10:12:35.908142 <... ioctl resumed> , 0x7ffdac3356f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.908157 <... ioctl resumed> , 0x7ffdc17db840) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:35.908174 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.908210 read(14,  <unfinished ...>
[pid 25481] 10:12:35.908233 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25474] 10:12:35.908263 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.908280 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.908302 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.908324 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.908348 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25481] 10:12:35.908366 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25474] 10:12:35.908454 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25473] 10:12:35.908566 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.908581 <... lseek resumed> ) = 0
[pid 25458] 10:12:35.908629 fstat(7,  <unfinished ...>
[pid 25482] 10:12:35.908696 read(14,  <unfinished ...>
[pid 25481] 10:12:35.908721 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.908755 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.908787 read(12,  <unfinished ...>
[pid 25472] 10:12:35.908812 read(14,  <unfinished ...>
[pid 25458] 10:12:35.908834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10504, st_size=5373836, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.908872 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25481] 10:12:35.908889 <... open resumed> ) = 9
[pid 25474] 10:12:35.908962 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.908999 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25472] 10:12:35.909023 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25458] 10:12:35.909140 write(7, "2015-12-30 10:12:35 [25458] 1aEJMY-0006cO-Sq SMTP connection outbound 1451491955 1aEJMY-0006cO-Sq finestweddingsites.com paula@wagthedogmedia.com\n", 146 <unfinished ...>
[pid 25482] 10:12:35.909301 read(14,  <unfinished ...>
[pid 25481] 10:12:35.909329 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.909353 <... open resumed> ) = 9
[pid 25473] 10:12:35.909371 brk(0x10f2000 <unfinished ...>
[pid 25472] 10:12:35.909396 brk(0x2930000 <unfinished ...>
[pid 25458] 10:12:35.909419 <... write resumed> ) = 146
[pid 25482] 10:12:35.909475 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25481] 10:12:35.909558 <... ioctl resumed> , 0x7ffeeb177fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.909582 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.909606 <... brk resumed> ) = 0x10f2000
[pid 25472] 10:12:35.909620 <... brk resumed> ) = 0x2930000
[pid 25458] 10:12:35.910137 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25482] 10:12:35.910807 read(14,  <unfinished ...>
[pid 25481] 10:12:35.910837 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.910861 <... ioctl resumed> , 0x7fff65a1bc40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.910881 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25472] 10:12:35.910904 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25458] 10:12:35.910926 <... open resumed> ) = 16
[pid 25482] 10:12:35.910953 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25481] 10:12:35.911037 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.911073 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.911101 <... lseek resumed> ) = 4868
[pid 25472] 10:12:35.911114 <... lseek resumed> ) = 4868
[pid 25458] 10:12:35.911130 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25482] 10:12:35.911164 read(14,  <unfinished ...>
[pid 25481] 10:12:35.911189 brk(0x1c04000 <unfinished ...>
[pid 25474] 10:12:35.911214 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.911245 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.911270 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:35.911292 <... lseek resumed> ) = 9
[pid 25482] 10:12:35.911318 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25481] 10:12:35.911376 <... brk resumed> ) = 0x1c04000
[pid 25474] 10:12:35.911412 brk(0x2587000 <unfinished ...>
[pid 25473] 10:12:35.911439 <... lseek resumed> ) = 4868
[pid 25472] 10:12:35.911452 <... lseek resumed> ) = 4868
[pid 25458] 10:12:35.911547 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25482] 10:12:35.911595 brk(0x1ed1000 <unfinished ...>
[pid 25481] 10:12:35.911622 read(9,  <unfinished ...>
[pid 25474] 10:12:35.911662 <... brk resumed> ) = 0x2587000
[pid 25473] 10:12:35.911691 close(12 <unfinished ...>
[pid 25472] 10:12:35.911717 close(14 <unfinished ...>
[pid 25458] 10:12:35.911740 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:35.911768 <... brk resumed> ) = 0x1ed1000
[pid 25481] 10:12:35.911816 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25474] 10:12:35.912129 read(9,  <unfinished ...>
[pid 25473] 10:12:35.912163 <... close resumed> ) = 0
[pid 25472] 10:12:35.912177 <... close resumed> ) = 0
[pid 25458] 10:12:35.912209 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.912265 read(14,  <unfinished ...>
[pid 25481] 10:12:35.912290 read(9,  <unfinished ...>
[pid 25474] 10:12:35.912315 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25473] 10:12:35.912715 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.912756 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.912783 <... lseek resumed> ) = 9
[pid 25482] 10:12:35.912811 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25481] 10:12:35.912901 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25474] 10:12:35.913625 read(9,  <unfinished ...>
[pid 25473] 10:12:35.913675 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.913693 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.913711 fstat(16,  <unfinished ...>
[pid 25482] 10:12:35.913747 read(14,  <unfinished ...>
[pid 25481] 10:12:35.913771 read(9,  <unfinished ...>
[pid 25474] 10:12:35.913795 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25473] 10:12:35.914579 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.914629 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.914657 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=9, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.914701 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25481] 10:12:35.914734 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25474] 10:12:35.914759 read(9,  <unfinished ...>
[pid 25473] 10:12:35.914879 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.914904 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.914925 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.914967 read(14,  <unfinished ...>
[pid 25481] 10:12:35.914992 brk(0x1c25000 <unfinished ...>
[pid 25474] 10:12:35.915015 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25473] 10:12:35.915119 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.915154 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.915179 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.915213 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25481] 10:12:35.915297 <... brk resumed> ) = 0x1c25000
[pid 25474] 10:12:35.915314 brk(0x25a8000 <unfinished ...>
[pid 25473] 10:12:35.915747 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.915769 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.915788 write(16, "1", 1 <unfinished ...>
[pid 25482] 10:12:35.915833 read(14,  <unfinished ...>
[pid 25481] 10:12:35.915858 read(9,  <unfinished ...>
[pid 25474] 10:12:35.915880 <... brk resumed> ) = 0x25a8000
[pid 25473] 10:12:35.916213 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.916250 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.916276 <... write resumed> ) = 1
[pid 25482] 10:12:35.916303 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25481] 10:12:35.916387 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.916407 read(9,  <unfinished ...>
[pid 25473] 10:12:35.916435 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.916450 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.916529 close(16 <unfinished ...>
[pid 25482] 10:12:35.916575 read(14,  <unfinished ...>
[pid 25481] 10:12:35.916601 close(9 <unfinished ...>
[pid 25474] 10:12:35.916624 <... read resumed> "", 8192) = 0
[pid 25473] 10:12:35.916638 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.916670 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.916694 <... close resumed> ) = 0
[pid 25482] 10:12:35.916753 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25481] 10:12:35.916832 <... close resumed> ) = 0
[pid 25474] 10:12:35.916849 close(9 <unfinished ...>
[pid 25473] 10:12:35.917638 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.917661 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.917679 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.917724 read(14,  <unfinished ...>
[pid 25481] 10:12:35.917755 read(8,  <unfinished ...>
[pid 25474] 10:12:35.917781 <... close resumed> ) = 0
[pid 25473] 10:12:35.917795 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.918529 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.918562 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.918608 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25481] 10:12:35.918698 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25474] 10:12:35.918726 read(8,  <unfinished ...>
[pid 25473] 10:12:35.919531 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.919560 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.919587 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25482] 10:12:35.919646 read(14,  <unfinished ...>
[pid 25481] 10:12:35.919676 read(8,  <unfinished ...>
[pid 25474] 10:12:35.919701 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25473] 10:12:35.919723 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.920534 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.920573 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.920652 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25481] 10:12:35.920751 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25474] 10:12:35.920776 read(8,  <unfinished ...>
[pid 25473] 10:12:35.921494 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.921519 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.921538 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25482] 10:12:35.921583 read(14,  <unfinished ...>
[pid 25481] 10:12:35.921608 read(8,  <unfinished ...>
[pid 25474] 10:12:35.921633 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25473] 10:12:35.921658 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.922375 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.922410 <... socket resumed> ) = 16
[pid 25482] 10:12:35.922438 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25481] 10:12:35.922601 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25474] 10:12:35.922629 read(8,  <unfinished ...>
[pid 25473] 10:12:35.923234 <... stat resumed> 0x7ffdac335900) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.923257 <... stat resumed> 0x7ffdc17dba50) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.923279 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25482] 10:12:35.923333 read(14,  <unfinished ...>
[pid 25481] 10:12:35.923359 read(8,  <unfinished ...>
[pid 25474] 10:12:35.923383 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25473] 10:12:35.923402 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25472] 10:12:35.924107 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25458] 10:12:35.924142 <... connect resumed> ) = 0
[pid 25482] 10:12:35.924170 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25481] 10:12:35.924250 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25474] 10:12:35.924273 read(8,  <unfinished ...>
[pid 25473] 10:12:35.924484 <... stat resumed> 0x7ffdac3359a0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.924505 <... stat resumed> 0x7ffdc17dbaf0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:35.924524 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25482] 10:12:35.924566 read(14,  <unfinished ...>
[pid 25481] 10:12:35.924592 brk(0x1c46000 <unfinished ...>
[pid 25474] 10:12:35.924616 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25473] 10:12:35.924635 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25472] 10:12:35.924850 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25458] 10:12:35.924881 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25482] 10:12:35.924911 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25481] 10:12:35.924951 <... brk resumed> ) = 0x1c46000
[pid 25474] 10:12:35.924968 brk(0x25c9000 <unfinished ...>
[pid 25473] 10:12:35.925426 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25472] 10:12:35.925542 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25458] 10:12:35.925582 sendto(16, "\236\37\1\0\0\1\0\0\0\0\0\0\16wagthedogmedia\3com\0\0\17\0\1", 36, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25482] 10:12:35.925658 read(14,  <unfinished ...>
[pid 25481] 10:12:35.925685 read(8,  <unfinished ...>
[pid 25474] 10:12:35.925710 <... brk resumed> ) = 0x25c9000
[pid 25473] 10:12:35.925727 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.926201 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25458] 10:12:35.926238 <... sendto resumed> ) = 36
[pid 25482] 10:12:35.926266 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25481] 10:12:35.926369 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25474] 10:12:35.926393 read(8,  <unfinished ...>
[pid 25473] 10:12:35.927253 <... open resumed> ) = 12
[pid 25472] 10:12:35.927273 <... open resumed> ) = 14
[pid 25458] 10:12:35.927293 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25482] 10:12:35.927338 read(14,  <unfinished ...>
[pid 25481] 10:12:35.927364 brk(0x1c67000 <unfinished ...>
[pid 25474] 10:12:35.927387 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25473] 10:12:35.927406 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.928262 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25482] 10:12:35.928300 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25481] 10:12:35.928385 <... brk resumed> ) = 0x1c67000
[pid 25474] 10:12:35.928405 brk(0x25ea000 <unfinished ...>
[pid 25473] 10:12:35.928669 <... ioctl resumed> , 0x7ffdac3356f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:35.928701 read(14,  <unfinished ...>
[pid 25481] 10:12:35.928734 read(8,  <unfinished ...>
[pid 25474] 10:12:35.928759 <... brk resumed> ) = 0x25ea000
[pid 25472] 10:12:35.928774 <... ioctl resumed> , 0x7ffdc17db840) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:35.929009 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25481] 10:12:35.929111 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25474] 10:12:35.929141 read(8,  <unfinished ...>
[pid 25473] 10:12:35.929592 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.929813 read(14,  <unfinished ...>
[pid 25481] 10:12:35.929841 read(8,  <unfinished ...>
[pid 25474] 10:12:35.929862 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25472] 10:12:35.929882 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.930429 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25474] 10:12:35.930575 read(8,  <unfinished ...>
[pid 25473] 10:12:35.930611 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.930631 read(14,  <unfinished ...>
[pid 25474] 10:12:35.930684 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25472] 10:12:35.930705 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.931179 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25474] 10:12:35.931296 brk(0x260b000 <unfinished ...>
[pid 25473] 10:12:35.931325 read(12,  <unfinished ...>
[pid 25482] 10:12:35.931351 read(14,  <unfinished ...>
[pid 25472] 10:12:35.931376 read(14,  <unfinished ...>
[pid 25482] 10:12:35.931402 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25482] 10:12:35.931569 read(14, "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25482] 10:12:35.931627 read(14, "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25482] 10:12:35.931722 read(14, ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25482] 10:12:35.931772 read(14, "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25482] 10:12:35.931859 read(14, "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25482] 10:12:35.931910 read(14, "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25482] 10:12:35.932007 read(14, ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25482] 10:12:35.932104 read(14, "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25482] 10:12:35.932156 read(14, "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25482] 10:12:35.932262 read(14, "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25482] 10:12:35.932360 read(14, "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25482] 10:12:35.932466 read(14, "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25482] 10:12:35.932518 brk(0x1ef2000) = 0x1ef2000
[pid 25482] 10:12:35.932622 read(14, ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25482] 10:12:35.932674 read(14, "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25482] 10:12:35.932759 read(14, "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25482] 10:12:35.932855 read(14, " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25482] 10:12:35.932888 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25482] 10:12:35.932992 read(14, ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25482] 10:12:35.933024 read(14, "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25482] 10:12:35.933101 read(14, "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25482] 10:12:35.933168 read(14, "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25482] 10:12:35.933196 read(14, "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25482] 10:12:35.933264 read(14, "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25482] 10:12:35.933293 read(14, "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25482] 10:12:35.933356 read(14, "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25482] 10:12:35.933387 read(14, "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25482] 10:12:35.933456 read(14,  <unfinished ...>
[pid 25481] 10:12:35.933668 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25474] 10:12:35.933689 <... brk resumed> ) = 0x260b000
[pid 25473] 10:12:35.934182 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25472] 10:12:35.934354 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25482] 10:12:35.934962 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25481] 10:12:35.935492 brk(0x1c88000 <unfinished ...>
[pid 25474] 10:12:35.935532 read(8,  <unfinished ...>
[pid 25473] 10:12:35.935561 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.935592 read(14,  <unfinished ...>
[pid 25474] 10:12:35.935617 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25472] 10:12:35.935637 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.935846 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25473] 10:12:35.935935 <... lseek resumed> ) = 2366
[pid 25482] 10:12:35.935958 read(14, "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25482] 10:12:35.936010 read(14, "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25482] 10:12:35.936113 read(14, "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25481] 10:12:35.936406 <... brk resumed> ) = 0x1c88000
[pid 25473] 10:12:35.936566 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.936748 <... lseek resumed> ) = 2366
[pid 25482] 10:12:35.936772 read(14,  <unfinished ...>
[pid 25481] 10:12:35.936800 read(8,  <unfinished ...>
[pid 25473] 10:12:35.936824 <... lseek resumed> ) = 2366
[pid 25482] 10:12:35.936847 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25472] 10:12:35.936867 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:35.936963 read(14,  <unfinished ...>
[pid 25473] 10:12:35.936985 close(12 <unfinished ...>
[pid 25472] 10:12:35.937005 <... lseek resumed> ) = 2366
[pid 25482] 10:12:35.937039 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25481] 10:12:35.937059 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25473] 10:12:35.937138 <... close resumed> ) = 0
[pid 25472] 10:12:35.937589 close(14 <unfinished ...>
[pid 25482] 10:12:35.937626 read(14,  <unfinished ...>
[pid 25480] 10:12:35.937647 <... select resumed> ) = 1 (in [11], left {599, 924148})
[pid 25480] 10:12:35.937679 read(11, "\27\3\1\0P", 5) = 5
[pid 25480] 10:12:35.937723 read(11, "\n\3Paae\275\"3\2177%\2654\305\222\306!d\303^e\261t\360\207\360\273\325\250\3676\265\216E\364dJ\206\33\242\201D@z6\331\310'm\17N\3504\22\340\7\33X\304W\33\306\366&IV-\313\255\243lz\20\33\254\233\0\370y", 80) = 80
[pid 25480] 10:12:35.937780 write(9, "kcarter@scottsdalegolfgroup.com\n", 32) = 32
[pid 25480] 10:12:35.937835 fsync(9 <unfinished ...>
[pid 25482] 10:12:35.938324 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25473] 10:12:35.938350 read(11,  <unfinished ...>
[pid 25472] 10:12:35.938443 <... close resumed> ) = 0
[pid 25482] 10:12:35.938468 read(14,  <unfinished ...>
[pid 25480] 10:12:35.938490 <... fsync resumed> ) = 0
[pid 25480] 10:12:35.938517 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25480] 10:12:35.938572 alarm(60)   = 0
[pid 25480] 10:12:35.938607 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25482] 10:12:35.938646 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25480] 10:12:35.938728 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.938759 read(14,  <unfinished ...>
[pid 25480] 10:12:35.938781 alarm(0)    = 60
[pid 25480] 10:12:35.938844 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25482] 10:12:35.938911 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25480] 10:12:35.938983 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR <unfinished ...>
[pid 25482] 10:12:35.939023 read(14,  <unfinished ...>
[pid 25480] 10:12:35.939043 <... open resumed> ) = 15
[pid 25480] 10:12:35.939062 fcntl(15, F_GETFD) = 0
[pid 25480] 10:12:35.939095 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25482] 10:12:35.939132 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25480] 10:12:35.939200 read(15,  <unfinished ...>
[pid 25482] 10:12:35.939231 read(14,  <unfinished ...>
[pid 25480] 10:12:35.939251 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25480] 10:12:35.939280 close(15)   = 0
[pid 25480] 10:12:35.939322 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.939357 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25480] 10:12:35.939385 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.939409 read(14,  <unfinished ...>
[pid 25480] 10:12:35.939433 stat("/var/tmp",  <unfinished ...>
[pid 25482] 10:12:35.940555 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25480] 10:12:35.940665 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25482] 10:12:35.940732 read(14,  <unfinished ...>
[pid 25480] 10:12:35.940764 brk(0xb79000 <unfinished ...>
[pid 25474] 10:12:35.940790 read(8,  <unfinished ...>
[pid 25473] 10:12:35.940810 <... read resumed> "", 8192) = 0
[pid 25472] 10:12:35.940830 read(13,  <unfinished ...>
[pid 25482] 10:12:35.940864 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25480] 10:12:35.940941 <... brk resumed> ) = 0xb79000
[pid 25474] 10:12:35.941241 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25473] 10:12:35.941269 close(11 <unfinished ...>
[pid 25482] 10:12:35.941770 read(14,  <unfinished ...>
[pid 25481] 10:12:35.941800 read(8,  <unfinished ...>
[pid 25480] 10:12:35.941822 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0 <unfinished ...>
[pid 25474] 10:12:35.941858 brk(0x262c000 <unfinished ...>
[pid 25472] 10:12:35.941879 <... read resumed> "", 8192) = 0
[pid 25482] 10:12:35.941899 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25480] 10:12:35.941932 <... open resumed> ) = 15
[pid 25473] 10:12:35.941949 <... close resumed> ) = 0
[pid 25482] 10:12:35.941966 read(14,  <unfinished ...>
[pid 25480] 10:12:35.941991 fcntl(15, F_GETFD <unfinished ...>
[pid 25482] 10:12:35.942018 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25480] 10:12:35.942092 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.942116 brk(0x1f13000 <unfinished ...>
[pid 25480] 10:12:35.942141 fcntl(15, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.942168 <... brk resumed> ) = 0x1f13000
[pid 25480] 10:12:35.942199 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.942222 read(14,  <unfinished ...>
[pid 25480] 10:12:35.942247 fstat(15,  <unfinished ...>
[pid 25482] 10:12:35.942274 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25480] 10:12:35.942304 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25482] 10:12:35.942355 read(14,  <unfinished ...>
[pid 25480] 10:12:35.942382 pread(15,  <unfinished ...>
[pid 25482] 10:12:35.942410 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25480] 10:12:35.942621 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25482] 10:12:35.942674 read(14,  <unfinished ...>
[pid 25480] 10:12:35.942702 pread(15,  <unfinished ...>
[pid 25482] 10:12:35.942733 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25480] 10:12:35.942810 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25482] 10:12:35.942859 read(14,  <unfinished ...>
[pid 25480] 10:12:35.942887 close(15 <unfinished ...>
[pid 25482] 10:12:35.942916 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25480] 10:12:35.942998 <... close resumed> ) = 0
[pid 25482] 10:12:35.943035 read(14,  <unfinished ...>
[pid 25480] 10:12:35.943058 close(14)   = 0
[pid 25480] 10:12:35.943105 write(11, "\27\3\1\0 \346\266\225\275\276\262\217\226,\275\273\17B\30O\222|\310\216\255]\321\276Y\355\177\335\352\352\362\243\302\27\3\1\0 \364qqL\10\334\251'J\276\310\371o\373\37\f\26\254JBT\277T\247N\363\230-\21\263\352\340", 74 <unfinished ...>
[pid 25482] 10:12:35.943166 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25480] 10:12:35.943251 <... write resumed> ) = 74
[pid 25482] 10:12:35.943284 read(14,  <unfinished ...>
[pid 25480] 10:12:35.943306 write(11, "\25\3\1\0 \370\33\217\357\333n\372%\270\301\312\r\253N\304b}\3621P\324\276\35\257\374\315\271\316\301^\332]", 37) = 37
[pid 25480] 10:12:35.943509 close(11)   = 0
[pid 25480] 10:12:35.943587 close(13)   = 0
[pid 25482] 10:12:35.943629 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25480] 10:12:35.943662 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25482] 10:12:35.943696 read(14,  <unfinished ...>
[pid 25480] 10:12:35.943723 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.943745 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25480] 10:12:35.943844 close(10 <unfinished ...>
[pid 25482] 10:12:35.943877 read(14,  <unfinished ...>
[pid 25480] 10:12:35.943897 <... close resumed> ) = 0
[pid 25480] 10:12:35.943915 munmap(0x7fea0f284000, 4096) = 0
[pid 25480] 10:12:35.943960 write(12, "S000004V\f\0\0", 11) = 11
[pid 25433] 10:12:35.944017 <... select resumed> ) = 1 (in [10], left {59, 560266})
[pid 25482] 10:12:35.944047 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25480] 10:12:35.944076 write(12, "X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0", 196 <unfinished ...>
[pid 25433] 10:12:35.944103 read(10,  <unfinished ...>
[pid 25482] 10:12:35.944135 read(14,  <unfinished ...>
[pid 25480] 10:12:35.944158 <... write resumed> ) = 196
[pid 25433] 10:12:35.944260 <... read resumed> "S000004V\f\0\0X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0", 16384) = 207
[pid 25482] 10:12:35.944298 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25480] 10:12:35.944392 write(12, "X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT\\nMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew\\nHhcNMTQwNDI4MTc0MzMzWhcNMTgwNDMwMDcxMjI1WjCBwDEpMCcGA1UEBRMgNkFL\\nWFplbXhIT2pMTUZWdHlVWF"..., 1888 <unfinished ...>
[pid 25433] 10:12:35.944414 wait4(-1,  <unfinished ...>
[pid 25482] 10:12:35.944428 read(14,  <unfinished ...>
[pid 25480] 10:12:35.944438 <... write resumed> ) = 1888
[pid 25433] 10:12:35.944449 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25482] 10:12:35.944843 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25481] 10:12:35.944886 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25480] 10:12:35.944906 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25474] 10:12:35.945400 <... brk resumed> ) = 0x262c000
[pid 25473] 10:12:35.945419 stat("/etc/userdomains",  <unfinished ...>
[pid 25472] 10:12:35.945866 close(13 <unfinished ...>
[pid 25433] 10:12:35.945895 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:35.945939 read(14,  <unfinished ...>
[pid 25481] 10:12:35.945963 brk(0x1ca9000 <unfinished ...>
[pid 25480] 10:12:35.945987 <... write resumed> ) = 9
[pid 25474] 10:12:35.946007 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.946030 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.946058 <... close resumed> ) = 0
[pid 25433] 10:12:35.946083 <... select resumed> ) = 1 (in [10], left {59, 999998})
[pid 25482] 10:12:35.946290 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25481] 10:12:35.946387 <... brk resumed> ) = 0x1ca9000
[pid 25480] 10:12:35.946407 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25473] 10:12:35.946846 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.946881 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.946913 read(10,  <unfinished ...>
[pid 25482] 10:12:35.946949 read(14,  <unfinished ...>
[pid 25481] 10:12:35.946973 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25480] 10:12:35.946995 <... write resumed> ) = 11
[pid 25474] 10:12:35.947016 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.947034 <... open resumed> ) = 11
[pid 25472] 10:12:35.947049 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.947066 <... read resumed> "X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT\\nMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew\\nHhcNMTQwNDI4MTc0MzMzWhcNMTgwNDMwMDcxMjI1WjCBwDEpMCcGA1UEBRMgNkFL\\nWFplbXhIT2pMTUZWdHlVWF"..., 16384) = 1908
[pid 25482] 10:12:35.947328 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25480] 10:12:35.947371 write(12, "A000096\0=\0\0\0\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 83/D3-30194-37204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000", 103 <unfinished ...>
[pid 25474] 10:12:35.947400 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.947427 fstat(11,  <unfinished ...>
[pid 25472] 10:12:35.947450 read(12,  <unfinished ...>
[pid 25433] 10:12:35.947554 wait4(-1,  <unfinished ...>
[pid 25482] 10:12:35.947598 read(14,  <unfinished ...>
[pid 25480] 10:12:35.947624 <... write resumed> ) = 103
[pid 25474] 10:12:35.947644 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.947660 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.947694 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.947714 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25482] 10:12:35.947769 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25480] 10:12:35.947855 write(12, "I00002050.116.78.207\00052769\0", 27 <unfinished ...>
[pid 25474] 10:12:35.947886 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.947911 fstat(11,  <unfinished ...>
[pid 25472] 10:12:35.947938 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.947966 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:35.948005 read(14,  <unfinished ...>
[pid 25481] 10:12:35.948029 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.948044 <... write resumed> ) = 27
[pid 25474] 10:12:35.948065 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.948080 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.948114 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.948141 <... select resumed> ) = 1 (in [10], left {59, 999998})
[pid 25482] 10:12:35.948186 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25481] 10:12:35.948221 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25480] 10:12:35.948248 write(12, "Z0000010", 8 <unfinished ...>
[pid 25474] 10:12:35.948273 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.948296 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.948323 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.948353 read(10,  <unfinished ...>
[pid 25482] 10:12:35.948387 read(14,  <unfinished ...>
[pid 25481] 10:12:35.948410 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.948425 <... write resumed> ) = 8
[pid 25474] 10:12:35.948447 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.948466 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25472] 10:12:35.948485 <... open resumed> ) = 13
[pid 25433] 10:12:35.948505 <... read resumed> "A000096\0=\0\0\0\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 83/D3-30194-37204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000I00002050.116.78.207\00052769\0Z0000010", 16384) = 138
[pid 25482] 10:12:35.948539 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25481] 10:12:35.948620 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25480] 10:12:35.948649 close(12 <unfinished ...>
[pid 25474] 10:12:35.948672 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.948697 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25472] 10:12:35.948720 fstat(13,  <unfinished ...>
[pid 25433] 10:12:35.948742 close(10 <unfinished ...>
[pid 25482] 10:12:35.948779 read(14,  <unfinished ...>
[pid 25481] 10:12:35.948804 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.948818 <... close resumed> ) = 0
[pid 25474] 10:12:35.949184 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.949204 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.949220 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.949256 <... close resumed> ) = 0
[pid 25482] 10:12:35.949282 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25481] 10:12:35.949366 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25480] 10:12:35.949396 exit_group(0) = ?
[pid 25474] 10:12:35.950079 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.950118 read(11,  <unfinished ...>
[pid 25472] 10:12:35.950145 fstat(13,  <unfinished ...>
[pid 25433] 10:12:35.950169 wait4(25480,  <unfinished ...>
[pid 25482] 10:12:35.950214 read(14,  <unfinished ...>
[pid 25481] 10:12:35.950238 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25480] 10:12:35.950259 +++ exited with 0 +++
[pid 25474] 10:12:35.950277 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.950292 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25472] 10:12:35.950318 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.950379 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25480
[pid 25482] 10:12:35.950422 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25481] 10:12:35.950454 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25474] 10:12:35.950556 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.950594 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.950624 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.950651 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.950686 read(14,  <unfinished ...>
[pid 25481] 10:12:35.950710 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.950725 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.950741 <... open resumed> ) = 12
[pid 25472] 10:12:35.950762 <... mmap resumed> ) = 0x7ff101082000
[pid 25433] 10:12:35.950781 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.950834 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25481] 10:12:35.950925 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25474] 10:12:35.950955 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.950984 fstat(12,  <unfinished ...>
[pid 25472] 10:12:35.951008 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:35.951031 write(8, "2015-12-30 10:12:35 kcarter@scottsdalegolfgroup.com: remote_smtp transport succeeded\n", 85 <unfinished ...>
[pid 25482] 10:12:35.951072 read(14,  <unfinished ...>
[pid 25481] 10:12:35.951096 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.951111 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.951131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25472] 10:12:35.951166 <... lseek resumed> ) = 0
[pid 25433] 10:12:35.951183 <... write resumed> ) = 85
[pid 25482] 10:12:35.951225 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25481] 10:12:35.951264 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25474] 10:12:35.951294 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.951322 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.951351 read(13,  <unfinished ...>
[pid 25433] 10:12:35.951374 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.951409 read(14,  <unfinished ...>
[pid 25481] 10:12:35.951432 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.951447 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.951468 <... mmap resumed> ) = 0x7f7c15ca5000
[pid 25472] 10:12:35.951488 <... read resumed> "", 4096) = 0
[pid 25433] 10:12:35.951514 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.951570 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25481] 10:12:35.951658 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25474] 10:12:35.951691 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.951719 read(12,  <unfinished ...>
[pid 25472] 10:12:35.951746 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25433] 10:12:35.951773 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.951807 read(14,  <unfinished ...>
[pid 25481] 10:12:35.951831 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.951846 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.951865 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25472] 10:12:35.951902 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25433] 10:12:35.951946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.951978 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25481] 10:12:35.952048 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25474] 10:12:35.952057 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.952063 close(12 <unfinished ...>
[pid 25472] 10:12:35.952089 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25433] 10:12:35.952104 close(7 <unfinished ...>
[pid 25482] 10:12:35.952122 read(14,  <unfinished ...>
[pid 25481] 10:12:35.952132 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.952138 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.952144 <... close resumed> ) = 0
[pid 25472] 10:12:35.952156 <... open resumed> ) = 14
[pid 25433] 10:12:35.952165 <... close resumed> ) = 0
[pid 25482] 10:12:35.952184 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25481] 10:12:35.952251 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25474] 10:12:35.952259 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.952266 munmap(0x7f7c15ca5000, 4096 <unfinished ...>
[pid 25472] 10:12:35.952293 fstat(14,  <unfinished ...>
[pid 25433] 10:12:35.952302 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25482] 10:12:35.952332 read(14,  <unfinished ...>
[pid 25481] 10:12:35.952342 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.952349 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.952354 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.952391 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25433] 10:12:35.952412 <... open resumed> ) = 7
[pid 25482] 10:12:35.952429 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25481] 10:12:35.952720 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25474] 10:12:35.952760 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25473] 10:12:35.952789 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25472] 10:12:35.952818 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:35.952845 fcntl(7, F_GETFD <unfinished ...>
[pid 25482] 10:12:35.952878 read(14,  <unfinished ...>
[pid 25481] 10:12:35.952901 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.952916 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:35.952933 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25472] 10:12:35.952973 <... mmap resumed> ) = 0x7ff101081000
[pid 25433] 10:12:35.952991 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.953016 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25481] 10:12:35.953049 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25474] 10:12:35.953078 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25473] 10:12:35.953106 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25472] 10:12:35.953139 read(14,  <unfinished ...>
[pid 25433] 10:12:35.953165 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.953197 read(14,  <unfinished ...>
[pid 25481] 10:12:35.953220 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.953235 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:35.953266 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25472] 10:12:35.953308 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25433] 10:12:35.953336 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.953362 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25481] 10:12:35.953442 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25474] 10:12:35.953479 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.953510 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.953541 close(14 <unfinished ...>
[pid 25433] 10:12:35.953565 fstat(7,  <unfinished ...>
[pid 25482] 10:12:35.953597 read(14,  <unfinished ...>
[pid 25481] 10:12:35.953621 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.953636 <... open resumed> ) = 9
[pid 25473] 10:12:35.953651 <... open resumed> ) = 12
[pid 25472] 10:12:35.953672 <... close resumed> ) = 0
[pid 25433] 10:12:35.953689 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5373982, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.953726 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25481] 10:12:35.953806 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25474] 10:12:35.953838 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:35.953864 fstat(12,  <unfinished ...>
[pid 25472] 10:12:35.953886 munmap(0x7ff101081000, 4096 <unfinished ...>
[pid 25433] 10:12:35.953914 write(7, "2015-12-30 10:12:35 [25433] 1aEJMY-0006c6-AN => kcarter@scottsdalegolfgroup.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3158 H=mx1.emailsrvr.com [98.129.185.131]:25 X=TL"..., 516 <unfinished ...>
[pid 25482] 10:12:35.953956 read(14,  <unfinished ...>
[pid 25481] 10:12:35.953980 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25474] 10:12:35.954003 <... ioctl resumed> , 0x7fff65a1bc40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:35.954010 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25472] 10:12:35.954036 <... munmap resumed> ) = 0
[pid 25433] 10:12:35.954061 <... write resumed> ) = 516
[pid 25482] 10:12:35.954108 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25481] 10:12:35.954185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.954195 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.954201 fstat(12,  <unfinished ...>
[pid 25472] 10:12:35.954220 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25433] 10:12:35.954234 wait4(-1,  <unfinished ...>
[pid 25482] 10:12:35.954251 read(14,  <unfinished ...>
[pid 25481] 10:12:35.954261 <... open resumed> ) = 9
[pid 25474] 10:12:35.954266 <... lseek resumed> ) = 0
[pid 25473] 10:12:35.954271 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25472] 10:12:35.954318 <... open resumed> ) = 14
[pid 25433] 10:12:35.954331 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25482] 10:12:35.954349 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25481] 10:12:35.954421 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.954430 read(9,  <unfinished ...>
[pid 25473] 10:12:35.954435 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.954453 fstat(14,  <unfinished ...>
[pid 25433] 10:12:35.954694 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:35.954735 read(14,  <unfinished ...>
[pid 25481] 10:12:35.954759 <... ioctl resumed> , 0x7ffeeb177fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.954775 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25473] 10:12:35.954796 <... mmap resumed> ) = 0x7f7c15ca5000
[pid 25472] 10:12:35.955009 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25482] 10:12:35.955059 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25481] 10:12:35.955092 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.955117 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25473] 10:12:35.955150 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25472] 10:12:35.955175 fstat(14,  <unfinished ...>
[pid 25482] 10:12:35.955205 read(14,  <unfinished ...>
[pid 25481] 10:12:35.955229 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.955242 <... lseek resumed> ) = 878
[pid 25473] 10:12:35.955285 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.955308 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25482] 10:12:35.955348 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25481] 10:12:35.955430 read(9,  <unfinished ...>
[pid 25474] 10:12:35.955458 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:35.955554 read(12,  <unfinished ...>
[pid 25472] 10:12:35.955583 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.955618 read(14,  <unfinished ...>
[pid 25481] 10:12:35.955642 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25474] 10:12:35.955661 <... lseek resumed> ) = 878
[pid 25473] 10:12:35.955866 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25472] 10:12:35.955905 <... mmap resumed> ) = 0x7ff101081000
[pid 25482] 10:12:35.955932 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25481] 10:12:35.955976 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.956001 close(9 <unfinished ...>
[pid 25473] 10:12:35.956024 read(12,  <unfinished ...>
[pid 25472] 10:12:35.956047 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.956077 brk(0x1f34000 <unfinished ...>
[pid 25481] 10:12:35.956101 <... lseek resumed> ) = 878
[pid 25474] 10:12:35.956114 <... close resumed> ) = 0
[pid 25473] 10:12:35.956130 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.956406 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.956443 <... brk resumed> ) = 0x1f34000
[pid 25481] 10:12:35.956573 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.956605 read(8,  <unfinished ...>
[pid 25473] 10:12:35.956630 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25472] 10:12:35.956664 read(14,  <unfinished ...>
[pid 25482] 10:12:35.956698 read(14,  <unfinished ...>
[pid 25481] 10:12:35.956721 <... lseek resumed> ) = 878
[pid 25474] 10:12:35.956735 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25473] 10:12:35.956756 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2943, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.957417 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25482] 10:12:35.957485 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25481] 10:12:35.957568 close(9 <unfinished ...>
[pid 25474] 10:12:35.957600 read(8,  <unfinished ...>
[pid 25473] 10:12:35.957626 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.957659 read(14,  <unfinished ...>
[pid 25482] 10:12:35.957690 read(14,  <unfinished ...>
[pid 25481] 10:12:35.957714 <... close resumed> ) = 0
[pid 25474] 10:12:35.957727 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25473] 10:12:35.957964 <... open resumed> ) = 13
[pid 25472] 10:12:35.958108 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.958154 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25481] 10:12:35.958190 read(8,  <unfinished ...>
[pid 25474] 10:12:35.958216 brk(0x264d000 <unfinished ...>
[pid 25473] 10:12:35.958240 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25472] 10:12:35.958265 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.958302 read(14,  <unfinished ...>
[pid 25481] 10:12:35.958328 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25474] 10:12:35.958347 <... brk resumed> ) = 0x264d000
[pid 25473] 10:12:35.958976 <... ioctl resumed> , 0x7ffdac3387e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25472] 10:12:35.959992 <... open resumed> ) = 15
[pid 25482] 10:12:35.960031 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25481] 10:12:35.960115 read(8,  <unfinished ...>
[pid 25474] 10:12:35.960148 read(8,  <unfinished ...>
[pid 25473] 10:12:35.960173 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25472] 10:12:35.960197 fstat(15,  <unfinished ...>
[pid 25482] 10:12:35.960228 read(14,  <unfinished ...>
[pid 25481] 10:12:35.960251 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25474] 10:12:35.960270 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25473] 10:12:35.960407 <... lseek resumed> ) = 0
[pid 25472] 10:12:35.960713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25482] 10:12:35.960770 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25481] 10:12:35.960850 brk(0x1cca000 <unfinished ...>
[pid 25474] 10:12:35.960879 brk(0x266e000 <unfinished ...>
[pid 25473] 10:12:35.960900 fstat(13,  <unfinished ...>
[pid 25472] 10:12:35.960924 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.960957 read(14,  <unfinished ...>
[pid 25481] 10:12:35.960981 <... brk resumed> ) = 0x1cca000
[pid 25473] 10:12:35.960995 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2943, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.962101 <... mmap resumed> ) = 0x7ff101080000
[pid 25482] 10:12:35.962141 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25481] 10:12:35.962182 read(8,  <unfinished ...>
[pid 25473] 10:12:35.962205 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.962229 read(15,  <unfinished ...>
[pid 25482] 10:12:35.962261 read(14,  <unfinished ...>
[pid 25473] 10:12:35.962285 <... fcntl resumed> ) = 0
[pid 25472] 10:12:35.962362 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25482] 10:12:35.962403 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25473] 10:12:35.962567 read(13,  <unfinished ...>
[pid 25472] 10:12:35.962599 close(15 <unfinished ...>
[pid 25482] 10:12:35.962632 read(14,  <unfinished ...>
[pid 25481] 10:12:35.962656 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25474] 10:12:35.962674 <... brk resumed> ) = 0x266e000
[pid 25473] 10:12:35.962893 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2943
[pid 25472] 10:12:35.963411 <... close resumed> ) = 0
[pid 25482] 10:12:35.963536 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25481] 10:12:35.963578 brk(0x1ceb000 <unfinished ...>
[pid 25473] 10:12:35.963601 read(13,  <unfinished ...>
[pid 25472] 10:12:35.963746 munmap(0x7ff101080000, 4096 <unfinished ...>
[pid 25482] 10:12:35.963788 read(14,  <unfinished ...>
[pid 25473] 10:12:35.963813 <... read resumed> "", 8192) = 0
[pid 25472] 10:12:35.963839 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.963876 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25473] 10:12:35.963978 close(13 <unfinished ...>
[pid 25472] 10:12:35.964008 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25482] 10:12:35.964044 read(14,  <unfinished ...>
[pid 25473] 10:12:35.964068 <... close resumed> ) = 0
[pid 25472] 10:12:35.964125 <... open resumed> ) = 15
[pid 25482] 10:12:35.964153 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25473] 10:12:35.964245 stat("/etc/userdomains",  <unfinished ...>
[pid 25472] 10:12:35.964553 fstat(15,  <unfinished ...>
[pid 25482] 10:12:35.964586 read(14,  <unfinished ...>
[pid 25481] 10:12:35.964611 <... brk resumed> ) = 0x1ceb000
[pid 25473] 10:12:35.964625 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25472] 10:12:35.965544 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25482] 10:12:35.965600 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25473] 10:12:35.965702 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25472] 10:12:35.965737 fstat(15,  <unfinished ...>
[pid 25482] 10:12:35.965766 read(14,  <unfinished ...>
[pid 25473] 10:12:35.965790 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25472] 10:12:35.965831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25482] 10:12:35.965866 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25473] 10:12:35.965960 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25472] 10:12:35.965991 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:35.966024 read(14,  <unfinished ...>
[pid 25473] 10:12:35.966048 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25472] 10:12:35.966107 <... mmap resumed> ) = 0x7ff101080000
[pid 25482] 10:12:35.966134 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25473] 10:12:35.966168 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25472] 10:12:35.967008 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25482] 10:12:35.967045 read(14,  <unfinished ...>
[pid 25474] 10:12:35.967069 read(8,  <unfinished ...>
[pid 25473] 10:12:35.967090 <... open resumed> ) = 13
[pid 25472] 10:12:35.967110 <... lseek resumed> ) = 0
[pid 25482] 10:12:35.967135 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25473] 10:12:35.967234 fstat(13,  <unfinished ...>
[pid 25472] 10:12:35.967262 read(15,  <unfinished ...>
[pid 25482] 10:12:35.967291 read(14,  <unfinished ...>
[pid 25473] 10:12:35.967315 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25472] 10:12:35.967347 <... read resumed> "", 4096) = 0
[pid 25482] 10:12:35.967384 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25473] 10:12:35.967595 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.967635 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.967669 read(14,  <unfinished ...>
[pid 25473] 10:12:35.967693 <... mmap resumed> ) = 0x7f7c15ca4000
[pid 25472] 10:12:35.967710 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.967757 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25473] 10:12:35.967850 read(13,  <unfinished ...>
[pid 25472] 10:12:35.967887 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.967920 read(14,  <unfinished ...>
[pid 25473] 10:12:35.967944 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25472] 10:12:35.967975 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.968021 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25473] 10:12:35.968111 close(13 <unfinished ...>
[pid 25472] 10:12:35.968141 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.968173 read(14,  <unfinished ...>
[pid 25473] 10:12:35.968197 <... close resumed> ) = 0
[pid 25472] 10:12:35.968213 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.968263 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25473] 10:12:35.968343 munmap(0x7f7c15ca4000, 4096 <unfinished ...>
[pid 25472] 10:12:35.968377 stat("/etc/userdomains",  <unfinished ...>
[pid 25482] 10:12:35.968410 read(14,  <unfinished ...>
[pid 25473] 10:12:35.968433 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.968457 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25482] 10:12:35.968589 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25473] 10:12:35.968678 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25472] 10:12:35.968710 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.968740 read(14,  <unfinished ...>
[pid 25473] 10:12:35.968764 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25472] 10:12:35.968793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.968849 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25473] 10:12:35.968881 pipe( <unfinished ...>
[pid 25472] 10:12:35.968909 write(8, "2015-12-30 10:12:35 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25482] 10:12:35.968948 read(14,  <unfinished ...>
[pid 25473] 10:12:35.968971 <... pipe resumed> [13, 14]) = 0
[pid 25472] 10:12:35.968989 <... write resumed> ) = 101
[pid 25482] 10:12:35.969013 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25473] 10:12:35.969088 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25472] 10:12:35.969122 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.969153 read(14,  <unfinished ...>
[pid 25473] 10:12:35.969177 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25472] 10:12:35.969198 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.969242 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25473] 10:12:35.969274 close(10 <unfinished ...>
[pid 25472] 10:12:35.969300 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.969336 read(14,  <unfinished ...>
[pid 25473] 10:12:35.969360 <... close resumed> ) = 0
[pid 25472] 10:12:35.969376 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.969412 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25473] 10:12:35.969491 munmap(0x7f7c15ca7000, 4096 <unfinished ...>
[pid 25472] 10:12:35.969526 close(7 <unfinished ...>
[pid 25482] 10:12:35.969557 read(14,  <unfinished ...>
[pid 25473] 10:12:35.969582 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.969600 <... close resumed> ) = 0
[pid 25482] 10:12:35.969624 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25473] 10:12:35.969704 close(11 <unfinished ...>
[pid 25472] 10:12:35.970077 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25482] 10:12:35.970127 read(14,  <unfinished ...>
[pid 25481] 10:12:35.970153 read(8,  <unfinished ...>
[pid 25473] 10:12:35.970173 <... close resumed> ) = 0
[pid 25472] 10:12:35.970190 <... open resumed> ) = 7
[pid 25482] 10:12:35.970214 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25473] 10:12:35.970288 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25472] 10:12:35.970305 fcntl(7, F_GETFD <unfinished ...>
[pid 25482] 10:12:35.970321 read(14,  <unfinished ...>
[pid 25473] 10:12:35.970331 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.970341 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.970354 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25473] 10:12:35.970379 close(12 <unfinished ...>
[pid 25472] 10:12:35.970390 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:35.970404 read(14,  <unfinished ...>
[pid 25473] 10:12:35.970414 <... close resumed> ) = 0
[pid 25472] 10:12:35.970422 <... fcntl resumed> ) = 0
[pid 25482] 10:12:35.970435 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25473] 10:12:35.970660 munmap(0x7f7c15ca5000, 4096 <unfinished ...>
[pid 25472] 10:12:35.970697 fstat(7,  <unfinished ...>
[pid 25482] 10:12:35.970727 read(14,  <unfinished ...>
[pid 25473] 10:12:35.970751 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.970769 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5374498, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.970813 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25474] 10:12:35.970869 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25473] 10:12:35.970889 close(9 <unfinished ...>
[pid 25472] 10:12:35.971020 write(7, "2015-12-30 10:12:35 [25472] 1aEJMZ-0006cf-8U ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25482] 10:12:35.971061 brk(0x1f55000 <unfinished ...>
[pid 25474] 10:12:35.971085 brk(0x268f000 <unfinished ...>
[pid 25473] 10:12:35.971105 <... close resumed> ) = 0
[pid 25472] 10:12:35.971121 <... write resumed> ) = 110
[pid 25482] 10:12:35.971144 <... brk resumed> ) = 0x1f55000
[pid 25473] 10:12:35.971207 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25472] 10:12:35.971238 close(14 <unfinished ...>
[pid 25482] 10:12:35.971268 read(14,  <unfinished ...>
[pid 25473] 10:12:35.971296 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.971315 <... close resumed> ) = 0
[pid 25482] 10:12:35.971339 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25474] 10:12:35.971418 <... brk resumed> ) = 0x268f000
[pid 25473] 10:12:35.971435 clone( <unfinished ...>
[pid 25472] 10:12:35.972063 munmap(0x7ff101081000, 4096 <unfinished ...>
[pid 25482] 10:12:35.972104 read(14,  <unfinished ...>
[pid 25472] 10:12:35.972132 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.972156 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25473] 10:12:35.972253 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25490
[pid 25472] 10:12:35.972294 close(15 <unfinished ...>
[pid 25482] 10:12:35.972327 read(14,  <unfinished ...>
[pid 25473] 10:12:35.972351 close(14 <unfinished ...>
[pid 25472] 10:12:35.972373 <... close resumed> ) = 0
[pid 25482] 10:12:35.972394 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25473] 10:12:35.972498 <... close resumed> ) = 0
[pid 25472] 10:12:35.972519 munmap(0x7ff101080000, 4096 <unfinished ...>
[pid 25482] 10:12:35.972553 read(14,  <unfinished ...>
[pid 25473] 10:12:35.972577 read(13,  <unfinished ...>
[pid 25472] 10:12:35.972599 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.972620 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25472] 10:12:35.972727 close(10 <unfinished ...>
[pid 25482] 10:12:35.972766 read(14,  <unfinished ...>
[pid 25472] 10:12:35.972790 <... close resumed> ) = 0
[pid 25482] 10:12:35.972810 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25472] 10:12:35.972883 munmap(0x7ff101085000, 4096 <unfinished ...>
[pid 25482] 10:12:35.972916 read(14,  <unfinished ...>
[pid 25472] 10:12:35.972951 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.972976 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25472] 10:12:35.973068 close(11 <unfinished ...>
[pid 25482] 10:12:35.973100 read(14,  <unfinished ...>
[pid 25472] 10:12:35.973124 <... close resumed> ) = 0
[pid 25482] 10:12:35.973143 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25472] 10:12:35.973228 munmap(0x7ff101084000, 4096 <unfinished ...>
[pid 25482] 10:12:35.973262 read(14,  <unfinished ...>
[pid 25472] 10:12:35.973287 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.973309 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25472] 10:12:35.973390 close(9 <unfinished ...>
[pid 25482] 10:12:35.973421 read(14,  <unfinished ...>
[pid 25472] 10:12:35.973446 <... close resumed> ) = 0
[pid 25482] 10:12:35.973550 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25472] 10:12:35.973704 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25482] 10:12:35.973746 read(14,  <unfinished ...>
[pid 25472] 10:12:35.973775 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.974399 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25481] 10:12:35.974588 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25474] 10:12:35.974623 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.974761 close(13 <unfinished ...>
[pid 25482] 10:12:35.974800 read(14,  <unfinished ...>
[pid 25481] 10:12:35.974829 brk(0x1d0c000 <unfinished ...>
[pid 25472] 10:12:35.974851 <... close resumed> ) = 0
[pid 25482] 10:12:35.974871 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25472] 10:12:35.974961 munmap(0x7ff101082000, 4096 <unfinished ...>
[pid 25482] 10:12:35.974996 read(14,  <unfinished ...>
[pid 25472] 10:12:35.975021 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.975043 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25472] 10:12:35.975153 close(12 <unfinished ...>
[pid 25482] 10:12:35.975185 read(14,  <unfinished ...>
[pid 25472] 10:12:35.975209 <... close resumed> ) = 0
[pid 25482] 10:12:35.975228 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25472] 10:12:35.975309 munmap(0x7ff101083000, 4096 <unfinished ...>
[pid 25482] 10:12:35.975347 read(14,  <unfinished ...>
[pid 25472] 10:12:35.975371 <... munmap resumed> ) = 0
[pid 25482] 10:12:35.975412 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25472] 10:12:35.975562 geteuid( <unfinished ...>
[pid 25482] 10:12:35.975598 read(14,  <unfinished ...>
[pid 25472] 10:12:35.975621 <... geteuid resumed> ) = 0
[pid 25482] 10:12:35.975641 <... read resumed> "", 4096) = 0
[pid 25472] 10:12:35.975671 getegid( <unfinished ...>
[pid 25482] 10:12:35.975698 close(14 <unfinished ...>
[pid 25472] 10:12:35.975735 <... getegid resumed> ) = 12
[pid 25482] 10:12:35.975764 <... close resumed> ) = 0
[pid 25481] 10:12:35.975786 <... brk resumed> ) = 0x1d0c000
[pid 25472] 10:12:35.975800 setgid(12 <unfinished ...>
[pid 25482] 10:12:35.975830 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25472] 10:12:35.975858 <... setgid resumed> ) = 0
[pid 25482] 10:12:35.975878 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.976692 setuid(47 <unfinished ...>
[pid 25482] 10:12:35.977524 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.977574 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.977598 <... setuid resumed> ) = 0
[pid 25482] 10:12:35.977625 <... open resumed> ) = 14
[pid 25472] 10:12:35.977644 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff0fec866a0},  <unfinished ...>
[pid 25482] 10:12:35.977677 fstat(14,  <unfinished ...>
[pid 25472] 10:12:35.977700 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25482] 10:12:35.977741 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.977782 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25482] 10:12:35.977880 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25472] 10:12:35.977938 <... write resumed> ) = 36
[pid 25482] 10:12:35.977968 <... mmap resumed> ) = 0x7fdec5ab6000
[pid 25472] 10:12:35.977987 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.978017 read(14,  <unfinished ...>
[pid 25472] 10:12:35.978073 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.978116 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          238696 kB\nCached:           331752 kB\nBuffers:               0 kB\nActive:           311108 kB\nInactive:         467444 kB\nActive(anon):     177000 kB\nInactive(anon):   277604 kB\nActive(file):     134108 kB\nInac"..., 1024) = 588
[pid 25472] 10:12:35.978148 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:35.978178 close(14 <unfinished ...>
[pid 25472] 10:12:35.978206 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25482] 10:12:35.978240 <... close resumed> ) = 0
[pid 25472] 10:12:35.978257 close(7 <unfinished ...>
[pid 25482] 10:12:35.978284 munmap(0x7fdec5ab6000, 4096 <unfinished ...>
[pid 25472] 10:12:35.978313 <... close resumed> ) = 0
[pid 25482] 10:12:35.978341 <... munmap resumed> ) = 0
[pid 25472] 10:12:35.978723 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25472] 10:12:35.978781 fcntl(7, F_GETFD) = 0
[pid 25472] 10:12:35.978821 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25472] 10:12:35.978859 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5374608, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.978906 write(7, "2015-12-30 10:12:35 [25472] 1aEJMZ-0006cf-8U Frozen (delivery error message)\n", 77) = 77
[pid 25472] 10:12:35.978948 open("/var/spool/exim/input/Z/hdr.25472", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25472] 10:12:35.979034 fchown(9, 47, 12) = 0
[pid 25472] 10:12:35.979073 fchmod(9, 0640) = 0
[pid 25472] 10:12:35.979109 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25472] 10:12:35.979144 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064856, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.979189 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff101086000
[pid 25472] 10:12:35.979226 lseek(9, 0, SEEK_CUR) = 0
[pid 25472] 10:12:35.979591 write(9, "1aEJMZ-0006cf-8U-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491955\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25472] 10:12:35.979647 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064856, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25472] 10:12:35.979700 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMZ-0006cf-8U\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:35 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691) = 691
[pid 25472] 10:12:35.979757 fsync(9 <unfinished ...>
[pid 25482] 10:12:35.980054 alarm(300 <unfinished ...>
[pid 25481] 10:12:35.980082 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.980100 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:35.980120 <... alarm resumed> ) = 0
[pid 25481] 10:12:35.980137 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25482] 10:12:35.980191 brk(0x1f76000 <unfinished ...>
[pid 25474] 10:12:35.980215 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25482] 10:12:35.980251 <... brk resumed> ) = 0x1f76000
[pid 25481] 10:12:35.980267 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.980325 <... fsync resumed> ) = 0
[pid 25482] 10:12:35.980357 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2s\17\251\3530PM6\335VT\361\366\255X\241A\275V\304\357\202{z\302\272\264\265\356\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25481] 10:12:35.980413 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25474] 10:12:35.980445 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.980529 fstat(9,  <unfinished ...>
[pid 25482] 10:12:35.980566 <... write resumed> ) = 258
[pid 25481] 10:12:35.980586 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.980607 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.980635 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064856, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25482] 10:12:35.980671 read(11,  <unfinished ...>
[pid 25481] 10:12:35.980694 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25474] 10:12:35.980727 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.980744 close(9 <unfinished ...>
[pid 25481] 10:12:35.980784 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.980799 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.980834 <... close resumed> ) = 0
[pid 25481] 10:12:35.980856 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25474] 10:12:35.980883 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.980897 munmap(0x7ff101086000, 4096 <unfinished ...>
[pid 25481] 10:12:35.980935 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.980950 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.980977 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.981003 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25474] 10:12:35.981030 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981045 rename("/var/spool/exim/input/Z/hdr.25472", "/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-H" <unfinished ...>
[pid 25481] 10:12:35.981130 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981146 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.981179 <... rename resumed> ) = 0
[pid 25481] 10:12:35.981202 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25474] 10:12:35.981239 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981253 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25481] 10:12:35.981295 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981310 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.981340 <... open resumed> ) = 9
[pid 25481] 10:12:35.981362 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25474] 10:12:35.981391 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981405 fsync(9 <unfinished ...>
[pid 25481] 10:12:35.981436 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981450 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.981487 <... fsync resumed> ) = 0
[pid 25481] 10:12:35.981509 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25474] 10:12:35.981538 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981554 close(9 <unfinished ...>
[pid 25481] 10:12:35.981587 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981602 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.981630 <... close resumed> ) = 0
[pid 25481] 10:12:35.981652 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25474] 10:12:35.981680 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981701 close(8 <unfinished ...>
[pid 25481] 10:12:35.981740 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981759 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.981796 <... close resumed> ) = 0
[pid 25481] 10:12:35.981820 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25474] 10:12:35.981852 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.981867 munmap(0x7ff101087000, 4096 <unfinished ...>
[pid 25481] 10:12:35.981903 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.981918 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25472] 10:12:35.981948 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.981977 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25474] 10:12:35.982008 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25472] 10:12:35.982023 unlink("/var/spool/exim/input/Z/1aEJMZ-0006cf-8U-J" <unfinished ...>
[pid 25481] 10:12:35.982060 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25474] 10:12:35.982087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25472] 10:12:35.982119 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.982142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.982173 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25472] 10:12:35.982196 close(6 <unfinished ...>
[pid 25481] 10:12:35.982219 <... open resumed> ) = 9
[pid 25474] 10:12:35.982225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25472] 10:12:35.982233 <... close resumed> ) = 0
[pid 25472] 10:12:35.982371 exit_group(0) = ?
[pid 25472] 10:12:35.983125 +++ exited with 0 +++
[pid 25481] 10:12:35.983170 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.983199 <... open resumed> ) = 9
[pid 25481] 10:12:35.983215 <... ioctl resumed> , 0x7ffeeb177fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.983238 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.983266 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.983291 <... ioctl resumed> , 0x7fff65a1bc40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.983308 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.983326 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.983383 read(9,  <unfinished ...>
[pid 25474] 10:12:35.983412 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.983428 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25474] 10:12:35.983531 read(9,  <unfinished ...>
[pid 25481] 10:12:35.983750 brk(0x1d2d000 <unfinished ...>
[pid 25474] 10:12:35.983783 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25481] 10:12:35.983812 <... brk resumed> ) = 0x1d2d000
[pid 25474] 10:12:35.984010 brk(0x26b0000 <unfinished ...>
[pid 25481] 10:12:35.984470 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.984503 <... brk resumed> ) = 0x26b0000
[pid 25481] 10:12:35.984520 <... lseek resumed> ) = 4868
[pid 25474] 10:12:35.984970 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.985013 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.985040 <... lseek resumed> ) = 4868
[pid 25481] 10:12:35.985057 <... lseek resumed> ) = 4868
[pid 25474] 10:12:35.985074 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.985101 close(9 <unfinished ...>
[pid 25474] 10:12:35.985127 <... lseek resumed> ) = 4868
[pid 25481] 10:12:35.985143 <... close resumed> ) = 0
[pid 25474] 10:12:35.985161 close(9 <unfinished ...>
[pid 25481] 10:12:35.985206 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25474] 10:12:35.985238 <... close resumed> ) = 0
[pid 25481] 10:12:35.985254 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985289 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25481] 10:12:35.985334 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25474] 10:12:35.985368 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985386 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985405 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25481] 10:12:35.985437 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25474] 10:12:35.985532 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985555 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985578 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25481] 10:12:35.985608 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25474] 10:12:35.985635 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985651 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985669 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25481] 10:12:35.985701 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25474] 10:12:35.985729 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985745 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985770 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25481] 10:12:35.985807 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25474] 10:12:35.985838 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985859 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985878 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25481] 10:12:35.985911 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25474] 10:12:35.985943 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.985960 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.985981 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25481] 10:12:35.986013 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25474] 10:12:35.986044 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.986061 <... stat resumed> 0x7ffeeb1781d0) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.986079 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25481] 10:12:35.986120 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25474] 10:12:35.986151 <... stat resumed> 0x7fff65a1be50) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.986168 <... stat resumed> 0x7ffeeb178270) = -1 ENOENT (No such file or directory)
[pid 25474] 10:12:35.986189 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25481] 10:12:35.986220 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25474] 10:12:35.986251 <... stat resumed> 0x7fff65a1bef0) = -1 ENOENT (No such file or directory)
[pid 25481] 10:12:35.986268 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25474] 10:12:35.986300 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25481] 10:12:35.986333 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.986367 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25481] 10:12:35.986396 <... open resumed> ) = 9
[pid 25474] 10:12:35.986415 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25481] 10:12:35.986450 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25474] 10:12:35.986482 <... open resumed> ) = 9
[pid 25481] 10:12:35.986498 <... ioctl resumed> , 0x7ffeeb177fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25474] 10:12:35.986520 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25481] 10:12:35.986548 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.986573 <... ioctl resumed> , 0x7fff65a1bc40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25481] 10:12:35.986589 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.986607 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.986651 read(9,  <unfinished ...>
[pid 25474] 10:12:35.986679 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.986695 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25474] 10:12:35.986733 read(9,  <unfinished ...>
[pid 25481] 10:12:35.987186 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.987218 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25481] 10:12:35.987241 <... lseek resumed> ) = 2366
[pid 25474] 10:12:35.987821 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.987869 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.987901 <... lseek resumed> ) = 2366
[pid 25481] 10:12:35.987918 <... lseek resumed> ) = 2366
[pid 25474] 10:12:35.987936 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.987963 close(9 <unfinished ...>
[pid 25474] 10:12:35.987989 <... lseek resumed> ) = 2366
[pid 25481] 10:12:35.988005 <... close resumed> ) = 0
[pid 25474] 10:12:35.988023 close(9 <unfinished ...>
[pid 25481] 10:12:35.988351 read(8,  <unfinished ...>
[pid 25474] 10:12:35.988382 <... close resumed> ) = 0
[pid 25481] 10:12:35.988399 <... read resumed> "", 8192) = 0
[pid 25474] 10:12:35.988708 read(8,  <unfinished ...>
[pid 25481] 10:12:35.988771 close(8 <unfinished ...>
[pid 25474] 10:12:35.988805 <... read resumed> "", 8192) = 0
[pid 25481] 10:12:35.988828 <... close resumed> ) = 0
[pid 25474] 10:12:35.988849 close(8 <unfinished ...>
[pid 25481] 10:12:35.989084 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.989114 <... close resumed> ) = 0
[pid 25474] 10:12:35.989325 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25474] 10:12:35.989378 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.989429 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f84e3f4f000
[pid 25474] 10:12:35.989536 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.989594 close(8)    = 0
[pid 25481] 10:12:35.989638 <... open resumed> ) = 8
[pid 25474] 10:12:35.989653 munmap(0x7f84e3f4f000, 4096 <unfinished ...>
[pid 25481] 10:12:35.989687 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.989713 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.989728 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25474] 10:12:35.989806 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25481] 10:12:35.989839 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.989868 <... lseek resumed> ) = 19
[pid 25481] 10:12:35.989884 <... mmap resumed> ) = 0x7f04ce1d2000
[pid 25474] 10:12:35.989902 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.989936 read(8,  <unfinished ...>
[pid 25474] 10:12:35.989964 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.989981 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25474] 10:12:35.990003 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990040 close(8 <unfinished ...>
[pid 25474] 10:12:35.990066 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990082 <... close resumed> ) = 0
[pid 25474] 10:12:35.990099 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990128 munmap(0x7f04ce1d2000, 4096 <unfinished ...>
[pid 25474] 10:12:35.990157 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990173 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.990191 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990261 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.990288 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990305 <... lseek resumed> ) = 19
[pid 25474] 10:12:35.990322 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990358 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.990386 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990402 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.990423 alarm(300 <unfinished ...>
[pid 25481] 10:12:35.990451 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.990565 <... alarm resumed> ) = 0
[pid 25481] 10:12:35.990584 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.990602 alarm(0 <unfinished ...>
[pid 25481] 10:12:35.990629 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.990657 <... alarm resumed> ) = 300
[pid 25481] 10:12:35.990673 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.990690 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990719 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.990746 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990761 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.990778 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990807 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.990834 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990849 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.990867 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990898 alarm(300 <unfinished ...>
[pid 25474] 10:12:35.990923 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.990939 <... alarm resumed> ) = 0
[pid 25474] 10:12:35.990956 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.990984 alarm(0 <unfinished ...>
[pid 25474] 10:12:35.991009 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.991024 <... alarm resumed> ) = 300
[pid 25474] 10:12:35.991042 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f84e2e07790},  <unfinished ...>
[pid 25481] 10:12:35.991070 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.991097 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25481] 10:12:35.991112 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.991133 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25481] 10:12:35.991162 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.991189 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0}, 8) = 0
[pid 25481] 10:12:35.991208 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.991226 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25481] 10:12:35.991254 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.991284 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0}, 8) = 0
[pid 25481] 10:12:35.991302 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.991327 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.991358 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.991385 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.991415 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.991444 open("/var/spool/exim/input/Z/hdr.25474", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25481] 10:12:35.991591 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f04cd08a790},  <unfinished ...>
[pid 25474] 10:12:35.991624 <... open resumed> ) = 8
[pid 25481] 10:12:35.991641 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25474] 10:12:35.991659 fchown(8, 47, 12 <unfinished ...>
[pid 25481] 10:12:35.991693 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.991721 <... fchown resumed> ) = 0
[pid 25481] 10:12:35.991737 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0}, 8) = 0
[pid 25474] 10:12:35.991763 fchmod(8, 0640 <unfinished ...>
[pid 25481] 10:12:35.991793 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.991821 <... fchmod resumed> ) = 0
[pid 25481] 10:12:35.991836 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0}, 8) = 0
[pid 25474] 10:12:35.991858 fcntl(8, F_GETFL <unfinished ...>
[pid 25481] 10:12:35.991890 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.991917 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25481] 10:12:35.991934 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.991968 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.992006 open("/var/spool/exim/input/Z/hdr.25481", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25474] 10:12:35.992058 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.992090 <... open resumed> ) = 8
[pid 25474] 10:12:35.992107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.992137 fchown(8, 47, 12 <unfinished ...>
[pid 25474] 10:12:35.992165 <... mmap resumed> ) = 0x7f84e3f4f000
[pid 25481] 10:12:35.992182 <... fchown resumed> ) = 0
[pid 25474] 10:12:35.992199 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25481] 10:12:35.992226 fchmod(8, 0640 <unfinished ...>
[pid 25474] 10:12:35.992252 <... lseek resumed> ) = 0
[pid 25481] 10:12:35.992268 <... fchmod resumed> ) = 0
[pid 25474] 10:12:35.992301 write(8, "1aEJMZ-0006cs-RM-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 474 <unfinished ...>
[pid 25481] 10:12:35.992346 fcntl(8, F_GETFL <unfinished ...>
[pid 25474] 10:12:35.992372 <... write resumed> ) = 474
[pid 25481] 10:12:35.992388 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25474] 10:12:35.992406 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.992437 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.992534 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=474, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.992570 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.992605 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006cs-RM; Wed, 30 Dec 2015 10:12:35 -0600\n118T To:  VHuerta@ncghotels.com, aepperson@ncghotels.com, SCarrol"..., 601 <unfinished ...>
[pid 25481] 10:12:35.992639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.992667 <... write resumed> ) = 601
[pid 25481] 10:12:35.992682 <... mmap resumed> ) = 0x7f04ce1d2000
[pid 25474] 10:12:35.992701 fsync(8 <unfinished ...>
[pid 25481] 10:12:35.992770 lseek(8, 0, SEEK_CUR) = 0
[pid 25481] 10:12:35.992850 write(8, "1aEJMZ-0006cz-RM-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268Process 25490 attached
 <unfinished ...>
[pid 25490] 10:12:35.993020 set_robust_list(0x7f7c15c92aa0, 24) = 0
[pid 25481] 10:12:35.993064 <... write resumed> ) = 268
[pid 25490] 10:12:35.993106 close(13 <unfinished ...>
[pid 25481] 10:12:35.993138 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.993162 <... fsync resumed> ) = 0
[pid 25490] 10:12:35.993179 <... close resumed> ) = 0
[pid 25481] 10:12:35.993194 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25490] 10:12:35.993234 geteuid( <unfinished ...>
[pid 25474] 10:12:35.993265 fstat(8,  <unfinished ...>
[pid 25490] 10:12:35.993291 <... geteuid resumed> ) = 0
[pid 25481] 10:12:35.993304 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMZ-0006cz-RM\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:35 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691 <unfinished ...>
[pid 25490] 10:12:35.993341 getegid( <unfinished ...>
[pid 25474] 10:12:35.993369 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1075, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25490] 10:12:35.993403 <... getegid resumed> ) = 12
[pid 25481] 10:12:35.993420 <... write resumed> ) = 691
[pid 25490] 10:12:35.993442 setgid(500 <unfinished ...>
[pid 25474] 10:12:35.993547 close(8 <unfinished ...>
[pid 25490] 10:12:35.993582 <... setgid resumed> ) = 0
[pid 25481] 10:12:35.993596 fsync(8 <unfinished ...>
[pid 25490] 10:12:35.993646 setuid(503 <unfinished ...>
[pid 25474] 10:12:35.993674 <... close resumed> ) = 0
[pid 25490] 10:12:35.993691 <... setuid resumed> ) = 0
[pid 25474] 10:12:35.993716 munmap(0x7f84e3f4f000, 4096 <unfinished ...>
[pid 25490] 10:12:35.993808 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.993844 <... munmap resumed> ) = 0
[pid 25490] 10:12:35.993866 <... open resumed> ) = 9
[pid 25481] 10:12:35.993887 <... fsync resumed> ) = 0
[pid 25490] 10:12:35.993913 fstat(9,  <unfinished ...>
[pid 25474] 10:12:35.993938 rename("/var/spool/exim/input/Z/hdr.25474", "/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-H" <unfinished ...>
[pid 25490] 10:12:35.993990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25481] 10:12:35.994019 fstat(8,  <unfinished ...>
[pid 25490] 10:12:35.994083 brk(0x1113000 <unfinished ...>
[pid 25474] 10:12:35.994107 <... rename resumed> ) = 0
[pid 25490] 10:12:35.994124 <... brk resumed> ) = 0x1113000
[pid 25481] 10:12:35.994141 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25490] 10:12:35.994240 fstat(9,  <unfinished ...>
[pid 25474] 10:12:35.994268 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25490] 10:12:35.994302 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25481] 10:12:35.994328 close(8 <unfinished ...>
[pid 25490] 10:12:35.994359 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.994386 <... open resumed> ) = 8
[pid 25490] 10:12:35.994409 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25481] 10:12:35.994425 <... close resumed> ) = 0
[pid 25490] 10:12:35.994444 read(9,  <unfinished ...>
[pid 25474] 10:12:35.994484 fsync(8 <unfinished ...>
[pid 25490] 10:12:35.994512 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25481] 10:12:35.994530 munmap(0x7f04ce1d2000, 4096 <unfinished ...>
[pid 25490] 10:12:35.994563 read(9,  <unfinished ...>
[pid 25474] 10:12:35.994591 <... fsync resumed> ) = 0
[pid 25490] 10:12:35.994608 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25481] 10:12:35.994630 <... munmap resumed> ) = 0
[pid 25490] 10:12:35.994652 close(9 <unfinished ...>
[pid 25474] 10:12:35.994683 close(8 <unfinished ...>
[pid 25490] 10:12:35.994710 <... close resumed> ) = 0
[pid 25481] 10:12:35.994731 rename("/var/spool/exim/input/Z/hdr.25481", "/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-H" <unfinished ...>
[pid 25490] 10:12:35.994786 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25474] 10:12:35.994814 <... close resumed> ) = 0
[pid 25490] 10:12:35.994831 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.994848 <... rename resumed> ) = 0
[pid 25490] 10:12:35.995258 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25474] 10:12:35.995292 fstat(6,  <unfinished ...>
[pid 25481] 10:12:35.995319 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25474] 10:12:35.995354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.995391 <... open resumed> ) = 8
[pid 25474] 10:12:35.995429 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cs-RM", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25481] 10:12:35.995650 fsync(8 <unfinished ...>
[pid 25474] 10:12:35.995683 <... open resumed> ) = 8
[pid 25481] 10:12:35.995700 <... fsync resumed> ) = 0
[pid 25474] 10:12:35.995720 fcntl(8, F_GETFL <unfinished ...>
[pid 25481] 10:12:35.995750 close(8 <unfinished ...>
[pid 25474] 10:12:35.995776 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25481] 10:12:35.995794 <... close resumed> ) = 0
[pid 25474] 10:12:35.995812 fstat(8,  <unfinished ...>
[pid 25481] 10:12:35.995841 fstat(6,  <unfinished ...>
[pid 25474] 10:12:35.995865 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.995894 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.995923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25481] 10:12:35.995965 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cz-RM", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25474] 10:12:35.996016 <... mmap resumed> ) = 0x7f84e3f4f000
[pid 25481] 10:12:35.996035 <... open resumed> ) = 8
[pid 25474] 10:12:35.996054 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25490] 10:12:35.996085 <... lseek resumed> ) = 19
[pid 25481] 10:12:35.996099 fcntl(8, F_GETFL <unfinished ...>
[pid 25490] 10:12:35.996126 read(6,  <unfinished ...>
[pid 25474] 10:12:35.996148 <... lseek resumed> ) = 0
[pid 25490] 10:12:35.996170 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2426) = 1858
[pid 25481] 10:12:35.996194 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25474] 10:12:35.996536 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.996580 fstat(8,  <unfinished ...>
[pid 25474] 10:12:35.996606 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.996636 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064880, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.996674 write(8, "2015-12-30 10:12:35 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2420 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148 <unfinished ...>
[pid 25481] 10:12:35.996715 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25474] 10:12:35.996747 <... write resumed> ) = 148
[pid 25481] 10:12:35.996763 <... mmap resumed> ) = 0x7f04ce1d2000
[pid 25474] 10:12:35.996781 close(8 <unfinished ...>
[pid 25481] 10:12:35.996809 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25474] 10:12:35.996835 <... close resumed> ) = 0
[pid 25481] 10:12:35.996851 <... lseek resumed> ) = 0
[pid 25474] 10:12:35.996868 munmap(0x7f84e3f4f000, 4096 <unfinished ...>
[pid 25481] 10:12:35.996901 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.996930 <... munmap resumed> ) = 0
[pid 25481] 10:12:35.996945 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.996979 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.997018 write(8, "2015-12-30 10:12:35 Received from <> R=1aEJMY-0006bs-1f U=mailnull P=local S=3777 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142 <unfinished ...>
[pid 25474] 10:12:35.997053 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.997082 <... write resumed> ) = 142
[pid 25474] 10:12:35.997110 stat("/etc/localtime",  <unfinished ...>
[pid 25481] 10:12:35.997141 close(8 <unfinished ...>
[pid 25474] 10:12:35.997167 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25481] 10:12:35.997194 <... close resumed> ) = 0
[pid 25474] 10:12:35.997215 close(7 <unfinished ...>
[pid 25490] 10:12:35.997447 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25481] 10:12:35.997547 munmap(0x7f04ce1d2000, 4096 <unfinished ...>
[pid 25474] 10:12:35.997580 <... close resumed> ) = 0
[pid 25481] 10:12:35.997597 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.997618 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25481] 10:12:35.997660 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.997689 <... open resumed> ) = 7
[pid 25481] 10:12:35.997705 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.997744 fcntl(7, F_GETFD <unfinished ...>
[pid 25481] 10:12:35.997783 stat("/etc/localtime",  <unfinished ...>
[pid 25474] 10:12:35.997811 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.997826 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25474] 10:12:35.997855 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25481] 10:12:35.997888 close(7 <unfinished ...>
[pid 25474] 10:12:35.997914 <... fcntl resumed> ) = 0
[pid 25481] 10:12:35.997930 <... close resumed> ) = 0
[pid 25474] 10:12:35.997947 fstat(7,  <unfinished ...>
[pid 25481] 10:12:35.997976 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25474] 10:12:35.998007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5374685, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25481] 10:12:35.998035 <... open resumed> ) = 7
[pid 25474] 10:12:35.998053 write(7, "2015-12-30 10:12:35 [25474] 1aEJMZ-0006cs-RM <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2420 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for VHuerta@ncghotels.com aepperson@ncghotels.com S"..., 353 <unfinished ...>
[pid 25481] 10:12:35.998089 fcntl(7, F_GETFD <unfinished ...>
[pid 25474] 10:12:35.998113 <... write resumed> ) = 353
[pid 25481] 10:12:35.998129 <... fcntl resumed> ) = 0
[pid 25490] 10:12:35.998159 <... write resumed> ) = 4
[pid 25474] 10:12:35.998175 close(6 <unfinished ...>
[pid 25473] 10:12:35.998202 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25490] 10:12:35.998228 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25481] 10:12:35.998252 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25474] 10:12:35.998274 <... close resumed> ) = 0
[pid 25473] 10:12:35.998287 read(13,  <unfinished ...>
[pid 25490] 10:12:35.998320 <... write resumed> ) = 4
[pid 25481] 10:12:35.998333 <... fcntl resumed> ) = 0
[pid 25474] 10:12:35.998348 munmap(0x7f84e3f50000, 4096 <unfinished ...>
[pid 25473] 10:12:35.998375 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25490] 10:12:35.998399 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25481] 10:12:35.998422 fstat(7,  <unfinished ...>
[pid 25474] 10:12:35.998444 <... munmap resumed> ) = 0
[pid 25473] 10:12:35.998457 read(13,  <unfinished ...>
[pid 25490] 10:12:35.998569 <... write resumed> ) = 4
[pid 25481] 10:12:35.998583 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5375038, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25474] 10:12:35.998612 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25473] 10:12:35.998640 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25490] 10:12:35.998666 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25481] 10:12:35.998693 write(7, "2015-12-30 10:12:35 [25481] 1aEJMZ-0006cz-RM <= <> R=1aEJMY-0006bs-1f U=mailnull P=local S=3777 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204 <unfinished ...>
[pid 25474] 10:12:35.998724 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0}, 8) = 0
[pid 25473] 10:12:35.998741 read(13,  <unfinished ...>
[pid 25490] 10:12:35.998775 <... write resumed> ) = 40
[pid 25481] 10:12:35.998789 <... write resumed> ) = 204
[pid 25474] 10:12:35.998805 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0},  <unfinished ...>
[pid 25473] 10:12:35.998832 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25490] 10:12:35.998868 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25481] 10:12:35.998896 close(6 <unfinished ...>
[pid 25474] 10:12:35.998922 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f84e1b506a0}, 8) = 0
[pid 25473] 10:12:35.998939 read(13,  <unfinished ...>
[pid 25490] 10:12:35.998971 <... write resumed> ) = 4
[pid 25481] 10:12:35.998984 <... close resumed> ) = 0
[pid 25474] 10:12:35.998999 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25473] 10:12:35.999038 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25490] 10:12:35.999062 close(14 <unfinished ...>
[pid 25481] 10:12:35.999085 munmap(0x7f04ce1d3000, 4096 <unfinished ...>
[pid 25474] 10:12:35.999111 <... open resumed> ) = 6
[pid 25473] 10:12:35.999125 wait4(-1,  <unfinished ...>
[pid 25490] 10:12:35.999156 <... close resumed> ) = 0
[pid 25481] 10:12:35.999169 <... munmap resumed> ) = 0
[pid 25474] 10:12:35.999195 read(6,  <unfinished ...>
[pid 25490] 10:12:35.999230 exit_group(0) = ?
[pid 25481] 10:12:35.999244 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25490] 10:12:35.999548 +++ exited with 0 +++
[pid 25481] 10:12:35.999562 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0}, 8) = 0
[pid 25474] 10:12:35.999579 <... read resumed> "0.18 0.08 0.01 2/251 25490\n", 40) = 27
[pid 25473] 10:12:35.999596 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25490
[pid 25481] 10:12:35.999621 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0},  <unfinished ...>
[pid 25474] 10:12:35.999649 close(6 <unfinished ...>
[pid 25473] 10:12:35.999674 close(13 <unfinished ...>
[pid 25481] 10:12:35.999704 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f04cbdd36a0}, 8) = 0
[pid 25474] 10:12:35.999725 <... close resumed> ) = 0
[pid 25473] 10:12:35.999741 <... close resumed> ) = 0
[pid 25481] 10:12:35.999776 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25474] 10:12:35.999807 clone( <unfinished ...>
[pid 25473] 10:12:36.000031 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25481] 10:12:36.000068 <... open resumed> ) = 6
[pid 25473] 10:12:36.000083 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25481] 10:12:36.000133 read(6,  <unfinished ...>
[pid 25474] 10:12:36.000163 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f84e3f3aa90) = 25491
[pid 25473] 10:12:36.000180 stat("/etc/userdomains",  <unfinished ...>
[pid 25481] 10:12:36.000424 <... read resumed> "0.18 0.08 0.01 3/251 25491\n", 40) = 27
[pid 25474] 10:12:36.000442 exit_group(0) = ?
[pid 25473] 10:12:36.000458 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25481] 10:12:36.000882 close(6 <unfinished ...>
[pid 25474] 10:12:36.000911 +++ exited with 0 +++
[pid 25473] 10:12:36.000924 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25389] 10:12:36.000952 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25474
[pid 25481] 10:12:36.000978 <... close resumed> ) = 0
[pid 25473] 10:12:36.000991 <... open resumed> ) = 9
[pid 25389] 10:12:36.001019 munmap(0x7ff3d4f3d000, 4096 <unfinished ...>
[pid 25481] 10:12:36.001055 clone( <unfinished ...>
[pid 25473] 10:12:36.001307 fstat(9,  <unfinished ...>
[pid 25389] 10:12:36.001335 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.001512 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.001563 pipe2( <unfinished ...>
[pid 25481] 10:12:36.001599 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f04ce1bda90) = 25492
[pid 25473] 10:12:36.001615 fstat(9,  <unfinished ...>
[pid 25389] 10:12:36.001639 <... pipe2 resumed> [5, 6], O_CLOEXEC) = 0
[pid 25473] 10:12:36.001662 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.001691 clone( <unfinished ...>
[pid 25473] 10:12:36.002239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca8000
[pid 25389] 10:12:36.002282 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25493
[pid 25473] 10:12:36.002322 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25389] 10:12:36.002350 close(5 <unfinished ...>
[pid 25473] 10:12:36.002377 <... lseek resumed> ) = 0
[pid 25389] 10:12:36.002394 <... close resumed> ) = 0
[pid 25473] 10:12:36.002415 read(9,  <unfinished ...>
[pid 25389] 10:12:36.002442 fcntl(6, F_SETFD, 0 <unfinished ...>
[pid 25473] 10:12:36.002716 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25481] 10:12:36.002759 exit_group(0) = ?
[pid 25389] 10:12:36.002777 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.002800 stat("/etc/userdomains",  <unfinished ...>
[pid 25389] 10:12:36.002828 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.002855 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.003108 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167951, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25481] 10:12:36.003171 +++ exited with 0 +++
[pid 25473] 10:12:36.003186 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:36.003212 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25481
[pid 25389] 10:12:36.003233 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.003265 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:36.003326 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0},  <unfinished ...>
[pid 25389] 10:12:36.003361 <... mmap resumed> ) = 0x7ff3d4f3d000
[pid 25473] 10:12:36.003393 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25425] 10:12:36.003427 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f380b0246a0}, 8) = 0
[pid 25389] 10:12:36.003536 write(6, "To:  ljacques@westernskiesgolf.com, westernsky@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type"..., 2091 <unfinished ...>
[pid 25473] 10:12:36.003588 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:36.003614 write(8, "2015-12-30 10:12:35 hiltongardeninn@finestweddingsites.com: children all complete\n", 82 <unfinished ...>
[pid 25389] 10:12:36.003647 <... write resumed> ) = 2091
[pid 25473] 10:12:36.003674 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:36.003703 <... write resumed> ) = 82
[pid 25389] 10:12:36.003727 close(6 <unfinished ...>
[pid 25473] 10:12:36.003756 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.003794 open("/var/spool/exim/input/Y/hdr.25425", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25389] 10:12:36.003856 <... close resumed> ) = 0
[pid 25473] 10:12:36.003879 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25425] 10:12:36.003908 <... open resumed> ) = 10
[pid 25389] 10:12:36.003924 wait4(25493,  <unfinished ...>
[pid 25473] 10:12:36.003950 <... open resumed> ) = 10
[pid 25425] 10:12:36.003966 fchown(10, 47, 12 <unfinished ...>
[pid 25473] 10:12:36.003997 fstat(10,  <unfinished ...>
[pid 25425] 10:12:36.004020 <... fchown resumed> ) = 0
[pid 25473] 10:12:36.004039 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.004071 fchmod(10, 0640 <unfinished ...>
[pid 25473] 10:12:36.004101 fstat(10,  <unfinished ...>
[pid 25425] 10:12:36.004123 <... fchmod resumed> ) = 0
[pid 25473] 10:12:36.004142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.004170 fcntl(10, F_GETFL <unfinished ...>
[pid 25473] 10:12:36.004196 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:36.004221 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25473] 10:12:36.004247 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25425] 10:12:36.004265 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.004291 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:36.004314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800134, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.004344 <... lseek resumed> ) = 0
[pid 25425] 10:12:36.004361 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.004390 read(10,  <unfinished ...>
[pid 25425] 10:12:36.004416 <... mmap resumed> ) = 0x7f380d424000
[pid 25473] 10:12:36.004436 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25425] 10:12:36.004497 lseek(10, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.004530 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25425] 10:12:36.004559 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.004593 <... open resumed> ) = 11
[pid 25425] 10:12:36.004613 write(10, "1aEJMY-0006bs-1f-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 722 <unfinished ...>
[pid 25473] 10:12:36.004655 fstat(11,  <unfinished ...>
[pid 25425] 10:12:36.004679 <... write resumed> ) = 722
[pid 25473] 10:12:36.004698 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25425] 10:12:36.004731 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.004757 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:36.004783 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800134, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=722, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.004819 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25425] 10:12:36.004836 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006bs-1f; Wed, 30 Dec 2015 10:12:34 -0600\n071T To:  tracy.thompson@hilton.com, hiltongardeninn@finestweddin"..., 554 <unfinished ...>
[pid 25473] 10:12:36.004869 read(11,  <unfinished ...>
[pid 25425] 10:12:36.004894 <... write resumed> ) = 554
[pid 25473] 10:12:36.004922 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25425] 10:12:36.004953 fsync(10 <unfinished ...>
[pid 25473] 10:12:36.005015 close(11)   = 0
[pid 25473] 10:12:36.005051 munmap(0x7f7c15ca6000, 4096) = 0
[pid 25473] 10:12:36.005196 open("/etc/localdomains", O_RDONLY) = 11
[pid 25473] 10:12:36.005239 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.005271 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.005299 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca6000
[pid 25425] 10:12:36.005324 <... fsync resumed> ) = 0
[pid 25473] 10:12:36.005336 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:36.005345 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.005357 <... lseek resumed> ) = 0
[pid 25425] 10:12:36.005366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124800134, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1276, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.005388 read(11,  <unfinished ...>
[pid 25425] 10:12:36.005401 close(10 <unfinished ...>
[pid 25473] 10:12:36.005416 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25425] 10:12:36.005441 <... close resumed> ) = 0
[pid 25473] 10:12:36.005648 stat("/jail_owner",  <unfinished ...>
[pid 25425] 10:12:36.005684 munmap(0x7f380d424000, 4096 <unfinished ...>
[pid 25473] 10:12:36.005717 <... stat resumed> 0x7ffdac33b840) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:36.005741 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.005768 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:36.005804 rename("/var/spool/exim/input/Y/hdr.25425", "/var/spool/exim/input/Y/1aEJMY-0006bs-1f-H" <unfinished ...>
[pid 25473] 10:12:36.005888 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:36.005932 <... rename resumed> ) = 0
[pid 25473] 10:12:36.005955 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassytempe_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25425] 10:12:36.005988 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25473] 10:12:36.006022 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:36.006047 <... open resumed> ) = 10
[pid 25473] 10:12:36.006068 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25425] 10:12:36.006096 fsync(10 <unfinished ...>
[pid 25473] 10:12:36.006122 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25425] 10:12:36.006154 <... fsync resumed> ) = 0
[pid 25473] 10:12:36.006174 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassytempe/config.pck",  <unfinished ...>
[pid 25425] 10:12:36.006203 close(10 <unfinished ...>
[pid 25473] 10:12:36.006231 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25425] 10:12:36.006252 <... close resumed> ) = 0
[pid 25473] 10:12:36.006277 stat("/etc/demouids",  <unfinished ...>
[pid 25425] 10:12:36.006304 unlink("/var/spool/exim/msglog/Y/1aEJMY-0006bs-1f" <unfinished ...>
[pid 25473] 10:12:36.006347 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:36.006390 <... unlink resumed> ) = 0
[pid 25473] 10:12:36.006415 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25425] 10:12:36.006444 unlink("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-D" <unfinished ...>
[pid 25473] 10:12:36.006489 <... open resumed> ) = 12
[pid 25425] 10:12:36.006506 <... unlink resumed> ) = 0
[pid 25473] 10:12:36.006527 fstat(12,  <unfinished ...>
[pid 25425] 10:12:36.006550 unlink("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-H" <unfinished ...>
[pid 25473] 10:12:36.006605 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:36.006638 <... unlink resumed> ) = 0
[pid 25473] 10:12:36.006668 fstat(12,  <unfinished ...>
[pid 25425] 10:12:36.006694 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.006723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:36.006750 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.006790 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:36.006819 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.006848 <... mmap resumed> ) = 0x7f7c15ca5000
[pid 25425] 10:12:36.006865 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.006898 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:36.006922 close(7 <unfinished ...>
[pid 25473] 10:12:36.006951 <... lseek resumed> ) = 0
[pid 25425] 10:12:36.006968 <... close resumed> ) = 0
[pid 25473] 10:12:36.006996 read(12,  <unfinished ...>
[pid 25425] 10:12:36.007021 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25473] 10:12:36.007056 <... read resumed> "", 4096) = 0
[pid 25425] 10:12:36.007081 <... open resumed> ) = 7
[pid 25473] 10:12:36.007103 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25425] 10:12:36.007132 fcntl(7, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.007159 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25425] 10:12:36.007275 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.007303 stat("/etc/userdomains",  <unfinished ...>
[pid 25425] 10:12:36.007332 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.007362 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25425] 10:12:36.007404 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.007418 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25425] 10:12:36.007432 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.007445 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.007613 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5375242, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.007653 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25425] 10:12:36.007683 write(7, "2015-12-30 10:12:36 [25425] 1aEJMY-0006bs-1f Completed QT=2s\n", 61 <unfinished ...>
[pid 25473] 10:12:36.007718 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.007755 <... write resumed> ) = 61
[pid 25473] 10:12:36.007783 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25425] 10:12:36.007814 close(8 <unfinished ...>
[pid 25473] 10:12:36.007860 <... open resumed> ) = 13
[pid 25425] 10:12:36.007878 <... close resumed> ) = 0
[pid 25473] 10:12:36.007898 fstat(13,  <unfinished ...>
[pid 25425] 10:12:36.007921 munmap(0x7f380d425000, 4096 <unfinished ...>
[pid 25473] 10:12:36.007952 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.007984 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.008006 fstat(13,  <unfinished ...>
[pid 25425] 10:12:36.008029 close(9 <unfinished ...>
[pid 25473] 10:12:36.008057 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25425] 10:12:36.008084 <... close resumed> ) = 0
[pid 25473] 10:12:36.008106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25425] 10:12:36.008133 unlink("/var/spool/exim/input/Y/1aEJMY-0006bs-1f-J" <unfinished ...>
[pid 25473] 10:12:36.008193 <... mmap resumed> ) = 0x7f7c15ca4000
[pid 25425] 10:12:36.008212 <... unlink resumed> ) = 0
[pid 25473] 10:12:36.008232 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25425] 10:12:36.008261 close(6 <unfinished ...>
[pid 25473] 10:12:36.008311 <... lseek resumed> ) = 0
[pid 25425] 10:12:36.008329 <... close resumed> ) = 0
[pid 25473] 10:12:36.008503 read(13,  <unfinished ...>
[pid 25425] 10:12:36.008538 exit_group(0) = ?
[pid 25473] 10:12:36.010589 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25425] 10:12:36.010629 +++ exited with 0 +++
[pid 25473] 10:12:36.010647 read(13, "", 4096) = 0
[pid 25473] 10:12:36.010700 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.010770 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25473] 10:12:36.010830 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25473] 10:12:36.010904 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25473] 10:12:36.010948 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.010994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca3000
[pid 25473] 10:12:36.011031 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.011083 close(14)   = 0
[pid 25473] 10:12:36.011119 munmap(0x7f7c15ca3000, 4096) = 0
[pid 25473] 10:12:36.011165 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25473] 10:12:36.011217 pipe([14, 15]) = 0
[pid 25473] 10:12:36.011255 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25473] 10:12:36.011296 close(12)   = 0
[pid 25473] 10:12:36.011331 munmap(0x7f7c15ca5000, 4096) = 0
[pid 25473] 10:12:36.011368 close(9)    = 0
[pid 25473] 10:12:36.011402 munmap(0x7f7c15ca8000, 4096) = 0
[pid 25473] 10:12:36.011442 close(11)   = 0
[pid 25473] 10:12:36.011490 munmap(0x7f7c15ca6000, 4096) = 0
[pid 25473] 10:12:36.011527 close(13)   = 0
[pid 25473] 10:12:36.011562 munmap(0x7f7c15ca4000, 4096) = 0
[pid 25473] 10:12:36.011598 close(10)   = 0
[pid 25473] 10:12:36.011631 munmap(0x7f7c15ca7000, 4096) = 0
[pid 25473] 10:12:36.011670 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25494
[pid 25473] 10:12:36.011928 close(15)   = 0
[pid 25473] 10:12:36.011965 read(14, Process 25493 attached
 <unfinished ...>
[pid 25493] 10:12:36.012028 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25493] 10:12:36.012080 close(6)    = 0
[pid 25493] 10:12:36.012117 dup2(5, 0)  = 0
[pid 25493] 10:12:36.012152 close(5)    = 0
[pid 25493] 10:12:36.012198 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25493] 10:12:36.012807 brk(0)      = 0x1bf7000
[pid 25493] 10:12:36.012867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9003779000
[pid 25493] 10:12:36.012918 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.012972 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25493] 10:12:36.013014 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25493] 10:12:36.013063 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f900376f000
[pid 25493] 10:12:36.013101 close(5)    = 0
[pid 25493] 10:12:36.013145 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25493] 10:12:36.013190 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.013234 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25493] 10:12:36.013284 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f900333a000
[pid 25493] 10:12:36.013326 mprotect(0x7f9003357000, 2093056, PROT_NONE) = 0
[pid 25493] 10:12:36.013366 mmap(0x7f9003556000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f9003556000
[pid 25493] 10:12:36.013412 mmap(0x7f900355a000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f900355a000
[pid 25493] 10:12:36.013526 close(5)    = 0
[pid 25493] 10:12:36.013585 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25493] 10:12:36.013630 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.013672 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.013723 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f9003136000
[pid 25493] 10:12:36.013763 mprotect(0x7f9003138000, 2097152, PROT_NONE) = 0
[pid 25493] 10:12:36.013801 mmap(0x7f9003338000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f9003338000
[pid 25493] 10:12:36.013850 close(5)    = 0
[pid 25493] 10:12:36.013892 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25493] 10:12:36.013936 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.013979 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.014026 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f900376e000
[pid 25493] 10:12:36.014068 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f9002da2000
[pid 25493] 10:12:36.014107 mprotect(0x7f9002f2c000, 2097152, PROT_NONE) = 0
[pid 25493] 10:12:36.014145 mmap(0x7f900312c000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f900312c000
[pid 25493] 10:12:36.014189 mmap(0x7f9003131000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9003131000
[pid 25493] 10:12:36.014234 close(5)    = 0
[pid 25493] 10:12:36.014291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f900376d000
Process 25492 attached
[pid 25493] 10:12:36.014355 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.014395 set_robust_list(0x7f04ce1bdaa0, 24 <unfinished ...>
[pid 25493] 10:12:36.014423 <... mmap resumed> ) = 0x7f900376c000
[pid 25493] 10:12:36.014445 arch_prctl(ARCH_SET_FS, 0x7f900376d700) = 0
[pid 25493] 10:12:36.014572 mprotect(0x7f900312c000, 16384, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.014604 <... set_robust_list resumed> ) = 0
[pid 25492] 10:12:36.014641 close(0)    = 0
[pid 25492] 10:12:36.014683 close(1)    = 0
[pid 25492] 10:12:36.014718 close(2)    = 0
[pid 25492] 10:12:36.014800 setsid( <unfinished ...>
[pid 25493] 10:12:36.014832 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.014853 <... setsid resumed> ) = 25492
[pid 25492] 10:12:36.014877 fstat(0,  <unfinished ...>
[pid 25493] 10:12:36.014908 mprotect(0x7f9003338000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.014934 <... fstat resumed> 0x7ffeeb17caf0) = -1 EBADF (Bad file descriptor)
[pid 25493] 10:12:36.014957 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.014985 open("/dev/null", O_RDWR <unfinished ...>
[pid 25493] 10:12:36.015060 mprotect(0x7f900377a000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.015096 <... open resumed> ) = 0
[pid 25492] 10:12:36.015117 fstat(1, 0x7ffeeb17caf0) = -1 EBADF (Bad file descriptor)
[pid 25492] 10:12:36.015158 dup2(0, 1)  = 1
[pid 25492] 10:12:36.015193 fstat(2, 0x7ffeeb17caf0) = -1 EBADF (Bad file descriptor)
[pid 25492] 10:12:36.015227 dup2(0, 2)  = 2
[pid 25492] 10:12:36.015260 geteuid()   = 47
[pid 25492] 10:12:36.015300 fstat(0,  <unfinished ...>
[pid 25493] 10:12:36.015330 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.015349 munmap(0x7f900376f000, 39387 <unfinished ...>
[pid 25492] 10:12:36.015376 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25493] 10:12:36.015415 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.015436 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25492] 10:12:36.015605 fstat(2,  <unfinished ...>
[pid 25493] 10:12:36.015664 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25492] 10:12:36.015692 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25492] 10:12:36.015729 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMZ-0006cz-RM"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25493] 10:12:36.016312 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25493] 10:12:36.016353 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25493] 10:12:36.016406 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc7fd92870) = -1 EINVAL (Invalid argument)
[pid 25493] 10:12:36.016548 brk(0)      = 0x1bf7000
[pid 25493] 10:12:36.016629 brk(0x1c18000) = 0x1c18000
[pid 25493] 10:12:36.016688 getuid()    = 503
[pid 25493] 10:12:36.016724 getgid()    = 500
[pid 25493] 10:12:36.016758 geteuid()   = 503
[pid 25493] 10:12:36.016791 getegid()   = 500
[pid 25493] 10:12:36.016833 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25493] 10:12:36.016905 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 5
[pid 25493] 10:12:36.016961 fstat(5, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.017011 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9003778000
[pid 25493] 10:12:36.017049 read(5, "MemTotal:        1048576 kB\nMemFree:          247532 kB\nCached:           331840 kB\nBuffers:               0 kB\nActive:           302872 kB\nInactive:         467468 kB\nActive(anon):     168700 kB\nInactive(anon):   277604 kB\nActive(file):     134172 kB\nInac"..., 1024) = 588
[pid 25493] 10:12:36.017133 close(5)    = 0
[pid 25493] 10:12:36.017172 munmap(0x7f9003778000, 4096) = 0
[pid 25493] 10:12:36.017243 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25493] 10:12:36.017289 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, 8) = 0
[pid 25493] 10:12:36.017331 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25493] 10:12:36.017370 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, 8) = 0
[pid 25493] 10:12:36.017408 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25493] 10:12:36.017445 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, 8) = 0
[pid 25493] 10:12:36.017564 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25493] 10:12:36.017606 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f9002dd46a0}, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, 8) = 0
[pid 25493] 10:12:36.017648 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25493] 10:12:36.017730 getcwd("/home/finest09/public_html/includes", 4096) = 36
[pid 25493] 10:12:36.017780 getpid()    = 25493
[pid 25493] 10:12:36.017824 getppid( <unfinished ...>
[pid 25492] 10:12:36.017866 brk(0 <unfinished ...>
[pid 25493] 10:12:36.017892 <... getppid resumed> ) = 25389
[pid 25493] 10:12:36.017919 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25492] 10:12:36.017970 <... brk resumed> ) = 0x23b1000
[pid 25493] 10:12:36.017996 stat("/bin/sh",  <unfinished ...>
[pid 25492] 10:12:36.018026 fcntl(0, F_GETFD) = 0
[pid 25492] 10:12:36.018059 fcntl(1, F_GETFD) = 0
[pid 25493] 10:12:36.018096 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25492] 10:12:36.018128 fcntl(2, F_GETFD) = 0
[pid 25492] 10:12:36.018167 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25493] 10:12:36.018203 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25492] 10:12:36.018255 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.018276 geteuid()   = 503
[pid 25492] 10:12:36.018322 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.018352 getegid()   = 500
[pid 25493] 10:12:36.018385 getuid()    = 503
[pid 25493] 10:12:36.018418 getgid()    = 500
[pid 25493] 10:12:36.018450 access("/bin/sh", X_OK <unfinished ...>
[pid 25492] 10:12:36.018559 <... mmap resumed> ) = 0x7f638dcb0000
[pid 25493] 10:12:36.018584 <... access resumed> ) = 0
[pid 25492] 10:12:36.018618 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25493] 10:12:36.018649 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25493] 10:12:36.018699 geteuid()   = 503
[pid 25493] 10:12:36.018732 getegid()   = 500
[pid 25492] 10:12:36.018768 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.018788 getuid()    = 503
[pid 25493] 10:12:36.018822 getgid( <unfinished ...>
[pid 25492] 10:12:36.018855 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.018883 <... getgid resumed> ) = 500
[pid 25493] 10:12:36.018902 access("/bin/sh", R_OK) = 0
[pid 25492] 10:12:36.018948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.018970 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25493] 10:12:36.019020 stat("/bin/sh",  <unfinished ...>
[pid 25492] 10:12:36.019046 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25493] 10:12:36.019076 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25492] 10:12:36.019109 <... stat resumed> 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019130 geteuid( <unfinished ...>
[pid 25492] 10:12:36.019155 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.019182 <... geteuid resumed> ) = 503
[pid 25492] 10:12:36.019204 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019223 getegid()   = 500
[pid 25492] 10:12:36.019255 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25493] 10:12:36.019282 getuid( <unfinished ...>
[pid 25492] 10:12:36.019309 <... stat resumed> 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019329 <... getuid resumed> ) = 503
[pid 25493] 10:12:36.019347 getgid( <unfinished ...>
[pid 25492] 10:12:36.019374 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.019400 <... getgid resumed> ) = 500
[pid 25493] 10:12:36.019418 access("/bin/sh", X_OK <unfinished ...>
[pid 25492] 10:12:36.019450 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019546 <... access resumed> ) = 0
[pid 25492] 10:12:36.019569 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019609 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25492] 10:12:36.019664 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.019692 geteuid( <unfinished ...>
[pid 25492] 10:12:36.019722 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019741 <... geteuid resumed> ) = 503
[pid 25493] 10:12:36.019760 getegid()   = 500
[pid 25492] 10:12:36.019793 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25493] 10:12:36.019819 getuid( <unfinished ...>
[pid 25492] 10:12:36.019847 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25493] 10:12:36.019877 <... getuid resumed> ) = 503
[pid 25493] 10:12:36.019896 getgid( <unfinished ...>
[pid 25492] 10:12:36.019921 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.019948 <... getgid resumed> ) = 500
[pid 25492] 10:12:36.019978 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.019997 access("/bin/sh", R_OK) = 0
[pid 25493] 10:12:36.020050 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.020079 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.020120 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.020154 <... socket resumed> ) = 5
[pid 25492] 10:12:36.020179 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020199 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25492] 10:12:36.020228 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25493] 10:12:36.020266 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.020291 <... stat resumed> 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.020311 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020355 close(5)    = 0
[pid 25492] 10:12:36.020393 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25493] 10:12:36.020423 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.020455 <... stat resumed> 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020568 <... socket resumed> ) = 5
[pid 25492] 10:12:36.020590 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020635 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.020679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25493] 10:12:36.020706 close(5 <unfinished ...>
[pid 25492] 10:12:36.020743 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25493] 10:12:36.020778 <... close resumed> ) = 0
[pid 25493] 10:12:36.020805 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.020833 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020884 <... open resumed> ) = 5
[pid 25492] 10:12:36.020904 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.020946 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.020973 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.021013 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25493] 10:12:36.021044 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9003778000
[pid 25492] 10:12:36.021082 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.021122 read(5, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25492] 10:12:36.021164 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.021218 read(5,  <unfinished ...>
[pid 25492] 10:12:36.021245 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffc8d385830) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.021284 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.021325 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.021348 close(5)    = 0
[pid 25492] 10:12:36.021386 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25493] 10:12:36.021437 munmap(0x7f9003778000, 4096) = 0
[pid 25492] 10:12:36.021557 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.021597 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.021629 <... open resumed> ) = 6
[pid 25492] 10:12:36.021648 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25492] 10:12:36.021694 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.021724 <... open resumed> ) = 5
[pid 25492] 10:12:36.021745 <... mmap resumed> ) = 0x7f638dca6000
[pid 25493] 10:12:36.021765 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.021790 close(6 <unfinished ...>
[pid 25493] 10:12:36.021815 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25492] 10:12:36.021845 <... close resumed> ) = 0
[pid 25493] 10:12:36.021864 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25492] 10:12:36.021899 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.021928 <... mmap resumed> ) = 0x7f900376f000
[pid 25493] 10:12:36.021947 close(5)    = 0
[pid 25493] 10:12:36.021988 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.022024 <... open resumed> ) = 6
[pid 25492] 10:12:36.022043 read(6,  <unfinished ...>
[pid 25493] 10:12:36.022076 <... open resumed> ) = 5
[pid 25492] 10:12:36.022096 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.022130 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.022177 read(5,  <unfinished ...>
[pid 25492] 10:12:36.022203 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.022232 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.022259 <... mmap resumed> ) = 0x7f638d878000
[pid 25493] 10:12:36.022279 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.022326 mprotect(0x7f638d88e000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.022359 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25492] 10:12:36.022390 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.022409 mmap(0x7f638da8e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25493] 10:12:36.022439 <... mmap resumed> ) = 0x7f9002b94000
[pid 25492] 10:12:36.022570 <... mmap resumed> ) = 0x7f638da8e000
[pid 25493] 10:12:36.022599 mprotect(0x7f9002ba0000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.022632 mmap(0x7f638da90000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.022665 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.022685 mmap(0x7f9002da0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25492] 10:12:36.022716 <... mmap resumed> ) = 0x7f638da90000
[pid 25493] 10:12:36.022738 <... mmap resumed> ) = 0x7f9002da0000
[pid 25492] 10:12:36.022763 close(6 <unfinished ...>
[pid 25493] 10:12:36.022799 close(5 <unfinished ...>
[pid 25492] 10:12:36.022825 <... close resumed> ) = 0
[pid 25492] 10:12:36.022849 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.022933 <... close resumed> ) = 0
[pid 25493] 10:12:36.022969 mprotect(0x7f9002da0000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.023004 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.023025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.023072 <... mprotect resumed> ) = 0
Process 25491 attached
[pid 25493] 10:12:36.023118 munmap(0x7f900376f000, 39387 <unfinished ...>
[pid 25492] 10:12:36.023146 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.023198 set_robust_list(0x7f84e3f3aaa0, 24 <unfinished ...>
[pid 25493] 10:12:36.023232 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.023254 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.023295 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.023331 <... open resumed> ) = 6
[pid 25491] 10:12:36.023350 <... set_robust_list resumed> ) = 0
[pid 25491] 10:12:36.023391 close(0 <unfinished ...>
[pid 25493] 10:12:36.023433 <... open resumed> ) = 5
[pid 25492] 10:12:36.023454 read(6,  <unfinished ...>
[pid 25493] 10:12:36.023537 fcntl(5, F_GETFD <unfinished ...>
[pid 25492] 10:12:36.023567 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.023594 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.023620 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25492] 10:12:36.023640 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.023676 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.023703 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dca5000
[pid 25493] 10:12:36.023741 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.023777 <... close resumed> ) = 0
[pid 25492] 10:12:36.023801 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.023829 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9003778000
[pid 25491] 10:12:36.023866 close(1 <unfinished ...>
[pid 25493] 10:12:36.023892 read(5,  <unfinished ...>
[pid 25492] 10:12:36.023920 <... mmap resumed> ) = 0x7f638d65f000
[pid 25491] 10:12:36.023940 <... close resumed> ) = 0
[pid 25493] 10:12:36.023963 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.023987 close(2 <unfinished ...>
[pid 25492] 10:12:36.024013 mprotect(0x7f638d675000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.024039 <... close resumed> ) = 0
[pid 25492] 10:12:36.024061 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.024094 close(5 <unfinished ...>
[pid 25491] 10:12:36.024173 setsid( <unfinished ...>
[pid 25492] 10:12:36.024199 mmap(0x7f638d874000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f638d874000
[pid 25492] 10:12:36.024245 mmap(0x7f638d876000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.024276 <... close resumed> ) = 0
[pid 25493] 10:12:36.024295 munmap(0x7f9003778000, 4096 <unfinished ...>
[pid 25492] 10:12:36.024323 <... mmap resumed> ) = 0x7f638d876000
[pid 25493] 10:12:36.024347 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.024374 close(6 <unfinished ...>
[pid 25493] 10:12:36.024541 getpgrp( <unfinished ...>
[pid 25482] 10:12:36.024564 <... read resumed> "\26\3\0037}\2\0", 7) = 7
[pid 25482] 10:12:36.024630 read(11, "\0M\3\3V\204\2sG\271\0374U\257 \34\7\243\v\330^\2\2269\240ww\356\265}#m\356_\251\372 Z%\0\0\350\277R<\316\203j\276+E\225\r\314(\233\366\241\32\270\354J4\224\225\316\266\367.\300(\0\0\5\377\1\0\1\0\v\0\22B\0\22?\0\7%0\202\7!0\202\6\t\240\3\2\1\2\2\nh\225I\360\0\1\0\0\337\2760\r\6\t*\206H\206\367\r\1\1\5\5\0000\201\2001\0230\21\6\n\t\222&\211\223\362,d\1\31\26\3com1\0310\27\6\n\t\222&\211\223\362,d\1\31\26\tmicrosoft1\0240\22\6\n\t\222&\211\223\362,d\1\31\26\4corp1\0270\25\6\n\t\222&\211\223\362,d\1\31\26\7redmond1\0370\35\6\3U\4\3\23\26MSIT Machine Auth "..., 14203) = 2889
[pid 25482] 10:12:36.024686 read(11,  <unfinished ...>
[pid 25492] 10:12:36.024717 <... close resumed> ) = 0
[pid 25492] 10:12:36.024742 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.024787 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.024831 <... setsid resumed> ) = 25491
[pid 25491] 10:12:36.024855 fstat(0,  <unfinished ...>
[pid 25492] 10:12:36.024881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.024922 <... fstat resumed> 0x7fff65a20770) = -1 EBADF (Bad file descriptor)
[pid 25493] 10:12:36.024943 <... getpgrp resumed> ) = 29163
[pid 25491] 10:12:36.024965 open("/dev/null", O_RDWR <unfinished ...>
[pid 25493] 10:12:36.024994 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, 8) = 0
[pid 25492] 10:12:36.025040 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.025074 <... open resumed> ) = 0
[pid 25493] 10:12:36.025097 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25492] 10:12:36.025131 <... open resumed> ) = 6
[pid 25491] 10:12:36.025152 fstat(1,  <unfinished ...>
[pid 25493] 10:12:36.025178 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25493] 10:12:36.025253 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25491] 10:12:36.025284 <... fstat resumed> 0x7fff65a20770) = -1 EBADF (Bad file descriptor)
[pid 25491] 10:12:36.025311 dup2(0, 1 <unfinished ...>
[pid 25492] 10:12:36.025338 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.025383 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.025410 <... dup2 resumed> ) = 1
[pid 25492] 10:12:36.025430 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.025541 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.025587 fstat(2,  <unfinished ...>
[pid 25492] 10:12:36.025618 <... mmap resumed> ) = 0x7f638d428000
[pid 25491] 10:12:36.025638 <... fstat resumed> 0x7fff65a20770) = -1 EBADF (Bad file descriptor)
[pid 25491] 10:12:36.025658 dup2(0, 2 <unfinished ...>
[pid 25492] 10:12:36.025685 mprotect(0x7f638d42f000, 2097152, PROT_NONE) = 0
[pid 25491] 10:12:36.025720 <... dup2 resumed> ) = 2
[pid 25492] 10:12:36.025743 mmap(0x7f638d62f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25491] 10:12:36.025794 geteuid(Process 25494 attached
 <unfinished ...>
[pid 25493] 10:12:36.025851 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25492] 10:12:36.025872 <... mmap resumed> ) = 0x7f638d62f000
[pid 25491] 10:12:36.025893 <... geteuid resumed> ) = 47
[pid 25494] 10:12:36.025919 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25493] 10:12:36.025959 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25492] 10:12:36.025981 mmap(0x7f638d631000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25494] 10:12:36.026014 <... set_robust_list resumed> ) = 0
[pid 25493] 10:12:36.026028 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25491] 10:12:36.026068 fstat(0,  <unfinished ...>
[pid 25494] 10:12:36.026108 close(14 <unfinished ...>
[pid 25493] 10:12:36.026131 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25492] 10:12:36.026152 <... mmap resumed> ) = 0x7f638d631000
[pid 25494] 10:12:36.026170 <... close resumed> ) = 0
[pid 25493] 10:12:36.026190 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25491] 10:12:36.026216 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25494] 10:12:36.026304 geteuid( <unfinished ...>
[pid 25493] 10:12:36.026331 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0},  <unfinished ...>
[pid 25492] 10:12:36.026359 close(6 <unfinished ...>
[pid 25494] 10:12:36.026386 <... geteuid resumed> ) = 0
[pid 25493] 10:12:36.026400 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0}, 8) = 0
[pid 25491] 10:12:36.026417 fstat(1,  <unfinished ...>
[pid 25494] 10:12:36.026446 getegid( <unfinished ...>
[pid 25493] 10:12:36.026601 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f9002dd46a0},  <unfinished ...>
[pid 25492] 10:12:36.026630 <... close resumed> ) = 0
[pid 25494] 10:12:36.026649 <... getegid resumed> ) = 12
[pid 25493] 10:12:36.026670 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7f9002dd46a0}, 8) = 0
[pid 25491] 10:12:36.026693 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25494] 10:12:36.026727 setgid(500 <unfinished ...>
[pid 25493] 10:12:36.026752 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0},  <unfinished ...>
[pid 25492] 10:12:36.026776 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25494] 10:12:36.026809 <... setgid resumed> ) = 0
[pid 25493] 10:12:36.026823 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f9002dd46a0}, 8) = 0
[pid 25491] 10:12:36.026842 fstat(2,  <unfinished ...>
[pid 25494] 10:12:36.026874 setuid(503 <unfinished ...>
[pid 25493] 10:12:36.026896 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25492] 10:12:36.027115 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25494] 10:12:36.027142 <... setuid resumed> ) = 0
[pid 25491] 10:12:36.027160 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25494] 10:12:36.027218 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.027258 <... execve resumed> ) = 0
[pid 25492] 10:12:36.027272 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25494] 10:12:36.027324 <... open resumed> ) = 9
[pid 25493] 10:12:36.027340 brk(0 <unfinished ...>
[pid 25491] 10:12:36.027371 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMZ-0006cs-RM"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25494] 10:12:36.028060 fstat(9,  <unfinished ...>
[pid 25493] 10:12:36.028092 <... brk resumed> ) = 0x1e61000
[pid 25492] 10:12:36.028107 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25494] 10:12:36.028131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25493] 10:12:36.028168 fcntl(0, F_GETFD <unfinished ...>
[pid 25494] 10:12:36.028224 brk(0x1113000 <unfinished ...>
[pid 25492] 10:12:36.028248 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.028278 <... execve resumed> ) = 0
[pid 25494] 10:12:36.028296 <... brk resumed> ) = 0x1113000
[pid 25493] 10:12:36.028326 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.028403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25494] 10:12:36.028428 fstat(9,  <unfinished ...>
[pid 25493] 10:12:36.028455 fcntl(1, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.028528 brk(0 <unfinished ...>
[pid 25494] 10:12:36.028557 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25493] 10:12:36.028584 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.028601 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25494] 10:12:36.028637 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.028664 fcntl(2, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.028686 <... brk resumed> ) = 0x15bf000
[pid 25494] 10:12:36.028704 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25493] 10:12:36.028721 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.028736 <... open resumed> ) = 6
[pid 25494] 10:12:36.028760 read(9,  <unfinished ...>
[pid 25493] 10:12:36.028795 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25491] 10:12:36.028822 fcntl(0, F_GETFD <unfinished ...>
[pid 25494] 10:12:36.028849 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25493] 10:12:36.028867 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.028883 read(6,  <unfinished ...>
[pid 25494] 10:12:36.028924 read(9,  <unfinished ...>
[pid 25493] 10:12:36.028950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.028975 <... fcntl resumed> ) = 0
[pid 25494] 10:12:36.028994 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25493] 10:12:36.029014 <... mmap resumed> ) = 0x7f702ac82000
[pid 25492] 10:12:36.029031 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25494] 10:12:36.029064 close(9 <unfinished ...>
[pid 25493] 10:12:36.029090 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25491] 10:12:36.029116 fcntl(1, F_GETFD <unfinished ...>
[pid 25494] 10:12:36.029143 <... close resumed> ) = 0
[pid 25493] 10:12:36.029156 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.029172 fstat(6,  <unfinished ...>
[pid 25494] 10:12:36.029208 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25493] 10:12:36.029234 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.029271 <... fcntl resumed> ) = 0
[pid 25494] 10:12:36.029289 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.029304 <... open resumed> ) = 5
[pid 25492] 10:12:36.029785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25494] 10:12:36.029832 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.029860 fstat(5,  <unfinished ...>
[pid 25491] 10:12:36.029882 fcntl(2, F_GETFD <unfinished ...>
[pid 25494] 10:12:36.029908 <... lseek resumed> ) = 19
[pid 25493] 10:12:36.029922 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25492] 10:12:36.029949 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25494] 10:12:36.029981 read(6,  <unfinished ...>
[pid 25493] 10:12:36.030004 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25491] 10:12:36.030028 <... fcntl resumed> ) = 0
[pid 25494] 10:12:36.030046 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2426) = 1858
[pid 25493] 10:12:36.030071 <... mmap resumed> ) = 0x7f702ac78000
[pid 25492] 10:12:36.030553 <... mmap resumed> ) = 0x7f638d1a4000
[pid 25493] 10:12:36.030585 close(5 <unfinished ...>
[pid 25491] 10:12:36.030611 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25493] 10:12:36.030642 <... close resumed> ) = 0
[pid 25492] 10:12:36.030656 mprotect(0x7f638d227000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.030696 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.030727 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.030746 <... open resumed> ) = 5
[pid 25492] 10:12:36.030774 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.030793 read(5,  <unfinished ...>
[pid 25491] 10:12:36.030817 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.030846 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.030867 mmap(0x7f638d426000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25493] 10:12:36.030901 fstat(5,  <unfinished ...>
[pid 25491] 10:12:36.030924 <... mmap resumed> ) = 0x7f33164fc000
[pid 25493] 10:12:36.030941 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.030983 <... mmap resumed> ) = 0x7f638d426000
[pid 25493] 10:12:36.031006 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25491] 10:12:36.031043 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25493] 10:12:36.031148 <... mmap resumed> ) = 0x7f702a6d0000
[pid 25492] 10:12:36.031164 close(6 <unfinished ...>
[pid 25494] 10:12:36.031193 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25493] 10:12:36.031222 mprotect(0x7f702a85a000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.031248 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.031267 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.031289 <... close resumed> ) = 0
[pid 25493] 10:12:36.031309 mmap(0x7f702aa5a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25491] 10:12:36.031346 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.031380 <... mmap resumed> ) = 0x7f702aa5a000
[pid 25492] 10:12:36.031402 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25494] 10:12:36.031445 <... write resumed> ) = 4
[pid 25493] 10:12:36.031541 mmap(0x7f702aa5f000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.031582 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.031598 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25494] 10:12:36.031627 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25493] 10:12:36.031651 <... mmap resumed> ) = 0x7f702aa5f000
[pid 25492] 10:12:36.031665 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.031686 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.031716 read(14,  <unfinished ...>
[pid 25494] 10:12:36.031747 <... write resumed> ) = 4
[pid 25493] 10:12:36.031760 close(5 <unfinished ...>
[pid 25492] 10:12:36.031783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.031813 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.031828 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25494] 10:12:36.031854 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25493] 10:12:36.031877 <... close resumed> ) = 0
[pid 25492] 10:12:36.031890 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.031917 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.031948 read(14,  <unfinished ...>
[pid 25494] 10:12:36.031979 <... write resumed> ) = 4
[pid 25493] 10:12:36.031993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.032020 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.032049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.032063 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25494] 10:12:36.032091 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25493] 10:12:36.032117 <... mmap resumed> ) = 0x7f702ac77000
[pid 25492] 10:12:36.032130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.032150 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25473] 10:12:36.032181 read(14,  <unfinished ...>
[pid 25494] 10:12:36.032214 <... write resumed> ) = 40
[pid 25493] 10:12:36.032227 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.032253 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.032282 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.032297 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25494] 10:12:36.032323 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25493] 10:12:36.032347 <... mmap resumed> ) = 0x7f702ac76000
[pid 25492] 10:12:36.032362 <... open resumed> ) = 6
[pid 25491] 10:12:36.032380 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.032408 read(14,  <unfinished ...>
[pid 25494] 10:12:36.032439 <... write resumed> ) = 4
[pid 25493] 10:12:36.032457 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.032580 read(6,  <unfinished ...>
[pid 25491] 10:12:36.032604 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.032619 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25494] 10:12:36.032647 close(15 <unfinished ...>
[pid 25493] 10:12:36.032670 <... mmap resumed> ) = 0x7f702ac75000
[pid 25492] 10:12:36.032684 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.032708 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.032737 wait4(-1,  <unfinished ...>
[pid 25494] 10:12:36.032765 <... close resumed> ) = 0
[pid 25493] 10:12:36.032778 arch_prctl(ARCH_SET_FS, 0x7f702ac76700 <unfinished ...>
[pid 25492] 10:12:36.032813 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.032835 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25494] 10:12:36.032854 exit_group(0) = ?
[pid 25493] 10:12:36.032869 <... arch_prctl resumed> ) = 0
[pid 25492] 10:12:36.033142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25494] 10:12:36.033256 +++ exited with 0 +++
[pid 25493] 10:12:36.033272 mprotect(0x7f702aa5a000, 16384, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.033298 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.033323 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.033352 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25494
[pid 25493] 10:12:36.033377 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.033393 <... mmap resumed> ) = 0x7f638dca4000
[pid 25491] 10:12:36.033413 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.033432 close(14 <unfinished ...>
[pid 25493] 10:12:36.033545 mprotect(0x7f702ac83000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.033579 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.033607 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25473] 10:12:36.033634 <... close resumed> ) = 0
[pid 25493] 10:12:36.033657 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.033670 <... mmap resumed> ) = 0x7f638cf96000
[pid 25491] 10:12:36.033685 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25473] 10:12:36.033713 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25493] 10:12:36.033749 munmap(0x7f702ac78000, 39387 <unfinished ...>
[pid 25492] 10:12:36.033775 mprotect(0x7f638cfa2000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.033801 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.033832 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25493] 10:12:36.033879 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.033896 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.033938 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.033961 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.033997 getuid( <unfinished ...>
[pid 25492] 10:12:36.034018 mmap(0x7f638d1a2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25491] 10:12:36.034046 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.034075 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.034123 <... getuid resumed> ) = 503
[pid 25492] 10:12:36.034139 <... mmap resumed> ) = 0x7f638d1a2000
[pid 25491] 10:12:36.034155 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.034179 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.034217 getgid( <unfinished ...>
[pid 25492] 10:12:36.034239 close(6 <unfinished ...>
[pid 25491] 10:12:36.034260 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.034289 <... open resumed> ) = 9
[pid 25493] 10:12:36.034312 <... getgid resumed> ) = 500
[pid 25492] 10:12:36.034326 <... close resumed> ) = 0
[pid 25491] 10:12:36.034341 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.034363 fstat(9,  <unfinished ...>
[pid 25493] 10:12:36.034397 getegid( <unfinished ...>
[pid 25492] 10:12:36.034418 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.034449 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25473] 10:12:36.034582 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.034625 <... getegid resumed> ) = 499
[pid 25492] 10:12:36.034641 <... open resumed> ) = 6
[pid 25491] 10:12:36.034656 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.034673 fstat(9,  <unfinished ...>
[pid 25493] 10:12:36.034703 getppid( <unfinished ...>
[pid 25492] 10:12:36.034724 read(6,  <unfinished ...>
[pid 25491] 10:12:36.034746 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.034776 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.034810 <... getppid resumed> ) = 25389
[pid 25492] 10:12:36.034824 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.034847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.034864 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.034898 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25492] 10:12:36.034927 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.034949 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.034982 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25493] 10:12:36.035005 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25492] 10:12:36.035030 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25491] 10:12:36.035094 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.035115 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.035146 brk(0 <unfinished ...>
[pid 25492] 10:12:36.035168 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.035194 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.035224 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.035247 <... brk resumed> ) = 0x1e61000
[pid 25492] 10:12:36.035261 <... mmap resumed> ) = 0x7f638cd73000
[pid 25491] 10:12:36.035276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.035291 read(9,  <unfinished ...>
[pid 25493] 10:12:36.035325 brk(0x1e82000 <unfinished ...>
[pid 25492] 10:12:36.035347 mprotect(0x7f638cd94000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.035373 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25473] 10:12:36.035404 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25493] 10:12:36.035447 <... brk resumed> ) = 0x1e82000
[pid 25492] 10:12:36.035578 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.035619 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:36.035667 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.035722 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.035762 mmap(0x7f638cf94000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25491] 10:12:36.035807 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.035854 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.035929 <... socket resumed> ) = 5
[pid 25492] 10:12:36.035951 <... mmap resumed> ) = 0x7f638cf94000
[pid 25491] 10:12:36.035968 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.035989 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.036025 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25492] 10:12:36.036059 close(6 <unfinished ...>
[pid 25491] 10:12:36.036081 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.036107 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.036180 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.036200 <... close resumed> ) = 0
[pid 25491] 10:12:36.036216 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.036239 stat("/home/finest09/etc/finestweddingsites.com/embassytempe/filter",  <unfinished ...>
[pid 25493] 10:12:36.036282 close(5 <unfinished ...>
[pid 25492] 10:12:36.036335 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.036380 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.036414 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.036444 <... close resumed> ) = 0
[pid 25492] 10:12:36.036532 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.036555 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.036571 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.036608 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.036634 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.036664 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25473] 10:12:36.036690 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.036737 <... socket resumed> ) = 5
[pid 25492] 10:12:36.036755 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.036771 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.036788 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.036825 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25492] 10:12:36.036856 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.036886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.036913 <... open resumed> ) = 10
[pid 25493] 10:12:36.036936 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.036950 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.036966 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.036983 fstat(10,  <unfinished ...>
[pid 25493] 10:12:36.037014 close(5 <unfinished ...>
[pid 25492] 10:12:36.037037 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.037067 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25473] 10:12:36.037093 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.037130 <... close resumed> ) = 0
[pid 25492] 10:12:36.037144 <... open resumed> ) = 6
[pid 25491] 10:12:36.037169 <... stat resumed> 0x7ffc8619c230) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.037186 fstat(10,  <unfinished ...>
[pid 25493] 10:12:36.037217 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.037243 read(6,  <unfinished ...>
[pid 25491] 10:12:36.037266 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.037293 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.037332 <... open resumed> ) = 5
[pid 25492] 10:12:36.037346 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.037374 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.037392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.037427 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.037449 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.037575 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25473] 10:12:36.037604 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25493] 10:12:36.037628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25492] 10:12:36.037654 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.037682 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:36.037709 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.037753 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.037780 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.037806 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.037833 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.037856 <... mmap resumed> ) = 0x7f702ac81000
[pid 25492] 10:12:36.037870 <... mmap resumed> ) = 0x7f638cb56000
[pid 25491] 10:12:36.037885 <... open resumed> ) = 6
[pid 25473] 10:12:36.037900 read(10,  <unfinished ...>
[pid 25493] 10:12:36.037934 read(5,  <unfinished ...>
[pid 25492] 10:12:36.037958 mprotect(0x7f638cb6d000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.037985 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.038007 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25493] 10:12:36.038039 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25492] 10:12:36.038057 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.038089 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25473] 10:12:36.038117 read(10,  <unfinished ...>
[pid 25493] 10:12:36.038148 read(5,  <unfinished ...>
[pid 25492] 10:12:36.038169 mmap(0x7f638cd6d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25491] 10:12:36.038203 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.038228 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.038269 <... read resumed> "", 4096) = 0
[pid 25492] 10:12:36.038287 <... mmap resumed> ) = 0x7f638cd6d000
[pid 25491] 10:12:36.038306 <... mmap resumed> ) = 0x7f33164f2000
[pid 25473] 10:12:36.038326 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.038363 close(5 <unfinished ...>
[pid 25492] 10:12:36.038392 mmap(0x7f638cd6f000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.038420 close(6 <unfinished ...>
[pid 25473] 10:12:36.038442 <... open resumed> ) = 11
[pid 25493] 10:12:36.038583 <... close resumed> ) = 0
[pid 25492] 10:12:36.038604 <... mmap resumed> ) = 0x7f638cd6f000
[pid 25491] 10:12:36.038620 <... close resumed> ) = 0
[pid 25473] 10:12:36.038641 fstat(11,  <unfinished ...>
[pid 25493] 10:12:36.038682 munmap(0x7f702ac81000, 4096 <unfinished ...>
[pid 25492] 10:12:36.038708 close(6 <unfinished ...>
[pid 25491] 10:12:36.038730 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.038760 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.038796 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.038809 <... close resumed> ) = 0
[pid 25491] 10:12:36.038834 <... open resumed> ) = 6
[pid 25473] 10:12:36.038857 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.038945 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.038977 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.039006 read(6,  <unfinished ...>
[pid 25473] 10:12:36.039028 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25493] 10:12:36.039051 <... open resumed> ) = 5
[pid 25492] 10:12:36.039065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.039081 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.039103 read(11,  <unfinished ...>
[pid 25493] 10:12:36.039138 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.039160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.039190 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.039212 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.039249 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25492] 10:12:36.039276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.039292 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.039324 close(11 <unfinished ...>
[pid 25493] 10:12:36.039361 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25492] 10:12:36.039386 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.039415 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.039440 <... close resumed> ) = 0
[pid 25493] 10:12:36.039523 <... mmap resumed> ) = 0x7f702ac78000
[pid 25492] 10:12:36.039544 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.039560 <... mmap resumed> ) = 0x7f33160c4000
[pid 25473] 10:12:36.039578 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25493] 10:12:36.039613 close(5 <unfinished ...>
[pid 25492] 10:12:36.039635 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.039663 mprotect(0x7f33160da000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.039688 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.039727 <... close resumed> ) = 0
[pid 25492] 10:12:36.039744 <... open resumed> ) = 6
[pid 25491] 10:12:36.039768 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.039784 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.039818 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.039846 read(6,  <unfinished ...>
[pid 25491] 10:12:36.039869 mmap(0x7f33162da000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25473] 10:12:36.039897 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.039948 <... open resumed> ) = 5
[pid 25492] 10:12:36.039964 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.039987 <... mmap resumed> ) = 0x7f33162da000
[pid 25473] 10:12:36.040003 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25493] 10:12:36.040044 read(5,  <unfinished ...>
[pid 25492] 10:12:36.040066 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.040087 mmap(0x7f33162dc000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.040113 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25493] 10:12:36.040158 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.040180 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.040212 <... mmap resumed> ) = 0x7f33162dc000
[pid 25473] 10:12:36.040229 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25493] 10:12:36.040272 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.040294 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.040319 close(6 <unfinished ...>
[pid 25473] 10:12:36.040340 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.040394 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.040426 <... mmap resumed> ) = 0x7f638dca3000
[pid 25491] 10:12:36.040448 <... close resumed> ) = 0
[pid 25473] 10:12:36.040570 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.040622 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25492] 10:12:36.040649 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.040675 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.040703 <... open resumed> ) = 11
[pid 25493] 10:12:36.040726 <... mmap resumed> ) = 0x7f702a4c2000
[pid 25492] 10:12:36.040740 <... mmap resumed> ) = 0x7f638c7e2000
[pid 25491] 10:12:36.040754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.040770 fstat(11,  <unfinished ...>
[pid 25493] 10:12:36.040801 mprotect(0x7f702a4ce000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.040826 mprotect(0x7f638c951000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.040850 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.040880 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.040918 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.040939 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.040958 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.040979 fstat(11,  <unfinished ...>
[pid 25493] 10:12:36.041021 mmap(0x7f702a6ce000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25492] 10:12:36.041058 mmap(0x7f638cb50000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25491] 10:12:36.041093 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.041131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.041176 <... mmap resumed> ) = 0x7f702a6ce000
[pid 25492] 10:12:36.041194 <... mmap resumed> ) = 0x7f638cb50000
[pid 25491] 10:12:36.041224 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.041255 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.041304 close(5 <unfinished ...>
[pid 25492] 10:12:36.041333 close(6 <unfinished ...>
[pid 25491] 10:12:36.041361 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.041402 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25493] 10:12:36.041432 <... close resumed> ) = 0
[pid 25492] 10:12:36.041455 <... close resumed> ) = 0
[pid 25491] 10:12:36.041583 <... open resumed> ) = 6
[pid 25473] 10:12:36.041613 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.041656 mprotect(0x7f702a6ce000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.041690 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.041728 read(6,  <unfinished ...>
[pid 25473] 10:12:36.041758 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.041788 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.041805 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.041830 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.041859 read(11,  <unfinished ...>
[pid 25493] 10:12:36.041905 munmap(0x7f702ac78000, 39387 <unfinished ...>
[pid 25492] 10:12:36.041940 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.041981 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.042010 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25493] 10:12:36.042053 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.042072 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.042099 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.042137 read(11,  <unfinished ...>
[pid 25493] 10:12:36.042178 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.042213 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.042250 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.042284 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.042328 <... open resumed> ) = 5
[pid 25492] 10:12:36.042348 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.042373 <... mmap resumed> ) = 0x7f33164f1000
[pid 25473] 10:12:36.042397 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.042448 fcntl(5, F_GETFD <unfinished ...>
[pid 25492] 10:12:36.042578 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.042620 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.042655 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.042712 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25492] 10:12:36.042734 <... open resumed> ) = 6
[pid 25491] 10:12:36.042757 <... mmap resumed> ) = 0x7f3315eab000
[pid 25473] 10:12:36.042778 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25493] 10:12:36.042826 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.042854 read(6,  <unfinished ...>
[pid 25491] 10:12:36.042884 mprotect(0x7f3315ec1000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.042926 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25493] 10:12:36.042989 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25492] 10:12:36.043025 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.043053 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.043073 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25493] 10:12:36.043119 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.043152 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.043181 mmap(0x7f33160c0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25473] 10:12:36.043217 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.043298 <... mmap resumed> ) = 0x7f702ac81000
[pid 25492] 10:12:36.043323 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25491] 10:12:36.043361 <... mmap resumed> ) = 0x7f33160c0000
[pid 25473] 10:12:36.043382 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.043443 read(5,  <unfinished ...>
[pid 25492] 10:12:36.043559 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.043591 mmap(0x7f33160c2000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.043619 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.043670 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25492] 10:12:36.043692 <... mmap resumed> ) = 0x7f638c553000
[pid 25491] 10:12:36.043724 <... mmap resumed> ) = 0x7f33160c2000
[pid 25473] 10:12:36.043740 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25493] 10:12:36.043783 close(5 <unfinished ...>
[pid 25492] 10:12:36.043806 mprotect(0x7f638c5de000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.043832 close(6 <unfinished ...>
[pid 25473] 10:12:36.043854 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.043912 <... close resumed> ) = 0
[pid 25492] 10:12:36.043930 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.043945 <... close resumed> ) = 0
[pid 25473] 10:12:36.043960 stat("/etc/userdomains",  <unfinished ...>
[pid 25493] 10:12:36.044001 munmap(0x7f702ac81000, 4096 <unfinished ...>
[pid 25492] 10:12:36.044028 mmap(0x7f638c7de000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25491] 10:12:36.044056 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.044085 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.044127 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.044142 <... mmap resumed> ) = 0x7f638c7de000
[pid 25491] 10:12:36.044164 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.044185 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.044221 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.044248 mmap(0x7f638c7e1000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.044275 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.044306 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.044403 <... socket resumed> ) = 5
[pid 25492] 10:12:36.044425 <... mmap resumed> ) = 0x7f638c7e1000
[pid 25491] 10:12:36.044441 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.044539 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.044578 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25492] 10:12:36.044612 close(6 <unfinished ...>
[pid 25491] 10:12:36.044634 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.044664 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.044687 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.044702 <... close resumed> ) = 0
[pid 25491] 10:12:36.044727 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.044742 read(10,  <unfinished ...>
[pid 25493] 10:12:36.044778 close(5 <unfinished ...>
[pid 25492] 10:12:36.044803 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.044832 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.044860 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25493] 10:12:36.044894 <... close resumed> ) = 0
[pid 25492] 10:12:36.044909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.044927 <... open resumed> ) = 6
[pid 25473] 10:12:36.044940 read(10,  <unfinished ...>
[pid 25493] 10:12:36.044970 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25492] 10:12:36.044995 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.045026 read(6,  <unfinished ...>
[pid 25473] 10:12:36.045048 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.045098 <... socket resumed> ) = 5
[pid 25492] 10:12:36.045117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.045135 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.045162 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.045199 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25492] 10:12:36.045229 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.045260 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.045281 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25493] 10:12:36.045327 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.045343 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.045363 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.045391 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.045430 close(5 <unfinished ...>
[pid 25492] 10:12:36.045454 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.045567 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.045595 <... open resumed> ) = 12
[pid 25493] 10:12:36.045619 <... close resumed> ) = 0
[pid 25492] 10:12:36.045633 <... open resumed> ) = 6
[pid 25491] 10:12:36.045655 <... mmap resumed> ) = 0x7f3315c74000
[pid 25473] 10:12:36.045670 fstat(12,  <unfinished ...>
[pid 25493] 10:12:36.045700 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.045727 read(6,  <unfinished ...>
[pid 25491] 10:12:36.045751 mprotect(0x7f3315c7b000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.045777 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25493] 10:12:36.045816 <... open resumed> ) = 5
[pid 25492] 10:12:36.045841 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.045870 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.045885 fstat(12,  <unfinished ...>
[pid 25493] 10:12:36.045916 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.045937 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.045959 mmap(0x7f3315e7b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25473] 10:12:36.045996 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25493] 10:12:36.046041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25492] 10:12:36.046066 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25491] 10:12:36.046095 <... mmap resumed> ) = 0x7f3315e7b000
[pid 25473] 10:12:36.046109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.046148 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.046172 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.046199 mmap(0x7f3315e7d000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.046224 <... mmap resumed> ) = 0x7f7c15ca5000
[pid 25493] 10:12:36.046247 <... mmap resumed> ) = 0x7f702ac81000
[pid 25492] 10:12:36.046260 <... mmap resumed> ) = 0x7f638c34d000
[pid 25491] 10:12:36.046278 <... mmap resumed> ) = 0x7f3315e7d000
[pid 25473] 10:12:36.046291 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.046328 read(5,  <unfinished ...>
[pid 25492] 10:12:36.046353 mprotect(0x7f638c353000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.046380 close(6 <unfinished ...>
[pid 25473] 10:12:36.046404 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.046426 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25492] 10:12:36.046445 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.046579 <... close resumed> ) = 0
[pid 25473] 10:12:36.046599 read(12,  <unfinished ...>
[pid 25493] 10:12:36.046637 close(5 <unfinished ...>
[pid 25492] 10:12:36.046666 mmap(0x7f638c552000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25491] 10:12:36.046702 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.046740 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.046773 <... close resumed> ) = 0
[pid 25492] 10:12:36.046790 <... mmap resumed> ) = 0x7f638c552000
[pid 25491] 10:12:36.046813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.046831 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.046864 munmap(0x7f702ac81000, 4096 <unfinished ...>
[pid 25492] 10:12:36.046890 close(6 <unfinished ...>
[pid 25491] 10:12:36.046913 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.046944 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25493] 10:12:36.046994 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.047019 <... close resumed> ) = 0
[pid 25491] 10:12:36.047042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.047061 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.047095 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.047121 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.047150 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.047178 <... open resumed> ) = 13
[pid 25493] 10:12:36.047208 <... open resumed> ) = 5
[pid 25492] 10:12:36.047225 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.047242 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.047260 fstat(13,  <unfinished ...>
[pid 25493] 10:12:36.047289 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.047311 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.047345 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.047375 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.047409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25492] 10:12:36.047435 <... open resumed> ) = 6
[pid 25491] 10:12:36.047450 <... open resumed> ) = 6
[pid 25473] 10:12:36.047541 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.047578 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.047603 read(6,  <unfinished ...>
[pid 25491] 10:12:36.047627 read(6,  <unfinished ...>
[pid 25473] 10:12:36.047654 <... mmap resumed> ) = 0x7f7c15ca4000
[pid 25493] 10:12:36.047681 <... mmap resumed> ) = 0x7f702ac81000
[pid 25492] 10:12:36.047700 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.047725 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.047753 read(13,  <unfinished ...>
[pid 25493] 10:12:36.047790 read(5,  <unfinished ...>
[pid 25492] 10:12:36.047816 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.047838 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.047860 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.047897 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25492] 10:12:36.047930 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.047965 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.047994 close(13 <unfinished ...>
[pid 25493] 10:12:36.048024 close(5 <unfinished ...>
[pid 25492] 10:12:36.048048 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.048073 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.048099 <... close resumed> ) = 0
[pid 25493] 10:12:36.048120 <... close resumed> ) = 0
[pid 25492] 10:12:36.048136 <... mmap resumed> ) = 0x7f638dca2000
[pid 25491] 10:12:36.048155 <... mmap resumed> ) = 0x7f33159f0000
[pid 25473] 10:12:36.048172 munmap(0x7f7c15ca4000, 4096 <unfinished ...>
[pid 25493] 10:12:36.048206 munmap(0x7f702ac81000, 4096 <unfinished ...>
[pid 25492] 10:12:36.048230 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.048256 mprotect(0x7f3315a73000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.048282 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.048326 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.048362 <... mmap resumed> ) = 0x7f638c017000
[pid 25491] 10:12:36.048385 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.048403 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.048443 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25492] 10:12:36.048603 mprotect(0x7f638c143000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.048633 mmap(0x7f3315c72000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25473] 10:12:36.048662 <... open resumed> ) = 13
[pid 25493] 10:12:36.048686 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25492] 10:12:36.048710 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.048727 <... mmap resumed> ) = 0x7f3315c72000
[pid 25473] 10:12:36.048751 fstat(13,  <unfinished ...>
[pid 25493] 10:12:36.048782 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25492] 10:12:36.048811 mmap(0x7f638c343000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25491] 10:12:36.048842 close(6 <unfinished ...>
[pid 25473] 10:12:36.048864 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.048902 <... readlink resumed> 0x7ffc2cac9510, 4095) = -1 EINVAL (Invalid argument)
[pid 25492] 10:12:36.048928 <... mmap resumed> ) = 0x7f638c343000
[pid 25491] 10:12:36.048950 <... close resumed> ) = 0
[pid 25473] 10:12:36.048973 fstat(13,  <unfinished ...>
[pid 25493] 10:12:36.049004 getcwd( <unfinished ...>
[pid 25492] 10:12:36.049029 mmap(0x7f638c34c000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.049057 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.049088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.049122 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25492] 10:12:36.049148 <... mmap resumed> ) = 0x7f638c34c000
[pid 25491] 10:12:36.049171 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.049190 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.049222 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25492] 10:12:36.049256 close(6 <unfinished ...>
[pid 25491] 10:12:36.049278 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.049310 <... mmap resumed> ) = 0x7f7c15ca4000
[pid 25493] 10:12:36.049332 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25492] 10:12:36.049362 <... close resumed> ) = 0
[pid 25491] 10:12:36.049384 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.049404 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.049433 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.049535 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.049572 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.049601 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.049624 <... open resumed> ) = 5
[pid 25492] 10:12:36.049642 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.049664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.049689 read(13,  <unfinished ...>
[pid 25493] 10:12:36.049723 fstat(5,  <unfinished ...>
[pid 25492] 10:12:36.049751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.049787 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.049817 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25493] 10:12:36.049848 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25492] 10:12:36.049877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.049894 <... open resumed> ) = 6
[pid 25473] 10:12:36.049909 read(13,  <unfinished ...>
[pid 25493] 10:12:36.049937 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.049963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.049992 read(6,  <unfinished ...>
[pid 25473] 10:12:36.050014 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.050047 <... mmap resumed> ) = 0x7f702ac81000
[pid 25492] 10:12:36.050067 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.050086 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.050109 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25493] 10:12:36.050146 read(5,  <unfinished ...>
[pid 25492] 10:12:36.050175 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.050205 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.050228 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25493] 10:12:36.050275 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25492] 10:12:36.050298 <... open resumed> ) = 6
[pid 25491] 10:12:36.050313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25473] 10:12:36.050343 stat("/usr/local/cpanel/3rdparty/mailman/lists/jennifer.gonzales_onehospitalitygroup.com/config.pck",  <unfinished ...>
[pid 25493] 10:12:36.050381 read(5,  <unfinished ...>
[pid 25492] 10:12:36.050405 read(6,  <unfinished ...>
[pid 25491] 10:12:36.050428 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.050454 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.050594 <... read resumed> "", 1024) = 0
[pid 25492] 10:12:36.050621 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.050652 <... mmap resumed> ) = 0x7f33164f0000
[pid 25473] 10:12:36.050677 stat("/etc/demouids",  <unfinished ...>
[pid 25493] 10:12:36.050714 setregid(499, 499 <unfinished ...>
[pid 25492] 10:12:36.050744 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.050772 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.050800 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.050848 <... setregid resumed> ) = 0
[pid 25492] 10:12:36.050869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.050898 <... mmap resumed> ) = 0x7f33157e2000
[pid 25473] 10:12:36.050915 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.050949 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25492] 10:12:36.051184 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.051216 mprotect(0x7f33157ee000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.051244 <... open resumed> ) = 14
[pid 25492] 10:12:36.051269 <... mmap resumed> ) = 0x7f638be13000
[pid 25491] 10:12:36.051286 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.051301 fstat(14,  <unfinished ...>
[pid 25493] 10:12:36.051330 <... execve resumed> ) = 0
[pid 25492] 10:12:36.051360 mprotect(0x7f638be15000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.051390 mmap(0x7f33159ee000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25473] 10:12:36.051419 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.051457 brk(0 <unfinished ...>
[pid 25492] 10:12:36.051589 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.051606 <... mmap resumed> ) = 0x7f33159ee000
[pid 25473] 10:12:36.051631 fstat(14,  <unfinished ...>
[pid 25493] 10:12:36.051669 <... brk resumed> ) = 0x108f000
[pid 25492] 10:12:36.051692 mmap(0x7f638c015000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25491] 10:12:36.051722 close(6 <unfinished ...>
[pid 25473] 10:12:36.051750 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.051790 fcntl(0, F_GETFD <unfinished ...>
[pid 25492] 10:12:36.051814 <... mmap resumed> ) = 0x7f638c015000
[pid 25491] 10:12:36.051837 <... close resumed> ) = 0
[pid 25473] 10:12:36.051862 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.051895 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.051911 close(6 <unfinished ...>
[pid 25491] 10:12:36.051933 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.051966 <... mmap resumed> ) = 0x7f7c15ca3000
[pid 25493] 10:12:36.051989 fcntl(1, F_GETFD <unfinished ...>
[pid 25492] 10:12:36.052011 <... close resumed> ) = 0
[pid 25491] 10:12:36.052032 <... open resumed> ) = 6
[pid 25473] 10:12:36.052049 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.052078 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.052094 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.052122 read(6,  <unfinished ...>
[pid 25473] 10:12:36.052145 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.052168 fcntl(2, F_GETFD <unfinished ...>
[pid 25492] 10:12:36.052190 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.052207 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.052236 read(14,  <unfinished ...>
[pid 25493] 10:12:36.052265 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.052286 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.052319 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.052342 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.052373 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25492] 10:12:36.052406 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.052424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25473] 10:12:36.052454 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25493] 10:12:36.052568 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.052600 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.052632 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.052667 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25493] 10:12:36.052833 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.052869 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.052888 <... mmap resumed> ) = 0x7f33155bf000
[pid 25473] 10:12:36.052905 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.052942 <... mmap resumed> ) = 0x7f6578ae9000
[pid 25492] 10:12:36.052972 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.053006 mprotect(0x7f33155e0000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.053033 <... open resumed> ) = 15
[pid 25493] 10:12:36.053058 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25492] 10:12:36.053088 <... open resumed> ) = 6
[pid 25491] 10:12:36.053103 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.053119 fstat(15,  <unfinished ...>
[pid 25493] 10:12:36.053147 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.053173 read(6,  <unfinished ...>
[pid 25491] 10:12:36.053198 mmap(0x7f33157e0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25473] 10:12:36.053227 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.053262 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.053291 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.053319 <... mmap resumed> ) = 0x7f33157e0000
[pid 25473] 10:12:36.053341 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.053373 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.053392 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.053415 close(6 <unfinished ...>
[pid 25473] 10:12:36.053438 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25493] 10:12:36.053543 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.053579 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.053609 <... close resumed> ) = 0
[pid 25473] 10:12:36.053633 read(15,  <unfinished ...>
[pid 25493] 10:12:36.053674 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.053698 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.053733 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.053767 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.053801 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.053831 <... mmap resumed> ) = 0x7f638bc10000
[pid 25491] 10:12:36.053847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.053864 close(15 <unfinished ...>
[pid 25493] 10:12:36.053894 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.053910 mprotect(0x7f638bc12000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.053937 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.053968 <... close resumed> ) = 0
[pid 25493] 10:12:36.053990 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25492] 10:12:36.054016 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.054096 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.054120 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25493] 10:12:36.054154 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.054172 mmap(0x7f638be11000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25491] 10:12:36.054200 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.054230 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.054300 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.054336 <... mmap resumed> ) = 0x7f638be11000
[pid 25491] 10:12:36.054361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.054381 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25493] 10:12:36.054417 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.054434 close(6 <unfinished ...>
[pid 25491] 10:12:36.054456 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.054540 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25493] 10:12:36.054594 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.054631 <... close resumed> ) = 0
[pid 25491] 10:12:36.054659 <... open resumed> ) = 6
[pid 25473] 10:12:36.054682 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.054719 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.054742 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.054776 read(6,  <unfinished ...>
[pid 25473] 10:12:36.054800 <... open resumed> ) = 15
[pid 25493] 10:12:36.054822 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.054851 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.054868 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.054891 fstat(15,  <unfinished ...>
[pid 25493] 10:12:36.054920 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.054936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.054966 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.054988 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.055022 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25492] 10:12:36.055048 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.055064 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.055093 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.055125 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25492] 10:12:36.055153 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.055182 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.055209 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25493] 10:12:36.055232 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.055263 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.055281 <... mmap resumed> ) = 0x7f33153a2000
[pid 25473] 10:12:36.055297 read(15,  <unfinished ...>
[pid 25493] 10:12:36.055329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.055346 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.055376 mprotect(0x7f33153b9000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.055405 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.055439 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.055582 <... open resumed> ) = 6
[pid 25491] 10:12:36.055600 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.055616 close(15 <unfinished ...>
[pid 25493] 10:12:36.055653 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.055677 read(6,  <unfinished ...>
[pid 25491] 10:12:36.055702 mmap(0x7f33155b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25473] 10:12:36.055733 <... close resumed> ) = 0
[pid 25493] 10:12:36.055756 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.055788 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.055812 <... mmap resumed> ) = 0x7f33155b9000
[pid 25473] 10:12:36.055834 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25493] 10:12:36.055867 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.055884 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.055907 mmap(0x7f33155bb000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.055934 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.055966 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25492] 10:12:36.056000 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.056029 <... mmap resumed> ) = 0x7f33155bb000
[pid 25473] 10:12:36.056058 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.056097 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.056115 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.056141 close(6 <unfinished ...>
[pid 25473] 10:12:36.056163 <... open resumed> ) = 15
[pid 25493] 10:12:36.056185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.056217 <... mmap resumed> ) = 0x7f638dca1000
[pid 25491] 10:12:36.056236 <... close resumed> ) = 0
[pid 25473] 10:12:36.056259 fstat(15,  <unfinished ...>
[pid 25493] 10:12:36.056289 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.056306 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.056333 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.056366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.056399 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.056429 <... mmap resumed> ) = 0x7f638b87c000
[pid 25491] 10:12:36.056444 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.056539 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.056585 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.056603 mprotect(0x7f638ba06000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.056630 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.056665 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25493] 10:12:36.056687 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.056717 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.056733 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.056750 read(15,  <unfinished ...>
[pid 25493] 10:12:36.056782 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.056799 mmap(0x7f638bc06000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25491] 10:12:36.056828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.056859 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.056891 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25492] 10:12:36.056921 <... mmap resumed> ) = 0x7f638bc06000
[pid 25491] 10:12:36.056941 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.056960 close(15 <unfinished ...>
[pid 25493] 10:12:36.056991 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.057019 mmap(0x7f638bc0b000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.057046 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.057075 <... close resumed> ) = 0
[pid 25493] 10:12:36.057097 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.057126 <... mmap resumed> ) = 0x7f638bc0b000
[pid 25491] 10:12:36.057147 <... open resumed> ) = 6
[pid 25473] 10:12:36.057164 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25493] 10:12:36.057197 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.057213 close(6 <unfinished ...>
[pid 25491] 10:12:36.057235 read(6,  <unfinished ...>
[pid 25473] 10:12:36.057258 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.057370 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.057409 <... close resumed> ) = 0
[pid 25491] 10:12:36.057433 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.057458 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.057579 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.057598 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.057628 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.057651 <... open resumed> ) = 15
[pid 25493] 10:12:36.057679 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.057709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.057726 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25473] 10:12:36.057756 fstat(15,  <unfinished ...>
[pid 25493] 10:12:36.057785 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.057801 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.057832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.057858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.057895 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25492] 10:12:36.057923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.057940 <... mmap resumed> ) = 0x7f33164ef000
[pid 25473] 10:12:36.057960 fstat(15,  <unfinished ...>
[pid 25493] 10:12:36.057989 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.058006 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.058035 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.058062 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.058095 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.058124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.058143 <... mmap resumed> ) = 0x7f331502e000
[pid 25473] 10:12:36.058159 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.058190 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.058207 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.058238 mprotect(0x7f331519d000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.058265 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25493] 10:12:36.058288 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.058315 <... open resumed> ) = 6
[pid 25491] 10:12:36.058332 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.058349 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.058377 <... stat resumed> 0x7ffc364bcb60) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.058394 read(6,  <unfinished ...>
[pid 25491] 10:12:36.058417 mmap(0x7f331539c000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25473] 10:12:36.058446 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.058542 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.058580 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.058609 <... mmap resumed> ) = 0x7f331539c000
[pid 25473] 10:12:36.058635 read(15,  <unfinished ...>
[pid 25493] 10:12:36.058670 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.058687 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.058710 close(6 <unfinished ...>
[pid 25473] 10:12:36.058733 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25493] 10:12:36.058760 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25492] 10:12:36.058789 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25491] 10:12:36.058819 <... close resumed> ) = 0
[pid 25473] 10:12:36.058843 read(15,  <unfinished ...>
[pid 25493] 10:12:36.058872 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.058901 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.058930 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.058959 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.059046 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.059083 <... mmap resumed> ) = 0x7f638b610000
[pid 25491] 10:12:36.059100 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.059117 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.059146 <... open resumed> ) = 6
[pid 25492] 10:12:36.059162 mprotect(0x7f638b672000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.059188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.059220 <... lseek resumed> ) = 353
[pid 25493] 10:12:36.059247 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.059270 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.059285 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.059302 read(9,  <unfinished ...>
[pid 25493] 10:12:36.059330 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25492] 10:12:36.059358 mmap(0x7f638b871000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25491] 10:12:36.059390 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.059420 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.059543 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.059579 <... mmap resumed> ) = 0x7f638b871000
[pid 25491] 10:12:36.059612 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.059634 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.059669 <... mmap resumed> ) = 0x7f6578adf000
[pid 25492] 10:12:36.059686 close(6 <unfinished ...>
[pid 25491] 10:12:36.059708 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.059741 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.059763 close(6 <unfinished ...>
[pid 25492] 10:12:36.059786 <... close resumed> ) = 0
[pid 25491] 10:12:36.059811 <... open resumed> ) = 6
[pid 25473] 10:12:36.059828 read(9,  <unfinished ...>
[pid 25493] 10:12:36.059857 <... close resumed> ) = 0
[pid 25492] 10:12:36.059880 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.059916 read(6,  <unfinished ...>
[pid 25473] 10:12:36.059940 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25493] 10:12:36.059997 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.060034 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.060051 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.060075 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.060113 <... open resumed> ) = 6
[pid 25492] 10:12:36.060129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.060160 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.060183 <... stat resumed> 0x7f7c14346880) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.060218 read(6,  <unfinished ...>
[pid 25492] 10:12:36.060245 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.060262 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25473] 10:12:36.060292 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25493] 10:12:36.060324 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.060348 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.060378 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.060407 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25493] 10:12:36.060572 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.060605 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.060624 <... mmap resumed> ) = 0x7f3314d9f000
[pid 25473] 10:12:36.060641 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.060680 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.060710 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.060741 mprotect(0x7f3314e2a000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.060774 <... open resumed> ) = 16
[pid 25493] 10:12:36.060804 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.060834 <... open resumed> ) = 6
[pid 25491] 10:12:36.060850 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.060865 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25493] 10:12:36.060896 <... mmap resumed> ) = 0x7f65786b1000
[pid 25492] 10:12:36.060912 read(6,  <unfinished ...>
[pid 25491] 10:12:36.060934 mmap(0x7f331502a000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25473] 10:12:36.060964 <... ioctl resumed> , 0x7ffdac33b340) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25493] 10:12:36.060989 mprotect(0x7f65786c7000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.061015 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.061038 <... mmap resumed> ) = 0x7f331502a000
[pid 25473] 10:12:36.061061 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25493] 10:12:36.061091 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.061107 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.061129 mmap(0x7f331502d000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.061156 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.061179 mmap(0x7f65788c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25492] 10:12:36.061207 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25491] 10:12:36.061236 <... mmap resumed> ) = 0x7f331502d000
[pid 25473] 10:12:36.061258 fstat(16,  <unfinished ...>
[pid 25493] 10:12:36.061288 <... mmap resumed> ) = 0x7f65788c7000
[pid 25492] 10:12:36.061309 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.061339 close(6 <unfinished ...>
[pid 25473] 10:12:36.061361 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25493] 10:12:36.061395 mmap(0x7f65788c9000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.061422 <... mmap resumed> ) = 0x7f638b22d000
[pid 25491] 10:12:36.061438 <... close resumed> ) = 0
[pid 25473] 10:12:36.061544 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.061582 <... mmap resumed> ) = 0x7f65788c9000
[pid 25492] 10:12:36.061605 mprotect(0x7f638b3e6000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.061633 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.061663 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.061688 close(6 <unfinished ...>
[pid 25492] 10:12:36.061711 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.061757 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.061779 fstat(16,  <unfinished ...>
[pid 25493] 10:12:36.061810 <... close resumed> ) = 0
[pid 25492] 10:12:36.061832 mmap(0x7f638b5e5000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25491] 10:12:36.061864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25482] 10:12:36.061903 <... read resumed> "crt0+\6\10+\6\1\5\5\0070\2\206\37http://corppki/aia/mswww(6).crt0\r\6\t*\206H\206\367\r\1\1\5\5\0\3\202\2\1\0\2436r\367E\v\247\2067\336 \215\365\327\216\332\211\0zRK\2052\2622\327\355\200W\375\rQ\34\321\36=\f>\221*0\342S\274a\7\211\2\21\271\33\203H\323\32\307G\226b\267\317\336\327\r\270\235\204\216\336\325\346\344\271\300\6\343\34\3641C\37S\374JB\265\233#\315\262\354\r\17\201\211\377Y\251\0\323\4J\v\257[\204\365;O\2717\221\210!\344\234\312Rvc~\210ze\264\216\26j\364`\275,\16\357\27\206+u\tXs\305O\271\250\33\357*\364\266\243\271\7\360\244\2209S\337\341\272\2\230\245\245\202\21\241\6S\262\302\353\375\352gr7c\320\205\317\206\5\310\303s\301"..., 11314) = 1448
[pid 25473] 10:12:36.061933 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25493] 10:12:36.061986 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.062020 <... mmap resumed> ) = 0x7f638b5e5000
[pid 25491] 10:12:36.062041 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:36.062059 read(11,  <unfinished ...>
[pid 25473] 10:12:36.062089 read(16,  <unfinished ...>
[pid 25493] 10:12:36.062120 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.062136 mmap(0x7f638b60c000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.062165 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25482] 10:12:36.062194 <... read resumed> "U\35\17\1\1\377\4\4\3\2\1\2060\37\6\3U\35#\4\0300\26\200\24\345\235Y0\202GX\314\254\372\10T6\206{:\265\4M\3600B\6\3U\35\37\4;0907\2405\2403\2061http://cdp1.public-trust.com/CRL/Omniroot2025.crl0\35\6\3U\35\16\4\26\4\24*M\227\225]4~\235\266\3463\276\234'\301p~g\333\3010\r\6\t*\206H\206\367\r\1\1\5\5\0\3\202\1\1\0#>\207n\323\312\326\16\2606%\215\314\n\316\334]t\363B\33\357\252\300Is\205\314}/w\t#\305,P\35F\303hh\357\0202\331M~\343Z\343\35\30<\322@T\315\357Y\356\337\376\373pJ\274\330t7+\334\244hqP\272c\313D\335\21H\377\370\361\377`\272|\2520}"..., 9866) = 4344
[pid 25473] 10:12:36.062218 <... read resumed> "0", 8192) = 1
[pid 25493] 10:12:36.062244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.062275 <... mmap resumed> ) = 0x7f638b60c000
[pid 25491] 10:12:36.062298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:36.062321 read(11,  <unfinished ...>
[pid 25473] 10:12:36.062344 read(16,  <unfinished ...>
[pid 25493] 10:12:36.062374 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.062390 close(6 <unfinished ...>
[pid 25491] 10:12:36.062412 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.062443 <... read resumed> "", 8192) = 0
[pid 25493] 10:12:36.062587 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.062627 <... close resumed> ) = 0
[pid 25491] 10:12:36.062653 <... open resumed> ) = 6
[pid 25473] 10:12:36.062671 close(16 <unfinished ...>
[pid 25493] 10:12:36.062701 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.062721 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.062751 read(6,  <unfinished ...>
[pid 25473] 10:12:36.062774 <... close resumed> ) = 0
[pid 25493] 10:12:36.062854 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.062893 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.062911 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.062941 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.062977 <... open resumed> ) = 6
[pid 25492] 10:12:36.062993 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.063029 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.063059 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25493] 10:12:36.063114 read(6,  <unfinished ...>
[pid 25492] 10:12:36.063142 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.063160 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25473] 10:12:36.063190 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.063222 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.063244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.063274 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.063303 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.063348 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.063375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.063394 <... mmap resumed> ) = 0x7f3314b99000
[pid 25473] 10:12:36.063411 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.063442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.063553 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.063589 mprotect(0x7f3314b9f000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.063617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.063655 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.063683 <... open resumed> ) = 6
[pid 25491] 10:12:36.063701 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.063717 close(7 <unfinished ...>
[pid 25493] 10:12:36.063748 <... mmap resumed> ) = 0x7f6578ade000
[pid 25492] 10:12:36.063774 read(6,  <unfinished ...>
[pid 25491] 10:12:36.063799 mmap(0x7f3314d9e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25473] 10:12:36.063828 <... close resumed> ) = 0
[pid 25493] 10:12:36.063853 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.063880 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.063903 <... mmap resumed> ) = 0x7f3314d9e000
[pid 25473] 10:12:36.063924 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25493] 10:12:36.063965 <... mmap resumed> ) = 0x7f6578498000
[pid 25492] 10:12:36.063981 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.064004 close(6 <unfinished ...>
[pid 25473] 10:12:36.064026 <... open resumed> ) = 7
[pid 25493] 10:12:36.064047 mprotect(0x7f65784ae000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.064074 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25491] 10:12:36.064102 <... close resumed> ) = 0
[pid 25473] 10:12:36.064125 fcntl(7, F_GETFD <unfinished ...>
[pid 25493] 10:12:36.064155 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.064171 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.064197 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.064226 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.064247 mmap(0x7f65786ad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25492] 10:12:36.064276 <... mmap resumed> ) = 0x7f638dca0000
[pid 25491] 10:12:36.064295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.064314 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.064351 <... mmap resumed> ) = 0x7f65786ad000
[pid 25492] 10:12:36.064377 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.064407 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.064449 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.064553 mmap(0x7f65786af000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.064585 <... mmap resumed> ) = 0x7f638b000000
[pid 25491] 10:12:36.064601 <... open resumed> ) = 6
[pid 25473] 10:12:36.064617 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.064645 <... mmap resumed> ) = 0x7f65786af000
[pid 25492] 10:12:36.064666 mprotect(0x7f638b02c000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.064695 read(6,  <unfinished ...>
[pid 25473] 10:12:36.064718 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5375303, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.064754 close(6 <unfinished ...>
[pid 25492] 10:12:36.064776 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.064792 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.064821 write(7, "2015-12-30 10:12:36 [25473] 1aEJMZ-0006ce-8t SMTP connection outbound 1451491956 1aEJMZ-0006ce-8t finestweddingsites.com jennifer.gonzales@onehospitalitygroup.com\n", 163 <unfinished ...>
[pid 25493] 10:12:36.064860 <... close resumed> ) = 0
[pid 25492] 10:12:36.064882 mmap(0x7f638b22c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25491] 10:12:36.064912 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.064935 <... write resumed> ) = 163
[pid 25493] 10:12:36.065000 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.065038 <... mmap resumed> ) = 0x7f638b22c000
[pid 25491] 10:12:36.065060 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:36.065091 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25493] 10:12:36.065133 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.065151 close(6 <unfinished ...>
[pid 25491] 10:12:36.065173 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.065198 <... open resumed> ) = 16
[pid 25493] 10:12:36.065225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.065259 <... close resumed> ) = 0
[pid 25491] 10:12:36.065282 <... mmap resumed> ) = 0x7f33164ee000
[pid 25473] 10:12:36.065303 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25493] 10:12:36.065333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.065350 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.065382 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.065409 <... lseek resumed> ) = 10
[pid 25493] 10:12:36.065434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.065554 <... open resumed> ) = 6
[pid 25491] 10:12:36.065574 <... mmap resumed> ) = 0x7f3314863000
[pid 25473] 10:12:36.065591 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25493] 10:12:36.065622 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.065643 read(6,  <unfinished ...>
[pid 25491] 10:12:36.065667 mprotect(0x7f331498f000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.065695 <... ioctl resumed> , 0x7ffdac33b340) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25493] 10:12:36.065719 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.065750 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.065773 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.065789 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25493] 10:12:36.065818 <... open resumed> ) = 6
[pid 25492] 10:12:36.065840 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.065863 mmap(0x7f3314b8f000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25473] 10:12:36.065893 <... lseek resumed> ) = 10
[pid 25493] 10:12:36.065916 read(6,  <unfinished ...>
[pid 25492] 10:12:36.065940 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25491] 10:12:36.065970 <... mmap resumed> ) = 0x7f3314b8f000
[pid 25473] 10:12:36.065992 fstat(16,  <unfinished ...>
[pid 25493] 10:12:36.066021 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.066044 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.066072 mmap(0x7f3314b98000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.066100 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=10, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25493] 10:12:36.066146 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.066169 <... mmap resumed> ) = 0x7f638adfb000
[pid 25491] 10:12:36.066185 <... mmap resumed> ) = 0x7f3314b98000
[pid 25473] 10:12:36.066206 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.066237 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.066265 mprotect(0x7f638ae00000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.066292 close(6 <unfinished ...>
[pid 25473] 10:12:36.066314 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.066347 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.066383 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.066405 <... close resumed> ) = 0
[pid 25473] 10:12:36.066428 write(16, "1", 1 <unfinished ...>
[pid 25493] 10:12:36.066569 <... mmap resumed> ) = 0x7f6578261000
[pid 25492] 10:12:36.066589 mmap(0x7f638afff000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25491] 10:12:36.066618 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.066648 <... write resumed> ) = 1
[pid 25493] 10:12:36.066671 mprotect(0x7f6578268000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.066698 <... mmap resumed> ) = 0x7f638afff000
[pid 25491] 10:12:36.066721 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.066739 close(16 <unfinished ...>
[pid 25493] 10:12:36.066770 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.066786 close(6 <unfinished ...>
[pid 25491] 10:12:36.066808 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.066839 <... close resumed> ) = 0
[pid 25493] 10:12:36.066881 mmap(0x7f6578468000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25492] 10:12:36.066915 <... close resumed> ) = 0
[pid 25491] 10:12:36.066942 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.066966 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.067003 <... mmap resumed> ) = 0x7f6578468000
[pid 25492] 10:12:36.067024 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.067054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.067082 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.067112 mmap(0x7f657846a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.067143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.067160 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.067178 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25493] 10:12:36.067212 <... mmap resumed> ) = 0x7f657846a000
[pid 25492] 10:12:36.067233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.067266 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.067296 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.067349 close(6 <unfinished ...>
[pid 25492] 10:12:36.067377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.067394 <... open resumed> ) = 6
[pid 25473] 10:12:36.067410 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.067444 <... close resumed> ) = 0
[pid 25492] 10:12:36.067548 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.067587 read(6,  <unfinished ...>
[pid 25473] 10:12:36.067611 <... open resumed> ) = 16
[pid 25493] 10:12:36.067634 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.067664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.067682 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.067706 fstat(16,  <unfinished ...>
[pid 25493] 10:12:36.067735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.067751 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.067779 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.067802 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25493] 10:12:36.067836 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.067867 <... open resumed> ) = 6
[pid 25491] 10:12:36.067882 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.067911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.067944 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.067961 read(6,  <unfinished ...>
[pid 25491] 10:12:36.067984 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.068019 <... mmap resumed> ) = 0x7f7c15ca1000
[pid 25493] 10:12:36.068043 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.068073 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.068096 <... mmap resumed> ) = 0x7f331465f000
[pid 25473] 10:12:36.068113 read(16,  <unfinished ...>
[pid 25493] 10:12:36.068146 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.068165 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.068187 mprotect(0x7f3314661000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.068214 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25493] 10:12:36.068245 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.068276 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25491] 10:12:36.068309 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.068326 read(16,  <unfinished ...>
[pid 25493] 10:12:36.068354 <... open resumed> ) = 6
[pid 25492] 10:12:36.068369 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.068398 mmap(0x7f3314861000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25473] 10:12:36.068428 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.068451 read(6,  <unfinished ...>
[pid 25492] 10:12:36.068581 <... mmap resumed> ) = 0x7f638abf8000
[pid 25491] 10:12:36.068600 <... mmap resumed> ) = 0x7f3314861000
[pid 25473] 10:12:36.068625 close(16 <unfinished ...>
[pid 25493] 10:12:36.068659 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.068683 mprotect(0x7f638abfa000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.068711 close(6 <unfinished ...>
[pid 25473] 10:12:36.068733 <... close resumed> ) = 0
[pid 25493] 10:12:36.068754 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.068777 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.068792 <... close resumed> ) = 0
[pid 25473] 10:12:36.068814 munmap(0x7f7c15ca1000, 4096 <unfinished ...>
[pid 25493] 10:12:36.068849 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.068879 mmap(0x7f638adf9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25491] 10:12:36.068908 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.068943 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.068966 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.068993 <... mmap resumed> ) = 0x7f638adf9000
[pid 25491] 10:12:36.069018 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.069037 uname( <unfinished ...>
[pid 25493] 10:12:36.069065 <... mmap resumed> ) = 0x7f6577fdd000
[pid 25492] 10:12:36.069081 close(6 <unfinished ...>
[pid 25491] 10:12:36.069103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.069134 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25493] 10:12:36.069227 mprotect(0x7f6578060000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.069260 <... close resumed> ) = 0
[pid 25491] 10:12:36.069285 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.069304 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25493] 10:12:36.069342 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.069358 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.069388 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.069416 <... socket resumed> ) = 16
[pid 25493] 10:12:36.069446 mmap(0x7f657825f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25492] 10:12:36.069567 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.069587 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.069605 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25493] 10:12:36.069647 <... mmap resumed> ) = 0x7f657825f000
[pid 25492] 10:12:36.069672 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.069707 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.069737 <... connect resumed> ) = 0
[pid 25493] 10:12:36.069763 close(6 <unfinished ...>
[pid 25492] 10:12:36.069786 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.069803 <... open resumed> ) = 6
[pid 25473] 10:12:36.069818 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25493] 10:12:36.069850 <... close resumed> ) = 0
[pid 25492] 10:12:36.069873 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.069903 read(6,  <unfinished ...>
[pid 25473] 10:12:36.069926 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25493] 10:12:36.069952 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.069981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.069999 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.070022 sendto(16, "\361\346\1\0\0\1\0\0\0\0\0\0\23onehospitalitygroup\3com\0\0\17\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25493] 10:12:36.070085 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.070104 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.070136 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.070165 <... sendto resumed> ) = 41
[pid 25493] 10:12:36.070188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.070219 <... open resumed> ) = 6
[pid 25491] 10:12:36.070234 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25473] 10:12:36.070265 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25493] 10:12:36.070297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.070314 read(6,  <unfinished ...>
[pid 25491] 10:12:36.070337 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.070370 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.070400 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.070424 <... mmap resumed> ) = 0x7f331445c000
[pid 25493] 10:12:36.070446 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.070561 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.070592 mprotect(0x7f331445e000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.070625 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.070662 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.070699 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.070721 <... open resumed> ) = 6
[pid 25492] 10:12:36.070736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.070762 mmap(0x7f331465d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25493] 10:12:36.070795 read(6,  <unfinished ...>
[pid 25492] 10:12:36.070818 <... mmap resumed> ) = 0x7f638dc9f000
[pid 25491] 10:12:36.070838 <... mmap resumed> ) = 0x7f331465d000
[pid 25493] 10:12:36.070868 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.070893 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.070922 close(6 <unfinished ...>
[pid 25493] 10:12:36.070949 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.070971 <... mmap resumed> ) = 0x7f638a9d5000
[pid 25491] 10:12:36.070986 <... close resumed> ) = 0
[pid 25493] 10:12:36.071013 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25492] 10:12:36.071048 mprotect(0x7f638a9ec000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.071076 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.071111 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.071141 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.071158 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.071180 <... mmap resumed> ) = 0x7f6578add000
[pid 25492] 10:12:36.071200 mmap(0x7f638abec000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25491] 10:12:36.071229 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.071265 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.071291 <... mmap resumed> ) = 0x7f638abec000
[pid 25491] 10:12:36.071316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.071340 <... mmap resumed> ) = 0x7f6577dcf000
[pid 25492] 10:12:36.071356 close(6 <unfinished ...>
[pid 25491] 10:12:36.071378 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.071412 mprotect(0x7f6577ddb000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.071442 <... close resumed> ) = 0
[pid 25491] 10:12:36.071554 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.071585 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.071602 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.071632 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.071668 mmap(0x7f6577fdb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25492] 10:12:36.071697 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.071714 <... open resumed> ) = 6
[pid 25493] 10:12:36.071734 <... mmap resumed> ) = 0x7f6577fdb000
[pid 25492] 10:12:36.071762 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.071796 read(6,  <unfinished ...>
[pid 25493] 10:12:36.071824 close(6 <unfinished ...>
[pid 25492] 10:12:36.071846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.071863 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.071891 <... close resumed> ) = 0
[pid 25492] 10:12:36.071913 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.071944 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.071971 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.072002 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.072021 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.072056 <... open resumed> ) = 6
[pid 25492] 10:12:36.072072 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.072102 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.072133 read(6,  <unfinished ...>
[pid 25492] 10:12:36.072161 <... open resumed> ) = 6
[pid 25491] 10:12:36.072177 <... mmap resumed> ) = 0x7f33164ed000
[pid 25493] 10:12:36.072201 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.072225 read(6,  <unfinished ...>
[pid 25491] 10:12:36.072248 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.072281 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.072303 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.072325 <... mmap resumed> ) = 0x7f33140c8000
[pid 25493] 10:12:36.072354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25492] 10:12:36.072390 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.072414 mprotect(0x7f3314252000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.072452 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.072587 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.072620 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.072642 <... mmap resumed> ) = 0x7f6577bac000
[pid 25492] 10:12:36.072658 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.072685 mmap(0x7f3314452000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25493] 10:12:36.072719 mprotect(0x7f6577bcd000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.072745 <... mmap resumed> ) = 0x7f638a791000
[pid 25491] 10:12:36.072761 <... mmap resumed> ) = 0x7f3314452000
[pid 25493] 10:12:36.072787 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.072804 mprotect(0x7f638a7d2000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.072830 mmap(0x7f3314457000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.072862 mmap(0x7f6577dcd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25492] 10:12:36.072888 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.072904 <... mmap resumed> ) = 0x7f3314457000
[pid 25493] 10:12:36.072929 <... mmap resumed> ) = 0x7f6577dcd000
[pid 25492] 10:12:36.072951 mmap(0x7f638a9d2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25491] 10:12:36.072979 close(6 <unfinished ...>
[pid 25493] 10:12:36.073006 close(6 <unfinished ...>
[pid 25492] 10:12:36.073028 <... mmap resumed> ) = 0x7f638a9d2000
[pid 25491] 10:12:36.073052 <... close resumed> ) = 0
[pid 25493] 10:12:36.073082 <... close resumed> ) = 0
[pid 25492] 10:12:36.073112 close(6 <unfinished ...>
[pid 25491] 10:12:36.073136 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.073172 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.073200 <... close resumed> ) = 0
[pid 25491] 10:12:36.073223 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.073247 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.073264 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.073293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.073328 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.073358 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.073375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.073396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.073413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.073444 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.073560 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.073593 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.073610 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.073633 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.073651 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.073680 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.073716 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.073745 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.073764 <... open resumed> ) = 6
[pid 25493] 10:12:36.073784 <... open resumed> ) = 6
[pid 25492] 10:12:36.073799 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.073829 read(6,  <unfinished ...>
[pid 25493] 10:12:36.073857 read(6,  <unfinished ...>
[pid 25492] 10:12:36.073879 <... open resumed> ) = 6
[pid 25491] 10:12:36.073900 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.073934 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.073957 read(6,  <unfinished ...>
[pid 25491] 10:12:36.073980 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.074014 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.074042 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.074071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25493] 10:12:36.074107 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.074135 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.074158 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.074191 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.074217 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.074245 <... mmap resumed> ) = 0x7f3313e5c000
[pid 25493] 10:12:36.074266 <... mmap resumed> ) = 0x7f657798f000
[pid 25492] 10:12:36.074282 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.074308 mprotect(0x7f3313ebe000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.074339 mprotect(0x7f65779a6000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.074365 <... mmap resumed> ) = 0x7f638dc9e000
[pid 25491] 10:12:36.074384 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.074405 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.074420 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.074449 mmap(0x7f33140bd000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25493] 10:12:36.074588 mmap(0x7f6577ba6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25492] 10:12:36.074619 <... mmap resumed> ) = 0x7f638a4aa000
[pid 25491] 10:12:36.074635 <... mmap resumed> ) = 0x7f33140bd000
[pid 25493] 10:12:36.074665 <... mmap resumed> ) = 0x7f6577ba6000
[pid 25492] 10:12:36.074688 mprotect(0x7f638a585000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.074715 close(6 <unfinished ...>
[pid 25493] 10:12:36.074742 mmap(0x7f6577ba8000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.074769 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.074784 <... close resumed> ) = 0
[pid 25493] 10:12:36.074814 <... mmap resumed> ) = 0x7f6577ba8000
[pid 25492] 10:12:36.074836 mmap(0x7f638a785000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25491] 10:12:36.074865 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.074901 close(6 <unfinished ...>
[pid 25492] 10:12:36.074923 <... mmap resumed> ) = 0x7f638a785000
[pid 25491] 10:12:36.074947 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.074970 <... close resumed> ) = 0
[pid 25492] 10:12:36.074993 close(6 <unfinished ...>
[pid 25491] 10:12:36.075016 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.075052 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.075086 <... close resumed> ) = 0
[pid 25491] 10:12:36.075110 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.075133 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.075149 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.075178 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.075211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.075241 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.075258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.075280 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.075296 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.075329 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.075369 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.075406 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.075430 <... open resumed> ) = 6
[pid 25493] 10:12:36.075451 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.075548 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.075581 read(6,  <unfinished ...>
[pid 25493] 10:12:36.075610 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.075638 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.075656 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.075685 <... open resumed> ) = 6
[pid 25492] 10:12:36.075700 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.075730 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.075758 read(6,  <unfinished ...>
[pid 25492] 10:12:36.075780 <... open resumed> ) = 6
[pid 25491] 10:12:36.075795 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25493] 10:12:36.075830 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.075852 read(6,  <unfinished ...>
[pid 25491] 10:12:36.075875 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.075907 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.075929 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.075957 <... mmap resumed> ) = 0x7f3313a79000
[pid 25493] 10:12:36.075978 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.076006 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.076029 mprotect(0x7f3313c32000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.076060 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.076086 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.076115 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.076136 <... mmap resumed> ) = 0x7f6578adc000
[pid 25492] 10:12:36.076155 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.076196 mmap(0x7f3313e31000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25493] 10:12:36.076247 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.076275 <... mmap resumed> ) = 0x7f638a2a6000
[pid 25491] 10:12:36.076291 <... mmap resumed> ) = 0x7f3313e31000
[pid 25493] 10:12:36.076317 <... mmap resumed> ) = 0x7f657761b000
[pid 25492] 10:12:36.076334 mprotect(0x7f638a2a9000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.076360 mmap(0x7f3313e58000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.076392 mprotect(0x7f657778a000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.076419 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.076435 <... mmap resumed> ) = 0x7f3313e58000
[pid 25493] 10:12:36.076562 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.076586 mmap(0x7f638a4a8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25491] 10:12:36.076620 close(6 <unfinished ...>
[pid 25493] 10:12:36.076649 mmap(0x7f6577989000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25492] 10:12:36.076681 <... mmap resumed> ) = 0x7f638a4a8000
[pid 25491] 10:12:36.076711 <... close resumed> ) = 0
[pid 25493] 10:12:36.076746 <... mmap resumed> ) = 0x7f6577989000
[pid 25492] 10:12:36.076773 close(6 <unfinished ...>
[pid 25491] 10:12:36.076797 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.076833 close(6 <unfinished ...>
[pid 25492] 10:12:36.076855 <... close resumed> ) = 0
[pid 25491] 10:12:36.076877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.076901 <... close resumed> ) = 0
[pid 25492] 10:12:36.076924 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.076954 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.076990 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.077020 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.077037 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.077059 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.077075 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.077113 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.077146 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.077177 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.077193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.077216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.077233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.077262 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.077297 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.077326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.077344 <... open resumed> ) = 6
[pid 25493] 10:12:36.077364 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.077381 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.077412 read(6,  <unfinished ...>
[pid 25493] 10:12:36.077441 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.077555 <... open resumed> ) = 6
[pid 25491] 10:12:36.077573 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.077602 <... open resumed> ) = 6
[pid 25492] 10:12:36.077618 read(6,  <unfinished ...>
[pid 25491] 10:12:36.077641 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.077668 read(6,  <unfinished ...>
[pid 25492] 10:12:36.077691 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.077713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25493] 10:12:36.077747 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.077770 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.077792 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.077823 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.077845 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.077880 <... mmap resumed> ) = 0x7f33164ec000
[pid 25493] 10:12:36.077905 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25492] 10:12:36.077935 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.077964 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.077995 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.078021 <... mmap resumed> ) = 0x7f638a07a000
[pid 25491] 10:12:36.078037 <... mmap resumed> ) = 0x7f331384c000
[pid 25493] 10:12:36.078057 <... mmap resumed> ) = 0x7f657738c000
[pid 25492] 10:12:36.078073 mprotect(0x7f638a0a3000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.078099 mprotect(0x7f3313878000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.078129 mprotect(0x7f6577417000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.078153 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.078169 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.078189 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.078204 mmap(0x7f638a2a3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25491] 10:12:36.078233 mmap(0x7f3313a78000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25493] 10:12:36.078265 mmap(0x7f6577617000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25492] 10:12:36.078292 <... mmap resumed> ) = 0x7f638a2a3000
[pid 25491] 10:12:36.078312 <... mmap resumed> ) = 0x7f3313a78000
[pid 25493] 10:12:36.078348 <... mmap resumed> ) = 0x7f6577617000
[pid 25492] 10:12:36.078372 mmap(0x7f638a2a5000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.078404 close(6 <unfinished ...>
[pid 25493] 10:12:36.078437 mmap(0x7f657761a000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.078569 <... mmap resumed> ) = 0x7f638a2a5000
[pid 25491] 10:12:36.078595 <... close resumed> ) = 0
[pid 25493] 10:12:36.078625 <... mmap resumed> ) = 0x7f657761a000
[pid 25492] 10:12:36.078647 close(6 <unfinished ...>
[pid 25491] 10:12:36.078672 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.078709 close(6 <unfinished ...>
[pid 25492] 10:12:36.078732 <... close resumed> ) = 0
[pid 25491] 10:12:36.078756 <... open resumed> ) = 6
[pid 25493] 10:12:36.078778 <... close resumed> ) = 0
[pid 25492] 10:12:36.078800 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.078830 read(6,  <unfinished ...>
[pid 25493] 10:12:36.078858 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.078886 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.078903 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.078931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.078953 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.078985 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.079012 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.079042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.079058 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25493] 10:12:36.079093 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.079110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.079139 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.079173 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.079201 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.079219 <... mmap resumed> ) = 0x7f3313647000
[pid 25493] 10:12:36.079240 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.079258 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.079288 mprotect(0x7f331364c000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.079319 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.079349 <... open resumed> ) = 6
[pid 25491] 10:12:36.079364 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.079384 <... open resumed> ) = 6
[pid 25492] 10:12:36.079400 read(6,  <unfinished ...>
[pid 25491] 10:12:36.079424 mmap(0x7f331384b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25493] 10:12:36.079458 read(6,  <unfinished ...>
[pid 25492] 10:12:36.079561 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.079586 <... mmap resumed> ) = 0x7f331384b000
[pid 25493] 10:12:36.079613 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.079636 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.079659 close(6 <unfinished ...>
[pid 25493] 10:12:36.079685 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.079708 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.079736 <... close resumed> ) = 0
[pid 25493] 10:12:36.079769 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25492] 10:12:36.079805 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.079832 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.079867 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.079895 <... mmap resumed> ) = 0x7f638dc9d000
[pid 25491] 10:12:36.079915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.079938 <... mmap resumed> ) = 0x7f6577186000
[pid 25492] 10:12:36.079954 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.079982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.080018 mprotect(0x7f657718c000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.080044 <... mmap resumed> ) = 0x7f6389e64000
[pid 25491] 10:12:36.080060 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.080081 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.080097 mprotect(0x7f6389e79000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.080123 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.080157 mmap(0x7f657738b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25492] 10:12:36.080185 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.080200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.080223 <... mmap resumed> ) = 0x7f657738b000
[pid 25492] 10:12:36.080244 mmap(0x7f638a078000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25491] 10:12:36.080272 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.080306 close(6 <unfinished ...>
[pid 25492] 10:12:36.080328 <... mmap resumed> ) = 0x7f638a078000
[pid 25491] 10:12:36.080360 <... open resumed> ) = 6
[pid 25493] 10:12:36.080389 <... close resumed> ) = 0
[pid 25492] 10:12:36.080412 close(6 <unfinished ...>
[pid 25491] 10:12:36.080441 read(6,  <unfinished ...>
[pid 25493] 10:12:36.080578 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.080611 <... close resumed> ) = 0
[pid 25491] 10:12:36.080648 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.080678 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.080696 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.080725 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.080752 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.080784 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.080800 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25493] 10:12:36.080835 <... open resumed> ) = 6
[pid 25492] 10:12:36.080851 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.080882 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.080922 read(6,  <unfinished ...>
[pid 25492] 10:12:36.080946 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.080962 <... mmap resumed> ) = 0x7f3313444000
[pid 25493] 10:12:36.080983 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.081006 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.081109 mprotect(0x7f3313446000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.081143 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.081166 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.081185 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.081205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.081238 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.081271 mmap(0x7f3313645000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25493] 10:12:36.081305 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.081330 <... open resumed> ) = 6
[pid 25491] 10:12:36.081346 <... mmap resumed> ) = 0x7f3313645000
[pid 25493] 10:12:36.081375 <... mmap resumed> ) = 0x7f6578adb000
[pid 25492] 10:12:36.081397 read(6,  <unfinished ...>
[pid 25491] 10:12:36.081423 close(6 <unfinished ...>
[pid 25493] 10:12:36.081450 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.081528 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.081554 <... close resumed> ) = 0
[pid 25493] 10:12:36.081584 <... mmap resumed> ) = 0x7f6576e50000
[pid 25492] 10:12:36.081602 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.081625 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.081659 mprotect(0x7f6576f7c000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.081687 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.081717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.081739 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.081755 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.081783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.081819 mmap(0x7f657717c000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25492] 10:12:36.081855 <... mmap resumed> ) = 0x7f6389c59000
[pid 25491] 10:12:36.081871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.081892 <... mmap resumed> ) = 0x7f657717c000
[pid 25492] 10:12:36.081913 mprotect(0x7f6389c63000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.081939 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.081975 mmap(0x7f6577185000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.082001 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.082017 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.082039 <... mmap resumed> ) = 0x7f6577185000
[pid 25492] 10:12:36.082061 mmap(0x7f6389e62000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25491] 10:12:36.082090 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.082127 close(6 <unfinished ...>
[pid 25492] 10:12:36.082149 <... mmap resumed> ) = 0x7f6389e62000
[pid 25491] 10:12:36.082173 <... open resumed> ) = 6
[pid 25493] 10:12:36.082195 <... close resumed> ) = 0
[pid 25492] 10:12:36.082217 close(6 <unfinished ...>
[pid 25491] 10:12:36.082240 read(6,  <unfinished ...>
[pid 25493] 10:12:36.082268 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.082297 <... close resumed> ) = 0
[pid 25491] 10:12:36.082321 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.082359 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.082380 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.082413 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.082446 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.082589 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.082609 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25493] 10:12:36.082645 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.082663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.082694 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.082725 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.082754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.082770 <... mmap resumed> ) = 0x7f33164eb000
[pid 25493] 10:12:36.082795 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.082814 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.082843 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.082877 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.082908 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.082927 <... mmap resumed> ) = 0x7f3313221000
[pid 25493] 10:12:36.082954 <... open resumed> ) = 6
[pid 25492] 10:12:36.082971 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.083001 mprotect(0x7f3313238000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.083033 read(6,  <unfinished ...>
[pid 25492] 10:12:36.083058 <... open resumed> ) = 6
[pid 25491] 10:12:36.083073 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.083094 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.083117 read(6,  <unfinished ...>
[pid 25491] 10:12:36.083140 mmap(0x7f3313438000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25493] 10:12:36.083173 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.083196 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.083218 <... mmap resumed> ) = 0x7f3313438000
[pid 25493] 10:12:36.083248 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.083279 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.083303 close(6 <unfinished ...>
[pid 25493] 10:12:36.083330 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.083357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.083386 <... close resumed> ) = 0
[pid 25493] 10:12:36.083430 <... mmap resumed> ) = 0x7f6576c4c000
[pid 25492] 10:12:36.083449 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.083583 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.083621 mprotect(0x7f6576c4e000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.083648 <... mmap resumed> ) = 0x7f6389a56000
[pid 25491] 10:12:36.083664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.083686 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.083707 mprotect(0x7f6389a58000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.083739 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.083776 mmap(0x7f6576e4e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25492] 10:12:36.083804 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.083820 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.083842 <... mmap resumed> ) = 0x7f6576e4e000
[pid 25492] 10:12:36.083866 mmap(0x7f6389c57000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25491] 10:12:36.083902 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.083938 close(6 <unfinished ...>
[pid 25492] 10:12:36.083960 <... mmap resumed> ) = 0x7f6389c57000
[pid 25491] 10:12:36.083988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.084018 <... close resumed> ) = 0
[pid 25492] 10:12:36.084042 close(6 <unfinished ...>
[pid 25491] 10:12:36.084065 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.084101 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.084130 <... close resumed> ) = 0
[pid 25491] 10:12:36.084153 <... open resumed> ) = 6
[pid 25493] 10:12:36.084174 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.084191 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.084217 read(6,  <unfinished ...>
[pid 25493] 10:12:36.084245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.084277 <... mmap resumed> ) = 0x7f638dc9c000
[pid 25491] 10:12:36.084311 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.084341 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.084358 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.084387 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.084414 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.084444 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.084532 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.084575 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.084594 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.084626 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.084660 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.084691 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.084707 <... mmap resumed> ) = 0x7f3312fdd000
[pid 25493] 10:12:36.084728 <... open resumed> ) = 6
[pid 25492] 10:12:36.084744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.084773 mprotect(0x7f331301e000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.084804 read(6,  <unfinished ...>
[pid 25492] 10:12:36.084827 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.084844 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.084865 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.084893 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.084923 mmap(0x7f331321e000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25493] 10:12:36.084956 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.084979 <... open resumed> ) = 6
[pid 25491] 10:12:36.084994 <... mmap resumed> ) = 0x7f331321e000
[pid 25493] 10:12:36.085023 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.085055 read(6,  <unfinished ...>
[pid 25491] 10:12:36.085079 close(6 <unfinished ...>
[pid 25493] 10:12:36.085105 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.085133 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.085155 <... close resumed> ) = 0
[pid 25493] 10:12:36.085184 <... mmap resumed> ) = 0x7f6576a49000
[pid 25492] 10:12:36.085201 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.085224 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.085259 mprotect(0x7f6576a4b000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.085285 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.085314 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.085344 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.085362 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.085398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.085436 mmap(0x7f6576c4a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25492] 10:12:36.085568 <... mmap resumed> ) = 0x7f6389837000
[pid 25491] 10:12:36.085591 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.085614 <... mmap resumed> ) = 0x7f6576c4a000
[pid 25492] 10:12:36.085639 mprotect(0x7f6389854000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.085669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.085705 close(6 <unfinished ...>
[pid 25492] 10:12:36.085727 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.085743 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.085766 <... close resumed> ) = 0
[pid 25492] 10:12:36.085788 mmap(0x7f6389a53000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25491] 10:12:36.085819 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.085856 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.085885 <... mmap resumed> ) = 0x7f6389a53000
[pid 25491] 10:12:36.085907 <... open resumed> ) = 6
[pid 25493] 10:12:36.085929 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.085952 mmap(0x7f6389a55000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.085980 read(6,  <unfinished ...>
[pid 25493] 10:12:36.086008 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.086039 <... mmap resumed> ) = 0x7f6389a55000
[pid 25491] 10:12:36.086061 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.086091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.086108 close(6 <unfinished ...>
[pid 25491] 10:12:36.086130 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.086157 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.086186 <... close resumed> ) = 0
[pid 25491] 10:12:36.086237 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.086274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.086302 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.086331 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.086360 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.086392 <... mmap resumed> ) = 0x7f638dc9b000
[pid 25491] 10:12:36.086448 <... mmap resumed> ) = 0x7f33164ea000
[pid 25493] 10:12:36.086554 <... open resumed> ) = 6
[pid 25492] 10:12:36.086574 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.086600 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.086633 read(6,  <unfinished ...>
[pid 25492] 10:12:36.086656 <... mmap resumed> ) = 0x7f638dc9a000
[pid 25491] 10:12:36.086681 <... mmap resumed> ) = 0x7f3312cf6000
[pid 25493] 10:12:36.086703 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.086727 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.086751 mprotect(0x7f3312dd1000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.086784 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.086806 <... mmap resumed> ) = 0x7f638dc98000
[pid 25491] 10:12:36.086826 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.086847 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.086876 arch_prctl(ARCH_SET_FS, 0x7f638dc987c0 <unfinished ...>
[pid 25491] 10:12:36.086900 mmap(0x7f3312fd1000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25493] 10:12:36.086939 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.086965 <... arch_prctl resumed> ) = 0
[pid 25491] 10:12:36.087021 <... mmap resumed> ) = 0x7f3312fd1000
[pid 25493] 10:12:36.087053 <... mmap resumed> ) = 0x7f6578ada000
[pid 25492] 10:12:36.087074 mprotect(0x7f6389a53000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087101 close(6 <unfinished ...>
[pid 25493] 10:12:36.087128 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.087155 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.087175 <... close resumed> ) = 0
[pid 25493] 10:12:36.087205 <... mmap resumed> ) = 0x7f65766b5000
[pid 25492] 10:12:36.087222 mprotect(0x7f6389c57000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087248 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.087283 mprotect(0x7f657683f000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.087308 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.087340 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.087363 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.087379 mprotect(0x7f6389e62000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087404 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.087448 mmap(0x7f6576a3f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25492] 10:12:36.087569 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.087597 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.087620 <... mmap resumed> ) = 0x7f6576a3f000
[pid 25492] 10:12:36.087642 mprotect(0x7f638a078000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.087705 mmap(0x7f6576a44000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.087732 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.087762 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.087787 <... mmap resumed> ) = 0x7f6576a44000
[pid 25492] 10:12:36.087809 mprotect(0x7f638a2a3000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087836 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.087873 close(6 <unfinished ...>
[pid 25492] 10:12:36.087895 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.087921 <... open resumed> ) = 6
[pid 25493] 10:12:36.087942 <... close resumed> ) = 0
[pid 25492] 10:12:36.087966 mprotect(0x7f638a4a8000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.087992 read(6,  <unfinished ...>
[pid 25493] 10:12:36.088020 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.088050 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.088170 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.088200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.088218 mprotect(0x7f638a785000, 40960, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.088243 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.088270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.088307 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.088405 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.088445 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.088532 mprotect(0x7f638a9d2000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.088565 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.088600 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.088631 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.088660 <... mmap resumed> ) = 0x7f3312af2000
[pid 25493] 10:12:36.088683 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.088702 mprotect(0x7f638abec000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.088728 mprotect(0x7f3312af5000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.088758 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.088790 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.088810 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.088831 <... open resumed> ) = 6
[pid 25492] 10:12:36.088847 mprotect(0x7f638adf9000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.088873 mmap(0x7f3312cf4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25493] 10:12:36.088907 read(6,  <unfinished ...>
[pid 25492] 10:12:36.088930 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.089134 <... mmap resumed> ) = 0x7f3312cf4000
[pid 25493] 10:12:36.089167 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.089193 mprotect(0x7f638b5e5000, 110592, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.089219 close(6 <unfinished ...>
[pid 25493] 10:12:36.089246 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.089269 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.089353 <... close resumed> ) = 0
[pid 25493] 10:12:36.089391 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25492] 10:12:36.089424 mprotect(0x7f638b871000, 16384, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.089451 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.089564 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.089599 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.089699 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.089725 <... mmap resumed> ) = 0x7f6576449000
[pid 25492] 10:12:36.089742 mprotect(0x7f638bc06000, 16384, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.089768 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.089806 mprotect(0x7f65764ab000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.089833 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.089852 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.089874 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.089896 mprotect(0x7f638be11000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.089922 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.089956 mmap(0x7f65766aa000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25492] 10:12:36.089986 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.090010 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.090035 <... mmap resumed> ) = 0x7f65766aa000
[pid 25492] 10:12:36.090060 mprotect(0x7f638c015000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.090089 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.090126 close(6 <unfinished ...>
[pid 25492] 10:12:36.090148 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.090836 <... open resumed> ) = 6
[pid 25493] 10:12:36.090868 <... close resumed> ) = 0
[pid 25492] 10:12:36.090894 mprotect(0x7f638cd6d000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.090924 read(6,  <unfinished ...>
[pid 25493] 10:12:36.090952 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.090983 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091020 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.091051 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.091069 mprotect(0x7f638d1a2000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.091095 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.091122 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.091153 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091173 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.091210 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.091227 mprotect(0x7f638d426000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.091253 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.091287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.091321 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091347 <... mmap resumed> ) = 0x7f33128c6000
[pid 25493] 10:12:36.091373 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.091394 mprotect(0x7f638d62f000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.091421 mprotect(0x7f33128ef000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.091452 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.091564 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091599 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.091622 <... open resumed> ) = 6
[pid 25492] 10:12:36.091638 mprotect(0x7f638d874000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.091665 mmap(0x7f3312aef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25493] 10:12:36.091700 read(6,  <unfinished ...>
[pid 25492] 10:12:36.091723 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091747 <... mmap resumed> ) = 0x7f3312aef000
[pid 25493] 10:12:36.091774 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.091805 mprotect(0x7f638da8e000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.091831 mmap(0x7f3312af1000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.091865 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.091888 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.091928 <... mmap resumed> ) = 0x7f3312af1000
[pid 25493] 10:12:36.091956 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25492] 10:12:36.091989 mprotect(0x7f638dcb1000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.092016 close(6 <unfinished ...>
[pid 25493] 10:12:36.092043 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.092070 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.092086 <... close resumed> ) = 0
[pid 25493] 10:12:36.092117 <... mmap resumed> ) = 0x7f6576066000
[pid 25492] 10:12:36.092134 munmap(0x7f638dca6000, 39387 <unfinished ...>
[pid 25491] 10:12:36.092164 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.092199 mprotect(0x7f657621f000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.092226 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.092242 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.092264 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.092280 set_tid_address(0x7f638dc98a90 <unfinished ...>
[pid 25491] 10:12:36.092303 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.092338 mmap(0x7f657641e000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25492] 10:12:36.092367 <... set_tid_address resumed> ) = 25492
[pid 25491] 10:12:36.092383 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.092404 <... mmap resumed> ) = 0x7f657641e000
[pid 25492] 10:12:36.092425 set_robust_list(0x7f638dc98aa0, 24 <unfinished ...>
[pid 25491] 10:12:36.092449 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.092582 mmap(0x7f6576445000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.092612 <... set_robust_list resumed> ) = 0
[pid 25491] 10:12:36.092628 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.092651 <... mmap resumed> ) = 0x7f6576445000
[pid 25492] 10:12:36.092674 futex(0x7ffc8d38612c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25491] 10:12:36.092701 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.092738 close(6 <unfinished ...>
[pid 25492] 10:12:36.092761 <... futex resumed> ) = 0
[pid 25491] 10:12:36.092776 <... open resumed> ) = 6
[pid 25493] 10:12:36.092796 <... close resumed> ) = 0
[pid 25492] 10:12:36.092828 futex(0x7ffc8d38612c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f638dc987c0 <unfinished ...>
[pid 25491] 10:12:36.092883 read(6,  <unfinished ...>
[pid 25493] 10:12:36.092931 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.093019 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25491] 10:12:36.093049 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.093079 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.093097 rt_sigaction(SIGRTMIN, {0x7f638cb5bc60, [], SA_RESTORER|SA_SIGINFO, 0x7f638cb65790},  <unfinished ...>
[pid 25491] 10:12:36.093127 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.093154 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.093186 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.093203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25493] 10:12:36.093238 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.093256 rt_sigaction(SIGRT_1, {0x7f638cb5bcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f638cb65790},  <unfinished ...>
[pid 25491] 10:12:36.093282 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.093313 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.093355 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.093376 <... mmap resumed> ) = 0x7f33164e9000
[pid 25493] 10:12:36.093401 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.093427 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25491] 10:12:36.093517 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.093559 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.093592 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25491] 10:12:36.093618 <... mmap resumed> ) = 0x7f33126b0000
[pid 25493] 10:12:36.093640 <... open resumed> ) = 6
[pid 25492] 10:12:36.093656 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25491] 10:12:36.093678 mprotect(0x7f33126c5000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.093709 read(6,  <unfinished ...>
[pid 25492] 10:12:36.093733 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25491] 10:12:36.093790 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.093813 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.093837 statfs("/selinux",  <unfinished ...>
[pid 25491] 10:12:36.093870 mmap(0x7f33128c4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25493] 10:12:36.093904 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.093927 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350340, f_bavail=6350340, f_files=1000000, f_ffree=691098, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25491] 10:12:36.093994 <... mmap resumed> ) = 0x7f33128c4000
[pid 25493] 10:12:36.094027 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25492] 10:12:36.094065 brk(0 <unfinished ...>
[pid 25491] 10:12:36.094089 close(6 <unfinished ...>
[pid 25493] 10:12:36.094115 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.094141 <... brk resumed> ) = 0x23b1000
[pid 25491] 10:12:36.094157 <... close resumed> ) = 0
[pid 25493] 10:12:36.094195 <... mmap resumed> ) = 0x7f6578ad9000
[pid 25492] 10:12:36.094216 brk(0x23d2000 <unfinished ...>
[pid 25491] 10:12:36.094241 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.094276 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.094303 <... brk resumed> ) = 0x23d2000
[pid 25491] 10:12:36.094329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.094353 <... mmap resumed> ) = 0x7f6575e39000
[pid 25492] 10:12:36.094369 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.094406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.094445 mprotect(0x7f6575e65000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.094550 <... open resumed> ) = 6
[pid 25491] 10:12:36.094582 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.094606 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.094622 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.094645 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.094679 mmap(0x7f6576065000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25492] 10:12:36.094709 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.094740 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.094764 <... mmap resumed> ) = 0x7f6576065000
[pid 25492] 10:12:36.094785 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.094812 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.094848 close(6 <unfinished ...>
[pid 25492] 10:12:36.094870 <... mmap resumed> ) = 0x7f638dcaf000
[pid 25491] 10:12:36.094886 <... open resumed> ) = 6
[pid 25493] 10:12:36.094907 <... close resumed> ) = 0
[pid 25492] 10:12:36.094929 read(6,  <unfinished ...>
[pid 25491] 10:12:36.095021 read(6,  <unfinished ...>
[pid 25493] 10:12:36.095049 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.095082 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25491] 10:12:36.095110 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.095139 <... open resumed> ) = 6
[pid 25492] 10:12:36.095155 read(6,  <unfinished ...>
[pid 25491] 10:12:36.095178 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.095211 read(6,  <unfinished ...>
[pid 25492] 10:12:36.095234 <... read resumed> "", 1024) = 0
[pid 25491] 10:12:36.095257 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.095293 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.095316 close(6 <unfinished ...>
[pid 25491] 10:12:36.095343 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.095378 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.095409 <... close resumed> ) = 0
[pid 25491] 10:12:36.095429 <... mmap resumed> ) = 0x7f33124a5000
[pid 25493] 10:12:36.095452 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25492] 10:12:36.095573 munmap(0x7f638dcaf000, 4096 <unfinished ...>
[pid 25491] 10:12:36.095602 mprotect(0x7f33124af000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.095636 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.095664 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.095730 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.095754 <... mmap resumed> ) = 0x7f6575c34000
[pid 25492] 10:12:36.095771 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25491] 10:12:36.095804 mmap(0x7f33126ae000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25493] 10:12:36.095837 mprotect(0x7f6575c39000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.095863 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.095946 <... mmap resumed> ) = 0x7f33126ae000
[pid 25493] 10:12:36.095979 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.095997 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f638cb65790},  <unfinished ...>
[pid 25491] 10:12:36.096024 close(6 <unfinished ...>
[pid 25493] 10:12:36.096050 mmap(0x7f6575e38000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25492] 10:12:36.096078 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.096103 <... close resumed> ) = 0
[pid 25493] 10:12:36.096134 <... mmap resumed> ) = 0x7f6575e38000
[pid 25492] 10:12:36.096155 fstat(2,  <unfinished ...>
[pid 25491] 10:12:36.096179 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.096214 close(6 <unfinished ...>
[pid 25492] 10:12:36.096236 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25491] 10:12:36.096295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.096321 <... close resumed> ) = 0
[pid 25492] 10:12:36.096349 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f638cb65790},  <unfinished ...>
[pid 25491] 10:12:36.096387 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.096437 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.096592 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.096626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.096655 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.096674 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0},  <unfinished ...>
[pid 25491] 10:12:36.096705 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.096742 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.096775 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.096794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.096818 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.096835 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0},  <unfinished ...>
[pid 25491] 10:12:36.096862 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.096901 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.096931 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.096950 <... open resumed> ) = 6
[pid 25493] 10:12:36.096971 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.096990 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f638cb65790},  <unfinished ...>
[pid 25491] 10:12:36.097016 read(6,  <unfinished ...>
[pid 25493] 10:12:36.097045 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.097075 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.097102 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.097133 <... open resumed> ) = 6
[pid 25492] 10:12:36.097150 umask(0 <unfinished ...>
[pid 25491] 10:12:36.097172 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.097201 read(6,  <unfinished ...>
[pid 25492] 10:12:36.097224 <... umask resumed> ) = 0
[pid 25491] 10:12:36.097281 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25493] 10:12:36.097322 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.097347 geteuid( <unfinished ...>
[pid 25491] 10:12:36.097371 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.097411 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.097434 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.097453 <... mmap resumed> ) = 0x7f33122a2000
[pid 25493] 10:12:36.097474 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25492] 10:12:36.097514 getuid( <unfinished ...>
[pid 25491] 10:12:36.097563 mprotect(0x7f33122a4000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.097599 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.097630 <... getuid resumed> ) = 47
[pid 25491] 10:12:36.097649 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.097677 <... mmap resumed> ) = 0x7f6575a31000
[pid 25492] 10:12:36.097695 getgid( <unfinished ...>
[pid 25491] 10:12:36.097717 mmap(0x7f33124a3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25493] 10:12:36.097752 mprotect(0x7f6575a33000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.097782 <... getgid resumed> ) = 12
[pid 25491] 10:12:36.097826 <... mmap resumed> ) = 0x7f33124a3000
[pid 25493] 10:12:36.097858 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.097876 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25491] 10:12:36.097899 close(6 <unfinished ...>
[pid 25493] 10:12:36.097927 mmap(0x7f6575c32000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25492] 10:12:36.097956 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25491] 10:12:36.097976 <... close resumed> ) = 0
[pid 25493] 10:12:36.098005 <... mmap resumed> ) = 0x7f6575c32000
[pid 25492] 10:12:36.098031 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25491] 10:12:36.098055 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.098087 close(6 <unfinished ...>
[pid 25492] 10:12:36.098110 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25491] 10:12:36.098131 <... mmap resumed> ) = 0x7f33164e8000
[pid 25493] 10:12:36.098168 <... close resumed> ) = 0
[pid 25492] 10:12:36.098195 getgroups(65536,  <unfinished ...>
[pid 25491] 10:12:36.098220 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.098256 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.098281 <... getgroups resumed> [12]) = 1
[pid 25491] 10:12:36.098297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.098312 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.098320 setgroups(0, [] <unfinished ...>
[pid 25491] 10:12:36.098331 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.098352 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.098367 <... setgroups resumed> ) = 0
[pid 25491] 10:12:36.098377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.098390 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.098398 getegid( <unfinished ...>
[pid 25491] 10:12:36.098407 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.098427 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.098441 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.098449 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.098464 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.098474 geteuid( <unfinished ...>
[pid 25491] 10:12:36.098482 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.098501 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.098533 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.098547 <... open resumed> ) = 6
[pid 25493] 10:12:36.098561 <... open resumed> ) = 6
[pid 25492] 10:12:36.098569 geteuid( <unfinished ...>
[pid 25491] 10:12:36.098578 read(6,  <unfinished ...>
[pid 25479] 10:12:36.098587 <... select resumed> ) = 1 (in [11], left {599, 775278})
[pid 25493] 10:12:36.098613 read(6,  <unfinished ...>
[pid 25492] 10:12:36.098623 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.098632 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25479] 10:12:36.098644 read(11,  <unfinished ...>
[pid 25493] 10:12:36.098660 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.098672 getegid( <unfinished ...>
[pid 25491] 10:12:36.098681 fstat(6,  <unfinished ...>
[pid 25479] 10:12:36.098690 <... read resumed> "\27\3\1\0P", 5) = 5
[pid 25493] 10:12:36.098706 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.098715 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.098726 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25479] 10:12:36.098747 read(11,  <unfinished ...>
[pid 25493] 10:12:36.098763 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25492] 10:12:36.098782 setgid(12 <unfinished ...>
[pid 25491] 10:12:36.098792 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25479] 10:12:36.098808 <... read resumed> "\305Ka\265\243\350\332\341Xm\343\210*\177q #\25T\205.$}9\2\211\221\234\203\274=\262\35\200\4\254\253\370\321o\3426\233(D\227\317\267\3578\235\200\347\261j9w<\f\21\205\f\342\24$+\306\335\264\345\224Y\376wA\t5Dv\247", 80) = 80
[pid 25493] 10:12:36.098841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.098854 <... setgid resumed> ) = 0
[pid 25491] 10:12:36.098864 <... mmap resumed> ) = 0x7f3312083000
[pid 25479] 10:12:36.098873 write(9, "weddings@hillcrestgolfclub.com\n", 31 <unfinished ...>
[pid 25493] 10:12:36.098900 <... mmap resumed> ) = 0x7f6578ad8000
[pid 25492] 10:12:36.098912 setuid(0 <unfinished ...>
[pid 25491] 10:12:36.098923 mprotect(0x7f33120a0000, 2093056, PROT_NONE <unfinished ...>
[pid 25479] 10:12:36.098936 <... write resumed> ) = 31
[pid 25493] 10:12:36.098950 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.098994 <... setuid resumed> ) = 0
[pid 25491] 10:12:36.099035 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.099313 fsync(9 <unfinished ...>
[pid 25493] 10:12:36.099380 <... mmap resumed> ) = 0x7f657580e000
[pid 25492] 10:12:36.099399 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.099439 mmap(0x7f331229f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25482] 10:12:36.099580 <... read resumed> " R21\0230\21\6\3U\4\n\23\nGlobalSign1\0230\21\6\3U\4\3\23\nGlobalSign\0R0P1\v0\t\6\3U\4\6\23\2KR1\0340\32\6\3U\4\n\f\23Government of Korea1\r0\v\6\3U\4\v\f\4GPKI1\0240\22\6\3U\4\3\f\vGPKIRootCA1\0\2610\201\2561\v0\t\6\3U\4\6\23\2EU1C0A\6\3U\4\7\23:Madrid (see current address at www.camerfirma.com/address)1\0220\20\6\3U\4\5\23\tA827432871\0330\31\6\3U\4\n\23\22AC Camerf"..., 5522) = 1448
[pid 25493] 10:12:36.099605 mprotect(0x7f6575825000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.099618 <... open resumed> ) = 6
[pid 25491] 10:12:36.099651 <... mmap resumed> ) = 0x7f331229f000
[pid 25482] 10:12:36.099669 read(11,  <unfinished ...>
[pid 25493] 10:12:36.099725 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.099742 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.099770 mmap(0x7f33122a1000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:36.099800 <... read resumed> "ivision1806\6\3U\4\v\23/(c) 2006 thawte, Inc. - For authorized use only1\0370\35\6\3U\4\3\23\26thawte Primary Root CA\0w0u1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1'0%\6\3U\4\v\23\36GTE CyberTrust Solutions, Inc.1#0!\6\3U\4\3\23\32GTE CyberTrust Global Root\0I0G1\v0\t\6\3U\4\6\23\2CH1\0250\23\6\3U\4\n\23\fSwissSign"..., 4074) = 4074
[pid 25493] 10:12:36.101281 mmap(0x7f6575a25000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25492] 10:12:36.101330 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.101370 <... mmap resumed> ) = 0x7f33122a1000
[pid 25482] 10:12:36.101395 brk(0x1f97000 <unfinished ...>
[pid 25479] 10:12:36.101422 <... fsync resumed> ) = 0
[pid 25493] 10:12:36.101454 <... mmap resumed> ) = 0x7f6575a25000
[pid 25492] 10:12:36.101480 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.101506 close(6 <unfinished ...>
[pid 25482] 10:12:36.101582 <... brk resumed> ) = 0x1f97000
[pid 25479] 10:12:36.106348 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR <unfinished ...>
[pid 25493] 10:12:36.106425 close(6 <unfinished ...>
[pid 25492] 10:12:36.106451 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.106486 <... close resumed> ) = 0
[pid 25482] 10:12:36.106549 write(11, "\26\3\3\0\7\v\0\0\3\0\0\0\26\3\3\0f\20\0\0ba\4\7\304\312|\257\256*\243\214\10\232FYf6X\241\347sM\374\4<\376Yd\237J ;\270\271\370::A\6~\254\36\374\210\177<\226\323`\0\242,t\272\22i'\32\232B\353\325\265\315V\"\344t@TW\307\264\5\233KA\310\237\332\242\375M0\237Kz\237&RW\23\2658\307\30id\24\3\3\0\1\1\26\3\3\0`\334Kr\237\216Y8\344y\335\7\361<\224t\211\nQ\f\316a6Q\tmf\331\313\\s\327\0\20\253 \260GP}\237\0365|t\225\270\235\230\317\361'\354f\340t\321\361qy\360\177Off\241\222wM$63$\355\353\341c\211\254opQ\204\203[\17\0248\266\21m\322\270\352\2356L", 226 <unfinished ...>
[pid 25479] 10:12:36.106606 <... open resumed> ) = 14
[pid 25493] 10:12:36.106636 <... close resumed> ) = 0
[pid 25492] 10:12:36.106687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.106741 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25482] 10:12:36.106774 <... write resumed> ) = 226
[pid 25479] 10:12:36.106789 alarm(60 <unfinished ...>
[pid 25493] 10:12:36.106825 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.106860 <... mmap resumed> ) = 0x7f638dcaf000
[pid 25491] 10:12:36.106877 <... mmap resumed> ) = 0x7f33164e7000
[pid 25482] 10:12:36.106936 read(11,  <unfinished ...>
[pid 25479] 10:12:36.106960 <... alarm resumed> ) = 0
[pid 25493] 10:12:36.106983 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.107012 read(6,  <unfinished ...>
[pid 25491] 10:12:36.107041 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:36.107067 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25493] 10:12:36.107106 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.107143 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25491] 10:12:36.107276 <... mmap resumed> ) = 0x7f33164e6000
[pid 25479] 10:12:36.107310 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.107334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.107354 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.107389 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:36.107416 alarm(0 <unfinished ...>
[pid 25493] 10:12:36.107445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.107477 <... socket resumed> ) = 7
[pid 25491] 10:12:36.107493 <... mmap resumed> ) = 0x7f33164e4000
[pid 25479] 10:12:36.107514 <... alarm resumed> ) = 60
[pid 25493] 10:12:36.107664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.107691 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.107741 arch_prctl(ARCH_SET_FS, 0x7f33164e47c0 <unfinished ...>
[pid 25479] 10:12:36.107766 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.107810 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.107845 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.107862 <... arch_prctl resumed> ) = 0
[pid 25479] 10:12:36.107918 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.107942 <... open resumed> ) = 6
[pid 25492] 10:12:36.107957 close(7 <unfinished ...>
[pid 25491] 10:12:36.107984 mprotect(0x7f331229f000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.108013 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.108055 read(6,  <unfinished ...>
[pid 25492] 10:12:36.108079 <... close resumed> ) = 0
[pid 25491] 10:12:36.108095 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.108115 <... open resumed> ) = 15
[pid 25493] 10:12:36.108139 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.108163 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.108189 mprotect(0x7f33124a3000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.108217 read(15,  <unfinished ...>
[pid 25493] 10:12:36.108270 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.108293 <... socket resumed> ) = 7
[pid 25491] 10:12:36.108309 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.108341 <... read resumed> "cpu  123069 1342424 395178 67343096 2509 0 0 0\ncpu0 123069 1342424 395178 67343096 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58419197\nbtime 1450798266\nprocesses 892972\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25493] 10:12:36.108370 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.108409 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.108442 mprotect(0x7f33126ae000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.108471 close(15 <unfinished ...>
[pid 25493] 10:12:36.108506 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.108616 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.108637 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.108668 <... close resumed> ) = 0
[pid 25493] 10:12:36.108715 <... mmap resumed> ) = 0x7f65755ca000
[pid 25492] 10:12:36.108734 close(7 <unfinished ...>
[pid 25491] 10:12:36.108760 mprotect(0x7f33128c4000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.108788 stat("/var/spool/exim/db/wait-remote_smtp",  <unfinished ...>
[pid 25493] 10:12:36.108828 mprotect(0x7f657560b000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.108855 <... close resumed> ) = 0
[pid 25491] 10:12:36.108879 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.108910 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25493] 10:12:36.108950 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.108967 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.108996 mprotect(0x7f3312aef000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.109022 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR <unfinished ...>
[pid 25493] 10:12:36.109059 mmap(0x7f657580b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25492] 10:12:36.109089 <... open resumed> ) = 7
[pid 25491] 10:12:36.109109 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.109136 <... open resumed> ) = 15
[pid 25493] 10:12:36.109159 <... mmap resumed> ) = 0x7f657580b000
[pid 25492] 10:12:36.109185 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.109210 mprotect(0x7f3312cf4000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.109237 fcntl(15, F_GETFD <unfinished ...>
[pid 25493] 10:12:36.109266 close(6 <unfinished ...>
[pid 25492] 10:12:36.109288 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25491] 10:12:36.109317 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.109441 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.109468 <... close resumed> ) = 0
[pid 25492] 10:12:36.109493 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.109584 mprotect(0x7f3312fd1000, 40960, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.109619 fcntl(15, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.109650 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.109681 <... mmap resumed> ) = 0x7f638dcae000
[pid 25491] 10:12:36.109698 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.109797 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.109822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.109840 read(7,  <unfinished ...>
[pid 25491] 10:12:36.109868 mprotect(0x7f331321e000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.109894 read(15,  <unfinished ...>
[pid 25493] 10:12:36.109923 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.109959 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25491] 10:12:36.110002 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.110033 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25493] 10:12:36.110068 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.110087 read(7,  <unfinished ...>
[pid 25491] 10:12:36.110110 mprotect(0x7f3313438000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.110137 close(15 <unfinished ...>
[pid 25493] 10:12:36.110169 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.110200 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.110218 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.110239 <... close resumed> ) = 0
[pid 25493] 10:12:36.110266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.110286 close(7 <unfinished ...>
[pid 25491] 10:12:36.110313 mprotect(0x7f3313645000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.110340 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.110374 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.110406 <... close resumed> ) = 0
[pid 25491] 10:12:36.110422 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.110712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.110745 <... open resumed> ) = 6
[pid 25492] 10:12:36.110762 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25491] 10:12:36.110791 mprotect(0x7f3313e31000, 110592, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.110819 stat("/var/tmp",  <unfinished ...>
[pid 25493] 10:12:36.110857 read(6,  <unfinished ...>
[pid 25492] 10:12:36.110880 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.110913 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.110994 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25493] 10:12:36.111052 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.111078 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.111116 mprotect(0x7f33140bd000, 16384, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.111143 brk(0xb79000 <unfinished ...>
[pid 25493] 10:12:36.111175 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.111198 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.111215 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.111316 <... brk resumed> ) = 0xb79000
[pid 25473] 10:12:36.111447 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25493] 10:12:36.111486 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.111585 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.111625 mprotect(0x7f3314452000, 16384, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.111654 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0 <unfinished ...>
[pid 25473] 10:12:36.111687 recvfrom(16,  <unfinished ...>
[pid 25493] 10:12:36.111721 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.111752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.111770 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.111790 <... open resumed> ) = 15
[pid 25473] 10:12:36.111807 <... recvfrom resumed> "\361\346\201\200\0\1\0\5\0\0\0\0\23onehospitalitygroup\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\2{\0\23\0\n\5aspmx\1l\6google\300 \300\f\0\17\0\1\0\0\2{\0\t\0\24\4alt1\3007\300\f\0\17\0\1\0\0\2{\0\t\0\24\4alt2\3007\300\f\0\17\0\1\0\0\2{\0\26\0\36\6aspmx2\ngooglemail\300 \300\f\0\17\0\1\0\0\2{\0\v\0\36\6aspmx3\300\207", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 171
[pid 25493] 10:12:36.111856 <... mmap resumed> ) = 0x7f6578ad7000
[pid 25492] 10:12:36.111881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.111912 mprotect(0x7f331465d000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.111939 fcntl(15, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.111962 close(16 <unfinished ...>
[pid 25493] 10:12:36.111996 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.112026 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.112044 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.112068 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.112085 <... close resumed> ) = 0
[pid 25493] 10:12:36.112146 <... mmap resumed> ) = 0x7f65752e3000
[pid 25492] 10:12:36.112166 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.112196 mprotect(0x7f3314861000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.112223 fcntl(15, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.112246 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25493] 10:12:36.112281 mprotect(0x7f65753be000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.112309 <... open resumed> ) = 7
[pid 25491] 10:12:36.112325 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.113042 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.113071 <... socket resumed> ) = 16
[pid 25493] 10:12:36.113097 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.113113 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.113137 mprotect(0x7f33155b9000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.113164 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.113187 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25493] 10:12:36.113225 mmap(0x7f65755be000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25492] 10:12:36.113256 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25491] 10:12:36.113286 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.113324 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25473] 10:12:36.113366 <... connect resumed> ) = 0
[pid 25493] 10:12:36.113392 <... mmap resumed> ) = 0x7f65755be000
[pid 25492] 10:12:36.113424 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25491] 10:12:36.113454 mprotect(0x7f33159ee000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.113482 pread(15,  <unfinished ...>
[pid 25473] 10:12:36.113506 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25493] 10:12:36.113603 close(6 <unfinished ...>
[pid 25492] 10:12:36.113635 <... mmap resumed> ) = 0x7f638dc8e000
[pid 25491] 10:12:36.113655 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.113680 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25473] 10:12:36.113728 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25493] 10:12:36.113759 <... close resumed> ) = 0
[pid 25492] 10:12:36.113785 close(7 <unfinished ...>
[pid 25491] 10:12:36.113809 mprotect(0x7f3315c72000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.113836 pread(15,  <unfinished ...>
[pid 25473] 10:12:36.113860 sendto(16, "\231\204\1\0\0\1\0\0\0\0\0\0\5aspmx\1l\6google\3com\0\0\1\0\1", 36, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25493] 10:12:36.113922 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.113955 <... close resumed> ) = 0
[pid 25491] 10:12:36.113982 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.114004 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25473] 10:12:36.114046 <... sendto resumed> ) = 36
[pid 25493] 10:12:36.114073 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.114092 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.114125 mprotect(0x7f3315e7b000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.114152 close(15 <unfinished ...>
[pid 25473] 10:12:36.114177 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25493] 10:12:36.114212 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.114245 <... open resumed> ) = 7
[pid 25491] 10:12:36.114261 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.114293 <... close resumed> ) = 0
[pid 25493] 10:12:36.114331 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.114350 read(7,  <unfinished ...>
[pid 25491] 10:12:36.114374 mprotect(0x7f33160c0000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.114402 close(14 <unfinished ...>
[pid 25493] 10:12:36.114436 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.114468 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.114498 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.114599 <... close resumed> ) = 0
[pid 25493] 10:12:36.114649 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.114676 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.114702 mprotect(0x7f33162da000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.114729 write(11, "\27\3\1\0 uqEEZR\0009@\260o8\270= \v$\255\313/\212\340,kD\270\270\364[\234C\352\27\3\1\0 \273\376\311\265\351\264\342\306x\"\274\337n\333\340\243P\4\f\26\226\376\356\367\253\36u\210\343\337\333D", 74 <unfinished ...>
[pid 25493] 10:12:36.114793 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.114827 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.114862 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.114907 <... write resumed> ) = 74
[pid 25493] 10:12:36.114940 <... open resumed> ) = 6
[pid 25492] 10:12:36.114958 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25491] 10:12:36.114992 mprotect(0x7f33164fd000, 4096, PROT_READ <unfinished ...>
[pid 25479] 10:12:36.115019 write(11, "\25\3\1\0 \370U\311R\266Ny\177\345O\217=n\334\351O\261\347\215\336*\10\241\254\313\350\323\375p\210\340\316", 37 <unfinished ...>
[pid 25493] 10:12:36.115069 read(6,  <unfinished ...>
[pid 25492] 10:12:36.115094 <... mmap resumed> ) = 0x7f6389629000
[pid 25491] 10:12:36.115110 <... mprotect resumed> ) = 0
[pid 25479] 10:12:36.115190 <... write resumed> ) = 37
[pid 25493] 10:12:36.115362 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.115392 mprotect(0x7f6389635000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.115420 munmap(0x7f33164f2000, 39387 <unfinished ...>
[pid 25479] 10:12:36.115449 close(11 <unfinished ...>
[pid 25493] 10:12:36.115503 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.115572 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.115592 <... munmap resumed> ) = 0
[pid 25479] 10:12:36.115609 <... close resumed> ) = 0
[pid 25493] 10:12:36.115649 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.115688 mmap(0x7f6389835000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25491] 10:12:36.115728 set_tid_address(0x7f33164e4a90 <unfinished ...>
[pid 25479] 10:12:36.115753 close(13 <unfinished ...>
[pid 25493] 10:12:36.115784 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.115815 <... mmap resumed> ) = 0x7f6389835000
[pid 25491] 10:12:36.115841 <... set_tid_address resumed> ) = 25491
[pid 25479] 10:12:36.115859 <... close resumed> ) = 0
[pid 25493] 10:12:36.115881 <... mmap resumed> ) = 0x7f65750df000
[pid 25492] 10:12:36.115898 close(7 <unfinished ...>
[pid 25491] 10:12:36.115920 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25479] 10:12:36.115943 munmap(0x7fea0f283000, 4096 <unfinished ...>
[pid 25493] 10:12:36.115976 mprotect(0x7f65750e2000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.116009 <... close resumed> ) = 0
[pid 25491] 10:12:36.116046 <... set_robust_list resumed> ) = 0
[pid 25479] 10:12:36.116064 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.116088 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.116105 mprotect(0x7f6389835000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.116132 futex(0x7ffc8619cb2c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25479] 10:12:36.116156 close(10 <unfinished ...>
[pid 25493] 10:12:36.116187 mmap(0x7f65752e1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25492] 10:12:36.116216 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.116236 <... futex resumed> ) = 0
[pid 25479] 10:12:36.116252 <... close resumed> ) = 0
[pid 25493] 10:12:36.116274 <... mmap resumed> ) = 0x7f65752e1000
[pid 25492] 10:12:36.116298 munmap(0x7f638dc8e000, 39387 <unfinished ...>
[pid 25491] 10:12:36.116327 futex(0x7ffc8619cb2c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f33164e47c0 <unfinished ...>
[pid 25479] 10:12:36.116354 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25493] 10:12:36.116385 close(6 <unfinished ...>
[pid 25492] 10:12:36.116407 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.116432 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25479] 10:12:36.116456 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.116488 <... close resumed> ) = 0
[pid 25492] 10:12:36.116513 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.116621 rt_sigaction(SIGRTMIN, {0x7f33153a7c60, [], SA_RESTORER|SA_SIGINFO, 0x7f33153b1790},  <unfinished ...>
[pid 25479] 10:12:36.116663 write(12, "S000004T\f\0\0", 11 <unfinished ...>
[pid 25493] 10:12:36.116717 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.116750 <... open resumed> ) = 7
[pid 25491] 10:12:36.116772 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25479] 10:12:36.116789 <... write resumed> ) = 11
[pid 25433] 10:12:36.116811 <... select resumed> ) = 1 (in [11], left {59, 838022})
[pid 25493] 10:12:36.116843 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.116862 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.116885 rt_sigaction(SIGRT_1, {0x7f33153a7cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f33153b1790},  <unfinished ...>
[pid 25479] 10:12:36.116912 write(12, "X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0", 196 <unfinished ...>
[pid 25433] 10:12:36.116938 read(11,  <unfinished ...>
[pid 25493] 10:12:36.116969 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.117001 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25491] 10:12:36.117021 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25479] 10:12:36.117038 <... write resumed> ) = 196
[pid 25433] 10:12:36.117140 <... read resumed> "S000004T\f\0\0X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0", 16384) = 207
[pid 25493] 10:12:36.117180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.117198 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.117221 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25479] 10:12:36.117247 write(12, "X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT\\nMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew\\nHhcNMTQwNDI4MTc0MzMzWhcNMTgwNDMwMDcxMjI1WjCBwDEpMCcGA1UEBRMgNkFL\\nWFplbXhIT2pMTUZWdHlVWF"..., 1888 <unfinished ...>
[pid 25433] 10:12:36.117275 wait4(-1,  <unfinished ...>
[pid 25493] 10:12:36.117305 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.117335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.117371 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25479] 10:12:36.117398 <... write resumed> ) = 1888
[pid 25433] 10:12:36.117417 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25493] 10:12:36.117445 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.117465 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.117493 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25479] 10:12:36.117516 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25433] 10:12:36.117622 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25493] 10:12:36.117672 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.117716 <... mmap resumed> ) = 0x7f638dcae000
[pid 25491] 10:12:36.117735 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25479] 10:12:36.117799 <... write resumed> ) = 9
[pid 25433] 10:12:36.117825 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25493] 10:12:36.117853 <... open resumed> ) = 6
[pid 25492] 10:12:36.117870 read(7,  <unfinished ...>
[pid 25491] 10:12:36.117897 statfs("/selinux",  <unfinished ...>
[pid 25479] 10:12:36.117931 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25433] 10:12:36.117956 read(11,  <unfinished ...>
[pid 25493] 10:12:36.117988 read(6,  <unfinished ...>
[pid 25492] 10:12:36.118011 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.118050 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350340, f_bavail=6350340, f_files=1000000, f_ffree=691098, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25479] 10:12:36.118119 <... write resumed> ) = 11
[pid 25433] 10:12:36.118143 <... read resumed> "X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT\\nMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew\\nHhcNMTQwNDI4MTc0MzMzWhcNMTgwNDMwMDcxMjI1WjCBwDEpMCcGA1UEBRMgNkFL\\nWFplbXhIT2pMTUZWdHlVWF"..., 16384) = 1908
[pid 25493] 10:12:36.118292 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.118321 close(7 <unfinished ...>
[pid 25491] 10:12:36.118347 brk(0 <unfinished ...>
[pid 25479] 10:12:36.118369 write(12, "A000096\0=\0\0\1\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 93/D3-30194-37204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000", 103 <unfinished ...>
[pid 25433] 10:12:36.118395 wait4(-1,  <unfinished ...>
[pid 25493] 10:12:36.118428 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.118451 <... close resumed> ) = 0
[pid 25491] 10:12:36.118466 <... brk resumed> ) = 0x15bf000
[pid 25479] 10:12:36.118482 <... write resumed> ) = 103
[pid 25433] 10:12:36.118502 <... wait4 resumed> 0x7ffc7271ba60, WNOHANG, NULL) = 0
[pid 25493] 10:12:36.118603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.118662 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25491] 10:12:36.118699 brk(0x15e0000 <unfinished ...>
[pid 25479] 10:12:36.118729 write(12, "I00002050.116.78.207\00052768\0", 27 <unfinished ...>
[pid 25433] 10:12:36.118755 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25493] 10:12:36.118790 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.118821 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.118860 <... brk resumed> ) = 0x15e0000
[pid 25479] 10:12:36.118891 <... write resumed> ) = 27
[pid 25433] 10:12:36.118910 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25493] 10:12:36.118939 <... mmap resumed> ) = 0x7f6574eb3000
[pid 25492] 10:12:36.118956 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.118985 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25479] 10:12:36.119021 write(12, "Z0000010", 8 <unfinished ...>
[pid 25433] 10:12:36.119046 read(11,  <unfinished ...>
[pid 25493] 10:12:36.119076 mprotect(0x7f6574edc000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.119104 <... socket resumed> ) = 7
[pid 25491] 10:12:36.119120 <... open resumed> ) = 6
[pid 25479] 10:12:36.119149 <... write resumed> ) = 8
[pid 25433] 10:12:36.119166 <... read resumed> "A000096\0=\0\0\1\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 93/D3-30194-37204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000I00002050.116.78.207\00052768\0Z0000010", 16384) = 138
[pid 25493] 10:12:36.119196 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.119213 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.119249 fstat(6,  <unfinished ...>
[pid 25479] 10:12:36.119272 close(12 <unfinished ...>
[pid 25433] 10:12:36.119295 close(11 <unfinished ...>
[pid 25493] 10:12:36.119329 mmap(0x7f65750dc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25492] 10:12:36.119360 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.119378 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25479] 10:12:36.119409 <... close resumed> ) = 0
[pid 25433] 10:12:36.119984 <... close resumed> ) = 0
[pid 25493] 10:12:36.120021 <... mmap resumed> ) = 0x7f65750dc000
[pid 25492] 10:12:36.120045 close(7 <unfinished ...>
[pid 25491] 10:12:36.120072 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25479] 10:12:36.120100 exit_group(0) = ?
[pid 25473] 10:12:36.120644 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25433] 10:12:36.120670 wait4(25479,  <unfinished ...>
[pid 25493] 10:12:36.120717 mmap(0x7f65750de000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.120747 <... close resumed> ) = 0
[pid 25491] 10:12:36.120764 <... mmap resumed> ) = 0x7f33164fb000
[pid 25479] 10:12:36.120780 +++ exited with 0 +++
[pid 25473] 10:12:36.120792 recvfrom(16,  <unfinished ...>
[pid 25433] 10:12:36.120816 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25479
[pid 25493] 10:12:36.120853 <... mmap resumed> ) = 0x7f65750de000
[pid 25492] 10:12:36.120878 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.120908 read(6,  <unfinished ...>
[pid 25473] 10:12:36.120998 <... recvfrom resumed> "\231\204\201\200\0\1\0\1\0\0\0\0\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\234\0\4\255\302M\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 52
[pid 25433] 10:12:36.121027 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.121062 close(6 <unfinished ...>
[pid 25492] 10:12:36.121085 <... socket resumed> ) = 7
[pid 25491] 10:12:36.121107 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25473] 10:12:36.121136 close(16 <unfinished ...>
[pid 25433] 10:12:36.121164 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.121213 <... close resumed> ) = 0
[pid 25492] 10:12:36.121242 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.121276 read(6,  <unfinished ...>
[pid 25473] 10:12:36.121300 <... close resumed> ) = 0
[pid 25433] 10:12:36.121354 write(8, "2015-12-30 10:12:36 weddings@hillcrestgolfclub.com: remote_smtp transport succeeded\n", 84 <unfinished ...>
[pid 25493] 10:12:36.121398 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.121429 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.121447 <... read resumed> "", 1024) = 0
[pid 25473] 10:12:36.121471 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25433] 10:12:36.121499 <... write resumed> ) = 84
[pid 25493] 10:12:36.121620 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.121651 close(7 <unfinished ...>
[pid 25491] 10:12:36.121685 close(6 <unfinished ...>
[pid 25473] 10:12:36.121713 <... socket resumed> ) = 16
[pid 25433] 10:12:36.121731 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.121766 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.121799 <... close resumed> ) = 0
[pid 25491] 10:12:36.121822 <... close resumed> ) = 0
[pid 25473] 10:12:36.121839 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25433] 10:12:36.121868 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.121916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.121934 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.121964 munmap(0x7f33164fb000, 4096 <unfinished ...>
[pid 25473] 10:12:36.121992 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25433] 10:12:36.122016 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.122049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.122079 <... open resumed> ) = 7
[pid 25491] 10:12:36.122096 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.122164 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:36.122193 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.122233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.122253 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.122276 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25473] 10:12:36.122309 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25433] 10:12:36.122333 close(7 <unfinished ...>
[pid 25493] 10:12:36.122366 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.122399 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.122434 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.122519 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:36.122626 <... close resumed> ) = 0
[pid 25493] 10:12:36.122656 <... open resumed> ) = 6
[pid 25492] 10:12:36.122673 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.122700 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f33153b1790},  <unfinished ...>
[pid 25473] 10:12:36.122728 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:36.122750 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25493] 10:12:36.122794 read(6,  <unfinished ...>
[pid 25492] 10:12:36.122820 <... mmap resumed> ) = 0x7f638dcae000
[pid 25491] 10:12:36.122837 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:36.122863 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:36.122888 <... open resumed> ) = 7
[pid 25493] 10:12:36.122912 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.122936 read(7,  <unfinished ...>
[pid 25491] 10:12:36.122962 fstat(2,  <unfinished ...>
[pid 25473] 10:12:36.122986 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:36.123007 fcntl(7, F_GETFD <unfinished ...>
[pid 25493] 10:12:36.123039 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.123062 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.123095 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25473] 10:12:36.123154 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25433] 10:12:36.123181 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.123205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25492] 10:12:36.123235 close(7 <unfinished ...>
[pid 25491] 10:12:36.123259 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f33153b1790},  <unfinished ...>
[pid 25473] 10:12:36.123287 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25433] 10:12:36.123308 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.123341 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.123367 <... close resumed> ) = 0
[pid 25491] 10:12:36.123383 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:36.123403 close(16 <unfinished ...>
[pid 25433] 10:12:36.123431 <... fcntl resumed> ) = 0
[pid 25493] 10:12:36.123455 <... mmap resumed> ) = 0x7f6578ad6000
[pid 25492] 10:12:36.123475 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25491] 10:12:36.123504 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25473] 10:12:36.123619 <... close resumed> ) = 0
[pid 25433] 10:12:36.123640 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.123671 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.123703 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.123741 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25473] 10:12:36.123764 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.123815 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5375466, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.123853 <... mmap resumed> ) = 0x7f6574c9d000
[pid 25492] 10:12:36.123870 read(6,  <unfinished ...>
[pid 25491] 10:12:36.123895 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25473] 10:12:36.123921 <... open resumed> ) = 16
[pid 25433] 10:12:36.123942 write(7, "2015-12-30 10:12:36 [25433] 1aEJMY-0006c6-AN => weddings@hillcrestgolfclub.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3156 H=mx1.emailsrvr.com [98.129.185.131]:25 X=TLS"..., 515 <unfinished ...>
[pid 25493] 10:12:36.123984 mprotect(0x7f6574cb2000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.124012 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25491] 10:12:36.124069 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25473] 10:12:36.124093 fstat(16,  <unfinished ...>
[pid 25433] 10:12:36.124116 <... write resumed> ) = 515
[pid 25493] 10:12:36.124163 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.124182 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.124212 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f33153b1790},  <unfinished ...>
[pid 25473] 10:12:36.124238 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25433] 10:12:36.124266 geteuid( <unfinished ...>
[pid 25493] 10:12:36.124296 mmap(0x7f6574eb1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25492] 10:12:36.124326 <... open resumed> ) = 7
[pid 25491] 10:12:36.124357 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:36.124385 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:36.124419 <... geteuid resumed> ) = 0
[pid 25493] 10:12:36.124447 <... mmap resumed> ) = 0x7f6574eb1000
[pid 25492] 10:12:36.124474 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.124500 umask(0 <unfinished ...>
[pid 25473] 10:12:36.124595 <... mmap resumed> ) = 0x7f7c15ca1000
[pid 25433] 10:12:36.124619 getegid( <unfinished ...>
[pid 25493] 10:12:36.124650 close(6 <unfinished ...>
[pid 25492] 10:12:36.124673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.124702 <... umask resumed> ) = 0
[pid 25473] 10:12:36.124764 read(16,  <unfinished ...>
[pid 25433] 10:12:36.124811 <... getegid resumed> ) = 12
[pid 25493] 10:12:36.124839 <... close resumed> ) = 0
[pid 25492] 10:12:36.124876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.124904 geteuid( <unfinished ...>
[pid 25473] 10:12:36.124932 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25433] 10:12:36.124955 setgid(12 <unfinished ...>
[pid 25493] 10:12:36.124986 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.125017 <... mmap resumed> ) = 0x7f638dcae000
[pid 25491] 10:12:36.125034 <... geteuid resumed> ) = 0
[pid 25473] 10:12:36.125052 read(16,  <unfinished ...>
[pid 25433] 10:12:36.125079 <... setgid resumed> ) = 0
[pid 25493] 10:12:36.125102 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.125120 read(7,  <unfinished ...>
[pid 25491] 10:12:36.125147 getuid( <unfinished ...>
[pid 25473] 10:12:36.125169 <... read resumed> "", 1024) = 0
[pid 25433] 10:12:36.125196 setuid(47 <unfinished ...>
[pid 25493] 10:12:36.125229 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.125264 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.125287 <... getuid resumed> ) = 47
[pid 25473] 10:12:36.125306 read(16,  <unfinished ...>
[pid 25433] 10:12:36.125333 <... setuid resumed> ) = 0
[pid 25493] 10:12:36.125360 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.125379 close(7 <unfinished ...>
[pid 25491] 10:12:36.125403 getgid( <unfinished ...>
[pid 25473] 10:12:36.125425 <... read resumed> "", 1024) = 0
[pid 25433] 10:12:36.125443 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25493] 10:12:36.125478 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.125508 <... close resumed> ) = 0
[pid 25491] 10:12:36.125528 <... getgid resumed> ) = 12
[pid 25473] 10:12:36.125576 close(16 <unfinished ...>
[pid 25433] 10:12:36.125605 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25493] 10:12:36.125641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.125663 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25491] 10:12:36.125692 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25473] 10:12:36.125717 <... close resumed> ) = 0
[pid 25433] 10:12:36.125732 stat("/etc/localtime",  <unfinished ...>
[pid 25493] 10:12:36.125766 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.125798 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.125823 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25473] 10:12:36.125843 munmap(0x7f7c15ca1000, 4096 <unfinished ...>
[pid 25433] 10:12:36.125869 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.125912 <... open resumed> ) = 6
[pid 25492] 10:12:36.125929 read(6,  <unfinished ...>
[pid 25491] 10:12:36.125954 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25473] 10:12:36.125977 <... munmap resumed> ) = 0
[pid 25433] 10:12:36.126027 pipe( <unfinished ...>
[pid 25493] 10:12:36.126066 read(6,  <unfinished ...>
[pid 25492] 10:12:36.126090 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25491] 10:12:36.126128 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25473] 10:12:36.126152 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25433] 10:12:36.126186 <... pipe resumed> [10, 11]) = 0
[pid 25493] 10:12:36.126213 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.126237 uname( <unfinished ...>
[pid 25491] 10:12:36.126260 getgroups(65536,  <unfinished ...>
[pid 25473] 10:12:36.126283 <... socket resumed> ) = 16
[pid 25433] 10:12:36.126299 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25493] 10:12:36.126334 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.126358 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25491] 10:12:36.126408 <... getgroups resumed> [12]) = 1
[pid 25473] 10:12:36.126436 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25433] 10:12:36.126469 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25493] 10:12:36.126495 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.126519 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0},  <unfinished ...>
[pid 25491] 10:12:36.126695 setgroups(0, [] <unfinished ...>
[pid 25473] 10:12:36.126721 <... connect resumed> ) = 0
[pid 25433] 10:12:36.126738 clone( <unfinished ...>
[pid 25493] 10:12:36.130417 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.130461 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f638cb65790}, 8) = 0
[pid 25491] 10:12:36.130496 <... setgroups resumed> ) = 0
[pid 25473] 10:12:36.130518 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25493] 10:12:36.130563 <... mmap resumed> ) = 0x7f6574a92000
[pid 25492] 10:12:36.130580 clone( <unfinished ...>
[pid 25491] 10:12:36.130801 getegid( <unfinished ...>
[pid 25473] 10:12:36.130825 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25433] 10:12:36.130845 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fea0f26ea90) = 25495
[pid 25493] 10:12:36.130895 mprotect(0x7f6574a9c000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.130927 <... getegid resumed> ) = 12
[pid 25473] 10:12:36.130944 sendto(16, "\215\271\1\0\0\1\0\0\0\0\0\0\4alt2\5aspmx\1l\6google\3com\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25433] 10:12:36.131003 close(10 <unfinished ...>
[pid 25493] 10:12:36.131036 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.131053 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f638dc98a90) = 25496
[pid 25491] 10:12:36.131094 geteuid( <unfinished ...>
[pid 25473] 10:12:36.131120 <... sendto resumed> ) = 41
[pid 25433] 10:12:36.131136 <... close resumed> ) = 0
[pid 25493] 10:12:36.131161 mmap(0x7f6574c9b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25492] 10:12:36.131191 wait4(25496,  <unfinished ...>
[pid 25491] 10:12:36.131214 <... geteuid resumed> ) = 0
[pid 25473] 10:12:36.131236 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25433] 10:12:36.131264 fcntl(11, F_GETFL <unfinished ...>
[pid 25493] 10:12:36.131293 <... mmap resumed> ) = 0x7f6574c9b000
[pid 25491] 10:12:36.131326 geteuid( <unfinished ...>
[pid 25433] 10:12:36.131353 <... fcntl resumed> ) = 0x1 (flags O_WRONLY)
[pid 25493] 10:12:36.131383 close(6 <unfinished ...>
[pid 25491] 10:12:36.131408 <... geteuid resumed> ) = 0
[pid 25433] 10:12:36.131424 fstat(11,  <unfinished ...>
[pid 25493] 10:12:36.131452 <... close resumed> ) = 0
[pid 25491] 10:12:36.131484 getegid( <unfinished ...>
[pid 25433] 10:12:36.131508 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130168038, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.131615 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.131653 <... getegid resumed> ) = 12
[pid 25433] 10:12:36.131676 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.131709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.131728 setgid(12 <unfinished ...>
[pid 25433] 10:12:36.131752 <... mmap resumed> ) = 0x7fea0f284000
[pid 25493] 10:12:36.131774 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.131810 <... setgid resumed> ) = 0
[pid 25433] 10:12:36.131829 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25493] 10:12:36.131858 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.131875 setuid(0 <unfinished ...>
[pid 25433] 10:12:36.131899 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25493] 10:12:36.132000 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.132036 <... setuid resumed> ) = 0
[pid 25433] 10:12:36.132089 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.132121 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.132141 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.132172 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124798116, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25493] 10:12:36.132208 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.132242 <... open resumed> ) = 6
[pid 25433] 10:12:36.132277 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1056 <unfinished ...>
[pid 25493] 10:12:36.132319 <... open resumed> ) = 6
[pid 25491] 10:12:36.132335 fstat(6,  <unfinished ...>
[pid 25433] 10:12:36.132358 <... write resumed> ) = 1056
[pid 25493] 10:12:36.132395 read(6,  <unfinished ...>
[pid 25491] 10:12:36.132421 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:36.132455 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.132485 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.132509 fstat(6,  <unfinished ...>
[pid 25433] 10:12:36.132615 <... lseek resumed> ) = 19
[pid 25493] 10:12:36.132646 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.132671 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25433] 10:12:36.132700 read(6,  <unfinished ...>
[pid 25493] 10:12:36.132735 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.132767 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:36.132795 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25493] 10:12:36.132830 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.132865 <... mmap resumed> ) = 0x7f33164fb000
[pid 25433] 10:12:36.132883 read(6,  <unfinished ...>
[pid 25493] 10:12:36.132911 <... mmap resumed> ) = 0x7f657488f000
[pid 25491] 10:12:36.132928 read(6,  <unfinished ...>
[pid 25433] 10:12:36.132956 <... read resumed> "", 8192) = 0
[pid 25493] 10:12:36.132979 mprotect(0x7f6574891000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.133007 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25433] 10:12:36.133136 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006c6-AN; Wed, 30 Dec 2015 10:12:34 -0600\nTo:  weddings@hillc"..., 2464 <unfinished ...>
[pid 25493] 10:12:36.133178 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.133195 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:36.133227 <... write resumed> ) = 2464
[pid 25493] 10:12:36.133327 mmap(0x7f6574a90000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25491] 10:12:36.133363 <... socket resumed> ) = 7
[pid 25433] 10:12:36.133381 write(11, "\n--1451491956-eximdsn-1284536747--\n", 35 <unfinished ...>
[pid 25493] 10:12:36.133413 <... mmap resumed> ) = 0x7f6574a90000
[pid 25491] 10:12:36.133439 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25433] 10:12:36.133480 <... write resumed> ) = 35
[pid 25493] 10:12:36.133503 close(6 <unfinished ...>
[pid 25491] 10:12:36.133572 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:36.133595 close(11 <unfinished ...>
[pid 25493] 10:12:36.133625 <... close resumed> ) = 0
[pid 25491] 10:12:36.133651 close(7 <unfinished ...>
[pid 25433] 10:12:36.133680 <... close resumed> ) = 0
[pid 25493] 10:12:36.133702 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.133739 <... close resumed> ) = 0
[pid 25433] 10:12:36.133761 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25493] 10:12:36.133796 <... mmap resumed> ) = 0x7f6578ad5000
[pid 25491] 10:12:36.133830 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25433] 10:12:36.133859 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.133886 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.133921 <... socket resumed> ) = 7
[pid 25433] 10:12:36.133937 wait4(25495,  <unfinished ...>
[pid 25493] 10:12:36.133970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.133988 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25493] 10:12:36.134025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.134061 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.134082 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.134099 close(7 <unfinished ...>
[pid 25493] 10:12:36.134128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.134157 <... close resumed> ) = 0
[pid 25493] 10:12:36.134185 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.134206 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.134239 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.134269 <... open resumed> ) = 7
[pid 25493] 10:12:36.134291 <... open resumed> ) = 6
[pid 25491] 10:12:36.134308 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.134337 read(6,  <unfinished ...>
[pid 25491] 10:12:36.134361 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25493] 10:12:36.134394 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.134424 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.134462 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.134491 <... mmap resumed> ) = 0x7f33164fa000
[pid 25493] 10:12:36.134517 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.134631 read(7,  <unfinished ...>
[pid 25493] 10:12:36.134665 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.134697 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25493] 10:12:36.134737 <... mmap resumed> ) = 0x7f6574670000
[pid 25491] 10:12:36.134755 read(7,  <unfinished ...>
[pid 25493] 10:12:36.134781 mprotect(0x7f657468d000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.134810 <... read resumed> "", 4096) = 0
[pid 25493] 10:12:36.134832 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.134848 close(7 <unfinished ...>
[pid 25493] 10:12:36.134876 mmap(0x7f657488c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25491] 10:12:36.134906 <... close resumed> ) = 0
[pid 25493] 10:12:36.134926 <... mmap resumed> ) = 0x7f657488c000
[pid 25491] 10:12:36.134947 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25493] 10:12:36.134979 mmap(0x7f657488e000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.135007 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.135047 <... mmap resumed> ) = 0x7f657488e000
[pid 25491] 10:12:36.135072 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.135109 close(6 <unfinished ...>
[pid 25491] 10:12:36.135132 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.135153 <... close resumed> ) = 0
[pid 25491] 10:12:36.135206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.135245 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.135272 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.135292 <... mmap resumed> ) = 0x7f6578ad4000
[pid 25491] 10:12:36.135352 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.135390 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.135424 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.135450 <... mmap resumed> ) = 0x7f6578ad3000
[pid 25491] 10:12:36.135476 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.135600 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.135633 <... open resumed> ) = 7
[pid 25493] 10:12:36.135654 <... mmap resumed> ) = 0x7f6578ad1000
[pid 25491] 10:12:36.135676 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.135703 arch_prctl(ARCH_SET_FS, 0x7f6578ad17c0 <unfinished ...>
[pid 25491] 10:12:36.135727 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25493] 10:12:36.135761 <... arch_prctl resumed> ) = 0
[pid 25491] 10:12:36.135818 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25493] 10:12:36.135850 mprotect(0x7f657488c000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.135877 <... mmap resumed> ) = 0x7f33164da000
[pid 25493] 10:12:36.135896 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.135916 close(7 <unfinished ...>
[pid 25493] 10:12:36.135943 mprotect(0x7f6574a90000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.135969 <... close resumed> ) = 0
[pid 25493] 10:12:36.135998 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136031 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.136070 mprotect(0x7f6574c9b000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.136096 <... open resumed> ) = 7
[pid 25493] 10:12:36.136115 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136141 read(7,  <unfinished ...>
[pid 25493] 10:12:36.136169 mprotect(0x7f6574eb1000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.136195 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.136222 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136252 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.136280 mprotect(0x7f65750dc000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.136338 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.136382 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136422 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25493] 10:12:36.136473 mprotect(0x7f65752e1000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.136506 <... mmap resumed> ) = 0x7f3311e75000
[pid 25493] 10:12:36.136614 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136748 mprotect(0x7f3311e81000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.136783 mprotect(0x7f65755be000, 40960, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.136809 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.136829 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.136939 mmap(0x7f3312081000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25493] 10:12:36.136977 mprotect(0x7f657580b000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.137004 <... mmap resumed> ) = 0x7f3312081000
[pid 25458] 10:12:36.137030 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25493] 10:12:36.137059 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.137089 close(7 <unfinished ...>
[pid 25458] 10:12:36.137114 recvfrom(16,  <unfinished ...>
[pid 25493] 10:12:36.137145 mprotect(0x7f6575a25000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.137171 <... close resumed> ) = 0
[pid 25458] 10:12:36.137208 <... recvfrom resumed> "\236\37\201\200\0\1\0\1\0\0\0\0\16wagthedogmedia\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\4\257\0\4\0\0\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 52
[pid 25493] 10:12:36.137245 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.137267 mprotect(0x7f3312081000, 4096, PROT_READ <unfinished ...>
[pid 25458] 10:12:36.137302 close(16 <unfinished ...>
[pid 25493] 10:12:36.137339 mprotect(0x7f6575c32000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.137368 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.137388 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25458] 10:12:36.137414 <... close resumed> ) = 0
[pid 25493] 10:12:36.137469 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.137761 munmap(0x7f33164da000, 39387 <unfinished ...>
[pid 25473] 10:12:36.137798 recvfrom(16,  <unfinished ...>
[pid 25458] 10:12:36.137824 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25493] 10:12:36.137860 mprotect(0x7f657641e000, 110592, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.137887 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.137913 <... recvfrom resumed> "\215\271\201\200\0\1\0\1\0\0\0\0\4alt2\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\235\0\4\255\302\314\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 57
[pid 25458] 10:12:36.137945 <... socket resumed> ) = 16
[pid 25493] 10:12:36.137968 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.138049 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.138082 close(16 <unfinished ...>
[pid 25458] 10:12:36.138110 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25493] 10:12:36.138150 mprotect(0x7f65766aa000, 16384, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.138179 <... open resumed> ) = 7
[pid 25473] 10:12:36.138200 <... close resumed> ) = 0
[pid 25458] 10:12:36.138254 <... connect resumed> ) = 0
[pid 25493] 10:12:36.138281 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.138385 fcntl(7, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.138414 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25458] 10:12:36.138454 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25493] 10:12:36.138489 mprotect(0x7f6576a3f000, 16384, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.138517 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25473] 10:12:36.138603 <... socket resumed> ) = 16
[pid 25458] 10:12:36.138622 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25493] 10:12:36.138648 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.138669 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.138699 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25458] 10:12:36.138730 sendto(16, "^\35\1\0\0\1\0\0\0\0\0\0\16wagthedogmedia\3com\0\0\1\0\1", 36, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25493] 10:12:36.138792 mprotect(0x7f6576c4a000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.138821 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25473] 10:12:36.138852 <... connect resumed> ) = 0
[pid 25458] 10:12:36.138869 <... sendto resumed> ) = 36
[pid 25493] 10:12:36.138891 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.138917 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.138946 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25458] 10:12:36.138971 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25493] 10:12:36.139003 mprotect(0x7f6576e4e000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.139030 <... mmap resumed> ) = 0x7f33164fa000
[pid 25473] 10:12:36.139047 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25493] 10:12:36.139071 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.139786 read(7,  <unfinished ...>
[pid 25473] 10:12:36.139826 sendto(16, "\235\271\1\0\0\1\0\0\0\0\0\0\4alt1\5aspmx\1l\6google\3com\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25493] 10:12:36.139884 mprotect(0x7f6577ba6000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.139914 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:36.139955 <... sendto resumed> ) = 41
[pid 25493] 10:12:36.139979 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140019 close(7 <unfinished ...>
[pid 25473] 10:12:36.140046 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25493] 10:12:36.140076 mprotect(0x7f6577fdb000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140104 <... close resumed> ) = 0
[pid 25493] 10:12:36.140123 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140144 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25493] 10:12:36.140176 mprotect(0x7f657825f000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140202 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.140246 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140271 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25493] 10:12:36.140304 mprotect(0x7f6578468000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140332 <... socket resumed> ) = 7
[pid 25493] 10:12:36.140352 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140383 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25493] 10:12:36.140425 mprotect(0x7f65786ad000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140452 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.140473 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140497 close(7 <unfinished ...>
[pid 25493] 10:12:36.140599 mprotect(0x7f65788c7000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140630 <... close resumed> ) = 0
[pid 25493] 10:12:36.140651 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140697 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25493] 10:12:36.140735 mprotect(0x7f6578aea000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.140770 <... socket resumed> ) = 7
[pid 25493] 10:12:36.140790 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.140807 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25493] 10:12:36.140842 munmap(0x7f6578adf000, 39387 <unfinished ...>
[pid 25491] 10:12:36.140878 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.140900 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.140917 close(7 <unfinished ...>
[pid 25493] 10:12:36.140946 set_tid_address(0x7f6578ad1a90 <unfinished ...>
[pid 25491] 10:12:36.140970 <... close resumed> ) = 0
[pid 25493] 10:12:36.140996 <... set_tid_address resumed> ) = 25493
[pid 25491] 10:12:36.141013 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.141047 set_robust_list(0x7f6578ad1aa0, 24 <unfinished ...>
[pid 25491] 10:12:36.141070 <... open resumed> ) = 7
[pid 25493] 10:12:36.141090 <... set_robust_list resumed> ) = 0
[pid 25491] 10:12:36.141107 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.141133 futex(0x7ffc364bd45c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25491] 10:12:36.141161 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.141194 <... futex resumed> ) = 0
[pid 25491] 10:12:36.141210 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.141240 futex(0x7ffc364bd45c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f6578ad17c0 <unfinished ...>
[pid 25491] 10:12:36.141265 <... mmap resumed> ) = 0x7f33164fa000
[pid 25493] 10:12:36.141285 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25491] 10:12:36.141308 read(7,  <unfinished ...>
[pid 25493] 10:12:36.141343 rt_sigaction(SIGRTMIN, {0x7f6577994c60, [], SA_RESTORER|SA_SIGINFO, 0x7f657799e790},  <unfinished ...>
[pid 25491] 10:12:36.141373 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.141409 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.141427 close(7 <unfinished ...>
[pid 25493] 10:12:36.141455 rt_sigaction(SIGRT_1, {0x7f6577994cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f657799e790},  <unfinished ...>
[pid 25491] 10:12:36.141482 <... close resumed> ) = 0
[pid 25493] 10:12:36.141502 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.141518 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25493] 10:12:36.141553 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25491] 10:12:36.141580 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.141620 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25491] 10:12:36.141649 read(6,  <unfinished ...>
[pid 25493] 10:12:36.141679 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25491] 10:12:36.141703 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25493] 10:12:36.141763 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25491] 10:12:36.141825 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25493] 10:12:36.141860 statfs("/selinux",  <unfinished ...>
[pid 25491] 10:12:36.141895 <... open resumed> ) = 7
[pid 25493] 10:12:36.141916 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350340, f_bavail=6350340, f_files=1000000, f_ffree=691098, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25491] 10:12:36.141985 fstat(7,  <unfinished ...>
[pid 25493] 10:12:36.142016 brk(0 <unfinished ...>
[pid 25491] 10:12:36.142038 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.142078 <... brk resumed> ) = 0x108f000
[pid 25491] 10:12:36.142095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.142125 brk(0x10b0000 <unfinished ...>
[pid 25491] 10:12:36.142150 <... mmap resumed> ) = 0x7f33164fa000
[pid 25493] 10:12:36.142170 <... brk resumed> ) = 0x10b0000
[pid 25491] 10:12:36.142197 read(7,  <unfinished ...>
[pid 25493] 10:12:36.142228 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.142265 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.142292 <... open resumed> ) = 6
[pid 25491] 10:12:36.142321 close(7 <unfinished ...>
[pid 25493] 10:12:36.142352 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.142375 <... close resumed> ) = 0
[pid 25493] 10:12:36.142394 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.142421 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25493] 10:12:36.142444 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.142461 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.142481 <... mmap resumed> ) = 0x7f6578ae8000
[pid 25491] 10:12:36.142490 read(6,  <unfinished ...>
[pid 25493] 10:12:36.142509 read(6,  <unfinished ...>
[pid 25491] 10:12:36.142750 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25493] 10:12:36.142798 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25491] 10:12:36.142830 uname( <unfinished ...>
[pid 25493] 10:12:36.142859 read(6,  <unfinished ...>
[pid 25491] 10:12:36.142883 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25493] 10:12:36.142937 <... read resumed> "", 1024) = 0
[pid 25491] 10:12:36.142964 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25493] 10:12:36.142997 close(6 <unfinished ...>
[pid 25491] 10:12:36.143024 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f33153b1790}, 8) = 0
[pid 25493] 10:12:36.143055 <... close resumed> ) = 0
[pid 25491] 10:12:36.143073 clone( <unfinished ...>
[pid 25493] 10:12:36.143315 munmap(0x7f6578ae8000, 4096) = 0
[pid 25491] 10:12:36.143410 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25497
[pid 25493] 10:12:36.143460 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25491] 10:12:36.143499 wait4(25497,  <unfinished ...>
[pid 25493] 10:12:36.143529 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.143632 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.143685 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25493] 10:12:36.143764 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.143813 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25493] 10:12:36.143852 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25493] 10:12:36.143890 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.143934 umask(0)    = 022
[pid 25493] 10:12:36.144006 geteuid()   = 0
[pid 25493] 10:12:36.144043 getuid()    = 503
[pid 25493] 10:12:36.144078 getgid()    = 499
[pid 25493] 10:12:36.144124 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25493] 10:12:36.144162 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25493] 10:12:36.144198 getgroups(65536, [500]) = 1
[pid 25493] 10:12:36.144236 setgroups(0, []) = 0
[pid 25493] 10:12:36.144273 getegid()   = 499
[pid 25493] 10:12:36.144307 geteuid()   = 0
[pid 25493] 10:12:36.144345 geteuid()   = 0
[pid 25493] 10:12:36.144377 getegid()   = 499
[pid 25493] 10:12:36.144410 setgid(499) = 0
[pid 25493] 10:12:36.144484 setuid(0)   = 0
[pid 25493] 10:12:36.144640 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25493] 10:12:36.144710 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25493] 10:12:36.144781 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25493] 10:12:36.144828 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae8000
[pid 25493] 10:12:36.144865 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25493] 10:12:36.145007 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25493] 10:12:36.145052 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.145100 close(7)    = 0
[pid 25493] 10:12:36.145136 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25493] 10:12:36.145172 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.145212 close(7)    = 0
[pid 25493] 10:12:36.145254 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25493] 10:12:36.145297 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25493] 10:12:36.145345 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.145381 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25493] 10:12:36.145449 read(7, "", 4096) = 0
[pid 25493] 10:12:36.145488 close(7)    = 0
[pid 25493] 10:12:36.145590 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.145663 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.145714 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.145763 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.145811 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25493] 10:12:36.145851 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25493] 10:12:36.145898 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f6578ac7000
[pid 25493] 10:12:36.145937 close(7)    = 0
[pid 25493] 10:12:36.145982 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25493] 10:12:36.146025 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.146067 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25493] 10:12:36.146126 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25473] 10:12:36.146165 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25493] 10:12:36.146191 <... mmap resumed> ) = 0x7f6574462000
[pid 25473] 10:12:36.146208 recvfrom(16,  <unfinished ...>
[pid 25493] 10:12:36.146238 mprotect(0x7f657446e000, 2097152, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.146265 <... recvfrom resumed> "\235\271\201\200\0\1\0\1\0\0\0\0\4alt1\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\373\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 57
[pid 25493] 10:12:36.146299 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.146316 close(16 <unfinished ...>
[pid 25493] 10:12:36.146348 mmap(0x7f657466e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25473] 10:12:36.146378 <... close resumed> ) = 0
[pid 25493] 10:12:36.146438 <... mmap resumed> ) = 0x7f657466e000
[pid 25473] 10:12:36.146468 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25493] 10:12:36.146502 close(7 <unfinished ...>
[pid 25473] 10:12:36.146530 <... socket resumed> ) = 16
[pid 25493] 10:12:36.146550 <... close resumed> ) = 0
[pid 25473] 10:12:36.146587 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25493] 10:12:36.146625 mprotect(0x7f657466e000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.146652 <... connect resumed> ) = 0
[pid 25493] 10:12:36.146672 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.146691 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25493] 10:12:36.146722 munmap(0x7f6578ac7000, 39387 <unfinished ...>
[pid 25473] 10:12:36.146751 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25493] 10:12:36.146773 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.146798 sendto(16, "\241F\1\0\0\1\0\0\0\0\0\0\6aspmx2\ngooglemail\3com\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25493] 10:12:36.146862 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.146895 <... sendto resumed> ) = 39
[pid 25493] 10:12:36.146915 <... open resumed> ) = 7
[pid 25473] 10:12:36.146937 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25493] 10:12:36.146967 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25493] 10:12:36.147003 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.147056 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.147093 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.147152 close(7)    = 0
[pid 25493] 10:12:36.147188 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.147244 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25493] 10:12:36.147285 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.147330 close(7)    = 0
[pid 25493] 10:12:36.147369 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25493] 10:12:36.147404 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.147458 close(7)    = 0
[pid 25493] 10:12:36.147501 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25493] 10:12:36.147665 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.147715 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.147751 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.147805 close(7)    = 0
[pid 25493] 10:12:36.147841 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.147895 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25493] 10:12:36.147971 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25493] 10:12:36.148016 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.148062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.148099 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.148142 close(7)    = 0
[pid 25493] 10:12:36.148176 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.148219 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25493] 10:12:36.148275 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25493] 10:12:36.148342 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, 8) = 0
[pid 25493] 10:12:36.148393 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f6578ad1a90) = 25498
[pid 25493] 10:12:36.148670 wait4(25498, Process 25496 attached
 <unfinished ...>
[pid 25496] 10:12:36.148741 set_robust_list(0x7f638dc98aa0, 24) = 0
[pid 25496] 10:12:36.148798 geteuid()   = 0
[pid 25496] 10:12:36.148839 geteuid()   = 0
[pid 25496] 10:12:36.148874 getegid()   = 12
[pid 25496] 10:12:36.148911 setgid(12)  = 0
[pid 25496] 10:12:36.148946 setuid(47)  = 0
[pid 25496] 10:12:36.150598 brk(0x23f3000Process 25495 attached
 <unfinished ...>
[pid 25495] 10:12:36.150675 set_robust_list(0x7fea0f26eaa0, 24) = 0
[pid 25495] 10:12:36.150746 close(0)    = 0
[pid 25495] 10:12:36.150835 dup2(10, 0) = 0
[pid 25495] 10:12:36.150873 close(10)   = 0
[pid 25495] 10:12:36.150907 close(11)   = 0
[pid 25495] 10:12:36.150955 fstat(0, {st_dev=makedev(0, 8), st_ino=2130168038, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.151007 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.151055 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.151106 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMY-0006c6-AN"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25496] 10:12:36.151628 <... brk resumed> ) = 0x23f3000
[pid 25496] 10:12:36.152018 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25495] 10:12:36.152075 brk(0)      = 0xb7b000
[pid 25495] 10:12:36.152114 fcntl(0, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.152147 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25473] 10:12:36.152176 recvfrom(16, "\241F\201\200\0\1\0\1\0\0\0\0\6aspmx2\ngooglemail\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\264\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 55
[pid 25473] 10:12:36.152224 close(16)   = 0
[pid 25473] 10:12:36.152301 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25473] 10:12:36.152343 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25473] 10:12:36.152385 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.152424 sendto(16, "E\226\1\0\0\1\0\0\0\0\0\0\6aspmx3\ngooglemail\3com\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0) = 39
[pid 25473] 10:12:36.152495 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25495] 10:12:36.152584 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.152608 fcntl(1, F_GETFD) = 0
[pid 25495] 10:12:36.152642 fcntl(2, F_GETFD) = 0
[pid 25495] 10:12:36.152682 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.152739 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42aa000
[pid 25495] 10:12:36.152794 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.152848 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.152894 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.152935 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.152975 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153015 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153055 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153095 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153135 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25495] 10:12:36.153188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153237 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153278 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153322 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153364 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153407 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153449 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153492 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25495] 10:12:36.153634 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153680 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153721 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153761 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153802 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153842 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffd51003ba0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.153923 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25495] 10:12:36.153976 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25495] 10:12:36.154015 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25495] 10:12:36.154062 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7efcd42a0000
[pid 25495] 10:12:36.154100 close(6)    = 0
[pid 25495] 10:12:36.154144 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25495] 10:12:36.154188 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.154232 fstat(6, Process 25497 attached
{st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.154305 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25496] 10:12:36.154343 <... open resumed> ) = 7
[pid 25497] 10:12:36.154374 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25495] 10:12:36.154406 <... mmap resumed> ) = 0x7efcd3e72000
[pid 25495] 10:12:36.154426 mprotect(0x7efcd3e88000, 2097152, PROT_NONE <unfinished ...>
[pid 25496] 10:12:36.154460 fstat(7,  <unfinished ...>
[pid 25495] 10:12:36.154490 <... mprotect resumed> ) = 0
[pid 25497] 10:12:36.154509 <... set_robust_list resumed> ) = 0
[pid 25495] 10:12:36.154533 mmap(0x7efcd4088000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25497] 10:12:36.154585 geteuid( <unfinished ...>
[pid 25495] 10:12:36.154619 <... mmap resumed> ) = 0x7efcd4088000
[pid 25496] 10:12:36.154639 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25496] 10:12:36.154677 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25495] 10:12:36.154718 mmap(0x7efcd408a000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25496] 10:12:36.154749 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25496] 10:12:36.154776 read(7,  <unfinished ...>
[pid 25495] 10:12:36.154806 <... mmap resumed> ) = 0x7efcd408a000
[pid 25495] 10:12:36.154835 close(6 <unfinished ...>
[pid 25496] 10:12:36.154868 <... read resumed> "\34\203\21\246u3\241\362\177ZZ6\5\256\204\222\215\37eS\213\350\213jR{\232\365\327\373;L\303\215n\26\261\n\346\33\27b\301/'R\305\223", 48) = 48
[pid 25482] 10:12:36.154897 <... read resumed> "\24\3\3\0\1", 5) = 5
[pid 25482] 10:12:36.154924 read(11, "\1", 1) = 1
[pid 25482] 10:12:36.155009 read(11, "\26\3\3\0`", 5) = 5
[pid 25482] 10:12:36.155049 read(11, ":$\nJ\337o\35\2727\206W\345\320\230\214\325%3\221I\200\2133\300{\375\257u\333;\271\370,)\261\5E\253\34\255\27>\341\354\177\331\232wvY\ri\3\347!\250KX\263\23F\244l\362\271\224\330\21m\344\254\354\250\1I\326\330\352\375\317\347dC\"DNi\320|8\361\2029.;\304", 96) = 96
[pid 25482] 10:12:36.155149 alarm(0)    = 300
[pid 25482] 10:12:36.155226 write(11, "\27\3\3\0p\304\317\301!3+\226\213^\374\365\373\361\241\353\23WTF\357\r\23q\10\226 \nNme\253o0A|\17/\205g\3009\334\260\253\203\233u>\264ACj\0363\7\360PJ\10u$'\276F\312Bq\356O\27\236\372\264\330@\336A1f\355\6\265\230\n\373\320m\251\"\0104\243\302\233\267\317\177\211l\227\274\245,Ws\252\25qJ\0276\365", 117) = 117
[pid 25482] 10:12:36.155297 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25497] 10:12:36.155340 <... geteuid resumed> ) = 0
[pid 25497] 10:12:36.155368 geteuid( <unfinished ...>
[pid 25496] 10:12:36.155399 close(7 <unfinished ...>
[pid 25495] 10:12:36.155426 <... close resumed> ) = 0
[pid 25496] 10:12:36.155447 <... close resumed> ) = 0
[pid 25495] 10:12:36.155474 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.155504 <... geteuid resumed> ) = 0
[pid 25497] 10:12:36.155668 getegid( <unfinished ...>
[pid 25495] 10:12:36.155708 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25497] 10:12:36.155730 <... getegid resumed> ) = 12
[pid 25497] 10:12:36.155753 setgid(12 <unfinished ...>
[pid 25496] 10:12:36.155797 getuid( <unfinished ...>
[pid 25495] 10:12:36.155824 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.155860 <... setgid resumed> ) = 0
[pid 25495] 10:12:36.155888 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25497] 10:12:36.155909 setuid(47)  = 0
[pid 25495] 10:12:36.156588 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25496] 10:12:36.156632 <... getuid resumed> ) = 47
[pid 25496] 10:12:36.156795 exit_group(0) = ?
[pid 25495] 10:12:36.156827 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.156853 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25495] 10:12:36.156898 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.156941 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.156991 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd429f000
[pid 25495] 10:12:36.157034 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd3c59000
[pid 25495] 10:12:36.157089 mprotect(0x7efcd3c6f000, 2093056, PROT_NONE) = 0
[pid 25495] 10:12:36.157128 mmap(0x7efcd3e6e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7efcd3e6e000
[pid 25495] 10:12:36.157174 mmap(0x7efcd3e70000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efcd3e70000
[pid 25495] 10:12:36.157219 close(6)    = 0
[pid 25495] 10:12:36.157262 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.157308 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.157355 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.157402 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25495] 10:12:36.157445 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.157738 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.157790 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd3a22000
[pid 25495] 10:12:36.157831 mprotect(0x7efcd3a29000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.157869 mmap(0x7efcd3c29000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7efcd3c29000
[pid 25495] 10:12:36.157914 mmap(0x7efcd3c2b000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efcd3c2b000
[pid 25495] 10:12:36.158017 close(6)    = 0
[pid 25495] 10:12:36.158061 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25496] 10:12:36.158162 +++ exited with 0 +++
[pid 25492] 10:12:36.158178 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25496
[pid 25492] 10:12:36.158202 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0}, 8) = 0
[pid 25492] 10:12:36.158275 getcwd("/var/spool/exim", 16380) = 16
[pid 25492] 10:12:36.158352 open("/etc/localtime", O_RDONLY) = 7
[pid 25492] 10:12:36.158395 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25492] 10:12:36.158443 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25492] 10:12:36.158486 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcae000
[pid 25492] 10:12:36.158527 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25492] 10:12:36.158582 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25492] 10:12:36.158617 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25492] 10:12:36.158665 close(7)    = 0
[pid 25492] 10:12:36.158701 munmap(0x7f638dcae000, 4096) = 0
[pid 25492] 10:12:36.158752 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25492] 10:12:36.158805 fcntl(7, F_GETFD) = 0
[pid 25492] 10:12:36.158844 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25492] 10:12:36.158877 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5375981, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25492] 10:12:36.158925 write(7, "2015-12-30 10:12:36 [25492] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMZ-0006cz-RM\n", 92) = 92
[pid 25492] 10:12:36.158968 chdir("/var/spool/exim") = 0
[pid 25492] 10:12:36.159012 setgid(12)  = 0
[pid 25492] 10:12:36.159075 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25492] 10:12:36.159158 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25492] 10:12:36.159242 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25492] 10:12:36.159316 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25492] 10:12:36.159393 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25492] 10:12:36.159487 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25492] 10:12:36.159744 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25492] 10:12:36.159830 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25492] 10:12:36.159877 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25492] 10:12:36.159925 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcae000
[pid 25492] 10:12:36.159963 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25492] 10:12:36.160011 close(8)    = 0
[pid 25492] 10:12:36.160047 munmap(0x7f638dcae000, 4096) = 0
[pid 25492] 10:12:36.160145 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25492] 10:12:36.160245 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25492] 10:12:36.160366 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25492] 10:12:36.160491 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25492] 10:12:36.160695 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25492] 10:12:36.160756 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25492] 10:12:36.160800 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25492] 10:12:36.160849 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcae000
[pid 25492] 10:12:36.160888 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25492] 10:12:36.160939 close(8)    = 0
[pid 25492] 10:12:36.160974 munmap(0x7f638dcae000, 4096) = 0
[pid 25492] 10:12:36.161022 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25492] 10:12:36.161066 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25492] 10:12:36.161113 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcae000
[pid 25492] 10:12:36.161150 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25492] 10:12:36.161205 close(8)    = 0
[pid 25492] 10:12:36.161241 munmap(0x7f638dcae000, 4096) = 0
[pid 25492] 10:12:36.161302 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25492] 10:12:36.161346 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25492] 10:12:36.161395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcae000
[pid 25492] 10:12:36.161432 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25492] 10:12:36.161480 close(8)    = 0
[pid 25492] 10:12:36.161516 munmap(0x7f638dcae000, 4096) = 0
[pid 25492] 10:12:36.161708 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25492] 10:12:36.161842 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25492] 10:12:36.161946 read(6, "", 4096) = 0
[pid 25492] 10:12:36.161987 read(6, "", 4096) = 0
[pid 25492] 10:12:36.162025 close(6)    = 0
[pid 25492] 10:12:36.162060 munmap(0x7f638dcaf000, 4096) = 0
[pid 25492] 10:12:36.162114 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f638cb65790}, NULL, 8) = 0
[pid 25492] 10:12:36.162166 open("/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-D", O_RDWR|O_APPEND) = 6
[pid 25492] 10:12:36.162217 fcntl(6, F_GETFD) = 0
[pid 25492] 10:12:36.162251 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25492] 10:12:36.162285 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25492] 10:12:36.162325 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064852, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25492] 10:12:36.162380 open("/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-H", O_RDONLY) = 8
[pid 25492] 10:12:36.162426 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25492] 10:12:36.162472 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcaf000
[pid 25492] 10:12:36.162510 read(8,  <unfinished ...>
[pid 25495] 10:12:36.162613 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.162640 <... read resumed> "1aEJMZ-0006cz-RM-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 959
[pid 25492] 10:12:36.162698 read(8, "", 4096) = 0
[pid 25492] 10:12:36.162735 close(8)    = 0
[pid 25492] 10:12:36.162769 munmap(0x7f638dcaf000, 4096) = 0
[pid 25492] 10:12:36.162809 open("/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.162870 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cz-RM", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25492] 10:12:36.162916 fcntl(8, F_GETFD) = 0
[pid 25492] 10:12:36.162949 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25492] 10:12:36.162986 fchown(8, 47, 12) = 0
[pid 25492] 10:12:36.163029 fchmod(8, 0640) = 0
[pid 25492] 10:12:36.163069 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25492] 10:12:36.163104 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064880, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25492] 10:12:36.163150 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f638dcaf000
[pid 25492] 10:12:36.163186 lseek(8, 0, SEEK_CUR) = 0
[pid 25492] 10:12:36.163225 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.163279 pipe([9, 10]) = 0
[pid 25492] 10:12:36.163320 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0}, {SIG_DFL, [], SA_RESTORER, 0x7f638cb65790}, 8) = 0
[pid 25492] 10:12:36.163362 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f638dc98a90) = 25499
[pid 25492] 10:12:36.163689 close(10)   = 0
[pid 25492] 10:12:36.163729 read(9,  <unfinished ...>
[pid 25495] 10:12:36.164591 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.164617 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.164679 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25495] 10:12:36.164725 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.164769 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.164819 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd379e000
[pid 25495] 10:12:36.164860 mprotect(0x7efcd3821000, 2093056, PROT_NONE) = 0
[pid 25495] 10:12:36.164898 mmap(0x7efcd3a20000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7efcd3a20000
[pid 25495] 10:12:36.164947 close(6)    = 0
[pid 25495] 10:12:36.164991 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.165036 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.165080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.165123 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25495] 10:12:36.165165 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.165217 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25495] 10:12:36.165269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd429e000
[pid 25495] 10:12:36.165312 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd3590000
[pid 25495] 10:12:36.165353 mprotect(0x7efcd359c000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.165392 mmap(0x7efcd379c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7efcd379c000
[pid 25495] 10:12:36.165446 close(6)    = 0
[pid 25495] 10:12:36.165496 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25495] 10:12:36.165626 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.165671 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25495] 10:12:36.165720 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd336d000
[pid 25495] 10:12:36.165760 mprotect(0x7efcd338e000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.165799 mmap(0x7efcd358e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7efcd358e000
[pid 25495] 10:12:36.165844 close(6)    = 0
[pid 25495] 10:12:36.165885 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.165930 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.165975 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.166018 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25495] 10:12:36.166060 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.166102 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.166150 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd3150000
[pid 25495] 10:12:36.166189 mprotect(0x7efcd3167000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.166226 mmap(0x7efcd3367000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7efcd3367000
[pid 25495] 10:12:36.166271 mmap(0x7efcd3369000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efcd3369000
[pid 25495] 10:12:36.166323 close(6)    = 0
[pid 25495] 10:12:36.166376 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.166427 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.166472 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.166516 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25495] 10:12:36.166637 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
Process 25498 attached
[pid 25495] 10:12:36.166704 fstat(6,  <unfinished ...>
[pid 25498] 10:12:36.166750 set_robust_list(0x7f6578ad1aa0, 24 <unfinished ...>
[pid 25495] 10:12:36.166772 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25498] 10:12:36.167042 <... set_robust_list resumed> ) = 0
[pid 25495] 10:12:36.167062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25498] 10:12:36.167125 geteuid( <unfinished ...>
[pid 25495] 10:12:36.167146 <... mmap resumed> ) = 0x7efcd429d000
[pid 25498] 10:12:36.167171 <... geteuid resumed> ) = 0
[pid 25495] 10:12:36.167186 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25498] 10:12:36.167226 geteuid( <unfinished ...>
[pid 25495] 10:12:36.167246 <... mmap resumed> ) = 0x7efcd2ddc000
[pid 25498] 10:12:36.167268 <... geteuid resumed> ) = 0
[pid 25495] 10:12:36.167281 mprotect(0x7efcd2f4b000, 2093056, PROT_NONE <unfinished ...>
[pid 25498] 10:12:36.167315 getegid( <unfinished ...>
[pid 25495] 10:12:36.167334 <... mprotect resumed> ) = 0
[pid 25498] 10:12:36.167356 <... getegid resumed> ) = 499
[pid 25495] 10:12:36.167369 mmap(0x7efcd314a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25498] 10:12:36.167408 setgid(12 <unfinished ...>
[pid 25495] 10:12:36.167428 <... mmap resumed> ) = 0x7efcd314a000
[pid 25498] 10:12:36.167459 <... setgid resumed> ) = 0
[pid 25495] 10:12:36.167475 close(6 <unfinished ...>
[pid 25498] 10:12:36.167505 setuid(47 <unfinished ...>
[pid 25495] 10:12:36.167528 <... close resumed> ) = 0
[pid 25498] 10:12:36.167558 <... setuid resumed> ) = 0
[pid 25495] 10:12:36.167573 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.168622 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.168674 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.168718 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25495] 10:12:36.168763 read(6,  <unfinished ...>
[pid 25497] 10:12:36.168805 brk(0x1601000 <unfinished ...>
[pid 25495] 10:12:36.168826 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25497] 10:12:36.168864 <... brk resumed> ) = 0x1601000
[pid 25495] 10:12:36.168879 fstat(6,  <unfinished ...>
[pid 25497] 10:12:36.169291 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25495] 10:12:36.169318 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25495] 10:12:36.169354 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd2b4d000
[pid 25495] 10:12:36.169396 mprotect(0x7efcd2bd8000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.169436 mmap(0x7efcd2dd8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7efcd2dd8000
[pid 25495] 10:12:36.169483 mmap(0x7efcd2ddb000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efcd2ddb000
[pid 25495] 10:12:36.169533 close(6)    = 0
[pid 25495] 10:12:36.169577 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.169623 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.169667 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.169710 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25495] 10:12:36.169756 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.169799 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25495] 10:12:36.169847 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd2947000
[pid 25495] 10:12:36.169887 mprotect(0x7efcd294d000, 2093056, PROT_NONE) = 0
[pid 25495] 10:12:36.169925 mmap(0x7efcd2b4c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7efcd2b4c000
[pid 25495] 10:12:36.169969 close(6)    = 0
[pid 25495] 10:12:36.170009 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.170052 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25495] 10:12:36.170096 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.170146 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25495] 10:12:36.170204 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd429c000
[pid 25495] 10:12:36.170246 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd2611000
[pid 25495] 10:12:36.170285 mprotect(0x7efcd273d000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.170341 mmap(0x7efcd293d000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7efcd293d000
[pid 25495] 10:12:36.170395 mmap(0x7efcd2946000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25497] 10:12:36.170440 <... open resumed> ) = 7
[pid 25495] 10:12:36.170454 <... mmap resumed> ) = 0x7efcd2946000
[pid 25497] 10:12:36.170488 fstat(7,  <unfinished ...>
[pid 25495] 10:12:36.170511 close(6 <unfinished ...>
[pid 25497] 10:12:36.170658 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25497] 10:12:36.170704 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25495] 10:12:36.170729 <... close resumed> ) = 0
[pid 25497] 10:12:36.170759 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25495] 10:12:36.170777 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.170818 read(7,  <unfinished ...>
[pid 25495] 10:12:36.170839 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25497] 10:12:36.170867 <... read resumed> "@u\10r\374\233\241\302\366\350bG\274q\273\205\327\26\373\225\3052\340f\216\264\352\251\233\324\252\252\337b]\277eO\241\314t{\266\31H\343\22-", 48) = 48
[pid 25495] 10:12:36.170884 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.170924 close(7 <unfinished ...>
[pid 25495] 10:12:36.170944 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25497] 10:12:36.170967 <... close resumed> ) = 0
[pid 25495] 10:12:36.170981 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.171035 getuid( <unfinished ...>
[pid 25495] 10:12:36.171055 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25497] 10:12:36.171080 <... getuid resumed> ) = 47
[pid 25495] 10:12:36.171094 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25497] 10:12:36.171271 exit_group(0) = ?
[pid 25495] 10:12:36.171286 <... open resumed> ) = 6
[pid 25495] 10:12:36.171306 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.171628 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.171682 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd240d000
[pid 25495] 10:12:36.171724 mprotect(0x7efcd240f000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.171762 mmap(0x7efcd260f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7efcd260f000
[pid 25495] 10:12:36.171811 close(6)    = 0
[pid 25495] 10:12:36.171854 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.171905 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.171949 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.171992 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25495] 10:12:36.172035 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.172385 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.172439 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7efcd220a000
[pid 25495] 10:12:36.172482 mprotect(0x7efcd220c000, 2093056, PROT_NONE) = 0
[pid 25495] 10:12:36.172604 mmap(0x7efcd240b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25497] 10:12:36.172669 +++ exited with 0 +++
[pid 25495] 10:12:36.172682 <... mmap resumed> ) = 0x7efcd240b000
[pid 25491] 10:12:36.172697 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25497
[pid 25491] 10:12:36.172722 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25491] 10:12:36.172790 getcwd("/var/spool/exim", 16380) = 16
[pid 25491] 10:12:36.172865 open("/etc/localtime", O_RDONLY) = 7
[pid 25491] 10:12:36.172907 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.172954 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.172998 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:36.173034 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25491] 10:12:36.173082 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25491] 10:12:36.173116 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25491] 10:12:36.173170 close(7)    = 0
[pid 25491] 10:12:36.173206 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:36.173257 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:36.173306 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:36.173341 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:36.173381 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376073, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.173434 write(7, "2015-12-30 10:12:36 [25491] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMZ-0006cs-RM\n", 92) = 92
[pid 25491] 10:12:36.173478 chdir("/var/spool/exim") = 0
[pid 25491] 10:12:36.173521 setgid(12 <unfinished ...>
[pid 25498] 10:12:36.173979 brk(0x10d1000 <unfinished ...>
[pid 25495] 10:12:36.174001 close(6 <unfinished ...>
[pid 25491] 10:12:36.174022 <... setgid resumed> ) = 0
[pid 25491] 10:12:36.174069 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25491] 10:12:36.174155 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25491] 10:12:36.174239 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25491] 10:12:36.174314 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25495] 10:12:36.174412 <... close resumed> ) = 0
[pid 25491] 10:12:36.174433 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25491] 10:12:36.174592 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25491] 10:12:36.174713 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25491] 10:12:36.174789 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25491] 10:12:36.174836 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.174890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:36.174928 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.174976 close(8)    = 0
[pid 25491] 10:12:36.175011 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:36.175109 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25491] 10:12:36.175207 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25491] 10:12:36.175327 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25491] 10:12:36.175455 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25491] 10:12:36.175646 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25491] 10:12:36.175708 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25491] 10:12:36.175751 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.175799 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:36.175836 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.175887 close(8)    = 0
[pid 25491] 10:12:36.175921 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:36.175967 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25491] 10:12:36.176009 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.176064 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:36.176101 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.176150 close(8)    = 0
[pid 25491] 10:12:36.176185 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:36.176243 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25491] 10:12:36.176285 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.176338 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:36.176387 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.176439 close(8)    = 0
[pid 25491] 10:12:36.176473 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:36.176665 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25491] 10:12:36.176802 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25491] 10:12:36.176904 read(6, "", 4096) = 0
[pid 25491] 10:12:36.176944 read(6, "", 4096) = 0
[pid 25491] 10:12:36.176981 close(6)    = 0
[pid 25491] 10:12:36.177015 munmap(0x7f33164fb000, 4096) = 0
[pid 25491] 10:12:36.177068 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f33153b1790}, NULL, 8) = 0
[pid 25491] 10:12:36.177120 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-D", O_RDWR|O_APPEND) = 6
[pid 25491] 10:12:36.177170 fcntl(6, F_GETFD) = 0
[pid 25491] 10:12:36.177204 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:36.177238 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25491] 10:12:36.177278 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:36.177333 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-H", O_RDONLY) = 8
[pid 25491] 10:12:36.177380 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1075, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:36.177427 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fb000
[pid 25491] 10:12:36.177464 read(8, "1aEJMZ-0006cs-RM-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1075
[pid 25491] 10:12:36.177623 read(8, "", 4096) = 0
[pid 25491] 10:12:36.177667 close(8)    = 0
[pid 25491] 10:12:36.177702 munmap(0x7f33164fb000, 4096) = 0
[pid 25491] 10:12:36.177744 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.177800 open("/var/spool/exim/msglog/Z/1aEJMZ-0006cs-RM", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25491] 10:12:36.177848 fcntl(8, F_GETFD) = 0
[pid 25491] 10:12:36.177888 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:36.177927 fchown(8, 47, 12) = 0
[pid 25491] 10:12:36.177970 fchmod(8, 0640) = 0
[pid 25491] 10:12:36.178010 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25491] 10:12:36.178047 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.178094 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fb000
[pid 25491] 10:12:36.178137 lseek(8, 0, SEEK_CUR) = 0
[pid 25491] 10:12:36.178179 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.178234 pipe([9, 10]) = 0
[pid 25491] 10:12:36.178274 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [], SA_RESTORER, 0x7f33153b1790}, 8) = 0
[pid 25491] 10:12:36.178318 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25500
[pid 25491] 10:12:36.178649 close(10)   = 0
[pid 25491] 10:12:36.178689 read(9,  <unfinished ...>
[pid 25498] 10:12:36.178736 <... brk resumed> ) = 0x10d1000
[pid 25495] 10:12:36.178751 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25498] 10:12:36.179253 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25495] 10:12:36.179283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25498] 10:12:36.179318 <... open resumed> ) = 7
[pid 25495] 10:12:36.179334 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25498] 10:12:36.179385 fstat(7,  <unfinished ...>
[pid 25495] 10:12:36.179408 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25498] 10:12:36.179431 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25495] 10:12:36.179460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25498] 10:12:36.179502 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25495] 10:12:36.179578 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25498] 10:12:36.179611 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25495] 10:12:36.179629 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25498] 10:12:36.179674 read(7,  <unfinished ...>
[pid 25495] 10:12:36.179694 <... open resumed> ) = 6
[pid 25498] 10:12:36.179728 <... read resumed> "0\334?7\344\225U<+\245(\374{\320Q\301q\20+\275\224;xT\323\344\243\262\273!\25\255\204y\317 \362?-\342\24\267\227,\374:\365V", 48) = 48
[pid 25495] 10:12:36.179746 read(6,  <unfinished ...>
[pid 25498] 10:12:36.179785 close(7 <unfinished ...>
[pid 25495] 10:12:36.179813 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25498] 10:12:36.179845 <... close resumed> ) = 0
[pid 25495] 10:12:36.179859 fstat(6,  <unfinished ...>
[pid 25498] 10:12:36.179906 getuid( <unfinished ...>
[pid 25495] 10:12:36.179927 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25498] 10:12:36.179963 <... getuid resumed> ) = 47
[pid 25495] 10:12:36.179977 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25498] 10:12:36.180149 exit_group(0) = ?
[pid 25495] 10:12:36.180164 <... mmap resumed> ) = 0x7efcd429b000
[pid 25498] 10:12:36.180423 +++ exited with 0 +++
[pid 25495] 10:12:36.180448 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.180472 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25498
[pid 25493] 10:12:36.180496 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, 8) = 0
[pid 25495] 10:12:36.180652 <... mmap resumed> ) = 0x7efcd1e76000
[pid 25493] 10:12:36.180672 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25493] 10:12:36.180751 open("/etc/localtime", O_RDONLY) = 7
[pid 25493] 10:12:36.180801 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.180850 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.180894 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.180937 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25493] 10:12:36.180987 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25493] 10:12:36.181020 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25493] 10:12:36.181069 close(7)    = 0
[pid 25493] 10:12:36.181105 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.181157 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25493] 10:12:36.181207 fcntl(7, F_GETFD) = 0
[pid 25493] 10:12:36.181240 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25493] 10:12:36.181272 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376165, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.181319 write(7, "2015-12-30 10:12:36 [25493] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25493] 10:12:36.181365 chdir("/var/spool/exim") = 0
[pid 25493] 10:12:36.181405 geteuid()   = 0
[pid 25493] 10:12:36.181438 getegid()   = 499
[pid 25493] 10:12:36.181480 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
Process 25499 attached
[pid 25495] 10:12:36.181643 mprotect(0x7efcd2000000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.181703 fstat(8,  <unfinished ...>
[pid 25499] 10:12:36.181736 set_robust_list(0x7f638dc98aa0, 24 <unfinished ...>
[pid 25495] 10:12:36.181760 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.181773 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25499] 10:12:36.181809 <... set_robust_list resumed> ) = 0
[pid 25495] 10:12:36.181823 mmap(0x7efcd2200000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25493] 10:12:36.181911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25499] 10:12:36.181944 close(9 <unfinished ...>
[pid 25495] 10:12:36.181967 <... mmap resumed> ) = 0x7efcd2200000
[pid 25493] 10:12:36.181981 <... mmap resumed> ) = 0x7f6578ae7000
[pid 25499] 10:12:36.182009 <... close resumed> ) = 0
[pid 25495] 10:12:36.182023 mmap(0x7efcd2205000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.182059 read(8,  <unfinished ...>
[pid 25499] 10:12:36.182092 geteuid( <unfinished ...>
[pid 25495] 10:12:36.182114 <... mmap resumed> ) = 0x7efcd2205000
[pid 25493] 10:12:36.182128 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25499] 10:12:36.182167 <... geteuid resumed> ) = 0
[pid 25495] 10:12:36.182183 close(6 <unfinished ...>
[pid 25493] 10:12:36.182208 close(8 <unfinished ...>
[pid 25499] 10:12:36.182236 getegid( <unfinished ...>
[pid 25495] 10:12:36.182258 <... close resumed> ) = 0
[pid 25493] 10:12:36.182271 <... close resumed> ) = 0
[pid 25499] 10:12:36.182302 <... getegid resumed> ) = 12
[pid 25495] 10:12:36.182317 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.182353 munmap(0x7f6578ae7000, 4096 <unfinished ...>
[pid 25499] 10:12:36.182385 setgid(494 <unfinished ...>
[pid 25495] 10:12:36.182409 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.182423 <... munmap resumed> ) = 0
[pid 25499] 10:12:36.182451 <... setgid resumed> ) = 0
[pid 25495] 10:12:36.182466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.182501 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25499] 10:12:36.182545 setuid(495 <unfinished ...>
[pid 25495] 10:12:36.182569 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.182584 <... open resumed> ) = 8
[pid 25499] 10:12:36.182607 <... setuid resumed> ) = 0
[pid 25495] 10:12:36.182620 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.182675 read(8,  <unfinished ...>
[pid 25499] 10:12:36.182706 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.182735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.182750 <... read resumed> "65536\n", 31) = 6
[pid 25499] 10:12:36.182777 <... open resumed> ) = 9
[pid 25495] 10:12:36.182791 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.182829 close(8 <unfinished ...>
[pid 25499] 10:12:36.182859 fstat(9,  <unfinished ...>
[pid 25495] 10:12:36.182881 <... open resumed> ) = 6
[pid 25493] 10:12:36.182894 <... close resumed> ) = 0
[pid 25499] 10:12:36.182923 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.182951 read(6,  <unfinished ...>
[pid 25493] 10:12:36.183024 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25499] 10:12:36.183059 fstat(9,  <unfinished ...>
[pid 25495] 10:12:36.183081 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.183102 <... open resumed> ) = 8
[pid 25499] 10:12:36.183128 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.183154 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.183180 fstat(8,  <unfinished ...>
[pid 25499] 10:12:36.183207 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.183234 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25493] 10:12:36.183259 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25499] 10:12:36.183294 <... mmap resumed> ) = 0x7f638dcae000
[pid 25495] 10:12:36.183309 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.183340 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25499] 10:12:36.183372 read(9,  <unfinished ...>
[pid 25495] 10:12:36.183402 <... mmap resumed> ) = 0x7efcd1c0a000
[pid 25493] 10:12:36.183417 <... mmap resumed> ) = 0x7f6578ae7000
[pid 25499] 10:12:36.183438 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25495] 10:12:36.183446 mprotect(0x7efcd1c6c000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.183452 lseek(8, 0, SEEK_CUR) = 0
[pid 25493] 10:12:36.183474 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.183506 read(8, "", 4096) = 0
[pid 25493] 10:12:36.183709 close(8)    = 0
[pid 25493] 10:12:36.183753 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.183794 setgroups(1, [12]) = 0
[pid 25493] 10:12:36.183833 setgid(12)  = 0
[pid 25493] 10:12:36.183866 setuid(47)  = 0
[pid 25493] 10:12:36.183928 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25493] 10:12:36.184013 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25493] 10:12:36.184104 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25493] 10:12:36.184179 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25493] 10:12:36.184256 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25493] 10:12:36.184348 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25493] 10:12:36.184466 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25493] 10:12:36.184627 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25493] 10:12:36.184677 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.184726 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.184763 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.184811 close(8)    = 0
[pid 25493] 10:12:36.184846 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.184946 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25493] 10:12:36.185044 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25493] 10:12:36.185169 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25493] 10:12:36.185297 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25493] 10:12:36.185416 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25493] 10:12:36.185482 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25493] 10:12:36.185592 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25493] 10:12:36.185648 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.185686 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25493] 10:12:36.185744 close(8)    = 0
[pid 25493] 10:12:36.185786 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.185834 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25493] 10:12:36.185878 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.185924 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.185960 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.186010 close(8)    = 0
[pid 25493] 10:12:36.186044 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.186104 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25493] 10:12:36.186147 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25493] 10:12:36.186192 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae7000
[pid 25493] 10:12:36.186228 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25493] 10:12:36.186276 close(8)    = 0
[pid 25493] 10:12:36.186310 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.186421 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25493] 10:12:36.186646 read(6,  <unfinished ...>
[pid 25499] 10:12:36.186697 read(9,  <unfinished ...>
[pid 25495] 10:12:36.186727 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.186744 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25499] 10:12:36.186845 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25495] 10:12:36.186872 mmap(0x7efcd1e6b000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25493] 10:12:36.186910 read(6,  <unfinished ...>
[pid 25499] 10:12:36.186939 close(9 <unfinished ...>
[pid 25495] 10:12:36.186969 <... mmap resumed> ) = 0x7efcd1e6b000
[pid 25493] 10:12:36.186995 <... read resumed> "", 4096) = 0
[pid 25499] 10:12:36.187021 <... close resumed> ) = 0
[pid 25495] 10:12:36.187035 close(6 <unfinished ...>
[pid 25493] 10:12:36.187060 read(6,  <unfinished ...>
[pid 25499] 10:12:36.187087 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25495] 10:12:36.187113 <... close resumed> ) = 0
[pid 25493] 10:12:36.187142 <... read resumed> "", 4096) = 0
[pid 25499] 10:12:36.187169 <... munmap resumed> ) = 0
[pid 25495] 10:12:36.187184 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.187264 close(6 <unfinished ...>
[pid 25499] 10:12:36.187295 brk(0x23f4000 <unfinished ...>
[pid 25495] 10:12:36.187319 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.187337 <... close resumed> ) = 0
[pid 25499] 10:12:36.187358 <... brk resumed> ) = 0x23f4000
[pid 25495] 10:12:36.187372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.187510 munmap(0x7f6578ae8000, 4096 <unfinished ...>
[pid 25499] 10:12:36.187550 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.187583 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.187601 <... munmap resumed> ) = 0
[pid 25499] 10:12:36.187629 <... write resumed> ) = 4
[pid 25495] 10:12:36.187644 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.187677 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.187708 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25499] 10:12:36.187734 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.187758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.187777 <... open resumed> ) = 6
[pid 25492] 10:12:36.187795 read(9,  <unfinished ...>
[pid 25499] 10:12:36.187825 <... write resumed> ) = 4
[pid 25495] 10:12:36.187838 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.187873 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.187897 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25499] 10:12:36.187921 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.187946 <... open resumed> ) = 6
[pid 25493] 10:12:36.187962 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25492] 10:12:36.187991 read(9,  <unfinished ...>
[pid 25499] 10:12:36.188020 <... write resumed> ) = 4
[pid 25495] 10:12:36.188033 read(6,  <unfinished ...>
[pid 25493] 10:12:36.188059 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.188085 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25499] 10:12:36.188109 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25495] 10:12:36.188132 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.188156 <... mmap resumed> ) = 0x7f6578ae8000
[pid 25492] 10:12:36.188172 read(9,  <unfinished ...>
[pid 25499] 10:12:36.188201 <... write resumed> ) = 4
[pid 25495] 10:12:36.188214 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.188239 read(6,  <unfinished ...>
[pid 25492] 10:12:36.188264 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25499] 10:12:36.188288 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.188320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25493] 10:12:36.188353 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25492] 10:12:36.188383 read(9,  <unfinished ...>
[pid 25499] 10:12:36.188413 <... write resumed> ) = 4
[pid 25495] 10:12:36.188426 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.188458 close(6 <unfinished ...>
[pid 25492] 10:12:36.188482 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25499] 10:12:36.188506 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25495] 10:12:36.188670 <... mmap resumed> ) = 0x7efcd1827000
[pid 25493] 10:12:36.188695 <... close resumed> ) = 0
[pid 25492] 10:12:36.188717 read(9,  <unfinished ...>
[pid 25499] 10:12:36.188752 <... write resumed> ) = 40
[pid 25495] 10:12:36.188766 mprotect(0x7efcd19e0000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.188796 munmap(0x7f6578ae8000, 4096 <unfinished ...>
[pid 25492] 10:12:36.188822 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25499] 10:12:36.188848 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.188872 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.188888 <... munmap resumed> ) = 0
[pid 25492] 10:12:36.188921 read(9,  <unfinished ...>
[pid 25499] 10:12:36.188953 <... write resumed> ) = 4
[pid 25495] 10:12:36.188967 mmap(0x7efcd1bdf000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25493] 10:12:36.189000 fstat(1,  <unfinished ...>
[pid 25492] 10:12:36.189027 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25499] 10:12:36.189055 close(10 <unfinished ...>
[pid 25495] 10:12:36.189079 <... mmap resumed> ) = 0x7efcd1bdf000
[pid 25493] 10:12:36.189100 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25492] 10:12:36.189143 wait4(-1,  <unfinished ...>
[pid 25499] 10:12:36.189174 <... close resumed> ) = 0
[pid 25495] 10:12:36.189188 mmap(0x7efcd1c06000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.189230 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f657799e790},  <unfinished ...>
[pid 25499] 10:12:36.189265 exit_group(0) = ?
[pid 25495] 10:12:36.189278 <... mmap resumed> ) = 0x7efcd1c06000
[pid 25493] 10:12:36.189528 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25499] 10:12:36.189581 +++ exited with 0 +++
[pid 25495] 10:12:36.189597 close(6 <unfinished ...>
[pid 25493] 10:12:36.189620 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f65766e76a0},  <unfinished ...>
[pid 25492] 10:12:36.189647 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25499
[pid 25495] 10:12:36.189671 <... close resumed> ) = 0
[pid 25493] 10:12:36.189697 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25492] 10:12:36.189717 close(9 <unfinished ...>
[pid 25495] 10:12:36.189752 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.189783 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f65766e76a0},  <unfinished ...>
[pid 25492] 10:12:36.189810 <... close resumed> ) = 0
[pid 25495] 10:12:36.189831 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.189855 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25492] 10:12:36.189878 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0},  <unfinished ...>
[pid 25495] 10:12:36.189910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.189944 fstat(0,  <unfinished ...>
[pid 25492] 10:12:36.189967 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0}, 8) = 0
[pid 25495] 10:12:36.190008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.190028 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130167951, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25492] 10:12:36.190057 brk(0x23f3000 <unfinished ...>
[pid 25495] 10:12:36.190087 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.190117 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.190143 <... brk resumed> ) = 0x23f3000
[pid 25495] 10:12:36.190173 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.190194 <... mmap resumed> ) = 0x7f6578ae8000
[pid 25492] 10:12:36.190211 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25495] 10:12:36.190255 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.190288 read(0,  <unfinished ...>
[pid 25492] 10:12:36.190314 <... open resumed> ) = 9
[pid 25495] 10:12:36.190341 <... open resumed> ) = 6
[pid 25493] 10:12:36.190358 <... read resumed> "To:  ljacques@westernskiesgolf.com, westernsky@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type"..., 4096) = 2091
[pid 25492] 10:12:36.190439 alarm(60 <unfinished ...>
[pid 25495] 10:12:36.190474 read(6,  <unfinished ...>
[pid 25493] 10:12:36.190499 stat("/etc/localtime",  <unfinished ...>
[pid 25492] 10:12:36.190651 <... alarm resumed> ) = 0
[pid 25495] 10:12:36.190682 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.190707 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25492] 10:12:36.190754 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25495] 10:12:36.190792 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.190816 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25492] 10:12:36.190890 <... fcntl resumed> ) = 0
Process 25500 attached
[pid 25495] 10:12:36.190935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25493] 10:12:36.190982 <... open resumed> ) = 6
[pid 25492] 10:12:36.191004 alarm(0 <unfinished ...>
[pid 25500] 10:12:36.191035 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25495] 10:12:36.191058 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.191091 fchown(6, 47, 12 <unfinished ...>
[pid 25492] 10:12:36.191121 <... alarm resumed> ) = 60
[pid 25500] 10:12:36.191191 <... set_robust_list resumed> ) = 0
[pid 25495] 10:12:36.191208 <... mmap resumed> ) = 0x7efcd429a000
[pid 25493] 10:12:36.191282 <... fchown resumed> ) = 0
[pid 25492] 10:12:36.191304 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25500] 10:12:36.191348 close(9 <unfinished ...>
[pid 25495] 10:12:36.191371 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.191400 fchmod(6, 0640 <unfinished ...>
[pid 25492] 10:12:36.191426 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25500] 10:12:36.191450 <... close resumed> ) = 0
[pid 25495] 10:12:36.191463 <... mmap resumed> ) = 0x7efcd15fa000
[pid 25493] 10:12:36.191488 <... fchmod resumed> ) = 0
[pid 25492] 10:12:36.191509 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25500] 10:12:36.191558 geteuid( <unfinished ...>
[pid 25495] 10:12:36.191581 mprotect(0x7efcd1626000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.191611 fcntl(6, F_GETFL <unfinished ...>
[pid 25492] 10:12:36.191635 <... open resumed> ) = 10
[pid 25500] 10:12:36.191658 <... geteuid resumed> ) = 0
[pid 25495] 10:12:36.191672 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.191690 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25492] 10:12:36.191708 read(10,  <unfinished ...>
[pid 25500] 10:12:36.191762 getegid( <unfinished ...>
[pid 25495] 10:12:36.191784 mmap(0x7efcd1826000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25493] 10:12:36.191814 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.191838 <... read resumed> "cpu  123070 1342425 395184 67343097 2509 0 0 0\ncpu0 123070 1342425 395184 67343097 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58429396\nbtime 1450798266\nprocesses 892978\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25500] 10:12:36.191865 <... getegid resumed> ) = 12
[pid 25495] 10:12:36.191879 <... mmap resumed> ) = 0x7efcd1826000
[pid 25493] 10:12:36.191904 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064882, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25492] 10:12:36.191934 close(10 <unfinished ...>
[pid 25500] 10:12:36.191967 setgid(494 <unfinished ...>
[pid 25495] 10:12:36.191990 close(6 <unfinished ...>
[pid 25493] 10:12:36.192013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.192038 <... close resumed> ) = 0
[pid 25500] 10:12:36.192114 <... setgid resumed> ) = 0
[pid 25495] 10:12:36.192130 <... close resumed> ) = 0
[pid 25493] 10:12:36.192156 <... mmap resumed> ) = 0x7f6578ae7000
[pid 25492] 10:12:36.192174 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25500] 10:12:36.192209 setuid(495 <unfinished ...>
[pid 25495] 10:12:36.192232 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.192266 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.192289 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25500] 10:12:36.192331 <... setuid resumed> ) = 0
[pid 25495] 10:12:36.192345 <... open resumed> ) = 6
[pid 25493] 10:12:36.192383 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.192401 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25500] 10:12:36.192438 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.192466 read(6,  <unfinished ...>
[pid 25493] 10:12:36.192489 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25492] 10:12:36.192646 <... open resumed> ) = 10
[pid 25500] 10:12:36.192681 <... open resumed> ) = 9
[pid 25495] 10:12:36.192696 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.192730 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.192802 fcntl(10, F_GETFD <unfinished ...>
[pid 25482] 10:12:36.192828 <... select resumed> ) = 1 (in [11], left {299, 962776})
[pid 25500] 10:12:36.192867 fstat(9,  <unfinished ...>
[pid 25495] 10:12:36.192890 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.192913 read(0,  <unfinished ...>
[pid 25492] 10:12:36.192935 <... fcntl resumed> ) = 0
[pid 25482] 10:12:36.192951 read(11,  <unfinished ...>
[pid 25500] 10:12:36.192984 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.193011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25493] 10:12:36.193081 <... read resumed> "", 4096) = 0
[pid 25492] 10:12:36.193111 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25482] 10:12:36.193135 <... read resumed> "\27\3\3\1\20", 5) = 5
[pid 25500] 10:12:36.193164 fstat(9,  <unfinished ...>
[pid 25495] 10:12:36.193187 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.193217 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f657799e790},  <unfinished ...>
[pid 25492] 10:12:36.193245 <... fcntl resumed> ) = 0
[pid 25482] 10:12:36.193266 read(11,  <unfinished ...>
[pid 25473] 10:12:36.193292 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25500] 10:12:36.193322 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.193350 <... mmap resumed> ) = 0x7efcd13f5000
[pid 25493] 10:12:36.193369 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25492] 10:12:36.193387 read(10,  <unfinished ...>
[pid 25482] 10:12:36.193410 <... read resumed> "F\21!\7K\314Yx{\356\274\10\21e\342\37\32Tu\10'\32q\17\230\0\245\222P\340\377\223\352r}.\335m\247\254\212\253\f\256\262\32\206a\315\2\37\372M\352+\231\262F<v\370\301$qV?\2275\377\355%\353\17\271\324\337?\321\232\354w\200\322\32\232\37\316#\277\nw\5\356\346\2034\230$\267\257\r\354\256N?\21\351\264f\326vZ\7]\317\336ht\r#Uaf+_\346\26J\00256\262\250^\374\224l\20\267 \1773\237\271\\\32B\373&\3543\224\200\351\177\323\314#\236\7_\365kW\253\212r\251\t\314\257~p\352 \365SR\6\254\3\311:\322\347\354\270\375\221\330\302\365O\2569_\307\370G\327p\206J\242\353\313\275\f\205J;B\327\361\v\235\353\5L(\212h\332\263E^&\331\223G\2305l\236\235O\344\265\373\37\205\352m\330\250\207Q\256\264 \3554k\30n\366"..., 272) = 272
[pid 25473] 10:12:36.193507 recvfrom(16,  <unfinished ...>
[pid 25500] 10:12:36.193644 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.193674 mprotect(0x7efcd13fa000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.193703 write(6, "1aEJMa-0006dB-67-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877 <unfinished ...>
[pid 25492] 10:12:36.193746 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25482] 10:12:36.193784 write(11, "\27\3\3\0\260\216\225/\215\n.\264\237v6\n\333\315F!k\307\345\253%\31Ak\332\347\231\3511\347\240\36\2617<]b1K\32b3\276P\3238\20{.i\36>\374\344glB\274$\33\356\246n\217;I[\235\3\306\214\254\361\262K{\363_\326\377\32oB(\202\2\333\237a\343\224?\325\5+\224\223p\36\333\335\346;1\245\333\217t\275\316 2\333Q\270\363OM4\201)\373\220\232\37=l\244\243\254Y\317+}\362le\23b\3170\221pAA\252\312\326$:\370\tM\247\336\4J\225\207Nm\266\337\304u\3167\240\f\304\244\365\203\3550rD", 181 <unfinished ...>
[pid 25473] 10:12:36.193835 <... recvfrom resumed> "E\226\201\200\0\1\0\1\0\0\0\0\6aspmx3\ngooglemail\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0}\0\4\255\302\314\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 55
[pid 25500] 10:12:36.193876 <... mmap resumed> ) = 0x7f33164fa000
[pid 25495] 10:12:36.193891 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.193909 <... write resumed> ) = 1877
[pid 25492] 10:12:36.193928 close(10 <unfinished ...>
[pid 25482] 10:12:36.193953 <... write resumed> ) = 181
[pid 25473] 10:12:36.193973 close(16 <unfinished ...>
[pid 25500] 10:12:36.194011 read(9,  <unfinished ...>
[pid 25495] 10:12:36.194041 mmap(0x7efcd15f9000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25493] 10:12:36.194072 fsync(6 <unfinished ...>
[pid 25492] 10:12:36.194147 <... close resumed> ) = 0
[pid 25482] 10:12:36.194183 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25473] 10:12:36.194321 <... close resumed> ) = 0
[pid 25500] 10:12:36.194451 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25495] 10:12:36.194479 <... mmap resumed> ) = 0x7efcd15f9000
[pid 25492] 10:12:36.194504 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.194620 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25500] 10:12:36.194659 read(9,  <unfinished ...>
[pid 25495] 10:12:36.194687 close(6 <unfinished ...>
[pid 25493] 10:12:36.194711 <... fsync resumed> ) = 0
[pid 25492] 10:12:36.194747 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.194776 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25500] 10:12:36.194842 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25495] 10:12:36.194865 <... close resumed> ) = 0
[pid 25493] 10:12:36.194898 stat("/etc/localtime",  <unfinished ...>
[pid 25492] 10:12:36.194926 stat("/var/tmp",  <unfinished ...>
[pid 25473] 10:12:36.194956 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25500] 10:12:36.194992 close(9 <unfinished ...>
[pid 25495] 10:12:36.195016 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.195053 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25492] 10:12:36.195126 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25473] 10:12:36.195209 <... open resumed> ) = 16
[pid 25500] 10:12:36.195240 <... close resumed> ) = 0
[pid 25495] 10:12:36.195255 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.195274 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.195297 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.195325 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25500] 10:12:36.195358 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25495] 10:12:36.195385 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.195422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064882, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25492] 10:12:36.195546 <... mmap resumed> ) = 0x7f638dc67000
[pid 25473] 10:12:36.195688 <... ioctl resumed> , 0x7ffdac33ce60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25500] 10:12:36.195719 <... munmap resumed> ) = 0
[pid 25495] 10:12:36.195733 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.195796 brk(0x10d1000 <unfinished ...>
[pid 25492] 10:12:36.195824 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.195857 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25500] 10:12:36.195888 brk(0x1602000 <unfinished ...>
[pid 25495] 10:12:36.195911 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.195942 <... brk resumed> ) = 0x10d1000
[pid 25492] 10:12:36.195990 <... open resumed> ) = 10
[pid 25473] 10:12:36.196009 <... lseek resumed> ) = 0
[pid 25500] 10:12:36.196034 <... brk resumed> ) = 0x1602000
[pid 25495] 10:12:36.196048 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.196227 getuid( <unfinished ...>
[pid 25492] 10:12:36.196255 fcntl(10, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.196278 fstat(16,  <unfinished ...>
[pid 25500] 10:12:36.196309 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25495] 10:12:36.196332 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.196363 <... getuid resumed> ) = 47
[pid 25492] 10:12:36.196381 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.196398 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25500] 10:12:36.196435 <... lseek resumed> ) = 19
[pid 25495] 10:12:36.196448 <... open resumed> ) = 6
[pid 25493] 10:12:36.196472 geteuid( <unfinished ...>
[pid 25492] 10:12:36.196496 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.196651 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25500] 10:12:36.196700 read(6,  <unfinished ...>
[pid 25495] 10:12:36.196726 read(6,  <unfinished ...>
[pid 25493] 10:12:36.196750 <... geteuid resumed> ) = 47
[pid 25492] 10:12:36.196769 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.196790 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.196820 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25500] 10:12:36.196854 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2420) = 1858
[pid 25495] 10:12:36.196879 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.197185 getgid( <unfinished ...>
[pid 25492] 10:12:36.197215 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.197239 read(16,  <unfinished ...>
[pid 25458] 10:12:36.197264 recvfrom(16,  <unfinished ...>
[pid 25500] 10:12:36.197300 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.197333 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.197359 <... getgid resumed> ) = 12
[pid 25492] 10:12:36.197378 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.197445 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25458] 10:12:36.197742 <... recvfrom resumed> "^\35\201\200\0\1\0\1\0\0\0\0\16wagthedogmedia\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\4\257\0\4\307\274\310#", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 52
[pid 25500] 10:12:36.197796 <... write resumed> ) = 4
[pid 25495] 10:12:36.197812 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25493] 10:12:36.197847 getegid( <unfinished ...>
[pid 25492] 10:12:36.197871 pread(10,  <unfinished ...>
[pid 25491] 10:12:36.197896 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25473] 10:12:36.197916 close(16 <unfinished ...>
[pid 25458] 10:12:36.197941 close(16 <unfinished ...>
[pid 25500] 10:12:36.197980 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.198004 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.198037 <... getegid resumed> ) = 12
[pid 25492] 10:12:36.198126 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25491] 10:12:36.198204 read(9,  <unfinished ...>
[pid 25473] 10:12:36.198233 <... close resumed> ) = 0
[pid 25458] 10:12:36.198287 <... close resumed> ) = 0
[pid 25500] 10:12:36.198393 <... write resumed> ) = 4
[pid 25495] 10:12:36.198413 <... mmap resumed> ) = 0x7efcd11f2000
[pid 25493] 10:12:36.198432 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.198470 pread(10,  <unfinished ...>
[pid 25491] 10:12:36.198497 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25473] 10:12:36.198515 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.198628 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25500] 10:12:36.198669 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.198693 mprotect(0x7efcd11f4000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.198723 <... open resumed> ) = 8
[pid 25492] 10:12:36.198741 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25491] 10:12:36.198791 read(9,  <unfinished ...>
[pid 25473] 10:12:36.198818 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.198857 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25500] 10:12:36.198912 <... write resumed> ) = 4
[pid 25495] 10:12:36.198929 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.198947 read(8,  <unfinished ...>
[pid 25492] 10:12:36.198973 close(10 <unfinished ...>
[pid 25491] 10:12:36.198997 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.199015 stat("/usr/local/cpanel/3rdparty/mailman/lists/gretchen.murry_onehospitalitygroup.com/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.199049 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25500] 10:12:36.199088 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25495] 10:12:36.199112 mmap(0x7efcd13f3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25493] 10:12:36.199144 <... read resumed> "\24hn\242", 4) = 4
[pid 25492] 10:12:36.199163 <... close resumed> ) = 0
[pid 25491] 10:12:36.199207 read(9,  <unfinished ...>
[pid 25473] 10:12:36.199233 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.199263 <... open resumed> ) = 16
[pid 25500] 10:12:36.199294 <... write resumed> ) = 4
[pid 25495] 10:12:36.199309 <... mmap resumed> ) = 0x7efcd13f3000
[pid 25493] 10:12:36.199336 close(8 <unfinished ...>
[pid 25492] 10:12:36.199364 munmap(0x7f638dc67000, 200704 <unfinished ...>
[pid 25491] 10:12:36.199417 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25473] 10:12:36.199436 stat("/etc/demouids",  <unfinished ...>
[pid 25458] 10:12:36.199462 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25500] 10:12:36.199498 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.199595 close(6 <unfinished ...>
[pid 25493] 10:12:36.199626 <... close resumed> ) = 0
[pid 25492] 10:12:36.199727 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.199764 read(9,  <unfinished ...>
[pid 25473] 10:12:36.199789 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.199844 <... ioctl resumed> , 0x7ffc7ad951c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25500] 10:12:36.199879 <... write resumed> ) = 4
[pid 25495] 10:12:36.199893 <... close resumed> ) = 0
[pid 25493] 10:12:36.199923 readlink("/proc/self/exe",  <unfinished ...>
[pid 25492] 10:12:36.199975 close(9 <unfinished ...>
[pid 25491] 10:12:36.200004 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.200028 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25458] 10:12:36.200058 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25500] 10:12:36.200092 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25495] 10:12:36.200116 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.200146 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25492] 10:12:36.200214 <... close resumed> ) = 0
[pid 25491] 10:12:36.200253 read(9,  <unfinished ...>
[pid 25473] 10:12:36.200283 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.200378 <... lseek resumed> ) = 0
[pid 25500] 10:12:36.200413 <... write resumed> ) = 40
[pid 25495] 10:12:36.200428 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.200448 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.200473 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.200504 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25473] 10:12:36.200528 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25458] 10:12:36.200555 fstat(16,  <unfinished ...>
[pid 25500] 10:12:36.200590 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25495] 10:12:36.200614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.200651 <... ioctl resumed> , 0x7ffc364786f0) = -1 EINVAL (Invalid argument)
[pid 25492] 10:12:36.200673 <... open resumed> ) = 9
[pid 25491] 10:12:36.200694 read(9,  <unfinished ...>
[pid 25473] 10:12:36.200719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25458] 10:12:36.200855 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25500] 10:12:36.200902 <... write resumed> ) = 4
[pid 25495] 10:12:36.200916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.200936 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.200960 fstat(9,  <unfinished ...>
[pid 25491] 10:12:36.200982 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.201003 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.201035 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25500] 10:12:36.201069 close(10 <unfinished ...>
[pid 25495] 10:12:36.201091 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.201121 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25492] 10:12:36.201143 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.201180 wait4(-1,  <unfinished ...>
[pid 25473] 10:12:36.201204 <... stat resumed> 0x7f7c14346880) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.201230 <... fcntl resumed> ) = 0
[pid 25500] 10:12:36.201265 <... close resumed> ) = 0
[pid 25495] 10:12:36.201281 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.201313 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.201348 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.201371 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25458] 10:12:36.201398 read(16,  <unfinished ...>
[pid 25500] 10:12:36.201430 exit_group(0) = ?
[pid 25495] 10:12:36.201444 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.201840 <... ioctl resumed> , 0x7ffc364786f0) = -1 EINVAL (Invalid argument)
[pid 25492] 10:12:36.201861 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.201892 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.201933 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25500] 10:12:36.202139 +++ exited with 0 +++
[pid 25495] 10:12:36.202157 <... open resumed> ) = 6
[pid 25493] 10:12:36.202174 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.202198 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.202225 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25500
[pid 25473] 10:12:36.202245 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.202278 close(16 <unfinished ...>
[pid 25495] 10:12:36.202312 read(6,  <unfinished ...>
[pid 25493] 10:12:36.202336 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25492] 10:12:36.202356 <... mmap resumed> ) = 0x7f638dcae000
[pid 25491] 10:12:36.202374 close(9 <unfinished ...>
[pid 25473] 10:12:36.202400 <... open resumed> ) = 16
[pid 25458] 10:12:36.202419 <... close resumed> ) = 0
[pid 25495] 10:12:36.202472 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.202502 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.202532 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.202556 <... close resumed> ) = 0
[pid 25473] 10:12:36.202572 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.202596 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25495] 10:12:36.202634 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.202658 <... ioctl resumed> , 0x7ffc36478700) = -1 EINVAL (Invalid argument)
[pid 25492] 10:12:36.202676 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.202693 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25473] 10:12:36.202722 <... ioctl resumed> , 0x7ffdac33b340) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.202740 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25495] 10:12:36.202785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25493] 10:12:36.202823 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.202848 read(9,  <unfinished ...>
[pid 25491] 10:12:36.202874 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25473] 10:12:36.202915 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.202941 stat("/usr/local/cpanel/3rdparty/mailman/lists/info_theviewsatsuperstition.com/config.pck",  <unfinished ...>
[pid 25495] 10:12:36.202982 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.203009 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25492] 10:12:36.203031 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25491] 10:12:36.203077 brk(0x1601000 <unfinished ...>
[pid 25473] 10:12:36.203106 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.203123 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.203160 <... mmap resumed> ) = 0x7efcd4299000
[pid 25493] 10:12:36.203181 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.203215 stat("/jail_owner",  <unfinished ...>
[pid 25491] 10:12:36.203242 <... brk resumed> ) = 0x1601000
[pid 25473] 10:12:36.203267 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.203291 stat("/etc/demouids",  <unfinished ...>
[pid 25495] 10:12:36.203326 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.203357 <... open resumed> ) = 8
[pid 25492] 10:12:36.203375 <... stat resumed> 0x7ffc8d341f50) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.203400 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25473] 10:12:36.203439 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25458] 10:12:36.203466 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25495] 10:12:36.203513 <... mmap resumed> ) = 0x7efcd0fcf000
[pid 25493] 10:12:36.203671 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.203704 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:36.203733 <... open resumed> ) = 9
[pid 25473] 10:12:36.203754 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.203778 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25495] 10:12:36.203815 mprotect(0x7efcd0fe6000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.203844 <... ioctl resumed> , 0x7ffc364787d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.203862 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:36.203901 alarm(60 <unfinished ...>
[pid 25473] 10:12:36.203928 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.203946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25495] 10:12:36.204054 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.204078 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.204102 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25491] 10:12:36.204132 <... alarm resumed> ) = 0
[pid 25473] 10:12:36.204148 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.204172 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25495] 10:12:36.204206 mmap(0x7efcd11e6000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25493] 10:12:36.204238 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.204257 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.204282 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25473] 10:12:36.204313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25458] 10:12:36.204350 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25495] 10:12:36.204493 <... mmap resumed> ) = 0x7efcd11e6000
[pid 25493] 10:12:36.204532 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.204560 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:36.204590 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.204609 read(16,  <unfinished ...>
[pid 25458] 10:12:36.204635 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25495] 10:12:36.204674 close(6 <unfinished ...>
[pid 25493] 10:12:36.204697 <... fcntl resumed> ) = 0
[pid 25492] 10:12:36.204716 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:36.204752 alarm(0 <unfinished ...>
[pid 25473] 10:12:36.204777 <... read resumed> "0", 8192) = 1
[pid 25458] 10:12:36.204796 <... stat resumed> 0x7f03f3286880) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.204832 <... close resumed> ) = 0
[pid 25493] 10:12:36.204875 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25492] 10:12:36.204901 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25491] 10:12:36.204929 <... alarm resumed> ) = 60
[pid 25473] 10:12:36.204991 read(16,  <unfinished ...>
[pid 25458] 10:12:36.205018 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25495] 10:12:36.205053 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.205084 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f657799e790}, 8) = 0
[pid 25492] 10:12:36.205110 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.205133 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.205171 <... read resumed> "", 8192) = 0
[pid 25458] 10:12:36.205192 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25495] 10:12:36.205243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.205264 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790},  <unfinished ...>
[pid 25492] 10:12:36.205290 stat("/etc/demouids",  <unfinished ...>
[pid 25491] 10:12:36.205316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.205339 close(16 <unfinished ...>
[pid 25458] 10:12:36.205364 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.205404 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.205439 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f657799e790}, 8) = 0
[pid 25492] 10:12:36.205894 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.205959 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.206003 <... close resumed> ) = 0
[pid 25458] 10:12:36.206068 <... open resumed> ) = 16
[pid 25495] 10:12:36.206103 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.206122 read(8,  <unfinished ...>
[pid 25492] 10:12:36.206146 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.206174 <... open resumed> ) = 10
[pid 25473] 10:12:36.206191 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.206220 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.206254 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.206284 <... read resumed> "", 8192) = 0
[pid 25492] 10:12:36.206308 <... open resumed> ) = 10
[pid 25491] 10:12:36.206326 read(10,  <unfinished ...>
[pid 25473] 10:12:36.206373 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25458] 10:12:36.206417 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.206447 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.206468 close(8 <unfinished ...>
[pid 25492] 10:12:36.206493 fstat(10,  <unfinished ...>
[pid 25491] 10:12:36.206515 <... read resumed> "cpu  123070 1342426 395185 67343097 2509 0 0 0\ncpu0 123070 1342426 395185 67343097 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58431250\nbtime 1450798266\nprocesses 892978\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25473] 10:12:36.206621 stat("/etc/localtime",  <unfinished ...>
[pid 25458] 10:12:36.206656 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.206694 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.206733 <... close resumed> ) = 0
[pid 25492] 10:12:36.206945 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.206988 close(10 <unfinished ...>
[pid 25473] 10:12:36.207017 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:36.207056 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.207085 <... open resumed> ) = 6
[pid 25493] 10:12:36.207102 brk(0x10f2000 <unfinished ...>
[pid 25492] 10:12:36.207126 fstat(10,  <unfinished ...>
[pid 25491] 10:12:36.207149 <... close resumed> ) = 0
[pid 25473] 10:12:36.207220 stat("/etc/localtime",  <unfinished ...>
[pid 25458] 10:12:36.207250 fstat(16,  <unfinished ...>
[pid 25495] 10:12:36.207281 read(6,  <unfinished ...>
[pid 25493] 10:12:36.207305 <... brk resumed> ) = 0x10f2000
[pid 25492] 10:12:36.207424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.207469 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25473] 10:12:36.207502 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25458] 10:12:36.207540 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25495] 10:12:36.207578 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.207603 stat("/etc/exim.pl",  <unfinished ...>
[pid 25492] 10:12:36.207630 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.207657 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.207694 close(7 <unfinished ...>
[pid 25458] 10:12:36.207720 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25495] 10:12:36.207753 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.207776 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.207807 <... mmap resumed> ) = 0x7f638dcad000
[pid 25491] 10:12:36.207824 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.207855 <... close resumed> ) = 0
[pid 25458] 10:12:36.207875 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.207903 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.207934 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.207962 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.207985 <... open resumed> ) = 10
[pid 25473] 10:12:36.208003 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25458] 10:12:36.208036 fstat(16,  <unfinished ...>
[pid 25495] 10:12:36.208068 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.208099 <... open resumed> ) = 8
[pid 25492] 10:12:36.208118 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.208135 fcntl(10, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.208159 <... open resumed> ) = 7
[pid 25458] 10:12:36.208174 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25495] 10:12:36.208222 <... mmap resumed> ) = 0x7efcd0d8b000
[pid 25493] 10:12:36.208240 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.208271 read(10,  <unfinished ...>
[pid 25491] 10:12:36.208292 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.208301 fcntl(7, F_GETFD <unfinished ...>
[pid 25458] 10:12:36.208310 read(16,  <unfinished ...>
[pid 25495] 10:12:36.208329 mprotect(0x7efcd0dcc000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.208343 <... ioctl resumed> , 0x7ffc36478600) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.208354 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.208371 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.208381 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.208389 <... read resumed> "0", 8192) = 1
[pid 25495] 10:12:36.208409 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.208417 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.208426 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25491] 10:12:36.208440 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.208453 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.208463 read(16,  <unfinished ...>
[pid 25495] 10:12:36.208480 mmap(0x7efcd0fcc000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25493] 10:12:36.208496 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.208731 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25491] 10:12:36.208812 read(10,  <unfinished ...>
[pid 25473] 10:12:36.208842 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.208858 <... read resumed> "", 8192) = 0
[pid 25495] 10:12:36.208889 <... mmap resumed> ) = 0x7efcd0fcc000
[pid 25493] 10:12:36.208917 read(8,  <unfinished ...>
[pid 25492] 10:12:36.208945 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.208973 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25473] 10:12:36.209009 fstat(7,  <unfinished ...>
[pid 25458] 10:12:36.209034 close(16 <unfinished ...>
[pid 25495] 10:12:36.209068 close(6 <unfinished ...>
[pid 25493] 10:12:36.209092 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25492] 10:12:36.210049 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.210106 close(10 <unfinished ...>
[pid 25473] 10:12:36.210135 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376266, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25458] 10:12:36.210166 <... close resumed> ) = 0
[pid 25495] 10:12:36.210242 <... close resumed> ) = 0
[pid 25493] 10:12:36.210277 brk(0x1113000 <unfinished ...>
[pid 25492] 10:12:36.210304 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.210335 <... close resumed> ) = 0
[pid 25473] 10:12:36.210369 write(7, "2015-12-30 10:12:36 [25473] 1aEJMZ-0006ce-8t SMTP connection outbound 1451491956 1aEJMZ-0006ce-8t finestweddingsites.com gretchen.murry@onehospitalitygroup.com\n", 160 <unfinished ...>
[pid 25458] 10:12:36.210411 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25495] 10:12:36.210449 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.210480 <... brk resumed> ) = 0x1113000
[pid 25492] 10:12:36.210811 <... open resumed> ) = 11
[pid 25491] 10:12:36.210840 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.210872 <... write resumed> ) = 160
[pid 25458] 10:12:36.210915 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25495] 10:12:36.210976 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.210997 read(8,  <unfinished ...>
[pid 25492] 10:12:36.211024 fstat(11,  <unfinished ...>
[pid 25491] 10:12:36.211047 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.211067 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25458] 10:12:36.211104 stat("/etc/localtime",  <unfinished ...>
[pid 25495] 10:12:36.211139 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.211173 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25492] 10:12:36.212174 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.212227 stat("/var/tmp",  <unfinished ...>
[pid 25473] 10:12:36.212263 <... open resumed> ) = 16
[pid 25458] 10:12:36.212281 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.212332 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.212353 brk(0x1134000 <unfinished ...>
[pid 25492] 10:12:36.212378 fstat(11,  <unfinished ...>
[pid 25491] 10:12:36.212402 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25473] 10:12:36.212484 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25458] 10:12:36.212512 stat("/etc/localtime",  <unfinished ...>
[pid 25495] 10:12:36.212620 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.212660 <... brk resumed> ) = 0x1134000
[pid 25492] 10:12:36.212996 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.213040 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.213070 <... lseek resumed> ) = 11
[pid 25458] 10:12:36.213089 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.213140 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.213163 read(8,  <unfinished ...>
[pid 25492] 10:12:36.213190 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.213217 <... mmap resumed> ) = 0x7f33164b3000
[pid 25473] 10:12:36.213350 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.213378 close(7 <unfinished ...>
[pid 25495] 10:12:36.213413 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.213447 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25492] 10:12:36.214542 <... mmap resumed> ) = 0x7f638dcac000
[pid 25491] 10:12:36.214576 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.214621 <... ioctl resumed> , 0x7ffdac33b340) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.214648 <... close resumed> ) = 0
[pid 25495] 10:12:36.214685 <... open resumed> ) = 6
[pid 25493] 10:12:36.214704 brk(0x1155000 <unfinished ...>
[pid 25492] 10:12:36.214732 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.214757 <... open resumed> ) = 10
[pid 25473] 10:12:36.214773 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.214796 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25495] 10:12:36.214839 read(6,  <unfinished ...>
[pid 25493] 10:12:36.214863 <... brk resumed> ) = 0x1155000
[pid 25492] 10:12:36.214877 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.215129 fcntl(10, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.215161 <... lseek resumed> ) = 11
[pid 25458] 10:12:36.215180 <... open resumed> ) = 7
[pid 25495] 10:12:36.215207 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.215295 read(8,  <unfinished ...>
[pid 25492] 10:12:36.215322 read(11,  <unfinished ...>
[pid 25491] 10:12:36.215351 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.215368 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.215391 fcntl(7, F_GETFD <unfinished ...>
[pid 25495] 10:12:36.215423 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.215445 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25492] 10:12:36.215463 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:36.215872 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.215909 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=11, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25458] 10:12:36.215942 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.215969 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.216006 read(8,  <unfinished ...>
[pid 25492] 10:12:36.216030 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.216061 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.216081 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.216105 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25495] 10:12:36.216137 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.216164 <... read resumed> "", 8192) = 0
[pid 25492] 10:12:36.216179 <... open resumed> ) = 12
[pid 25491] 10:12:36.216202 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.216228 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.216252 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.216279 <... mmap resumed> ) = 0x7efcd4298000
[pid 25493] 10:12:36.216299 close(8 <unfinished ...>
[pid 25492] 10:12:36.216324 fstat(12,  <unfinished ...>
[pid 25491] 10:12:36.216347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.216413 write(16, "1", 1 <unfinished ...>
[pid 25458] 10:12:36.216447 fstat(7,  <unfinished ...>
[pid 25495] 10:12:36.216480 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.216510 <... close resumed> ) = 0
[pid 25492] 10:12:36.216528 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.216579 pread(10,  <unfinished ...>
[pid 25473] 10:12:36.216613 <... write resumed> ) = 1
[pid 25458] 10:12:36.216632 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376426, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.216675 <... mmap resumed> ) = 0x7efcd0aa4000
[pid 25493] 10:12:36.216693 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25492] 10:12:36.216727 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.216759 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25473] 10:12:36.216829 close(16 <unfinished ...>
[pid 25458] 10:12:36.216860 write(7, "2015-12-30 10:12:36 [25458] 1aEJMY-0006cO-Sq SMTP connection outbound 1451491956 1aEJMY-0006cO-Sq finestweddingsites.com info@theviewsatsuperstition.com\n", 153 <unfinished ...>
[pid 25495] 10:12:36.216900 mprotect(0x7efcd0b7f000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.216930 <... stat resumed> 0x7f6577185880) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.216946 <... mmap resumed> ) = 0x7f638dcab000
[pid 25491] 10:12:36.216968 pread(10,  <unfinished ...>
[pid 25473] 10:12:36.216994 <... close resumed> ) = 0
[pid 25458] 10:12:36.217036 <... write resumed> ) = 153
[pid 25495] 10:12:36.217091 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.217112 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25492] 10:12:36.217139 read(12,  <unfinished ...>
[pid 25491] 10:12:36.217172 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25473] 10:12:36.217211 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.217243 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25495] 10:12:36.217288 mmap(0x7efcd0d7f000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25493] 10:12:36.217320 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.217349 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.217378 pread(10,  <unfinished ...>
[pid 25473] 10:12:36.217389 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.217406 <... open resumed> ) = 16
[pid 25495] 10:12:36.217426 <... mmap resumed> ) = 0x7efcd0d7f000
[pid 25493] 10:12:36.217444 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25492] 10:12:36.217453 close(12 <unfinished ...>
[pid 25491] 10:12:36.217467 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25473] 10:12:36.217517 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.217735 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25495] 10:12:36.217770 close(6 <unfinished ...>
[pid 25493] 10:12:36.217793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.217820 <... close resumed> ) = 0
[pid 25491] 10:12:36.217839 close(10 <unfinished ...>
[pid 25473] 10:12:36.217864 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.217917 <... lseek resumed> ) = 12
[pid 25495] 10:12:36.217949 <... close resumed> ) = 0
[pid 25493] 10:12:36.217977 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.218007 munmap(0x7f638dcab000, 4096 <unfinished ...>
[pid 25491] 10:12:36.218035 <... close resumed> ) = 0
[pid 25473] 10:12:36.218079 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25458] 10:12:36.218113 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.218147 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.218179 <... open resumed> ) = 8
[pid 25492] 10:12:36.218198 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.218244 munmap(0x7f33164b3000, 200704 <unfinished ...>
[pid 25473] 10:12:36.218288 <... socket resumed> ) = 16
[pid 25458] 10:12:36.218305 <... ioctl resumed> , 0x7ffc7ad936a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.218333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.218351 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.218374 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.218401 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.218433 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25458] 10:12:36.218468 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.218501 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.218610 <... ioctl resumed> , 0x7ffc36478600) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.218629 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.218660 close(9 <unfinished ...>
[pid 25473] 10:12:36.218691 <... connect resumed> ) = 0
[pid 25458] 10:12:36.218708 <... lseek resumed> ) = 12
[pid 25495] 10:12:36.218735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.218753 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.218775 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.218801 <... close resumed> ) = 0
[pid 25473] 10:12:36.218835 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25458] 10:12:36.218865 fstat(16,  <unfinished ...>
[pid 25495] 10:12:36.218897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.218928 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.218963 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.219014 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.219048 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25458] 10:12:36.219067 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=12, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.219104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.219125 read(8,  <unfinished ...>
[pid 25492] 10:12:36.219151 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.219179 <... open resumed> ) = 9
[pid 25473] 10:12:36.219198 sendto(16, "e\333\1\0\0\1\0\0\0\0\0\0\23onehospitalitygroup\3com\0\0\17\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25458] 10:12:36.219255 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25495] 10:12:36.219290 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.219323 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25492] 10:12:36.219835 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.219891 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.219919 <... sendto resumed> ) = 41
[pid 25458] 10:12:36.219936 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.219976 <... open resumed> ) = 6
[pid 25493] 10:12:36.219995 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.220022 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.220049 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.220086 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25458] 10:12:36.220115 write(16, "1", 1 <unfinished ...>
[pid 25495] 10:12:36.220151 read(6,  <unfinished ...>
[pid 25493] 10:12:36.220176 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.220192 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.220240 fstat(9,  <unfinished ...>
[pid 25458] 10:12:36.220267 <... write resumed> ) = 1
[pid 25495] 10:12:36.220291 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.220317 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.220344 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.220369 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.220397 close(16 <unfinished ...>
[pid 25495] 10:12:36.220430 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.220453 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.220468 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.220511 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.220633 <... close resumed> ) = 0
[pid 25495] 10:12:36.220681 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.220719 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.220748 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.220773 <... mmap resumed> ) = 0x7f33164fa000
[pid 25458] 10:12:36.220790 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25495] 10:12:36.220825 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.220857 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.220872 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.220912 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.220944 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.220976 <... mmap resumed> ) = 0x7efcd08a0000
[pid 25493] 10:12:36.220994 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.221021 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.221047 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.221063 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25495] 10:12:36.221098 mprotect(0x7efcd08a3000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.221126 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.221147 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.221198 read(9,  <unfinished ...>
[pid 25458] 10:12:36.221230 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.221281 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.221302 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.221339 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25491] 10:12:36.221365 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25458] 10:12:36.221411 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25495] 10:12:36.221451 mmap(0x7efcd0aa2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25493] 10:12:36.221483 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.221500 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.221598 stat("/jail_owner",  <unfinished ...>
[pid 25458] 10:12:36.221634 <... socket resumed> ) = 16
[pid 25495] 10:12:36.221658 <... mmap resumed> ) = 0x7efcd0aa2000
[pid 25493] 10:12:36.221684 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.221717 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.221745 <... stat resumed> 0x7ffc86158950) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.221769 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25495] 10:12:36.221809 close(6 <unfinished ...>
[pid 25493] 10:12:36.221832 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.221852 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.221891 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.221924 <... connect resumed> ) = 0
[pid 25495] 10:12:36.221948 <... close resumed> ) = 0
[pid 25493] 10:12:36.221974 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.222005 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.222034 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.222072 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25495] 10:12:36.222113 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.222143 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.222161 <... open resumed> ) = 12
[pid 25491] 10:12:36.222177 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.222207 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25495] 10:12:36.222233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.222251 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.222280 fstat(12,  <unfinished ...>
[pid 25491] 10:12:36.222303 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.222342 sendto(16, "zJ\1\0\0\1\0\0\0\0\0\0\26theviewsatsuperstition\3com\0\0\17\0\1", 44, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25495] 10:12:36.222406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.222442 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.222463 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.222494 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.222598 <... sendto resumed> ) = 44
[pid 25495] 10:12:36.222628 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.222647 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.222678 fstat(12,  <unfinished ...>
[pid 25491] 10:12:36.222701 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.222745 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25495] 10:12:36.222782 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.222812 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.222830 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.222857 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25495] 10:12:36.222892 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.222912 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.222942 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.222968 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.222996 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.223029 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.223049 <... mmap resumed> ) = 0x7f638dcab000
[pid 25491] 10:12:36.223067 stat("/etc/demouids",  <unfinished ...>
[pid 25495] 10:12:36.223099 <... open resumed> ) = 6
[pid 25493] 10:12:36.223115 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.223144 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.223168 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25495] 10:12:36.223223 read(6,  <unfinished ...>
[pid 25493] 10:12:36.223251 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.223269 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.223285 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.223320 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.223343 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.223373 read(12,  <unfinished ...>
[pid 25491] 10:12:36.223396 <... open resumed> ) = 10
[pid 25495] 10:12:36.223418 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.223441 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.223469 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.223504 fstat(10,  <unfinished ...>
[pid 25495] 10:12:36.223543 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25493] 10:12:36.223574 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.223606 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.223644 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25495] 10:12:36.223684 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.223724 <... open resumed> ) = 9
[pid 25492] 10:12:36.223744 <... open resumed> ) = 13
[pid 25491] 10:12:36.223764 fstat(10,  <unfinished ...>
[pid 25495] 10:12:36.223795 <... mmap resumed> ) = 0x7efcd0674000
[pid 25493] 10:12:36.223812 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.223835 fstat(13,  <unfinished ...>
[pid 25491] 10:12:36.223858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25495] 10:12:36.223891 mprotect(0x7efcd069d000, 2097152, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.223919 <... ioctl resumed> , 0x7ffc36478010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.223937 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.223962 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.223980 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.223988 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.223997 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.224007 <... mmap resumed> ) = 0x7f33164f9000
[pid 25495] 10:12:36.224021 mmap(0x7efcd089d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25493] 10:12:36.224036 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.224056 <... mmap resumed> ) = 0x7f638dcaa000
[pid 25491] 10:12:36.224066 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25495] 10:12:36.224081 <... mmap resumed> ) = 0x7efcd089d000
[pid 25493] 10:12:36.224094 brk(0x1176000 <unfinished ...>
[pid 25492] 10:12:36.224104 read(13,  <unfinished ...>
[pid 25491] 10:12:36.224116 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.224131 mmap(0x7efcd089f000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.224144 <... brk resumed> ) = 0x1176000
[pid 25492] 10:12:36.224162 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.224180 read(10,  <unfinished ...>
[pid 25495] 10:12:36.224196 <... mmap resumed> ) = 0x7efcd089f000
[pid 25493] 10:12:36.224210 read(9,  <unfinished ...>
[pid 25492] 10:12:36.224221 close(13 <unfinished ...>
[pid 25491] 10:12:36.224232 <... read resumed> "", 4096) = 0
[pid 25495] 10:12:36.224255 close(6 <unfinished ...>
[pid 25493] 10:12:36.224264 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25492] 10:12:36.224784 <... close resumed> ) = 0
[pid 25491] 10:12:36.224812 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25495] 10:12:36.224852 <... close resumed> ) = 0
[pid 25493] 10:12:36.224879 read(9,  <unfinished ...>
[pid 25492] 10:12:36.224908 munmap(0x7f638dcaa000, 4096 <unfinished ...>
[pid 25491] 10:12:36.224936 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25495] 10:12:36.225090 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.225130 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25492] 10:12:36.225882 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.225934 getuid( <unfinished ...>
[pid 25495] 10:12:36.225971 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.225990 read(9,  <unfinished ...>
[pid 25492] 10:12:36.226015 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.226042 <... getuid resumed> ) = 0
[pid 25495] 10:12:36.226068 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.226102 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25492] 10:12:36.226121 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.226253 geteuid( <unfinished ...>
[pid 25495] 10:12:36.226292 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.226310 brk(0x1197000 <unfinished ...>
[pid 25492] 10:12:36.226334 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25491] 10:12:36.226364 <... geteuid resumed> ) = 0
[pid 25495] 10:12:36.226389 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.226421 <... brk resumed> ) = 0x1197000
[pid 25492] 10:12:36.226434 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.226884 getgid( <unfinished ...>
[pid 25495] 10:12:36.226927 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.226948 read(9,  <unfinished ...>
[pid 25492] 10:12:36.226972 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.227000 <... getgid resumed> ) = 12
[pid 25495] 10:12:36.227027 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.227062 <... read resumed> "", 8192) = 0
[pid 25492] 10:12:36.227076 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.227118 getegid( <unfinished ...>
[pid 25495] 10:12:36.227150 <... open resumed> ) = 6
[pid 25493] 10:12:36.227166 close(9 <unfinished ...>
[pid 25492] 10:12:36.227189 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25491] 10:12:36.227218 <... getegid resumed> ) = 12
[pid 25495] 10:12:36.227314 read(6,  <unfinished ...>
[pid 25493] 10:12:36.227348 <... close resumed> ) = 0
[pid 25492] 10:12:36.227362 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25491] 10:12:36.228165 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.228223 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25493] 10:12:36.228250 read(8,  <unfinished ...>
[pid 25492] 10:12:36.228277 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25491] 10:12:36.228305 <... open resumed> ) = 11
[pid 25495] 10:12:36.228330 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.228356 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25492] 10:12:36.228374 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.229174 read(11,  <unfinished ...>
[pid 25495] 10:12:36.229222 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25493] 10:12:36.229258 read(8,  <unfinished ...>
[pid 25492] 10:12:36.229284 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.229310 <... read resumed> "i\v\3144", 4) = 4
[pid 25495] 10:12:36.229343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.229373 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25492] 10:12:36.229392 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.230168 close(11 <unfinished ...>
[pid 25495] 10:12:36.230216 <... mmap resumed> ) = 0x7efcd4297000
[pid 25493] 10:12:36.230239 read(8,  <unfinished ...>
[pid 25492] 10:12:36.230265 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25491] 10:12:36.230294 <... close resumed> ) = 0
[pid 25495] 10:12:36.230406 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25493] 10:12:36.230444 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25492] 10:12:36.230464 <... stat resumed> 0x7ffc8d344d40) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.231053 readlink("/proc/self/exe",  <unfinished ...>
[pid 25495] 10:12:36.231121 <... mmap resumed> ) = 0x7efcd045e000
[pid 25493] 10:12:36.231140 read(8,  <unfinished ...>
[pid 25492] 10:12:36.231166 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.231193 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25495] 10:12:36.231268 mprotect(0x7efcd0473000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.231302 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25492] 10:12:36.231322 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.231594 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.231645 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.231663 brk(0x11b8000 <unfinished ...>
[pid 25492] 10:12:36.231687 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.231717 <... ioctl resumed> , 0x7ffc86152ee0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:36.231739 <... select resumed> ) = 1 (in [11], left {299, 962688})
[pid 25495] 10:12:36.231775 mmap(0x7efcd0672000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25493] 10:12:36.231807 <... brk resumed> ) = 0x11b8000
[pid 25492] 10:12:36.231821 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.232354 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:36.232392 read(11,  <unfinished ...>
[pid 25495] 10:12:36.232428 <... mmap resumed> ) = 0x7efcd0672000
[pid 25493] 10:12:36.232456 read(8,  <unfinished ...>
[pid 25492] 10:12:36.232483 getuid( <unfinished ...>
[pid 25491] 10:12:36.232506 <... lseek resumed> ) = 0
[pid 25482] 10:12:36.232586 <... read resumed> "\27\3\3\0`", 5) = 5
[pid 25495] 10:12:36.232629 close(6 <unfinished ...>
[pid 25493] 10:12:36.232654 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25492] 10:12:36.232673 <... getuid resumed> ) = 0
[pid 25491] 10:12:36.233439 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25482] 10:12:36.233478 read(11,  <unfinished ...>
[pid 25495] 10:12:36.233514 <... close resumed> ) = 0
[pid 25493] 10:12:36.233614 brk(0x11d9000 <unfinished ...>
[pid 25492] 10:12:36.233649 geteuid( <unfinished ...>
[pid 25491] 10:12:36.233672 <... ioctl resumed> , 0x7ffc86152ee0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25482] 10:12:36.233698 <... read resumed> "\5\243\303$vB\374'\361\211)\353i\7O\7\353\262-G\246Y%IA\274\27\233\347Ia\22\244\v\370\313\255\27\331jI\2144\306*d@\203;\232[\2758\36685\367\200\330\332\177\315y\367^Z\225\370l\33!\324\375\256@2\316\276s3\323\251\r\266\211\34y\366\177\225\252e\355\367\345\305", 96) = 96
[pid 25495] 10:12:36.233764 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.233800 <... brk resumed> ) = 0x11d9000
[pid 25492] 10:12:36.233814 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.234044 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25482] 10:12:36.234076 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25495] 10:12:36.234115 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.234134 read(8,  <unfinished ...>
[pid 25492] 10:12:36.234159 getgid( <unfinished ...>
[pid 25491] 10:12:36.234182 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.234207 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.234243 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25492] 10:12:36.234262 <... getgid resumed> ) = 12
[pid 25491] 10:12:36.234789 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.234833 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.234852 read(8,  <unfinished ...>
[pid 25492] 10:12:36.234873 getegid( <unfinished ...>
[pid 25491] 10:12:36.234896 <... ioctl resumed> , 0x7ffc86152ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.234919 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.234951 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.235032 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.235067 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.235087 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.235119 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.235146 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.235181 <... open resumed> ) = 13
[pid 25491] 10:12:36.235200 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.235234 <... open resumed> ) = 6
[pid 25492] 10:12:36.235250 read(13,  <unfinished ...>
[pid 25491] 10:12:36.235275 <... open resumed> ) = 11
[pid 25495] 10:12:36.235298 read(6,  <unfinished ...>
[pid 25492] 10:12:36.235325 <... read resumed> "\300\3258\216", 4) = 4
[pid 25491] 10:12:36.235345 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.235375 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.235405 close(13 <unfinished ...>
[pid 25491] 10:12:36.235431 <... ioctl resumed> , 0x7ffc86152fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.235454 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.235478 <... close resumed> ) = 0
[pid 25491] 10:12:36.235666 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.235713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.235754 readlink("/proc/self/exe",  <unfinished ...>
[pid 25491] 10:12:36.235795 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.235821 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.235854 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25491] 10:12:36.235914 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25495] 10:12:36.235948 <... mmap resumed> ) = 0x7efcd0253000
[pid 25492] 10:12:36.235966 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.235995 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.236021 mprotect(0x7efcd025d000, 2093056, PROT_NONE <unfinished ...>
[pid 25493] 10:12:36.236050 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25492] 10:12:36.236068 <... ioctl resumed> , 0x7ffc8d341ba0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.236427 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25495] 10:12:36.236473 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.236498 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.236592 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25495] 10:12:36.236859 mmap(0x7efcd045c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25492] 10:12:36.236899 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.236922 brk(0x1622000 <unfinished ...>
[pid 25495] 10:12:36.236953 <... mmap resumed> ) = 0x7efcd045c000
[pid 25492] 10:12:36.236980 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.237007 <... brk resumed> ) = 0x1622000
[pid 25495] 10:12:36.237042 close(6 <unfinished ...>
[pid 25492] 10:12:36.237067 <... ioctl resumed> , 0x7ffc8d341ba0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.237087 read(11,  <unfinished ...>
[pid 25495] 10:12:36.237115 <... close resumed> ) = 0
[pid 25492] 10:12:36.237141 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.237165 <... read resumed> "", 8192) = 0
[pid 25495] 10:12:36.237193 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.237226 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.237245 close(11 <unfinished ...>
[pid 25495] 10:12:36.237275 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.237293 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.237320 <... close resumed> ) = 0
[pid 25495] 10:12:36.237684 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.237732 <... ioctl resumed> , 0x7ffc8d341bb0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.237759 stat("/etc/exim.pl",  <unfinished ...>
[pid 25495] 10:12:36.237793 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.237811 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.237842 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.237887 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.237919 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.237940 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.237975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.237995 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.238258 <... open resumed> ) = 11
[pid 25495] 10:12:36.238295 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.238334 brk(0x11fa000 <unfinished ...>
[pid 25492] 10:12:36.238356 <... open resumed> ) = 13
[pid 25491] 10:12:36.238375 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.238406 <... open resumed> ) = 6
[pid 25492] 10:12:36.238422 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.238446 <... ioctl resumed> , 0x7ffc86152df0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.238469 read(6,  <unfinished ...>
[pid 25492] 10:12:36.238493 <... ioctl resumed> , 0x7ffc8d341c80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.238511 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.238615 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.238648 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.238673 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.238717 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.238744 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.238763 read(11,  <unfinished ...>
[pid 25495] 10:12:36.238795 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25492] 10:12:36.238830 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.238855 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25495] 10:12:36.239736 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.239788 <... fcntl resumed> ) = 0
[pid 25491] 10:12:36.239810 brk(0x1643000 <unfinished ...>
[pid 25495] 10:12:36.239841 <... mmap resumed> ) = 0x7efcd0050000
[pid 25492] 10:12:36.239858 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25491] 10:12:36.239882 <... brk resumed> ) = 0x1643000
[pid 25495] 10:12:36.240238 mprotect(0x7efcd0052000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.240283 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0}, 8) = 0
[pid 25491] 10:12:36.240578 read(11,  <unfinished ...>
[pid 25495] 10:12:36.240625 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.240642 <... brk resumed> ) = 0x11fa000
[pid 25492] 10:12:36.240656 brk(0x2415000 <unfinished ...>
[pid 25491] 10:12:36.240766 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25495] 10:12:36.241632 mmap(0x7efcd0251000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25492] 10:12:36.241781 <... brk resumed> ) = 0x2415000
[pid 25491] 10:12:36.241814 brk(0x1664000 <unfinished ...>
[pid 25495] 10:12:36.241848 <... mmap resumed> ) = 0x7efcd0251000
[pid 25493] 10:12:36.241874 read(8,  <unfinished ...>
[pid 25492] 10:12:36.241897 read(13,  <unfinished ...>
[pid 25491] 10:12:36.241921 <... brk resumed> ) = 0x1664000
[pid 25495] 10:12:36.242360 close(6 <unfinished ...>
[pid 25492] 10:12:36.242399 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.242423 read(11,  <unfinished ...>
[pid 25495] 10:12:36.242462 <... close resumed> ) = 0
[pid 25493] 10:12:36.242487 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25492] 10:12:36.242507 close(13 <unfinished ...>
[pid 25491] 10:12:36.242638 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25495] 10:12:36.243270 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.243601 <... close resumed> ) = 0
[pid 25491] 10:12:36.243864 brk(0x1685000 <unfinished ...>
[pid 25495] 10:12:36.243906 <... mmap resumed> ) = 0x7efcd4296000
[pid 25492] 10:12:36.243943 stat("/etc/exim.pl",  <unfinished ...>
[pid 25495] 10:12:36.243978 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.244010 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.244042 <... brk resumed> ) = 0x1685000
[pid 25495] 10:12:36.244060 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.244585 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.244635 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.244671 <... open resumed> ) = 13
[pid 25491] 10:12:36.244690 read(11,  <unfinished ...>
[pid 25495] 10:12:36.244719 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.244737 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.244767 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.244796 <... ioctl resumed> , 0x7ffc8d341ab0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.244815 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25495] 10:12:36.244837 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.245132 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.245171 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.245204 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.245245 read(11,  <unfinished ...>
[pid 25495] 10:12:36.245277 <... open resumed> ) = 6
[pid 25492] 10:12:36.245294 read(13,  <unfinished ...>
[pid 25495] 10:12:36.245618 read(6,  <unfinished ...>
[pid 25492] 10:12:36.245647 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25491] 10:12:36.246444 <... read resumed> "", 8192) = 0
[pid 25495] 10:12:36.246479 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.246512 brk(0x2436000 <unfinished ...>
[pid 25495] 10:12:36.246603 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.246630 <... brk resumed> ) = 0x2436000
[pid 25491] 10:12:36.246964 close(11 <unfinished ...>
[pid 25495] 10:12:36.247019 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25492] 10:12:36.247057 read(13,  <unfinished ...>
[pid 25495] 10:12:36.247090 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.247122 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25491] 10:12:36.247948 <... close resumed> ) = 0
[pid 25495] 10:12:36.247983 <... mmap resumed> ) = 0x7efccfe31000
[pid 25492] 10:12:36.248026 brk(0x2457000 <unfinished ...>
[pid 25495] 10:12:36.248061 mprotect(0x7efccfe4e000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.248090 <... brk resumed> ) = 0x2457000
[pid 25491] 10:12:36.248505 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25495] 10:12:36.248606 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.248626 read(13,  <unfinished ...>
[pid 25495] 10:12:36.248657 mmap(0x7efcd004d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25492] 10:12:36.248937 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25491] 10:12:36.249667 <... stat resumed> 0x7f3314b98880) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.249704 <... mmap resumed> ) = 0x7efcd004d000
[pid 25493] 10:12:36.249735 read(8,  <unfinished ...>
[pid 25492] 10:12:36.249758 brk(0x2478000 <unfinished ...>
[pid 25495] 10:12:36.249787 mmap(0x7efcd004f000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.249818 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25495] 10:12:36.249850 <... mmap resumed> ) = 0x7efcd004f000
[pid 25492] 10:12:36.249873 <... brk resumed> ) = 0x2478000
[pid 25495] 10:12:36.249899 close(6 <unfinished ...>
[pid 25491] 10:12:36.250347 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.250387 <... close resumed> ) = 0
[pid 25492] 10:12:36.250450 read(13,  <unfinished ...>
[pid 25458] 10:12:36.250477 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25495] 10:12:36.250505 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.250594 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25491] 10:12:36.250616 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25458] 10:12:36.250912 recvfrom(16,  <unfinished ...>
[pid 25495] 10:12:36.250949 <... mmap resumed> ) = 0x7efcd4295000
[pid 25492] 10:12:36.251009 read(13,  <unfinished ...>
[pid 25491] 10:12:36.251035 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25458] 10:12:36.251065 <... recvfrom resumed> "zJ\201\200\0\1\0\1\0\0\0\0\26theviewsatsuperstition\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\4\260\0\4\0\0\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 60
[pid 25495] 10:12:36.251106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.251140 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.251155 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.251188 close(16 <unfinished ...>
[pid 25495] 10:12:36.251226 <... mmap resumed> ) = 0x7efcd4294000
[pid 25493] 10:12:36.251252 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25492] 10:12:36.251272 close(13 <unfinished ...>
[pid 25491] 10:12:36.251418 <... open resumed> ) = 11
[pid 25458] 10:12:36.251437 <... close resumed> ) = 0
[pid 25495] 10:12:36.251491 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.251588 <... close resumed> ) = 0
[pid 25491] 10:12:36.251609 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.251657 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25495] 10:12:36.252064 <... mmap resumed> ) = 0x7efcd4292000
[pid 25492] 10:12:36.252099 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25491] 10:12:36.252130 <... ioctl resumed> , 0x7ffc86152df0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.252146 <... socket resumed> ) = 16
[pid 25495] 10:12:36.252174 arch_prctl(ARCH_SET_FS, 0x7efcd42927c0 <unfinished ...>
[pid 25493] 10:12:36.252198 brk(0x121b000 <unfinished ...>
[pid 25492] 10:12:36.252219 <... stat resumed> 0x7f638c34c880) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.252234 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.252262 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25495] 10:12:36.252301 <... arch_prctl resumed> ) = 0
[pid 25492] 10:12:36.252362 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25491] 10:12:36.252389 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.252403 <... connect resumed> ) = 0
[pid 25495] 10:12:36.252449 mprotect(0x7efcd004d000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.252487 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.252516 read(11,  <unfinished ...>
[pid 25458] 10:12:36.252618 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25495] 10:12:36.252655 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.252677 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25491] 10:12:36.252703 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25458] 10:12:36.252721 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25495] 10:12:36.253017 mprotect(0x7efcd0251000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.253055 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.253085 brk(0x16a6000 <unfinished ...>
[pid 25458] 10:12:36.253113 sendto(16, "\352\332\1\0\0\1\0\0\0\0\0\0\26theviewsatsuperstition\3com\0\0\1\0\1", 44, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25495] 10:12:36.253178 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.253213 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.253244 <... brk resumed> ) = 0x16a6000
[pid 25458] 10:12:36.253259 <... sendto resumed> ) = 44
[pid 25495] 10:12:36.253459 mprotect(0x7efcd045c000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.253503 <... open resumed> ) = 13
[pid 25491] 10:12:36.253589 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25458] 10:12:36.253626 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25495] 10:12:36.253660 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.253687 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.253712 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.253731 mprotect(0x7efcd0672000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.253761 <... ioctl resumed> , 0x7ffc8d341ab0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.253780 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.253813 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.253843 mprotect(0x7efcd089d000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.253869 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.253895 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.253925 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.253947 mprotect(0x7efcd0aa2000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.253979 <... brk resumed> ) = 0x121b000
[pid 25492] 10:12:36.253993 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.254337 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.254494 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25491] 10:12:36.254584 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.254625 mprotect(0x7efcd0d7f000, 40960, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.254654 read(13,  <unfinished ...>
[pid 25495] 10:12:36.254682 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.254781 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.254803 mprotect(0x7efcd0fcc000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.254833 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25495] 10:12:36.254861 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.255173 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.255217 mprotect(0x7efcd11e6000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.255246 brk(0x2499000 <unfinished ...>
[pid 25495] 10:12:36.255273 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.255294 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.255316 mprotect(0x7efcd13f3000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.255351 <... brk resumed> ) = 0x2499000
[pid 25495] 10:12:36.255369 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.255798 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.255848 mprotect(0x7efcd1bdf000, 110592, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.255877 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.255906 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.255984 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.256006 mprotect(0x7efcd1e6b000, 16384, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.256035 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.256054 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.256157 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.256195 mprotect(0x7efcd2200000, 16384, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.256222 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.256251 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.256271 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.256290 mprotect(0x7efcd240b000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.256324 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.256343 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.256372 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.256411 mprotect(0x7efcd260f000, 4096, PROT_READ <unfinished ...>
[pid 25492] 10:12:36.256439 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.256470 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.257158 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.257183 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257207 mprotect(0x7efcd3367000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.257237 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.257265 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257285 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.257324 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.257341 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.257382 mprotect(0x7efcd379c000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.257410 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.257435 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.257465 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.257486 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.257501 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257579 mprotect(0x7efcd3a20000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.257613 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.257639 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257665 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.257693 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.257710 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.257751 mprotect(0x7efcd3c29000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.257779 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.257804 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.257837 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.257869 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.257885 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257906 mprotect(0x7efcd3e6e000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.257934 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.257967 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.257987 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.258014 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.258030 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.258072 mprotect(0x7efcd4088000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.258099 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.258130 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.258164 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.258204 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.258221 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.258242 mprotect(0x7efcd42ab000, 4096, PROT_READ <unfinished ...>
[pid 25493] 10:12:36.258274 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.258313 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.258339 <... mprotect resumed> ) = 0
[pid 25493] 10:12:36.258361 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.258376 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25495] 10:12:36.258418 munmap(0x7efcd42a0000, 39387 <unfinished ...>
[pid 25493] 10:12:36.258458 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.258489 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.258516 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.258625 <... munmap resumed> ) = 0
[pid 25493] 10:12:36.258648 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.258663 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.258679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25495] 10:12:36.258718 set_tid_address(0x7efcd4292a90 <unfinished ...>
[pid 25493] 10:12:36.258741 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.258769 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.258796 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25495] 10:12:36.258841 <... set_tid_address resumed> ) = 25495
[pid 25493] 10:12:36.258859 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.258874 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.258893 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.258937 set_robust_list(0x7efcd4292aa0, 24 <unfinished ...>
[pid 25493] 10:12:36.258961 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.258990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.259017 <... open resumed> ) = 12
[pid 25495] 10:12:36.259041 <... set_robust_list resumed> ) = 0
[pid 25493] 10:12:36.259058 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.259072 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.259088 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.259120 futex(0x7ffd5100449c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25493] 10:12:36.259145 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.259179 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.259207 <... ioctl resumed> , 0x7ffc86152800) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.259232 <... futex resumed> ) = 0
[pid 25493] 10:12:36.259248 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.259262 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.259281 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.259318 futex(0x7ffd5100449c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7efcd42927c0 <unfinished ...>
[pid 25493] 10:12:36.259343 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.259372 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.259399 <... lseek resumed> ) = 0
[pid 25495] 10:12:36.259444 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25493] 10:12:36.259470 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.259485 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.259502 read(12,  <unfinished ...>
[pid 25495] 10:12:36.259617 rt_sigaction(SIGRTMIN, {0x7efcd3155c60, [], SA_RESTORER|SA_SIGINFO, 0x7efcd315f790},  <unfinished ...>
[pid 25493] 10:12:36.259651 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.259680 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.259708 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25495] 10:12:36.260031 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25493] 10:12:36.260057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.260087 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.260125 read(12,  <unfinished ...>
[pid 25495] 10:12:36.260159 rt_sigaction(SIGRT_1, {0x7efcd3155cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7efcd315f790},  <unfinished ...>
[pid 25493] 10:12:36.260187 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.260219 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.260249 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25495] 10:12:36.260891 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25493] 10:12:36.260923 <... open resumed> ) = 9
[pid 25492] 10:12:36.260939 <... open resumed> ) = 14
[pid 25491] 10:12:36.260962 brk(0x16c7000 <unfinished ...>
[pid 25495] 10:12:36.260993 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25493] 10:12:36.261021 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.261044 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25495] 10:12:36.261074 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25493] 10:12:36.261100 <... ioctl resumed> , 0x7ffc36478010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.261116 <... ioctl resumed> , 0x7ffc8d3414c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.261136 <... brk resumed> ) = 0x16c7000
[pid 25495] 10:12:36.261154 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25493] 10:12:36.261352 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.261378 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25495] 10:12:36.261409 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25493] 10:12:36.261467 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.261483 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.261599 read(12,  <unfinished ...>
[pid 25495] 10:12:36.261638 statfs("/selinux",  <unfinished ...>
[pid 25493] 10:12:36.261674 read(9,  <unfinished ...>
[pid 25492] 10:12:36.261698 read(14,  <unfinished ...>
[pid 25495] 10:12:36.261728 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350339, f_bavail=6350339, f_files=1000000, f_ffree=691097, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25493] 10:12:36.261797 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25492] 10:12:36.261819 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25491] 10:12:36.262314 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25495] 10:12:36.262352 brk(0 <unfinished ...>
[pid 25493] 10:12:36.262856 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25492] 10:12:36.262886 read(14,  <unfinished ...>
[pid 25495] 10:12:36.262920 <... brk resumed> ) = 0xb7b000
[pid 25493] 10:12:36.262937 <... lseek resumed> ) = 878
[pid 25492] 10:12:36.262951 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25491] 10:12:36.263578 read(12,  <unfinished ...>
[pid 25495] 10:12:36.263623 brk(0xb9c000 <unfinished ...>
[pid 25493] 10:12:36.263650 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.263674 brk(0x24ba000 <unfinished ...>
[pid 25495] 10:12:36.263702 <... brk resumed> ) = 0xb9c000
[pid 25493] 10:12:36.263731 <... lseek resumed> ) = 878
[pid 25491] 10:12:36.263746 <... read resumed> "", 8192) = 0
[pid 25495] 10:12:36.263768 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.263812 close(9 <unfinished ...>
[pid 25492] 10:12:36.263836 <... brk resumed> ) = 0x24ba000
[pid 25495] 10:12:36.263855 <... open resumed> ) = 6
[pid 25493] 10:12:36.264053 <... close resumed> ) = 0
[pid 25491] 10:12:36.264075 close(12 <unfinished ...>
[pid 25495] 10:12:36.264348 fstat(6,  <unfinished ...>
[pid 25493] 10:12:36.264376 read(8,  <unfinished ...>
[pid 25492] 10:12:36.264401 read(14,  <unfinished ...>
[pid 25495] 10:12:36.264430 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.264463 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25491] 10:12:36.264482 <... close resumed> ) = 0
[pid 25495] 10:12:36.265112 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25493] 10:12:36.265910 read(8,  <unfinished ...>
[pid 25492] 10:12:36.265942 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25495] 10:12:36.265970 <... mmap resumed> ) = 0x7efcd42a9000
[pid 25493] 10:12:36.266389 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25491] 10:12:36.266421 read(11,  <unfinished ...>
[pid 25495] 10:12:36.266650 read(6,  <unfinished ...>
[pid 25493] 10:12:36.266746 brk(0x123c000 <unfinished ...>
[pid 25492] 10:12:36.266768 read(14,  <unfinished ...>
[pid 25495] 10:12:36.266801 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25493] 10:12:36.266834 <... brk resumed> ) = 0x123c000
[pid 25491] 10:12:36.266849 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25495] 10:12:36.267436 read(6,  <unfinished ...>
[pid 25492] 10:12:36.268293 <... read resumed> "", 8192) = 0
[pid 25495] 10:12:36.268322 <... read resumed> "", 1024) = 0
[pid 25491] 10:12:36.268355 read(11,  <unfinished ...>
[pid 25495] 10:12:36.268388 close(6 <unfinished ...>
[pid 25492] 10:12:36.268417 close(14 <unfinished ...>
[pid 25495] 10:12:36.268446 <... close resumed> ) = 0
[pid 25491] 10:12:36.268470 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25495] 10:12:36.268494 munmap(0x7efcd42a9000, 4096 <unfinished ...>
[pid 25492] 10:12:36.269275 <... close resumed> ) = 0
[pid 25495] 10:12:36.269300 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.270112 read(11,  <unfinished ...>
[pid 25495] 10:12:36.270158 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25492] 10:12:36.270197 read(13,  <unfinished ...>
[pid 25495] 10:12:36.270226 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.270322 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25495] 10:12:36.270351 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25492] 10:12:36.270978 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25495] 10:12:36.271008 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.271827 brk(0x16e8000 <unfinished ...>
[pid 25495] 10:12:36.271872 fstat(2,  <unfinished ...>
[pid 25492] 10:12:36.271899 read(13,  <unfinished ...>
[pid 25495] 10:12:36.271927 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25491] 10:12:36.271994 <... brk resumed> ) = 0x16e8000
[pid 25495] 10:12:36.272016 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7efcd315f790},  <unfinished ...>
[pid 25492] 10:12:36.272128 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25495] 10:12:36.272155 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.272920 read(11,  <unfinished ...>
[pid 25495] 10:12:36.272965 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25492] 10:12:36.272997 read(13,  <unfinished ...>
[pid 25495] 10:12:36.273024 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.273053 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25495] 10:12:36.273075 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25492] 10:12:36.273762 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25495] 10:12:36.273792 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.274359 read(11,  <unfinished ...>
[pid 25495] 10:12:36.274402 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25492] 10:12:36.274433 brk(0x24db000 <unfinished ...>
[pid 25495] 10:12:36.274469 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.274501 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25495] 10:12:36.275049 umask(0 <unfinished ...>
[pid 25492] 10:12:36.275089 <... brk resumed> ) = 0x24db000
[pid 25491] 10:12:36.275104 brk(0x1709000 <unfinished ...>
[pid 25495] 10:12:36.275188 <... umask resumed> ) = 0
[pid 25492] 10:12:36.275254 read(13,  <unfinished ...>
[pid 25495] 10:12:36.275287 geteuid( <unfinished ...>
[pid 25491] 10:12:36.275312 <... brk resumed> ) = 0x1709000
[pid 25495] 10:12:36.275330 <... geteuid resumed> ) = 0
[pid 25492] 10:12:36.275857 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25495] 10:12:36.275893 getuid( <unfinished ...>
[pid 25491] 10:12:36.276590 read(11,  <unfinished ...>
[pid 25495] 10:12:36.276621 <... getuid resumed> ) = 47
[pid 25492] 10:12:36.276643 read(13,  <unfinished ...>
[pid 25495] 10:12:36.276667 getgid()    = 12
[pid 25495] 10:12:36.276756 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25495] 10:12:36.276799 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25495] 10:12:36.276835 getgroups(65536, []) = 0
[pid 25495] 10:12:36.276874 setgroups(0, []) = 0
[pid 25495] 10:12:36.276911 getegid()   = 12
[pid 25495] 10:12:36.276944 geteuid()   = 0
[pid 25495] 10:12:36.276980 geteuid()   = 0
[pid 25495] 10:12:36.277013 getegid()   = 12
[pid 25495] 10:12:36.277047 setgid(12)  = 0
[pid 25495] 10:12:36.277082 setuid(0)   = 0
[pid 25495] 10:12:36.277143 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25495] 10:12:36.277198 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.277252 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.277298 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a9000
[pid 25495] 10:12:36.277340 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25495] 10:12:36.277485 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25495] 10:12:36.277610 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.277666 close(7)    = 0
[pid 25495] 10:12:36.277703 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25495] 10:12:36.277739 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.277779 close(7)    = 0
[pid 25495] 10:12:36.277822 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25495] 10:12:36.277866 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25495] 10:12:36.277914 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.277957 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25495] 10:12:36.278016 read(7, "", 4096) = 0
[pid 25495] 10:12:36.278052 close(7)    = 0
[pid 25495] 10:12:36.278093 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.278151 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.278199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.278247 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.278287 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25495] 10:12:36.278325 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25495] 10:12:36.278371 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7efcd4288000
[pid 25495] 10:12:36.278409 close(7)    = 0
[pid 25495] 10:12:36.278453 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25495] 10:12:36.278496 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.278608 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.278667 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7efccfc23000
[pid 25495] 10:12:36.278724 mprotect(0x7efccfc2f000, 2097152, PROT_NONE) = 0
[pid 25495] 10:12:36.278764 mmap(0x7efccfe2f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7efccfe2f000
[pid 25495] 10:12:36.278813 close(7)    = 0
[pid 25495] 10:12:36.278870 mprotect(0x7efccfe2f000, 4096, PROT_READ) = 0
[pid 25495] 10:12:36.278912 munmap(0x7efcd4288000, 39387) = 0
[pid 25495] 10:12:36.278959 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25495] 10:12:36.279007 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25495] 10:12:36.279046 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25495] 10:12:36.279093 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.279130 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25495] 10:12:36.279190 close(7)    = 0
[pid 25495] 10:12:36.279227 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.279283 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25495] 10:12:36.279324 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.279369 close(7)    = 0
[pid 25495] 10:12:36.279415 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25493] 10:12:36.280053 read(8,  <unfinished ...>
[pid 25492] 10:12:36.280084 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25491] 10:12:36.280105 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25495] 10:12:36.280684 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25493] 10:12:36.281255 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25492] 10:12:36.281279 brk(0x24fc000 <unfinished ...>
[pid 25495] 10:12:36.281579 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.281607 brk(0x125d000 <unfinished ...>
[pid 25491] 10:12:36.281632 read(11,  <unfinished ...>
[pid 25495] 10:12:36.281663 close(7 <unfinished ...>
[pid 25493] 10:12:36.281690 <... brk resumed> ) = 0x125d000
[pid 25492] 10:12:36.281704 <... brk resumed> ) = 0x24fc000
[pid 25495] 10:12:36.282585 <... close resumed> ) = 0
[pid 25491] 10:12:36.283053 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25495] 10:12:36.283089 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.283434 read(13,  <unfinished ...>
[pid 25495] 10:12:36.283465 <... open resumed> ) = 7
[pid 25495] 10:12:36.283487 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25495] 10:12:36.283600 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.283631 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25495] 10:12:36.283653 <... mmap resumed> ) = 0x7efcd42a8000
[pid 25495] 10:12:36.283673 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25495] 10:12:36.283737 close(7 <unfinished ...>
[pid 25473] 10:12:36.283765 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25495] 10:12:36.283791 <... close resumed> ) = 0
[pid 25473] 10:12:36.283807 recvfrom(16,  <unfinished ...>
[pid 25495] 10:12:36.283839 munmap(0x7efcd42a8000, 4096 <unfinished ...>
[pid 25473] 10:12:36.283867 <... recvfrom resumed> "e\333\201\200\0\1\0\5\0\0\0\0\23onehospitalitygroup\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\16\17\0\23\0\n\5aspmx\1l\6google\300 \300\f\0\17\0\1\0\0\16\17\0\t\0\24\4alt1\3007\300\f\0\17\0\1\0\0\16\17\0\t\0\24\4alt2\3007\300\f\0\17\0\1\0\0\16\17\0\26\0\36\6aspmx2\ngooglemail\300 \300\f\0\17\0\1\0\0\16\17\0\v\0\36\6aspmx3\300\207", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 171
[pid 25495] 10:12:36.283911 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.283948 close(16 <unfinished ...>
[pid 25495] 10:12:36.283984 read(6,  <unfinished ...>
[pid 25473] 10:12:36.284009 <... close resumed> ) = 0
[pid 25495] 10:12:36.284058 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25473] 10:12:36.284118 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25495] 10:12:36.284155 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.284185 <... socket resumed> ) = 16
[pid 25495] 10:12:36.284206 <... open resumed> ) = 7
[pid 25473] 10:12:36.284223 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25495] 10:12:36.284259 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.284283 <... connect resumed> ) = 0
[pid 25495] 10:12:36.284303 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25473] 10:12:36.284333 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25495] 10:12:36.284365 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.284395 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25495] 10:12:36.284418 <... mmap resumed> ) = 0x7efcd42a8000
[pid 25473] 10:12:36.284435 sendto(16, "U&\1\0\0\1\0\0\0\0\0\0\5aspmx\1l\6google\3com\0\0\1\0\1", 36, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25495] 10:12:36.284499 read(7,  <unfinished ...>
[pid 25473] 10:12:36.284615 <... sendto resumed> ) = 36
[pid 25495] 10:12:36.284644 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:36.284670 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25495] 10:12:36.284701 close(7)    = 0
[pid 25495] 10:12:36.284736 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.284782 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25495] 10:12:36.284842 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25495] 10:12:36.284912 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790}, 8) = 0
[pid 25495] 10:12:36.284967 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7efcd4292a90) = 25501
[pid 25495] 10:12:36.285747 wait4(25501,  <unfinished ...>
[pid 25492] 10:12:36.286374 read(13,  <unfinished ...>
[pid 25491] 10:12:36.286404 brk(0x172a000 <unfinished ...>
[pid 25492] 10:12:36.286446 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25492] 10:12:36.286888 brk(0x251d000 <unfinished ...>
[pid 25491] 10:12:36.286939 <... brk resumed> ) = 0x172a000
[pid 25492] 10:12:36.287280 <... brk resumed> ) = 0x251d000
[pid 25491] 10:12:36.287311 read(11, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25491] 10:12:36.288243 read(11,  <unfinished ...>
[pid 25492] 10:12:36.288382 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25492] 10:12:36.289160 read(13,  <unfinished ...>
[pid 25493] 10:12:36.289582 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25493] 10:12:36.289724 brk(0x127e000 <unfinished ...>
[pid 25491] 10:12:36.289766 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25473] 10:12:36.289795 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25473] 10:12:36.289818 recvfrom(16, "U&\201\200\0\1\0\1\0\0\0\0\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\v\0\4@\351\240\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 52
[pid 25473] 10:12:36.289865 close(16)   = 0
[pid 25473] 10:12:36.289944 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25473] 10:12:36.289987 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25473] 10:12:36.290028 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.290068 sendto(16, "m\v\1\0\0\1\0\0\0\0\0\0\4alt2\5aspmx\1l\6google\3com\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0) = 41
[pid 25473] 10:12:36.290133 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25491] 10:12:36.290407 brk(0x174b000 <unfinished ...>
[pid 25493] 10:12:36.290458 <... brk resumed> ) = 0x127e000
[pid 25493] 10:12:36.291335 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25492] 10:12:36.291383 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25491] 10:12:36.291493 <... brk resumed> ) = 0x174b000
[pid 25491] 10:12:36.292114 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.292384 brk(0x253e000) = 0x253e000
[pid 25492] 10:12:36.292998 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25491] 10:12:36.293049 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293074 stat("/usr/local/cpanel/strict.pm", 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293119 stat("/etc/exim/perl/strict.pmc", 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293163 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293183 stat("/etc/exim/perl/strict.pm", 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293222 stat("/usr/local/cpanel/Errno.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293264 stat("/usr/local/cpanel/strict.pmc", 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293309 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.293339 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25493] 10:12:36.293375 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293401 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293430 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.293468 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25493] 10:12:36.293509 <... stat resumed> 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293598 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.293646 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293669 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293689 stat("/usr/local/cpanel/Errno.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293728 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293774 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293822 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293865 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.293908 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.293951 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.293982 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25493] 10:12:36.294015 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.294042 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.294062 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.294105 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.294149 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.294180 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25493] 10:12:36.294214 <... stat resumed> 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.294238 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.294258 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.294316 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25493] 10:12:36.294374 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.294406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25493] 10:12:36.294454 <... open resumed> ) = 9
[pid 25491] 10:12:36.294494 <... open resumed> ) = 12
[pid 25493] 10:12:36.294609 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.294651 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc86152800) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25493] 10:12:36.294690 <... ioctl resumed> , 0x7ffc36478010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.294712 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25493] 10:12:36.294740 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.294766 <... lseek resumed> ) = 0
[pid 25493] 10:12:36.294786 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.294828 read(12,  <unfinished ...>
[pid 25493] 10:12:36.294887 read(9,  <unfinished ...>
[pid 25491] 10:12:36.294917 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25491] 10:12:36.295130 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25493] 10:12:36.295170 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25493] 10:12:36.295367 brk(0x129f000 <unfinished ...>
[pid 25492] 10:12:36.295408 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295436 stat("/usr/local/cpanel/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295490 stat("/etc/exim/perl/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295597 stat("/etc/exim/perl/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295646 stat("/usr/local/cpanel/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295686 stat("/usr/local/cpanel/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295728 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295771 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295815 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295857 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295899 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295941 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.295985 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.296026 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.296082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25492] 10:12:36.296128 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc8d3414c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.296173 lseek(14, 0, SEEK_CUR) = 0
[pid 25492] 10:12:36.296231 read(14,  <unfinished ...>
[pid 25493] 10:12:36.296263 <... brk resumed> ) = 0x129f000
[pid 25491] 10:12:36.296599 <... lseek resumed> ) = 878
[pid 25492] 10:12:36.296632 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25491] 10:12:36.296661 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.296883 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.296915 <... lseek resumed> ) = 878
[pid 25491] 10:12:36.296937 close(12)   = 0
[pid 25491] 10:12:36.297198 read(11,  <unfinished ...>
[pid 25492] 10:12:36.297235 <... lseek resumed> ) = 878
[pid 25492] 10:12:36.297256 lseek(14, 0, SEEK_CUR) = 878
[pid 25492] 10:12:36.297291 close(14)   = 0
[pid 25491] 10:12:36.297589 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25493] 10:12:36.297811 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.298313 brk(0x176c000 <unfinished ...>
[pid 25492] 10:12:36.298353 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25493] 10:12:36.298585 <... lseek resumed> ) = 4868
[pid 25493] 10:12:36.298616 lseek(9, 0, SEEK_CUR) = 4868
[pid 25493] 10:12:36.298653 close(9)    = 0
[pid 25493] 10:12:36.298706 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298754 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298799 stat("/etc/exim/perl/Exporter.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298840 stat("/etc/exim/perl/Exporter.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298881 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298921 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.298964 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.299010 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffc36478220) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.299056 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffc364782c0) = -1 ENOENT (No such file or directory)
[pid 25493] 10:12:36.299100 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25493] 10:12:36.299159 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25493] 10:12:36.299513 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc36478010) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25493] 10:12:36.299641 lseek(9, 0, SEEK_CUR) = 0
[pid 25493] 10:12:36.299696 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25493] 10:12:36.300153 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.300197 <... brk resumed> ) = 0x176c000
[pid 25491] 10:12:36.300329 read(11, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25492] 10:12:36.300661 brk(0x255f000) = 0x255f000
[pid 25492] 10:12:36.300799 read(13,  <unfinished ...>
[pid 25493] 10:12:36.301457 <... lseek resumed> ) = 2366
[pid 25493] 10:12:36.301492 lseek(9, 0, SEEK_CUR) = 2366
[pid 25493] 10:12:36.301590 close(9)    = 0
[pid 25492] 10:12:36.301633 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25493] 10:12:36.301955 read(8, "", 8192) = 0
[pid 25493] 10:12:36.302480 close(8)    = 0
[pid 25493] 10:12:36.302796 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25492] 10:12:36.303452 brk(0x2580000Process 25501 attached
 <unfinished ...>
[pid 25501] 10:12:36.303577 set_robust_list(0x7efcd4292aa0, 24) = 0
[pid 25501] 10:12:36.303646 geteuid()   = 0
[pid 25493] 10:12:36.303690 <... open resumed> ) = 8
[pid 25501] 10:12:36.303716 geteuid( <unfinished ...>
[pid 25493] 10:12:36.303746 fstat(8,  <unfinished ...>
[pid 25501] 10:12:36.303773 <... geteuid resumed> ) = 0
[pid 25501] 10:12:36.303793 getegid( <unfinished ...>
[pid 25493] 10:12:36.303819 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25501] 10:12:36.303854 <... getegid resumed> ) = 12
[pid 25493] 10:12:36.303874 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25501] 10:12:36.303908 setgid(12 <unfinished ...>
[pid 25493] 10:12:36.303936 <... mmap resumed> ) = 0x7f6578ae6000
[pid 25493] 10:12:36.303956 read(8,  <unfinished ...>
[pid 25501] 10:12:36.303983 <... setgid resumed> ) = 0
[pid 25493] 10:12:36.304007 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25501] 10:12:36.304032 setuid(47)  = 0
[pid 25493] 10:12:36.304075 close(8)    = 0
[pid 25493] 10:12:36.304625 munmap(0x7f6578ae6000, 4096) = 0
[pid 25493] 10:12:36.304718 lseek(6, 19, SEEK_SET) = 19
[pid 25493] 10:12:36.304774 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.304818 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.304856 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.304893 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.304930 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.304969 alarm(300)  = 0
[pid 25493] 10:12:36.305006 alarm(0)    = 300
[pid 25493] 10:12:36.305040 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.305077 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.305114 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25491] 10:12:36.305406 brk(0x178d000 <unfinished ...>
[pid 25493] 10:12:36.305444 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.305487 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f657799e790}, NULL, 8) = 0
[pid 25493] 10:12:36.305584 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, 8) = 0
[pid 25493] 10:12:36.305633 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, 8) = 0
[pid 25493] 10:12:36.305680 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.305746 open("/var/spool/exim/input/a/hdr.25493", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25493] 10:12:36.305837 fchown(8, 47, 12) = 0
[pid 25493] 10:12:36.305878 fchmod(8, 0640) = 0
[pid 25493] 10:12:36.305915 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25493] 10:12:36.305956 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064884, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.306005 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae6000
[pid 25493] 10:12:36.306045 lseek(8, 0, SEEK_CUR) = 0
[pid 25493] 10:12:36.306095 write(8, "1aEJMa-0006dB-67-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 428) = 428
[pid 25493] 10:12:36.306145 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064884, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=428, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.306198 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dB-67; Wed, 30 Dec 2015 10:12:36 -0600\n070T To:  ljacques@westernskiesgolf.com, westernsky@finestwedding"..., 553) = 553
[pid 25493] 10:12:36.306409 fsync(8 <unfinished ...>
[pid 25491] 10:12:36.306490 <... brk resumed> ) = 0x178d000
[pid 25491] 10:12:36.306712 read(11,  <unfinished ...>
[pid 25492] 10:12:36.306828 <... brk resumed> ) = 0x2580000
[pid 25491] 10:12:36.306853 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25493] 10:12:36.306880 <... fsync resumed> ) = 0
[pid 25493] 10:12:36.306900 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064884, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=981, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.306950 close(8)    = 0
[pid 25493] 10:12:36.306987 munmap(0x7f6578ae6000, 4096) = 0
[pid 25493] 10:12:36.307032 rename("/var/spool/exim/input/a/hdr.25493", "/var/spool/exim/input/a/1aEJMa-0006dB-67-H") = 0
[pid 25493] 10:12:36.307100 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25493] 10:12:36.307144 fsync(8)    = 0
[pid 25493] 10:12:36.307180 close(8)    = 0
[pid 25493] 10:12:36.307217 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064882, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.307283 open("/var/spool/exim/msglog/a/1aEJMa-0006dB-67", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25493] 10:12:36.307358 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25493] 10:12:36.307396 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080150, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.307444 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6578ae6000
[pid 25491] 10:12:36.308636 brk(0x17ae000 <unfinished ...>
[pid 25493] 10:12:36.308681 lseek(8, 0, SEEK_CUR) = 0
[pid 25493] 10:12:36.308722 stat("/etc/localtime",  <unfinished ...>
[pid 25482] 10:12:36.308757 <... select resumed> ) = 1 (in [11], left {299, 925363})
[pid 25482] 10:12:36.308787 read(11, "\27\3\3\0`", 5) = 5
[pid 25482] 10:12:36.308825 read(11, "P+\265s\240)\344\201q\201R\276\230n~\255\202@\206`\35nz\365\317\372\17\v\325\247\245V\235\2315\370 O|\310\300o?@\202\264\330k\37\250\235\226j\\'\23Blo\212\266M@'\3729*\300\2$\337\355p\311W\326\235\330\215Z<\377\231.L&\270\3\216\334\220JdV\307\t", 96) = 96
[pid 25482] 10:12:36.308893 select(12, [11], NULL, NULL, {300, 0}) = 1 (in [11], left {299, 999998})
[pid 25482] 10:12:36.308939 read(11, "\27\3\3\0p", 5) = 5
[pid 25482] 10:12:36.308976 read(11, "\307i\35\273\235\365\322\242\216\7\324\17\225\227\265\213\23O\220u\242`\237\206\334'>\255\31\24\350_`\3078q)\35S\273\r\2\\\232i\1\240\7\227\310}\212\354\17u\360\36,`\350s\r\304\320\364\256\260\"\230\204\3721\20\306u\324s\334\374\210\352PDo\271f[\36L\332N\375l!\6fm\266\250\264\264\340#\276\372\24Y\356\323k\370\1", 112) = 112
[pid 25482] 10:12:36.309050 lseek(6, 19, SEEK_SET) = 19
[pid 25482] 10:12:36.309089 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25482] 10:12:36.309142 read(6, "", 8192) = 0
[pid 25482] 10:12:36.309176 alarm(300)  = 0
[pid 25482] 10:12:36.309248 write(11, "\27\3\3\fp\26\30z\336\364\262\237\201\337Bk\210\6Y6,u\331\0012i9I\f-k\34\241\230\237d;\237\321\2121\t\264T\220\370\273?q*+\254!\354\236\201\321\236J\5\300\225!\266!G\344$\257\250e\32\317;X'\2<\25\332\214\32\263\223\377\340\234Kc\355\346O\302\261\253\n\377G\260\251\235\236\320\265\320L\375y\231\233Kw\352\344\211\202^\2316e\36\277\21u}z\34\34\326\10\260\277\341\4\224gN\207\33]\33\315W\313\372\342\272\340\366\306\303\261%4\310[hL^\343>\316-\237\366O\311P\n\23\221<\213gY\0\234\346m\33C\366\335\257\355\\\356\272&iJ\322BV,\t\255\356\227\323\341\227m\362\16_\230\304f,d\252W\342$\346\27\220\271hJ;.b\36\4\277\354\301\20\255=\222a\326\343\26\354^\303BF\217\276\210\303\330-\213\302 \27\230\1'Q"..., 3189) = 3189
[pid 25482] 10:12:36.309336 alarm(0)    = 300
[pid 25482] 10:12:36.309375 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25493] 10:12:36.309413 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.309457 write(8, "2015-12-30 10:12:36 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2372 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25493] 10:12:36.309606 close(8)    = 0
[pid 25492] 10:12:36.310667 read(13,  <unfinished ...>
[pid 25493] 10:12:36.310704 munmap(0x7f6578ae6000, 4096) = 0
[pid 25493] 10:12:36.310750 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.310815 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25493] 10:12:36.310877 close(7)    = 0
[pid 25493] 10:12:36.310918 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25493] 10:12:36.310965 fcntl(7, F_GETFD) = 0
[pid 25493] 10:12:36.311000 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25492] 10:12:36.311037 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25493] 10:12:36.311062 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376579, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25493] 10:12:36.311411 write(7, "2015-12-30 10:12:36 [25493] 1aEJMa-0006dB-67 <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2372 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for ljacques@westernskiesgolf.com westernsky@finest"..., 307) = 307
[pid 25493] 10:12:36.311468 close(6)    = 0
[pid 25493] 10:12:36.311510 munmap(0x7f6578ae7000, 4096) = 0
[pid 25493] 10:12:36.311624 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, 8) = 0
[pid 25493] 10:12:36.311672 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f65766e76a0}, 8) = 0
[pid 25493] 10:12:36.311713 open("/proc/loadavg", O_RDONLY) = 6
[pid 25493] 10:12:36.311767 read(6, "0.18 0.08 0.01 4/251 25501\n", 40) = 27
[pid 25493] 10:12:36.311811 close(6)    = 0
[pid 25493] 10:12:36.311864 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f6578ad1a90) = 25502
[pid 25493] 10:12:36.312820 exit_group(0) = ?
[pid 25493] 10:12:36.313132 +++ exited with 0 +++
[pid 25389] 10:12:36.313151 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25493
[pid 25389] 10:12:36.313177 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:36.313379 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:36.313439 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25503
[pid 25389] 10:12:36.313959 close(5)    = 0
[pid 25389] 10:12:36.313997 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:36.314033 fstat(6, {st_dev=makedev(0, 8), st_ino=2130168205, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25389] 10:12:36.314082 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:36.314129 write(6, "To:  ltoms@rmrcc.com, redmountainranch@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"text/c"..., 2083) = 2083
[pid 25389] 10:12:36.314172 close(6)    = 0
[pid 25389] 10:12:36.314206 wait4(25503,  <unfinished ...>
[pid 25501] 10:12:36.314765 brk(0xbbd000 <unfinished ...>
[pid 25491] 10:12:36.314802 <... brk resumed> ) = 0x17ae000
[pid 25491] 10:12:36.315060 read(11,  <unfinished ...>
[pid 25492] 10:12:36.315365 brk(0x25a1000 <unfinished ...>
[pid 25501] 10:12:36.315400 <... brk resumed> ) = 0xbbd000
[pid 25501] 10:12:36.315843 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25491] 10:12:36.315889 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25492] 10:12:36.316591 <... brk resumed> ) = 0x25a1000
[pid 25492] 10:12:36.316826 read(13,  <unfinished ...>
[pid 25501] 10:12:36.316878 <... open resumed> ) = 7
[pid 25501] 10:12:36.316907 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25501] 10:12:36.316965 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25501] 10:12:36.317011 read(7,  <unfinished ...>
[pid 25492] 10:12:36.317040 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25501] 10:12:36.317598 <... read resumed> "5\v\267\223/P\201\240\"\230\v\10\240\240$\346\vR\362\266\310u\357\3\362\37F!\3557b*y\220\220[Kl|\202\350\6+\370!=q\220", 48) = 48
[pid 25501] 10:12:36.317638 close(7)    = 0
[pid 25501] 10:12:36.317694 getuid()    = 47
[pid 25501] 10:12:36.317871 exit_group(0) = ?
[pid 25501] 10:12:36.318119 +++ exited with 0 +++
[pid 25495] 10:12:36.318137 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25501
[pid 25495] 10:12:36.318162 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, 8) = 0
[pid 25495] 10:12:36.318229 getcwd("/var/spool/exim", 16380) = 16
[pid 25495] 10:12:36.318305 open("/etc/localtime", O_RDONLY) = 7
[pid 25495] 10:12:36.318367 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.318418 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.318462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.318501 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25495] 10:12:36.318629 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25495] 10:12:36.318667 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25495] 10:12:36.318724 close(7)    = 0
[pid 25495] 10:12:36.318768 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.318832 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25495] 10:12:36.318882 fcntl(7, F_GETFD) = 0
[pid 25495] 10:12:36.318916 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25495] 10:12:36.318949 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376886, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.318996 write(7, "2015-12-30 10:12:36 [25495] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMY-0006c6-AN\n", 108) = 108
[pid 25495] 10:12:36.319038 chdir("/var/spool/exim") = 0
[pid 25495] 10:12:36.319079 geteuid()   = 0
[pid 25495] 10:12:36.319113 getegid()   = 12
[pid 25495] 10:12:36.319156 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.319199 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25495] 10:12:36.319247 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.319284 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25495] 10:12:36.319333 close(8)    = 0
[pid 25495] 10:12:36.319368 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.319408 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25495] 10:12:36.319456 read(8, "65536\n", 31) = 6
[pid 25495] 10:12:36.319492 close(8)    = 0
[pid 25495] 10:12:36.319615 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.319666 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25495] 10:12:36.319713 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.319750 lseek(8, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.319786 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25495] 10:12:36.319839 read(8, "", 4096) = 0
[pid 25495] 10:12:36.319876 close(8)    = 0
[pid 25495] 10:12:36.319911 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.319950 setgroups(1, [12]) = 0
[pid 25495] 10:12:36.319988 setgid(12)  = 0
[pid 25495] 10:12:36.320022 setuid(47)  = 0
[pid 25495] 10:12:36.320084 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25495] 10:12:36.320169 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25495] 10:12:36.320252 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25495] 10:12:36.320347 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25495] 10:12:36.320432 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25495] 10:12:36.320598 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25495] 10:12:36.320723 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25495] 10:12:36.320797 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.320843 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25495] 10:12:36.320890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.320927 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25495] 10:12:36.320974 close(8)    = 0
[pid 25495] 10:12:36.321015 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.321116 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25495] 10:12:36.321213 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25495] 10:12:36.321334 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25495] 10:12:36.321459 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25495] 10:12:36.321670 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25495] 10:12:36.321738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.321784 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25495] 10:12:36.321841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.321881 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25495] 10:12:36.321934 close(8)    = 0
[pid 25495] 10:12:36.321972 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.322022 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.322066 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25495] 10:12:36.322115 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.322153 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25495] 10:12:36.322211 close(8)    = 0
[pid 25495] 10:12:36.322249 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.322310 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25495] 10:12:36.322355 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25495] 10:12:36.322405 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.322443 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25495] 10:12:36.322492 close(8)    = 0
[pid 25495] 10:12:36.322604 munmap(0x7efcd42a8000, 4096) = 0
[pid 25495] 10:12:36.322719 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25495] 10:12:36.322859 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25495] 10:12:36.322964 read(6, "", 4096) = 0
[pid 25495] 10:12:36.323006 read(6, "", 4096) = 0
[pid 25495] 10:12:36.323045 close(6)    = 0
[pid 25495] 10:12:36.323082 munmap(0x7efcd42a9000, 4096) = 0
[pid 25495] 10:12:36.323126 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25495] 10:12:36.323170 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25495] 10:12:36.323220 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a9000
[pid 25495] 10:12:36.323259 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25495] 10:12:36.323314 close(6)    = 0
[pid 25495] 10:12:36.323362 munmap(0x7efcd42a9000, 4096) = 0
[pid 25495] 10:12:36.323413 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.323478 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7efcd315f790}, NULL, 8) = 0
[pid 25495] 10:12:36.323603 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25495] 10:12:36.323653 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25495] 10:12:36.323698 fstat(0, {st_dev=makedev(0, 8), st_ino=2130168038, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.323752 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a9000
[pid 25495] 10:12:36.323803 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3555
[pid 25495] 10:12:36.323894 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.323974 open("/var/spool/exim/input/a/1aEJMa-0006dD-AR-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25495] 10:12:36.324066 fchown(6, 47, 12) = 0
[pid 25495] 10:12:36.324110 fchmod(6, 0640) = 0
[pid 25495] 10:12:36.324151 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25495] 10:12:36.324189 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080152, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.324237 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efcd42a8000
[pid 25495] 10:12:36.324276 lseek(6, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.324312 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25495] 10:12:36.324434 read(0, "", 4096) = 0
[pid 25495] 10:12:36.324475 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7efcd315f790}, NULL, 8) = 0
[pid 25495] 10:12:36.324516 write(6, "1aEJMa-0006dD-AR-D\n--1451491956-eximdsn-1284536747\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3200) = 3200
[pid 25495] 10:12:36.324656 fsync(6 <unfinished ...>
[pid 25491] 10:12:36.325005 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25495] 10:12:36.325364 <... fsync resumed> ) = 0
[pid 25495] 10:12:36.325418 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25495] 10:12:36.325574 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080152, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3200, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25495] 10:12:36.325725 brk(0xbbd000) = 0xbbd000
[pid 25495] 10:12:36.325794 getuid()    = 47
[pid 25495] 10:12:36.325833 geteuid()   = 47
[pid 25495] 10:12:36.325876 getgid()    = 12
[pid 25495] 10:12:36.325913 getegid()   = 12
[pid 25495] 10:12:36.326016 open("/dev/urandom", O_RDONLY) = 8
[pid 25495] 10:12:36.326068 read(8, ")\331=\257", 4) = 4
[pid 25495] 10:12:36.326110 close(8)    = 0
[pid 25495] 10:12:36.326225 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25495] 10:12:36.326335 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd50fbf730) = -1 EINVAL (Invalid argument)
[pid 25495] 10:12:36.326384 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25495] 10:12:36.326426 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd50fbf730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.326474 lseek(1, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.326520 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd50fbf740) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.326622 lseek(2, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.326662 open("/dev/null", O_RDONLY) = 8
[pid 25495] 10:12:36.326709 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd50fbf810) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.326748 lseek(8, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.326785 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25495] 10:12:36.326823 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7efcd315f790}, 8) = 0
[pid 25495] 10:12:36.326867 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7efcd315f790}, 8) = 0
[pid 25495] 10:12:36.327144 read(8, "", 8192) = 0
[pid 25495] 10:12:36.327193 close(8)    = 0
[pid 25495] 10:12:36.327410 brk(0xbde000) = 0xbde000
[pid 25495] 10:12:36.327626 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25495] 10:12:36.327693 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25495] 10:12:36.327738 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd50fbf640) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25495] 10:12:36.327779 lseek(8, 0, SEEK_CUR) = 0
[pid 25495] 10:12:36.327838 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25495] 10:12:36.328889 brk(0xbff000) = 0xbff000
[pid 25495] 10:12:36.329129 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25495] 10:12:36.330123 brk(0xc20000 <unfinished ...>
[pid 25458] 10:12:36.330163 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25458] 10:12:36.330191 recvfrom(16, "\352\332\201\200\0\1\0\1\0\0\0\0\26theviewsatsuperstition\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\4\257\0\4\242\325\373\252", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 60
[pid 25458] 10:12:36.330246 close(16)   = 0
[pid 25458] 10:12:36.330363 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25458] 10:12:36.330452 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.330492 <... brk resumed> ) = 0xc20000
[pid 25458] 10:12:36.330516 <... open resumed> ) = 16
[pid 25458] 10:12:36.330598 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc7ad951c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.330647 lseek(16, 0, SEEK_CUR) = 0
[pid 25458] 10:12:36.330683 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.330731 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25458] 10:12:36.330774 read(16, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25458] 10:12:36.330978 close(16)   = 0
[pid 25458] 10:12:36.331036 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 16
[pid 25458] 10:12:36.331089 alarm(60)   = 0
[pid 25458] 10:12:36.331124 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25458] 10:12:36.331162 alarm(0)    = 60
[pid 25458] 10:12:36.331207 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.331255 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 17
[pid 25458] 10:12:36.331301 read(17, "cpu  123071 1342433 395189 67343097 2509 0 0 0\ncpu0 123071 1342433 395189 67343097 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58440142\nbtime 1450798266\nprocesses 892981\nprocs_running 7\nprocs_blocked 0\n", 8192) = 191
[pid 25458] 10:12:36.331363 close(17)   = 0
[pid 25458] 10:12:36.331417 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.331476 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25495] 10:12:36.332090 read(8,  <unfinished ...>
[pid 25492] 10:12:36.332127 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.332153 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.332170 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25458] 10:12:36.332192 fcntl(17, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.332220 recvfrom(16,  <unfinished ...>
[pid 25458] 10:12:36.332247 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.332267 <... recvfrom resumed> "m\v\201\200\0\1\0\1\0\0\0\0\4alt2\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\213\0\4\255\302\314\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 57
[pid 25458] 10:12:36.332296 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.332329 close(16 <unfinished ...>
[pid 25458] 10:12:36.332358 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.332378 <... close resumed> ) = 0
[pid 25458] 10:12:36.332434 read(17,  <unfinished ...>
[pid 25473] 10:12:36.332475 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25458] 10:12:36.332511 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25473] 10:12:36.332614 <... socket resumed> ) = 16
[pid 25458] 10:12:36.332637 close(17 <unfinished ...>
[pid 25473] 10:12:36.332666 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25458] 10:12:36.332700 <... close resumed> ) = 0
[pid 25473] 10:12:36.332726 <... connect resumed> ) = 0
[pid 25458] 10:12:36.332744 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.332776 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25458] 10:12:36.332810 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.332834 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25458] 10:12:36.332853 stat("/var/tmp",  <unfinished ...>
[pid 25473] 10:12:36.332887 sendto(16, "-\1\1\0\0\1\0\0\0\0\0\0\4alt1\5aspmx\1l\6google\3com\0\0\1\0\1", 41, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25458] 10:12:36.332945 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25473] 10:12:36.332998 <... sendto resumed> ) = 41
[pid 25458] 10:12:36.333018 brk(0x1694000 <unfinished ...>
[pid 25473] 10:12:36.333047 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25458] 10:12:36.333075 <... brk resumed> ) = 0x1694000
[pid 25458] 10:12:36.333202 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25458] 10:12:36.333248 fcntl(17, F_GETFD) = 0
[pid 25458] 10:12:36.333281 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25458] 10:12:36.333314 fstat(17, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.333373 pread(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25458] 10:12:36.333438 pread(17, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25458] 10:12:36.333499 pread(17, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25495] 10:12:36.333668 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25492] 10:12:36.333693 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.333709 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25458] 10:12:36.333732 close(17)   = 0
[pid 25458] 10:12:36.333783 close(16)   = 0
[pid 25458] 10:12:36.333834 lseek(13, 0, SEEK_SET) = 0
[pid 25458] 10:12:36.333870 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25458] 10:12:36.333928 stat("/jail_owner", 0x7ffc7ad93ba0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.333975 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.334040 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck", 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.334088 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.334143 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck", 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.334186 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.334250 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.334364 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.334436 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.334498 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25495] 10:12:36.335494 brk(0xc41000 <unfinished ...>
[pid 25492] 10:12:36.335526 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.335552 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.335571 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 16
[pid 25458] 10:12:36.335615 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.335667 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.335714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be1000
[pid 25458] 10:12:36.335753 lseek(16, 0, SEEK_SET) = 0
[pid 25458] 10:12:36.335788 read(16, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25458] 10:12:36.335878 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4116, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.335956 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY) = 17
[pid 25458] 10:12:36.336005 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc7ad90b40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.336045 lseek(17, 0, SEEK_CUR) = 0
[pid 25458] 10:12:36.336080 fstat(17, {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4116, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.336127 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25458] 10:12:36.336167 read(17, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4116
[pid 25458] 10:12:36.336900 read(17, "", 8192) = 0
[pid 25458] 10:12:36.336955 close(17)   = 0
[pid 25458] 10:12:36.337013 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.337086 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.337150 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.337224 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25458] 10:12:36.337271 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.337317 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be0000
[pid 25458] 10:12:36.337359 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:36.337414 close(17)   = 0
[pid 25458] 10:12:36.337450 munmap(0x7f03f4be0000, 4096 <unfinished ...>
[pid 25495] 10:12:36.337518 <... brk resumed> ) = 0xc41000
[pid 25492] 10:12:36.337609 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.337627 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25458] 10:12:36.337651 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.337683 open("/etc/group", O_RDONLY|O_CLOEXEC) = 17
[pid 25458] 10:12:36.337727 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.337773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be0000
[pid 25458] 10:12:36.337818 read(17, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.337871 close(17)   = 0
[pid 25458] 10:12:36.337906 munmap(0x7f03f4be0000, 4096) = 0
[pid 25458] 10:12:36.337952 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.338004 pipe([17, 18]) = 0
[pid 25458] 10:12:36.338043 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25458] 10:12:36.338087 close(15)   = 0
[pid 25458] 10:12:36.338122 munmap(0x7f03f4be2000, 4096) = 0
[pid 25458] 10:12:36.338160 close(14)   = 0
[pid 25458] 10:12:36.338194 munmap(0x7f03f4be3000, 4096) = 0
[pid 25458] 10:12:36.338230 close(9)    = 0
[pid 25458] 10:12:36.338264 munmap(0x7f03f4be8000, 4096) = 0
[pid 25458] 10:12:36.338300 close(13)   = 0
[pid 25458] 10:12:36.338334 munmap(0x7f03f4be4000, 4096) = 0
[pid 25458] 10:12:36.338370 close(12)   = 0
[pid 25458] 10:12:36.338404 munmap(0x7f03f4be5000, 4096) = 0
[pid 25458] 10:12:36.338438 close(16)   = 0
[pid 25458] 10:12:36.338474 munmap(0x7f03f4be1000, 4096) = 0
[pid 25458] 10:12:36.338510 close(11 <unfinished ...>
[pid 25495] 10:12:36.338889 read(8,  <unfinished ...>
[pid 25492] 10:12:36.338913 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.338937 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.338955 <... close resumed> ) = 0
[pid 25458] 10:12:36.338975 munmap(0x7f03f4be6000, 4096) = 0
[pid 25458] 10:12:36.339015 close(10)   = 0
[pid 25458] 10:12:36.339050 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25473] 10:12:36.339089 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25458] 10:12:36.339110 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.339133 recvfrom(16,  <unfinished ...>
[pid 25458] 10:12:36.339159 clone( <unfinished ...>
[pid 25473] 10:12:36.339451 <... recvfrom resumed> "-\1\201\200\0\1\0\1\0\0\0\0\4alt1\5aspmx\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\335\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 57
[pid 25473] 10:12:36.339497 close(16 <unfinished ...>
[pid 25458] 10:12:36.339597 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25504
[pid 25495] 10:12:36.339645 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25492] 10:12:36.339667 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.339683 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25473] 10:12:36.339705 <... close resumed> ) = 0
[pid 25458] 10:12:36.339759 close(18 <unfinished ...>
[pid 25473] 10:12:36.339791 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25458] 10:12:36.339820 <... close resumed> ) = 0
[pid 25473] 10:12:36.339841 <... socket resumed> ) = 16
[pid 25458] 10:12:36.339857 read(17,  <unfinished ...>
[pid 25473] 10:12:36.339882 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25473] 10:12:36.339925 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.339964 sendto(16, "\tC\1\0\0\1\0\0\0\0\0\0\6aspmx2\ngooglemail\3com\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0) = 39
[pid 25473] 10:12:36.340040 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25495] 10:12:36.340366 read(8,  <unfinished ...>
[pid 25492] 10:12:36.340391 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.340415 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.340450 <... read resumed> "", 8192) = 0
[pid 25492] 10:12:36.340468 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.340484 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25495] 10:12:36.340598 close(8 <unfinished ...>
[pid 25492] 10:12:36.340626 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.340648 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.340682 <... close resumed> ) = 0
[pid 25492] 10:12:36.340697 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.340712 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25495] 10:12:36.340770 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25492] 10:12:36.340793 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.340814 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.340850 <... stat resumed> 0x7efcd2946880) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.340866 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.340881 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25495] 10:12:36.340934 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25492] 10:12:36.340956 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.340978 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.341011 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.341039 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.341054 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25495] 10:12:36.341096 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25492] 10:12:36.341117 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.341139 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.341173 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25492] 10:12:36.341200 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.341215 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25495] 10:12:36.341258 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.341281 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.341302 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
Process 25502 attached
[pid 25495] 10:12:36.341360 <... open resumed> ) = 8
[pid 25492] 10:12:36.341375 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.341389 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25502] 10:12:36.341448 set_robust_list(0x7f6578ad1aa0, 24 <unfinished ...>
[pid 25495] 10:12:36.341470 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.341499 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.341610 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.341637 <... set_robust_list resumed> ) = 0
[pid 25495] 10:12:36.341651 <... ioctl resumed> , 0x7ffd50fbf640) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.341666 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.341725 close(0 <unfinished ...>
[pid 25495] 10:12:36.341749 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.341770 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:36.341792 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25502] 10:12:36.341845 <... close resumed> ) = 0
[pid 25495] 10:12:36.341859 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.341872 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.341887 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.341938 close(1 <unfinished ...>
[pid 25495] 10:12:36.341963 read(8,  <unfinished ...>
[pid 25492] 10:12:36.341983 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:36.342005 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25502] 10:12:36.342054 <... close resumed> ) = 0
[pid 25495] 10:12:36.342068 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25492] 10:12:36.342086 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.342113 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
Process 25503 attached
[pid 25502] 10:12:36.342669 close(2 <unfinished ...>
[pid 25495] 10:12:36.342718 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.342746 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.342779 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.342817 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25502] 10:12:36.342840 <... close resumed> ) = 0
[pid 25495] 10:12:36.342854 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.342930 <... open resumed> ) = 14
[pid 25503] 10:12:36.342954 <... set_robust_list resumed> ) = 0
[pid 25502] 10:12:36.342973 setsid( <unfinished ...>
[pid 25495] 10:12:36.343018 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.343044 <... open resumed> ) = 12
[pid 25503] 10:12:36.343064 close(6 <unfinished ...>
[pid 25502] 10:12:36.343092 <... setsid resumed> ) = 25502
[pid 25495] 10:12:36.343106 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.343127 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25503] 10:12:36.343164 <... close resumed> ) = 0
[pid 25502] 10:12:36.343177 fstat(0,  <unfinished ...>
[pid 25495] 10:12:36.343201 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.343235 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25503] 10:12:36.343264 dup2(5, 0 <unfinished ...>
[pid 25502] 10:12:36.343287 <... fstat resumed> 0x7ffc3647cb40) = -1 EBADF (Bad file descriptor)
[pid 25495] 10:12:36.343303 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.343322 <... ioctl resumed> , 0x7ffc8d3414c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.343347 <... dup2 resumed> ) = 0
[pid 25502] 10:12:36.343363 open("/dev/null", O_RDWR <unfinished ...>
[pid 25495] 10:12:36.343400 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.343427 <... ioctl resumed> , 0x7ffc86152800) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.343448 close(5 <unfinished ...>
[pid 25502] 10:12:36.343473 <... open resumed> ) = 0
[pid 25495] 10:12:36.343486 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.343504 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.343630 <... close resumed> ) = 0
[pid 25502] 10:12:36.343646 fstat(1,  <unfinished ...>
[pid 25495] 10:12:36.343679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.343711 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.343725 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.343789 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25502] 10:12:36.344438 <... fstat resumed> 0x7ffc3647cb40) = -1 EBADF (Bad file descriptor)
[pid 25495] 10:12:36.344465 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.344491 read(14,  <unfinished ...>
[pid 25502] 10:12:36.344539 dup2(0, 1 <unfinished ...>
[pid 25495] 10:12:36.344563 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.344593 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.344613 <... execve resumed> ) = 0
[pid 25502] 10:12:36.344660 <... dup2 resumed> ) = 1
[pid 25495] 10:12:36.344677 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.344699 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25491] 10:12:36.344721 read(12,  <unfinished ...>
[pid 25502] 10:12:36.344870 fstat(2,  <unfinished ...>
[pid 25495] 10:12:36.344894 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.344917 brk(0x25c2000 <unfinished ...>
[pid 25491] 10:12:36.344938 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25502] 10:12:36.345070 <... fstat resumed> 0x7ffc3647cb40) = -1 EBADF (Bad file descriptor)
[pid 25495] 10:12:36.345093 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.345108 <... brk resumed> ) = 0x25c2000
[pid 25491] 10:12:36.345122 brk(0x17cf000 <unfinished ...>
[pid 25502] 10:12:36.345774 dup2(0, 2 <unfinished ...>
[pid 25495] 10:12:36.345812 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.345845 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.345869 <... brk resumed> ) = 0x17cf000
[pid 25503] 10:12:36.345892 brk(0 <unfinished ...>
[pid 25502] 10:12:36.346419 <... dup2 resumed> ) = 2
[pid 25495] 10:12:36.346439 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.346459 <... lseek resumed> ) = 4868
[pid 25473] 10:12:36.346479 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25503] 10:12:36.346514 <... brk resumed> ) = 0xe94000
[pid 25502] 10:12:36.346584 geteuid( <unfinished ...>
[pid 25495] 10:12:36.346633 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.346665 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.346688 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.346711 recvfrom(16,  <unfinished ...>
[pid 25503] 10:12:36.346746 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.346773 <... geteuid resumed> ) = 47
[pid 25495] 10:12:36.346788 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.346814 <... lseek resumed> ) = 4868
[pid 25491] 10:12:36.346832 <... lseek resumed> ) = 4868
[pid 25473] 10:12:36.346848 <... recvfrom resumed> "\tC\201\200\0\1\0\1\0\0\0\0\6aspmx2\ngooglemail\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\264\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 55
[pid 25503] 10:12:36.346888 <... mmap resumed> ) = 0x7fbb7f4c9000
[pid 25502] 10:12:36.346904 fstat(0,  <unfinished ...>
[pid 25495] 10:12:36.346940 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.346970 close(14 <unfinished ...>
[pid 25491] 10:12:36.346994 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.347017 close(16 <unfinished ...>
[pid 25503] 10:12:36.347055 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25502] 10:12:36.347083 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.347112 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.347129 <... close resumed> ) = 0
[pid 25491] 10:12:36.347148 <... lseek resumed> ) = 4868
[pid 25473] 10:12:36.347187 <... close resumed> ) = 0
[pid 25503] 10:12:36.347256 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.347275 fstat(1,  <unfinished ...>
[pid 25495] 10:12:36.347312 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25492] 10:12:36.347343 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25491] 10:12:36.347370 close(12 <unfinished ...>
[pid 25473] 10:12:36.347394 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25503] 10:12:36.347432 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.347461 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.347488 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.347505 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.347603 <... close resumed> ) = 0
[pid 25473] 10:12:36.347624 <... socket resumed> ) = 16
[pid 25503] 10:12:36.347669 <... open resumed> ) = 5
[pid 25502] 10:12:36.347685 fstat(2,  <unfinished ...>
[pid 25495] 10:12:36.347710 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25492] 10:12:36.347740 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25491] 10:12:36.347765 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.347790 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25503] 10:12:36.347831 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.347853 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25495] 10:12:36.347881 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.347927 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.347947 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.347968 <... connect resumed> ) = 0
[pid 25503] 10:12:36.347996 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.348022 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMa-0006dB-67"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25495] 10:12:36.348782 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.348827 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25491] 10:12:36.348854 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.348879 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25503] 10:12:36.348916 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25495] 10:12:36.348943 <... open resumed> ) = 9
[pid 25492] 10:12:36.348957 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.348977 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.348994 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25503] 10:12:36.349027 <... mmap resumed> ) = 0x7fbb7f4bf000
[pid 25502] 10:12:36.349042 <... execve resumed> ) = 0
[pid 25495] 10:12:36.349057 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.349099 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25491] 10:12:36.349124 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.349149 sendto(16, "\r\264\1\0\0\1\0\0\0\0\0\0\6aspmx3\ngooglemail\3com\0\0\1\0\1", 39, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25503] 10:12:36.349214 close(5 <unfinished ...>
[pid 25502] 10:12:36.349238 brk(0 <unfinished ...>
[pid 25495] 10:12:36.349260 <... ioctl resumed> , 0x7ffd50fbf050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.349276 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.349293 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.349313 <... sendto resumed> ) = 39
[pid 25503] 10:12:36.349341 <... close resumed> ) = 0
[pid 25502] 10:12:36.349355 <... brk resumed> ) = 0x1085000
[pid 25495] 10:12:36.349382 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.349409 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25491] 10:12:36.349435 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.349459 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25503] 10:12:36.349494 open("/lib64/libtinfo.so.5", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.349587 fcntl(0, F_GETFD <unfinished ...>
[pid 25495] 10:12:36.349618 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.349632 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.349665 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.349731 <... open resumed> ) = 5
[pid 25502] 10:12:36.349753 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.349769 brk(0xc62000 <unfinished ...>
[pid 25492] 10:12:36.349794 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.349827 read(5,  <unfinished ...>
[pid 25502] 10:12:36.349850 fcntl(1, F_GETFD <unfinished ...>
[pid 25495] 10:12:36.349878 <... brk resumed> ) = 0xc62000
[pid 25491] 10:12:36.349892 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25503] 10:12:36.349940 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.349962 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.349979 read(9,  <unfinished ...>
[pid 25492] 10:12:36.350006 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.350027 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.350056 fcntl(2, F_GETFD <unfinished ...>
[pid 25495] 10:12:36.350078 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25491] 10:12:36.350096 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.350420 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.350462 <... fcntl resumed> ) = 0
[pid 25495] 10:12:36.350480 read(9,  <unfinished ...>
[pid 25492] 10:12:36.350513 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25503] 10:12:36.350630 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.350660 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25495] 10:12:36.350689 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25491] 10:12:36.350707 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.351438 <... mmap resumed> ) = 0x7fbb7f08a000
[pid 25502] 10:12:36.351457 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.351477 read(9,  <unfinished ...>
[pid 25492] 10:12:36.351519 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.351601 mprotect(0x7fbb7f0a7000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.351633 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.351661 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25491] 10:12:36.351681 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.351782 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.351809 <... mmap resumed> ) = 0x7f3c0be4e000
[pid 25495] 10:12:36.351982 brk(0xc83000 <unfinished ...>
[pid 25492] 10:12:36.352034 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.352074 mmap(0x7fbb7f2a6000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000 <unfinished ...>
[pid 25502] 10:12:36.352112 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25495] 10:12:36.352142 <... brk resumed> ) = 0xc83000
[pid 25491] 10:12:36.352156 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25503] 10:12:36.352592 <... mmap resumed> ) = 0x7fbb7f2a6000
[pid 25502] 10:12:36.352615 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.352640 read(9,  <unfinished ...>
[pid 25492] 10:12:36.352675 <... stat resumed> 0x7ffc8d3416d0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.352697 mmap(0x7fbb7f2aa000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.352732 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.352765 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.352780 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.352805 <... mmap resumed> ) = 0x7fbb7f2aa000
[pid 25502] 10:12:36.352822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.352839 close(9 <unfinished ...>
[pid 25492] 10:12:36.352865 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25503] 10:12:36.352903 close(5 <unfinished ...>
[pid 25502] 10:12:36.352925 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25495] 10:12:36.352952 <... close resumed> ) = 0
[pid 25491] 10:12:36.352965 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.353893 <... close resumed> ) = 0
[pid 25502] 10:12:36.353913 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.353945 read(8,  <unfinished ...>
[pid 25492] 10:12:36.353976 <... stat resumed> 0x7ffc8d341770) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.353998 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.354033 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.354062 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25491] 10:12:36.354081 <... stat resumed> 0x7ffc86152a10) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.354851 <... open resumed> ) = 5
[pid 25502] 10:12:36.354885 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.354905 read(8,  <unfinished ...>
[pid 25492] 10:12:36.354934 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.354972 read(5,  <unfinished ...>
[pid 25502] 10:12:36.354995 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25495] 10:12:36.355021 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25491] 10:12:36.355040 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25503] 10:12:36.355616 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.355651 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.355670 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25503] 10:12:36.355726 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.355750 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.355773 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.355796 <... stat resumed> 0x7ffc86152ab0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.355838 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.355867 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.355881 <... open resumed> ) = 14
[pid 25491] 10:12:36.355895 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.356155 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.356188 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25495] 10:12:36.356217 read(8,  <unfinished ...>
[pid 25492] 10:12:36.356238 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.356261 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25503] 10:12:36.356293 <... mmap resumed> ) = 0x7fbb7ee86000
[pid 25502] 10:12:36.356308 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.356342 mprotect(0x7fbb7ee88000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.356365 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.356387 <... ioctl resumed> , 0x7ffc8d3414c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.356402 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.356457 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.356473 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.356487 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.356508 <... open resumed> ) = 12
[pid 25503] 10:12:36.356620 mmap(0x7fbb7f088000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000 <unfinished ...>
[pid 25502] 10:12:36.356650 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25492] 10:12:36.356673 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.356687 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25503] 10:12:36.356758 <... mmap resumed> ) = 0x7fbb7f088000
[pid 25502] 10:12:36.356773 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25492] 10:12:36.356801 read(14,  <unfinished ...>
[pid 25491] 10:12:36.356821 <... ioctl resumed> , 0x7ffc86152800) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.356871 close(5 <unfinished ...>
[pid 25502] 10:12:36.356897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.356938 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25492] 10:12:36.356958 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25491] 10:12:36.357361 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.357404 <... close resumed> ) = 0
[pid 25502] 10:12:36.357942 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.357977 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.358002 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.358063 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.358092 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.358115 <... lseek resumed> ) = 2366
[pid 25491] 10:12:36.358128 read(12,  <unfinished ...>
[pid 25503] 10:12:36.358181 <... open resumed> ) = 5
[pid 25502] 10:12:36.358195 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.358211 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.358231 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25503] 10:12:36.358746 read(5,  <unfinished ...>
[pid 25502] 10:12:36.358782 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.358808 <... lseek resumed> ) = 2366
[pid 25491] 10:12:36.358822 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.358870 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.358892 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.358907 close(14 <unfinished ...>
[pid 25491] 10:12:36.358927 <... lseek resumed> ) = 2366
[pid 25503] 10:12:36.358959 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.358980 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25492] 10:12:36.359002 <... close resumed> ) = 0
[pid 25491] 10:12:36.359015 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.359384 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.359420 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.359437 read(13,  <unfinished ...>
[pid 25491] 10:12:36.359457 <... lseek resumed> ) = 2366
[pid 25503] 10:12:36.359489 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.359514 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.359613 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.359631 close(12 <unfinished ...>
[pid 25503] 10:12:36.359683 <... mmap resumed> ) = 0x7fbb7f4be000
[pid 25502] 10:12:36.359697 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.359712 close(13 <unfinished ...>
[pid 25491] 10:12:36.359732 <... close resumed> ) = 0
[pid 25503] 10:12:36.360062 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.360095 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.360119 <... close resumed> ) = 0
[pid 25491] 10:12:36.360133 read(11,  <unfinished ...>
[pid 25503] 10:12:36.360602 <... mmap resumed> ) = 0x7fbb7eaf2000
[pid 25502] 10:12:36.360622 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.360639 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.360662 <... read resumed> "", 8192) = 0
[pid 25503] 10:12:36.360698 mprotect(0x7fbb7ec7c000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.360722 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.360746 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.360760 close(11 <unfinished ...>
[pid 25503] 10:12:36.360812 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.360826 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.360840 read(12,  <unfinished ...>
[pid 25491] 10:12:36.360860 <... close resumed> ) = 0
[pid 25503] 10:12:36.361078 mmap(0x7fbb7ee7c000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25502] 10:12:36.361109 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25492] 10:12:36.361133 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.361147 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.361225 <... mmap resumed> ) = 0x7fbb7ee7c000
[pid 25502] 10:12:36.361241 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.361269 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:36.361292 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.361405 mmap(0x7fbb7ee81000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.361442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.361477 read(8,  <unfinished ...>
[pid 25492] 10:12:36.361499 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.361594 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.361627 <... mmap resumed> ) = 0x7fbb7ee81000
[pid 25502] 10:12:36.361641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.361703 close(5 <unfinished ...>
[pid 25502] 10:12:36.361731 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25495] 10:12:36.361760 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25492] 10:12:36.361785 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.361994 <... open resumed> ) = 11
[pid 25503] 10:12:36.362017 <... close resumed> ) = 0
[pid 25502] 10:12:36.362035 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.362077 brk(0xca4000 <unfinished ...>
[pid 25492] 10:12:36.362102 <... open resumed> ) = 13
[pid 25503] 10:12:36.362120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.362144 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.362167 fstat(11,  <unfinished ...>
[pid 25503] 10:12:36.362213 <... mmap resumed> ) = 0x7fbb7f4bd000
[pid 25502] 10:12:36.362228 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.362242 fstat(13,  <unfinished ...>
[pid 25491] 10:12:36.362263 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.362312 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.362336 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25492] 10:12:36.362359 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.362384 fstat(11,  <unfinished ...>
[pid 25503] 10:12:36.362435 <... mmap resumed> ) = 0x7fbb7f4bc000
[pid 25502] 10:12:36.362449 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.362468 <... brk resumed> ) = 0xca4000
[pid 25492] 10:12:36.362491 fstat(13,  <unfinished ...>
[pid 25491] 10:12:36.363033 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.363075 arch_prctl(ARCH_SET_FS, 0x7fbb7f4bd700 <unfinished ...>
[pid 25502] 10:12:36.363102 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.363144 read(8,  <unfinished ...>
[pid 25492] 10:12:36.363166 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
Process 25504 attached
[pid 25503] 10:12:36.363213 <... arch_prctl resumed> ) = 0
[pid 25502] 10:12:36.363245 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.363352 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.363384 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25504] 10:12:36.363416 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25503] 10:12:36.363439 mprotect(0x7fbb7ee7c000, 16384, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.363467 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25492] 10:12:36.363497 <... mmap resumed> ) = 0x7f638dcaa000
[pid 25504] 10:12:36.363517 <... set_robust_list resumed> ) = 0
[pid 25503] 10:12:36.363609 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.363657 <... stat resumed> 0x7ffced9be2b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.363687 <... mmap resumed> ) = 0x7f33164f8000
[pid 25504] 10:12:36.363714 close(17 <unfinished ...>
[pid 25503] 10:12:36.363749 mprotect(0x7fbb7f088000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.363775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.363806 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25504] 10:12:36.363836 <... close resumed> ) = 0
[pid 25503] 10:12:36.363850 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.363873 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.363933 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25504] 10:12:36.363967 geteuid( <unfinished ...>
[pid 25503] 10:12:36.363989 mprotect(0x7fbb7f4ca000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.364014 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25492] 10:12:36.364042 <... lseek resumed> ) = 0
[pid 25504] 10:12:36.364062 <... geteuid resumed> ) = 0
[pid 25503] 10:12:36.364078 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.364093 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.364122 <... lseek resumed> ) = 0
[pid 25504] 10:12:36.364146 getegid( <unfinished ...>
[pid 25503] 10:12:36.364171 munmap(0x7fbb7f4bf000, 39387 <unfinished ...>
[pid 25502] 10:12:36.364201 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.364230 read(13,  <unfinished ...>
[pid 25504] 10:12:36.364259 <... getegid resumed> ) = 12
[pid 25503] 10:12:36.364273 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.364291 <... open resumed> ) = 6
[pid 25491] 10:12:36.364340 read(11,  <unfinished ...>
[pid 25504] 10:12:36.364377 setgid(500 <unfinished ...>
[pid 25503] 10:12:36.364401 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.364424 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.364447 <... read resumed> "", 4096) = 0
[pid 25504] 10:12:36.364467 <... setgid resumed> ) = 0
[pid 25503] 10:12:36.364491 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.364514 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25491] 10:12:36.364629 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25504] 10:12:36.364663 setuid(503 <unfinished ...>
[pid 25503] 10:12:36.364732 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25502] 10:12:36.364771 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.364800 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25504] 10:12:36.364836 <... setuid resumed> ) = 0
[pid 25503] 10:12:36.364850 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25502] 10:12:36.364896 <... mmap resumed> ) = 0x7f3c0be44000
[pid 25495] 10:12:36.364920 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25491] 10:12:36.364941 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25504] 10:12:36.365639 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.365682 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25502] 10:12:36.365713 close(6 <unfinished ...>
[pid 25492] 10:12:36.365738 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:36.365774 <... open resumed> ) = 12
[pid 25504] 10:12:36.365817 <... open resumed> ) = 9
[pid 25503] 10:12:36.365839 <... ioctl resumed> , 0x7ffd6c8eb140) = -1 EINVAL (Invalid argument)
[pid 25502] 10:12:36.365866 <... close resumed> ) = 0
[pid 25492] 10:12:36.365910 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25504] 10:12:36.365960 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.365983 brk(0 <unfinished ...>
[pid 25502] 10:12:36.366005 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.366037 fstat(12,  <unfinished ...>
[pid 25504] 10:12:36.366066 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.366093 <... brk resumed> ) = 0xe94000
[pid 25502] 10:12:36.366209 <... open resumed> ) = 6
[pid 25492] 10:12:36.366268 <... open resumed> ) = 14
[pid 25504] 10:12:36.366293 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.366319 brk(0xeb5000 <unfinished ...>
[pid 25502] 10:12:36.366343 read(6,  <unfinished ...>
[pid 25491] 10:12:36.366366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25504] 10:12:36.366398 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.366425 <... brk resumed> ) = 0xeb5000
[pid 25502] 10:12:36.366443 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.366487 fstat(14,  <unfinished ...>
[pid 25504] 10:12:36.366633 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.366669 getuid( <unfinished ...>
[pid 25502] 10:12:36.366692 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.366714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25504] 10:12:36.366746 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25503] 10:12:36.366760 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.366776 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.366807 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25504] 10:12:36.366842 read(9,  <unfinished ...>
[pid 25503] 10:12:36.366883 getgid( <unfinished ...>
[pid 25502] 10:12:36.366907 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.366934 <... mmap resumed> ) = 0x7f33164f7000
[pid 25504] 10:12:36.366959 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25503] 10:12:36.366984 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.367000 <... mmap resumed> ) = 0x7f3c0ba16000
[pid 25492] 10:12:36.367017 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.367044 read(12,  <unfinished ...>
[pid 25504] 10:12:36.367079 read(9,  <unfinished ...>
[pid 25503] 10:12:36.367105 geteuid( <unfinished ...>
[pid 25502] 10:12:36.367127 mprotect(0x7f3c0ba2c000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.367153 <... mmap resumed> ) = 0x7f638dca9000
[pid 25491] 10:12:36.367167 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25504] 10:12:36.367209 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25503] 10:12:36.367228 <... geteuid resumed> ) = 503
[pid 25502] 10:12:36.367246 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.367263 read(14,  <unfinished ...>
[pid 25491] 10:12:36.367290 close(12 <unfinished ...>
[pid 25504] 10:12:36.367323 close(9 <unfinished ...>
[pid 25503] 10:12:36.367347 getegid( <unfinished ...>
[pid 25502] 10:12:36.367369 mmap(0x7f3c0bc2c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25492] 10:12:36.367399 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.367418 <... close resumed> ) = 0
[pid 25504] 10:12:36.367449 <... close resumed> ) = 0
[pid 25503] 10:12:36.367463 <... getegid resumed> ) = 500
[pid 25502] 10:12:36.367479 <... mmap resumed> ) = 0x7f3c0bc2c000
[pid 25492] 10:12:36.367505 close(14 <unfinished ...>
[pid 25491] 10:12:36.367621 munmap(0x7f33164f7000, 4096 <unfinished ...>
[pid 25504] 10:12:36.367659 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25503] 10:12:36.367684 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.367707 mmap(0x7f3c0bc2e000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.367734 <... close resumed> ) = 0
[pid 25491] 10:12:36.367956 <... munmap resumed> ) = 0
[pid 25504] 10:12:36.368020 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.368042 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.368455 <... mmap resumed> ) = 0x7f3c0bc2e000
[pid 25492] 10:12:36.368516 munmap(0x7f638dca9000, 4096 <unfinished ...>
[pid 25491] 10:12:36.368610 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25504] 10:12:36.368654 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.368678 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.368715 close(6 <unfinished ...>
[pid 25492] 10:12:36.368739 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.368772 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25504] 10:12:36.368836 <... lseek resumed> ) = 19
[pid 25503] 10:12:36.368859 <... open resumed> ) = 5
[pid 25502] 10:12:36.368874 <... close resumed> ) = 0
[pid 25492] 10:12:36.368896 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.368937 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25504] 10:12:36.369062 read(6,  <unfinished ...>
[pid 25503] 10:12:36.369087 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.369110 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.369142 brk(0xcc5000 <unfinished ...>
[pid 25492] 10:12:36.369163 <... open resumed> ) = 14
[pid 25491] 10:12:36.369180 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25504] 10:12:36.369229 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2446) = 1858
[pid 25503] 10:12:36.369249 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.369803 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.369832 fstat(14,  <unfinished ...>
[pid 25491] 10:12:36.369860 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25504] 10:12:36.369901 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.369933 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.369959 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.369994 <... brk resumed> ) = 0xcc5000
[pid 25492] 10:12:36.370008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25491] 10:12:36.370192 <... open resumed> ) = 12
[pid 25504] 10:12:36.370228 <... write resumed> ) = 4
[pid 25503] 10:12:36.370242 <... mmap resumed> ) = 0x7fbb7f4c8000
[pid 25502] 10:12:36.370258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.370276 read(8,  <unfinished ...>
[pid 25492] 10:12:36.370299 fstat(14,  <unfinished ...>
[pid 25491] 10:12:36.370322 fstat(12,  <unfinished ...>
[pid 25458] 10:12:36.370345 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25504] 10:12:36.370374 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.370399 read(5,  <unfinished ...>
[pid 25502] 10:12:36.370456 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.370492 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25491] 10:12:36.370590 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.370629 read(17,  <unfinished ...>
[pid 25504] 10:12:36.370666 <... write resumed> ) = 4
[pid 25503] 10:12:36.370679 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          242892 kB\nCached:           332660 kB\nBuffers:               0 kB\nActive:           307152 kB\nInactive:         467536 kB\nActive(anon):     172228 kB\nInactive(anon):   277604 kB\nActive(file):     134924 kB\nInac"..., 1024) = 588
[pid 25502] 10:12:36.370705 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.370737 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25492] 10:12:36.370769 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.371309 fstat(12,  <unfinished ...>
[pid 25458] 10:12:36.371337 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25504] 10:12:36.371368 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.371394 close(5 <unfinished ...>
[pid 25502] 10:12:36.371420 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.371453 read(8,  <unfinished ...>
[pid 25492] 10:12:36.371476 <... mmap resumed> ) = 0x7f638dca9000
[pid 25491] 10:12:36.371494 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.371588 read(17,  <unfinished ...>
[pid 25504] 10:12:36.371628 <... write resumed> ) = 4
[pid 25503] 10:12:36.371643 <... close resumed> ) = 0
[pid 25502] 10:12:36.371659 <... open resumed> ) = 6
[pid 25492] 10:12:36.371674 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.371700 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.371727 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25504] 10:12:36.371758 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25503] 10:12:36.371785 munmap(0x7fbb7f4c8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.371812 read(6,  <unfinished ...>
[pid 25492] 10:12:36.371836 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.371854 <... mmap resumed> ) = 0x7f33164f7000
[pid 25458] 10:12:36.371871 read(17,  <unfinished ...>
[pid 25504] 10:12:36.371905 <... write resumed> ) = 40
[pid 25503] 10:12:36.371919 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.371934 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.371991 read(14,  <unfinished ...>
[pid 25491] 10:12:36.372024 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.372048 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25504] 10:12:36.372075 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.372099 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.372126 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.372149 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25491] 10:12:36.372183 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.372200 read(17,  <unfinished ...>
[pid 25504] 10:12:36.372232 <... write resumed> ) = 4
[pid 25503] 10:12:36.372246 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.372270 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.372300 read(14,  <unfinished ...>
[pid 25491] 10:12:36.372328 read(12,  <unfinished ...>
[pid 25458] 10:12:36.372354 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25504] 10:12:36.372381 close(18 <unfinished ...>
[pid 25503] 10:12:36.372405 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.372430 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.372457 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.372488 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25458] 10:12:36.372517 wait4(-1,  <unfinished ...>
[pid 25504] 10:12:36.372632 <... close resumed> ) = 0
[pid 25503] 10:12:36.372647 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.372680 <... mmap resumed> ) = 0x7f3c0be43000
[pid 25492] 10:12:36.372705 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.372737 read(12,  <unfinished ...>
[pid 25504] 10:12:36.372769 exit_group(0) = ?
[pid 25503] 10:12:36.372782 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.373105 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.373136 <... open resumed> ) = 15
[pid 25491] 10:12:36.373154 <... read resumed> "", 4096) = 0
[pid 25504] 10:12:36.373290 +++ exited with 0 +++
[pid 25503] 10:12:36.373308 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.373325 <... mmap resumed> ) = 0x7f3c0b7fd000
[pid 25495] 10:12:36.373344 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25492] 10:12:36.373362 fstat(15,  <unfinished ...>
[pid 25491] 10:12:36.373600 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25458] 10:12:36.373638 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25504
[pid 25503] 10:12:36.373666 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.373693 mprotect(0x7f3c0b813000, 2093056, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.373721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.373752 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2943, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.373810 close(17 <unfinished ...>
[pid 25503] 10:12:36.373851 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.373869 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.373888 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.374269 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.374308 <... close resumed> ) = 0
[pid 25503] 10:12:36.374342 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.374370 mmap(0x7f3c0ba12000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25495] 10:12:36.374404 brk(0xce6000 <unfinished ...>
[pid 25492] 10:12:36.374425 <... mmap resumed> ) = 0x7f638dca8000
[pid 25491] 10:12:36.374443 <... open resumed> ) = 13
[pid 25458] 10:12:36.374462 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25503] 10:12:36.374498 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.374514 <... mmap resumed> ) = 0x7f3c0ba12000
[pid 25492] 10:12:36.374609 read(15,  <unfinished ...>
[pid 25491] 10:12:36.374641 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.374667 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0}, 8) = 0
[pid 25503] 10:12:36.374718 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.374747 mmap(0x7f3c0ba14000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.374777 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.374810 <... ioctl resumed> , 0x7ffc861558f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.374830 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.374865 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.374882 <... mmap resumed> ) = 0x7f3c0ba14000
[pid 25492] 10:12:36.374908 close(15 <unfinished ...>
[pid 25491] 10:12:36.374935 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.374959 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.375011 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.375036 close(6 <unfinished ...>
[pid 25492] 10:12:36.375059 <... close resumed> ) = 0
[pid 25491] 10:12:36.375075 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.375096 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.375134 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.375152 <... close resumed> ) = 0
[pid 25492] 10:12:36.375180 munmap(0x7f638dca8000, 4096 <unfinished ...>
[pid 25491] 10:12:36.375209 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.375232 <... open resumed> ) = 9
[pid 25503] 10:12:36.375256 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.375282 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.375324 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.375364 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2943, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.375399 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.375430 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.375446 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.375474 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.375504 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.375628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.375681 uname( <unfinished ...>
[pid 25502] 10:12:36.375708 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.375746 <... brk resumed> ) = 0xce6000
[pid 25492] 10:12:36.375760 <... open resumed> ) = 15
[pid 25491] 10:12:36.375922 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.375958 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.375995 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25502] 10:12:36.376064 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.376085 read(8,  <unfinished ...>
[pid 25492] 10:12:36.376106 fstat(15,  <unfinished ...>
[pid 25491] 10:12:36.376129 read(13,  <unfinished ...>
[pid 25458] 10:12:36.376154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.376191 getcwd( <unfinished ...>
[pid 25502] 10:12:36.376222 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.376253 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25491] 10:12:36.376284 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2943
[pid 25458] 10:12:36.376901 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.376950 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25502] 10:12:36.376981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.377008 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25492] 10:12:36.377028 fstat(15,  <unfinished ...>
[pid 25491] 10:12:36.377371 read(13,  <unfinished ...>
[pid 25458] 10:12:36.377400 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25503] 10:12:36.377427 getpid( <unfinished ...>
[pid 25502] 10:12:36.377450 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.377485 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25491] 10:12:36.377516 <... read resumed> "", 8192) = 0
[pid 25458] 10:12:36.377616 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.377652 <... getpid resumed> ) = 25503
[pid 25502] 10:12:36.377682 <... open resumed> ) = 6
[pid 25492] 10:12:36.377701 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.377728 close(13 <unfinished ...>
[pid 25458] 10:12:36.377753 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.377777 getppid( <unfinished ...>
[pid 25502] 10:12:36.377800 read(6,  <unfinished ...>
[pid 25492] 10:12:36.377824 <... mmap resumed> ) = 0x7f638dca8000
[pid 25491] 10:12:36.377841 <... close resumed> ) = 0
[pid 25458] 10:12:36.377906 read(9,  <unfinished ...>
[pid 25503] 10:12:36.377947 <... getppid resumed> ) = 25389
[pid 25502] 10:12:36.377975 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.378002 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.378026 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.378053 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25503] 10:12:36.378105 stat(".",  <unfinished ...>
[pid 25502] 10:12:36.378138 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.378161 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.378178 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.378615 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.378677 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25502] 10:12:36.378723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.378764 read(15,  <unfinished ...>
[pid 25491] 10:12:36.378793 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.378823 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.378875 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.378909 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.378939 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.378973 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.379018 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.379056 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.379087 <... mmap resumed> ) = 0x7f3c0b5c6000
[pid 25492] 10:12:36.379105 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.379131 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.379157 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.379251 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.379285 mprotect(0x7f3c0b5cd000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.379315 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.379356 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.379420 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25503] 10:12:36.379466 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.379495 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.379521 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.379549 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.379580 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.379611 geteuid( <unfinished ...>
[pid 25502] 10:12:36.379636 mmap(0x7f3c0b7cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25492] 10:12:36.379768 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.379814 <... open resumed> ) = 13
[pid 25458] 10:12:36.379836 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.379876 <... geteuid resumed> ) = 503
[pid 25502] 10:12:36.379892 <... mmap resumed> ) = 0x7f3c0b7cd000
[pid 25495] 10:12:36.379915 read(8,  <unfinished ...>
[pid 25492] 10:12:36.379936 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.379962 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.379985 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.380032 getegid( <unfinished ...>
[pid 25502] 10:12:36.380068 mmap(0x7f3c0b7cf000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.380098 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.380138 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.380185 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.380225 <... getegid resumed> ) = 500
[pid 25502] 10:12:36.380241 <... mmap resumed> ) = 0x7f3c0b7cf000
[pid 25495] 10:12:36.380264 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25492] 10:12:36.380284 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:36.380901 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.380940 <... open resumed> ) = 10
[pid 25503] 10:12:36.380969 getuid( <unfinished ...>
[pid 25502] 10:12:36.380992 close(6 <unfinished ...>
[pid 25495] 10:12:36.381016 brk(0xd07000 <unfinished ...>
[pid 25492] 10:12:36.381036 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:36.381083 <... mmap resumed> ) = 0x7f33164f6000
[pid 25458] 10:12:36.381103 fstat(10,  <unfinished ...>
[pid 25503] 10:12:36.381135 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.381152 <... close resumed> ) = 0
[pid 25492] 10:12:36.381176 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.381204 read(13,  <unfinished ...>
[pid 25458] 10:12:36.381231 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.381271 getgid( <unfinished ...>
[pid 25502] 10:12:36.381295 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.381327 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.381378 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.381414 fstat(10,  <unfinished ...>
[pid 25503] 10:12:36.381447 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.381463 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.381483 write(8, "2015-12-30 10:12:36 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25491] 10:12:36.381750 close(13 <unfinished ...>
[pid 25458] 10:12:36.381785 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.381824 access("/bin/sh", X_OK <unfinished ...>
[pid 25502] 10:12:36.381854 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.381892 <... write resumed> ) = 101
[pid 25491] 10:12:36.381912 <... close resumed> ) = 0
[pid 25458] 10:12:36.381929 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.381963 <... access resumed> ) = 0
[pid 25502] 10:12:36.381979 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.381997 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.382023 munmap(0x7f33164f6000, 4096 <unfinished ...>
[pid 25458] 10:12:36.382051 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25503] 10:12:36.382076 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.382103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.382133 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.382172 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.382201 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.382240 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.382269 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.382290 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.382316 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.382345 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.382369 geteuid( <unfinished ...>
[pid 25502] 10:12:36.382396 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.382429 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.382461 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.382489 read(10,  <unfinished ...>
[pid 25503] 10:12:36.382606 <... geteuid resumed> ) = 503
[pid 25502] 10:12:36.382625 <... open resumed> ) = 6
[pid 25495] 10:12:36.382641 <... brk resumed> ) = 0xd07000
[pid 25492] 10:12:36.382655 close(7 <unfinished ...>
[pid 25491] 10:12:36.382909 pipe( <unfinished ...>
[pid 25458] 10:12:36.382943 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25503] 10:12:36.382979 getegid( <unfinished ...>
[pid 25502] 10:12:36.383002 read(6,  <unfinished ...>
[pid 25492] 10:12:36.383026 <... close resumed> ) = 0
[pid 25491] 10:12:36.383047 <... pipe resumed> [13, 14]) = 0
[pid 25458] 10:12:36.383065 read(10,  <unfinished ...>
[pid 25503] 10:12:36.383096 <... getegid resumed> ) = 500
[pid 25502] 10:12:36.383112 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.383135 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25491] 10:12:36.383171 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25458] 10:12:36.383200 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.383244 getuid( <unfinished ...>
[pid 25502] 10:12:36.383270 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.383293 <... open resumed> ) = 7
[pid 25491] 10:12:36.383309 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25458] 10:12:36.383331 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.383492 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.383586 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.383624 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.383649 close(10 <unfinished ...>
[pid 25458] 10:12:36.383674 <... open resumed> ) = 11
[pid 25503] 10:12:36.383702 getgid( <unfinished ...>
[pid 25502] 10:12:36.383733 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.383762 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.383785 <... fcntl resumed> ) = 0
[pid 25491] 10:12:36.383803 <... close resumed> ) = 0
[pid 25458] 10:12:36.383819 fstat(11,  <unfinished ...>
[pid 25503] 10:12:36.383850 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.383866 <... mmap resumed> ) = 0x7f3c0b342000
[pid 25492] 10:12:36.383883 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.383906 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25458] 10:12:36.383934 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25503] 10:12:36.383978 access("/bin/sh", R_OK <unfinished ...>
[pid 25502] 10:12:36.384008 mprotect(0x7f3c0b3c5000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.384036 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.384052 <... fcntl resumed> ) = 0
[pid 25491] 10:12:36.384070 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.384088 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.384124 <... access resumed> ) = 0
[pid 25502] 10:12:36.384141 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.384157 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.384183 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.384206 close(11 <unfinished ...>
[pid 25458] 10:12:36.384230 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25503] 10:12:36.384255 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.384281 mmap(0x7f3c0b5c4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25495] 10:12:36.384311 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.384326 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5376994, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.384361 <... close resumed> ) = 0
[pid 25458] 10:12:36.384378 read(11,  <unfinished ...>
[pid 25503] 10:12:36.384414 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.384443 <... mmap resumed> ) = 0x7f3c0b5c4000
[pid 25495] 10:12:36.384473 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.384587 write(7, "2015-12-30 10:12:36 [25492] 1aEJMZ-0006cz-RM ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25491] 10:12:36.384626 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25458] 10:12:36.384654 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25503] 10:12:36.384696 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.384724 close(6 <unfinished ...>
[pid 25495] 10:12:36.384747 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.384766 <... write resumed> ) = 110
[pid 25491] 10:12:36.384792 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.384811 close(11 <unfinished ...>
[pid 25503] 10:12:36.384844 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.384879 <... close resumed> ) = 0
[pid 25495] 10:12:36.384903 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.384929 close(14 <unfinished ...>
[pid 25491] 10:12:36.384954 close(12 <unfinished ...>
[pid 25458] 10:12:36.384978 <... close resumed> ) = 0
[pid 25503] 10:12:36.385003 geteuid( <unfinished ...>
[pid 25502] 10:12:36.385025 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.385055 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.385069 <... close resumed> ) = 0
[pid 25491] 10:12:36.385090 <... close resumed> ) = 0
[pid 25458] 10:12:36.385107 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25503] 10:12:36.385142 <... geteuid resumed> ) = 503
[pid 25502] 10:12:36.385158 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.385175 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.385201 munmap(0x7f638dca9000, 4096 <unfinished ...>
[pid 25491] 10:12:36.385228 munmap(0x7f33164f7000, 4096 <unfinished ...>
[pid 25458] 10:12:36.385252 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.385293 getegid( <unfinished ...>
[pid 25502] 10:12:36.385318 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.385353 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.385368 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.385387 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.385407 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.385443 <... getegid resumed> ) = 500
[pid 25502] 10:12:36.385463 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.385486 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.385599 close(15 <unfinished ...>
[pid 25491] 10:12:36.385627 close(9 <unfinished ...>
[pid 25458] 10:12:36.385656 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.385717 getuid( <unfinished ...>
[pid 25502] 10:12:36.385742 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.385772 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.385787 <... close resumed> ) = 0
[pid 25491] 10:12:36.385810 <... close resumed> ) = 0
[pid 25458] 10:12:36.385826 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25503] 10:12:36.385864 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.385880 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.385899 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.385931 munmap(0x7f638dca8000, 4096 <unfinished ...>
[pid 25491] 10:12:36.385957 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25458] 10:12:36.385982 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25503] 10:12:36.386032 getgid( <unfinished ...>
[pid 25502] 10:12:36.386057 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.386088 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.386103 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.386122 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.386141 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.386179 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.386200 <... open resumed> ) = 6
[pid 25495] 10:12:36.386217 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.386246 close(10 <unfinished ...>
[pid 25491] 10:12:36.386270 clone( <unfinished ...>
[pid 25458] 10:12:36.386640 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.386709 access("/bin/sh", X_OK <unfinished ...>
[pid 25502] 10:12:36.386743 read(6,  <unfinished ...>
[pid 25495] 10:12:36.386767 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.386783 <... close resumed> ) = 0
[pid 25458] 10:12:36.386806 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.386846 <... access resumed> ) = 0
[pid 25502] 10:12:36.386862 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.386886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.386916 munmap(0x7f638dcad000, 4096 <unfinished ...>
[pid 25491] 10:12:36.386943 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25505
[pid 25458] 10:12:36.386979 <... open resumed> ) = 11
[pid 25503] 10:12:36.387007 stat("/bin/sh",  <unfinished ...>
[pid 25502] 10:12:36.387034 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.387057 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.387071 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.387091 close(14 <unfinished ...>
[pid 25458] 10:12:36.387114 fstat(11,  <unfinished ...>
[pid 25503] 10:12:36.387146 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25502] 10:12:36.387176 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25495] 10:12:36.387204 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.387234 close(11 <unfinished ...>
[pid 25491] 10:12:36.387259 <... close resumed> ) = 0
[pid 25458] 10:12:36.387275 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.387315 geteuid( <unfinished ...>
[pid 25502] 10:12:36.387338 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.387365 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.387382 <... close resumed> ) = 0
[pid 25491] 10:12:36.387402 read(13,  <unfinished ...>
[pid 25458] 10:12:36.387425 fstat(11,  <unfinished ...>
[pid 25503] 10:12:36.387462 <... geteuid resumed> ) = 503
[pid 25502] 10:12:36.387483 <... mmap resumed> ) = 0x7f3c0be42000
[pid 25495] 10:12:36.387589 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.387638 munmap(0x7f638dcac000, 4096 <unfinished ...>
[pid 25458] 10:12:36.387667 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.387704 getegid( <unfinished ...>
[pid 25502] 10:12:36.387726 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.387754 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.387769 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.387788 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.387822 <... getegid resumed> ) = 500
[pid 25502] 10:12:36.387838 <... mmap resumed> ) = 0x7f3c0b134000
[pid 25495] 10:12:36.387854 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.387883 close(9 <unfinished ...>
[pid 25458] 10:12:36.387907 <... mmap resumed> ) = 0x7f03f4be6000
[pid 25503] 10:12:36.387931 getuid( <unfinished ...>
[pid 25502] 10:12:36.387953 mprotect(0x7f3c0b140000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.387980 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.387995 <... close resumed> ) = 0
[pid 25458] 10:12:36.388016 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.388047 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.388063 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.388079 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25492] 10:12:36.388108 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25458] 10:12:36.388134 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.388159 getgid( <unfinished ...>
[pid 25502] 10:12:36.388181 mmap(0x7f3c0b340000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25495] 10:12:36.388210 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.388224 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.388243 read(11,  <unfinished ...>
[pid 25503] 10:12:36.388278 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.388294 <... mmap resumed> ) = 0x7f3c0b340000
[pid 25495] 10:12:36.388319 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25492] 10:12:36.388351 close(13 <unfinished ...>
[pid 25458] 10:12:36.388376 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25503] 10:12:36.388429 access("/bin/sh", R_OK <unfinished ...>
[pid 25502] 10:12:36.388461 close(6 <unfinished ...>
[pid 25495] 10:12:36.388485 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25492] 10:12:36.388589 <... close resumed> ) = 0
[pid 25458] 10:12:36.388615 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.388651 <... access resumed> ) = 0
[pid 25502] 10:12:36.388686 <... close resumed> ) = 0
[pid 25495] 10:12:36.388712 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.388744 munmap(0x7f638dcaa000, 4096 <unfinished ...>
[pid 25458] 10:12:36.388771 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.388822 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.388855 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.388889 <... open resumed> ) = 9
[pid 25492] 10:12:36.388959 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.388984 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25503] 10:12:36.389022 <... socket resumed> ) = 5
[pid 25502] 10:12:36.389038 <... open resumed> ) = 6
[pid 25495] 10:12:36.389054 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25492] 10:12:36.389078 close(12 <unfinished ...>
[pid 25458] 10:12:36.389103 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25503] 10:12:36.389153 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.389193 read(6,  <unfinished ...>
[pid 25495] 10:12:36.389218 <... ioctl resumed> , 0x7ffd50fbf050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25492] 10:12:36.389233 <... close resumed> ) = 0
[pid 25458] 10:12:36.389252 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.389287 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.389304 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.389330 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.389353 munmap(0x7f638dcab000, 4096 <unfinished ...>
[pid 25458] 10:12:36.389378 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.389438 close(5 <unfinished ...>
[pid 25502] 10:12:36.389474 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.389503 <... lseek resumed> ) = 0
[pid 25492] 10:12:36.389581 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.389652 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25503] 10:12:36.389697 <... close resumed> ) = 0
[pid 25502] 10:12:36.389714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25495] 10:12:36.389744 read(9,  <unfinished ...>
[pid 25492] 10:12:36.389769 geteuid( <unfinished ...>
[pid 25458] 10:12:36.389791 <... stat resumed> 0x7ffc7ad925f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.389824 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.389853 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.389881 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25492] 10:12:36.389906 <... geteuid resumed> ) = 0
[pid 25458] 10:12:36.390149 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.390194 <... socket resumed> ) = 5
[pid 25502] 10:12:36.390211 <... mmap resumed> ) = 0x7f3c0af11000
[pid 25495] 10:12:36.390227 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25492] 10:12:36.390250 getegid( <unfinished ...>
[pid 25473] 10:12:36.390272 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25458] 10:12:36.390293 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.390349 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.390386 mprotect(0x7f3c0af32000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.390414 <... lseek resumed> ) = 878
[pid 25492] 10:12:36.390428 <... getegid resumed> ) = 12
[pid 25473] 10:12:36.390449 recvfrom(16,  <unfinished ...>
[pid 25458] 10:12:36.390479 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.390590 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.390610 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.390627 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25492] 10:12:36.390650 setgid(12 <unfinished ...>
[pid 25473] 10:12:36.390672 <... recvfrom resumed> "\r\264\201\200\0\1\0\1\0\0\0\0\6aspmx3\ngooglemail\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0`\0\4\255\302\314\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 55
[pid 25458] 10:12:36.390703 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.390776 close(5 <unfinished ...>
[pid 25502] 10:12:36.390808 mmap(0x7f3c0b132000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25495] 10:12:36.390841 <... lseek resumed> ) = 878
[pid 25492] 10:12:36.390855 <... setgid resumed> ) = 0
[pid 25473] 10:12:36.390875 close(16 <unfinished ...>
[pid 25458] 10:12:36.390904 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.390941 <... close resumed> ) = 0
[pid 25502] 10:12:36.390965 <... mmap resumed> ) = 0x7f3c0b132000
[pid 25495] 10:12:36.390988 close(9 <unfinished ...>
[pid 25492] 10:12:36.391012 setuid(47 <unfinished ...>
[pid 25473] 10:12:36.391036 <... close resumed> ) = 0
[pid 25458] 10:12:36.391131 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.391192 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.391225 close(6 <unfinished ...>
[pid 25495] 10:12:36.391248 <... close resumed> ) = 0
[pid 25492] 10:12:36.391261 <... setuid resumed> ) = 0
[pid 25473] 10:12:36.391585 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25458] 10:12:36.391627 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25503] 10:12:36.391666 <... open resumed> ) = 5
[pid 25502] 10:12:36.391686 <... close resumed> ) = 0
[pid 25495] 10:12:36.391711 read(8,  <unfinished ...>
[pid 25492] 10:12:36.391739 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f638b8ae6a0},  <unfinished ...>
[pid 25473] 10:12:36.391769 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25458] 10:12:36.391814 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25503] 10:12:36.391876 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.391903 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.391934 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25492] 10:12:36.391953 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25473] 10:12:36.392584 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.392629 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.392669 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25502] 10:12:36.392701 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.392720 read(8,  <unfinished ...>
[pid 25492] 10:12:36.392746 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25473] 10:12:36.392777 <... open resumed> ) = 16
[pid 25458] 10:12:36.392796 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.392855 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.392886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.392922 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25492] 10:12:36.392940 <... write resumed> ) = 36
[pid 25473] 10:12:36.393075 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.393108 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.393143 <... mmap resumed> ) = 0x7fbb7f4c8000
[pid 25502] 10:12:36.393160 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.393178 brk(0xd28000 <unfinished ...>
[pid 25492] 10:12:36.393201 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.393229 <... ioctl resumed> , 0x7ffdac33ce60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.393247 <... lseek resumed> ) = 2781
[pid 25503] 10:12:36.393291 read(5,  <unfinished ...>
[pid 25502] 10:12:36.393323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.393355 <... brk resumed> ) = 0xd28000
[pid 25492] 10:12:36.393369 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.394464 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.394513 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.394553 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25502] 10:12:36.394597 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.394621 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.394648 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.394666 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.394713 read(5,  <unfinished ...>
[pid 25502] 10:12:36.394739 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.394773 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.394858 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.394888 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25503] 10:12:36.394928 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.394946 <... open resumed> ) = 6
[pid 25495] 10:12:36.394962 read(8,  <unfinished ...>
[pid 25492] 10:12:36.394987 close(7 <unfinished ...>
[pid 25473] 10:12:36.395012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.395042 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25503] 10:12:36.395093 close(5 <unfinished ...>
[pid 25502] 10:12:36.395120 read(6,  <unfinished ...>
[pid 25495] 10:12:36.395143 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25492] 10:12:36.395162 <... close resumed> ) = 0
[pid 25473] 10:12:36.395375 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.395409 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.395449 <... close resumed> ) = 0
[pid 25502] 10:12:36.395466 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.395492 brk(0xd49000 <unfinished ...>
[pid 25492] 10:12:36.395598 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25473] 10:12:36.395639 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.395667 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.395736 munmap(0x7fbb7f4c8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.395769 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.395793 <... open resumed> ) = 7
[pid 25473] 10:12:36.395809 read(16,  <unfinished ...>
[pid 25458] 10:12:36.395834 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25503] 10:12:36.395876 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.395905 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25492] 10:12:36.395943 fcntl(7, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.395967 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25458] 10:12:36.396155 <... stat resumed> 0x7ffc7ad925f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.396197 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.396231 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.396260 <... brk resumed> ) = 0xd49000
[pid 25492] 10:12:36.396274 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.396583 close(16 <unfinished ...>
[pid 25458] 10:12:36.396620 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.396657 <... open resumed> ) = 5
[pid 25502] 10:12:36.396674 <... mmap resumed> ) = 0x7f3c0acf4000
[pid 25492] 10:12:36.396691 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.396723 <... close resumed> ) = 0
[pid 25458] 10:12:36.396766 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.396827 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.396853 mprotect(0x7f3c0ad0b000, 2097152, PROT_NONE <unfinished ...>
[pid 25492] 10:12:36.396882 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.396898 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25458] 10:12:36.396938 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25503] 10:12:36.396973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.397003 <... mprotect resumed> ) = 0
[pid 25492] 10:12:36.397019 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.397042 <... open resumed> ) = 16
[pid 25458] 10:12:36.397058 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.397119 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.397470 mmap(0x7f3c0af0b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25492] 10:12:36.397577 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377104, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.397617 alarm(60 <unfinished ...>
[pid 25458] 10:12:36.397643 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.397683 <... mmap resumed> ) = 0x7fbb7f4bf000
[pid 25502] 10:12:36.397700 <... mmap resumed> ) = 0x7f3c0af0b000
[pid 25492] 10:12:36.397723 write(7, "2015-12-30 10:12:36 [25492] 1aEJMZ-0006cz-RM Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25473] 10:12:36.397755 <... alarm resumed> ) = 0
[pid 25458] 10:12:36.397772 <... open resumed> ) = 12
[pid 25503] 10:12:36.397796 close(5 <unfinished ...>
[pid 25502] 10:12:36.397820 mmap(0x7f3c0af0d000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.397856 <... write resumed> ) = 77
[pid 25473] 10:12:36.397876 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25458] 10:12:36.397905 fstat(12,  <unfinished ...>
[pid 25503] 10:12:36.397936 <... close resumed> ) = 0
[pid 25502] 10:12:36.397963 <... mmap resumed> ) = 0x7f3c0af0d000
[pid 25492] 10:12:36.397986 open("/var/spool/exim/input/Z/hdr.25492", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25473] 10:12:36.398058 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.398076 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.398117 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.398151 close(6 <unfinished ...>
[pid 25492] 10:12:36.398174 <... open resumed> ) = 9
[pid 25473] 10:12:36.398190 alarm(0 <unfinished ...>
[pid 25458] 10:12:36.398213 fstat(12,  <unfinished ...>
[pid 25503] 10:12:36.398243 <... open resumed> ) = 5
[pid 25502] 10:12:36.398259 <... close resumed> ) = 0
[pid 25492] 10:12:36.398284 fchown(9, 47, 12 <unfinished ...>
[pid 25473] 10:12:36.398314 <... alarm resumed> ) = 60
[pid 25458] 10:12:36.398344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.398382 read(5,  <unfinished ...>
[pid 25502] 10:12:36.398407 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.398439 <... fchown resumed> ) = 0
[pid 25473] 10:12:36.398456 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.398493 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.399272 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.399313 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.399334 fchmod(9, 0640 <unfinished ...>
[pid 25473] 10:12:36.399363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.399380 <... mmap resumed> ) = 0x7f03f4be5000
[pid 25503] 10:12:36.399407 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.399432 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.399472 read(8,  <unfinished ...>
[pid 25492] 10:12:36.399493 <... fchmod resumed> ) = 0
[pid 25473] 10:12:36.399565 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.399611 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.399643 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.399696 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.399719 fcntl(9, F_GETFL <unfinished ...>
[pid 25473] 10:12:36.399743 <... open resumed> ) = 17
[pid 25458] 10:12:36.399760 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.399784 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.399820 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.399852 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25473] 10:12:36.399871 read(17,  <unfinished ...>
[pid 25458] 10:12:36.399918 read(12,  <unfinished ...>
[pid 25503] 10:12:36.399954 <... mmap resumed> ) = 0x7fbb7e8e4000
[pid 25502] 10:12:36.399971 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.399991 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.400015 <... read resumed> "cpu  123072 1342434 395193 67343097 2509 0 0 0\ncpu0 123072 1342434 395193 67343097 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58446884\nbtime 1450798266\nprocesses 892983\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25458] 10:12:36.400036 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25503] 10:12:36.400079 mprotect(0x7fbb7e8f0000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.400111 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.400142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080154, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.400171 close(17 <unfinished ...>
[pid 25458] 10:12:36.400199 stat("/jail_owner",  <unfinished ...>
[pid 25503] 10:12:36.400232 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.400248 <... open resumed> ) = 6
[pid 25492] 10:12:36.400264 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.400297 <... close resumed> ) = 0
[pid 25458] 10:12:36.400328 <... stat resumed> 0x7ffc7ad93ba0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.400361 mmap(0x7fbb7eaf0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25502] 10:12:36.400393 read(6,  <unfinished ...>
[pid 25492] 10:12:36.400417 <... mmap resumed> ) = 0x7f638dcae000
[pid 25473] 10:12:36.400433 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25458] 10:12:36.400463 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25503] 10:12:36.400503 <... mmap resumed> ) = 0x7fbb7eaf0000
[pid 25502] 10:12:36.400623 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.400651 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.400676 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.400708 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25503] 10:12:36.400752 close(5 <unfinished ...>
[pid 25502] 10:12:36.400776 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.400799 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.400837 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.400877 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25503] 10:12:36.400920 <... close resumed> ) = 0
[pid 25502] 10:12:36.400952 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25492] 10:12:36.400984 write(9, "1aEJMZ-0006cz-RM-H\nmailnull 47 12\n<>\n1451491955 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491956\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25473] 10:12:36.401021 <... open resumed> ) = 17
[pid 25458] 10:12:36.401038 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.401071 mprotect(0x7fbb7eaf0000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.401100 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25492] 10:12:36.401128 <... write resumed> ) = 268
[pid 25473] 10:12:36.401146 fcntl(17, F_GETFD <unfinished ...>
[pid 25458] 10:12:36.401169 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25503] 10:12:36.401204 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.401224 <... mmap resumed> ) = 0x7f3c0be41000
[pid 25492] 10:12:36.401245 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.401268 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.401284 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25503] 10:12:36.401325 munmap(0x7fbb7f4bf000, 39387 <unfinished ...>
[pid 25502] 10:12:36.401356 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.401387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080154, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.401421 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.401451 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25503] 10:12:36.401494 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.401659 <... mmap resumed> ) = 0x7f3c0a980000
[pid 25492] 10:12:36.401696 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMZ-0006cz-RM\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:35 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691 <unfinished ...>
[pid 25473] 10:12:36.401743 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.401763 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.401801 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.401836 mprotect(0x7f3c0aaef000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.401866 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25492] 10:12:36.401885 <... write resumed> ) = 691
[pid 25473] 10:12:36.402017 read(17,  <unfinished ...>
[pid 25458] 10:12:36.402049 stat("/etc/demouids",  <unfinished ...>
[pid 25503] 10:12:36.402087 <... open resumed> ) = 5
[pid 25502] 10:12:36.402107 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.402124 brk(0xd6a000 <unfinished ...>
[pid 25492] 10:12:36.402152 fsync(9 <unfinished ...>
[pid 25473] 10:12:36.402220 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25458] 10:12:36.402264 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.402405 fcntl(5, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.402433 mmap(0x7f3c0acee000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25495] 10:12:36.402467 <... brk resumed> ) = 0xd6a000
[pid 25473] 10:12:36.402482 close(17 <unfinished ...>
[pid 25458] 10:12:36.403370 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.403418 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25502] 10:12:36.403441 <... mmap resumed> ) = 0x7f3c0acee000
[pid 25495] 10:12:36.403469 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25492] 10:12:36.403495 <... fsync resumed> ) = 0
[pid 25473] 10:12:36.403521 <... close resumed> ) = 0
[pid 25458] 10:12:36.403556 <... open resumed> ) = 13
[pid 25503] 10:12:36.403584 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.403608 close(6 <unfinished ...>
[pid 25492] 10:12:36.403631 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.403654 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.403682 fstat(13,  <unfinished ...>
[pid 25503] 10:12:36.403713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.403743 <... close resumed> ) = 0
[pid 25492] 10:12:36.403769 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080154, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.403800 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.403820 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.403859 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.403888 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.403919 close(9 <unfinished ...>
[pid 25473] 10:12:36.403945 stat("/var/tmp",  <unfinished ...>
[pid 25458] 10:12:36.403975 fstat(13,  <unfinished ...>
[pid 25503] 10:12:36.404005 <... mmap resumed> ) = 0x7fbb7f4c8000
[pid 25502] 10:12:36.404022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.404039 <... close resumed> ) = 0
[pid 25473] 10:12:36.404055 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25458] 10:12:36.404104 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.404151 read(5,  <unfinished ...>
[pid 25502] 10:12:36.404180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.404216 munmap(0x7f638dcae000, 4096 <unfinished ...>
[pid 25473] 10:12:36.404245 brk(0x1140000 <unfinished ...>
[pid 25458] 10:12:36.404269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.404303 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.404340 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.404359 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.404382 <... brk resumed> ) = 0x1140000
[pid 25458] 10:12:36.404513 <... mmap resumed> ) = 0x7f03f4be4000
[pid 25503] 10:12:36.404630 close(5 <unfinished ...>
[pid 25502] 10:12:36.404659 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.404691 rename("/var/spool/exim/input/Z/hdr.25492", "/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-H" <unfinished ...>
[pid 25473] 10:12:36.404778 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.404811 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.404843 <... close resumed> ) = 0
[pid 25502] 10:12:36.404859 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.404880 <... rename resumed> ) = 0
[pid 25473] 10:12:36.404899 <... open resumed> ) = 17
[pid 25458] 10:12:36.404915 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.404939 munmap(0x7fbb7f4c8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.404967 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25492] 10:12:36.405001 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25473] 10:12:36.405031 fcntl(17, F_GETFD <unfinished ...>
[pid 25458] 10:12:36.405054 read(13,  <unfinished ...>
[pid 25503] 10:12:36.405084 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.405143 <... open resumed> ) = 6
[pid 25492] 10:12:36.405162 <... open resumed> ) = 9
[pid 25473] 10:12:36.405179 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.405194 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.405229 getpgrp( <unfinished ...>
[pid 25502] 10:12:36.405254 read(6,  <unfinished ...>
[pid 25492] 10:12:36.405278 fsync(9 <unfinished ...>
[pid 25473] 10:12:36.405301 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.405324 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25503] 10:12:36.405362 <... getpgrp resumed> ) = 29163
[pid 25502] 10:12:36.405380 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25492] 10:12:36.405404 <... fsync resumed> ) = 0
[pid 25473] 10:12:36.405420 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.405437 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25503] 10:12:36.405514 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.405643 fstat(6,  <unfinished ...>
[pid 25492] 10:12:36.405669 close(9 <unfinished ...>
[pid 25473] 10:12:36.405694 fstat(17,  <unfinished ...>
[pid 25458] 10:12:36.405717 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.405753 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.405779 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25492] 10:12:36.405811 <... close resumed> ) = 0
[pid 25473] 10:12:36.405829 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.405873 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.405919 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25502] 10:12:36.405945 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25492] 10:12:36.405975 close(8 <unfinished ...>
[pid 25473] 10:12:36.406000 pread(17,  <unfinished ...>
[pid 25458] 10:12:36.406025 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.406057 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25502] 10:12:36.406136 <... mmap resumed> ) = 0x7f3c0a6f1000
[pid 25492] 10:12:36.406157 <... close resumed> ) = 0
[pid 25473] 10:12:36.406173 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25458] 10:12:36.406221 <... lseek resumed> ) = 353
[pid 25503] 10:12:36.406280 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.406308 mprotect(0x7f3c0a77c000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.406338 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.406353 munmap(0x7f638dcaf000, 4096 <unfinished ...>
[pid 25473] 10:12:36.406385 pread(17,  <unfinished ...>
[pid 25458] 10:12:36.406410 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.406450 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.406481 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.406499 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25492] 10:12:36.406605 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.406639 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25458] 10:12:36.406681 <... open resumed> ) = 14
[pid 25503] 10:12:36.406713 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.406739 mmap(0x7f3c0a97c000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25495] 10:12:36.406777 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.406793 unlink("/var/spool/exim/input/Z/1aEJMZ-0006cz-RM-J" <unfinished ...>
[pid 25473] 10:12:36.406836 pread(17,  <unfinished ...>
[pid 25458] 10:12:36.406860 fstat(14,  <unfinished ...>
[pid 25503] 10:12:36.406892 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.406921 <... mmap resumed> ) = 0x7f3c0a97c000
[pid 25495] 10:12:36.406944 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25492] 10:12:36.406971 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.406989 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25458] 10:12:36.407037 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25503] 10:12:36.407080 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25502] 10:12:36.407104 mmap(0x7f3c0a97f000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.407133 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.407148 close(6 <unfinished ...>
[pid 25473] 10:12:36.407178 close(17 <unfinished ...>
[pid 25458] 10:12:36.407202 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.407236 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25502] 10:12:36.407311 <... mmap resumed> ) = 0x7f3c0a97f000
[pid 25495] 10:12:36.407339 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25492] 10:12:36.407367 <... close resumed> ) = 0
[pid 25473] 10:12:36.407516 <... close resumed> ) = 0
[pid 25458] 10:12:36.407637 <... mmap resumed> ) = 0x7f03f4be3000
[pid 25503] 10:12:36.407669 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.407697 close(6 <unfinished ...>
[pid 25495] 10:12:36.407721 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25492] 10:12:36.407736 exit_group(0) = ?
[pid 25473] 10:12:36.408354 close(16 <unfinished ...>
[pid 25458] 10:12:36.408397 read(14,  <unfinished ...>
[pid 25503] 10:12:36.408497 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.408521 <... close resumed> ) = 0
[pid 25495] 10:12:36.408596 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25492] 10:12:36.408626 +++ exited with 0 +++
[pid 25473] 10:12:36.408638 <... close resumed> ) = 0
[pid 25458] 10:12:36.408665 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25503] 10:12:36.408702 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.408729 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.408762 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.408783 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.408810 close(14 <unfinished ...>
[pid 25503] 10:12:36.408841 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.408861 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.408879 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25473] 10:12:36.408905 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.408922 <... close resumed> ) = 0
[pid 25503] 10:12:36.408945 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0},  <unfinished ...>
[pid 25502] 10:12:36.408971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.409007 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.409022 read(13,  <unfinished ...>
[pid 25458] 10:12:36.409053 munmap(0x7f03f4be3000, 4096 <unfinished ...>
[pid 25503] 10:12:36.409088 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7fbb7eb246a0}, 8) = 0
[pid 25502] 10:12:36.409112 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.409130 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25473] 10:12:36.409162 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25458] 10:12:36.409194 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.409236 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25502] 10:12:36.409483 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.409517 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.409658 stat("/jail_owner",  <unfinished ...>
[pid 25458] 10:12:36.409692 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:36.409735 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.409756 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25473] 10:12:36.409786 <... stat resumed> 0x7ffdac33b840) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.409810 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.409842 <... execve resumed> ) = 0
[pid 25502] 10:12:36.409876 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.409913 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.409927 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.409964 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.409999 brk(0 <unfinished ...>
[pid 25502] 10:12:36.410021 <... open resumed> ) = 6
[pid 25495] 10:12:36.410037 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25473] 10:12:36.410065 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.410104 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.410159 <... brk resumed> ) = 0x1914000
[pid 25502] 10:12:36.410180 read(6,  <unfinished ...>
[pid 25495] 10:12:36.410205 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.410219 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.410252 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.410287 fcntl(0, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.410310 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.410334 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25473] 10:12:36.410364 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.410388 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.410433 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.410451 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.410802 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.410835 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.410898 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.410962 fcntl(1, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.411003 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25495] 10:12:36.411060 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25473] 10:12:36.411121 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.411183 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.411276 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.411312 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.411366 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.411394 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.411449 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.411512 fcntl(2, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.411657 <... mmap resumed> ) = 0x7f3c0a4eb000
[pid 25495] 10:12:36.411682 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25473] 10:12:36.411719 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.411745 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
Process 25505 attached
[pid 25503] 10:12:36.411818 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.411860 mprotect(0x7f3c0a4f1000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.411894 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25473] 10:12:36.411922 stat("/etc/demouids",  <unfinished ...>
[pid 25458] 10:12:36.411955 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.411991 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25503] 10:12:36.412014 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25502] 10:12:36.412043 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.412059 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.412092 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.412143 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.412195 <... set_robust_list resumed> ) = 0
[pid 25503] 10:12:36.412211 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.412270 mmap(0x7f3c0a6f0000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25495] 10:12:36.412305 <... open resumed> ) = 9
[pid 25473] 10:12:36.412319 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25458] 10:12:36.412360 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.412396 close(13 <unfinished ...>
[pid 25503] 10:12:36.412418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.412445 <... mmap resumed> ) = 0x7f3c0a6f0000
[pid 25495] 10:12:36.412467 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:36.412500 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.412698 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.412770 <... close resumed> ) = 0
[pid 25503] 10:12:36.412789 <... mmap resumed> ) = 0x7fd60cb39000
[pid 25502] 10:12:36.412823 close(6 <unfinished ...>
[pid 25495] 10:12:36.412849 <... ioctl resumed> , 0x7ffd50fbf050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:36.412864 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.412894 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25505] 10:12:36.412929 geteuid( <unfinished ...>
[pid 25503] 10:12:36.412950 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25502] 10:12:36.412978 <... close resumed> ) = 0
[pid 25495] 10:12:36.413003 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.413027 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.413071 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25505] 10:12:36.413104 <... geteuid resumed> ) = 0
[pid 25503] 10:12:36.413119 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.413146 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.413180 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.413194 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.413261 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25505] 10:12:36.413299 getegid( <unfinished ...>
[pid 25503] 10:12:36.413323 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.413352 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.413370 read(9,  <unfinished ...>
[pid 25473] 10:12:36.413394 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.413431 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25505] 10:12:36.413480 <... getegid resumed> ) = 12
[pid 25503] 10:12:36.413496 <... open resumed> ) = 5
[pid 25502] 10:12:36.413595 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.413638 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25473] 10:12:36.413657 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25458] 10:12:36.413877 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25505] 10:12:36.413919 setgid(500 <unfinished ...>
[pid 25503] 10:12:36.413941 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.413965 <... open resumed> ) = 6
[pid 25495] 10:12:36.413987 brk(0xd8b000 <unfinished ...>
[pid 25473] 10:12:36.414012 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.414052 <... open resumed> ) = 14
[pid 25505] 10:12:36.414081 <... setgid resumed> ) = 0
[pid 25503] 10:12:36.414095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.414125 read(6,  <unfinished ...>
[pid 25495] 10:12:36.414150 <... brk resumed> ) = 0xd8b000
[pid 25473] 10:12:36.414163 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.414700 fstat(14,  <unfinished ...>
[pid 25505] 10:12:36.414738 setuid(503 <unfinished ...>
[pid 25503] 10:12:36.414763 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.414790 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.414817 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.414845 <... open resumed> ) = 16
[pid 25458] 10:12:36.414864 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25505] 10:12:36.414914 <... setuid resumed> ) = 0
[pid 25503] 10:12:36.414929 <... mmap resumed> ) = 0x7fd60cb2f000
[pid 25502] 10:12:36.414977 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.415003 <... lseek resumed> ) = 4868
[pid 25473] 10:12:36.415017 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.415041 fstat(14,  <unfinished ...>
[pid 25505] 10:12:36.415072 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.415102 close(5 <unfinished ...>
[pid 25502] 10:12:36.415125 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25495] 10:12:36.415154 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.415177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.415208 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25505] 10:12:36.415244 <... open resumed> ) = 9
[pid 25503] 10:12:36.415258 <... close resumed> ) = 0
[pid 25502] 10:12:36.415295 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.415324 <... lseek resumed> ) = 4868
[pid 25473] 10:12:36.415338 fstat(16,  <unfinished ...>
[pid 25458] 10:12:36.415363 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25505] 10:12:36.415397 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.415424 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.415457 <... mmap resumed> ) = 0x7f3c0be40000
[pid 25495] 10:12:36.415480 close(9 <unfinished ...>
[pid 25473] 10:12:36.415505 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.415620 <... mmap resumed> ) = 0x7f03f4be3000
[pid 25505] 10:12:36.415647 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.415672 <... open resumed> ) = 5
[pid 25502] 10:12:36.415756 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.415788 <... close resumed> ) = 0
[pid 25473] 10:12:36.415802 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.415847 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25505] 10:12:36.415881 brk(0x17f0000 <unfinished ...>
[pid 25503] 10:12:36.415904 read(5,  <unfinished ...>
[pid 25502] 10:12:36.415928 <... mmap resumed> ) = 0x7f3c0a1b5000
[pid 25495] 10:12:36.415944 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.415971 <... mmap resumed> ) = 0x7f7c15ca1000
[pid 25458] 10:12:36.415987 <... lseek resumed> ) = 0
[pid 25505] 10:12:36.416013 <... brk resumed> ) = 0x17f0000
[pid 25503] 10:12:36.416026 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.416121 mprotect(0x7f3c0a2e1000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.416153 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.416168 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.416193 read(14,  <unfinished ...>
[pid 25505] 10:12:36.416224 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.416246 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.416268 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.416285 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.416314 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.416332 <... read resumed> "", 4096) = 0
[pid 25505] 10:12:36.416382 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.416416 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.416451 mmap(0x7f3c0a4e1000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25495] 10:12:36.416488 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.416586 read(16,  <unfinished ...>
[pid 25458] 10:12:36.416627 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25505] 10:12:36.416667 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.416694 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.416726 <... mmap resumed> ) = 0x7f3c0a4e1000
[pid 25495] 10:12:36.416748 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.416774 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25458] 10:12:36.416835 <... open resumed> ) = 15
[pid 25505] 10:12:36.416867 <... mmap resumed> ) = 0x7f33164fa000
[pid 25503] 10:12:36.416882 <... mmap resumed> ) = 0x7fd60c587000
[pid 25502] 10:12:36.416900 mmap(0x7f3c0a4ea000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.416929 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.416944 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25458] 10:12:36.416978 fstat(15,  <unfinished ...>
[pid 25505] 10:12:36.417010 read(9,  <unfinished ...>
[pid 25503] 10:12:36.417043 mprotect(0x7fd60c711000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.417076 <... mmap resumed> ) = 0x7f3c0a4ea000
[pid 25495] 10:12:36.417098 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.417124 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4116, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.417171 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25505] 10:12:36.417212 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25503] 10:12:36.417230 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.417247 close(6 <unfinished ...>
[pid 25495] 10:12:36.417270 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.417284 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.417320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25505] 10:12:36.417355 read(9,  <unfinished ...>
[pid 25503] 10:12:36.417381 mmap(0x7fd60c911000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25502] 10:12:36.417412 <... close resumed> ) = 0
[pid 25495] 10:12:36.417437 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.417464 <... open resumed> ) = 17
[pid 25458] 10:12:36.417482 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25505] 10:12:36.417585 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25503] 10:12:36.417610 <... mmap resumed> ) = 0x7fd60c911000
[pid 25502] 10:12:36.417637 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.417669 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.417684 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25458] 10:12:36.417716 read(15,  <unfinished ...>
[pid 25505] 10:12:36.417758 close(9 <unfinished ...>
[pid 25503] 10:12:36.417788 mmap(0x7fd60c916000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.417818 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.417835 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.417861 <... ioctl resumed> , 0x7ffdac3387e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25458] 10:12:36.417879 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25505] 10:12:36.417913 <... close resumed> ) = 0
[pid 25503] 10:12:36.417927 <... mmap resumed> ) = 0x7fd60c916000
[pid 25502] 10:12:36.417950 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.417985 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.418000 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25458] 10:12:36.418029 close(15 <unfinished ...>
[pid 25505] 10:12:36.418062 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25503] 10:12:36.418087 close(5 <unfinished ...>
[pid 25502] 10:12:36.418110 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.418127 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.418157 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.418175 <... close resumed> ) = 0
[pid 25505] 10:12:36.418200 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.418213 <... close resumed> ) = 0
[pid 25502] 10:12:36.418741 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.418786 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.418802 fstat(17,  <unfinished ...>
[pid 25458] 10:12:36.418828 munmap(0x7f03f4be2000, 4096 <unfinished ...>
[pid 25505] 10:12:36.418865 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.418888 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.418915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.418934 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.418965 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4116, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25458] 10:12:36.418995 <... munmap resumed> ) = 0
[pid 25505] 10:12:36.419036 <... lseek resumed> ) = 19
[pid 25503] 10:12:36.419052 <... mmap resumed> ) = 0x7fd60cb2e000
[pid 25502] 10:12:36.419075 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.419108 <... stat resumed> 0x7ffd50fbf260) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.419123 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.419153 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.419187 read(6,  <unfinished ...>
[pid 25503] 10:12:36.419210 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.419235 <... open resumed> ) = 6
[pid 25495] 10:12:36.419251 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25473] 10:12:36.419279 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.419304 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.419367 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2420) = 1858
[pid 25503] 10:12:36.419389 <... mmap resumed> ) = 0x7fd60cb2d000
[pid 25502] 10:12:36.419925 read(6,  <unfinished ...>
[pid 25495] 10:12:36.419958 <... stat resumed> 0x7ffd50fbf300) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.419974 read(17,  <unfinished ...>
[pid 25458] 10:12:36.420001 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25505] 10:12:36.420037 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.420068 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.420095 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.420118 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25473] 10:12:36.420148 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4116
[pid 25458] 10:12:36.420790 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25505] 10:12:36.420838 <... write resumed> ) = 4
[pid 25503] 10:12:36.420855 <... mmap resumed> ) = 0x7fd60cb2c000
[pid 25502] 10:12:36.420877 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.420902 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25491] 10:12:36.420930 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25473] 10:12:36.420953 read(17,  <unfinished ...>
[pid 25458] 10:12:36.420976 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.421012 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.421035 arch_prctl(ARCH_SET_FS, 0x7fd60cb2d700 <unfinished ...>
[pid 25502] 10:12:36.421058 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.421088 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.421120 read(13,  <unfinished ...>
[pid 25473] 10:12:36.421144 <... read resumed> "", 8192) = 0
[pid 25458] 10:12:36.421165 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.421212 <... write resumed> ) = 4
[pid 25503] 10:12:36.421227 <... arch_prctl resumed> ) = 0
[pid 25502] 10:12:36.421318 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.421355 <... open resumed> ) = 9
[pid 25491] 10:12:36.421368 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25473] 10:12:36.421397 close(17 <unfinished ...>
[pid 25458] 10:12:36.421433 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25505] 10:12:36.421475 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.421499 mprotect(0x7fd60c911000, 16384, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.421595 <... mmap resumed> ) = 0x7f3c09fb1000
[pid 25495] 10:12:36.421614 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.421639 read(13,  <unfinished ...>
[pid 25473] 10:12:36.421662 <... close resumed> ) = 0
[pid 25458] 10:12:36.421700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25505] 10:12:36.421758 <... write resumed> ) = 4
[pid 25503] 10:12:36.421774 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.421797 mprotect(0x7f3c09fb3000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.421826 <... ioctl resumed> , 0x7ffd50fbf050) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.421841 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.421865 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.421892 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25505] 10:12:36.421929 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25503] 10:12:36.421953 mprotect(0x7fd60cb3a000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.421979 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.421995 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.422017 read(13,  <unfinished ...>
[pid 25473] 10:12:36.422042 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.422087 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25505] 10:12:36.422122 <... write resumed> ) = 40
[pid 25503] 10:12:36.422137 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.422155 mmap(0x7f3c0a1b3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25495] 10:12:36.422186 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.422199 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25473] 10:12:36.422238 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.422268 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.422304 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.422328 munmap(0x7fd60cb2f000, 39387 <unfinished ...>
[pid 25502] 10:12:36.422356 <... mmap resumed> ) = 0x7f3c0a1b3000
[pid 25495] 10:12:36.422381 read(9,  <unfinished ...>
[pid 25491] 10:12:36.422407 read(13,  <unfinished ...>
[pid 25473] 10:12:36.422432 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.422468 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.422603 <... write resumed> ) = 4
[pid 25503] 10:12:36.422624 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.422678 close(6 <unfinished ...>
[pid 25495] 10:12:36.422704 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25491] 10:12:36.422729 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.423169 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.423209 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25505] 10:12:36.423248 close(14 <unfinished ...>
[pid 25503] 10:12:36.423271 getuid( <unfinished ...>
[pid 25502] 10:12:36.423294 <... close resumed> ) = 0
[pid 25495] 10:12:36.423318 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.423342 wait4(-1,  <unfinished ...>
[pid 25473] 10:12:36.423365 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.423422 <... stat resumed> 0x7ffc7ad96990) = -1 ENOENT (No such file or directory)
[pid 25505] 10:12:36.423463 <... close resumed> ) = 0
[pid 25503] 10:12:36.423479 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.423579 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.423619 <... lseek resumed> ) = 2366
[pid 25473] 10:12:36.423633 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.423664 stat("/etc/userdomains",  <unfinished ...>
[pid 25505] 10:12:36.423699 exit_group(0) = ?
[pid 25503] 10:12:36.423713 getgid( <unfinished ...>
[pid 25502] 10:12:36.424016 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.424037 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.424060 <... open resumed> ) = 17
[pid 25458] 10:12:36.424077 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25505] 10:12:36.424139 +++ exited with 0 +++
[pid 25503] 10:12:36.424155 <... getgid resumed> ) = 500
[pid 25502] 10:12:36.424172 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.424206 <... lseek resumed> ) = 2366
[pid 25491] 10:12:36.424219 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25505
[pid 25473] 10:12:36.424241 fstat(17,  <unfinished ...>
[pid 25458] 10:12:36.424264 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.424300 getegid( <unfinished ...>
[pid 25502] 10:12:36.424322 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.424339 close(9 <unfinished ...>
[pid 25491] 10:12:36.424362 close(13 <unfinished ...>
[pid 25473] 10:12:36.424388 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.424417 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.424583 <... getegid resumed> ) = 499
[pid 25502] 10:12:36.424611 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.424645 <... close resumed> ) = 0
[pid 25491] 10:12:36.424658 <... close resumed> ) = 0
[pid 25473] 10:12:36.424996 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.425034 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.425076 getppid( <unfinished ...>
[pid 25502] 10:12:36.425100 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.425120 read(8,  <unfinished ...>
[pid 25491] 10:12:36.425149 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25473] 10:12:36.425181 <... mmap resumed> ) = 0x7f7c15ca0000
[pid 25458] 10:12:36.425198 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.425224 <... getppid resumed> ) = 25389
[pid 25502] 10:12:36.425243 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.425280 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.425295 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25473] 10:12:36.425339 read(17,  <unfinished ...>
[pid 25458] 10:12:36.425372 read(14,  <unfinished ...>
[pid 25503] 10:12:36.425404 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25502] 10:12:36.425433 <... open resumed> ) = 6
[pid 25495] 10:12:36.425450 close(8 <unfinished ...>
[pid 25491] 10:12:36.425473 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.425499 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:36.425604 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.425663 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25502] 10:12:36.425742 read(6,  <unfinished ...>
[pid 25495] 10:12:36.425768 <... close resumed> ) = 0
[pid 25491] 10:12:36.425781 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.426020 close(17 <unfinished ...>
[pid 25458] 10:12:36.426054 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.426157 brk(0 <unfinished ...>
[pid 25502] 10:12:36.426181 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.426206 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.426234 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.426266 <... close resumed> ) = 0
[pid 25458] 10:12:36.426284 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.426335 <... brk resumed> ) = 0x1914000
[pid 25502] 10:12:36.426355 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.426378 <... open resumed> ) = 8
[pid 25491] 10:12:36.426391 <... open resumed> ) = 9
[pid 25473] 10:12:36.426411 munmap(0x7f7c15ca0000, 4096 <unfinished ...>
[pid 25458] 10:12:36.426440 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.426479 brk(0x1935000 <unfinished ...>
[pid 25502] 10:12:36.426503 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.426613 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.426643 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.426666 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.426696 <... open resumed> ) = 15
[pid 25503] 10:12:36.426724 <... brk resumed> ) = 0x1935000
[pid 25502] 10:12:36.426759 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.426792 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.426818 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.426851 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.426882 fstat(15,  <unfinished ...>
[pid 25503] 10:12:36.426914 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.426943 <... mmap resumed> ) = 0x7f3c09dae000
[pid 25495] 10:12:36.426960 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.426985 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.427007 <... open resumed> ) = 17
[pid 25458] 10:12:36.427024 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.427064 <... socket resumed> ) = 5
[pid 25502] 10:12:36.427081 mprotect(0x7f3c09db0000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.427109 <... mmap resumed> ) = 0x7efcd42a7000
[pid 25491] 10:12:36.427122 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.427156 fstat(17,  <unfinished ...>
[pid 25458] 10:12:36.427179 fstat(15,  <unfinished ...>
[pid 25503] 10:12:36.427210 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.427248 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.427265 read(8,  <unfinished ...>
[pid 25491] 10:12:36.427290 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.427316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.427343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.427379 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.427396 mmap(0x7f3c09faf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25495] 10:12:36.427426 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.427444 <... mmap resumed> ) = 0x7f33164fa000
[pid 25473] 10:12:36.427469 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.427496 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.427647 close(5 <unfinished ...>
[pid 25502] 10:12:36.427676 <... mmap resumed> ) = 0x7f3c09faf000
[pid 25495] 10:12:36.427702 close(8 <unfinished ...>
[pid 25491] 10:12:36.427727 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.427751 <... mmap resumed> ) = 0x7f7c15ca0000
[pid 25458] 10:12:36.427767 <... mmap resumed> ) = 0x7f03f4be2000
[pid 25503] 10:12:36.427792 <... close resumed> ) = 0
[pid 25502] 10:12:36.427808 close(6 <unfinished ...>
[pid 25495] 10:12:36.427830 <... close resumed> ) = 0
[pid 25491] 10:12:36.427843 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.427861 read(17,  <unfinished ...>
[pid 25458] 10:12:36.427887 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.427918 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.427945 <... close resumed> ) = 0
[pid 25495] 10:12:36.427969 munmap(0x7efcd42a7000, 4096 <unfinished ...>
[pid 25491] 10:12:36.427996 read(9,  <unfinished ...>
[pid 25473] 10:12:36.428023 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.428055 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.428082 <... socket resumed> ) = 5
[pid 25502] 10:12:36.428098 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.428129 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.428143 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:36.428226 close(17 <unfinished ...>
[pid 25458] 10:12:36.428258 read(15,  <unfinished ...>
[pid 25503] 10:12:36.428290 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.428326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.428344 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25491] 10:12:36.428367 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.428393 <... close resumed> ) = 0
[pid 25458] 10:12:36.428408 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.428441 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.428460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.428493 <... lseek resumed> ) = 19
[pid 25491] 10:12:36.428586 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.428636 munmap(0x7f7c15ca0000, 4096 <unfinished ...>
[pid 25458] 10:12:36.428667 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.428705 close(5 <unfinished ...>
[pid 25502] 10:12:36.428731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.428748 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.428775 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.428800 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.428825 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25503] 10:12:36.428881 <... close resumed> ) = 0
[pid 25502] 10:12:36.428910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.428948 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.428962 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.429024 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.429057 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.429095 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.429123 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.429143 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.429169 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25473] 10:12:36.429201 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.429229 <... open resumed> ) = 16
[pid 25503] 10:12:36.429254 <... open resumed> ) = 5
[pid 25502] 10:12:36.429278 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.429310 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.429324 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.429348 pipe( <unfinished ...>
[pid 25458] 10:12:36.429375 fstat(16,  <unfinished ...>
[pid 25503] 10:12:36.429406 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.429429 <... open resumed> ) = 6
[pid 25495] 10:12:36.429444 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.429472 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.429499 <... pipe resumed> [17, 18]) = 0
[pid 25458] 10:12:36.429597 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25503] 10:12:36.429646 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25502] 10:12:36.429682 read(6,  <unfinished ...>
[pid 25495] 10:12:36.429708 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.429721 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.429762 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25458] 10:12:36.429792 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.429828 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.429853 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.429878 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.429911 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.429941 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25458] 10:12:36.429962 <... mmap resumed> ) = 0x7f03f4be1000
[pid 25503] 10:12:36.429989 <... mmap resumed> ) = 0x7fd60cb38000
[pid 25502] 10:12:36.430005 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.430028 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.430041 <... open resumed> ) = 10
[pid 25473] 10:12:36.430060 close(15 <unfinished ...>
[pid 25458] 10:12:36.430084 read(16,  <unfinished ...>
[pid 25503] 10:12:36.430120 read(5,  <unfinished ...>
[pid 25502] 10:12:36.430146 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25495] 10:12:36.430175 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.430200 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.430222 <... close resumed> ) = 0
[pid 25458] 10:12:36.430238 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25503] 10:12:36.430271 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25502] 10:12:36.430309 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.430337 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.430351 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.430387 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25458] 10:12:36.430416 close(16 <unfinished ...>
[pid 25503] 10:12:36.430449 read(5,  <unfinished ...>
[pid 25502] 10:12:36.430474 <... mmap resumed> ) = 0x7f3c0be3f000
[pid 25495] 10:12:36.430495 alarm(300 <unfinished ...>
[pid 25491] 10:12:36.430625 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.430651 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.430669 <... close resumed> ) = 0
[pid 25503] 10:12:36.430694 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.430714 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.430744 <... alarm resumed> ) = 0
[pid 25491] 10:12:36.430758 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.430788 close(14 <unfinished ...>
[pid 25458] 10:12:36.430812 munmap(0x7f03f4be1000, 4096 <unfinished ...>
[pid 25503] 10:12:36.430848 close(5 <unfinished ...>
[pid 25502] 10:12:36.430872 <... mmap resumed> ) = 0x7f3c09a1a000
[pid 25495] 10:12:36.430888 alarm(0 <unfinished ...>
[pid 25491] 10:12:36.430909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.430934 <... close resumed> ) = 0
[pid 25458] 10:12:36.430950 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.430990 <... close resumed> ) = 0
[pid 25502] 10:12:36.431009 mprotect(0x7f3c09ba4000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.431037 <... alarm resumed> ) = 300
[pid 25491] 10:12:36.431056 <... mmap resumed> ) = 0x7f33164f9000
[pid 25473] 10:12:36.431075 munmap(0x7f7c15ca3000, 4096 <unfinished ...>
[pid 25458] 10:12:36.431100 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.431139 munmap(0x7fd60cb38000, 4096 <unfinished ...>
[pid 25502] 10:12:36.431164 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.431180 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.431206 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.431229 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.431246 <... open resumed> ) = 16
[pid 25503] 10:12:36.431272 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.431299 mmap(0x7f3c09da4000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25495] 10:12:36.431331 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.431346 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.431372 close(9 <unfinished ...>
[pid 25458] 10:12:36.431400 fstat(16,  <unfinished ...>
[pid 25503] 10:12:36.431434 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.431463 <... mmap resumed> ) = 0x7f3c09da4000
[pid 25495] 10:12:36.431484 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.431577 read(10,  <unfinished ...>
[pid 25473] 10:12:36.431611 <... close resumed> ) = 0
[pid 25458] 10:12:36.431627 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25503] 10:12:36.431669 <... open resumed> ) = 5
[pid 25502] 10:12:36.431688 mmap(0x7f3c09da9000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.431717 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.431734 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25473] 10:12:36.431780 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25458] 10:12:36.431812 fstat(16,  <unfinished ...>
[pid 25503] 10:12:36.431844 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.431867 <... mmap resumed> ) = 0x7f3c09da9000
[pid 25495] 10:12:36.431888 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.431916 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.431944 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.431962 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25503] 10:12:36.431999 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.432026 close(6 <unfinished ...>
[pid 25495] 10:12:36.432049 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.432065 <... open resumed> ) = 11
[pid 25473] 10:12:36.432083 close(13 <unfinished ...>
[pid 25458] 10:12:36.432108 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.432143 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.432168 <... close resumed> ) = 0
[pid 25495] 10:12:36.432193 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.432220 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.432242 <... close resumed> ) = 0
[pid 25458] 10:12:36.432258 <... mmap resumed> ) = 0x7f03f4be1000
[pid 25503] 10:12:36.432288 <... mmap resumed> ) = 0x7fd60cb2f000
[pid 25502] 10:12:36.432305 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.432336 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.432352 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.432380 munmap(0x7f7c15ca4000, 4096 <unfinished ...>
[pid 25458] 10:12:36.432406 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.432438 close(5 <unfinished ...>
[pid 25502] 10:12:36.432459 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.432479 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7efcd315f790},  <unfinished ...>
[pid 25491] 10:12:36.432505 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.432620 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.432638 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.432664 <... close resumed> ) = 0
[pid 25502] 10:12:36.432691 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.432727 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.432745 <... mmap resumed> ) = 0x7f33164f8000
[pid 25473] 10:12:36.432762 close(12 <unfinished ...>
[pid 25458] 10:12:36.432786 read(16,  <unfinished ...>
[pid 25503] 10:12:36.432821 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.432853 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.432871 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25491] 10:12:36.432899 read(11,  <unfinished ...>
[pid 25473] 10:12:36.432925 <... close resumed> ) = 0
[pid 25458] 10:12:36.432942 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25503] 10:12:36.432985 <... open resumed> ) = 5
[pid 25502] 10:12:36.433002 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.433031 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, 8) = 0
[pid 25491] 10:12:36.433051 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.433081 munmap(0x7f7c15ca5000, 4096 <unfinished ...>
[pid 25458] 10:12:36.433107 read(16,  <unfinished ...>
[pid 25503] 10:12:36.433138 read(5,  <unfinished ...>
[pid 25502] 10:12:36.433161 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.433180 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25491] 10:12:36.433207 close(11 <unfinished ...>
[pid 25473] 10:12:36.433231 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.433248 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.433286 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.433317 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.433353 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, 8) = 0
[pid 25491] 10:12:36.433380 <... close resumed> ) = 0
[pid 25473] 10:12:36.433397 close(16 <unfinished ...>
[pid 25458] 10:12:36.433420 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.433457 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.433480 <... open resumed> ) = 6
[pid 25495] 10:12:36.433495 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.433605 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25473] 10:12:36.433633 <... close resumed> ) = 0
[pid 25458] 10:12:36.433649 <... open resumed> ) = 17
[pid 25503] 10:12:36.433675 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.433713 read(6,  <unfinished ...>
[pid 25495] 10:12:36.433738 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.433779 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.433847 munmap(0x7f7c15ca1000, 4096 <unfinished ...>
[pid 25458] 10:12:36.433878 fstat(17,  <unfinished ...>
[pid 25503] 10:12:36.433910 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25502] 10:12:36.433938 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.433962 open("/var/spool/exim/input/a/hdr.25495", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25491] 10:12:36.434037 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.434067 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.434085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25503] 10:12:36.434123 <... mmap resumed> ) = 0x7fd60c379000
[pid 25502] 10:12:36.434139 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.434162 <... open resumed> ) = 8
[pid 25491] 10:12:36.434178 <... open resumed> ) = 11
[pid 25473] 10:12:36.434194 close(11 <unfinished ...>
[pid 25458] 10:12:36.434218 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.434253 mprotect(0x7fd60c385000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.434281 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25495] 10:12:36.434311 fchown(8, 47, 12 <unfinished ...>
[pid 25491] 10:12:36.434340 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.434362 <... close resumed> ) = 0
[pid 25458] 10:12:36.434378 <... mmap resumed> ) = 0x7f03f4be0000
[pid 25503] 10:12:36.434403 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.434419 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.434454 <... fchown resumed> ) = 0
[pid 25491] 10:12:36.434472 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.434503 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25458] 10:12:36.434615 read(17,  <unfinished ...>
[pid 25503] 10:12:36.434653 mmap(0x7fd60c585000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25502] 10:12:36.434683 <... mmap resumed> ) = 0x7f3c097ae000
[pid 25495] 10:12:36.434700 fchmod(8, 0640 <unfinished ...>
[pid 25491] 10:12:36.434726 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.434748 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.434765 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25503] 10:12:36.434807 <... mmap resumed> ) = 0x7fd60c585000
[pid 25502] 10:12:36.434833 mprotect(0x7f3c09810000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.434862 <... fchmod resumed> ) = 0
[pid 25491] 10:12:36.434879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.434907 close(10 <unfinished ...>
[pid 25458] 10:12:36.434931 close(17 <unfinished ...>
[pid 25503] 10:12:36.434963 close(5 <unfinished ...>
[pid 25502] 10:12:36.434985 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.435001 fcntl(8, F_GETFL <unfinished ...>
[pid 25491] 10:12:36.435024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.435050 <... close resumed> ) = 0
[pid 25458] 10:12:36.435065 <... close resumed> ) = 0
[pid 25503] 10:12:36.435089 <... close resumed> ) = 0
[pid 25502] 10:12:36.435121 mmap(0x7f3c09a0f000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25495] 10:12:36.435152 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25491] 10:12:36.435179 <... mmap resumed> ) = 0x7f33164f8000
[pid 25473] 10:12:36.435197 munmap(0x7f7c15ca7000, 4096 <unfinished ...>
[pid 25458] 10:12:36.435221 munmap(0x7f03f4be0000, 4096 <unfinished ...>
[pid 25503] 10:12:36.435256 mprotect(0x7fd60c585000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.435282 <... mmap resumed> ) = 0x7f3c09a0f000
[pid 25495] 10:12:36.435307 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.435333 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.435355 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.435374 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.435411 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.435432 close(6 <unfinished ...>
[pid 25495] 10:12:36.435456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.435486 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.435503 clone( <unfinished ...>
[pid 25458] 10:12:36.435863 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.435905 munmap(0x7fd60cb2f000, 39387 <unfinished ...>
[pid 25502] 10:12:36.435934 <... close resumed> ) = 0
[pid 25495] 10:12:36.435961 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.435989 read(11,  <unfinished ...>
[pid 25458] 10:12:36.436017 <... open resumed> ) = 17
[pid 25503] 10:12:36.436043 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.436066 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.436104 <... mmap resumed> ) = 0x7efcd42a7000
[pid 25491] 10:12:36.436121 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25473] 10:12:36.436156 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25506
[pid 25458] 10:12:36.436196 fstat(17,  <unfinished ...>
[pid 25503] 10:12:36.436231 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.436261 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.436279 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.436321 stat("/jail_owner",  <unfinished ...>
[pid 25473] 10:12:36.436360 close(18 <unfinished ...>
[pid 25458] 10:12:36.436383 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25503] 10:12:36.436425 <... open resumed> ) = 5
[pid 25502] 10:12:36.436446 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.436481 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.436578 <... stat resumed> 0x7ffc86158950) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.436609 <... close resumed> ) = 0
[pid 25458] 10:12:36.436627 fstat(17,  <unfinished ...>
[pid 25503] 10:12:36.436660 fcntl(5, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.436683 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.436700 write(8, "1aEJMa-0006dD-AR-H\nmailnull 47 12\n<>\n1451491956 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25491] 10:12:36.436738 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25473] 10:12:36.436769 read(17,  <unfinished ...>
[pid 25458] 10:12:36.436790 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25503] 10:12:36.436826 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25502] 10:12:36.436847 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.436879 <... write resumed> ) = 268
[pid 25491] 10:12:36.436895 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.436931 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.436966 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.436989 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.437009 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.437032 stat("/usr/local/cpanel/3rdparty/mailman/lists/courtyardavondale_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.437064 <... mmap resumed> ) = 0x7f03f4be0000
[pid 25503] 10:12:36.437088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.437122 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.437154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.437187 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.437212 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.437244 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.437269 <... open resumed> ) = 6
[pid 25495] 10:12:36.437285 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMa-0006dD-AR\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:36 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692 <unfinished ...>
[pid 25491] 10:12:36.437316 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.437344 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.437368 <... mmap resumed> ) = 0x7fd60cb38000
[pid 25502] 10:12:36.437384 read(6,  <unfinished ...>
[pid 25495] 10:12:36.437408 <... write resumed> ) = 692
[pid 25491] 10:12:36.437424 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.437457 read(17,  <unfinished ...>
[pid 25503] 10:12:36.437489 read(5,  <unfinished ...>
[pid 25502] 10:12:36.437618 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.437646 fsync(8 <unfinished ...>
[pid 25491] 10:12:36.437720 stat("/usr/local/cpanel/3rdparty/mailman/lists/courtyardavondale/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.437753 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.437801 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.437906 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.437931 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.437954 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.437990 close(5 <unfinished ...>
[pid 25502] 10:12:36.438014 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25491] 10:12:36.438045 stat("/etc/demouids",  <unfinished ...>
[pid 25458] 10:12:36.438072 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.438124 <... close resumed> ) = 0
[pid 25502] 10:12:36.438142 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.438173 <... fsync resumed> ) = 0
[pid 25491] 10:12:36.438195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.438240 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.438278 munmap(0x7fd60cb38000, 4096 <unfinished ...>
[pid 25502] 10:12:36.438306 <... mmap resumed> ) = 0x7f3c093cb000
[pid 25495] 10:12:36.438323 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.438346 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.438375 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.438420 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.438446 mprotect(0x7f3c09584000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.438475 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.438505 <... open resumed> ) = 12
[pid 25458] 10:12:36.438607 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.438643 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.438672 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.438688 close(8 <unfinished ...>
[pid 25491] 10:12:36.438714 fstat(12,  <unfinished ...>
[pid 25458] 10:12:36.438736 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.438782 <... socket resumed> ) = 5
[pid 25502] 10:12:36.438800 mmap(0x7f3c09783000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25495] 10:12:36.438831 <... close resumed> ) = 0
[pid 25491] 10:12:36.438848 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.438879 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.438913 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.438950 <... mmap resumed> ) = 0x7f3c09783000
[pid 25495] 10:12:36.438972 munmap(0x7efcd42a7000, 4096 <unfinished ...>
[pid 25491] 10:12:36.438999 fstat(12,  <unfinished ...>
[pid 25458] 10:12:36.439022 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.439070 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.439090 mmap(0x7f3c097aa000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.439119 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.439142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.439171 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.439205 close(5 <unfinished ...>
[pid 25502] 10:12:36.439231 <... mmap resumed> ) = 0x7f3c097aa000
[pid 25495] 10:12:36.439253 rename("/var/spool/exim/input/a/hdr.25495", "/var/spool/exim/input/a/1aEJMa-0006dD-AR-H" <unfinished ...>
[pid 25491] 10:12:36.439318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.439345 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.439410 <... close resumed> ) = 0
[pid 25502] 10:12:36.439437 close(6 <unfinished ...>
[pid 25495] 10:12:36.439461 <... rename resumed> ) = 0
[pid 25491] 10:12:36.439479 <... mmap resumed> ) = 0x7f33164f7000
[pid 25458] 10:12:36.439496 write(8, "2015-12-30 10:12:36 routing failed for finest09@fin.finestweddingsites.com <theviewsatsuperstition@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 184 <unfinished ...>
[pid 25503] 10:12:36.439618 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.439647 <... close resumed> ) = 0
[pid 25495] 10:12:36.439673 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25491] 10:12:36.439706 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.439729 <... write resumed> ) = 184
[pid 25503] 10:12:36.439756 <... socket resumed> ) = 5
[pid 25502] 10:12:36.439774 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.439805 <... open resumed> ) = 8
[pid 25491] 10:12:36.439821 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.439839 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.439872 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.439904 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.439922 fsync(8 <unfinished ...>
[pid 25491] 10:12:36.439945 read(12,  <unfinished ...>
[pid 25458] 10:12:36.439968 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.440015 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.440035 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.440068 <... fsync resumed> ) = 0
[pid 25491] 10:12:36.440087 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.440113 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.440148 close(5 <unfinished ...>
[pid 25502] 10:12:36.440174 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.440192 close(8 <unfinished ...>
[pid 25491] 10:12:36.440216 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25458] 10:12:36.440244 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.440283 <... close resumed> ) = 0
[pid 25502] 10:12:36.440305 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.440336 <... close resumed> ) = 0
[pid 25491] 10:12:36.440354 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.440477 close(7 <unfinished ...>
[pid 25503] 10:12:36.440603 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.440637 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.440657 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.440682 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.440712 <... close resumed> ) = 0
[pid 25503] 10:12:36.440741 <... open resumed> ) = 5
[pid 25502] 10:12:36.440760 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.440794 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080152, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3200, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.440837 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.440885 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25503] 10:12:36.440929 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.440952 <... open resumed> ) = 6
[pid 25495] 10:12:36.440968 open("/var/spool/exim/msglog/a/1aEJMa-0006dD-AR", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25491] 10:12:36.441026 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.441057 <... open resumed> ) = 7
[pid 25503] 10:12:36.441081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.441110 read(6,  <unfinished ...>
[pid 25495] 10:12:36.441133 <... open resumed> ) = 8
[pid 25491] 10:12:36.441149 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.441184 fcntl(7, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.441216 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.441242 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.441266 fcntl(8, F_GETFL <unfinished ...>
[pid 25491] 10:12:36.441288 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25458] 10:12:36.441317 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.441341 <... mmap resumed> ) = 0x7fd60cb38000
[pid 25502] 10:12:36.441358 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.441381 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25491] 10:12:36.441399 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.441435 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.441468 read(5,  <unfinished ...>
[pid 25502] 10:12:36.441495 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25495] 10:12:36.441609 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.441640 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.441678 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.441703 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.441745 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25495] 10:12:36.441774 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080156, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.441803 <... open resumed> ) = 13
[pid 25458] 10:12:36.441819 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.441850 close(5 <unfinished ...>
[pid 25502] 10:12:36.441874 <... mmap resumed> ) = 0x7f3c0be3e000
[pid 25495] 10:12:36.441894 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.441920 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.441943 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377181, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.441978 <... close resumed> ) = 0
[pid 25502] 10:12:36.441994 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.442023 <... mmap resumed> ) = 0x7efcd42a7000
[pid 25491] 10:12:36.442040 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.442070 write(7, "2015-12-30 10:12:36 [25458] 1aEJMY-0006cO-Sq ** finest09@fin.finestweddingsites.com <theviewsatsuperstition@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 193 <unfinished ...>
[pid 25503] 10:12:36.442111 munmap(0x7fd60cb38000, 4096 <unfinished ...>
[pid 25502] 10:12:36.442138 <... mmap resumed> ) = 0x7f3c0919e000
[pid 25495] 10:12:36.442154 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.442177 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.442200 <... write resumed> ) = 193
[pid 25503] 10:12:36.442225 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.442248 mprotect(0x7f3c091ca000, 2097152, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.442277 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.442297 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.442325 close(16 <unfinished ...>
[pid 25503] 10:12:36.442357 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.442386 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.442402 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.442427 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.442453 <... close resumed> ) = 0
[pid 25503] 10:12:36.442478 <... open resumed> ) = 5
[pid 25502] 10:12:36.442496 mmap(0x7f3c093ca000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25495] 10:12:36.442629 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.442670 <... mmap resumed> ) = 0x7f33164f6000
[pid 25458] 10:12:36.442689 munmap(0x7f03f4be1000, 4096 <unfinished ...>
[pid 25503] 10:12:36.442724 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.442751 <... mmap resumed> ) = 0x7f3c093ca000
[pid 25495] 10:12:36.442773 write(8, "2015-12-30 10:12:36 Received from <> R=1aEJMY-0006c6-AN U=mailnull P=local S=3824 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142 <unfinished ...>
[pid 25491] 10:12:36.442808 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.442832 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.442858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.442942 close(6 <unfinished ...>
[pid 25495] 10:12:36.442966 <... write resumed> ) = 142
[pid 25491] 10:12:36.442983 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.443000 close(17 <unfinished ...>
[pid 25503] 10:12:36.443033 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.443059 <... close resumed> ) = 0
[pid 25495] 10:12:36.443084 close(8 <unfinished ...>
[pid 25491] 10:12:36.443110 read(13,  <unfinished ...>
[pid 25458] 10:12:36.443137 <... close resumed> ) = 0
[pid 25503] 10:12:36.443161 <... mmap resumed> ) = 0x7fd60cb38000
[pid 25502] 10:12:36.443178 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.443213 <... close resumed> ) = 0
[pid 25491] 10:12:36.443229 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25458] 10:12:36.443255 munmap(0x7f03f4be0000, 4096 <unfinished ...>
[pid 25503] 10:12:36.443289 read(5,  <unfinished ...>
[pid 25502] 10:12:36.443315 <... open resumed> ) = 6
[pid 25495] 10:12:36.443331 munmap(0x7efcd42a7000, 4096 <unfinished ...>
[pid 25491] 10:12:36.443357 read(13,  <unfinished ...>
[pid 25458] 10:12:36.443379 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.443405 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.443440 read(6,  <unfinished ...>
[pid 25495] 10:12:36.443465 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.443484 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.443583 close(13 <unfinished ...>
[pid 25503] 10:12:36.443623 close(5 <unfinished ...>
[pid 25502] 10:12:36.443647 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.443672 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.443698 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.443723 <... close resumed> ) = 0
[pid 25503] 10:12:36.443746 <... close resumed> ) = 0
[pid 25502] 10:12:36.443762 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.443785 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.443823 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.443874 munmap(0x7f03f4be4000, 4096 <unfinished ...>
[pid 25503] 10:12:36.443912 munmap(0x7fd60cb38000, 4096 <unfinished ...>
[pid 25502] 10:12:36.443937 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25495] 10:12:36.443968 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:36.443995 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.444022 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.444047 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.444078 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.444110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.444142 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.444178 close(14 <unfinished ...>
[pid 25503] 10:12:36.444212 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25502] 10:12:36.444254 <... mmap resumed> ) = 0x7f3c08f99000
[pid 25495] 10:12:36.444271 close(7 <unfinished ...>
[pid 25491] 10:12:36.444295 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.444322 <... close resumed> ) = 0
[pid 25503] 10:12:36.444345 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25502] 10:12:36.444369 mprotect(0x7f3c08f9e000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.444398 <... close resumed> ) = 0
[pid 25491] 10:12:36.444417 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.444471 munmap(0x7f03f4be3000, 4096 <unfinished ...>
[pid 25503] 10:12:36.444599 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25502] 10:12:36.444639 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.444656 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25491] 10:12:36.444688 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.444716 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.444742 <... readlink resumed> 0x7fff186dd380, 4095) = -1 EINVAL (Invalid argument)
[pid 25502] 10:12:36.444769 mmap(0x7f3c0919d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25495] 10:12:36.444800 <... open resumed> ) = 7
[pid 25491] 10:12:36.444817 <... open resumed> ) = 14
[pid 25458] 10:12:36.444834 close(9 <unfinished ...>
[pid 25503] 10:12:36.444866 getcwd( <unfinished ...>
[pid 25502] 10:12:36.444891 <... mmap resumed> ) = 0x7f3c0919d000
[pid 25495] 10:12:36.444912 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.444936 fstat(14,  <unfinished ...>
[pid 25458] 10:12:36.444958 <... close resumed> ) = 0
[pid 25503] 10:12:36.444982 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25502] 10:12:36.445007 close(6 <unfinished ...>
[pid 25495] 10:12:36.445031 <... fcntl resumed> ) = 0
[pid 25491] 10:12:36.445047 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.445076 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25503] 10:12:36.445118 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25502] 10:12:36.445147 <... close resumed> ) = 0
[pid 25495] 10:12:36.445173 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.445198 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.445225 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.445249 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25502] 10:12:36.445280 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.445311 <... fcntl resumed> ) = 0
[pid 25491] 10:12:36.445327 <... mmap resumed> ) = 0x7f33164f5000
[pid 25458] 10:12:36.445344 close(12 <unfinished ...>
[pid 25503] 10:12:36.445376 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.445403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.445421 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.445444 read(14,  <unfinished ...>
[pid 25458] 10:12:36.445472 <... close resumed> ) = 0
[pid 25503] 10:12:36.445495 <... open resumed> ) = 5
[pid 25502] 10:12:36.445603 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.445645 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377374, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.445675 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.445706 munmap(0x7f03f4be5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.445742 fstat(5,  <unfinished ...>
[pid 25502] 10:12:36.445765 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.445783 write(7, "2015-12-30 10:12:36 [25495] 1aEJMa-0006dD-AR <= <> R=1aEJMY-0006c6-AN U=mailnull P=local S=3824 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204 <unfinished ...>
[pid 25491] 10:12:36.445813 close(14 <unfinished ...>
[pid 25458] 10:12:36.445838 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.445863 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25502] 10:12:36.445891 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.445922 <... write resumed> ) = 204
[pid 25491] 10:12:36.445940 <... close resumed> ) = 0
[pid 25458] 10:12:36.445956 close(15 <unfinished ...>
[pid 25503] 10:12:36.445988 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.446014 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.446033 close(6 <unfinished ...>
[pid 25491] 10:12:36.446061 munmap(0x7f33164f5000, 4096 <unfinished ...>
[pid 25458] 10:12:36.446086 <... close resumed> ) = 0
[pid 25503] 10:12:36.446110 <... mmap resumed> ) = 0x7fd60cb38000
[pid 25502] 10:12:36.446127 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.446158 <... close resumed> ) = 0
[pid 25491] 10:12:36.446175 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.446200 munmap(0x7f03f4be2000, 4096 <unfinished ...>
[pid 25503] 10:12:36.446234 read(5,  <unfinished ...>
[pid 25502] 10:12:36.446269 <... open resumed> ) = 6
[pid 25495] 10:12:36.446285 munmap(0x7efcd42a8000, 4096 <unfinished ...>
[pid 25491] 10:12:36.446311 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.446340 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.446365 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25502] 10:12:36.446387 read(6,  <unfinished ...>
[pid 25495] 10:12:36.446411 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.446428 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25458] 10:12:36.446457 close(11 <unfinished ...>
[pid 25503] 10:12:36.446489 read(5,  <unfinished ...>
[pid 25502] 10:12:36.446602 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25495] 10:12:36.446631 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25491] 10:12:36.446661 pipe( <unfinished ...>
[pid 25458] 10:12:36.446688 <... close resumed> ) = 0
[pid 25503] 10:12:36.446712 <... read resumed> "", 1024) = 0
[pid 25502] 10:12:36.446734 fstat(6,  <unfinished ...>
[pid 25495] 10:12:36.446759 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, 8) = 0
[pid 25491] 10:12:36.446779 <... pipe resumed> [14, 15]) = 0
[pid 25458] 10:12:36.446796 munmap(0x7f03f4be6000, 4096 <unfinished ...>
[pid 25503] 10:12:36.446830 setregid(499, 499 <unfinished ...>
[pid 25502] 10:12:36.446854 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25495] 10:12:36.446885 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0},  <unfinished ...>
[pid 25491] 10:12:36.446912 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25458] 10:12:36.446937 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.446961 <... setregid resumed> ) = 0
[pid 25502] 10:12:36.446980 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25495] 10:12:36.447011 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7efcd1ea86a0}, 8) = 0
[pid 25491] 10:12:36.447031 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25458] 10:12:36.447051 close(10 <unfinished ...>
[pid 25503] 10:12:36.447083 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25502] 10:12:36.447321 <... mmap resumed> ) = 0x7f3c08d96000
[pid 25495] 10:12:36.447341 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.447379 close(12 <unfinished ...>
[pid 25458] 10:12:36.447403 <... close resumed> ) = 0
[pid 25502] 10:12:36.447428 mprotect(0x7f3c08d98000, 2093056, PROT_NONE <unfinished ...>
[pid 25495] 10:12:36.447456 <... open resumed> ) = 6
[pid 25491] 10:12:36.447478 <... close resumed> ) = 0
[pid 25458] 10:12:36.447494 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25503] 10:12:36.447636 <... execve resumed> ) = 0
[pid 25502] 10:12:36.447671 <... mprotect resumed> ) = 0
[pid 25495] 10:12:36.447689 read(6,  <unfinished ...>
[pid 25491] 10:12:36.447718 munmap(0x7f33164f7000, 4096 <unfinished ...>
[pid 25458] 10:12:36.447744 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.447779 brk(0 <unfinished ...>
[pid 25502] 10:12:36.447803 mmap(0x7f3c08f97000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25495] 10:12:36.447832 <... read resumed> "0.18 0.08 0.01 3/251 25506\n", 40) = 27
[pid 25491] 10:12:36.447851 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.447869 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25503] 10:12:36.447941 <... brk resumed> ) = 0x1c9d000
[pid 25502] 10:12:36.447961 <... mmap resumed> ) = 0x7f3c08f97000
[pid 25495] 10:12:36.447987 close(6 <unfinished ...>
[pid 25491] 10:12:36.448016 close(9 <unfinished ...>
[pid 25458] 10:12:36.448040 <... open resumed> ) = 9
[pid 25503] 10:12:36.448063 fcntl(0, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.448086 close(6 <unfinished ...>
[pid 25495] 10:12:36.448108 <... close resumed> ) = 0
[pid 25491] 10:12:36.448136 <... close resumed> ) = 0
[pid 25458] 10:12:36.448153 fcntl(9, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.448183 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.448199 <... close resumed> ) = 0
[pid 25495] 10:12:36.448224 clone( <unfinished ...>
[pid 25491] 10:12:36.448501 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25458] 10:12:36.448644 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.448686 fcntl(1, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.448726 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.448780 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.448809 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.448862 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.448889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.448919 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7efcd4292a90) = 25507
[pid 25491] 10:12:36.449235 close(11 <unfinished ...>
[pid 25458] 10:12:36.449284 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.449323 fcntl(2, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.449365 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25495] 10:12:36.449418 exit_group(0) = ?
[pid 25491] 10:12:36.449823 <... close resumed> ) = 0
[pid 25458] 10:12:36.449861 fchown(9, 47, 12 <unfinished ...>
[pid 25503] 10:12:36.449929 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.449954 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25495] 10:12:36.449973 +++ exited with 0 +++
[pid 25491] 10:12:36.449986 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25458] 10:12:36.450014 <... fchown resumed> ) = 0
[pid 25433] 10:12:36.450031 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25495
[pid 25503] 10:12:36.450063 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25502] 10:12:36.450092 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.450125 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.450143 fchmod(9, 0640 <unfinished ...>
[pid 25433] 10:12:36.450170 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0},  <unfinished ...>
[pid 25503] 10:12:36.450206 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.450237 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.450259 close(13 <unfinished ...>
[pid 25458] 10:12:36.450285 <... fchmod resumed> ) = 0
[pid 25433] 10:12:36.450326 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fea0ce846a0}, 8) = 0
[pid 25503] 10:12:36.450372 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.450402 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.450437 <... close resumed> ) = 0
[pid 25458] 10:12:36.450454 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25433] 10:12:36.450491 write(8, "2015-12-30 10:12:36 hillcrestgolfclub@finestweddingsites.com: children all complete\n", 84 <unfinished ...>
[pid 25503] 10:12:36.450617 <... mmap resumed> ) = 0x7ff4da3e9000
[pid 25502] 10:12:36.450652 <... open resumed> ) = 6
[pid 25491] 10:12:36.450672 munmap(0x7f33164f6000, 4096 <unfinished ...>
[pid 25458] 10:12:36.450700 <... open resumed> ) = 10
[pid 25433] 10:12:36.450716 <... write resumed> ) = 84
[pid 25503] 10:12:36.450744 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25502] 10:12:36.450777 read(6,  <unfinished ...>
[pid 25491] 10:12:36.450803 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.450820 alarm(60 <unfinished ...>
[pid 25433] 10:12:36.450845 open("/var/spool/exim/input/Y/hdr.25433", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25503] 10:12:36.450910 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.450939 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.450966 close(10 <unfinished ...>
[pid 25458] 10:12:36.450992 <... alarm resumed> ) = 0
[pid 25433] 10:12:36.451008 <... open resumed> ) = 10
[pid 25503] 10:12:36.451032 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.451062 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.451086 <... close resumed> ) = 0
[pid 25458] 10:12:36.451102 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25433] 10:12:36.451136 fchown(10, 47, 12 <unfinished ...>
[pid 25503] 10:12:36.451172 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.451189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.451222 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25458] 10:12:36.451249 <... fcntl resumed> ) = 0
[pid 25433] 10:12:36.451265 <... fchown resumed> ) = 0
[pid 25503] 10:12:36.451289 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.451317 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.451345 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.451364 alarm(0 <unfinished ...>
[pid 25433] 10:12:36.451387 fchmod(10, 0640 <unfinished ...>
[pid 25503] 10:12:36.451423 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.451442 <... mmap resumed> ) = 0x7f3c0be3d000
[pid 25491] 10:12:36.451463 clone( <unfinished ...>
[pid 25458] 10:12:36.451804 <... alarm resumed> ) = 60
[pid 25433] 10:12:36.451855 <... fchmod resumed> ) = 0
[pid 25503] 10:12:36.451884 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.451916 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:36.451949 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25433] 10:12:36.451979 fcntl(10, F_GETFL <unfinished ...>
[pid 25503] 10:12:36.452009 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.452027 <... mmap resumed> ) = 0x7f3c08b73000
[pid 25491] 10:12:36.452044 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25508
[pid 25458] 10:12:36.452077 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:36.452115 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25503] 10:12:36.452145 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25502] 10:12:36.452174 mprotect(0x7f3c08b8a000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.452203 close(15 <unfinished ...>
[pid 25458] 10:12:36.452226 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.452256 fstat(10,  <unfinished ...>
[pid 25503] 10:12:36.452287 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.452305 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.452322 <... close resumed> ) = 0
[pid 25458] 10:12:36.452338 <... open resumed> ) = 11
[pid 25433] 10:12:36.452354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.452390 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.452419 mmap(0x7f3c08d8a000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25491] 10:12:36.452450 read(14,  <unfinished ...>
[pid 25458] 10:12:36.452476 fcntl(11, F_GETFD <unfinished ...>
[pid 25433] 10:12:36.452498 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.452601 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.452621 <... mmap resumed> ) = 0x7f3c08d8a000
[pid 25458] 10:12:36.452648 <... fcntl resumed> ) = 0
[pid 25433] 10:12:36.452667 <... mmap resumed> ) = 0x7fea0f284000
[pid 25503] 10:12:36.452696 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.452726 close(6 <unfinished ...>
[pid 25458] 10:12:36.452749 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:36.452773 lseek(10, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.452805 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.452823 <... close resumed> ) = 0
[pid 25458] 10:12:36.452863 <... fcntl resumed> ) = 0
[pid 25433] 10:12:36.452882 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.452920 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.452951 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.452980 read(11,  <unfinished ...>
[pid 25433] 10:12:36.453004 write(10, "1aEJMY-0006c6-AN-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 803 <unfinished ...>
[pid 25503] 10:12:36.453046 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.453064 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.453081 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25433] 10:12:36.453108 <... write resumed> ) = 803
[pid 25503] 10:12:36.453131 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25502] 10:12:36.453159 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.453191 close(11 <unfinished ...>
[pid 25433] 10:12:36.453215 fstat(10,  <unfinished ...>
[pid 25503] 10:12:36.453244 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25502] 10:12:36.453275 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.453293 <... close resumed> ) = 0
[pid 25433] 10:12:36.453314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=803, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.453353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.453386 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.453416 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.453443 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006c6-AN; Wed, 30 Dec 2015 10:12:34 -0600\n111T To:  weddings@hillcrestgolfclub.com, kcarter@scottsdalegolfg"..., 594 <unfinished ...>
[pid 25503] 10:12:36.453482 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.453500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.453519 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:36.453646 <... write resumed> ) = 594
[pid 25503] 10:12:36.453685 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.453717 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.453750 stat("/var/tmp",  <unfinished ...>
[pid 25433] 10:12:36.453783 fsync(10 <unfinished ...>
[pid 25503] 10:12:36.453850 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.453871 <... open resumed> ) = 6
[pid 25458] 10:12:36.453895 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25503] 10:12:36.454093 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.454132 read(6,  <unfinished ...>
[pid 25458] 10:12:36.454157 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.454194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.454216 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:36.454241 <... open resumed> ) = 11
[pid 25503] 10:12:36.454264 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25502] 10:12:36.454294 fstat(6,  <unfinished ...>
[pid 25458] 10:12:36.454319 fcntl(11, F_GETFD <unfinished ...>
[pid 25433] 10:12:36.454341 <... fsync resumed> ) = 0
[pid 25503] 10:12:36.454363 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.454381 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:36.454412 <... fcntl resumed> ) = 0
[pid 25433] 10:12:36.454429 fstat(10,  <unfinished ...>
[pid 25503] 10:12:36.454458 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.454489 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:36.454520 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25433] 10:12:36.454624 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1397, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.454662 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.454680 <... mmap resumed> ) = 0x7f3c0892f000
[pid 25458] 10:12:36.454697 <... fcntl resumed> ) = 0
[pid 25433] 10:12:36.454714 close(10 <unfinished ...>
[pid 25503] 10:12:36.454746 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.454778 mprotect(0x7f3c08970000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:36.454808 fstat(11,  <unfinished ...>
[pid 25433] 10:12:36.454831 <... close resumed> ) = 0
[pid 25503] 10:12:36.454854 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.454872 <... mprotect resumed> ) = 0
[pid 25458] 10:12:36.454888 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25433] 10:12:36.454941 munmap(0x7fea0f284000, 4096 <unfinished ...>
[pid 25503] 10:12:36.454979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.455013 mmap(0x7f3c08b70000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25458] 10:12:36.455043 pread(11,  <unfinished ...>
[pid 25433] 10:12:36.455067 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.455097 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.455116 <... mmap resumed> ) = 0x7f3c08b70000
[pid 25458] 10:12:36.455141 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25433] 10:12:36.455181 rename("/var/spool/exim/input/Y/hdr.25433", "/var/spool/exim/input/Y/1aEJMY-0006c6-AN-H" <unfinished ...>
[pid 25503] 10:12:36.455266 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25502] 10:12:36.455299 close(6 <unfinished ...>
[pid 25458] 10:12:36.455323 pread(11,  <unfinished ...>
[pid 25433] 10:12:36.455347 <... rename resumed> ) = 0
[pid 25503] 10:12:36.455371 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25502] 10:12:36.455401 <... close resumed> ) = 0
[pid 25458] 10:12:36.455434 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25433] 10:12:36.455472 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25503] 10:12:36.455512 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.455662 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.455694 close(11 <unfinished ...>
[pid 25433] 10:12:36.455719 <... open resumed> ) = 10
[pid 25503] 10:12:36.455742 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.455760 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.455779 <... close resumed> ) = 0
[pid 25433] 10:12:36.455814 fsync(10 <unfinished ...>
[pid 25503] 10:12:36.455849 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.455877 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.455909 close(10 <unfinished ...>
[pid 25433] 10:12:36.455935 <... fsync resumed> ) = 0
[pid 25503] 10:12:36.455958 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.455977 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.456000 <... close resumed> ) = 0
[pid 25433] 10:12:36.456033 close(10 <unfinished ...>
[pid 25503] 10:12:36.456066 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.456095 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.456125 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.456154 <... close resumed> ) = 0
[pid 25503] 10:12:36.456182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.456200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.456219 <... open resumed> ) = 10
[pid 25433] 10:12:36.456237 unlink("/var/spool/exim/msglog/Y/1aEJMY-0006c6-AN" <unfinished ...>
[pid 25503] 10:12:36.456285 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25502] 10:12:36.456313 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.456345 fstat(10,  <unfinished ...>
[pid 25433] 10:12:36.456369 <... unlink resumed> ) = 0
[pid 25503] 10:12:36.456393 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.456411 <... open resumed> ) = 6
[pid 25458] 10:12:36.456427 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:36.456459 unlink("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-D" <unfinished ...>
[pid 25503] 10:12:36.456505 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.456617 read(6,  <unfinished ...>
[pid 25458] 10:12:36.456650 fstat(10,  <unfinished ...>
[pid 25433] 10:12:36.456674 <... unlink resumed> ) = 0
[pid 25503] 10:12:36.456704 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.456725 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25458] 10:12:36.456750 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25433] 10:12:36.456783 unlink("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-H" <unfinished ...>
[pid 25503] 10:12:36.456881 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25502] 10:12:36.456945 fstat(6,  <unfinished ...>
[pid 25458] 10:12:36.456977 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25433] 10:12:36.457005 <... unlink resumed> ) = 0
[pid 25503] 10:12:36.457038 <... stat resumed> 0x7ffdc4d6bf80) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.457058 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25458] 10:12:36.457089 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25433] 10:12:36.457106 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.457139 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.457169 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.457202 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25433] 10:12:36.457226 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.457272 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.457291 <... mmap resumed> ) = 0x7f3c0be3c000
[pid 25458] 10:12:36.457312 <... lseek resumed> ) = 0
[pid 25433] 10:12:36.457330 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.457363 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25502] 10:12:36.457393 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25458] 10:12:36.457423 read(10,  <unfinished ...>
[pid 25433] 10:12:36.457450 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.457489 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25502] 10:12:36.457598 <... mmap resumed> ) = 0x7f3c08648000
[pid 25458] 10:12:36.457629 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25433] 10:12:36.457686 close(7 <unfinished ...>
[pid 25503] 10:12:36.457726 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.457757 mprotect(0x7f3c08723000, 2097152, PROT_NONE <unfinished ...>
[pid 25458] 10:12:36.457788 pipe( <unfinished ...>
[pid 25433] 10:12:36.457816 <... close resumed> ) = 0
[pid 25503] 10:12:36.457842 <... open resumed> ) = 6
[pid 25502] 10:12:36.457859 <... mprotect resumed> ) = 0
[pid 25458] 10:12:36.457875 <... pipe resumed> [11, 12]) = 0
[pid 25433] 10:12:36.457894 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25503] 10:12:36.457934 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.457958 mmap(0x7f3c08923000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25458] 10:12:36.458045 close(10 <unfinished ...>
[pid 25433] 10:12:36.458071 <... open resumed> ) = 7
[pid 25503] 10:12:36.458094 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.458125 <... mmap resumed> ) = 0x7f3c08923000
[pid 25458] 10:12:36.458152 <... close resumed> ) = 0
[pid 25433] 10:12:36.458170 fcntl(7, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.458201 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.458227 close(6 <unfinished ...>
[pid 25458] 10:12:36.458249 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25433] 10:12:36.458276 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.458299 <... mmap resumed> ) = 0x7ff4da3df000
[pid 25502] 10:12:36.458316 <... close resumed> ) = 0
[pid 25458] 10:12:36.458341 <... munmap resumed> ) = 0
[pid 25433] 10:12:36.458362 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.458394 close(6 <unfinished ...>
[pid 25502] 10:12:36.458416 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.458448 clone( <unfinished ...>
[pid 25433] 10:12:36.458810 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.458837 <... close resumed> ) = 0
[pid 25502] 10:12:36.458869 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25433] 10:12:36.458890 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.458920 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.458953 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.458986 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25509
[pid 25433] 10:12:36.459021 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377578, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.459059 <... open resumed> ) = 6
[pid 25502] 10:12:36.459076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.459093 close(12 <unfinished ...>
[pid 25433] 10:12:36.459115 write(7, "2015-12-30 10:12:36 [25433] 1aEJMY-0006c6-AN Completed QT=2s\n", 61 <unfinished ...>
[pid 25503] 10:12:36.459152 read(6,  <unfinished ...>
[pid 25502] 10:12:36.459176 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.459206 <... close resumed> ) = 0
[pid 25433] 10:12:36.459222 <... write resumed> ) = 61
[pid 25503] 10:12:36.459249 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.459274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.459294 read(11,  <unfinished ...>
[pid 25433] 10:12:36.459317 close(8 <unfinished ...>
[pid 25503] 10:12:36.459365 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.459389 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25433] 10:12:36.459421 <... close resumed> ) = 0
[pid 25503] 10:12:36.459442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.459473 <... open resumed> ) = 6
[pid 25433] 10:12:36.459490 munmap(0x7fea0f285000, 4096 <unfinished ...>
[pid 25503] 10:12:36.459596 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.459639 read(6,  <unfinished ...>
[pid 25433] 10:12:36.459667 <... munmap resumed> ) = 0
Process 25506 attached
[pid 25503] 10:12:36.459718 <... mmap resumed> ) = 0x7ff4d9fb1000
[pid 25502] 10:12:36.459738 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25433] 10:12:36.459765 close(9 <unfinished ...>
[pid 25503] 10:12:36.459799 mprotect(0x7ff4d9fc7000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.459828 fstat(6,  <unfinished ...>
[pid 25433] 10:12:36.459852 <... close resumed> ) = 0
[pid 25503] 10:12:36.459875 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.459892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25433] 10:12:36.459930 unlink("/var/spool/exim/input/Y/1aEJMY-0006c6-AN-J" <unfinished ...>
[pid 25503] 10:12:36.459999 mmap(0x7ff4da1c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25502] 10:12:36.460031 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25433] 10:12:36.460063 <... unlink resumed> ) = 0
[pid 25503] 10:12:36.460084 <... mmap resumed> ) = 0x7ff4da1c7000
[pid 25502] 10:12:36.460106 <... mmap resumed> ) = 0x7f3c08444000
[pid 25433] 10:12:36.460123 close(6 <unfinished ...>
[pid 25503] 10:12:36.460176 mmap(0x7ff4da1c9000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.460205 mprotect(0x7f3c08447000, 2093056, PROT_NONE <unfinished ...>
[pid 25433] 10:12:36.460233 <... close resumed> ) = 0
[pid 25503] 10:12:36.460433 <... mmap resumed> ) = 0x7ff4da1c9000
[pid 25502] 10:12:36.460461 <... mprotect resumed> ) = 0
[pid 25433] 10:12:36.460480 exit_group(0) = ?
[pid 25503] 10:12:36.461271 close(6 <unfinished ...>
[pid 25502] 10:12:36.461305 mmap(0x7f3c08646000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25433] 10:12:36.461336 +++ exited with 0 +++
[pid 25503] 10:12:36.461352 <... close resumed> ) = 0
[pid 25502] 10:12:36.461376 <... mmap resumed> ) = 0x7f3c08646000
[pid 25503] 10:12:36.461407 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.461441 close(6 <unfinished ...>
[pid 25503] 10:12:36.461470 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.461487 <... close resumed> ) = 0
[pid 25503] 10:12:36.461514 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.461603 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25506] 10:12:36.461673 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25503] 10:12:36.461700 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.461722 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.461744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.461904 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.461947 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.461970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.461992 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.462026 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.462060 <... open resumed> ) = 6
[pid 25502] 10:12:36.462077 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.462100 read(6,  <unfinished ...>
[pid 25502] 10:12:36.462125 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.462160 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.462184 <... open resumed> ) = 6
[pid 25503] 10:12:36.462204 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.462234 read(6,  <unfinished ...>
[pid 25503] 10:12:36.462262 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.462292 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.462320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.462348 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.462375 <... mmap resumed> ) = 0x7ff4da3de000
[pid 25502] 10:12:36.462396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.462433 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.462462 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.462498 <... mmap resumed> ) = 0x7ff4d9d98000
[pid 25502] 10:12:36.462514 <... mmap resumed> ) = 0x7f3c08218000
[pid 25503] 10:12:36.462630 mprotect(0x7ff4d9dae000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.462666 mprotect(0x7f3c08241000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.462703 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.462723 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.462744 mmap(0x7ff4d9fad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25502] 10:12:36.462777 mmap(0x7f3c08441000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25503] 10:12:36.462812 <... mmap resumed> ) = 0x7ff4d9fad000
[pid 25502] 10:12:36.462833 <... mmap resumed> ) = 0x7f3c08441000
[pid 25503] 10:12:36.462858 mmap(0x7ff4d9faf000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.462887 mmap(0x7f3c08443000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.462918 <... mmap resumed> ) = 0x7ff4d9faf000
[pid 25502] 10:12:36.462939 <... mmap resumed> ) = 0x7f3c08443000
[pid 25503] 10:12:36.462965 close(6 <unfinished ...>
[pid 25502] 10:12:36.462989 close(6 <unfinished ...>
[pid 25503] 10:12:36.463016 <... close resumed> ) = 0
[pid 25502] 10:12:36.463039 <... close resumed> ) = 0
[pid 25503] 10:12:36.463069 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.463102 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.463135 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.463153 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.463174 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.463206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.463241 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.463258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.463279 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.463314 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.463348 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.463370 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.463393 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.463425 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.463461 <... open resumed> ) = 6
[pid 25502] 10:12:36.463478 <... open resumed> ) = 6
[pid 25503] 10:12:36.463498 read(6,  <unfinished ...>
[pid 25502] 10:12:36.463596 read(6,  <unfinished ...>
[pid 25506] 10:12:36.463644 <... set_robust_list resumed> ) = 0
[pid 25503] 10:12:36.463659 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.463690 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.463722 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.463747 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.463777 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.463809 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.463842 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.463871 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.463901 <... mmap resumed> ) = 0x7ff4d9b61000
[pid 25502] 10:12:36.463917 <... mmap resumed> ) = 0x7f3c0be3b000
[pid 25503] 10:12:36.463941 mprotect(0x7ff4d9b68000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.463970 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.464003 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.464019 <... mmap resumed> ) = 0x7f3c08002000
[pid 25503] 10:12:36.464039 mmap(0x7ff4d9d68000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25502] 10:12:36.464068 mprotect(0x7f3c08017000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.464098 <... mmap resumed> ) = 0x7ff4d9d68000
[pid 25502] 10:12:36.464120 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.464141 mmap(0x7ff4d9d6a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.464169 mmap(0x7f3c08216000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25503] 10:12:36.464200 <... mmap resumed> ) = 0x7ff4d9d6a000
[pid 25502] 10:12:36.464221 <... mmap resumed> ) = 0x7f3c08216000
[pid 25503] 10:12:36.464258 close(6 <unfinished ...>
[pid 25502] 10:12:36.464284 close(6 <unfinished ...>
[pid 25503] 10:12:36.464310 <... close resumed> ) = 0
[pid 25502] 10:12:36.464332 <... close resumed> ) = 0
[pid 25503] 10:12:36.464369 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.464402 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.464438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.464456 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.464477 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.464509 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25506] 10:12:36.464692 close(17 <unfinished ...>
[pid 25503] 10:12:36.464720 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.464739 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.464760 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.464796 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.464830 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.464848 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.464871 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.464902 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.464937 <... open resumed> ) = 6
[pid 25502] 10:12:36.464953 <... open resumed> ) = 6
[pid 25503] 10:12:36.464972 read(6,  <unfinished ...>
[pid 25502] 10:12:36.464997 read(6,  <unfinished ...>
[pid 25503] 10:12:36.465024 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.465047 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.465073 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.465096 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.465124 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.465154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.465189 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.465218 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.465258 <... mmap resumed> ) = 0x7ff4d98dd000
[pid 25502] 10:12:36.465276 <... mmap resumed> ) = 0x7f3c07df7000
[pid 25503] 10:12:36.465297 mprotect(0x7ff4d9960000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.465325 mprotect(0x7f3c07e01000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.465355 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.465371 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.465390 mmap(0x7ff4d9b5f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25502] 10:12:36.465419 mmap(0x7f3c08000000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25503] 10:12:36.465451 <... mmap resumed> ) = 0x7ff4d9b5f000
[pid 25502] 10:12:36.465475 <... mmap resumed> ) = 0x7f3c08000000
[pid 25503] 10:12:36.465507 close(6 <unfinished ...>
[pid 25502] 10:12:36.465616 close(6 <unfinished ...>
[pid 25503] 10:12:36.465653 <... close resumed> ) = 0
[pid 25502] 10:12:36.465677 <... close resumed> ) = 0
[pid 25503] 10:12:36.465712 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.465749 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.465783 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.465801 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.465822 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.465854 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.465889 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.465906 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.465926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.465955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.465988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.466007 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.466030 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.466062 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.466098 <... open resumed> ) = 6
[pid 25502] 10:12:36.466114 <... open resumed> ) = 6
[pid 25503] 10:12:36.466134 read(6,  <unfinished ...>
[pid 25502] 10:12:36.466158 read(6,  <unfinished ...>
[pid 25503] 10:12:36.466186 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.466209 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.466235 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.466258 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.466286 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25502] 10:12:36.466320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.466354 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.466382 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.466418 <... mmap resumed> ) = 0x7ff4da3dd000
[pid 25502] 10:12:36.466438 <... mmap resumed> ) = 0x7f3c07bf4000
[pid 25503] 10:12:36.466458 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.466485 mprotect(0x7f3c07bf6000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.466518 <... mmap resumed> ) = 0x7ff4d96cf000
[pid 25502] 10:12:36.466650 <... mprotect resumed> ) = 0
[pid 25506] 10:12:36.466675 <... close resumed> ) = 0
[pid 25503] 10:12:36.466689 mprotect(0x7ff4d96db000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.466716 mmap(0x7f3c07df5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25503] 10:12:36.466750 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.466766 <... mmap resumed> ) = 0x7f3c07df5000
[pid 25503] 10:12:36.466795 mmap(0x7ff4d98db000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25502] 10:12:36.466826 close(6 <unfinished ...>
[pid 25503] 10:12:36.466853 <... mmap resumed> ) = 0x7ff4d98db000
[pid 25502] 10:12:36.466877 <... close resumed> ) = 0
[pid 25503] 10:12:36.466905 close(6 <unfinished ...>
[pid 25502] 10:12:36.466929 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.466959 <... close resumed> ) = 0
[pid 25502] 10:12:36.466981 <... mmap resumed> ) = 0x7f3c0be3a000
[pid 25503] 10:12:36.467017 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.467054 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.467087 <... open resumed> ) = 6
[pid 25502] 10:12:36.467103 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.467124 read(6,  <unfinished ...>
[pid 25502] 10:12:36.467148 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.467184 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.467207 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.467228 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.467251 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.467284 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:36.467314 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.467338 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.467373 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.467407 <... mmap resumed> ) = 0x7ff4d94ac000
[pid 25502] 10:12:36.467423 <... open resumed> ) = 6
[pid 25503] 10:12:36.467442 mprotect(0x7ff4d94cd000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.467469 read(6,  <unfinished ...>
[pid 25503] 10:12:36.467496 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.467511 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.467627 mmap(0x7ff4d96cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25502] 10:12:36.467662 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.467689 <... mmap resumed> ) = 0x7ff4d96cd000
[pid 25502] 10:12:36.467711 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.467747 close(6 <unfinished ...>
[pid 25502] 10:12:36.467771 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.467804 <... close resumed> ) = 0
[pid 25502] 10:12:36.467826 <... mmap resumed> ) = 0x7f3c079d5000
[pid 25503] 10:12:36.467848 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.467878 mprotect(0x7f3c079f2000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.467909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.467926 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.467946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.467977 mmap(0x7f3c07bf1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25503] 10:12:36.468011 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.468028 <... mmap resumed> ) = 0x7f3c07bf1000
[pid 25503] 10:12:36.468052 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.468083 mmap(0x7f3c07bf3000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.468115 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.468134 <... mmap resumed> ) = 0x7f3c07bf3000
[pid 25503] 10:12:36.468160 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.468193 close(6 <unfinished ...>
[pid 25503] 10:12:36.468220 <... open resumed> ) = 6
[pid 25502] 10:12:36.468236 <... close resumed> ) = 0
[pid 25503] 10:12:36.468293 read(6,  <unfinished ...>
[pid 25502] 10:12:36.468320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.468351 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.468381 <... mmap resumed> ) = 0x7f3c0be39000
[pid 25503] 10:12:36.468443 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.468470 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.468499 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.468650 <... mmap resumed> ) = 0x7f3c0be38000
[pid 25503] 10:12:36.468686 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.468724 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.468760 <... mmap resumed> ) = 0x7ff4d928f000
[pid 25502] 10:12:36.468777 <... mmap resumed> ) = 0x7f3c0be36000
[pid 25503] 10:12:36.468801 mprotect(0x7ff4d92a6000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.468829 arch_prctl(ARCH_SET_FS, 0x7f3c0be367c0 <unfinished ...>
[pid 25503] 10:12:36.468857 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.468872 <... arch_prctl resumed> ) = 0
[pid 25503] 10:12:36.468929 mmap(0x7ff4d94a6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25502] 10:12:36.468961 mprotect(0x7f3c07bf1000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.468992 <... mmap resumed> ) = 0x7ff4d94a6000
[pid 25502] 10:12:36.469012 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469037 mmap(0x7ff4d94a8000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.469066 mprotect(0x7f3c07df5000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469095 <... mmap resumed> ) = 0x7ff4d94a8000
[pid 25502] 10:12:36.469116 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469156 close(6 <unfinished ...>
[pid 25502] 10:12:36.469180 mprotect(0x7f3c08000000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469209 <... close resumed> ) = 0
[pid 25502] 10:12:36.469232 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469261 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.469292 mprotect(0x7f3c08216000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469322 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.469339 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.469405 mprotect(0x7f3c08441000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469435 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.469453 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469485 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.469516 mprotect(0x7f3c08646000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469614 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.469635 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469769 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.469801 mprotect(0x7f3c08923000, 40960, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.469832 <... open resumed> ) = 6
[pid 25502] 10:12:36.469848 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.469951 read(6,  <unfinished ...>
[pid 25502] 10:12:36.469977 mprotect(0x7f3c08b70000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.470007 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.470038 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.470069 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.470094 mprotect(0x7f3c08d8a000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.470122 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25502] 10:12:36.470153 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.470177 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.470204 mprotect(0x7f3c08f97000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.470234 <... mmap resumed> ) = 0x7ff4da3dc000
[pid 25502] 10:12:36.470254 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.470467 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.470500 mprotect(0x7f3c09783000, 110592, PROT_READProcess 25508 attached
Process 25507 attached
 <unfinished ...>
[pid 25506] 10:12:36.470687 geteuid( <unfinished ...>
[pid 25503] 10:12:36.470714 <... mmap resumed> ) = 0x7ff4d8f1b000
[pid 25502] 10:12:36.470733 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.470823 mprotect(0x7ff4d908a000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.470855 mprotect(0x7f3c09a0f000, 16384, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.470902 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.470918 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.471027 mmap(0x7ff4d9289000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25502] 10:12:36.471062 mprotect(0x7f3c09da4000, 16384, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.471093 <... mmap resumed> ) = 0x7ff4d9289000
[pid 25502] 10:12:36.471119 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.471144 close(6 <unfinished ...>
[pid 25502] 10:12:36.471168 mprotect(0x7f3c09faf000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.471199 <... close resumed> ) = 0
[pid 25502] 10:12:36.471223 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.471252 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.471286 mprotect(0x7f3c0a1b3000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.471316 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.471334 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472075 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.472123 mprotect(0x7f3c0af0b000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472155 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.472173 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.472247 mprotect(0x7f3c0b340000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.472296 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472322 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.472358 mprotect(0x7f3c0b5c4000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472388 <... open resumed> ) = 6
[pid 25502] 10:12:36.472404 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472428 read(6,  <unfinished ...>
[pid 25502] 10:12:36.472452 mprotect(0x7f3c0b7cd000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472485 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.472578 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472622 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.472647 mprotect(0x7f3c0ba12000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472678 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25502] 10:12:36.472711 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472740 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.472770 mprotect(0x7f3c0bc2c000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472800 <... mmap resumed> ) = 0x7ff4d8c8c000
[pid 25502] 10:12:36.472816 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472861 mprotect(0x7ff4d8d17000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.472890 mprotect(0x7f3c0be4f000, 4096, PROT_READ <unfinished ...>
[pid 25503] 10:12:36.472919 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.472935 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.472956 mmap(0x7ff4d8f17000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25502] 10:12:36.472987 munmap(0x7f3c0be44000, 39387 <unfinished ...>
[pid 25503] 10:12:36.473079 <... mmap resumed> ) = 0x7ff4d8f17000
[pid 25502] 10:12:36.473104 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.473128 mmap(0x7ff4d8f1a000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.473157 set_tid_address(0x7f3c0be36a90 <unfinished ...>
[pid 25503] 10:12:36.473184 <... mmap resumed> ) = 0x7ff4d8f1a000
[pid 25502] 10:12:36.473205 <... set_tid_address resumed> ) = 25502
[pid 25503] 10:12:36.473226 close(6 <unfinished ...>
[pid 25502] 10:12:36.473249 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25503] 10:12:36.473275 <... close resumed> ) = 0
[pid 25502] 10:12:36.473298 <... set_robust_list resumed> ) = 0
[pid 25503] 10:12:36.473319 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.473349 futex(0x7ffced9bebac, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25503] 10:12:36.473378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.473395 <... futex resumed> ) = 0
[pid 25503] 10:12:36.473415 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.473446 futex(0x7ffced9bebac, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f3c0be367c0 <unfinished ...>
[pid 25503] 10:12:36.473476 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.473493 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25508] 10:12:36.473608 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25507] 10:12:36.473639 set_robust_list(0x7efcd4292aa0, 24 <unfinished ...>
[pid 25506] 10:12:36.473662 <... geteuid resumed> ) = 0
[pid 25503] 10:12:36.473681 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.473720 rt_sigaction(SIGRTMIN, {0x7f3c0acf9c60, [], SA_RESTORER|SA_SIGINFO, 0x7f3c0ad03790},  <unfinished ...>
[pid 25508] 10:12:36.473758 <... set_robust_list resumed> ) = 0
[pid 25507] 10:12:36.473772 <... set_robust_list resumed> ) = 0
[pid 25506] 10:12:36.473811 getegid( <unfinished ...>
[pid 25503] 10:12:36.473856 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.473882 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25508] 10:12:36.473907 close(14 <unfinished ...>
[pid 25507] 10:12:36.473930 close(0 <unfinished ...>
[pid 25506] 10:12:36.473956 <... getegid resumed> ) = 12
[pid 25503] 10:12:36.473970 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.474010 rt_sigaction(SIGRT_1, {0x7f3c0acf9cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f3c0ad03790},  <unfinished ...>
[pid 25508] 10:12:36.474045 <... close resumed> ) = 0
[pid 25507] 10:12:36.474059 <... close resumed> ) = 0
[pid 25506] 10:12:36.474081 setgid(500 <unfinished ...>
[pid 25503] 10:12:36.474108 <... open resumed> ) = 6
[pid 25502] 10:12:36.474124 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25508] 10:12:36.474147 geteuid( <unfinished ...>
[pid 25507] 10:12:36.474168 close(1 <unfinished ...>
[pid 25506] 10:12:36.474190 <... setgid resumed> ) = 0
[pid 25503] 10:12:36.474203 read(6,  <unfinished ...>
[pid 25502] 10:12:36.474228 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25508] 10:12:36.474262 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.474275 <... close resumed> ) = 0
[pid 25506] 10:12:36.474290 setuid(503 <unfinished ...>
[pid 25503] 10:12:36.474315 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.474339 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25508] 10:12:36.474378 getegid( <unfinished ...>
[pid 25507] 10:12:36.474407 close(2 <unfinished ...>
[pid 25506] 10:12:36.474431 <... setuid resumed> ) = 0
[pid 25503] 10:12:36.474445 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.474575 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25508] 10:12:36.474612 <... getegid resumed> ) = 12
[pid 25507] 10:12:36.474625 <... close resumed> ) = 0
[pid 25506] 10:12:36.474644 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.474732 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25502] 10:12:36.474764 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25508] 10:12:36.474831 setgid(500 <unfinished ...>
[pid 25507] 10:12:36.474856 setsid( <unfinished ...>
[pid 25506] 10:12:36.474880 <... open resumed> ) = 9
[pid 25503] 10:12:36.474893 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.475107 statfs("/selinux",  <unfinished ...>
[pid 25508] 10:12:36.475152 <... setgid resumed> ) = 0
[pid 25507] 10:12:36.475165 <... setsid resumed> ) = 25507
[pid 25506] 10:12:36.475181 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.475209 <... mmap resumed> ) = 0x7ff4d8a86000
[pid 25502] 10:12:36.475226 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350339, f_bavail=6350339, f_files=1000000, f_ffree=691095, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25508] 10:12:36.475301 setuid(503 <unfinished ...>
[pid 25507] 10:12:36.475328 fstat(0,  <unfinished ...>
[pid 25506] 10:12:36.475350 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.475378 mprotect(0x7ff4d8a8c000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.475581 brk(0 <unfinished ...>
[pid 25508] 10:12:36.475628 <... setuid resumed> ) = 0
[pid 25507] 10:12:36.475645 <... fstat resumed> 0x7ffd50fc3b80) = -1 EBADF (Bad file descriptor)
[pid 25506] 10:12:36.475691 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.475721 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.475737 <... brk resumed> ) = 0x1085000
[pid 25508] 10:12:36.475761 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.475790 open("/dev/null", O_RDWR <unfinished ...>
[pid 25506] 10:12:36.475823 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.475859 mmap(0x7ff4d8c8b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25502] 10:12:36.475895 brk(0x10a6000Process 25509 attached
 <unfinished ...>
[pid 25508] 10:12:36.475956 <... open resumed> ) = 9
[pid 25507] 10:12:36.475971 <... open resumed> ) = 0
[pid 25506] 10:12:36.475993 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.476023 <... mmap resumed> ) = 0x7ff4d8c8b000
[pid 25502] 10:12:36.476044 <... brk resumed> ) = 0x10a6000
[pid 25509] 10:12:36.476080 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25508] 10:12:36.476103 fstat(9,  <unfinished ...>
[pid 25507] 10:12:36.476125 fstat(1,  <unfinished ...>
[pid 25506] 10:12:36.476146 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25503] 10:12:36.476159 close(6 <unfinished ...>
[pid 25502] 10:12:36.476183 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25509] 10:12:36.476230 <... set_robust_list resumed> ) = 0
[pid 25508] 10:12:36.476243 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25507] 10:12:36.476341 <... fstat resumed> 0x7ffd50fc3b80) = -1 EBADF (Bad file descriptor)
[pid 25506] 10:12:36.476394 read(9,  <unfinished ...>
[pid 25503] 10:12:36.476443 <... close resumed> ) = 0
[pid 25502] 10:12:36.476468 <... open resumed> ) = 6
[pid 25509] 10:12:36.476572 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25508] 10:12:36.476607 brk(0x17f0000 <unfinished ...>
[pid 25507] 10:12:36.476631 dup2(0, 1 <unfinished ...>
[pid 25506] 10:12:36.476654 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25503] 10:12:36.476672 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.476705 fstat(6,  <unfinished ...>
[pid 25509] 10:12:36.476737 <... setrlimit resumed> ) = 0
[pid 25508] 10:12:36.476751 <... brk resumed> ) = 0x17f0000
[pid 25507] 10:12:36.476887 <... dup2 resumed> ) = 1
[pid 25506] 10:12:36.476967 read(9,  <unfinished ...>
[pid 25503] 10:12:36.476998 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.477017 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25509] 10:12:36.477056 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25508] 10:12:36.477085 fstat(9,  <unfinished ...>
[pid 25507] 10:12:36.477107 fstat(2,  <unfinished ...>
[pid 25506] 10:12:36.477128 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25503] 10:12:36.477151 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.477191 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25509] 10:12:36.477227 <... open resumed> ) = 10
[pid 25508] 10:12:36.477240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25507] 10:12:36.477275 <... fstat resumed> 0x7ffd50fc3b80) = -1 EBADF (Bad file descriptor)
[pid 25506] 10:12:36.477294 close(9 <unfinished ...>
[pid 25503] 10:12:36.477319 <... open resumed> ) = 6
[pid 25502] 10:12:36.477335 <... mmap resumed> ) = 0x7f3c0be4d000
[pid 25509] 10:12:36.477361 fstat(10,  <unfinished ...>
[pid 25508] 10:12:36.477384 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.477409 dup2(0, 2 <unfinished ...>
[pid 25506] 10:12:36.477431 <... close resumed> ) = 0
[pid 25503] 10:12:36.477444 read(6,  <unfinished ...>
[pid 25502] 10:12:36.477469 read(6,  <unfinished ...>
[pid 25509] 10:12:36.477655 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25508] 10:12:36.477685 <... mmap resumed> ) = 0x7f33164fa000
[pid 25507] 10:12:36.477719 <... dup2 resumed> ) = 2
[pid 25506] 10:12:36.477737 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25503] 10:12:36.477766 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.477792 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25509] 10:12:36.477830 fstat(10,  <unfinished ...>
[pid 25508] 10:12:36.477853 read(9,  <unfinished ...>
[pid 25507] 10:12:36.477884 geteuid( <unfinished ...>
[pid 25506] 10:12:36.477905 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.477919 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.478340 read(6,  <unfinished ...>
[pid 25509] 10:12:36.478376 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25508] 10:12:36.478403 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25507] 10:12:36.478425 <... geteuid resumed> ) = 47
[pid 25506] 10:12:36.478441 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.478476 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25502] 10:12:36.478577 <... read resumed> "", 1024) = 0
[pid 25509] 10:12:36.478617 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25508] 10:12:36.478647 read(9,  <unfinished ...>
[pid 25507] 10:12:36.478674 fstat(0,  <unfinished ...>
[pid 25506] 10:12:36.478696 <... lseek resumed> ) = 19
[pid 25503] 10:12:36.478710 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.478737 close(6 <unfinished ...>
[pid 25509] 10:12:36.478774 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25508] 10:12:36.478788 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25507] 10:12:36.478810 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25506] 10:12:36.478842 read(6,  <unfinished ...>
[pid 25503] 10:12:36.478867 <... mmap resumed> ) = 0x7ff4da3db000
[pid 25502] 10:12:36.478888 <... close resumed> ) = 0
[pid 25509] 10:12:36.478913 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25508] 10:12:36.478936 close(9 <unfinished ...>
[pid 25507] 10:12:36.478959 fstat(1,  <unfinished ...>
[pid 25506] 10:12:36.478980 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2426) = 1858
[pid 25503] 10:12:36.478998 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.479570 munmap(0x7f3c0be4d000, 4096 <unfinished ...>
[pid 25509] 10:12:36.479618 <... lseek resumed> ) = 0
[pid 25508] 10:12:36.479633 <... close resumed> ) = 0
[pid 25507] 10:12:36.479651 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25506] 10:12:36.479682 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.479714 <... mmap resumed> ) = 0x7ff4d8750000
[pid 25502] 10:12:36.479731 <... munmap resumed> ) = 0
[pid 25509] 10:12:36.479814 read(10,  <unfinished ...>
[pid 25508] 10:12:36.479845 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25507] 10:12:36.479871 fstat(2,  <unfinished ...>
[pid 25506] 10:12:36.479894 <... write resumed> ) = 4
[pid 25503] 10:12:36.479907 mprotect(0x7ff4d887c000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.479936 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25473] 10:12:36.479969 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25509] 10:12:36.479999 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25508] 10:12:36.480017 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.480077 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25506] 10:12:36.480599 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.480645 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.480663 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.480761 read(17,  <unfinished ...>
[pid 25509] 10:12:36.480806 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25508] 10:12:36.480837 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.480860 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMa-0006dD-AR"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25506] 10:12:36.481572 <... write resumed> ) = 4
[pid 25503] 10:12:36.481597 mmap(0x7ff4d8a7c000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25502] 10:12:36.481633 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f3c0ad03790},  <unfinished ...>
[pid 25473] 10:12:36.481664 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25509] 10:12:36.481692 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25508] 10:12:36.481721 <... lseek resumed> ) = 19
[pid 25506] 10:12:36.481768 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.481799 <... mmap resumed> ) = 0x7ff4d8a7c000
[pid 25502] 10:12:36.481820 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25473] 10:12:36.481848 read(17,  <unfinished ...>
[pid 25509] 10:12:36.481883 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25508] 10:12:36.481913 read(6,  <unfinished ...>
[pid 25507] 10:12:36.481937 <... execve resumed> ) = 0
[pid 25506] 10:12:36.481950 <... write resumed> ) = 4
[pid 25503] 10:12:36.481981 mmap(0x7ff4d8a85000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.482014 fstat(2,  <unfinished ...>
[pid 25473] 10:12:36.482038 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.482068 <... open resumed> ) = 13
[pid 25508] 10:12:36.482083 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2420) = 1858
[pid 25507] 10:12:36.482109 brk(0 <unfinished ...>
[pid 25506] 10:12:36.482665 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25503] 10:12:36.482696 <... mmap resumed> ) = 0x7ff4d8a85000
[pid 25502] 10:12:36.482719 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25473] 10:12:36.482782 read(17,  <unfinished ...>
[pid 25509] 10:12:36.482822 fstat(13,  <unfinished ...>
[pid 25508] 10:12:36.482844 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.482875 <... brk resumed> ) = 0x1f92000
[pid 25506] 10:12:36.482890 <... write resumed> ) = 40
[pid 25503] 10:12:36.482906 close(6 <unfinished ...>
[pid 25502] 10:12:36.482930 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f3c0ad03790},  <unfinished ...>
[pid 25473] 10:12:36.482957 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25509] 10:12:36.482987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25508] 10:12:36.483014 <... write resumed> ) = 4
[pid 25507] 10:12:36.483032 fcntl(0, F_GETFD <unfinished ...>
[pid 25506] 10:12:36.483056 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.483080 <... close resumed> ) = 0
[pid 25502] 10:12:36.483105 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.483127 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25473] 10:12:36.483147 read(17,  <unfinished ...>
[pid 25509] 10:12:36.483181 fstat(13,  <unfinished ...>
[pid 25508] 10:12:36.483203 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.483225 <... fcntl resumed> ) = 0
[pid 25506] 10:12:36.483238 <... write resumed> ) = 4
[pid 25503] 10:12:36.483253 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.483287 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25491] 10:12:36.483313 read(14,  <unfinished ...>
[pid 25473] 10:12:36.483336 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.483365 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25508] 10:12:36.483390 <... write resumed> ) = 4
[pid 25507] 10:12:36.483405 fcntl(1, F_GETFD <unfinished ...>
[pid 25506] 10:12:36.483429 close(18 <unfinished ...>
[pid 25503] 10:12:36.483451 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.483471 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.483490 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25473] 10:12:36.483581 wait4(-1,  <unfinished ...>
[pid 25509] 10:12:36.483630 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25508] 10:12:36.483660 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.483685 <... fcntl resumed> ) = 0
[pid 25506] 10:12:36.483699 <... close resumed> ) = 0
[pid 25503] 10:12:36.483713 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.483764 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25491] 10:12:36.483791 read(14,  <unfinished ...>
[pid 25509] 10:12:36.483824 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25508] 10:12:36.483844 <... write resumed> ) = 4
[pid 25507] 10:12:36.483860 fcntl(2, F_GETFD <unfinished ...>
[pid 25506] 10:12:36.483883 exit_group(0) = ?
[pid 25503] 10:12:36.483896 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.484170 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25491] 10:12:36.484193 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.484238 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25508] 10:12:36.484263 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25507] 10:12:36.484287 <... fcntl resumed> ) = 0
[pid 25506] 10:12:36.484300 +++ exited with 0 +++
[pid 25503] 10:12:36.484319 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.484352 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f3c0ad03790},  <unfinished ...>
[pid 25491] 10:12:36.484379 read(14,  <unfinished ...>
[pid 25473] 10:12:36.484405 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25506
[pid 25509] 10:12:36.484435 <... lseek resumed> ) = 0
[pid 25508] 10:12:36.484450 <... write resumed> ) = 40
[pid 25507] 10:12:36.484469 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25503] 10:12:36.484500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.484596 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25491] 10:12:36.484630 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25473] 10:12:36.484651 close(17 <unfinished ...>
[pid 25509] 10:12:36.484689 read(13,  <unfinished ...>
[pid 25508] 10:12:36.484715 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.484739 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.484753 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.484803 umask(0 <unfinished ...>
[pid 25491] 10:12:36.484826 read(14,  <unfinished ...>
[pid 25473] 10:12:36.484848 <... close resumed> ) = 0
[pid 25509] 10:12:36.484874 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25508] 10:12:36.484893 <... write resumed> ) = 4
[pid 25507] 10:12:36.484914 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.484942 <... open resumed> ) = 6
[pid 25502] 10:12:36.484958 <... umask resumed> ) = 0
[pid 25491] 10:12:36.485019 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.485041 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25509] 10:12:36.485080 read(13,  <unfinished ...>
[pid 25508] 10:12:36.485102 close(15 <unfinished ...>
[pid 25507] 10:12:36.485124 <... mmap resumed> ) = 0x7f43504d7000
[pid 25503] 10:12:36.485138 read(6,  <unfinished ...>
[pid 25502] 10:12:36.485177 geteuid( <unfinished ...>
[pid 25491] 10:12:36.485200 wait4(-1,  <unfinished ...>
[pid 25473] 10:12:36.485222 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25509] 10:12:36.485274 <... read resumed> "", 4096) = 0
[pid 25508] 10:12:36.485291 <... close resumed> ) = 0
[pid 25507] 10:12:36.485338 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25503] 10:12:36.485384 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.485414 <... geteuid resumed> ) = 0
[pid 25473] 10:12:36.485434 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.485470 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25508] 10:12:36.485496 exit_group(0) = ?
[pid 25507] 10:12:36.485585 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.485874 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.485912 getuid( <unfinished ...>
[pid 25473] 10:12:36.485934 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.486001 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25508] 10:12:36.486021 +++ exited with 0 +++
[pid 25507] 10:12:36.486035 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.486064 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.486095 <... getuid resumed> ) = 47
[pid 25491] 10:12:36.486115 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25508
[pid 25473] 10:12:36.486134 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25509] 10:12:36.486171 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25507] 10:12:36.486197 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.486211 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.486243 getgid( <unfinished ...>
[pid 25491] 10:12:36.486265 close(14 <unfinished ...>
[pid 25473] 10:12:36.486291 <... open resumed> ) = 9
[pid 25509] 10:12:36.486316 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25507] 10:12:36.486334 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.486362 <... mmap resumed> ) = 0x7ff4d854c000
[pid 25502] 10:12:36.486378 <... getgid resumed> ) = 12
[pid 25491] 10:12:36.486424 <... close resumed> ) = 0
[pid 25473] 10:12:36.486443 fstat(9,  <unfinished ...>
[pid 25509] 10:12:36.486474 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25507] 10:12:36.486499 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.486579 mprotect(0x7ff4d854e000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.486613 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25491] 10:12:36.486637 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25473] 10:12:36.486664 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.486707 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f03f3a9f790}, 8) = 0
[pid 25507] 10:12:36.486726 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.486759 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.486775 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25491] 10:12:36.486794 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25473] 10:12:36.486834 fstat(9,  <unfinished ...>
[pid 25509] 10:12:36.486886 close(11 <unfinished ...>
[pid 25507] 10:12:36.486909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.486923 mmap(0x7ff4d874e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25502] 10:12:36.486960 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25491] 10:12:36.486983 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.487009 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.487046 <... close resumed> ) = 0
[pid 25507] 10:12:36.487059 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25503] 10:12:36.487087 <... mmap resumed> ) = 0x7ff4d874e000
[pid 25502] 10:12:36.487110 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25491] 10:12:36.487133 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.487175 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25509] 10:12:36.487213 fcntl(12, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.487235 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.487250 close(6 <unfinished ...>
[pid 25502] 10:12:36.487274 getgroups(65536,  <unfinished ...>
[pid 25491] 10:12:36.487297 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.487327 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25509] 10:12:36.487353 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.487367 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.487395 <... close resumed> ) = 0
[pid 25502] 10:12:36.487420 <... getgroups resumed> [12]) = 1
[pid 25491] 10:12:36.487445 <... open resumed> ) = 9
[pid 25473] 10:12:36.487463 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25509] 10:12:36.487504 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.487614 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.487630 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.487662 setgroups(0, [] <unfinished ...>
[pid 25491] 10:12:36.487686 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.487709 <... lseek resumed> ) = 0
[pid 25509] 10:12:36.487735 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.487749 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.487791 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.487809 <... setgroups resumed> ) = 0
[pid 25491] 10:12:36.487827 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.487861 read(9,  <unfinished ...>
[pid 25509] 10:12:36.487898 geteuid( <unfinished ...>
[pid 25507] 10:12:36.487919 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.487934 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.487969 getegid( <unfinished ...>
[pid 25491] 10:12:36.487991 fstat(9,  <unfinished ...>
[pid 25473] 10:12:36.488014 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25509] 10:12:36.488058 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.488076 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.488106 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.488128 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.488145 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.488174 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.488209 getegid( <unfinished ...>
[pid 25507] 10:12:36.488231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.488245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.488277 geteuid( <unfinished ...>
[pid 25491] 10:12:36.488300 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.488326 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.488374 <... getegid resumed> ) = 12
[pid 25507] 10:12:36.488391 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25503] 10:12:36.488422 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.488441 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.488462 <... mmap resumed> ) = 0x7f33164fa000
[pid 25473] 10:12:36.488479 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.488593 setgid(500 <unfinished ...>
[pid 25507] 10:12:36.488628 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25503] 10:12:36.488660 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.488694 geteuid( <unfinished ...>
[pid 25491] 10:12:36.488716 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.488739 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.488810 <... setgid resumed> ) = 0
[pid 25507] 10:12:36.488828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.488862 <... open resumed> ) = 6
[pid 25502] 10:12:36.488879 <... geteuid resumed> ) = 0
[pid 25491] 10:12:36.488895 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.488912 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25509] 10:12:36.488952 setuid(503 <unfinished ...>
[pid 25507] 10:12:36.488974 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.488989 read(6,  <unfinished ...>
[pid 25502] 10:12:36.489014 getegid( <unfinished ...>
[pid 25491] 10:12:36.489036 read(9,  <unfinished ...>
[pid 25473] 10:12:36.489062 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25509] 10:12:36.489092 <... setuid resumed> ) = 0
[pid 25507] 10:12:36.489107 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.489138 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.489167 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.489191 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:36.489227 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25509] 10:12:36.489268 chdir("/" <unfinished ...>
[pid 25507] 10:12:36.489292 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.489307 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.489332 setgid(12 <unfinished ...>
[pid 25491] 10:12:36.489355 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.489380 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.489428 <... chdir resumed> ) = 0
[pid 25507] 10:12:36.489444 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.489492 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.489605 <... setgid resumed> ) = 0
[pid 25491] 10:12:36.489627 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.489667 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25509] 10:12:36.489709 geteuid( <unfinished ...>
[pid 25507] 10:12:36.489730 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.489745 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.489776 setuid(0 <unfinished ...>
[pid 25491] 10:12:36.489800 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.489826 <... open resumed> ) = 10
[pid 25509] 10:12:36.489851 <... geteuid resumed> ) = 503
[pid 25507] 10:12:36.489865 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25503] 10:12:36.489895 <... mmap resumed> ) = 0x7ff4d8349000
[pid 25502] 10:12:36.489911 <... setuid resumed> ) = 0
[pid 25491] 10:12:36.489964 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.490027 fstat(10,  <unfinished ...>
[pid 25509] 10:12:36.490064 getegid( <unfinished ...>
[pid 25507] 10:12:36.490085 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.490100 mprotect(0x7ff4d834b000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.490130 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.490160 stat("/home/finest09/etc/finestweddingsites.com/courtyardavondale/filter",  <unfinished ...>
[pid 25473] 10:12:36.490191 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.490231 <... getegid resumed> ) = 500
[pid 25507] 10:12:36.490245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.490312 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.490331 <... open resumed> ) = 6
[pid 25491] 10:12:36.490366 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.490391 fstat(10,  <unfinished ...>
[pid 25509] 10:12:36.490425 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25507] 10:12:36.490455 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.490469 mmap(0x7ff4d854a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25502] 10:12:36.490501 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.490607 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.490636 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.490674 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25507] 10:12:36.490700 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.490731 <... mmap resumed> ) = 0x7ff4d854a000
[pid 25502] 10:12:36.490757 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.490793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.490832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25509] 10:12:36.490871 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25507] 10:12:36.490898 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.490913 close(6 <unfinished ...>
[pid 25502] 10:12:36.490938 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.490960 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.490988 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25509] 10:12:36.491013 <... chdir resumed> ) = 0
[pid 25507] 10:12:36.491027 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.491059 <... close resumed> ) = 0
[pid 25502] 10:12:36.491083 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.491113 <... open resumed> ) = 10
[pid 25473] 10:12:36.491130 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25509] 10:12:36.491162 stat("tmp",  <unfinished ...>
[pid 25507] 10:12:36.491188 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.491205 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.491234 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.491259 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.491282 <... lseek resumed> ) = 0
[pid 25509] 10:12:36.491307 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.491343 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25503] 10:12:36.491375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.491392 <... mmap resumed> ) = 0x7f3c0be4d000
[pid 25491] 10:12:36.491409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.491440 read(10,  <unfinished ...>
[pid 25509] 10:12:36.491476 stat("new",  <unfinished ...>
[pid 25507] 10:12:36.491501 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.491637 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.491670 read(6,  <unfinished ...>
[pid 25491] 10:12:36.491698 fstat(10,  <unfinished ...>
[pid 25473] 10:12:36.491721 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25509] 10:12:36.491755 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.491782 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.491814 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.491831 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25491] 10:12:36.491959 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.491994 read(10,  <unfinished ...>
[pid 25509] 10:12:36.492028 stat("cur",  <unfinished ...>
[pid 25507] 10:12:36.492055 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.492072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.492102 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.492133 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.492159 <... read resumed> "", 4096) = 0
[pid 25509] 10:12:36.492205 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25507] 10:12:36.492235 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.492330 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.492351 <... socket resumed> ) = 7
[pid 25491] 10:12:36.492368 <... mmap resumed> ) = 0x7f33164f9000
[pid 25473] 10:12:36.492385 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25509] 10:12:36.492423 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25507] 10:12:36.492460 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.492479 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.492626 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.492671 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.492695 <... open resumed> ) = 11
[pid 25509] 10:12:36.492724 <... open resumed> ) = 11
[pid 25507] 10:12:36.492739 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.492773 <... open resumed> ) = 6
[pid 25502] 10:12:36.492789 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.492806 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.492822 fstat(11,  <unfinished ...>
[pid 25509] 10:12:36.492854 read(11,  <unfinished ...>
[pid 25507] 10:12:36.492877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.492894 read(6,  <unfinished ...>
[pid 25502] 10:12:36.492916 close(7 <unfinished ...>
[pid 25491] 10:12:36.492943 read(10,  <unfinished ...>
[pid 25473] 10:12:36.492969 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25509] 10:12:36.493060 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2943
[pid 25507] 10:12:36.493084 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25503] 10:12:36.493177 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.493201 <... close resumed> ) = 0
[pid 25491] 10:12:36.493217 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25473] 10:12:36.493242 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25509] 10:12:36.493278 stat("tmp/1451491956.H493151P25509.fin.finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.493310 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.493328 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.493351 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.493378 read(10,  <unfinished ...>
[pid 25473] 10:12:36.493402 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25509] 10:12:36.493428 <... stat resumed> 0x7ffc7ad96b90) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.493443 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.493476 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.493585 <... socket resumed> ) = 7
[pid 25491] 10:12:36.493608 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.493644 read(11,  <unfinished ...>
[pid 25509] 10:12:36.493684 open("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25507] 10:12:36.493747 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.493768 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.493795 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.493828 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.493856 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25509] 10:12:36.493896 <... open resumed> ) = 14
[pid 25507] 10:12:36.493912 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25503] 10:12:36.493948 <... mmap resumed> ) = 0x7ff4da3da000
[pid 25502] 10:12:36.493969 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.493986 <... open resumed> ) = 11
[pid 25473] 10:12:36.494005 close(11 <unfinished ...>
[pid 25509] 10:12:36.494040 chown("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25507] 10:12:36.494071 <... stat resumed> 0x7ffd396fd3f0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.494089 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.494118 close(7 <unfinished ...>
[pid 25491] 10:12:36.494143 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.494166 <... close resumed> ) = 0
[pid 25509] 10:12:36.494190 <... chown resumed> ) = 0
[pid 25507] 10:12:36.494204 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.494239 <... mmap resumed> ) = 0x7ff4d7fb5000
[pid 25502] 10:12:36.494256 <... close resumed> ) = 0
[pid 25491] 10:12:36.494278 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.494310 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25509] 10:12:36.494349 chmod("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25507] 10:12:36.494381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.494404 mprotect(0x7ff4d813f000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.494434 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.494473 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.494500 <... munmap resumed> ) = 0
[pid 25509] 10:12:36.494621 <... chmod resumed> ) = 0
[pid 25507] 10:12:36.494641 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25503] 10:12:36.494671 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.494687 <... open resumed> ) = 7
[pid 25491] 10:12:36.494706 <... mmap resumed> ) = 0x7f33164f8000
[pid 25473] 10:12:36.494723 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.494758 chown("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25507] 10:12:36.494786 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.494818 mmap(0x7ff4d833f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25502] 10:12:36.494855 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.494879 read(11,  <unfinished ...>
[pid 25473] 10:12:36.494905 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.494959 <... chown resumed> ) = 0
[pid 25507] 10:12:36.494975 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.495006 <... mmap resumed> ) = 0x7ff4d833f000
[pid 25502] 10:12:36.495028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25491] 10:12:36.495057 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.495088 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25509] 10:12:36.495125 chmod("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25507] 10:12:36.495153 <... open resumed> ) = 6
[pid 25503] 10:12:36.495168 mmap(0x7ff4d8344000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.495197 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.495222 close(11 <unfinished ...>
[pid 25473] 10:12:36.495246 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25509] 10:12:36.495295 <... chmod resumed> ) = 0
[pid 25507] 10:12:36.495310 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.495369 <... mmap resumed> ) = 0x7ff4d8344000
[pid 25502] 10:12:36.495391 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25491] 10:12:36.495410 <... close resumed> ) = 0
[pid 25473] 10:12:36.495426 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25509] 10:12:36.495463 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.495488 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25503] 10:12:36.495600 close(6 <unfinished ...>
[pid 25502] 10:12:36.495637 read(7,  <unfinished ...>
[pid 25491] 10:12:36.495670 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25473] 10:12:36.495703 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.495768 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.495799 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.495863 <... close resumed> ) = 0
[pid 25502] 10:12:36.495889 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25491] 10:12:36.495934 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.495964 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25509] 10:12:36.496007 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.496030 <... mmap resumed> ) = 0x7f43504cd000
[pid 25503] 10:12:36.496047 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.496076 read(7,  <unfinished ...>
[pid 25491] 10:12:36.496099 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.496124 <... open resumed> ) = 11
[pid 25509] 10:12:36.496149 <... lseek resumed> ) = 19
[pid 25507] 10:12:36.496163 close(6 <unfinished ...>
[pid 25503] 10:12:36.496187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.496205 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:36.496222 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.496267 fstat(11,  <unfinished ...>
[pid 25509] 10:12:36.496301 read(6,  <unfinished ...>
[pid 25507] 10:12:36.496328 <... close resumed> ) = 0
[pid 25503] 10:12:36.496354 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.496388 close(7 <unfinished ...>
[pid 25491] 10:12:36.496412 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25473] 10:12:36.496440 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.496480 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25507] 10:12:36.496499 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.496639 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.496659 <... close resumed> ) = 0
[pid 25491] 10:12:36.496676 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25473] 10:12:36.496718 fstat(11,  <unfinished ...>
[pid 25509] 10:12:36.496752 read(6,  <unfinished ...>
[pid 25507] 10:12:36.496775 <... open resumed> ) = 6
[pid 25503] 10:12:36.496790 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.496821 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25491] 10:12:36.496853 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25473] 10:12:36.496886 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.496924 <... read resumed> "", 8192) = 0
[pid 25507] 10:12:36.496938 read(6,  <unfinished ...>
[pid 25503] 10:12:36.496964 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.496989 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.497023 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.497077 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25509] 10:12:36.497122 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:36 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2591 <unfinished ...>
[pid 25507] 10:12:36.497158 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.497183 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.497216 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.497245 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.497275 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25509] 10:12:36.497300 <... write resumed> ) = 2591
[pid 25507] 10:12:36.497314 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.497344 <... open resumed> ) = 6
[pid 25502] 10:12:36.497361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.497378 <... open resumed> ) = 11
[pid 25473] 10:12:36.497395 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25509] 10:12:36.497427 fsync(14 <unfinished ...>
[pid 25507] 10:12:36.497496 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.497713 read(6,  <unfinished ...>
[pid 25502] 10:12:36.497740 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.497775 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.497798 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.497822 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.497851 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.497875 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.497892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.497924 read(11,  <unfinished ...>
[pid 25507] 10:12:36.497964 <... mmap resumed> ) = 0x7f435009f000
[pid 25503] 10:12:36.497981 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.498003 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.498033 fstat(11,  <unfinished ...>
[pid 25473] 10:12:36.498056 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25509] 10:12:36.498113 <... fsync resumed> ) = 0
[pid 25507] 10:12:36.498130 mprotect(0x7f43500b5000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.498163 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25502] 10:12:36.498193 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.498218 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.498247 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.498282 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25507] 10:12:36.498305 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.498320 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.498349 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.498379 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.498404 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.498449 <... lseek resumed> ) = 2943
[pid 25507] 10:12:36.498467 mmap(0x7f43502b5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25503] 10:12:36.498497 <... mmap resumed> ) = 0x7ff4d7d49000
[pid 25502] 10:12:36.498624 <... open resumed> ) = 7
[pid 25491] 10:12:36.498646 <... mmap resumed> ) = 0x7f33164f8000
[pid 25473] 10:12:36.498662 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25509] 10:12:36.498702 write(11, "2591 1\n", 7 <unfinished ...>
[pid 25507] 10:12:36.498733 <... mmap resumed> ) = 0x7f43502b5000
[pid 25503] 10:12:36.498755 mprotect(0x7ff4d7dab000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.498783 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.498807 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.498836 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25509] 10:12:36.498887 <... write resumed> ) = 7
[pid 25507] 10:12:36.498906 mmap(0x7f43502b7000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.498935 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.498951 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25491] 10:12:36.498979 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.498996 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25509] 10:12:36.499032 close(11 <unfinished ...>
[pid 25507] 10:12:36.499057 <... mmap resumed> ) = 0x7f43502b7000
[pid 25503] 10:12:36.499079 mmap(0x7ff4d7faa000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25502] 10:12:36.499109 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25491] 10:12:36.499135 read(11,  <unfinished ...>
[pid 25473] 10:12:36.499162 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.499243 <... close resumed> ) = 0
[pid 25507] 10:12:36.499271 close(6 <unfinished ...>
[pid 25503] 10:12:36.499297 <... mmap resumed> ) = 0x7ff4d7faa000
[pid 25502] 10:12:36.499322 <... mmap resumed> ) = 0x7f3c0be2c000
[pid 25491] 10:12:36.499342 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25473] 10:12:36.499370 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25509] 10:12:36.499408 fstat(14,  <unfinished ...>
[pid 25507] 10:12:36.499439 <... close resumed> ) = 0
[pid 25503] 10:12:36.499462 close(6 <unfinished ...>
[pid 25502] 10:12:36.499486 close(7 <unfinished ...>
[pid 25491] 10:12:36.499582 read(11,  <unfinished ...>
[pid 25473] 10:12:36.499611 <... stat resumed> 0x7ffdac33a290) = -1 ENOENT (No such file or directory)
[pid 25509] 10:12:36.499646 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016472, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2591, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.499678 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.499708 <... close resumed> ) = 0
[pid 25502] 10:12:36.499735 <... close resumed> ) = 0
[pid 25491] 10:12:36.499762 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.499791 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.499831 close(14 <unfinished ...>
[pid 25507] 10:12:36.499855 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.499873 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.499902 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.499934 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.499959 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.500010 <... close resumed> ) = 0
[pid 25507] 10:12:36.500041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.500076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.500093 <... open resumed> ) = 7
[pid 25491] 10:12:36.500109 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.500144 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25509] 10:12:36.500182 rename("tmp/1451491956.H493151P25509.fin.finestweddingsites.com", "new/1451491956.H493151P25509.fin.finestweddingsites.com,S=2591" <unfinished ...>
[pid 25507] 10:12:36.500236 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.500254 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.500287 read(7,  <unfinished ...>
[pid 25491] 10:12:36.500311 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25473] 10:12:36.500339 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25509] 10:12:36.500405 <... rename resumed> ) = 0
[pid 25507] 10:12:36.500436 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.500468 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.500485 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.500596 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25473] 10:12:36.500645 stat("/etc/userdomains",  <unfinished ...>
[pid 25509] 10:12:36.500683 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.500717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.500738 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.500769 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.500792 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25473] 10:12:36.500819 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25509] 10:12:36.500871 <... write resumed> ) = 4
[pid 25507] 10:12:36.500890 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.500922 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.500941 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25491] 10:12:36.500976 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.501031 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25458] 10:12:36.501062 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.501093 write(12, "\37\n\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.501120 <... open resumed> ) = 6
[pid 25503] 10:12:36.501136 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.501167 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25491] 10:12:36.501201 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.501227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25458] 10:12:36.501266 read(11,  <unfinished ...>
[pid 25509] 10:12:36.501305 <... write resumed> ) = 4
[pid 25507] 10:12:36.501323 read(6,  <unfinished ...>
[pid 25503] 10:12:36.501346 <... open resumed> ) = 6
[pid 25502] 10:12:36.501361 <... mmap resumed> ) = 0x7f3c077c7000
[pid 25491] 10:12:36.501378 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.501425 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25458] 10:12:36.501455 <... read resumed> "\37\n\0\0", 4) = 4
[pid 25509] 10:12:36.501483 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25507] 10:12:36.501584 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.501614 read(6,  <unfinished ...>
[pid 25502] 10:12:36.501639 mprotect(0x7f3c077d3000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.501668 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25473] 10:12:36.501696 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.501741 read(11,  <unfinished ...>
[pid 25509] 10:12:36.501778 <... write resumed> ) = 4
[pid 25507] 10:12:36.501794 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.501816 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.501839 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.501855 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.501902 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.501928 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25509] 10:12:36.501956 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.501981 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.502009 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.502032 mmap(0x7f3c079d3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25491] 10:12:36.502063 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:36.502088 <... lseek resumed> ) = 2781
[pid 25458] 10:12:36.502124 read(11,  <unfinished ...>
[pid 25509] 10:12:36.502162 <... write resumed> ) = 4
[pid 25507] 10:12:36.502178 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.502204 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25502] 10:12:36.502234 <... mmap resumed> ) = 0x7f3c079d3000
[pid 25491] 10:12:36.502262 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.502305 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.502334 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.502362 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.502389 <... mmap resumed> ) = 0x7f43504cc000
[pid 25503] 10:12:36.502409 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.502439 close(7 <unfinished ...>
[pid 25491] 10:12:36.502462 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.502489 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.502634 read(11,  <unfinished ...>
[pid 25509] 10:12:36.502675 <... write resumed> ) = 4
[pid 25507] 10:12:36.502692 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.502720 <... mmap resumed> ) = 0x7ff4d7966000
[pid 25502] 10:12:36.502737 <... close resumed> ) = 0
[pid 25491] 10:12:36.502779 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.502877 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25458] 10:12:36.502912 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.502940 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.502965 <... mmap resumed> ) = 0x7f434fe86000
[pid 25503] 10:12:36.502981 mprotect(0x7ff4d7b1f000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.503009 mprotect(0x7f3c079d3000, 4096, PROT_READ <unfinished ...>
[pid 25491] 10:12:36.503035 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.503059 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.503105 read(11,  <unfinished ...>
[pid 25509] 10:12:36.503148 <... write resumed> ) = 4
[pid 25507] 10:12:36.503165 mprotect(0x7f434fe9c000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.503192 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.503208 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.503228 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.503245 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25458] 10:12:36.503273 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.503300 write(12, "\260\363D\1\0\0\0\0", 8 <unfinished ...>
[pid 25507] 10:12:36.503325 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.503340 mmap(0x7ff4d7d1e000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25502] 10:12:36.503371 munmap(0x7f3c0be2c000, 39387 <unfinished ...>
[pid 25491] 10:12:36.503405 read(10,  <unfinished ...>
[pid 25473] 10:12:36.503429 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.503482 read(11,  <unfinished ...>
[pid 25509] 10:12:36.503593 <... write resumed> ) = 8
[pid 25507] 10:12:36.503613 mmap(0x7f435009b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25503] 10:12:36.503643 <... mmap resumed> ) = 0x7ff4d7d1e000
[pid 25502] 10:12:36.503665 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.503692 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25473] 10:12:36.503727 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25458] 10:12:36.503759 <... read resumed> "\260\363D\1\0\0\0\0", 8) = 8
[pid 25509] 10:12:36.503787 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.503813 <... mmap resumed> ) = 0x7f435009b000
[pid 25503] 10:12:36.503833 mmap(0x7ff4d7d45000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.503863 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.503893 read(10,  <unfinished ...>
[pid 25473] 10:12:36.503916 <... stat resumed> 0x7ffdac33a290) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.503941 read(11,  <unfinished ...>
[pid 25509] 10:12:36.503977 <... write resumed> ) = 4
[pid 25507] 10:12:36.503993 mmap(0x7f435009d000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.504020 <... mmap resumed> ) = 0x7ff4d7d45000
[pid 25502] 10:12:36.504042 <... open resumed> ) = 7
[pid 25491] 10:12:36.504066 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.504111 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.504142 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.504171 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.504195 <... mmap resumed> ) = 0x7f435009d000
[pid 25503] 10:12:36.504216 close(6 <unfinished ...>
[pid 25502] 10:12:36.504240 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:36.504263 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.504290 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.504333 read(11,  <unfinished ...>
[pid 25509] 10:12:36.504373 <... write resumed> ) = 4
[pid 25507] 10:12:36.504389 close(6 <unfinished ...>
[pid 25503] 10:12:36.504411 <... close resumed> ) = 0
[pid 25502] 10:12:36.504437 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25491] 10:12:36.504460 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25473] 10:12:36.504500 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25458] 10:12:36.504637 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25509] 10:12:36.504668 close(12 <unfinished ...>
[pid 25507] 10:12:36.504693 <... close resumed> ) = 0
[pid 25503] 10:12:36.504716 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.504749 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.504772 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.504800 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25458] 10:12:36.504859 close(11 <unfinished ...>
[pid 25509] 10:12:36.504903 <... close resumed> ) = 0
[pid 25507] 10:12:36.504921 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.504952 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.504970 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.505005 <... open resumed> ) = 12
[pid 25473] 10:12:36.505022 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.505051 <... close resumed> ) = 0
[pid 25509] 10:12:36.505087 close(10 <unfinished ...>
[pid 25507] 10:12:36.505113 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.505130 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.505164 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.505191 fstat(12,  <unfinished ...>
[pid 25473] 10:12:36.505214 <... open resumed> ) = 12
[pid 25458] 10:12:36.505230 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25509] 10:12:36.505276 <... close resumed> ) = 0
[pid 25507] 10:12:36.505293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.505324 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.505340 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25491] 10:12:36.505357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25473] 10:12:36.505388 fstat(12,  <unfinished ...>
[pid 25458] 10:12:36.505411 <... write resumed> ) = 55
[pid 25509] 10:12:36.505443 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.505476 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.505493 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.505605 read(7,  <unfinished ...>
[pid 25491] 10:12:36.505635 fstat(12,  <unfinished ...>
[pid 25473] 10:12:36.505657 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.505690 fsync(9 <unfinished ...>
[pid 25509] 10:12:36.505760 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.505791 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.505910 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.505930 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.505971 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25473] 10:12:36.506001 fstat(12,  <unfinished ...>
[pid 25509] 10:12:36.506041 close(13 <unfinished ...>
[pid 25507] 10:12:36.506066 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.506090 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.506123 close(7 <unfinished ...>
[pid 25491] 10:12:36.506147 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.506175 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.506204 <... fsync resumed> ) = 0
[pid 25509] 10:12:36.506231 <... close resumed> ) = 0
[pid 25507] 10:12:36.506247 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.506283 <... open resumed> ) = 6
[pid 25502] 10:12:36.506299 <... close resumed> ) = 0
[pid 25491] 10:12:36.506318 <... mmap resumed> ) = 0x7f33164f7000
[pid 25473] 10:12:36.506334 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.506360 wait4(-1,  <unfinished ...>
[pid 25509] 10:12:36.506391 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25507] 10:12:36.506418 <... open resumed> ) = 6
[pid 25503] 10:12:36.506434 read(6,  <unfinished ...>
[pid 25502] 10:12:36.506457 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25491] 10:12:36.506482 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.506505 <... mmap resumed> ) = 0x7f7c15ca5000
[pid 25509] 10:12:36.506609 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.507046 read(6,  <unfinished ...>
[pid 25503] 10:12:36.507078 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.507103 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.507145 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.507165 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25509] 10:12:36.507198 exit_group(0) = ?
[pid 25507] 10:12:36.507585 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.507618 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.507642 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.507673 read(12,  <unfinished ...>
[pid 25473] 10:12:36.507696 <... lseek resumed> ) = 0
[pid 25509] 10:12:36.507734 +++ exited with 0 +++
[pid 25507] 10:12:36.507748 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.507770 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25502] 10:12:36.507801 <... socket resumed> ) = 7
[pid 25491] 10:12:36.507817 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.507842 read(12,  <unfinished ...>
[pid 25458] 10:12:36.507871 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25509
[pid 25507] 10:12:36.507929 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.507963 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.507990 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.508029 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.508056 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25458] 10:12:36.508095 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.508137 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.508165 <... mmap resumed> ) = 0x7ff4da3d9000
[pid 25502] 10:12:36.508185 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.508206 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:36.508258 stat("/jail_owner",  <unfinished ...>
[pid 25458] 10:12:36.508294 <... open resumed> ) = 10
[pid 25507] 10:12:36.508321 <... mmap resumed> ) = 0x7f434fc4f000
[pid 25503] 10:12:36.508338 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.508367 close(7 <unfinished ...>
[pid 25491] 10:12:36.508395 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.508424 <... stat resumed> 0x7ffdac33b840) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.508448 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.508482 mprotect(0x7f434fc56000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.508609 <... mmap resumed> ) = 0x7ff4d7739000
[pid 25502] 10:12:36.508631 <... close resumed> ) = 0
[pid 25491] 10:12:36.508648 <... open resumed> ) = 13
[pid 25473] 10:12:36.508666 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.508699 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.508741 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.508760 mprotect(0x7ff4d7765000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.508787 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25491] 10:12:36.508814 fstat(13,  <unfinished ...>
[pid 25473] 10:12:36.508837 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.508873 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.508906 mmap(0x7f434fe56000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25503] 10:12:36.508936 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.508952 <... socket resumed> ) = 7
[pid 25491] 10:12:36.508968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.508996 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.509026 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.509062 <... mmap resumed> ) = 0x7f434fe56000
[pid 25503] 10:12:36.509083 mmap(0x7ff4d7965000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25502] 10:12:36.509112 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25491] 10:12:36.509145 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.509171 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.509202 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.509238 mmap(0x7f434fe58000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.509266 <... mmap resumed> ) = 0x7ff4d7965000
[pid 25502] 10:12:36.509287 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.509305 <... mmap resumed> ) = 0x7f33164f6000
[pid 25473] 10:12:36.509322 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25458] 10:12:36.509351 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25507] 10:12:36.509378 <... mmap resumed> ) = 0x7f434fe58000
[pid 25503] 10:12:36.509400 close(6 <unfinished ...>
[pid 25502] 10:12:36.509425 close(7 <unfinished ...>
[pid 25491] 10:12:36.509452 read(13,  <unfinished ...>
[pid 25473] 10:12:36.509479 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25458] 10:12:36.509591 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.509631 close(6 <unfinished ...>
[pid 25503] 10:12:36.509654 <... close resumed> ) = 0
[pid 25502] 10:12:36.509680 <... close resumed> ) = 0
[pid 25491] 10:12:36.509705 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.509738 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25458] 10:12:36.509768 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.509793 <... close resumed> ) = 0
[pid 25503] 10:12:36.509815 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.509851 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.509879 close(13 <unfinished ...>
[pid 25473] 10:12:36.509903 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.509926 read(10,  <unfinished ...>
[pid 25507] 10:12:36.509962 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.509992 <... open resumed> ) = 6
[pid 25502] 10:12:36.510007 <... open resumed> ) = 7
[pid 25491] 10:12:36.510025 <... close resumed> ) = 0
[pid 25473] 10:12:36.510042 stat("/etc/demouids",  <unfinished ...>
[pid 25458] 10:12:36.510069 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25507] 10:12:36.510262 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.510290 read(6,  <unfinished ...>
[pid 25502] 10:12:36.510316 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.510340 munmap(0x7f33164f6000, 4096 <unfinished ...>
[pid 25473] 10:12:36.510368 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.510413 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.510455 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.510490 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.510597 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.510631 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.510674 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.510708 <... stat resumed> 0x7ffc7ad958e0) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.510745 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.510765 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.510788 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.510815 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.510843 <... open resumed> ) = 13
[pid 25458] 10:12:36.510860 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.510894 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.510924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:36.510954 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25491] 10:12:36.510971 <... open resumed> ) = 13
[pid 25473] 10:12:36.510988 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.511010 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.511062 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.511084 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.511115 read(7,  <unfinished ...>
[pid 25491] 10:12:36.511142 fstat(13,  <unfinished ...>
[pid 25473] 10:12:36.511165 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.511196 write(8, "2015-12-30 10:12:36 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25507] 10:12:36.511237 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.511269 <... mmap resumed> ) = 0x7ff4d7534000
[pid 25502] 10:12:36.511285 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.511320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.511354 fstat(13,  <unfinished ...>
[pid 25458] 10:12:36.511377 <... write resumed> ) = 132
[pid 25507] 10:12:36.511411 <... open resumed> ) = 6
[pid 25503] 10:12:36.511428 mprotect(0x7ff4d7539000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.511456 close(7 <unfinished ...>
[pid 25491] 10:12:36.511486 fstat(13,  <unfinished ...>
[pid 25473] 10:12:36.511588 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.511623 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.511658 read(6,  <unfinished ...>
[pid 25503] 10:12:36.511682 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.511698 <... close resumed> ) = 0
[pid 25491] 10:12:36.511715 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.511742 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.511768 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.511817 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.511843 mmap(0x7ff4d7738000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25502] 10:12:36.511873 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25491] 10:12:36.511900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.511925 <... mmap resumed> ) = 0x7f7c15ca4000
[pid 25458] 10:12:36.511942 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.511977 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.511999 <... mmap resumed> ) = 0x7ff4d7738000
[pid 25502] 10:12:36.512019 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.512057 <... mmap resumed> ) = 0x7f33164f6000
[pid 25473] 10:12:36.512077 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.512100 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.512141 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.512170 close(6 <unfinished ...>
[pid 25502] 10:12:36.512193 read(6,  <unfinished ...>
[pid 25491] 10:12:36.512218 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.512240 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.512257 close(7 <unfinished ...>
[pid 25507] 10:12:36.512290 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.512317 <... close resumed> ) = 0
[pid 25502] 10:12:36.512344 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25491] 10:12:36.512404 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.512425 read(13,  <unfinished ...>
[pid 25458] 10:12:36.512454 <... close resumed> ) = 0
[pid 25507] 10:12:36.512484 <... mmap resumed> ) = 0x7f434f9cb000
[pid 25503] 10:12:36.512502 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.512640 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.512671 read(13,  <unfinished ...>
[pid 25473] 10:12:36.512698 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.512724 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25507] 10:12:36.512769 mprotect(0x7f434fa4e000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.512797 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.512815 <... open resumed> ) = 7
[pid 25491] 10:12:36.512832 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25473] 10:12:36.512857 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25458] 10:12:36.512885 <... open resumed> ) = 7
[pid 25507] 10:12:36.512910 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.512926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.512958 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.512981 read(13,  <unfinished ...>
[pid 25473] 10:12:36.513003 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25458] 10:12:36.513070 fcntl(7, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.513107 mmap(0x7f434fc4d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25503] 10:12:36.513138 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.513155 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.513184 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.513210 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.513239 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.513264 <... mmap resumed> ) = 0x7f434fc4d000
[pid 25503] 10:12:36.513290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.513322 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.513348 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25473] 10:12:36.513378 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.513413 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.513448 close(6 <unfinished ...>
[pid 25503] 10:12:36.513471 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.513498 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25491] 10:12:36.513604 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25473] 10:12:36.513645 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.513670 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.513695 <... close resumed> ) = 0
[pid 25503] 10:12:36.513718 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.513757 read(7,  <unfinished ...>
[pid 25491] 10:12:36.513784 stat("/usr/local/cpanel/3rdparty/mailman/lists/scarroll_ncghotels.com/config.pck",  <unfinished ...>
[pid 25473] 10:12:36.513815 <... lseek resumed> ) = 353
[pid 25458] 10:12:36.513851 fstat(7,  <unfinished ...>
[pid 25507] 10:12:36.513887 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.513916 <... open resumed> ) = 6
[pid 25502] 10:12:36.513932 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25491] 10:12:36.513956 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.513985 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.514015 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377639, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.514052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.514070 read(6,  <unfinished ...>
[pid 25502] 10:12:36.514093 close(7 <unfinished ...>
[pid 25491] 10:12:36.514116 stat("/etc/demouids",  <unfinished ...>
[pid 25473] 10:12:36.514141 <... open resumed> ) = 14
[pid 25458] 10:12:36.514159 write(7, "2015-12-30 10:12:36 [25458] 1aEJMY-0006cO-Sq => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2591 QT=2s DT=0s\n", 232 <unfinished ...>
[pid 25507] 10:12:36.514203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.514234 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.514257 <... close resumed> ) = 0
[pid 25491] 10:12:36.514274 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.514314 fstat(14,  <unfinished ...>
[pid 25458] 10:12:36.514339 <... write resumed> ) = 232
[pid 25507] 10:12:36.514374 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.514395 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.514418 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25491] 10:12:36.514446 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.514475 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.514503 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25507] 10:12:36.514679 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.514710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25502] 10:12:36.514746 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.514771 <... open resumed> ) = 14
[pid 25473] 10:12:36.514789 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.514816 <... open resumed> ) = 11
[pid 25507] 10:12:36.514840 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.514860 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:36.514890 read(6,  <unfinished ...>
[pid 25491] 10:12:36.514914 fstat(14,  <unfinished ...>
[pid 25473] 10:12:36.514936 <... mmap resumed> ) = 0x7f7c15ca3000
[pid 25458] 10:12:36.514953 alarm(60 <unfinished ...>
[pid 25507] 10:12:36.514986 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.515016 <... mmap resumed> ) = 0x7ff4d7331000
[pid 25502] 10:12:36.515032 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25491] 10:12:36.515072 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.515106 read(14,  <unfinished ...>
[pid 25458] 10:12:36.515134 <... alarm resumed> ) = 0
[pid 25507] 10:12:36.515158 <... open resumed> ) = 6
[pid 25503] 10:12:36.515174 mprotect(0x7ff4d7333000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.515202 uname( <unfinished ...>
[pid 25491] 10:12:36.515224 fstat(14,  <unfinished ...>
[pid 25473] 10:12:36.515247 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:36.515272 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25507] 10:12:36.515310 read(6,  <unfinished ...>
[pid 25503] 10:12:36.515332 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.515349 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25491] 10:12:36.515411 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.515451 close(14 <unfinished ...>
[pid 25458] 10:12:36.515480 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.515589 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.515620 mmap(0x7ff4d7532000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25502] 10:12:36.515651 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25491] 10:12:36.515680 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.515712 <... close resumed> ) = 0
[pid 25458] 10:12:36.515728 alarm(0 <unfinished ...>
[pid 25507] 10:12:36.515760 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.515783 <... mmap resumed> ) = 0x7ff4d7532000
[pid 25502] 10:12:36.515808 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f3c0ad03790}, 8) = 0
[pid 25491] 10:12:36.515839 <... mmap resumed> ) = 0x7f33164f5000
[pid 25473] 10:12:36.515857 munmap(0x7f7c15ca3000, 4096 <unfinished ...>
[pid 25458] 10:12:36.515885 <... alarm resumed> ) = 60
[pid 25507] 10:12:36.515967 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25503] 10:12:36.516001 close(6 <unfinished ...>
[pid 25502] 10:12:36.516024 clone( <unfinished ...>
[pid 25491] 10:12:36.516256 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.516281 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.516311 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25507] 10:12:36.516357 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.516391 <... close resumed> ) = 0
[pid 25491] 10:12:36.516427 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.516448 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.516481 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.516588 <... mmap resumed> ) = 0x7f43504cb000
[pid 25503] 10:12:36.516617 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.516649 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25510
[pid 25491] 10:12:36.516694 read(14,  <unfinished ...>
[pid 25473] 10:12:36.516720 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.516744 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.516785 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.516813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.516830 wait4(25510,  <unfinished ...>
[pid 25491] 10:12:36.516852 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.516877 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.516905 <... open resumed> ) = 12
[pid 25507] 10:12:36.516929 <... mmap resumed> ) = 0x7f434f7bd000
[pid 25503] 10:12:36.516946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.516978 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25473] 10:12:36.517006 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.517051 fcntl(12, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.517085 mprotect(0x7f434f7c9000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.517114 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.517132 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25473] 10:12:36.517283 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.517321 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.517346 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.517368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.517401 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.517429 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:36.517466 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.517500 mmap(0x7f434f9c9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25503] 10:12:36.517613 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.517635 <... open resumed> ) = 15
[pid 25473] 10:12:36.517655 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.517684 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.517709 <... mmap resumed> ) = 0x7f434f9c9000
[pid 25503] 10:12:36.517735 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.517770 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.517793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:36.517839 read(12,  <unfinished ...>
[pid 25507] 10:12:36.517875 close(6 <unfinished ...>
[pid 25503] 10:12:36.517898 <... open resumed> ) = 6
[pid 25491] 10:12:36.517914 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25473] 10:12:36.517942 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.517968 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25507] 10:12:36.518002 <... close resumed> ) = 0
[pid 25503] 10:12:36.518026 read(6,  <unfinished ...>
[pid 25491] 10:12:36.518051 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.518078 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.518117 close(12 <unfinished ...>
[pid 25507] 10:12:36.518151 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.518184 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.518207 <... mmap resumed> ) = 0x7f33164f4000
[pid 25473] 10:12:36.518224 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.518250 <... close resumed> ) = 0
[pid 25507] 10:12:36.518280 <... open resumed> ) = 6
[pid 25503] 10:12:36.518304 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.518329 read(15,  <unfinished ...>
[pid 25473] 10:12:36.518356 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.518402 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.518451 read(6,  <unfinished ...>
[pid 25503] 10:12:36.518481 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.518621 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:36.518656 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.518684 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.518711 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.518735 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.518762 close(15 <unfinished ...>
[pid 25473] 10:12:36.518786 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25458] 10:12:36.518836 stat("/var/tmp",  <unfinished ...>
[pid 25507] 10:12:36.518877 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.518900 <... mmap resumed> ) = 0x7ff4da3d8000
[pid 25491] 10:12:36.518920 <... close resumed> ) = 0
[pid 25473] 10:12:36.518937 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25458] 10:12:36.518964 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25507] 10:12:36.519091 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25503] 10:12:36.519126 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.519157 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25473] 10:12:36.519185 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25458] 10:12:36.519208 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.519248 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.519274 <... mmap resumed> ) = 0x7ff4d710e000
[pid 25491] 10:12:36.519291 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.519350 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25458] 10:12:36.519385 <... open resumed> ) = 12
[pid 25507] 10:12:36.519409 <... mmap resumed> ) = 0x7f434f59a000
[pid 25503] 10:12:36.519431 mprotect(0x7ff4d7125000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.519460 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25473] 10:12:36.519487 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:36.519612 fcntl(12, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.519656 mprotect(0x7f434f5bb000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.519695 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.519712 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25473] 10:12:36.519758 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.519792 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.519815 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.519832 mmap(0x7ff4d7325000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25491] 10:12:36.519861 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.519889 <... open resumed> ) = 14
[pid 25458] 10:12:36.519906 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.519938 mmap(0x7f434f7bb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25503] 10:12:36.519965 <... mmap resumed> ) = 0x7ff4d7325000
[pid 25491] 10:12:36.519992 <... open resumed> ) = 15
[pid 25473] 10:12:36.520011 fstat(14,  <unfinished ...>
[pid 25458] 10:12:36.520034 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.520058 <... mmap resumed> ) = 0x7f434f7bb000
[pid 25503] 10:12:36.520078 close(6 <unfinished ...>
[pid 25491] 10:12:36.520102 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.520124 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:36.520155 fstat(12,  <unfinished ...>
[pid 25507] 10:12:36.520186 close(6 <unfinished ...>
[pid 25503] 10:12:36.520209 <... close resumed> ) = 0
[pid 25491] 10:12:36.520249 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.520278 fstat(14,  <unfinished ...>
[pid 25458] 10:12:36.520301 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.520351 <... close resumed> ) = 0
[pid 25503] 10:12:36.520376 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.520407 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.520434 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25458] 10:12:36.520461 pread(12,  <unfinished ...>
[pid 25507] 10:12:36.520495 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.520611 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.520637 <... mmap resumed> ) = 0x7f33164f4000
[pid 25473] 10:12:36.520662 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.520700 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25507] 10:12:36.520750 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.520772 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.520805 read(15,  <unfinished ...>
[pid 25473] 10:12:36.520832 <... mmap resumed> ) = 0x7f7c15ca3000
[pid 25458] 10:12:36.520849 pread(12,  <unfinished ...>
[pid 25507] 10:12:36.520881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.520912 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.520929 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.520957 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25458] 10:12:36.520981 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25507] 10:12:36.521018 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.521037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.521067 close(15 <unfinished ...>
[pid 25473] 10:12:36.521091 <... lseek resumed> ) = 0
[pid 25458] 10:12:36.521108 close(12 <unfinished ...>
[pid 25507] 10:12:36.521138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.521167 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.521186 <... close resumed> ) = 0
[pid 25473] 10:12:36.521202 read(14,  <unfinished ...>
[pid 25458] 10:12:36.521225 <... close resumed> ) = 0
[pid 25507] 10:12:36.521265 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.521286 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.521318 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25473] 10:12:36.521347 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.521378 close(11 <unfinished ...>
[pid 25507] 10:12:36.521418 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.521450 <... open resumed> ) = 6
[pid 25491] 10:12:36.521466 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.521493 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.521616 <... close resumed> ) = 0
[pid 25507] 10:12:36.521672 <... open resumed> ) = 6
[pid 25503] 10:12:36.521697 read(6,  <unfinished ...>
[pid 25491] 10:12:36.521722 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.521750 <... open resumed> ) = 15
[pid 25458] 10:12:36.521767 pipe( <unfinished ...>
[pid 25507] 10:12:36.521803 read(6,  <unfinished ...>
[pid 25503] 10:12:36.521831 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.521855 <... open resumed> ) = 15
[pid 25473] 10:12:36.521872 fstat(15,  <unfinished ...>
[pid 25458] 10:12:36.521895 <... pipe resumed> [11, 12]) = 0
[pid 25507] 10:12:36.521921 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.522006 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.522034 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.522057 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.522088 close(10 <unfinished ...>
[pid 25507] 10:12:36.522120 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.522142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.522172 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25473] 10:12:36.522200 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.522226 <... close resumed> ) = 0
[pid 25507] 10:12:36.522249 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.522278 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.522308 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.522333 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25458] 10:12:36.522351 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.522387 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.522414 <... mmap resumed> ) = 0x7ff4d6eca000
[pid 25491] 10:12:36.522430 <... mmap resumed> ) = 0x7f33164f4000
[pid 25473] 10:12:36.522446 read(15,  <unfinished ...>
[pid 25458] 10:12:36.522474 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.522500 <... mmap resumed> ) = 0x7f434f37d000
[pid 25503] 10:12:36.522577 mprotect(0x7ff4d6f0b000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.522613 read(15,  <unfinished ...>
[pid 25473] 10:12:36.522646 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.522688 clone( <unfinished ...>
[pid 25507] 10:12:36.522974 mprotect(0x7f434f394000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.523002 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.523018 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25473] 10:12:36.523045 close(15 <unfinished ...>
[pid 25507] 10:12:36.523078 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.523094 mmap(0x7ff4d710b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25491] 10:12:36.523123 close(15 <unfinished ...>
[pid 25473] 10:12:36.523147 <... close resumed> ) = 0
[pid 25458] 10:12:36.523162 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25511
[pid 25507] 10:12:36.523205 mmap(0x7f434f594000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25503] 10:12:36.523237 <... mmap resumed> ) = 0x7ff4d710b000
[pid 25491] 10:12:36.523262 <... close resumed> ) = 0
[pid 25473] 10:12:36.523280 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25458] 10:12:36.523307 close(12 <unfinished ...>
[pid 25507] 10:12:36.523337 <... mmap resumed> ) = 0x7f434f594000
[pid 25503] 10:12:36.523357 close(6 <unfinished ...>
[pid 25491] 10:12:36.523380 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25473] 10:12:36.523405 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.523435 <... close resumed> ) = 0
[pid 25507] 10:12:36.523463 mmap(0x7f434f596000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.523493 <... close resumed> ) = 0
[pid 25491] 10:12:36.523589 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.523716 stat("/etc/userdomains",  <unfinished ...>
[pid 25458] 10:12:36.523753 read(11,  <unfinished ...>
[pid 25507] 10:12:36.523782 <... mmap resumed> ) = 0x7f434f596000
[pid 25503] 10:12:36.523804 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.523837 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.523865 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.523919 close(6 <unfinished ...>
[pid 25503] 10:12:36.523945 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.523963 <... open resumed> ) = 15
[pid 25473] 10:12:36.523980 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25507] 10:12:36.524013 <... close resumed> ) = 0
[pid 25503] 10:12:36.524037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.524071 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.524093 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.524123 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.524154 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.524171 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.524203 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.524235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.524252 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.524287 fstat(15,  <unfinished ...>
[pid 25473] 10:12:36.524310 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.524350 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.524385 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.524404 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.524432 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25507] 10:12:36.524466 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.524482 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.524593 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.524623 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25507] 10:12:36.524672 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.524705 <... open resumed> ) = 6
[pid 25491] 10:12:36.524721 <... mmap resumed> ) = 0x7f33164f4000
[pid 25473] 10:12:36.524737 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25507] 10:12:36.524770 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.524789 read(6,  <unfinished ...>
[pid 25491] 10:12:36.524813 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.524835 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.524863 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.524893 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.524916 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.524933 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.524965 <... open resumed> ) = 6
[pid 25503] 10:12:36.524980 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.525003 read(15,  <unfinished ...>
[pid 25473] 10:12:36.525029 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.525077 read(6,  <unfinished ...>
[pid 25503] 10:12:36.525103 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.525133 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25473] 10:12:36.525154 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25507] 10:12:36.525187 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.525215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.525242 read(15,  <unfinished ...>
[pid 25473] 10:12:36.525265 <... stat resumed> 0x7ffdac33e630) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.525293 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.525320 <... mmap resumed> ) = 0x7ff4da3d7000
[pid 25491] 10:12:36.525340 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.525421 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.525461 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.525491 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.525629 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.525655 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.525700 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.525729 <... mmap resumed> ) = 0x7ff4d6be3000
[pid 25491] 10:12:36.525746 <... lseek resumed> ) = 353
[pid 25473] 10:12:36.525766 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.525801 <... mmap resumed> ) = 0x7f43504ca000
[pid 25503] 10:12:36.525820 mprotect(0x7ff4d6cbe000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.525848 read(9,  <unfinished ...>
[pid 25473] 10:12:36.525871 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.525967 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.526001 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.526018 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.526053 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.526087 <... mmap resumed> ) = 0x7f434f009000
[pid 25503] 10:12:36.526104 mmap(0x7ff4d6ebe000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25491] 10:12:36.526134 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:36.526156 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.526179 mprotect(0x7f434f178000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.526207 <... mmap resumed> ) = 0x7ff4d6ebe000
[pid 25491] 10:12:36.526232 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.526250 read(14,  <unfinished ...>
[pid 25507] 10:12:36.526280 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.526295 close(6 <unfinished ...>
[pid 25491] 10:12:36.526318 read(9,  <unfinished ...>
[pid 25473] 10:12:36.526343 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.526385 mmap(0x7f434f377000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25503] 10:12:36.526420 <... close resumed> ) = 0
[pid 25491] 10:12:36.526445 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:36.526602 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.526648 <... mmap resumed> ) = 0x7f434f377000
[pid 25503] 10:12:36.526674 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.526708 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.526740 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.526788 close(6 <unfinished ...>
[pid 25503] 10:12:36.526813 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.526831 <... stat resumed> 0x7f3314b98880) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.526861 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.526901 <... close resumed> ) = 0
[pid 25503] 10:12:36.526925 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.526958 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25473] 10:12:36.526984 <... open resumed> ) = 15
[pid 25507] 10:12:36.527007 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.527036 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.527053 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.527102 fstat(15,  <unfinished ...>
[pid 25507] 10:12:36.527136 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.527153 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.527183 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.527215 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.527252 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.527284 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.527303 <... open resumed> ) = 16
[pid 25473] 10:12:36.527325 fstat(15,  <unfinished ...>
[pid 25507] 10:12:36.527356 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.527374 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.527405 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:36.527432 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.527466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.527496 <... open resumed> ) = 6
[pid 25491] 10:12:36.527603 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:36.527633 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.527675 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.527696 read(6,  <unfinished ...>
[pid 25491] 10:12:36.527720 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.527743 <... mmap resumed> ) = 0x7f7c15ca2000
[pid 25507] 10:12:36.527766 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.527799 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.527823 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.527840 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.527870 <... open resumed> ) = 6
[pid 25503] 10:12:36.527885 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.527908 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.527930 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.527953 read(6,  <unfinished ...>
[pid 25503] 10:12:36.527976 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.528007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25473] 10:12:36.528035 read(15,  <unfinished ...>
[pid 25507] 10:12:36.528065 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.528087 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.528118 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.528142 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.528173 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.528198 <... mmap resumed> ) = 0x7ff4d69df000
[pid 25491] 10:12:36.528214 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.528232 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.528266 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25503] 10:12:36.528294 mprotect(0x7ff4d69e2000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.528325 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.528348 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.528402 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.528439 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.528456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25473] 10:12:36.528606 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.528652 <... mmap resumed> ) = 0x7f434ed7a000
[pid 25503] 10:12:36.528670 mmap(0x7ff4d6be1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25491] 10:12:36.528700 read(16,  <unfinished ...>
[pid 25473] 10:12:36.528723 <... open resumed> ) = 16
[pid 25507] 10:12:36.528746 mprotect(0x7f434ee05000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.528773 <... mmap resumed> ) = 0x7ff4d6be1000
[pid 25491] 10:12:36.528799 <... read resumed> "0", 8192) = 1
[pid 25473] 10:12:36.528821 fstat(16,  <unfinished ...>
[pid 25507] 10:12:36.528851 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.528866 close(6 <unfinished ...>
[pid 25491] 10:12:36.528889 read(16,  <unfinished ...>
[pid 25473] 10:12:36.528911 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25507] 10:12:36.528945 mmap(0x7f434f005000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25503] 10:12:36.528975 <... close resumed> ) = 0
[pid 25491] 10:12:36.528999 <... read resumed> "", 8192) = 0
[pid 25473] 10:12:36.529021 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.529055 <... mmap resumed> ) = 0x7f434f005000
[pid 25503] 10:12:36.529075 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.529106 close(16 <unfinished ...>
[pid 25473] 10:12:36.529130 <... mmap resumed> ) = 0x7f7c15ca1000
[pid 25507] 10:12:36.529152 mmap(0x7f434f008000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.529180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.529198 <... close resumed> ) = 0
[pid 25473] 10:12:36.529274 read(16,  <unfinished ...>
[pid 25507] 10:12:36.529315 <... mmap resumed> ) = 0x7f434f008000
[pid 25503] 10:12:36.529339 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.529374 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.529404 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25507] 10:12:36.529437 close(6 <unfinished ...>
[pid 25503] 10:12:36.529460 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.529477 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25473] 10:12:36.529598 close(16 <unfinished ...>
[pid 25507] 10:12:36.529639 <... close resumed> ) = 0
[pid 25503] 10:12:36.529663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.529696 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.529721 <... close resumed> ) = 0
[pid 25507] 10:12:36.529743 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.529772 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.529792 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.529839 munmap(0x7f7c15ca1000, 4096 <unfinished ...>
[pid 25507] 10:12:36.529877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.529895 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.529927 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.529952 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.529990 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.530025 <... open resumed> ) = 6
[pid 25491] 10:12:36.530041 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.530074 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.530109 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.530126 read(6,  <unfinished ...>
[pid 25491] 10:12:36.530150 close(7 <unfinished ...>
[pid 25473] 10:12:36.530174 <... open resumed> ) = 16
[pid 25507] 10:12:36.530197 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.530226 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.530249 <... close resumed> ) = 0
[pid 25473] 10:12:36.530268 fstat(16,  <unfinished ...>
[pid 25507] 10:12:36.530298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.530317 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.530340 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25473] 10:12:36.530374 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25507] 10:12:36.530411 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.530444 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.530472 <... open resumed> ) = 7
[pid 25473] 10:12:36.530489 fstat(16,  <unfinished ...>
[pid 25507] 10:12:36.530600 <... open resumed> ) = 6
[pid 25503] 10:12:36.530618 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.530650 fcntl(7, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.530674 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25507] 10:12:36.530709 read(6,  <unfinished ...>
[pid 25503] 10:12:36.530733 <... mmap resumed> ) = 0x7ff4d67b3000
[pid 25491] 10:12:36.530750 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.530766 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.530799 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.530827 mprotect(0x7ff4d67dc000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.530856 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.530879 <... mmap resumed> ) = 0x7f7c15ca1000
[pid 25507] 10:12:36.530901 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.530924 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.530939 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.530955 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.530985 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25503] 10:12:36.531014 mmap(0x7ff4d69dc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25491] 10:12:36.531044 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.531067 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.531089 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.531117 <... mmap resumed> ) = 0x7ff4d69dc000
[pid 25491] 10:12:36.531138 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5377871, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.531168 read(16,  <unfinished ...>
[pid 25507] 10:12:36.531200 <... mmap resumed> ) = 0x7f434eb74000
[pid 25503] 10:12:36.531217 mmap(0x7ff4d69de000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.531245 write(7, "2015-12-30 10:12:36 [25491] 1aEJMZ-0006cs-RM SMTP connection outbound 1451491956 1aEJMZ-0006cs-RM finestweddingsites.com scarroll@ncghotels.com\n", 144 <unfinished ...>
[pid 25473] 10:12:36.531275 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25507] 10:12:36.531315 mprotect(0x7f434eb7a000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.531343 <... mmap resumed> ) = 0x7ff4d69de000
[pid 25491] 10:12:36.531366 <... write resumed> ) = 144
[pid 25473] 10:12:36.531428 read(16,  <unfinished ...>
[pid 25507] 10:12:36.531463 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.531479 close(6 <unfinished ...>
[pid 25491] 10:12:36.531501 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25473] 10:12:36.531643 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.531680 mmap(0x7f434ed79000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25503] 10:12:36.531713 <... close resumed> ) = 0
[pid 25491] 10:12:36.531740 <... open resumed> ) = 16
[pid 25473] 10:12:36.531763 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.531802 <... mmap resumed> ) = 0x7f434ed79000
[pid 25503] 10:12:36.531823 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.531862 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25473] 10:12:36.531903 <... open resumed> ) = 17
[pid 25507] 10:12:36.531928 close(6 <unfinished ...>
[pid 25503] 10:12:36.531952 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.531975 <... lseek resumed> ) = 13
[pid 25473] 10:12:36.531993 fstat(17,  <unfinished ...>
[pid 25507] 10:12:36.532022 <... close resumed> ) = 0
[pid 25503] 10:12:36.532045 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.532079 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:36.532104 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25507] 10:12:36.532139 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.532169 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.532186 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:36.532203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.532236 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.532253 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.532281 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.532304 <... mmap resumed> ) = 0x7f7c15ca0000
[pid 25507] 10:12:36.532327 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.532361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.532380 <... lseek resumed> ) = 13
[pid 25473] 10:12:36.532397 read(17,  <unfinished ...>
[pid 25507] 10:12:36.532437 <... open resumed> ) = 6
[pid 25503] 10:12:36.532459 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.532494 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.532591 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25507] 10:12:36.532633 read(6,  <unfinished ...>
[pid 25503] 10:12:36.532658 <... open resumed> ) = 6
[pid 25491] 10:12:36.532674 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=13, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.532703 close(17 <unfinished ...>
[pid 25507] 10:12:36.532734 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.532757 read(6,  <unfinished ...>
[pid 25491] 10:12:36.532780 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.532803 <... close resumed> ) = 0
[pid 25507] 10:12:36.532825 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.532848 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.532876 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.532904 munmap(0x7f7c15ca0000, 4096 <unfinished ...>
[pid 25507] 10:12:36.532940 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.532969 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.532993 write(16, "1", 1 <unfinished ...>
[pid 25473] 10:12:36.533023 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.533056 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.533086 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:36.533116 <... write resumed> ) = 1
[pid 25473] 10:12:36.533133 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.533169 <... mmap resumed> ) = 0x7f43504c9000
[pid 25503] 10:12:36.533189 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.533216 close(16 <unfinished ...>
[pid 25473] 10:12:36.533240 <... open resumed> ) = 17
[pid 25507] 10:12:36.533263 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.533290 <... mmap resumed> ) = 0x7ff4da3d6000
[pid 25491] 10:12:36.533309 <... close resumed> ) = 0
[pid 25473] 10:12:36.533345 fstat(17,  <unfinished ...>
[pid 25507] 10:12:36.533380 <... mmap resumed> ) = 0x7f434e83e000
[pid 25503] 10:12:36.533396 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.533426 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.533455 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25507] 10:12:36.533493 mprotect(0x7f434e96a000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.533638 <... mmap resumed> ) = 0x7ff4d659d000
[pid 25491] 10:12:36.533658 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.533684 fstat(17,  <unfinished ...>
[pid 25507] 10:12:36.533715 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.533732 mprotect(0x7ff4d65b2000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.533759 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.533788 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25507] 10:12:36.533823 mmap(0x7f434eb6a000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25503] 10:12:36.533853 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.533870 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.533918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.533956 <... mmap resumed> ) = 0x7f434eb6a000
[pid 25503] 10:12:36.533978 mmap(0x7ff4d67b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25491] 10:12:36.534007 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.534037 <... mmap resumed> ) = 0x7f7c15ca0000
[pid 25507] 10:12:36.534066 mmap(0x7f434eb73000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.534095 <... mmap resumed> ) = 0x7ff4d67b1000
[pid 25491] 10:12:36.534120 <... open resumed> ) = 16
[pid 25473] 10:12:36.534139 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.534169 <... mmap resumed> ) = 0x7f434eb73000
[pid 25503] 10:12:36.534190 close(6 <unfinished ...>
[pid 25491] 10:12:36.534214 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.534236 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.534259 close(6 <unfinished ...>
[pid 25503] 10:12:36.534282 <... close resumed> ) = 0
[pid 25491] 10:12:36.534315 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25473] 10:12:36.534346 read(17,  <unfinished ...>
[pid 25507] 10:12:36.534376 <... close resumed> ) = 0
[pid 25503] 10:12:36.534397 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.534429 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.534455 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.534492 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.534630 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.534652 <... mmap resumed> ) = 0x7f33164f3000
[pid 25473] 10:12:36.534674 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.534713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.534730 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.534762 read(16,  <unfinished ...>
[pid 25473] 10:12:36.534789 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.534837 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.534871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.534889 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25473] 10:12:36.534914 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.534947 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.534963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.534993 read(16,  <unfinished ...>
[pid 25473] 10:12:36.535015 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.535058 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.535090 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.535108 <... read resumed> "", 4096) = 0
[pid 25473] 10:12:36.535126 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.535158 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.535176 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.535206 close(16 <unfinished ...>
[pid 25473] 10:12:36.535230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.535279 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.535313 <... open resumed> ) = 6
[pid 25491] 10:12:36.535329 <... close resumed> ) = 0
[pid 25473] 10:12:36.535345 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.535379 <... open resumed> ) = 6
[pid 25503] 10:12:36.535395 read(6,  <unfinished ...>
[pid 25491] 10:12:36.535418 munmap(0x7f33164f3000, 4096 <unfinished ...>
[pid 25473] 10:12:36.535446 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.535491 read(6,  <unfinished ...>
[pid 25503] 10:12:36.535595 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:36.535631 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.535650 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.535683 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.535706 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.535729 uname( <unfinished ...>
[pid 25473] 10:12:36.535752 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.535809 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.535837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25491] 10:12:36.535867 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25473] 10:12:36.536019 write(8, "2015-12-30 10:12:36 routing failed for finest09@fin.finestweddingsites.com <embassytempe@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 174 <unfinished ...>
[pid 25507] 10:12:36.536069 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.536103 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:36.536135 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25473] 10:12:36.536166 <... write resumed> ) = 174
[pid 25507] 10:12:36.536192 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.536227 <... mmap resumed> ) = 0x7ff4d6392000
[pid 25491] 10:12:36.536245 <... socket resumed> ) = 16
[pid 25473] 10:12:36.536269 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.536319 <... mmap resumed> ) = 0x7f434e63a000
[pid 25503] 10:12:36.536348 mprotect(0x7ff4d639c000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:36.536385 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25473] 10:12:36.536425 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.536472 mprotect(0x7f434e63c000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.536502 <... mprotect resumed> ) = 0
[pid 25491] 10:12:36.536582 <... connect resumed> ) = 0
[pid 25473] 10:12:36.536605 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.536640 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.536656 mmap(0x7ff4d659b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25491] 10:12:36.536685 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25473] 10:12:36.536713 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.536751 mmap(0x7f434e83c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25503] 10:12:36.536779 <... mmap resumed> ) = 0x7ff4d659b000
[pid 25491] 10:12:36.536805 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.536828 close(7 <unfinished ...>
[pid 25507] 10:12:36.536860 <... mmap resumed> ) = 0x7f434e83c000
[pid 25503] 10:12:36.536884 close(6 <unfinished ...>
[pid 25491] 10:12:36.536911 sendto(16, "#\16\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\0\0\17\0\1", 31, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25473] 10:12:36.536965 <... close resumed> ) = 0
[pid 25507] 10:12:36.536993 close(6 <unfinished ...>
[pid 25503] 10:12:36.537017 <... close resumed> ) = 0
[pid 25491] 10:12:36.537043 <... sendto resumed> ) = 31
[pid 25473] 10:12:36.537061 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25507] 10:12:36.537101 <... close resumed> ) = 0
[pid 25503] 10:12:36.537124 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.537155 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25473] 10:12:36.537183 <... open resumed> ) = 7
[pid 25507] 10:12:36.537205 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.537235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.537253 fcntl(7, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.537282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.537299 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.537331 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.537353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.537384 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.537403 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.537432 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.537449 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.537479 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.537500 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.537612 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.537640 fstat(7,  <unfinished ...>
[pid 25507] 10:12:36.537670 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.537688 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.537721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10512, st_size=5378015, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.537757 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.537788 <... open resumed> ) = 6
[pid 25473] 10:12:36.537804 write(7, "2015-12-30 10:12:36 [25473] 1aEJMZ-0006ce-8t ** finest09@fin.finestweddingsites.com <embassytempe@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 183 <unfinished ...>
[pid 25507] 10:12:36.537844 <... open resumed> ) = 6
[pid 25503] 10:12:36.537861 read(6,  <unfinished ...>
[pid 25473] 10:12:36.537884 <... write resumed> ) = 183
[pid 25507] 10:12:36.537908 read(6,  <unfinished ...>
[pid 25503] 10:12:36.537932 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.537955 close(16Process 25510 attached
 <unfinished ...>
[pid 25507] 10:12:36.538025 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.538051 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.538075 <... close resumed> ) = 0
[pid 25510] 10:12:36.538097 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25507] 10:12:36.538121 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.538144 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25473] 10:12:36.538174 munmap(0x7f7c15ca1000, 4096 <unfinished ...>
[pid 25510] 10:12:36.538209 <... set_robust_list resumed> ) = 0
[pid 25507] 10:12:36.538223 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.538280 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.538314 <... munmap resumed> ) = 0
[pid 25510] 10:12:36.538338 geteuid( <unfinished ...>
[pid 25507] 10:12:36.538362 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.538390 <... mmap resumed> ) = 0x7ff4d618f000
[pid 25473] 10:12:36.538407 close(17 <unfinished ...>
[pid 25510] 10:12:36.538437 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.538450 <... mmap resumed> ) = 0x7f434e437000
[pid 25503] 10:12:36.538473 mprotect(0x7ff4d6191000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.538503 <... close resumed> ) = 0
[pid 25510] 10:12:36.538635 geteuid( <unfinished ...>
[pid 25507] 10:12:36.538659 mprotect(0x7f434e439000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.538686 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.538701 munmap(0x7f7c15ca0000, 4096 <unfinished ...>
[pid 25510] 10:12:36.538734 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.538747 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.538765 mmap(0x7ff4d6390000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25473] 10:12:36.538793 <... munmap resumed> ) = 0
[pid 25510] 10:12:36.538817 getegid( <unfinished ...>
[pid 25507] 10:12:36.538839 mmap(0x7f434e638000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25503] 10:12:36.538865 <... mmap resumed> ) = 0x7ff4d6390000
[pid 25473] 10:12:36.538889 close(13 <unfinished ...>
[pid 25510] 10:12:36.538922 <... getegid resumed> ) = 12
[pid 25507] 10:12:36.538935 <... mmap resumed> ) = 0x7f434e638000
[pid 25503] 10:12:36.538964 close(6 <unfinished ...>
[pid 25473] 10:12:36.538988 <... close resumed> ) = 0
[pid 25510] 10:12:36.539010 setgid(12 <unfinished ...>
[pid 25507] 10:12:36.539033 close(6 <unfinished ...>
[pid 25503] 10:12:36.539055 <... close resumed> ) = 0
[pid 25473] 10:12:36.539078 munmap(0x7f7c15ca4000, 4096 <unfinished ...>
[pid 25510] 10:12:36.539111 <... setgid resumed> ) = 0
[pid 25507] 10:12:36.539124 <... close resumed> ) = 0
[pid 25503] 10:12:36.539148 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.539176 <... munmap resumed> ) = 0
[pid 25510] 10:12:36.539199 setuid(47 <unfinished ...>
[pid 25507] 10:12:36.539223 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.539254 <... mmap resumed> ) = 0x7ff4da3d5000
[pid 25473] 10:12:36.539288 close(14 <unfinished ...>
[pid 25510] 10:12:36.539320 <... setuid resumed> ) = 0
[pid 25507] 10:12:36.539333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.540955 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.540998 <... close resumed> ) = 0
[pid 25510] 10:12:36.541021 brk(0x10c7000 <unfinished ...>
[pid 25507] 10:12:36.541043 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.541074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.541092 munmap(0x7f7c15ca3000, 4096 <unfinished ...>
[pid 25507] 10:12:36.541131 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.541150 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.541183 <... munmap resumed> ) = 0
Process 25511 attached
[pid 25507] 10:12:36.541218 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.541266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.541283 close(9 <unfinished ...>
[pid 25511] 10:12:36.541314 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25507] 10:12:36.541336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.541354 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.541384 <... close resumed> ) = 0
[pid 25511] 10:12:36.541405 <... set_robust_list resumed> ) = 0
[pid 25507] 10:12:36.541419 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.541589 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.541610 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25511] 10:12:36.541646 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25507] 10:12:36.541681 <... open resumed> ) = 6
[pid 25503] 10:12:36.541701 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.541737 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.541761 <... setrlimit resumed> ) = 0
[pid 25507] 10:12:36.541775 read(6,  <unfinished ...>
[pid 25503] 10:12:36.541917 <... open resumed> ) = 6
[pid 25473] 10:12:36.541934 close(12 <unfinished ...>
[pid 25511] 10:12:36.541965 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.541986 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.542010 read(6,  <unfinished ...>
[pid 25473] 10:12:36.542033 <... close resumed> ) = 0
[pid 25507] 10:12:36.542053 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.542075 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25473] 10:12:36.542098 munmap(0x7f7c15ca5000, 4096 <unfinished ...>
[pid 25511] 10:12:36.542137 <... open resumed> ) = 10
[pid 25507] 10:12:36.542151 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25503] 10:12:36.542191 fstat(6,  <unfinished ...>
[pid 25473] 10:12:36.542215 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.542238 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.542260 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.542287 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25473] 10:12:36.542317 close(15 <unfinished ...>
[pid 25511] 10:12:36.542347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.542373 <... mmap resumed> ) = 0x7f43504c8000
[pid 25503] 10:12:36.542407 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25473] 10:12:36.542441 <... close resumed> ) = 0
[pid 25511] 10:12:36.542465 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.542488 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.542600 <... mmap resumed> ) = 0x7ff4d5f70000
[pid 25473] 10:12:36.542619 munmap(0x7f7c15ca2000, 4096 <unfinished ...>
[pid 25511] 10:12:36.542651 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.542684 <... mmap resumed> ) = 0x7f434e0a3000
[pid 25503] 10:12:36.542710 mprotect(0x7ff4d5f8d000, 2093056, PROT_NONE <unfinished ...>
[pid 25473] 10:12:36.542739 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.542768 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.542796 mprotect(0x7f434e22d000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.542822 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.542837 close(11 <unfinished ...>
[pid 25511] 10:12:36.542867 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25507] 10:12:36.542881 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.542900 mmap(0x7ff4d618c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25473] 10:12:36.542930 <... close resumed> ) = 0
[pid 25511] 10:12:36.542952 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.542976 mmap(0x7f434e42d000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25503] 10:12:36.543004 <... mmap resumed> ) = 0x7ff4d618c000
[pid 25473] 10:12:36.543026 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25511] 10:12:36.543060 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.543074 <... mmap resumed> ) = 0x7f434e42d000
[pid 25503] 10:12:36.543099 mmap(0x7ff4d618e000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.543128 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.543151 read(10,  <unfinished ...>
[pid 25507] 10:12:36.543179 mmap(0x7f434e432000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.543207 <... mmap resumed> ) = 0x7ff4d618e000
[pid 25473] 10:12:36.543229 close(10 <unfinished ...>
[pid 25511] 10:12:36.543261 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25507] 10:12:36.543280 <... mmap resumed> ) = 0x7f434e432000
[pid 25503] 10:12:36.543345 close(6 <unfinished ...>
[pid 25473] 10:12:36.543373 <... close resumed> ) = 0
[pid 25511] 10:12:36.543395 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25507] 10:12:36.543426 close(6 <unfinished ...>
[pid 25503] 10:12:36.543448 <... close resumed> ) = 0
[pid 25473] 10:12:36.543501 munmap(0x7f7c15ca7000, 4096 <unfinished ...>
[pid 25511] 10:12:36.543617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.543647 <... close resumed> ) = 0
[pid 25503] 10:12:36.543701 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.543733 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.543766 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.543797 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.543827 <... mmap resumed> ) = 0x7ff4da3d4000
[pid 25473] 10:12:36.543884 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25511] 10:12:36.543959 <... open resumed> ) = 13
[pid 25507] 10:12:36.543974 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.543994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.544021 <... open resumed> ) = 9
[pid 25511] 10:12:36.544042 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.544064 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.544096 <... mmap resumed> ) = 0x7ff4da3d3000
[pid 25473] 10:12:36.544121 fcntl(9, F_GETFD <unfinished ...>
[pid 25511] 10:12:36.544152 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.544184 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.544206 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:36.544233 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.544255 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.544276 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.544308 <... mmap resumed> ) = 0x7ff4da3d1000
[pid 25473] 10:12:36.544330 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25511] 10:12:36.544360 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.544386 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.544406 arch_prctl(ARCH_SET_FS, 0x7ff4da3d17c0 <unfinished ...>
[pid 25473] 10:12:36.544429 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.544451 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.544476 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.544584 <... arch_prctl resumed> ) = 0
[pid 25473] 10:12:36.544646 fchown(9, 47, 12 <unfinished ...>
[pid 25511] 10:12:36.544687 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25507] 10:12:36.544701 <... open resumed> ) = 6
[pid 25503] 10:12:36.544719 mprotect(0x7ff4d618c000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.544745 <... fchown resumed> ) = 0
[pid 25511] 10:12:36.544767 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.544790 read(6,  <unfinished ...>
[pid 25503] 10:12:36.544813 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.544833 fchmod(9, 0640 <unfinished ...>
[pid 25511] 10:12:36.544865 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.544879 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.544905 mprotect(0x7ff4d6390000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.544933 <... fchmod resumed> ) = 0
[pid 25511] 10:12:36.544979 read(13,  <unfinished ...>
[pid 25507] 10:12:36.545009 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.545032 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.545065 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25511] 10:12:36.545108 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25507] 10:12:36.545126 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25503] 10:12:36.545190 mprotect(0x7ff4d659b000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.545220 <... open resumed> ) = 10
[pid 25511] 10:12:36.545242 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25507] 10:12:36.545272 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.545306 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.545332 alarm(60 <unfinished ...>
[pid 25511] 10:12:36.545363 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25507] 10:12:36.545380 <... mmap resumed> ) = 0x7f434de37000
[pid 25503] 10:12:36.545398 mprotect(0x7ff4d67b1000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.545423 <... alarm resumed> ) = 0
[pid 25511] 10:12:36.545447 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25507] 10:12:36.545474 mprotect(0x7f434de99000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.545501 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.545610 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25511] 10:12:36.545649 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25507] 10:12:36.545665 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.545683 mprotect(0x7ff4d69dc000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.545710 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.545733 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f03f27e86a0},  <unfinished ...>
[pid 25507] 10:12:36.545758 mmap(0x7f434e098000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25503] 10:12:36.545789 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.545815 alarm(0 <unfinished ...>
[pid 25511] 10:12:36.545846 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f03f3a9f790}, 8) = 0
[pid 25507] 10:12:36.545863 <... mmap resumed> ) = 0x7f434e098000
[pid 25503] 10:12:36.545891 mprotect(0x7ff4d6be1000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.545920 <... alarm resumed> ) = 60
[pid 25511] 10:12:36.545972 close(11 <unfinished ...>
[pid 25507] 10:12:36.545997 close(6 <unfinished ...>
[pid 25503] 10:12:36.546019 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.546143 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25511] 10:12:36.546188 <... close resumed> ) = 0
[pid 25510] 10:12:36.546202 <... brk resumed> ) = 0x10c7000
[pid 25507] 10:12:36.546217 <... close resumed> ) = 0
[pid 25503] 10:12:36.546582 mprotect(0x7ff4d6ebe000, 40960, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.546620 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25511] 10:12:36.546661 fcntl(12, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.546685 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.546716 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.546824 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25511] 10:12:36.546866 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.546880 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.546899 mprotect(0x7ff4d710b000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.546926 <... open resumed> ) = 11
[pid 25511] 10:12:36.546948 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.546971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.547003 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.547031 fcntl(11, F_GETFD <unfinished ...>
[pid 25511] 10:12:36.547062 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.547075 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.547106 mprotect(0x7ff4d7325000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.547134 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.547156 geteuid( <unfinished ...>
[pid 25507] 10:12:36.547180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.547210 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.547231 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25511] 10:12:36.547268 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.547281 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.547303 mprotect(0x7ff4d7532000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.547330 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.547354 getegid( <unfinished ...>
[pid 25507] 10:12:36.547376 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.547407 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.547701 read(11,  <unfinished ...>
[pid 25511] 10:12:36.547750 <... getegid resumed> ) = 12
[pid 25507] 10:12:36.547767 <... open resumed> ) = 6
[pid 25503] 10:12:36.547788 mprotect(0x7ff4d7d1e000, 110592, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.547815 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25511] 10:12:36.547973 setgid(500 <unfinished ...>
[pid 25510] 10:12:36.548001 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25507] 10:12:36.548026 read(6,  <unfinished ...>
[pid 25503] 10:12:36.548049 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.548129 close(11 <unfinished ...>
[pid 25511] 10:12:36.548163 <... setgid resumed> ) = 0
[pid 25507] 10:12:36.548176 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.548202 mprotect(0x7ff4d7faa000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.548228 <... close resumed> ) = 0
[pid 25511] 10:12:36.548261 setuid(503 <unfinished ...>
[pid 25507] 10:12:36.548287 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.548310 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.548415 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25511] 10:12:36.548455 <... setuid resumed> ) = 0
[pid 25507] 10:12:36.548469 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25503] 10:12:36.548575 mprotect(0x7ff4d833f000, 16384, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.548609 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25511] 10:12:36.548637 chdir("/" <unfinished ...>
[pid 25510] 10:12:36.548663 <... open resumed> ) = 7
[pid 25507] 10:12:36.548682 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.548727 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.548748 stat("/var/tmp",  <unfinished ...>
[pid 25511] 10:12:36.548793 <... chdir resumed> ) = 0
[pid 25510] 10:12:36.548809 fstat(7,  <unfinished ...>
[pid 25507] 10:12:36.548847 <... mmap resumed> ) = 0x7f434da54000
[pid 25503] 10:12:36.548863 mprotect(0x7ff4d854a000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.548890 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25511] 10:12:36.549030 geteuid( <unfinished ...>
[pid 25510] 10:12:36.549058 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25507] 10:12:36.549085 mprotect(0x7f434dc0d000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.549119 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.549145 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25511] 10:12:36.549184 <... geteuid resumed> ) = 503
[pid 25510] 10:12:36.549198 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25507] 10:12:36.549225 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.549241 mprotect(0x7ff4d874e000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.549267 <... open resumed> ) = 11
[pid 25511] 10:12:36.549290 getegid( <unfinished ...>
[pid 25510] 10:12:36.549311 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25507] 10:12:36.549328 mmap(0x7f434de0c000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25503] 10:12:36.549367 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.550084 fcntl(11, F_GETFD <unfinished ...>
[pid 25511] 10:12:36.550126 <... getegid resumed> ) = 500
[pid 25510] 10:12:36.550140 read(7,  <unfinished ...>
[pid 25507] 10:12:36.550200 <... mmap resumed> ) = 0x7f434de0c000
[pid 25503] 10:12:36.550223 mprotect(0x7ff4d94a6000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.550251 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.550275 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25510] 10:12:36.550305 <... read resumed> "-\352LD&\3079\243\342\215BMa\211\266\311\0076\2728\203\257h\222sx\2\265l@rW\301\"%o\333\3774\10\4\276\347%\213\301\230w", 48) = 48
[pid 25507] 10:12:36.550322 mmap(0x7f434de33000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.550356 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.550396 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25511] 10:12:36.550429 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25510] 10:12:36.550456 close(7 <unfinished ...>
[pid 25507] 10:12:36.550484 <... mmap resumed> ) = 0x7f434de33000
[pid 25503] 10:12:36.550553 mprotect(0x7ff4d98db000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.550589 <... fcntl resumed> ) = 0
[pid 25511] 10:12:36.550614 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25510] 10:12:36.550642 <... close resumed> ) = 0
[pid 25507] 10:12:36.550655 close(6 <unfinished ...>
[pid 25503] 10:12:36.550699 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.550721 fstat(11,  <unfinished ...>
[pid 25511] 10:12:36.550752 <... chdir resumed> ) = 0
[pid 25510] 10:12:36.550765 getuid( <unfinished ...>
[pid 25507] 10:12:36.550788 <... close resumed> ) = 0
[pid 25503] 10:12:36.550820 mprotect(0x7ff4d9b5f000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.550848 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25511] 10:12:36.550904 stat("tmp",  <unfinished ...>
[pid 25510] 10:12:36.550934 <... getuid resumed> ) = 47
[pid 25507] 10:12:36.550947 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.551125 <... mprotect resumed> ) = 0
[pid 25473] 10:12:36.551148 pread(11,  <unfinished ...>
[pid 25511] 10:12:36.551182 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25510] 10:12:36.551215 exit_group(0) = ?
[pid 25507] 10:12:36.551231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.551485 mprotect(0x7ff4d9d68000, 4096, PROT_READ <unfinished ...>
[pid 25473] 10:12:36.551588 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25511] 10:12:36.551656 stat("new",  <unfinished ...>
[pid 25510] 10:12:36.551686 +++ exited with 0 +++
[pid 25507] 10:12:36.551699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.551732 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.551765 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25510
[pid 25491] 10:12:36.551788 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25473] 10:12:36.551813 pread(11,  <unfinished ...>
[pid 25511] 10:12:36.551847 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.551873 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.551892 mprotect(0x7ff4d9fad000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.551919 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25491] 10:12:36.551948 recvfrom(16,  <unfinished ...>
[pid 25473] 10:12:36.551974 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25511] 10:12:36.552013 stat("cur",  <unfinished ...>
[pid 25507] 10:12:36.552112 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.552143 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.552169 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25491] 10:12:36.552215 <... recvfrom resumed> "#\16\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\0,\0)\0\n\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\300\f\0\17\0\1\0\0\0,\0$\0\n\tncghotels\3com\tinbound10\7mxlogic\300O", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 132
[pid 25473] 10:12:36.552258 close(11 <unfinished ...>
[pid 25511] 10:12:36.552294 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25507] 10:12:36.552331 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.552419 mprotect(0x7ff4da1c7000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.552451 getcwd( <unfinished ...>
[pid 25491] 10:12:36.552481 close(16 <unfinished ...>
[pid 25473] 10:12:36.552564 <... close resumed> ) = 0
[pid 25511] 10:12:36.552615 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25507] 10:12:36.552653 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.552686 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.552729 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25491] 10:12:36.552785 <... close resumed> ) = 0
[pid 25473] 10:12:36.552838 close(10 <unfinished ...>
[pid 25511] 10:12:36.552879 <... open resumed> ) = 11
[pid 25507] 10:12:36.552893 <... open resumed> ) = 6
[pid 25503] 10:12:36.552913 mprotect(0x7ff4da3ea000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.552941 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.552970 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25473] 10:12:36.552999 <... close resumed> ) = 0
[pid 25511] 10:12:36.553037 read(11,  <unfinished ...>
[pid 25507] 10:12:36.553064 read(6,  <unfinished ...>
[pid 25503] 10:12:36.553087 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.553103 <... open resumed> ) = 7
[pid 25491] 10:12:36.553119 <... socket resumed> ) = 16
[pid 25473] 10:12:36.553134 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25511] 10:12:36.553172 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4116
[pid 25507] 10:12:36.553190 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.553287 munmap(0x7ff4da3df000, 39387 <unfinished ...>
[pid 25502] 10:12:36.553322 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.553345 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25473] 10:12:36.553377 <... open resumed> ) = 10
[pid 25511] 10:12:36.553403 stat("tmp/1451491956.H553274P25511.fin.finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.553436 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.553459 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.553476 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.553597 <... connect resumed> ) = 0
[pid 25473] 10:12:36.553623 fstat(10,  <unfinished ...>
[pid 25511] 10:12:36.553656 <... stat resumed> 0x7ffc7ad96b90) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.553671 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25503] 10:12:36.553705 set_tid_address(0x7ff4da3d1a90 <unfinished ...>
[pid 25502] 10:12:36.553729 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.553752 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25473] 10:12:36.553778 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25511] 10:12:36.553823 open("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25507] 10:12:36.553882 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.553913 <... set_tid_address resumed> ) = 25503
[pid 25502] 10:12:36.553929 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:36.553957 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.553976 fstat(10,  <unfinished ...>
[pid 25511] 10:12:36.554007 <... open resumed> ) = 14
[pid 25507] 10:12:36.554020 <... mmap resumed> ) = 0x7f43504c7000
[pid 25503] 10:12:36.554047 set_robust_list(0x7ff4da3d1aa0, 24 <unfinished ...>
[pid 25502] 10:12:36.554071 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.554096 sendto(16, "'a\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1", 55, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25473] 10:12:36.554151 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25511] 10:12:36.554190 chown("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25507] 10:12:36.554222 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.554252 <... set_robust_list resumed> ) = 0
[pid 25502] 10:12:36.554268 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25491] 10:12:36.554284 <... sendto resumed> ) = 55
[pid 25473] 10:12:36.554300 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25511] 10:12:36.554337 <... chown resumed> ) = 0
[pid 25507] 10:12:36.554350 <... mmap resumed> ) = 0x7f434d827000
[pid 25503] 10:12:36.554371 futex(0x7ffdc4d6c87c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25502] 10:12:36.554399 read(7,  <unfinished ...>
[pid 25491] 10:12:36.554426 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25473] 10:12:36.554464 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25511] 10:12:36.554494 chmod("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25507] 10:12:36.554609 mprotect(0x7f434d853000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.554640 <... futex resumed> ) = 0
[pid 25502] 10:12:36.554656 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25473] 10:12:36.554684 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25511] 10:12:36.554716 <... chmod resumed> ) = 0
[pid 25507] 10:12:36.554729 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.554746 futex(0x7ffdc4d6c87c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7ff4da3d17c0 <unfinished ...>
[pid 25502] 10:12:36.554771 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.554794 <... lseek resumed> ) = 0
[pid 25511] 10:12:36.554818 chown("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25507] 10:12:36.554852 mmap(0x7f434da53000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25503] 10:12:36.554882 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25502] 10:12:36.554905 <... lseek resumed> ) = 1279
[pid 25473] 10:12:36.554923 read(10,  <unfinished ...>
[pid 25511] 10:12:36.554956 <... chown resumed> ) = 0
[pid 25507] 10:12:36.554970 <... mmap resumed> ) = 0x7f434da53000
[pid 25503] 10:12:36.554991 rt_sigaction(SIGRTMIN, {0x7ff4d9294c60, [], SA_RESTORER|SA_SIGINFO, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.555020 read(7,  <unfinished ...>
[pid 25473] 10:12:36.555043 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25511] 10:12:36.555094 chmod("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25507] 10:12:36.555126 close(6 <unfinished ...>
[pid 25503] 10:12:36.555149 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.555165 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25473] 10:12:36.555198 pipe( <unfinished ...>
[pid 25511] 10:12:36.555234 <... chmod resumed> ) = 0
[pid 25507] 10:12:36.555247 <... close resumed> ) = 0
[pid 25503] 10:12:36.555304 rt_sigaction(SIGRT_1, {0x7ff4d9294cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.555336 close(7 <unfinished ...>
[pid 25473] 10:12:36.555360 <... pipe resumed> [11, 12]) = 0
[pid 25511] 10:12:36.555386 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.555414 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.555455 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.555477 <... close resumed> ) = 0
[pid 25473] 10:12:36.555495 close(10 <unfinished ...>
[pid 25511] 10:12:36.555638 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.555669 <... open resumed> ) = 6
[pid 25503] 10:12:36.555720 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25502] 10:12:36.555749 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25473] 10:12:36.555776 <... close resumed> ) = 0
[pid 25511] 10:12:36.555800 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.555831 read(6,  <unfinished ...>
[pid 25503] 10:12:36.555858 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25502] 10:12:36.555886 <... munmap resumed> ) = 0
[pid 25473] 10:12:36.555918 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25511] 10:12:36.555954 <... lseek resumed> ) = 19
[pid 25507] 10:12:36.555968 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.555999 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25502] 10:12:36.556022 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25473] 10:12:36.556058 <... munmap resumed> ) = 0
[pid 25511] 10:12:36.556084 read(6,  <unfinished ...>
[pid 25507] 10:12:36.556112 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.556136 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25502] 10:12:36.556195 <... open resumed> ) = 7
[pid 25473] 10:12:36.556216 clone( <unfinished ...>
[pid 25511] 10:12:36.556569 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25507] 10:12:36.556596 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25503] 10:12:36.556639 statfs("/selinux",  <unfinished ...>
[pid 25502] 10:12:36.556675 fcntl(7, F_GETFD <unfinished ...>
[pid 25511] 10:12:36.556719 read(6,  <unfinished ...>
[pid 25507] 10:12:36.556744 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.556786 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350337, f_bavail=6350337, f_files=1000000, f_ffree=691092, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25502] 10:12:36.556857 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.556878 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25512
[pid 25511] 10:12:36.556920 <... read resumed> "", 8192) = 0
[pid 25507] 10:12:36.556937 <... mmap resumed> ) = 0x7f434d622000
[pid 25503] 10:12:36.556955 brk(0 <unfinished ...>
[pid 25502] 10:12:36.556978 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.557001 close(12 <unfinished ...>
[pid 25511] 10:12:36.557030 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:36 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2591 <unfinished ...>
[pid 25507] 10:12:36.557065 mprotect(0x7f434d627000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.557095 <... brk resumed> ) = 0x1c9d000
[pid 25502] 10:12:36.557111 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.557127 <... close resumed> ) = 0
[pid 25511] 10:12:36.557150 <... write resumed> ) = 2591
[pid 25507] 10:12:36.557164 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.557182 brk(0x1cbe000 <unfinished ...>
[pid 25502] 10:12:36.557206 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.557229 read(11,  <unfinished ...>
[pid 25511] 10:12:36.557256 fsync(14 <unfinished ...>
[pid 25507] 10:12:36.557305 mmap(0x7f434d826000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25503] 10:12:36.557341 <... brk resumed> ) = 0x1cbe000
[pid 25502] 10:12:36.557377 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378198, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.557497 <... mmap resumed> ) = 0x7f434d826000
[pid 25503] 10:12:36.557640 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.557688 write(7, "2015-12-30 10:12:36 [25502] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMa-0006dB-67\n", 92 <unfinished ...>
[pid 25511] 10:12:36.557733 <... fsync resumed> ) = 0
[pid 25507] 10:12:36.557747 close(6 <unfinished ...>
[pid 25503] 10:12:36.557774 <... open resumed> ) = 6
[pid 25502] 10:12:36.557803 <... write resumed> ) = 92
[pid 25511] 10:12:36.557831 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25507] 10:12:36.557854 <... close resumed> ) = 0
[pid 25503] 10:12:36.557881 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.557906 chdir("/var/spool/exim" <unfinished ...>
[pid 25511] 10:12:36.557944 <... lseek resumed> ) = 4116
[pid 25507] 10:12:36.557957 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.557989 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.558019 <... chdir resumed> ) = 0
[pid 25511] 10:12:36.558045 write(11, "2591 1\n", 7 <unfinished ...>
[pid 25507] 10:12:36.558076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.558094 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.558121 setgid(12 <unfinished ...>
[pid 25511] 10:12:36.558150 <... write resumed> ) = 7
[pid 25507] 10:12:36.558163 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.558202 <... mmap resumed> ) = 0x7ff4da3e8000
[pid 25502] 10:12:36.558219 <... setgid resumed> ) = 0
[pid 25511] 10:12:36.558270 close(11 <unfinished ...>
[pid 25507] 10:12:36.558298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.558315 read(6,  <unfinished ...>
[pid 25502] 10:12:36.558407 read(6,  <unfinished ...>
[pid 25511] 10:12:36.558442 <... close resumed> ) = 0
[pid 25507] 10:12:36.558456 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.558491 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25502] 10:12:36.558585 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25511] 10:12:36.558660 fstat(14,  <unfinished ...>
[pid 25507] 10:12:36.558694 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.558717 read(6,  <unfinished ...>
[pid 25502] 10:12:36.558740 read(6,  <unfinished ...>
[pid 25511] 10:12:36.558771 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179978, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2591, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.558798 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.558831 <... read resumed> "", 1024) = 0
[pid 25502] 10:12:36.558855 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25511] 10:12:36.558937 close(14 <unfinished ...>
[pid 25507] 10:12:36.558968 <... open resumed> ) = 6
[pid 25503] 10:12:36.558984 close(6 <unfinished ...>
[pid 25502] 10:12:36.559010 read(6,  <unfinished ...>
[pid 25511] 10:12:36.559041 <... close resumed> ) = 0
[pid 25507] 10:12:36.559054 read(6,  <unfinished ...>
[pid 25503] 10:12:36.559100 <... close resumed> ) = 0
[pid 25502] 10:12:36.559117 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25511] 10:12:36.559180 rename("tmp/1451491956.H553274P25511.fin.finestweddingsites.com", "new/1451491956.H553274P25511.fin.finestweddingsites.com,S=2591" <unfinished ...>
[pid 25507] 10:12:36.559233 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.559260 munmap(0x7ff4da3e8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.559288 read(6,  <unfinished ...>
[pid 25511] 10:12:36.559319 <... rename resumed> ) = 0
[pid 25507] 10:12:36.559332 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.559360 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.559435 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25511] 10:12:36.559505 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.559622 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25503] 10:12:36.559656 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25502] 10:12:36.559702 read(6,  <unfinished ...>
[pid 25511] 10:12:36.559744 <... write resumed> ) = 4
[pid 25507] 10:12:36.559762 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.559797 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.559893 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25458] 10:12:36.559977 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.560011 write(12, "\37\n\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.560038 <... mmap resumed> ) = 0x7f434d41f000
[pid 25503] 10:12:36.560054 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.560081 read(6,  <unfinished ...>
[pid 25458] 10:12:36.560105 read(11,  <unfinished ...>
[pid 25511] 10:12:36.560138 <... write resumed> ) = 4
[pid 25507] 10:12:36.560152 mprotect(0x7f434d421000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.560181 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.560207 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25458] 10:12:36.560304 <... read resumed> "\37\n\0\0", 4) = 4
[pid 25511] 10:12:36.560334 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.560359 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.560375 fstat(2,  <unfinished ...>
[pid 25502] 10:12:36.560404 read(6,  <unfinished ...>
[pid 25458] 10:12:36.560428 read(11,  <unfinished ...>
[pid 25511] 10:12:36.560458 <... write resumed> ) = 4
[pid 25507] 10:12:36.560473 mmap(0x7f434d620000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25503] 10:12:36.560505 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25502] 10:12:36.560638 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25458] 10:12:36.560708 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25511] 10:12:36.560742 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.560767 <... mmap resumed> ) = 0x7f434d620000
[pid 25503] 10:12:36.560792 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.560821 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.560852 read(11,  <unfinished ...>
[pid 25511] 10:12:36.560883 <... write resumed> ) = 4
[pid 25507] 10:12:36.560897 close(6 <unfinished ...>
[pid 25503] 10:12:36.560922 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.560944 <... open resumed> ) = 8
[pid 25458] 10:12:36.560964 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.560989 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.561012 <... close resumed> ) = 0
[pid 25503] 10:12:36.561039 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25502] 10:12:36.561067 fstat(8,  <unfinished ...>
[pid 25458] 10:12:36.561090 read(11,  <unfinished ...>
[pid 25511] 10:12:36.561120 <... write resumed> ) = 4
[pid 25507] 10:12:36.561133 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.561166 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.561184 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.561213 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.561238 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.561261 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.561278 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25502] 10:12:36.561304 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.561330 read(11,  <unfinished ...>
[pid 25511] 10:12:36.561361 <... write resumed> ) = 4
[pid 25507] 10:12:36.561373 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.561408 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25502] 10:12:36.561434 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25458] 10:12:36.561456 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.561482 write(12, "\260\363D\1\0\0\0\0", 8 <unfinished ...>
[pid 25507] 10:12:36.561579 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.561604 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.561632 read(8,  <unfinished ...>
[pid 25458] 10:12:36.561660 read(11,  <unfinished ...>
[pid 25511] 10:12:36.561691 <... write resumed> ) = 8
[pid 25507] 10:12:36.561704 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.561736 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.561773 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:36.561803 <... read resumed> "\260\363D\1\0\0\0\0", 8) = 8
[pid 25511] 10:12:36.561829 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.561853 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.561872 umask(0 <unfinished ...>
[pid 25502] 10:12:36.561895 close(8 <unfinished ...>
[pid 25458] 10:12:36.561919 read(11,  <unfinished ...>
[pid 25511] 10:12:36.561948 <... write resumed> ) = 4
[pid 25507] 10:12:36.561961 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.561996 <... umask resumed> ) = 022
[pid 25502] 10:12:36.562055 <... close resumed> ) = 0
[pid 25458] 10:12:36.562075 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.562101 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.562124 <... open resumed> ) = 6
[pid 25503] 10:12:36.562140 geteuid( <unfinished ...>
[pid 25502] 10:12:36.562162 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25458] 10:12:36.562190 read(11,  <unfinished ...>
[pid 25511] 10:12:36.562220 <... write resumed> ) = 4
[pid 25507] 10:12:36.562233 read(6,  <unfinished ...>
[pid 25503] 10:12:36.562258 <... geteuid resumed> ) = 0
[pid 25502] 10:12:36.562276 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.562358 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25511] 10:12:36.562387 close(12 <unfinished ...>
[pid 25507] 10:12:36.562411 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.562440 getuid( <unfinished ...>
[pid 25502] 10:12:36.562469 read(6,  <unfinished ...>
[pid 25458] 10:12:36.562495 close(11 <unfinished ...>
[pid 25511] 10:12:36.562616 <... close resumed> ) = 0
[pid 25507] 10:12:36.562632 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.562660 <... getuid resumed> ) = 503
[pid 25502] 10:12:36.562679 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25458] 10:12:36.562762 <... close resumed> ) = 0
[pid 25511] 10:12:36.562798 close(10 <unfinished ...>
[pid 25507] 10:12:36.562825 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.562857 getgid( <unfinished ...>
[pid 25502] 10:12:36.562879 read(6,  <unfinished ...>
[pid 25458] 10:12:36.562903 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25511] 10:12:36.562943 <... close resumed> ) = 0
[pid 25507] 10:12:36.562956 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.562986 <... getgid resumed> ) = 499
[pid 25502] 10:12:36.563019 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25458] 10:12:36.563130 <... write resumed> ) = 28
[pid 25511] 10:12:36.563174 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.563205 <... mmap resumed> ) = 0x7f43504c6000
[pid 25503] 10:12:36.563226 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25502] 10:12:36.563249 read(6,  <unfinished ...>
[pid 25458] 10:12:36.563274 fsync(9 <unfinished ...>
[pid 25511] 10:12:36.563329 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.563344 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.563476 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25502] 10:12:36.563498 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25511] 10:12:36.563703 close(13 <unfinished ...>
[pid 25507] 10:12:36.563736 <... mmap resumed> ) = 0x7f434d1fc000
[pid 25503] 10:12:36.563753 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25502] 10:12:36.563776 read(6,  <unfinished ...>
[pid 25458] 10:12:36.563800 <... fsync resumed> ) = 0
[pid 25511] 10:12:36.563823 <... close resumed> ) = 0
[pid 25507] 10:12:36.563837 mprotect(0x7f434d213000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.563866 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25502] 10:12:36.563888 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25458] 10:12:36.563988 wait4(-1,  <unfinished ...>
[pid 25511] 10:12:36.564021 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25507] 10:12:36.564047 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.564064 getgroups(65536,  <unfinished ...>
[pid 25502] 10:12:36.564086 read(6,  <unfinished ...>
[pid 25511] 10:12:36.564116 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.564129 mmap(0x7f434d413000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25503] 10:12:36.564615 <... getgroups resumed> [500]) = 1
[pid 25502] 10:12:36.564643 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25511] 10:12:36.564688 exit_group(0) = ?
[pid 25507] 10:12:36.564705 <... mmap resumed> ) = 0x7f434d413000
[pid 25503] 10:12:36.565032 setgroups(0, [] <unfinished ...>
[pid 25502] 10:12:36.565062 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25511] 10:12:36.565112 +++ exited with 0 +++
[pid 25507] 10:12:36.565124 close(6 <unfinished ...>
[pid 25503] 10:12:36.565146 <... setgroups resumed> ) = 0
[pid 25502] 10:12:36.565165 <... open resumed> ) = 8
[pid 25458] 10:12:36.565183 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25511
[pid 25507] 10:12:36.565243 <... close resumed> ) = 0
[pid 25503] 10:12:36.565287 getegid( <unfinished ...>
[pid 25502] 10:12:36.565312 fstat(8,  <unfinished ...>
[pid 25458] 10:12:36.565336 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.565371 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.565403 <... getegid resumed> ) = 499
[pid 25502] 10:12:36.565420 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25458] 10:12:36.565451 <... open resumed> ) = 10
[pid 25507] 10:12:36.565481 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.565500 geteuid( <unfinished ...>
[pid 25502] 10:12:36.565597 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.565626 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.565656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.565693 <... geteuid resumed> ) = 0
[pid 25502] 10:12:36.565715 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25458] 10:12:36.565733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.565774 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.565793 geteuid( <unfinished ...>
[pid 25502] 10:12:36.565816 read(8,  <unfinished ...>
[pid 25458] 10:12:36.565842 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.565871 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.565901 <... geteuid resumed> ) = 0
[pid 25502] 10:12:36.565917 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25458] 10:12:36.565948 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.565983 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.566003 getegid( <unfinished ...>
[pid 25502] 10:12:36.566026 close(8 <unfinished ...>
[pid 25458] 10:12:36.566050 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.566083 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.566115 <... getegid resumed> ) = 499
[pid 25502] 10:12:36.566136 <... close resumed> ) = 0
[pid 25458] 10:12:36.566153 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25507] 10:12:36.566177 <... open resumed> ) = 6
[pid 25503] 10:12:36.566193 setgid(499 <unfinished ...>
[pid 25502] 10:12:36.566216 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25458] 10:12:36.566244 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.566275 read(6,  <unfinished ...>
[pid 25503] 10:12:36.566298 <... setgid resumed> ) = 0
[pid 25502] 10:12:36.566318 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.566348 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.566374 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.566399 setuid(0 <unfinished ...>
[pid 25502] 10:12:36.566424 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.566454 read(10,  <unfinished ...>
[pid 25507] 10:12:36.566488 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.566590 <... setuid resumed> ) = 0
[pid 25502] 10:12:36.566646 <... open resumed> ) = 8
[pid 25458] 10:12:36.566668 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25507] 10:12:36.566729 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.566766 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.566796 fstat(8,  <unfinished ...>
[pid 25458] 10:12:36.566820 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.566857 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.566888 <... open resumed> ) = 6
[pid 25502] 10:12:36.566923 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.566955 <... stat resumed> 0x7ffc7ad958e0) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.566997 <... mmap resumed> ) = 0x7f434cfb8000
[pid 25503] 10:12:36.567022 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.567046 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.567072 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.567105 mprotect(0x7f434cff9000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.567134 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25502] 10:12:36.567167 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25458] 10:12:36.567186 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.567232 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.567251 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.567274 read(8,  <unfinished ...>
[pid 25458] 10:12:36.567301 write(8, "2015-12-30 10:12:36 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25507] 10:12:36.567340 mmap(0x7f434d1f9000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25503] 10:12:36.567370 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25502] 10:12:36.567398 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.567428 <... write resumed> ) = 126
[pid 25507] 10:12:36.567459 <... mmap resumed> ) = 0x7f434d1f9000
[pid 25503] 10:12:36.567488 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.567599 close(8 <unfinished ...>
[pid 25458] 10:12:36.567627 write(8, "2015-12-30 10:12:36 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25507] 10:12:36.567664 close(6 <unfinished ...>
[pid 25503] 10:12:36.567687 <... mmap resumed> ) = 0x7ff4da3e8000
[pid 25502] 10:12:36.567703 <... close resumed> ) = 0
[pid 25458] 10:12:36.567720 <... write resumed> ) = 77
[pid 25507] 10:12:36.567754 <... close resumed> ) = 0
[pid 25503] 10:12:36.567788 read(6,  <unfinished ...>
[pid 25502] 10:12:36.567818 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25458] 10:12:36.567846 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.567880 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.567911 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25502] 10:12:36.568034 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.568088 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.568141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.568164 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.568197 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.568227 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.568260 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.568294 <... socket resumed> ) = 7
[pid 25502] 10:12:36.568311 <... open resumed> ) = 8
[pid 25458] 10:12:36.568329 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.568368 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.568387 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.568425 fstat(8,  <unfinished ...>
[pid 25458] 10:12:36.568448 close(7 <unfinished ...>
[pid 25507] 10:12:36.568481 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.568579 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.568601 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25458] 10:12:36.568631 <... close resumed> ) = 0
[pid 25507] 10:12:36.568659 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.568680 close(7 <unfinished ...>
[pid 25502] 10:12:36.568707 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25458] 10:12:36.568734 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25507] 10:12:36.568777 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.568810 <... close resumed> ) = 0
[pid 25502] 10:12:36.568827 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25458] 10:12:36.568846 <... open resumed> ) = 7
[pid 25507] 10:12:36.568870 <... open resumed> ) = 6
[pid 25503] 10:12:36.568886 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.568913 read(8,  <unfinished ...>
[pid 25458] 10:12:36.568940 fcntl(7, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.568971 read(6,  <unfinished ...>
[pid 25503] 10:12:36.568994 <... socket resumed> ) = 7
[pid 25502] 10:12:36.569010 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25458] 10:12:36.569046 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.569071 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.569094 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.569126 close(8 <unfinished ...>
[pid 25458] 10:12:36.569151 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.569182 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.569204 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.569221 <... close resumed> ) = 0
[pid 25458] 10:12:36.569237 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.569261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.569291 close(7 <unfinished ...>
[pid 25502] 10:12:36.569317 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25458] 10:12:36.569345 fstat(7,  <unfinished ...>
[pid 25507] 10:12:36.569375 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.569401 <... close resumed> ) = 0
[pid 25502] 10:12:36.569425 <... munmap resumed> ) = 0
[pid 25458] 10:12:36.569638 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378290, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.569707 <... mmap resumed> ) = 0x7f43504c5000
[pid 25503] 10:12:36.569741 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.569790 read(6,  <unfinished ...>
[pid 25458] 10:12:36.569830 write(7, "2015-12-30 10:12:36 [25458] 1aEJMY-0006cO-Sq => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2591 QT=2s "..., 262 <unfinished ...>
[pid 25507] 10:12:36.569894 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.569938 <... open resumed> ) = 7
[pid 25502] 10:12:36.569969 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25458] 10:12:36.570217 <... write resumed> ) = 262
[pid 25507] 10:12:36.570319 <... mmap resumed> ) = 0x7f434ccd1000
[pid 25503] 10:12:36.570353 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.570390 read(6,  <unfinished ...>
[pid 25458] 10:12:36.570428 pipe( <unfinished ...>
[pid 25507] 10:12:36.570484 mprotect(0x7f434cdac000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.570598 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25502] 10:12:36.570652 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25458] 10:12:36.570798 <... pipe resumed> [11, 12]) = 0
[pid 25507] 10:12:36.570857 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.570887 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.570932 read(6,  <unfinished ...>
[pid 25458] 10:12:36.570972 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25507] 10:12:36.571020 mmap(0x7f434cfac000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25503] 10:12:36.571066 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.571093 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.571122 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.571159 <... mmap resumed> ) = 0x7f434cfac000
[pid 25503] 10:12:36.571196 read(7,  <unfinished ...>
[pid 25502] 10:12:36.571240 read(6,  <unfinished ...>
[pid 25458] 10:12:36.571280 close(10 <unfinished ...>
[pid 25507] 10:12:36.571333 close(6 <unfinished ...>
[pid 25503] 10:12:36.571373 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25502] 10:12:36.571427 <... read resumed> "", 4096) = 0
[pid 25458] 10:12:36.571462 <... close resumed> ) = 0
[pid 25507] 10:12:36.571497 <... close resumed> ) = 0
[pid 25503] 10:12:36.571628 read(7,  <unfinished ...>
[pid 25502] 10:12:36.571671 close(6 <unfinished ...>
[pid 25458] 10:12:36.571710 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.571764 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.571816 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.571842 <... close resumed> ) = 0
[pid 25458] 10:12:36.571868 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.571911 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.571943 close(7 <unfinished ...>
[pid 25502] 10:12:36.571982 munmap(0x7f3c0be4d000, 4096 <unfinished ...>
[pid 25458] 10:12:36.572026 clone( <unfinished ...>
[pid 25507] 10:12:36.572418 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.572479 <... close resumed> ) = 0
[pid 25502] 10:12:36.572573 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.572645 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.572679 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.572725 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f3c0ad03790},  <unfinished ...>
[pid 25458] 10:12:36.572775 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25513
[pid 25507] 10:12:36.572837 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.572891 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.572939 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25458] 10:12:36.572982 close(12 <unfinished ...>
[pid 25507] 10:12:36.573031 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.573061 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.573108 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25458] 10:12:36.573167 <... close resumed> ) = 0
[pid 25507] 10:12:36.573226 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.573277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.573304 <... open resumed> ) = 6
[pid 25458] 10:12:36.573329 pipe( <unfinished ...>
[pid 25507] 10:12:36.573378 <... open resumed> ) = 6
[pid 25503] 10:12:36.573402 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.573460 fcntl(6, F_GETFD <unfinished ...>
[pid 25458] 10:12:36.573499 <... pipe resumed> [10, 12]) = 0
[pid 25507] 10:12:36.573625 read(6,  <unfinished ...>
[pid 25503] 10:12:36.573666 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.573692 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.573717 fcntl(10, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25507] 10:12:36.573765 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.573805 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.573865 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25458] 10:12:36.573906 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.573954 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.573995 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.574025 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.574055 clone( <unfinished ...>
[pid 25507] 10:12:36.574354 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.574415 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.574462 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25507] 10:12:36.574608 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.574674 <... open resumed> ) = 7
[pid 25502] 10:12:36.574718 <... fcntl resumed> ) = 0
[pid 25458] 10:12:36.574740 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f03f4bd2a90) = 25514
[pid 25507] 10:12:36.574788 <... mmap resumed> ) = 0x7f434cacd000
[pid 25503] 10:12:36.574810 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.574846 fstat(6,  <unfinished ...>
[pid 25458] 10:12:36.574870 close(12 <unfinished ...>
[pid 25507] 10:12:36.574899 mprotect(0x7f434cad0000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.574928 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25502] 10:12:36.574961 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064882, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25458] 10:12:36.574999 <... close resumed> ) = 0
[pid 25507] 10:12:36.575045 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.575064 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25502] 10:12:36.575092 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-H", O_RDONLY <unfinished ...>
[pid 25458] 10:12:36.575127 wait4(-1,  <unfinished ...>
[pid 25507] 10:12:36.575157 mmap(0x7f434cccf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25503] 10:12:36.575188 <... mmap resumed> ) = 0x7ff4da3c7000
[pid 25502] 10:12:36.575204 <... open resumed> ) = 8
[pid 25458] 10:12:36.575222 <... wait4 resumed> 0x7ffc7ad96e90, WNOHANG, NULL) = 0
[pid 25507] 10:12:36.575256 <... mmap resumed> ) = 0x7f434cccf000
[pid 25503] 10:12:36.575284 close(7 <unfinished ...>
[pid 25502] 10:12:36.575318 fstat(8,  <unfinished ...>
[pid 25458] 10:12:36.575343 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25507] 10:12:36.575381 close(6 <unfinished ...>
[pid 25503] 10:12:36.575404 <... close resumed> ) = 0
[pid 25502] 10:12:36.575432 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064884, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=981, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.575474 <... close resumed> ) = 0
[pid 25503] 10:12:36.575507 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.575549 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.575582 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.575613 <... open resumed> ) = 7
[pid 25502] 10:12:36.575629 <... mmap resumed> ) = 0x7f3c0be4d000
[pid 25507] 10:12:36.575651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.575669 read(7,  <unfinished ...>
[pid 25502] 10:12:36.575693 read(8,  <unfinished ...>
[pid 25507] 10:12:36.575739 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.575777 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:36.575801 <... read resumed> "1aEJMa-0006dB-67-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 981
[pid 25507] 10:12:36.575865 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.575886 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.575909 read(8,  <unfinished ...>
[pid 25507] 10:12:36.575937 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.575968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25502] 10:12:36.576003 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.576026 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.576084 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25502] 10:12:36.576141 close(8 <unfinished ...>
[pid 25507] 10:12:36.576193 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.576248 <... mmap resumed> ) = 0x7ff4d5d62000
[pid 25502] 10:12:36.576267 <... close resumed> ) = 0
[pid 25507] 10:12:36.576289 <... open resumed> ) = 6
[pid 25503] 10:12:36.576304 mprotect(0x7ff4d5d6e000, 2097152, PROT_NONE <unfinished ...>
[pid 25502] 10:12:36.576333 munmap(0x7f3c0be4d000, 4096 <unfinished ...>
[pid 25507] 10:12:36.576366 read(6,  <unfinished ...>
[pid 25503] 10:12:36.576390 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.576406 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.576431 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.576463 mmap(0x7ff4d5f6e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25502] 10:12:36.576500 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-J", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.576545 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.576569 <... mmap resumed> ) = 0x7ff4d5f6e000
[pid 25502] 10:12:36.576595 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.576626 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.576659 close(7 <unfinished ...>
[pid 25502] 10:12:36.576687 open("/var/spool/exim/msglog/a/1aEJMa-0006dB-67", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25507] 10:12:36.576738 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.576773 <... close resumed> ) = 0
[pid 25502] 10:12:36.576814 <... open resumed> ) = 8
[pid 25507] 10:12:36.576838 <... mmap resumed> ) = 0x7f434c8a1000
[pid 25503] 10:12:36.576855 mprotect(0x7ff4d5f6e000, 4096, PROT_READ <unfinished ...>
[pid 25502] 10:12:36.576882 fcntl(8, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.576911 mprotect(0x7f434c8ca000, 2097152, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.576937 <... mprotect resumed> ) = 0
[pid 25502] 10:12:36.576956 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.576978 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.576994 munmap(0x7ff4da3c7000, 39387 <unfinished ...>
[pid 25502] 10:12:36.577022 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.577051 mmap(0x7f434caca000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25503] 10:12:36.577080 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.577284 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.577319 <... mmap resumed> ) = 0x7f434caca000
[pid 25503] 10:12:36.577344 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.577376 fchown(8, 47, 12 <unfinished ...>
[pid 25507] 10:12:36.577413 mmap(0x7f434cacc000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.577443 <... open resumed> ) = 7
[pid 25502] 10:12:36.577469 <... fchown resumed> ) = 0
[pid 25507] 10:12:36.577554 <... mmap resumed> ) = 0x7f434cacc000
[pid 25503] 10:12:36.577582 fcntl(7, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.577609 fchmod(8, 0640 <unfinished ...>
[pid 25491] 10:12:36.577636 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25507] 10:12:36.577668 close(6 <unfinished ...>
[pid 25503] 10:12:36.577691 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25502] 10:12:36.577712 <... fchmod resumed> ) = 0
[pid 25491] 10:12:36.577752 recvfrom(16,  <unfinished ...>
[pid 25507] 10:12:36.577791 <... close resumed> ) = 0
[pid 25503] 10:12:36.577820 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.577845 fcntl(8, F_GETFL <unfinished ...>
[pid 25491] 10:12:36.577869 <... recvfrom resumed> "'a\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1\300\f\0\1\0\1\0\0\250\300\0\4\320A\220\3\300\f\0\1\0\1\0\0\250\300\0\4\320A\221\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 87
[pid 25507] 10:12:36.577909 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.577941 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.577977 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25491] 10:12:36.577997 close(16 <unfinished ...>
[pid 25507] 10:12:36.578032 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.578050 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.578077 fstat(8,  <unfinished ...>
[pid 25491] 10:12:36.578100 <... close resumed> ) = 0
[pid 25507] 10:12:36.578151 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.578192 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.578222 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080150, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25491] 10:12:36.578262 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25507] 10:12:36.578298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.578316 read(7,  <unfinished ...>
[pid 25502] 10:12:36.578344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.578370 <... socket resumed> ) = 16
[pid 25507] 10:12:36.578395 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.578426 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.578466 <... mmap resumed> ) = 0x7f3c0be4d000
[pid 25491] 10:12:36.578487 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25507] 10:12:36.578628 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.578650 close(7 <unfinished ...>
[pid 25502] 10:12:36.578685 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.578711 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25507] 10:12:36.578744 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.578779 <... close resumed> ) = 0
[pid 25502] 10:12:36.578795 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.578819 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25507] 10:12:36.578852 <... open resumed> ) = 6
[pid 25503] 10:12:36.578868 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.578895 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25491] 10:12:36.578924 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25507] 10:12:36.578958 read(6,  <unfinished ...>
[pid 25503] 10:12:36.578983 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.579023 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25491] 10:12:36.579062 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25507] 10:12:36.579097 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.579126 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.579156 pipe( <unfinished ...>
[pid 25491] 10:12:36.579183 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25507] 10:12:36.579211 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.579235 <... socket resumed> ) = 7
[pid 25502] 10:12:36.579251 <... pipe resumed> [9, 10]) = 0
[pid 25491] 10:12:36.579269 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25507] 10:12:36.579299 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.579329 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.579365 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25491] 10:12:36.579393 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25507] 10:12:36.579421 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.579449 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.579466 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f3c0ad03790}, 8) = 0
[pid 25491] 10:12:36.579595 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25507] 10:12:36.579638 <... mmap resumed> ) = 0x7f43504c4000
[pid 25503] 10:12:36.579660 close(7 <unfinished ...>
[pid 25502] 10:12:36.579723 clone( <unfinished ...>
[pid 25491] 10:12:36.579983 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25507] 10:12:36.580021 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.580054 <... close resumed> ) = 0
[pid 25491] 10:12:36.580072 close(16 <unfinished ...>
[pid 25507] 10:12:36.580106 <... mmap resumed> ) = 0x7f434c68b000
[pid 25503] 10:12:36.580122 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.580149 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25515
[pid 25491] 10:12:36.580191 <... close resumed> ) = 0
[pid 25507] 10:12:36.580219 mprotect(0x7f434c6a0000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.580248 <... socket resumed> ) = 7
[pid 25502] 10:12:36.580264 close(10 <unfinished ...>
[pid 25491] 10:12:36.580286 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.580342 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.580359 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25502] 10:12:36.580391 <... close resumed> ) = 0
[pid 25491] 10:12:36.580409 <... open resumed> ) = 16
[pid 25507] 10:12:36.580437 mmap(0x7f434c89f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25503] 10:12:36.580470 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.580488 read(9,  <unfinished ...>
[pid 25491] 10:12:36.580581 fstat(16,  <unfinished ...>
[pid 25507] 10:12:36.580614 <... mmap resumed> ) = 0x7f434c89f000
[pid 25503] 10:12:36.580642 close(7 <unfinished ...>
[pid 25491] 10:12:36.580676 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.580731 close(6 <unfinished ...>
[pid 25503] 10:12:36.580763 <... close resumed> ) = 0
[pid 25491] 10:12:36.580787 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.580826 <... close resumed> ) = 0
[pid 25503] 10:12:36.580861 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.580893 <... mmap resumed> ) = 0x7f33164f3000
[pid 25507] 10:12:36.580915 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.580945 <... open resumed> ) = 7
[pid 25491] 10:12:36.580961 read(16,  <unfinished ...>
[pid 25507] 10:12:36.581002 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.581020 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.581043 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25507] 10:12:36.581069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.581102 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:36.581131 read(16,  <unfinished ...>
[pid 25507] 10:12:36.581162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.581179 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.581204 <... read resumed> "", 1024) = 0
[pid 25507] 10:12:36.581237 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.581272 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25491] 10:12:36.581288 read(16,  <unfinished ...>
[pid 25507] 10:12:36.581320 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.581338 read(7,  <unfinished ...>
[pid 25491] 10:12:36.581365 <... read resumed> "", 1024) = 0
[pid 25507] 10:12:36.581389 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.581421 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:36.581455 close(16 <unfinished ...>
[pid 25507] 10:12:36.581577 <... open resumed> ) = 6
[pid 25503] 10:12:36.581604 close(7 <unfinished ...>
[pid 25491] 10:12:36.581631 <... close resumed> ) = 0
Process 25512 attached
[pid 25507] 10:12:36.581666 read(6,  <unfinished ...>
[pid 25503] 10:12:36.581697 <... close resumed> ) = 0
[pid 25491] 10:12:36.581721 munmap(0x7f33164f3000, 4096 <unfinished ...>
[pid 25507] 10:12:36.581765 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.581793 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25491] 10:12:36.581820 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.581888 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.581919 <... munmap resumed> ) = 0
[pid 25491] 10:12:36.581955 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25507] 10:12:36.581994 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25503] 10:12:36.582027 read(6,  <unfinished ...>
[pid 25491] 10:12:36.582053 <... socket resumed> ) = 16
[pid 25507] 10:12:36.582075 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25503] 10:12:36.582113 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25491] 10:12:36.582172 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25507] 10:12:36.582213 <... mmap resumed> ) = 0x7f434c480000
[pid 25503] 10:12:36.582232 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:36.582262 <... connect resumed> ) = 0
[pid 25507] 10:12:36.582285 mprotect(0x7f434c48a000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.582313 <... open resumed> ) = 7
[pid 25491] 10:12:36.582330 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25507] 10:12:36.582362 <... mprotect resumed> ) = 0
[pid 25503] 10:12:36.582378 fstat(7,  <unfinished ...>
[pid 25491] 10:12:36.582402 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25507] 10:12:36.582425 mmap(0x7f434c689000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25503] 10:12:36.582456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:36.582487 sendto(16, "oW\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1", 53, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25512] 10:12:36.582653 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25507] 10:12:36.582687 <... mmap resumed> ) = 0x7f434c689000
[pid 25503] 10:12:36.582715 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:36.582757 <... sendto resumed> ) = 53
[pid 25512] 10:12:36.582782 <... set_robust_list resumed> ) = 0
[pid 25507] 10:12:36.582797 close(6 <unfinished ...>
[pid 25503] 10:12:36.582819 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25491] 10:12:36.582836 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25507] 10:12:36.582867 <... close resumed> ) = 0
[pid 25503] 10:12:36.582892 read(7,  <unfinished ...>
[pid 25507] 10:12:36.582925 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.582956 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25507] 10:12:36.582982 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.583001 close(7 <unfinished ...>
[pid 25507] 10:12:36.583029 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.583061 <... close resumed> ) = 0
[pid 25507] 10:12:36.583080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.583097 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25507] 10:12:36.583128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.583157 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.583185 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.583205 read(6,  <unfinished ...>
[pid 25507] 10:12:36.583234 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.583266 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25507] 10:12:36.583323 <... open resumed> ) = 6
[pid 25503] 10:12:36.583345 uname( <unfinished ...>
[pid 25507] 10:12:36.583372 read(6,  <unfinished ...>
[pid 25503] 10:12:36.583403 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25507] 10:12:36.583465 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25503] 10:12:36.583597 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25507] 10:12:36.583640 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.583773 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790}, 8) = 0
[pid 25512] 10:12:36.583813 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25507] 10:12:36.583840 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25503] 10:12:36.583871 clone( <unfinished ...>
[pid 25507] 10:12:36.584094 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f434c27d000
[pid 25503] 10:12:36.584138 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff4da3d1a90) = 25516
[pid 25507] 10:12:36.584184 mprotect(0x7f434c27f000, 2093056, PROT_NONE <unfinished ...>
[pid 25503] 10:12:36.584214 wait4(25516,  <unfinished ...>
[pid 25507] 10:12:36.584239 <... mprotect resumed> ) = 0
[pid 25507] 10:12:36.584257 mmap(0x7f434c47e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f434c47e000
[pid 25507] 10:12:36.584305 close(6)    = 0
[pid 25507] 10:12:36.584347 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504c3000
[pid 25507] 10:12:36.584400 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.584445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.584489 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25512] 10:12:36.584601 <... setrlimit resumed> ) = 0
[pid 25507] 10:12:36.584616 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.584638 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25507] 10:12:36.584686 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25507] 10:12:36.584742 fstat(6,  <unfinished ...>
[pid 25512] 10:12:36.584913 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.584936 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25507] 10:12:36.584976 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f434c05e000
[pid 25507] 10:12:36.585018 mprotect(0x7f434c07b000, 2093056, PROT_NONE) = 0
[pid 25507] 10:12:36.585053 mmap(0x7f434c27a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f434c27a000
[pid 25507] 10:12:36.585098 mmap(0x7f434c27c000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f434c27c000
[pid 25507] 10:12:36.585141 close(6)    = 0
[pid 25507] 10:12:36.585211 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504c2000
[pid 25507] 10:12:36.585287 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504c1000
[pid 25507] 10:12:36.585333 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504bf000
[pid 25507] 10:12:36.585374 arch_prctl(ARCH_SET_FS, 0x7f43504bf7c0) = 0
[pid 25507] 10:12:36.585445 mprotect(0x7f434c27a000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.585489 mprotect(0x7f434c47e000, 4096, PROT_READ <unfinished ...>
[pid 25512] 10:12:36.585604 <... open resumed> ) = 10
[pid 25507] 10:12:36.585619 <... mprotect resumed> ) = 0
[pid 25507] 10:12:36.585654 mprotect(0x7f434c689000, 4096, PROT_READ <unfinished ...>
[pid 25512] 10:12:36.585706 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.585734 <... mprotect resumed> ) = 0
[pid 25507] 10:12:36.585767 mprotect(0x7f434c89f000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.585830 mprotect(0x7f434caca000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.585876 mprotect(0x7f434cccf000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.586017 mprotect(0x7f434cfac000, 40960, PROT_READ) = 0
[pid 25507] 10:12:36.586136 mprotect(0x7f434d1f9000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.586188 mprotect(0x7f434d413000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.586229 mprotect(0x7f434d620000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.586463 mprotect(0x7f434de0c000, 110592, PROT_READ) = 0
[pid 25512] 10:12:36.586625 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.586691 mprotect(0x7f434e098000, 16384, PROT_READ <unfinished ...>
[pid 25512] 10:12:36.586735 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.586762 <... mprotect resumed> ) = 0
[pid 25507] 10:12:36.586863 mprotect(0x7f434e42d000, 16384, PROT_READ) = 0
[pid 25507] 10:12:36.586907 mprotect(0x7f434e638000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.586950 mprotect(0x7f434e83c000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.587653 mprotect(0x7f434f594000, 4096, PROT_READ <unfinished ...>
[pid 25512] 10:12:36.587723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.587762 <... mprotect resumed> ) = 0
[pid 25507] 10:12:36.587805 mprotect(0x7f434f9c9000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.587849 mprotect(0x7f434fc4d000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.587890 mprotect(0x7f434fe56000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.587941 mprotect(0x7f435009b000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.587987 mprotect(0x7f43502b5000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.588047 mprotect(0x7f43504d8000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.588085 munmap(0x7f43504cd000, 39387) = 0
[pid 25507] 10:12:36.588126 set_tid_address(0x7f43504bfa90) = 25507
[pid 25507] 10:12:36.588160 set_robust_list(0x7f43504bfaa0, 24) = 0
[pid 25507] 10:12:36.588193 futex(0x7ffd396fdcec, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25507] 10:12:36.588231 futex(0x7ffd396fdcec, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f43504bf7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25507] 10:12:36.588282 rt_sigaction(SIGRTMIN, {0x7f434f382c60, [], SA_RESTORER|SA_SIGINFO, 0x7f434f38c790}, NULL, 8) = 0
[pid 25507] 10:12:36.588325 rt_sigaction(SIGRT_1, {0x7f434f382cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f434f38c790}, NULL, 8) = 0
[pid 25507] 10:12:36.588364 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25507] 10:12:36.588408 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25507] 10:12:36.588479 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350336, f_bavail=6350336, f_files=1000000, f_ffree=691092, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25507] 10:12:36.588649 brk(0)      = 0x1f92000
[pid 25507] 10:12:36.588689 brk(0x1fb3000) = 0x1fb3000
[pid 25507] 10:12:36.588747 open("/proc/filesystems", O_RDONLY) = 6
[pid 25507] 10:12:36.588806 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.588856 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d6000
[pid 25507] 10:12:36.588894 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25507] 10:12:36.589068 read(6, "", 1024) = 0
[pid 25507] 10:12:36.589112 close(6)    = 0
[pid 25507] 10:12:36.589151 munmap(0x7f43504d6000, 4096) = 0
[pid 25507] 10:12:36.589237 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.589349 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f434f38c790}, NULL, 8) = 0
[pid 25507] 10:12:36.589400 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25512] 10:12:36.589573 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.589606 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f434f38c790}, NULL, 8) = 0
[pid 25507] 10:12:36.589648 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25507] 10:12:36.589688 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25507] 10:12:36.589739 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f434f38c790}, NULL, 8) = 0
[pid 25507] 10:12:36.589784 umask(0)    = 0
[pid 25507] 10:12:36.589856 geteuid()   = 0
[pid 25507] 10:12:36.589892 getuid()    = 47
[pid 25507] 10:12:36.589926 getgid()    = 12
[pid 25507] 10:12:36.589982 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25507] 10:12:36.590019 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25507] 10:12:36.590054 getgroups(65536, [12]) = 1
[pid 25507] 10:12:36.590092 setgroups(0, []) = 0
[pid 25507] 10:12:36.590128 getegid()   = 12
[pid 25507] 10:12:36.590160 geteuid()   = 0
[pid 25507] 10:12:36.590195 geteuid()   = 0
[pid 25507] 10:12:36.590227 getegid()   = 12
[pid 25507] 10:12:36.590260 setgid(12)  = 0
[pid 25507] 10:12:36.590294 setuid(0)   = 0
[pid 25507] 10:12:36.590354 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25507] 10:12:36.590414 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25507] 10:12:36.590468 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
Process 25514 attached
[pid 25512] 10:12:36.590619 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25507] 10:12:36.590637 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d6000
[pid 25507] 10:12:36.590676 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25507] 10:12:36.590827 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25507] 10:12:36.590872 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.590921 close(7)    = 0
[pid 25507] 10:12:36.590957 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25507] 10:12:36.590991 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.591032 close(7)    = 0
[pid 25507] 10:12:36.591072 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25507] 10:12:36.591116 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25507] 10:12:36.591163 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25507] 10:12:36.591200 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25507] 10:12:36.591256 read(7, "", 4096) = 0
[pid 25507] 10:12:36.591291 close(7)    = 0
[pid 25507] 10:12:36.591324 munmap(0x7f43504d5000, 4096) = 0
[pid 25507] 10:12:36.591373 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.591417 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.591461 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.591583 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25507] 10:12:36.591627 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25507] 10:12:36.591682 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f43504b5000
[pid 25507] 10:12:36.591724 close(7)    = 0
[pid 25507] 10:12:36.591766 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25507] 10:12:36.591808 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25507] 10:12:36.591848 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25507] 10:12:36.591897 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f434be50000
[pid 25507] 10:12:36.591944 mprotect(0x7f434be5c000, 2097152, PROT_NONE) = 0
[pid 25507] 10:12:36.591981 mmap(0x7f434c05c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f434c05c000
[pid 25507] 10:12:36.592028 close(7)    = 0
[pid 25507] 10:12:36.592080 mprotect(0x7f434c05c000, 4096, PROT_READ) = 0
[pid 25507] 10:12:36.592122 munmap(0x7f43504b5000, 39387) = 0
[pid 25507] 10:12:36.592167 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25507] 10:12:36.592212 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25507] 10:12:36.592249 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25507] 10:12:36.592295 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25507] 10:12:36.592331 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25507] 10:12:36.592393 close(7)    = 0
[pid 25507] 10:12:36.592467 munmap(0x7f43504d5000, 4096Process 25513 attached
 <unfinished ...>
[pid 25514] 10:12:36.592598 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25512] 10:12:36.592625 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.592646 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.592683 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25507] 10:12:36.592724 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.592769 close(7)    = 0
[pid 25507] 10:12:36.592806 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25507] 10:12:36.592841 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.592882 close(7)    = 0
[pid 25507] 10:12:36.592922 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25507] 10:12:36.592967 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25507] 10:12:36.593013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25507] 10:12:36.593050 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25507] 10:12:36.593103 close(7)    = 0
[pid 25507] 10:12:36.593142 munmap(0x7f43504d5000, 4096) = 0
[pid 25507] 10:12:36.593195 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25507] 10:12:36.593268 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25507] 10:12:36.593312 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25507] 10:12:36.593357 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25507] 10:12:36.593393 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25507] 10:12:36.593442 close(7)    = 0
[pid 25514] 10:12:36.593599 <... set_robust_list resumed> ) = 0
[pid 25513] 10:12:36.593623 set_robust_list(0x7f03f4bd2aa0, 24 <unfinished ...>
[pid 25512] 10:12:36.593646 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.593659 munmap(0x7f43504d5000, 4096) = 0
[pid 25507] 10:12:36.593715 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25507] 10:12:36.593774 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25507] 10:12:36.593838 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, {SIG_DFL, [], SA_RESTORER, 0x7f434f38c790}, 8) = 0
[pid 25507] 10:12:36.593887 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f43504bfa90) = 25517
[pid 25507] 10:12:36.594139 wait4(25517,  <unfinished ...>
[pid 25514] 10:12:36.594211 fcntl(12, F_GETFD <unfinished ...>
[pid 25513] 10:12:36.594234 <... set_robust_list resumed> ) = 0
[pid 25512] 10:12:36.594249 read(10,  <unfinished ...>
[pid 25514] 10:12:36.594317 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.594333 fcntl(12, F_GETFD <unfinished ...>
[pid 25512] 10:12:36.594354 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25514] 10:12:36.594560 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.594591 <... fcntl resumed> ) = 0
[pid 25512] 10:12:36.594605 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25514] 10:12:36.594650 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.594664 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25512] 10:12:36.594684 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25514] 10:12:36.594764 close(11 <unfinished ...>
[pid 25513] 10:12:36.594791 <... fcntl resumed> ) = 0
[pid 25512] 10:12:36.594805 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25514] 10:12:36.594849 <... close resumed> ) = 0
[pid 25513] 10:12:36.594862 close(6 <unfinished ...>
[pid 25512] 10:12:36.594882 <... open resumed> ) = 13
[pid 25514] 10:12:36.594909 close(6 <unfinished ...>
[pid 25513] 10:12:36.594930 <... close resumed> ) = 0
[pid 25512] 10:12:36.594943 fstat(13,  <unfinished ...>
[pid 25514] 10:12:36.594998 <... close resumed> ) = 0
[pid 25513] 10:12:36.595012 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25512] 10:12:36.595035 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25514] 10:12:36.595111 open("/var/spool/exim/input/Y/1aEJMY-0006cO-Sq-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25513] 10:12:36.595137 <... open resumed> ) = 6
[pid 25512] 10:12:36.595150 fstat(13,  <unfinished ...>
[pid 25514] 10:12:36.595196 <... open resumed> ) = 6
[pid 25513] 10:12:36.595210 fcntl(6, F_GETFD <unfinished ...>
[pid 25512] 10:12:36.595230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25514] 10:12:36.595278 fcntl(6, F_GETFD <unfinished ...>
[pid 25513] 10:12:36.595301 <... fcntl resumed> ) = 0
[pid 25512] 10:12:36.595314 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25514] 10:12:36.595351 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.595364 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25512] 10:12:36.595385 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25514] 10:12:36.595410 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.595437 <... fcntl resumed> ) = 0
[pid 25512] 10:12:36.595450 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25514] 10:12:36.595595 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.595614 geteuid( <unfinished ...>
[pid 25512] 10:12:36.595635 <... lseek resumed> ) = 0
[pid 25514] 10:12:36.595711 geteuid( <unfinished ...>
[pid 25513] 10:12:36.595747 <... geteuid resumed> ) = 0
[pid 25512] 10:12:36.595761 read(13,  <unfinished ...>
[pid 25514] 10:12:36.595804 <... geteuid resumed> ) = 0
[pid 25513] 10:12:36.595819 getegid( <unfinished ...>
[pid 25512] 10:12:36.595839 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25514] 10:12:36.595878 getegid( <unfinished ...>
[pid 25513] 10:12:36.595900 <... getegid resumed> ) = 12
[pid 25512] 10:12:36.595913 read(13,  <unfinished ...>
[pid 25514] 10:12:36.595948 <... getegid resumed> ) = 12
[pid 25513] 10:12:36.595961 setgid(12 <unfinished ...>
[pid 25512] 10:12:36.595981 <... read resumed> "", 4096) = 0
[pid 25514] 10:12:36.596039 setgid(12 <unfinished ...>
[pid 25513] 10:12:36.596064 <... setgid resumed> ) = 0
[pid 25512] 10:12:36.596077 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, Process 25515 attached
 <unfinished ...>
[pid 25514] 10:12:36.596136 <... setgid resumed> ) = 0
[pid 25513] 10:12:36.596150 setuid(47 <unfinished ...>
[pid 25512] 10:12:36.596170 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25515] 10:12:36.596214 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25514] 10:12:36.596238 setuid(47 <unfinished ...>
[pid 25513] 10:12:36.596257 <... setuid resumed> ) = 0
[pid 25512] 10:12:36.596270 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25515] 10:12:36.596313 <... set_robust_list resumed> ) = 0
[pid 25514] 10:12:36.596327 <... setuid resumed> ) = 0
[pid 25513] 10:12:36.596342 close(11 <unfinished ...>
[pid 25512] 10:12:36.596362 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25515] 10:12:36.596455 close(9 <unfinished ...>
[pid 25514] 10:12:36.596487 close(10 <unfinished ...>
[pid 25513] 10:12:36.596584 <... close resumed> ) = 0
[pid 25512] 10:12:36.596602 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25515] 10:12:36.596631 <... close resumed> ) = 0
[pid 25515] 10:12:36.596845 geteuid( <unfinished ...>
[pid 25514] 10:12:36.596871 <... close resumed> ) = 0
[pid 25513] 10:12:36.596884 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25512] 10:12:36.596906 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f7c14b5f790}, 8) = 0
[pid 25515] 10:12:36.597089 <... geteuid resumed> ) = 0
[pid 25514] 10:12:36.597108 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25513] 10:12:36.597129 <... socket resumed> ) = 10
[pid 25512] 10:12:36.597142 close(11 <unfinished ...>
[pid 25515] 10:12:36.597184 getegid( <unfinished ...>
[pid 25514] 10:12:36.597204 <... socket resumed> ) = 10
[pid 25513] 10:12:36.597217 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25512] 10:12:36.597241 <... close resumed> ) = 0
[pid 25515] 10:12:36.597276 <... getegid resumed> ) = 12
[pid 25514] 10:12:36.597296 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25513] 10:12:36.597320 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25512] 10:12:36.597335 fcntl(12, F_GETFD <unfinished ...>
[pid 25515] 10:12:36.597379 setgid(494 <unfinished ...>
[pid 25514] 10:12:36.597401 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25513] 10:12:36.597415 close(10 <unfinished ...>
[pid 25512] 10:12:36.597452 <... fcntl resumed> ) = 0
[pid 25515] 10:12:36.597477 <... setgid resumed> ) = 0
[pid 25514] 10:12:36.597560 close(10 <unfinished ...>
[pid 25513] 10:12:36.597585 <... close resumed> ) = 0
[pid 25515] 10:12:36.597624 setuid(495 <unfinished ...>
[pid 25514] 10:12:36.597647 <... close resumed> ) = 0
[pid 25513] 10:12:36.597660 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25512] 10:12:36.597683 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25515] 10:12:36.597736 <... setuid resumed> ) = 0
[pid 25514] 10:12:36.597751 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25513] 10:12:36.597771 <... socket resumed> ) = 10
[pid 25512] 10:12:36.597784 <... fcntl resumed> ) = 0
[pid 25515] 10:12:36.597848 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25514] 10:12:36.597877 <... socket resumed> ) = 10
[pid 25513] 10:12:36.597891 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25512] 10:12:36.597914 geteuid( <unfinished ...>
[pid 25515] 10:12:36.597963 <... open resumed> ) = 9
[pid 25514] 10:12:36.597977 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25513] 10:12:36.598002 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25512] 10:12:36.598017 <... geteuid resumed> ) = 0
[pid 25515] 10:12:36.598056 fstat(9,  <unfinished ...>
[pid 25514] 10:12:36.598078 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25513] 10:12:36.598092 close(10 <unfinished ...>
[pid 25512] 10:12:36.598112 getegid( <unfinished ...>
[pid 25515] 10:12:36.598149 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25514] 10:12:36.598177 close(10 <unfinished ...>
[pid 25513] 10:12:36.598197 <... close resumed> ) = 0
[pid 25512] 10:12:36.598210 <... getegid resumed> ) = 12
[pid 25515] 10:12:36.598319 fstat(9,  <unfinished ...>
[pid 25514] 10:12:36.598344 <... close resumed> ) = 0
[pid 25513] 10:12:36.598357 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25512] 10:12:36.598379 setgid(500 <unfinished ...>
[pid 25515] 10:12:36.598456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25514] 10:12:36.598484 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.598581 <... open resumed> ) = 10
[pid 25512] 10:12:36.598597 <... setgid resumed> ) = 0
[pid 25515] 10:12:36.598640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25514] 10:12:36.598665 <... open resumed> ) = 10
[pid 25513] 10:12:36.598678 fstat(10,  <unfinished ...>
[pid 25512] 10:12:36.598698 setuid(503 <unfinished ...>
[pid 25515] 10:12:36.598745 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25514] 10:12:36.598769 fstat(10,  <unfinished ...>
[pid 25513] 10:12:36.598792 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25512] 10:12:36.598819 <... setuid resumed> ) = 0
[pid 25515] 10:12:36.598851 read(9,  <unfinished ...>
[pid 25514] 10:12:36.598879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25513] 10:12:36.598904 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25512] 10:12:36.598926 chdir("/" <unfinished ...>
[pid 25515] 10:12:36.598976 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25514] 10:12:36.598994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25513] 10:12:36.599016 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25512] 10:12:36.599029 <... chdir resumed> ) = 0
[pid 25515] 10:12:36.599071 read(9,  <unfinished ...>
[pid 25514] 10:12:36.599094 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25513] 10:12:36.599107 read(10,  <unfinished ...>
[pid 25512] 10:12:36.599127 geteuid( <unfinished ...>
[pid 25515] 10:12:36.599171 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25514] 10:12:36.599189 read(10,  <unfinished ...>
[pid 25513] 10:12:36.599209 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25512] 10:12:36.599227 <... geteuid resumed> ) = 503
[pid 25515] 10:12:36.599288 close(9 <unfinished ...>
[pid 25514] 10:12:36.599311 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25513] 10:12:36.599331 close(10 <unfinished ...>
[pid 25512] 10:12:36.599351 getegid( <unfinished ...>
[pid 25515] 10:12:36.599411 <... close resumed> ) = 0
[pid 25514] 10:12:36.599425 close(10 <unfinished ...>
[pid 25513] 10:12:36.599450 <... close resumed> ) = 0
[pid 25512] 10:12:36.599470 <... getegid resumed> ) = 500
[pid 25515] 10:12:36.599613 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25514] 10:12:36.599642 <... close resumed> ) = 0
[pid 25513] 10:12:36.599656 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25512] 10:12:36.599676 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25515] 10:12:36.599727 <... munmap resumed> ) = 0
[pid 25514] 10:12:36.599741 munmap(0x7f03f4be8000, 4096 <unfinished ...>
[pid 25513] 10:12:36.599771 <... munmap resumed> ) = 0
[pid 25512] 10:12:36.599788 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25515] 10:12:36.600041 brk(0x10c8000 <unfinished ...>
[pid 25514] 10:12:36.600072 <... munmap resumed> ) = 0
[pid 25513] 10:12:36.600086 stat("/etc/mailips",  <unfinished ...>
[pid 25512] 10:12:36.600108 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25515] 10:12:36.600196 <... brk resumed> ) = 0x10c8000
[pid 25514] 10:12:36.600212 stat("/etc/mailips",  <unfinished ...>
[pid 25513] 10:12:36.600234 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25512] 10:12:36.600267 <... chdir resumed> ) = 0
[pid 25515] 10:12:36.600484 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25514] 10:12:36.600580 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25513] 10:12:36.600614 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25512] 10:12:36.600637 stat("tmp",  <unfinished ...>
[pid 25515] 10:12:36.600717 <... lseek resumed> ) = 19
[pid 25514] 10:12:36.600735 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25513] 10:12:36.600757 <... open resumed> ) = 10
[pid 25512] 10:12:36.600771 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
Process 25516 attached
[pid 25515] 10:12:36.600847 read(6,  <unfinished ...>
[pid 25514] 10:12:36.600887 <... open resumed> ) = 10
[pid 25513] 10:12:36.600902 fstat(10,  <unfinished ...>
[pid 25512] 10:12:36.600929 stat("new",  <unfinished ...>
[pid 25516] 10:12:36.600962 set_robust_list(0x7ff4da3d1aa0, 24 <unfinished ...>
[pid 25515] 10:12:36.600985 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2372) = 1858
[pid 25514] 10:12:36.601003 fstat(10,  <unfinished ...>
[pid 25513] 10:12:36.601255 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25516] 10:12:36.601291 <... set_robust_list resumed> ) = 0
[pid 25515] 10:12:36.601329 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25514] 10:12:36.601388 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25512] 10:12:36.601415 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25516] 10:12:36.601460 geteuid( <unfinished ...>
[pid 25515] 10:12:36.601488 <... write resumed> ) = 4
[pid 25514] 10:12:36.601576 fstat(10,  <unfinished ...>
[pid 25513] 10:12:36.601605 fstat(10,  <unfinished ...>
[pid 25502] 10:12:36.601628 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25516] 10:12:36.601664 <... geteuid resumed> ) = 0
[pid 25515] 10:12:36.601686 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25514] 10:12:36.601721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25513] 10:12:36.601748 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25512] 10:12:36.601774 stat("cur",  <unfinished ...>
[pid 25502] 10:12:36.601803 read(9,  <unfinished ...>
[pid 25516] 10:12:36.601836 geteuid( <unfinished ...>
[pid 25515] 10:12:36.601857 <... write resumed> ) = 4
[pid 25514] 10:12:36.601871 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25513] 10:12:36.601905 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25512] 10:12:36.601930 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25502] 10:12:36.602014 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25516] 10:12:36.602048 <... geteuid resumed> ) = 0
[pid 25515] 10:12:36.602062 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25514] 10:12:36.602088 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25513] 10:12:36.602103 <... mmap resumed> ) = 0x7f03f4be8000
[pid 25512] 10:12:36.602120 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25502] 10:12:36.602158 read(9,  <unfinished ...>
[pid 25516] 10:12:36.602190 getegid( <unfinished ...>
[pid 25515] 10:12:36.602212 <... write resumed> ) = 4
[pid 25514] 10:12:36.602225 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.602250 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25512] 10:12:36.602272 <... open resumed> ) = 11
[pid 25502] 10:12:36.602289 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25516] 10:12:36.602316 <... getegid resumed> ) = 499
[pid 25515] 10:12:36.602330 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25514] 10:12:36.602359 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.602373 <... lseek resumed> ) = 0
[pid 25512] 10:12:36.602388 read(11,  <unfinished ...>
[pid 25502] 10:12:36.602415 read(9,  <unfinished ...>
[pid 25516] 10:12:36.602448 setgid(12 <unfinished ...>
[pid 25515] 10:12:36.602472 <... write resumed> ) = 4
[pid 25514] 10:12:36.602486 read(10,  <unfinished ...>
[pid 25513] 10:12:36.602591 read(10,  <unfinished ...>
[pid 25512] 10:12:36.602616 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2950
[pid 25502] 10:12:36.602698 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25516] 10:12:36.602732 <... setgid resumed> ) = 0
[pid 25515] 10:12:36.602755 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25514] 10:12:36.602784 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.602798 <... read resumed> "", 4096) = 0
[pid 25512] 10:12:36.602829 stat("tmp/1451491956.H602689P25512.fin.finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:36.603043 read(9,  <unfinished ...>
[pid 25516] 10:12:36.603078 setuid(47 <unfinished ...>
[pid 25515] 10:12:36.603102 <... write resumed> ) = 4
[pid 25514] 10:12:36.603115 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.603140 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25512] 10:12:36.603169 <... stat resumed> 0x7ffdac33e830) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.603190 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25516] 10:12:36.603218 <... setuid resumed> ) = 0
[pid 25515] 10:12:36.603232 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25514] 10:12:36.604886 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.604904 <... open resumed> ) = 11
[pid 25512] 10:12:36.604922 open("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25502] 10:12:36.604991 read(9,  <unfinished ...>
[pid 25516] 10:12:36.605031 brk(0x1cdf000 <unfinished ...>
[pid 25515] 10:12:36.605052 <... write resumed> ) = 40
[pid 25514] 10:12:36.605066 read(10,  <unfinished ...>
[pid 25513] 10:12:36.605086 fstat(11,  <unfinished ...>
[pid 25512] 10:12:36.605106 <... open resumed> ) = 14
[pid 25502] 10:12:36.605128 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25512] 10:12:36.605158 chown("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25502] 10:12:36.605192 read(9,  <unfinished ...>
[pid 25512] 10:12:36.605217 <... chown resumed> ) = 0
[pid 25512] 10:12:36.605239 chmod("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", 0660) = 0
[pid 25512] 10:12:36.605278 chown("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", 503, 500) = 0
[pid 25512] 10:12:36.605319 chmod("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", 0660) = 0
[pid 25512] 10:12:36.605394 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25512] 10:12:36.605489 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25515] 10:12:36.605603 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25514] 10:12:36.605627 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.605642 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25512] 10:12:36.605672 <... lseek resumed> ) = 19
[pid 25512] 10:12:36.605692 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25512] 10:12:36.605753 read(6, "", 8192) = 0
[pid 25512] 10:12:36.605791 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:36 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2571) = 2571
[pid 25512] 10:12:36.605841 fsync(14 <unfinished ...>
[pid 25515] 10:12:36.606173 <... write resumed> ) = 4
[pid 25514] 10:12:36.606191 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.606217 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.606240 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:36.606265 wait4(-1,  <unfinished ...>
[pid 25515] 10:12:36.606312 close(10 <unfinished ...>
[pid 25514] 10:12:36.606332 <... open resumed> ) = 11
[pid 25513] 10:12:36.606351 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25512] 10:12:36.606368 <... fsync resumed> ) = 0
[pid 25512] 10:12:36.606388 lseek(11, 0, SEEK_END) = 2950
[pid 25512] 10:12:36.606422 write(11, "2571 1\n", 7) = 7
[pid 25512] 10:12:36.606463 close(11)   = 0
[pid 25512] 10:12:36.606575 fstat(14, {st_dev=makedev(144, 4215), st_ino=122016474, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2571, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25512] 10:12:36.606631 close(14)   = 0
[pid 25512] 10:12:36.606677 rename("tmp/1451491956.H602689P25512.fin.finestweddingsites.com", "new/1451491956.H602689P25512.fin.finestweddingsites.com,S=2571") = 0
[pid 25512] 10:12:36.606755 write(12, "\0\0\0\0", 4) = 4
[pid 25473] 10:12:36.606802 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.606827 write(12, "\v\n\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.606854 read(11,  <unfinished ...>
[pid 25512] 10:12:36.606883 <... write resumed> ) = 4
[pid 25473] 10:12:36.606899 <... read resumed> "\v\n\0\0", 4) = 4
[pid 25512] 10:12:36.606920 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25473] 10:12:36.606947 read(11,  <unfinished ...>
[pid 25512] 10:12:36.606973 <... write resumed> ) = 4
[pid 25473] 10:12:36.606989 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25512] 10:12:36.607009 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.607039 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607066 <... write resumed> ) = 4
[pid 25473] 10:12:36.607081 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.607102 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.607126 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607152 <... write resumed> ) = 4
[pid 25473] 10:12:36.607167 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.607187 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.607211 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607237 <... write resumed> ) = 4
[pid 25473] 10:12:36.607252 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.607274 write(12, "\260\263\357\0\0\0\0\0", 8 <unfinished ...>
[pid 25473] 10:12:36.607300 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607329 <... write resumed> ) = 8
[pid 25473] 10:12:36.607344 <... read resumed> "\260\263\357\0\0\0\0\0", 8) = 8
[pid 25512] 10:12:36.607365 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.607390 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607417 <... write resumed> ) = 4
[pid 25473] 10:12:36.607432 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.607453 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25473] 10:12:36.607477 read(11,  <unfinished ...>
[pid 25512] 10:12:36.607578 <... write resumed> ) = 4
[pid 25473] 10:12:36.607598 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25512] 10:12:36.607622 close(12 <unfinished ...>
[pid 25473] 10:12:36.607648 close(11 <unfinished ...>
[pid 25512] 10:12:36.607679 <... close resumed> ) = 0
[pid 25473] 10:12:36.607697 <... close resumed> ) = 0
[pid 25512] 10:12:36.607725 close(10 <unfinished ...>
[pid 25473] 10:12:36.607753 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25512] 10:12:36.607792 <... close resumed> ) = 0
[pid 25473] 10:12:36.607809 <... write resumed> ) = 55
[pid 25512] 10:12:36.607833 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25473] 10:12:36.607877 fsync(9 <unfinished ...>
[pid 25512] 10:12:36.607929 <... munmap resumed> ) = 0
[pid 25512] 10:12:36.607963 close(13)   = 0
[pid 25512] 10:12:36.608030 munmap(0x7f7c15ca7000, 4096) = 0
[pid 25512] 10:12:36.608459 exit_group(0) = ?
[pid 25473] 10:12:36.608833 <... fsync resumed> ) = 0
[pid 25512] 10:12:36.608864 +++ exited with 0 +++
[pid 25473] 10:12:36.608878 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25512
[pid 25473] 10:12:36.608952 open("/etc/userdomains", O_RDONLY) = 10
[pid 25473] 10:12:36.608997 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.609048 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.609095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca8000
[pid 25473] 10:12:36.609133 lseek(10, 0, SEEK_SET) = 0
[pid 25473] 10:12:36.609166 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:36.609231 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com", 0x7ffdac33d580) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.609285 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.609349 write(8, "2015-12-30 10:12:36 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25473] 10:12:36.609410 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.609469 stat("/etc/localtime",  <unfinished ...>
[pid 25515] 10:12:36.609588 <... close resumed> ) = 0
[pid 25514] 10:12:36.609604 fstat(11,  <unfinished ...>
[pid 25513] 10:12:36.609625 read(11,  <unfinished ...>
[pid 25473] 10:12:36.609647 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.609683 close(7)    = 0
[pid 25473] 10:12:36.609734 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25473] 10:12:36.609781 fcntl(7, F_GETFD) = 0
[pid 25473] 10:12:36.609822 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:36.609857 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378552, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.609903 write(7, "2015-12-30 10:12:36 [25473] 1aEJMZ-0006ce-8t => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2571 QT=1s DT=0s\n", 232) = 232
[pid 25473] 10:12:36.609956 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25473] 10:12:36.610011 alarm(60)   = 0
[pid 25473] 10:12:36.610047 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25473] 10:12:36.610092 alarm(0)    = 60
[pid 25473] 10:12:36.610182 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.610249 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25473] 10:12:36.610298 fcntl(12, F_GETFD) = 0
[pid 25473] 10:12:36.610332 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:36.610373 read(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25473] 10:12:36.610455 close(12 <unfinished ...>
[pid 25516] 10:12:36.610604 <... brk resumed> ) = 0x1cdf000
[pid 25515] 10:12:36.610624 exit_group(0) = ?
[pid 25514] 10:12:36.611081 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25513] 10:12:36.611363 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25473] 10:12:36.611400 <... close resumed> ) = 0
[pid 25516] 10:12:36.611472 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25515] 10:12:36.611573 +++ exited with 0 +++
[pid 25514] 10:12:36.611591 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25513] 10:12:36.611626 close(11 <unfinished ...>
[pid 25502] 10:12:36.611657 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25515
[pid 25473] 10:12:36.611690 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.611726 close(9 <unfinished ...>
[pid 25473] 10:12:36.611754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.611778 <... close resumed> ) = 0
[pid 25473] 10:12:36.611797 stat("/var/tmp",  <unfinished ...>
[pid 25502] 10:12:36.611831 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25473] 10:12:36.611861 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25502] 10:12:36.611983 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25473] 10:12:36.612031 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.612068 brk(0x10c7000 <unfinished ...>
[pid 25473] 10:12:36.612094 <... open resumed> ) = 12
[pid 25502] 10:12:36.612114 <... brk resumed> ) = 0x10c7000
[pid 25473] 10:12:36.612139 fcntl(12, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.612167 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25473] 10:12:36.612201 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.612221 <... open resumed> ) = 9
[pid 25473] 10:12:36.612242 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.612269 alarm(60 <unfinished ...>
[pid 25473] 10:12:36.612293 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.612313 <... alarm resumed> ) = 0
[pid 25473] 10:12:36.612330 fstat(12,  <unfinished ...>
[pid 25502] 10:12:36.612359 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25473] 10:12:36.612387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25502] 10:12:36.612434 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.612454 pread(12,  <unfinished ...>
[pid 25502] 10:12:36.612482 alarm(0 <unfinished ...>
[pid 25473] 10:12:36.612585 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25502] 10:12:36.612632 <... alarm resumed> ) = 60
[pid 25473] 10:12:36.612710 pread(12,  <unfinished ...>
[pid 25502] 10:12:36.612755 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.612798 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25502] 10:12:36.612834 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.612854 close(12 <unfinished ...>
[pid 25502] 10:12:36.612893 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.613007 <... close resumed> ) = 0
[pid 25514] 10:12:36.613046 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25502] 10:12:36.613069 <... open resumed> ) = 10
[pid 25473] 10:12:36.613087 close(11 <unfinished ...>
[pid 25514] 10:12:36.613118 read(11,  <unfinished ...>
[pid 25502] 10:12:36.613146 read(10,  <unfinished ...>
[pid 25473] 10:12:36.613192 <... close resumed> ) = 0
[pid 25514] 10:12:36.613233 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.613268 <... read resumed> "cpu  123077 1342437 395206 67343097 2509 0 0 0\ncpu0 123077 1342437 395206 67343097 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58475504\nbtime 1450798266\nprocesses 892995\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25473] 10:12:36.613290 pipe( <unfinished ...>
[pid 25514] 10:12:36.613323 close(11 <unfinished ...>
[pid 25502] 10:12:36.613348 close(10 <unfinished ...>
[pid 25473] 10:12:36.613374 <... pipe resumed> [11, 12]) = 0
[pid 25514] 10:12:36.613398 <... close resumed> ) = 0
[pid 25502] 10:12:36.613414 <... close resumed> ) = 0
[pid 25473] 10:12:36.613480 close(10 <unfinished ...>
[pid 25514] 10:12:36.613578 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.613612 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25473] 10:12:36.613642 <... close resumed> ) = 0
[pid 25514] 10:12:36.613669 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.613731 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:36.613776 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25514] 10:12:36.613810 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.613840 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.613869 <... munmap resumed> ) = 0
[pid 25514] 10:12:36.613893 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25502] 10:12:36.614021 <... open resumed> ) = 10
[pid 25473] 10:12:36.614048 clone( <unfinished ...>
[pid 25514] 10:12:36.614272 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.614301 fcntl(10, F_GETFD <unfinished ...>
[pid 25514] 10:12:36.614331 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.614353 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.614370 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25518
[pid 25514] 10:12:36.614410 read(10,  <unfinished ...>
[pid 25502] 10:12:36.614437 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.614460 close(12 <unfinished ...>
[pid 25514] 10:12:36.614488 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.614603 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.614627 <... close resumed> ) = 0
Process 25517 attached
[pid 25516] 10:12:36.614665 <... open resumed> ) = 7
[pid 25514] 10:12:36.614693 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.614729 <... close resumed> ) = 0
[pid 25502] 10:12:36.614745 read(10,  <unfinished ...>
[pid 25473] 10:12:36.614770 read(11,  <unfinished ...>
[pid 25517] 10:12:36.614800 set_robust_list(0x7f43504bfaa0, 24 <unfinished ...>
[pid 25516] 10:12:36.614823 fstat(7,  <unfinished ...>
[pid 25514] 10:12:36.614845 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.614862 munmap(0x7f03f4be7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.614889 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25517] 10:12:36.614940 <... set_robust_list resumed> ) = 0
[pid 25516] 10:12:36.614956 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25514] 10:12:36.615010 read(10,  <unfinished ...>
[pid 25513] 10:12:36.615088 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.615102 close(10 <unfinished ...>
[pid 25517] 10:12:36.615169 geteuid( <unfinished ...>
[pid 25516] 10:12:36.615192 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25514] 10:12:36.615218 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.615258 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.615289 <... close resumed> ) = 0
[pid 25517] 10:12:36.615329 <... geteuid resumed> ) = 0
[pid 25516] 10:12:36.615344 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25514] 10:12:36.615368 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25513] 10:12:36.615412 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25502] 10:12:36.615427 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25517] 10:12:36.615639 geteuid( <unfinished ...>
[pid 25516] 10:12:36.615674 read(7,  <unfinished ...>
[pid 25514] 10:12:36.615711 <... open resumed> ) = 11
[pid 25513] 10:12:36.615730 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.615754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25517] 10:12:36.615783 <... geteuid resumed> ) = 0
[pid 25516] 10:12:36.615798 <... read resumed> "\246\275xic\31\345\372\263W\341w\216\301\222\353)\212s'\250\374aw\343Y\240I\213\230\342\22Xl\260\274\273[\357\331\322\237\244\373a\245\5\177", 48) = 48
[pid 25514] 10:12:36.615817 alarm(60 <unfinished ...>
[pid 25513] 10:12:36.615846 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.615859 stat("/var/tmp",  <unfinished ...>
[pid 25517] 10:12:36.615900 getegid( <unfinished ...>
[pid 25516] 10:12:36.615921 close(7 <unfinished ...>
[pid 25514] 10:12:36.615944 <... alarm resumed> ) = 0
[pid 25513] 10:12:36.615960 read(10,  <unfinished ...>
[pid 25502] 10:12:36.615982 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25517] 10:12:36.616065 <... getegid resumed> ) = 12
[pid 25516] 10:12:36.616081 <... close resumed> ) = 0
[pid 25514] 10:12:36.616100 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25513] 10:12:36.616150 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.616170 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25517] 10:12:36.616206 setgid(12 <unfinished ...>
[pid 25516] 10:12:36.616229 getuid( <unfinished ...>
[pid 25514] 10:12:36.616250 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.616266 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.616289 <... mmap resumed> ) = 0x7f3c0be05000
[pid 25517] 10:12:36.616432 <... setgid resumed> ) = 0
[pid 25516] 10:12:36.616451 <... getuid resumed> ) = 47
[pid 25514] 10:12:36.616467 alarm(0 <unfinished ...>
[pid 25513] 10:12:36.616720 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.616746 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25517] 10:12:36.616788 setuid(47 <unfinished ...>
[pid 25516] 10:12:36.616812 exit_group(0) = ?
[pid 25514] 10:12:36.616826 <... alarm resumed> ) = 60
[pid 25513] 10:12:36.617110 read(10,  <unfinished ...>
[pid 25502] 10:12:36.617139 <... open resumed> ) = 10
[pid 25517] 10:12:36.617179 <... setuid resumed> ) = 0
[pid 25516] 10:12:36.617194 +++ exited with 0 +++
[pid 25514] 10:12:36.618538 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25513] 10:12:36.618588 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.618631 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25516
[pid 25502] 10:12:36.618666 fcntl(10, F_GETFD <unfinished ...>
[pid 25514] 10:12:36.618700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25513] 10:12:36.618736 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25503] 10:12:36.618775 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25502] 10:12:36.618806 <... fcntl resumed> ) = 0
[pid 25514] 10:12:36.618830 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25513] 10:12:36.618860 <... open resumed> ) = 11
[pid 25503] 10:12:36.618876 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, 8) = 0
[pid 25502] 10:12:36.618921 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25514] 10:12:36.618955 <... open resumed> ) = 13
[pid 25513] 10:12:36.618972 alarm(60 <unfinished ...>
[pid 25503] 10:12:36.618995 getcwd( <unfinished ...>
[pid 25502] 10:12:36.619020 <... fcntl resumed> ) = 0
[pid 25514] 10:12:36.619047 fcntl(13, F_GETFD <unfinished ...>
[pid 25513] 10:12:36.619082 <... alarm resumed> ) = 0
[pid 25503] 10:12:36.619100 <... getcwd resumed> "/home/finest09/public_html/includes", 16380) = 36
[pid 25502] 10:12:36.619153 fstat(10,  <unfinished ...>
[pid 25514] 10:12:36.619187 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.619204 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25503] 10:12:36.619231 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.619261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25514] 10:12:36.619331 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.619357 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.619373 <... open resumed> ) = 7
[pid 25502] 10:12:36.619389 pread(10,  <unfinished ...>
[pid 25514] 10:12:36.619420 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.619438 alarm(0 <unfinished ...>
[pid 25503] 10:12:36.619461 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.619484 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25514] 10:12:36.619633 read(13,  <unfinished ...>
[pid 25513] 10:12:36.619663 <... alarm resumed> ) = 60
[pid 25503] 10:12:36.619728 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.619765 pread(10,  <unfinished ...>
[pid 25514] 10:12:36.619808 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25513] 10:12:36.619844 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25503] 10:12:36.619874 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.619897 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25514] 10:12:36.619945 close(13 <unfinished ...>
[pid 25513] 10:12:36.619972 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25503] 10:12:36.620037 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.620066 pread(10,  <unfinished ...>
[pid 25514] 10:12:36.620098 <... close resumed> ) = 0
[pid 25513] 10:12:36.620126 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.620162 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.620582 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25514] 10:12:36.620646 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25513] 10:12:36.620679 <... open resumed> ) = 13
[pid 25503] 10:12:36.620695 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.620712 close(10 <unfinished ...>
[pid 25514] 10:12:36.620743 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25513] 10:12:36.620765 fcntl(13, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.620795 read(7,  <unfinished ...>
[pid 25502] 10:12:36.620829 <... close resumed> ) = 0
[pid 25514] 10:12:36.620877 stat("/var/tmp",  <unfinished ...>
[pid 25513] 10:12:36.620909 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.620925 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25502] 10:12:36.620952 munmap(0x7f3c0be05000, 200704 <unfinished ...>
[pid 25514] 10:12:36.621004 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25513] 10:12:36.621196 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.621226 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.621250 <... munmap resumed> ) = 0
[pid 25514] 10:12:36.621286 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25513] 10:12:36.621320 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.621338 <... lseek resumed> ) = 1279
[pid 25502] 10:12:36.621355 close(9 <unfinished ...>
[pid 25514] 10:12:36.621387 <... open resumed> ) = 13
[pid 25513] 10:12:36.621403 read(13,  <unfinished ...>
[pid 25503] 10:12:36.621426 read(7,  <unfinished ...>
[pid 25502] 10:12:36.621449 <... close resumed> ) = 0
[pid 25514] 10:12:36.621566 fcntl(13, F_GETFD <unfinished ...>
[pid 25513] 10:12:36.621602 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25503] 10:12:36.621630 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25502] 10:12:36.621665 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25514] 10:12:36.621705 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.621722 close(13 <unfinished ...>
[pid 25503] 10:12:36.621749 close(7 <unfinished ...>
[pid 25502] 10:12:36.621795 <... open resumed> ) = 9
[pid 25514] 10:12:36.621824 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25513] 10:12:36.621849 <... close resumed> ) = 0
[pid 25503] 10:12:36.621878 <... close resumed> ) = 0
[pid 25502] 10:12:36.621897 fstat(9,  <unfinished ...>
[pid 25517] 10:12:36.621979 brk(0x1fd4000 <unfinished ...>
[pid 25514] 10:12:36.622000 <... fcntl resumed> ) = 0
[pid 25513] 10:12:36.622017 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.622044 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.622072 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25514] 10:12:36.622116 fstat(13,  <unfinished ...>
[pid 25513] 10:12:36.622144 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.622163 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.622192 fstat(9,  <unfinished ...>
[pid 25517] 10:12:36.622226 <... brk resumed> ) = 0x1fd4000
[pid 25514] 10:12:36.622240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25513] 10:12:36.622613 stat("/var/tmp",  <unfinished ...>
[pid 25503] 10:12:36.622667 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25502] 10:12:36.622714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25514] 10:12:36.622758 pread(13,  <unfinished ...>
[pid 25513] 10:12:36.622797 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25503] 10:12:36.622984 <... open resumed> ) = 7
[pid 25502] 10:12:36.623008 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25514] 10:12:36.623045 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25513] 10:12:36.623090 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.623125 fcntl(7, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.623148 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25514] 10:12:36.623172 pread(13,  <unfinished ...>
[pid 25513] 10:12:36.623196 <... open resumed> ) = 13
[pid 25503] 10:12:36.623215 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.623231 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25514] 10:12:36.623260 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25513] 10:12:36.623295 fcntl(13, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.623320 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.623345 <... lseek resumed> ) = 0
[pid 25514] 10:12:36.623368 pread(13,  <unfinished ...>
[pid 25513] 10:12:36.623596 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.623616 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.623632 read(9,  <unfinished ...>
[pid 25514] 10:12:36.623669 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25513] 10:12:36.623701 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.623776 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.623802 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25514] 10:12:36.623859 close(13 <unfinished ...>
[pid 25513] 10:12:36.623895 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.623912 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378784, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.623976 stat("/jail_owner",  <unfinished ...>
[pid 25517] 10:12:36.624014 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25514] 10:12:36.624038 <... close resumed> ) = 0
[pid 25513] 10:12:36.624091 fstat(13,  <unfinished ...>
[pid 25503] 10:12:36.624119 write(7, "2015-12-30 10:12:36 [25503] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101 <unfinished ...>
[pid 25502] 10:12:36.624150 <... stat resumed> 0x7ffced97a9d0) = -1 ENOENT (No such file or directory)
[pid 25517] 10:12:36.624185 <... open resumed> ) = 7
[pid 25514] 10:12:36.624201 close(11 <unfinished ...>
[pid 25513] 10:12:36.624235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25503] 10:12:36.624288 <... write resumed> ) = 101
[pid 25502] 10:12:36.624311 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25517] 10:12:36.624355 fstat(7,  <unfinished ...>
[pid 25514] 10:12:36.624377 <... close resumed> ) = 0
[pid 25513] 10:12:36.624418 pread(13,  <unfinished ...>
[pid 25503] 10:12:36.624445 chdir("/var/spool/exim" <unfinished ...>
[pid 25502] 10:12:36.624478 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25517] 10:12:36.624611 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25514] 10:12:36.624641 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25513] 10:12:36.624682 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25503] 10:12:36.624760 <... chdir resumed> ) = 0
[pid 25502] 10:12:36.624795 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25517] 10:12:36.624862 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25514] 10:12:36.624907 <... socket resumed> ) = 11
[pid 25513] 10:12:36.624934 pread(13,  <unfinished ...>
[pid 25503] 10:12:36.624959 geteuid( <unfinished ...>
[pid 25502] 10:12:36.624981 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25517] 10:12:36.625014 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25514] 10:12:36.625033 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25513] 10:12:36.625068 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25503] 10:12:36.625110 <... geteuid resumed> ) = 0
[pid 25502] 10:12:36.625129 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25517] 10:12:36.625166 read(7,  <unfinished ...>
[pid 25514] 10:12:36.625194 <... setsockopt resumed> ) = 0
[pid 25513] 10:12:36.625223 pread(13,  <unfinished ...>
[pid 25503] 10:12:36.625248 getegid( <unfinished ...>
[pid 25502] 10:12:36.625270 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25517] 10:12:36.625314 <... read resumed> "\316\6\24+$\261\363[F\307\355\24\355\224\7\307\367\226=\226Z\6c\363\344Ff\205c\234\344@*\233\265\206\23\246\373\210\363\330M\206\335\204\371[", 48) = 48
[pid 25514] 10:12:36.625333 alarm(300 <unfinished ...>
[pid 25513] 10:12:36.625369 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25503] 10:12:36.625404 <... getegid resumed> ) = 499
[pid 25502] 10:12:36.625435 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25517] 10:12:36.625476 close(7 <unfinished ...>
[pid 25514] 10:12:36.625621 <... alarm resumed> ) = 0
[pid 25513] 10:12:36.625652 close(13 <unfinished ...>
[pid 25503] 10:12:36.625682 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.625722 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25517] 10:12:36.625756 <... close resumed> ) = 0
[pid 25514] 10:12:36.625772 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("199.188.200.35")}, 16 <unfinished ...>
[pid 25513] 10:12:36.625875 <... close resumed> ) = 0
[pid 25503] 10:12:36.625918 <... open resumed> ) = 8
[pid 25502] 10:12:36.625940 stat("/etc/demouids",  <unfinished ...>
[pid 25517] 10:12:36.625976 getuid( <unfinished ...>
[pid 25513] 10:12:36.625998 close(11 <unfinished ...>
[pid 25503] 10:12:36.626026 fstat(8,  <unfinished ...>
[pid 25502] 10:12:36.626049 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25517] 10:12:36.626111 <... getuid resumed> ) = 47
[pid 25513] 10:12:36.626129 <... close resumed> ) = 0
[pid 25503] 10:12:36.626309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.626345 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25517] 10:12:36.626382 exit_group(0) = ?
[pid 25513] 10:12:36.626396 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25503] 10:12:36.630132 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.630174 <... open resumed> ) = 10
[pid 25517] 10:12:36.630213 +++ exited with 0 +++
[pid 25513] 10:12:36.630228 <... socket resumed> ) = 11
[pid 25507] 10:12:36.630252 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25517
[pid 25503] 10:12:36.630275 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.630299 fstat(10,  <unfinished ...>
[pid 25513] 10:12:36.630329 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25507] 10:12:36.630358 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0},  <unfinished ...>
[pid 25503] 10:12:36.630387 read(8,  <unfinished ...>
[pid 25502] 10:12:36.630414 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25513] 10:12:36.630453 <... setsockopt resumed> ) = 0
[pid 25507] 10:12:36.630481 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, 8) = 0
[pid 25503] 10:12:36.630582 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.630616 fstat(10,  <unfinished ...>
[pid 25513] 10:12:36.630648 alarm(300 <unfinished ...>
[pid 25507] 10:12:36.630674 getcwd( <unfinished ...>
[pid 25503] 10:12:36.630699 close(8 <unfinished ...>
[pid 25502] 10:12:36.630737 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25513] 10:12:36.630777 <... alarm resumed> ) = 0
[pid 25507] 10:12:36.630800 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25503] 10:12:36.630853 <... close resumed> ) = 0
[pid 25502] 10:12:36.630872 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25513] 10:12:36.630907 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("162.213.251.170")}, 16 <unfinished ...>
[pid 25507] 10:12:36.630977 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.631008 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.631037 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25507] 10:12:36.631059 <... open resumed> ) = 7
[pid 25503] 10:12:36.631075 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.631096 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.631127 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.631149 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.631182 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.631203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.631235 <... open resumed> ) = 8
[pid 25502] 10:12:36.631251 read(10,  <unfinished ...>
[pid 25507] 10:12:36.631281 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.631304 read(8,  <unfinished ...>
[pid 25502] 10:12:36.631328 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.631368 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.631405 <... read resumed> "65536\n", 31) = 6
[pid 25502] 10:12:36.631423 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25507] 10:12:36.631468 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.631575 close(8 <unfinished ...>
[pid 25502] 10:12:36.631606 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25507] 10:12:36.631775 <... mmap resumed> ) = 0x7f43504d5000
[pid 25503] 10:12:36.631800 <... close resumed> ) = 0
[pid 25502] 10:12:36.631824 getuid( <unfinished ...>
[pid 25507] 10:12:36.631853 read(7,  <unfinished ...>
[pid 25503] 10:12:36.631880 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.631910 <... getuid resumed> ) = 0
[pid 25507] 10:12:36.631933 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25503] 10:12:36.631962 <... open resumed> ) = 8
[pid 25502] 10:12:36.631981 geteuid( <unfinished ...>
[pid 25507] 10:12:36.632010 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.632033 fstat(8,  <unfinished ...>
[pid 25502] 10:12:36.632055 <... geteuid resumed> ) = 0
[pid 25507] 10:12:36.632078 <... lseek resumed> ) = 1279
[pid 25503] 10:12:36.632095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.632139 getgid( <unfinished ...>
[pid 25507] 10:12:36.632177 read(7,  <unfinished ...>
[pid 25503] 10:12:36.632203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.632229 <... getgid resumed> ) = 12
[pid 25507] 10:12:36.632253 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25503] 10:12:36.632286 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.632304 getegid( <unfinished ...>
[pid 25507] 10:12:36.632331 close(7 <unfinished ...>
[pid 25503] 10:12:36.632355 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.632378 <... getegid resumed> ) = 12
[pid 25507] 10:12:36.632610 <... close resumed> ) = 0
[pid 25503] 10:12:36.632641 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.632662 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.632702 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.632731 read(8,  <unfinished ...>
[pid 25502] 10:12:36.632760 <... open resumed> ) = 11
[pid 25507] 10:12:36.632784 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.632819 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.632864 read(11,  <unfinished ...>
[pid 25507] 10:12:36.632896 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25503] 10:12:36.632930 read(8,  <unfinished ...>
[pid 25502] 10:12:36.632953 <... read resumed> "c\240\224\34", 4) = 4
[pid 25507] 10:12:36.632977 <... open resumed> ) = 7
[pid 25503] 10:12:36.632995 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.633016 close(11 <unfinished ...>
[pid 25507] 10:12:36.633045 fcntl(7, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.633068 close(8 <unfinished ...>
[pid 25502] 10:12:36.633091 <... close resumed> ) = 0
[pid 25507] 10:12:36.633198 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.633218 <... close resumed> ) = 0
[pid 25502] 10:12:36.633236 readlink("/proc/self/exe",  <unfinished ...>
[pid 25507] 10:12:36.633293 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.633319 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.633352 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25507] 10:12:36.633437 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.633462 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.633554 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETSProcess 25518 attached
 <unfinished ...>
[pid 25507] 10:12:36.633625 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.633651 setgroups(1, [12] <unfinished ...>
[pid 25502] 10:12:36.633678 <... ioctl resumed> , 0x7ffced974f60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.633707 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25507] 10:12:36.633730 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378885, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.633768 <... setgroups resumed> ) = 0
[pid 25502] 10:12:36.633786 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.633816 <... set_robust_list resumed> ) = 0
[pid 25507] 10:12:36.633829 write(7, "2015-12-30 10:12:36 [25507] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMa-0006dD-AR\n", 92 <unfinished ...>
[pid 25503] 10:12:36.633933 setgid(12 <unfinished ...>
[pid 25502] 10:12:36.633958 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.633986 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25507] 10:12:36.634014 <... write resumed> ) = 92
[pid 25503] 10:12:36.634032 <... setgid resumed> ) = 0
[pid 25502] 10:12:36.634050 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.634080 <... setrlimit resumed> ) = 0
[pid 25507] 10:12:36.634093 chdir("/var/spool/exim" <unfinished ...>
[pid 25503] 10:12:36.634234 setuid(47 <unfinished ...>
[pid 25502] 10:12:36.634259 <... ioctl resumed> , 0x7ffced974f60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.634284 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.634307 <... chdir resumed> ) = 0
[pid 25503] 10:12:36.634325 <... setuid resumed> ) = 0
[pid 25502] 10:12:36.634372 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25507] 10:12:36.634410 setgid(12 <unfinished ...>
[pid 25503] 10:12:36.634433 read(6,  <unfinished ...>
[pid 25502] 10:12:36.634461 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.634488 <... open resumed> ) = 10
[pid 25507] 10:12:36.634574 <... setgid resumed> ) = 0
[pid 25503] 10:12:36.634627 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25502] 10:12:36.634692 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.634727 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.634752 read(6,  <unfinished ...>
[pid 25503] 10:12:36.634779 read(6,  <unfinished ...>
[pid 25502] 10:12:36.634802 <... ioctl resumed> , 0x7ffced974f70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.634834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.634863 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25503] 10:12:36.634938 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25502] 10:12:36.635008 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.635039 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.635061 read(6,  <unfinished ...>
[pid 25503] 10:12:36.635084 read(6,  <unfinished ...>
[pid 25502] 10:12:36.635108 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.635137 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.635166 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25503] 10:12:36.635235 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25502] 10:12:36.635293 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25518] 10:12:36.635333 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.635369 read(6,  <unfinished ...>
[pid 25503] 10:12:36.635399 read(6,  <unfinished ...>
[pid 25502] 10:12:36.635423 <... open resumed> ) = 11
[pid 25518] 10:12:36.635448 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25507] 10:12:36.635463 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25503] 10:12:36.635609 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25502] 10:12:36.635678 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.635712 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.635735 read(6,  <unfinished ...>
[pid 25503] 10:12:36.635762 read(6,  <unfinished ...>
[pid 25502] 10:12:36.635786 <... ioctl resumed> , 0x7ffced975040) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.635812 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.635826 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25503] 10:12:36.635894 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25502] 10:12:36.635971 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.636006 read(10,  <unfinished ...>
[pid 25507] 10:12:36.636033 read(6,  <unfinished ...>
[pid 25503] 10:12:36.636056 read(6,  <unfinished ...>
[pid 25502] 10:12:36.636080 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.636105 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25507] 10:12:36.636124 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25503] 10:12:36.636239 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25502] 10:12:36.636372 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25518] 10:12:36.636411 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25507] 10:12:36.636442 read(6,  <unfinished ...>
[pid 25503] 10:12:36.636465 read(6,  <unfinished ...>
[pid 25502] 10:12:36.636489 <... fcntl resumed> ) = 0
[pid 25518] 10:12:36.636605 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.636635 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25503] 10:12:36.636757 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25502] 10:12:36.636817 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25518] 10:12:36.636852 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.636881 read(6,  <unfinished ...>
[pid 25503] 10:12:36.636906 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.636937 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25518] 10:12:36.637208 <... open resumed> ) = 13
[pid 25507] 10:12:36.637229 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25503] 10:12:36.637323 <... open resumed> ) = 8
[pid 25502] 10:12:36.637352 brk(0x10e8000 <unfinished ...>
[pid 25518] 10:12:36.637385 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.637408 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.637437 fstat(8,  <unfinished ...>
[pid 25502] 10:12:36.637469 <... brk resumed> ) = 0x10e8000
[pid 25518] 10:12:36.637595 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.637633 <... open resumed> ) = 8
[pid 25503] 10:12:36.637655 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.637684 read(11,  <unfinished ...>
[pid 25518] 10:12:36.637714 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.637735 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.637768 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.637801 <... read resumed> "", 8192) = 0
[pid 25518] 10:12:36.637831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25507] 10:12:36.637858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25503] 10:12:36.637886 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.637903 close(11 <unfinished ...>
[pid 25518] 10:12:36.637932 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.637972 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.638003 read(8,  <unfinished ...>
[pid 25502] 10:12:36.638031 <... close resumed> ) = 0
[pid 25518] 10:12:36.638426 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25507] 10:12:36.638453 <... mmap resumed> ) = 0x7f43504d5000
[pid 25503] 10:12:36.638473 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.638509 stat("/etc/exim.pl",  <unfinished ...>
[pid 25518] 10:12:36.638546 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.638570 read(8,  <unfinished ...>
[pid 25503] 10:12:36.638598 close(8 <unfinished ...>
[pid 25502] 10:12:36.638622 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25518] 10:12:36.638661 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.638675 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25503] 10:12:36.638737 <... close resumed> ) = 0
[pid 25502] 10:12:36.638768 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25518] 10:12:36.638826 read(13,  <unfinished ...>
[pid 25507] 10:12:36.638869 close(8 <unfinished ...>
[pid 25503] 10:12:36.638911 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.638941 <... open resumed> ) = 11
[pid 25518] 10:12:36.638967 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25507] 10:12:36.638992 <... close resumed> ) = 0
[pid 25503] 10:12:36.639044 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.639130 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.639166 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25507] 10:12:36.639193 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.639220 read(6,  <unfinished ...>
[pid 25502] 10:12:36.639244 <... ioctl resumed> , 0x7ffced974e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.639269 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25507] 10:12:36.639286 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.639370 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25502] 10:12:36.639452 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.639578 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25507] 10:12:36.639614 read(6,  <unfinished ...>
[pid 25503] 10:12:36.639639 read(6,  <unfinished ...>
[pid 25502] 10:12:36.639663 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.639712 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25507] 10:12:36.639742 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25503] 10:12:36.639830 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25502] 10:12:36.639938 read(11,  <unfinished ...>
[pid 25518] 10:12:36.639977 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25507] 10:12:36.640004 read(6,  <unfinished ...>
[pid 25503] 10:12:36.640027 read(6,  <unfinished ...>
[pid 25502] 10:12:36.640050 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25518] 10:12:36.640978 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f7c14b5f790}, 8) = 0
[pid 25507] 10:12:36.641014 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25503] 10:12:36.641138 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25502] 10:12:36.641257 brk(0x1109000 <unfinished ...>
[pid 25518] 10:12:36.641295 close(11 <unfinished ...>
[pid 25507] 10:12:36.641319 read(6,  <unfinished ...>
[pid 25503] 10:12:36.641344 read(6,  <unfinished ...>
[pid 25502] 10:12:36.641367 <... brk resumed> ) = 0x1109000
[pid 25518] 10:12:36.641850 <... close resumed> ) = 0
[pid 25507] 10:12:36.641878 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25503] 10:12:36.642013 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25502] 10:12:36.642130 read(11,  <unfinished ...>
[pid 25518] 10:12:36.642171 fcntl(12, F_GETFD <unfinished ...>
[pid 25514] 10:12:36.642194 <... connect resumed> ) = 0
[pid 25507] 10:12:36.642212 read(6,  <unfinished ...>
[pid 25503] 10:12:36.642236 read(6,  <unfinished ...>
[pid 25502] 10:12:36.642259 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25518] 10:12:36.643150 <... fcntl resumed> ) = 0
[pid 25514] 10:12:36.643181 alarm(0 <unfinished ...>
[pid 25507] 10:12:36.643211 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25503] 10:12:36.643322 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25502] 10:12:36.643372 brk(0x112a000 <unfinished ...>
[pid 25518] 10:12:36.643410 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25514] 10:12:36.643434 <... alarm resumed> ) = 300
[pid 25507] 10:12:36.643460 read(6,  <unfinished ...>
[pid 25503] 10:12:36.643484 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.643574 <... brk resumed> ) = 0x112a000
[pid 25518] 10:12:36.644039 <... fcntl resumed> ) = 0
[pid 25514] 10:12:36.644065 getsockname(11,  <unfinished ...>
[pid 25507] 10:12:36.644115 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25503] 10:12:36.644154 <... open resumed> ) = 8
[pid 25502] 10:12:36.644174 read(11,  <unfinished ...>
[pid 25518] 10:12:36.644209 geteuid( <unfinished ...>
[pid 25514] 10:12:36.644230 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(48600), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25507] 10:12:36.644263 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.644293 fstat(8,  <unfinished ...>
[pid 25502] 10:12:36.644316 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25518] 10:12:36.645053 <... geteuid resumed> ) = 0
[pid 25514] 10:12:36.645083 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25507] 10:12:36.645118 <... open resumed> ) = 8
[pid 25503] 10:12:36.645135 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.645166 brk(0x114b000 <unfinished ...>
[pid 25518] 10:12:36.645197 getegid( <unfinished ...>
[pid 25514] 10:12:36.645225 <... setsockopt resumed> ) = 0
[pid 25507] 10:12:36.645248 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.645271 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25518] 10:12:36.645309 <... getegid resumed> ) = 12
[pid 25514] 10:12:36.645333 stat("/etc/mailhelo",  <unfinished ...>
[pid 25507] 10:12:36.645422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25503] 10:12:36.645468 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.645564 <... brk resumed> ) = 0x114b000
[pid 25518] 10:12:36.645604 setgid(500 <unfinished ...>
[pid 25514] 10:12:36.646327 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.646396 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.646440 read(8,  <unfinished ...>
[pid 25518] 10:12:36.646553 <... setgid resumed> ) = 0
[pid 25514] 10:12:36.646581 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.646630 <... mmap resumed> ) = 0x7f43504d5000
[pid 25503] 10:12:36.646655 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.646699 read(11,  <unfinished ...>
[pid 25518] 10:12:36.646748 setuid(503 <unfinished ...>
[pid 25514] 10:12:36.646789 <... open resumed> ) = 13
[pid 25507] 10:12:36.646815 read(8,  <unfinished ...>
[pid 25503] 10:12:36.646854 close(8 <unfinished ...>
[pid 25518] 10:12:36.646900 <... setuid resumed> ) = 0
[pid 25514] 10:12:36.646920 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.646955 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25503] 10:12:36.646999 <... close resumed> ) = 0
[pid 25502] 10:12:36.647022 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25518] 10:12:36.647057 chdir("/" <unfinished ...>
[pid 25514] 10:12:36.647486 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.647625 close(8 <unfinished ...>
[pid 25503] 10:12:36.647663 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25518] 10:12:36.647717 <... chdir resumed> ) = 0
[pid 25514] 10:12:36.647738 fstat(13,  <unfinished ...>
[pid 25513] 10:12:36.647791 <... connect resumed> ) = 0
[pid 25507] 10:12:36.647816 <... close resumed> ) = 0
[pid 25503] 10:12:36.647839 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.647877 read(11,  <unfinished ...>
[pid 25518] 10:12:36.647923 geteuid( <unfinished ...>
[pid 25514] 10:12:36.647953 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25513] 10:12:36.647996 alarm(0 <unfinished ...>
[pid 25507] 10:12:36.648037 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.648075 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25518] 10:12:36.648130 <... geteuid resumed> ) = 503
[pid 25514] 10:12:36.648151 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25513] 10:12:36.648198 <... alarm resumed> ) = 300
[pid 25507] 10:12:36.648234 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.648274 <... open resumed> ) = 8
[pid 25502] 10:12:36.648303 <... read resumed> "", 8192) = 0
[pid 25518] 10:12:36.648345 getegid( <unfinished ...>
[pid 25514] 10:12:36.648391 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25513] 10:12:36.648419 getsockname(11,  <unfinished ...>
[pid 25507] 10:12:36.648455 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.648581 fstat(8,  <unfinished ...>
[pid 25518] 10:12:36.648638 <... getegid resumed> ) = 500
[pid 25514] 10:12:36.648660 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.648734 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(38773), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25507] 10:12:36.648786 <... open resumed> ) = 8
[pid 25503] 10:12:36.648818 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.648866 close(11 <unfinished ...>
[pid 25518] 10:12:36.648917 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25514] 10:12:36.648962 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.648989 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25507] 10:12:36.649031 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.649065 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25518] 10:12:36.649120 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25514] 10:12:36.649164 read(13,  <unfinished ...>
[pid 25513] 10:12:36.649210 <... setsockopt resumed> ) = 0
[pid 25507] 10:12:36.649245 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25503] 10:12:36.649292 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.649317 <... close resumed> ) = 0
[pid 25518] 10:12:36.649348 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25514] 10:12:36.649417 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.649469 stat("/etc/mailhelo",  <unfinished ...>
[pid 25507] 10:12:36.649615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.649657 read(8,  <unfinished ...>
[pid 25518] 10:12:36.649711 <... chdir resumed> ) = 0
[pid 25514] 10:12:36.649734 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.649774 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.649831 <... mmap resumed> ) = 0x7f43504d5000
[pid 25503] 10:12:36.649857 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.649903 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25518] 10:12:36.649968 stat("tmp",  <unfinished ...>
[pid 25514] 10:12:36.650007 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.650033 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.650074 read(8,  <unfinished ...>
[pid 25503] 10:12:36.650112 close(8 <unfinished ...>
[pid 25518] 10:12:36.650162 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25514] 10:12:36.650203 read(13,  <unfinished ...>
[pid 25513] 10:12:36.650241 <... open resumed> ) = 13
[pid 25507] 10:12:36.650266 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25503] 10:12:36.650311 <... close resumed> ) = 0
[pid 25502] 10:12:36.650338 <... stat resumed> 0x7f3c0a4ea880) = -1 ENOENT (No such file or directory)
[pid 25518] 10:12:36.650374 stat("new",  <unfinished ...>
[pid 25514] 10:12:36.650419 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.650608 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.650655 close(8 <unfinished ...>
[pid 25503] 10:12:36.650690 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25518] 10:12:36.650747 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25514] 10:12:36.650795 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.650834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.650898 <... close resumed> ) = 0
[pid 25503] 10:12:36.650927 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.650990 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25518] 10:12:36.651047 stat("cur",  <unfinished ...>
[pid 25514] 10:12:36.651085 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.651111 fstat(13,  <unfinished ...>
[pid 25507] 10:12:36.651145 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.651185 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25518] 10:12:36.651241 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25514] 10:12:36.651281 read(13,  <unfinished ...>
[pid 25513] 10:12:36.651405 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.651454 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.651617 <... open resumed> ) = 8
[pid 25502] 10:12:36.651658 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25518] 10:12:36.651701 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25514] 10:12:36.651744 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.651767 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.651802 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.651831 fstat(8,  <unfinished ...>
[pid 25518] 10:12:36.651870 <... open resumed> ) = 11
[pid 25514] 10:12:36.651884 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25513] 10:12:36.651912 <... mmap resumed> ) = 0x7f03f4be7000
[pid 25507] 10:12:36.651929 <... open resumed> ) = 8
[pid 25503] 10:12:36.651946 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.651975 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25518] 10:12:36.652010 read(11,  <unfinished ...>
[pid 25514] 10:12:36.652034 <... lseek resumed> ) = 0
[pid 25513] 10:12:36.652050 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.652073 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.652095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.652120 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25518] 10:12:36.652160 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4123
[pid 25514] 10:12:36.652179 read(13,  <unfinished ...>
[pid 25513] 10:12:36.652281 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.652299 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25503] 10:12:36.652328 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.652347 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25518] 10:12:36.652385 stat("tmp/1451491956.H652258P25518.fin.finestweddingsites.com",  <unfinished ...>
[pid 25514] 10:12:36.652417 <... read resumed> "", 4096) = 0
[pid 25513] 10:12:36.652454 read(13,  <unfinished ...>
[pid 25507] 10:12:36.652479 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.652505 read(8,  <unfinished ...>
[pid 25502] 10:12:36.652531 <... open resumed> ) = 11
[pid 25518] 10:12:36.652560 <... stat resumed> 0x7ffdac33e830) = -1 ENOENT (No such file or directory)
[pid 25514] 10:12:36.652576 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25513] 10:12:36.652610 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.652682 <... mmap resumed> ) = 0x7f43504d5000
[pid 25503] 10:12:36.652707 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.652738 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.652782 open("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25513] 10:12:36.652842 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.652875 read(8,  <unfinished ...>
[pid 25503] 10:12:36.652905 close(8 <unfinished ...>
[pid 25502] 10:12:36.652929 <... ioctl resumed> , 0x7ffced974e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.652956 <... open resumed> ) = 14
[pid 25513] 10:12:36.652970 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.652995 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25503] 10:12:36.653032 <... close resumed> ) = 0
[pid 25502] 10:12:36.653049 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.653080 chown("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25513] 10:12:36.653111 read(13,  <unfinished ...>
[pid 25507] 10:12:36.653134 close(8 <unfinished ...>
[pid 25503] 10:12:36.653157 munmap(0x7ff4da3e7000, 4096 <unfinished ...>
[pid 25502] 10:12:36.653186 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.653233 <... chown resumed> ) = 0
[pid 25513] 10:12:36.653251 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.653276 <... close resumed> ) = 0
[pid 25503] 10:12:36.653293 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.653384 read(11,  <unfinished ...>
[pid 25518] 10:12:36.653423 chmod("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25513] 10:12:36.653453 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.653480 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25503] 10:12:36.653509 read(6,  <unfinished ...>
[pid 25502] 10:12:36.653534 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25518] 10:12:36.653981 <... chmod resumed> ) = 0
[pid 25513] 10:12:36.654007 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.654029 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.654121 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25502] 10:12:36.654246 brk(0x116c000 <unfinished ...>
[pid 25518] 10:12:36.654284 chown("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25513] 10:12:36.654325 read(13,  <unfinished ...>
[pid 25507] 10:12:36.654349 read(6,  <unfinished ...>
[pid 25503] 10:12:36.654373 read(6,  <unfinished ...>
[pid 25502] 10:12:36.654396 <... brk resumed> ) = 0x116c000
[pid 25518] 10:12:36.654612 <... chown resumed> ) = 0
[pid 25513] 10:12:36.654635 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.654674 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25503] 10:12:36.654859 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25502] 10:12:36.654964 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.654997 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25518] 10:12:36.655035 chmod("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25513] 10:12:36.655066 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25507] 10:12:36.655095 read(6,  <unfinished ...>
[pid 25503] 10:12:36.655118 read(6,  <unfinished ...>
[pid 25502] 10:12:36.655141 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.655160 recvfrom(16,  <unfinished ...>
[pid 25518] 10:12:36.655194 <... chmod resumed> ) = 0
[pid 25507] 10:12:36.655208 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25503] 10:12:36.655335 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.655363 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.655393 <... recvfrom resumed> "oW\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1\300\f\0\1\0\1\0\0T_\0\4\320A\220\3\300\f\0\1\0\1\0\0T_\0\4\320A\221\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 85
[pid 25518] 10:12:36.655432 stat("/etc/localtime",  <unfinished ...>
[pid 25507] 10:12:36.655458 read(6,  <unfinished ...>
[pid 25503] 10:12:36.655481 read(6,  <unfinished ...>
[pid 25502] 10:12:36.655503 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.655525 close(16 <unfinished ...>
[pid 25518] 10:12:36.655562 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.655590 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.655644 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.655667 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.655699 <... close resumed> ) = 0
[pid 25518] 10:12:36.655900 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.655934 read(6,  <unfinished ...>
[pid 25503] 10:12:36.655958 close(6 <unfinished ...>
[pid 25502] 10:12:36.655982 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.656000 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25518] 10:12:36.656035 <... lseek resumed> ) = 19
[pid 25507] 10:12:36.656049 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.656070 <... close resumed> ) = 0
[pid 25502] 10:12:36.656087 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.656114 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25518] 10:12:36.656168 read(6,  <unfinished ...>
[pid 25507] 10:12:36.656198 close(6 <unfinished ...>
[pid 25503] 10:12:36.656224 munmap(0x7ff4da3e8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.656252 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.656274 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25518] 10:12:36.656316 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25507] 10:12:36.656334 <... close resumed> ) = 0
[pid 25503] 10:12:36.656359 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.656381 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.656419 <... open resumed> ) = 16
[pid 25518] 10:12:36.656445 read(6,  <unfinished ...>
[pid 25507] 10:12:36.656467 munmap(0x7f43504d6000, 4096 <unfinished ...>
[pid 25503] 10:12:36.656493 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.656522 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.656539 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25518] 10:12:36.656572 <... read resumed> "", 8192) = 0
[pid 25507] 10:12:36.656589 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.656634 <... open resumed> ) = 6
[pid 25502] 10:12:36.656655 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.656686 <... ioctl resumed> , 0x7ffc86159f70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25518] 10:12:36.656719 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:36 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2571 <unfinished ...>
[pid 25507] 10:12:36.656757 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f434f38c790},  <unfinished ...>
[pid 25503] 10:12:36.656885 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.656911 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.656933 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25518] 10:12:36.656964 <... write resumed> ) = 2571
[pid 25507] 10:12:36.656977 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25503] 10:12:36.657008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.657040 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.657071 <... lseek resumed> ) = 0
[pid 25518] 10:12:36.657096 fsync(14 <unfinished ...>
[pid 25507] 10:12:36.657153 open("/var/spool/exim/input/a/1aEJMa-0006dD-AR-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25503] 10:12:36.657206 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.657331 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.657350 fstat(16,  <unfinished ...>
[pid 25507] 10:12:36.657382 <... open resumed> ) = 6
[pid 25503] 10:12:36.657398 <... mmap resumed> ) = 0x7ff4da3e8000
[pid 25502] 10:12:36.657415 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.657445 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25518] 10:12:36.657497 <... fsync resumed> ) = 0
[pid 25507] 10:12:36.657514 fcntl(6, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.657542 read(6,  <unfinished ...>
[pid 25502] 10:12:36.657569 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.657589 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25518] 10:12:36.657621 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25507] 10:12:36.657643 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.657658 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.657690 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.657723 <... fcntl resumed> ) = 0
[pid 25518] 10:12:36.657758 <... lseek resumed> ) = 4123
[pid 25507] 10:12:36.657849 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.657881 close(6 <unfinished ...>
[pid 25502] 10:12:36.657905 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.657923 read(16,  <unfinished ...>
[pid 25518] 10:12:36.657955 write(11, "2571 1\n", 7 <unfinished ...>
[pid 25507] 10:12:36.657984 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.658000 <... close resumed> ) = 0
[pid 25502] 10:12:36.658016 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.658046 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25518] 10:12:36.658280 <... write resumed> ) = 7
[pid 25507] 10:12:36.658303 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25503] 10:12:36.658339 munmap(0x7ff4da3e8000, 4096 <unfinished ...>
[pid 25502] 10:12:36.658368 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.658391 close(16 <unfinished ...>
[pid 25518] 10:12:36.658425 close(11 <unfinished ...>
[pid 25507] 10:12:36.658449 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.658468 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.658509 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25491] 10:12:36.658545 <... close resumed> ) = 0
[pid 25518] 10:12:36.658604 <... close resumed> ) = 0
[pid 25507] 10:12:36.658624 fstat(6,  <unfinished ...>
[pid 25503] 10:12:36.658652 fstat(1,  <unfinished ...>
[pid 25502] 10:12:36.658675 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:36.658692 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25518] 10:12:36.658740 fstat(14,  <unfinished ...>
[pid 25507] 10:12:36.658848 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080152, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3200, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.658893 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25502] 10:12:36.658937 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25491] 10:12:36.658973 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25518] 10:12:36.659018 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179980, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2571, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25507] 10:12:36.659044 open("/var/spool/exim/input/a/1aEJMa-0006dD-AR-H", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.659080 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.659108 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:36.659138 stat("/usr/local/cpanel/3rdparty/mailman/lists/aepperson_ncghotels.com/config.pck",  <unfinished ...>
[pid 25518] 10:12:36.659179 close(14 <unfinished ...>
[pid 25507] 10:12:36.659204 <... open resumed> ) = 8
[pid 25503] 10:12:36.659221 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.659254 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.659289 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25518] 10:12:36.659326 <... close resumed> ) = 0
[pid 25507] 10:12:36.659342 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.659381 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25502] 10:12:36.659409 <... open resumed> ) = 12
[pid 25491] 10:12:36.659428 stat("/etc/demouids",  <unfinished ...>
[pid 25518] 10:12:36.659468 rename("tmp/1451491956.H652258P25518.fin.finestweddingsites.com", "new/1451491956.H652258P25518.fin.finestweddingsites.com,S=2571" <unfinished ...>
[pid 25507] 10:12:36.659542 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.659581 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.659607 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.659633 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25518] 10:12:36.659694 <... rename resumed> ) = 0
[pid 25507] 10:12:36.659712 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.659744 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0},  <unfinished ...>
[pid 25502] 10:12:36.659849 <... ioctl resumed> , 0x7ffced974880) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.659876 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25518] 10:12:36.659916 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.659949 <... mmap resumed> ) = 0x7f43504d6000
[pid 25503] 10:12:36.659966 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.659989 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.660014 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25518] 10:12:36.660122 <... write resumed> ) = 4
[pid 25507] 10:12:36.660141 read(8,  <unfinished ...>
[pid 25503] 10:12:36.660172 fstat(0,  <unfinished ...>
[pid 25502] 10:12:36.660195 <... lseek resumed> ) = 0
[pid 25491] 10:12:36.660236 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25473] 10:12:36.660267 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.660308 write(12, "\v\n\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.660340 <... read resumed> "1aEJMa-0006dD-AR-H\nmailnull 47 12\n<>\n1451491956 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25503] 10:12:36.660398 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130168205, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.660441 read(12,  <unfinished ...>
[pid 25491] 10:12:36.660468 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25473] 10:12:36.660601 read(11,  <unfinished ...>
[pid 25518] 10:12:36.660647 <... write resumed> ) = 4
[pid 25507] 10:12:36.660662 read(8,  <unfinished ...>
[pid 25503] 10:12:36.660687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.660714 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25491] 10:12:36.661122 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.661174 <... read resumed> "\v\n\0\0", 4) = 4
[pid 25518] 10:12:36.661206 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.661232 <... read resumed> "", 4096) = 0
[pid 25503] 10:12:36.661249 <... mmap resumed> ) = 0x7ff4da3e8000
[pid 25502] 10:12:36.661266 read(12,  <unfinished ...>
[pid 25491] 10:12:36.661293 <... stat resumed> 0x7f3314b98880) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.661321 read(11,  <unfinished ...>
[pid 25518] 10:12:36.661364 <... write resumed> ) = 4
[pid 25507] 10:12:36.661381 close(8 <unfinished ...>
[pid 25503] 10:12:36.661406 read(0,  <unfinished ...>
[pid 25502] 10:12:36.661433 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25491] 10:12:36.662064 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25473] 10:12:36.662110 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25518] 10:12:36.662143 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.662226 <... close resumed> ) = 0
[pid 25503] 10:12:36.662246 <... read resumed> "To:  ltoms@rmrcc.com, redmountainranch@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"text/c"..., 4096) = 2083
[pid 25502] 10:12:36.662329 brk(0x118d000 <unfinished ...>
[pid 25491] 10:12:36.662361 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:36.662407 read(11,  <unfinished ...>
[pid 25518] 10:12:36.662445 <... write resumed> ) = 4
[pid 25507] 10:12:36.662462 munmap(0x7f43504d6000, 4096 <unfinished ...>
[pid 25503] 10:12:36.662490 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.662517 <... brk resumed> ) = 0x118d000
[pid 25491] 10:12:36.662702 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:36.662747 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.662829 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.662862 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.662883 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.662933 read(12,  <unfinished ...>
[pid 25491] 10:12:36.662961 <... open resumed> ) = 16
[pid 25473] 10:12:36.662979 read(11,  <unfinished ...>
[pid 25518] 10:12:36.663013 <... write resumed> ) = 4
[pid 25507] 10:12:36.663030 open("/var/spool/exim/input/a/1aEJMa-0006dD-AR-J", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.663068 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25502] 10:12:36.663127 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25491] 10:12:36.663580 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:36.663626 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.663662 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.663689 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.663713 <... open resumed> ) = 6
[pid 25502] 10:12:36.663735 read(12,  <unfinished ...>
[pid 25491] 10:12:36.663765 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:36.663855 read(11,  <unfinished ...>
[pid 25518] 10:12:36.663894 <... write resumed> ) = 4
[pid 25507] 10:12:36.663912 open("/var/spool/exim/msglog/a/1aEJMa-0006dD-AR", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25503] 10:12:36.663950 fchown(6, 47, 12 <unfinished ...>
[pid 25502] 10:12:36.663978 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:36.663997 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.664022 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.664049 write(12, "\260\263\357\0\0\0\0\0", 8 <unfinished ...>
[pid 25507] 10:12:36.664074 <... open resumed> ) = 8
[pid 25503] 10:12:36.664090 <... fchown resumed> ) = 0
[pid 25502] 10:12:36.664110 close(12 <unfinished ...>
[pid 25491] 10:12:36.664135 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.664152 read(11,  <unfinished ...>
[pid 25518] 10:12:36.664184 <... write resumed> ) = 8
[pid 25507] 10:12:36.664200 fcntl(8, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.664222 fchmod(6, 0640 <unfinished ...>
[pid 25502] 10:12:36.664248 <... close resumed> ) = 0
[pid 25491] 10:12:36.665019 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.665062 <... read resumed> "\260\263\357\0\0\0\0\0", 8) = 8
[pid 25518] 10:12:36.665093 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.665120 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.665136 <... fchmod resumed> ) = 0
[pid 25502] 10:12:36.665155 read(11,  <unfinished ...>
[pid 25491] 10:12:36.665182 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25473] 10:12:36.665214 read(11,  <unfinished ...>
[pid 25518] 10:12:36.665246 <... write resumed> ) = 4
[pid 25507] 10:12:36.665262 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.665286 fcntl(6, F_GETFL <unfinished ...>
[pid 25502] 10:12:36.665307 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25491] 10:12:36.665330 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.666130 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.666166 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25507] 10:12:36.666194 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.666215 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25502] 10:12:36.666235 read(11,  <unfinished ...>
[pid 25491] 10:12:36.666262 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.666280 read(11,  <unfinished ...>
[pid 25518] 10:12:36.666313 <... write resumed> ) = 4
[pid 25507] 10:12:36.666329 fchown(8, 47, 12 <unfinished ...>
[pid 25503] 10:12:36.666365 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.666396 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25491] 10:12:36.666415 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.667179 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25518] 10:12:36.667214 close(12 <unfinished ...>
[pid 25507] 10:12:36.667241 <... fchown resumed> ) = 0
[pid 25503] 10:12:36.667259 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.667291 read(11,  <unfinished ...>
[pid 25491] 10:12:36.667316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25473] 10:12:36.667369 close(11 <unfinished ...>
[pid 25518] 10:12:36.667416 <... close resumed> ) = 0
[pid 25507] 10:12:36.667435 fchmod(8, 0640 <unfinished ...>
[pid 25503] 10:12:36.667462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.667490 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25491] 10:12:36.667508 read(16,  <unfinished ...>
[pid 25473] 10:12:36.668127 <... close resumed> ) = 0
[pid 25518] 10:12:36.668168 close(10 <unfinished ...>
[pid 25507] 10:12:36.668198 <... fchmod resumed> ) = 0
[pid 25503] 10:12:36.668219 <... mmap resumed> ) = 0x7ff4da3e7000
[pid 25502] 10:12:36.668238 brk(0x11ae000 <unfinished ...>
[pid 25491] 10:12:36.668261 <... read resumed> "0", 8192) = 1
[pid 25473] 10:12:36.668282 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25518] 10:12:36.668327 <... close resumed> ) = 0
[pid 25507] 10:12:36.668344 fcntl(8, F_GETFL <unfinished ...>
[pid 25503] 10:12:36.668380 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.668404 <... brk resumed> ) = 0x11ae000
[pid 25491] 10:12:36.668418 read(16,  <unfinished ...>
[pid 25473] 10:12:36.668514 <... write resumed> ) = 28
[pid 25518] 10:12:36.668542 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.668572 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25503] 10:12:36.668590 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.668607 read(11,  <unfinished ...>
[pid 25491] 10:12:36.668632 <... read resumed> "", 8192) = 0
[pid 25473] 10:12:36.668653 fsync(9 <unfinished ...>
[pid 25518] 10:12:36.668710 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.668740 fstat(8,  <unfinished ...>
[pid 25503] 10:12:36.668896 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25502] 10:12:36.668914 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25491] 10:12:36.668922 close(16 <unfinished ...>
[pid 25518] 10:12:36.669562 close(13 <unfinished ...>
[pid 25507] 10:12:36.669594 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080156, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.669627 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.669706 read(11,  <unfinished ...>
[pid 25491] 10:12:36.669734 <... close resumed> ) = 0
[pid 25473] 10:12:36.669869 <... fsync resumed> ) = 0
[pid 25518] 10:12:36.669906 <... close resumed> ) = 0
[pid 25507] 10:12:36.669923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.669951 read(0,  <unfinished ...>
[pid 25502] 10:12:36.669974 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25491] 10:12:36.669993 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.670512 wait4(-1,  <unfinished ...>
[pid 25518] 10:12:36.670547 munmap(0x7f7c15ca7000, 4096 <unfinished ...>
[pid 25507] 10:12:36.670577 <... mmap resumed> ) = 0x7f43504d6000
[pid 25503] 10:12:36.670594 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.670619 brk(0x11cf000 <unfinished ...>
[pid 25491] 10:12:36.670644 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25518] 10:12:36.670701 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.671154 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.671187 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff4d929e790},  <unfinished ...>
[pid 25502] 10:12:36.671217 <... brk resumed> ) = 0x11cf000
[pid 25491] 10:12:36.671231 stat("/etc/localtime",  <unfinished ...>
[pid 25518] 10:12:36.671722 exit_group(0) = ?
[pid 25507] 10:12:36.672080 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.672117 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25502] 10:12:36.672137 read(11,  <unfinished ...>
[pid 25491] 10:12:36.672165 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25518] 10:12:36.672231 +++ exited with 0 +++
[pid 25507] 10:12:36.672246 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25503] 10:12:36.672274 write(6, "1aEJMa-0006dL-LG-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877 <unfinished ...>
[pid 25502] 10:12:36.672313 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25491] 10:12:36.672331 stat("/etc/localtime",  <unfinished ...>
[pid 25473] 10:12:36.672929 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25518
[pid 25507] 10:12:36.672995 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25503] 10:12:36.673036 <... write resumed> ) = 1877
[pid 25502] 10:12:36.673057 read(11,  <unfinished ...>
[pid 25491] 10:12:36.673084 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:36.673117 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.673156 pipe( <unfinished ...>
[pid 25503] 10:12:36.673182 fsync(6 <unfinished ...>
[pid 25502] 10:12:36.673244 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25491] 10:12:36.673264 close(7 <unfinished ...>
[pid 25473] 10:12:36.673642 <... open resumed> ) = 10
[pid 25507] 10:12:36.673673 <... pipe resumed> [9, 10]) = 0
[pid 25503] 10:12:36.673694 <... fsync resumed> ) = 0
[pid 25502] 10:12:36.673730 brk(0x11f0000 <unfinished ...>
[pid 25491] 10:12:36.673757 <... close resumed> ) = 0
[pid 25473] 10:12:36.673842 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.673881 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0},  <unfinished ...>
[pid 25503] 10:12:36.673910 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.673936 <... brk resumed> ) = 0x11f0000
[pid 25491] 10:12:36.673950 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25473] 10:12:36.674274 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.674323 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f434f38c790}, 8) = 0
[pid 25503] 10:12:36.674351 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.674421 read(11,  <unfinished ...>
[pid 25491] 10:12:36.674447 <... open resumed> ) = 7
[pid 25473] 10:12:36.674464 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.674495 clone( <unfinished ...>
[pid 25503] 10:12:36.674698 fstat(6,  <unfinished ...>
[pid 25491] 10:12:36.674723 fcntl(7, F_GETFD <unfinished ...>
[pid 25473] 10:12:36.674746 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25503] 10:12:36.674862 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.674986 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25491] 10:12:36.675010 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.675388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.675436 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f43504bfa90) = 25519
[pid 25503] 10:12:36.675481 brk(0x1cdf000 <unfinished ...>
[pid 25491] 10:12:36.675509 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.675533 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25507] 10:12:36.675556 close(10 <unfinished ...>
[pid 25503] 10:12:36.675579 <... brk resumed> ) = 0x1cdf000
[pid 25491] 10:12:36.675620 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.675639 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.675669 <... close resumed> ) = 0
[pid 25503] 10:12:36.675687 getuid( <unfinished ...>
[pid 25491] 10:12:36.675709 fstat(7,  <unfinished ...>
[pid 25473] 10:12:36.675732 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.675755 read(9,  <unfinished ...>
[pid 25503] 10:12:36.675847 <... getuid resumed> ) = 47
[pid 25491] 10:12:36.675873 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5378977, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.675907 read(10,  <unfinished ...>
[pid 25503] 10:12:36.675941 geteuid( <unfinished ...>
[pid 25491] 10:12:36.675963 write(7, "2015-12-30 10:12:36 [25491] 1aEJMZ-0006cs-RM SMTP connection outbound 1451491956 1aEJMZ-0006cs-RM finestweddingsites.com aepperson@ncghotels.com\n", 145 <unfinished ...>
[pid 25473] 10:12:36.675994 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25503] 10:12:36.676047 <... geteuid resumed> ) = 47
[pid 25491] 10:12:36.676071 <... write resumed> ) = 145
[pid 25473] 10:12:36.676124 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25503] 10:12:36.676165 getgid( <unfinished ...>
[pid 25491] 10:12:36.676188 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25473] 10:12:36.676228 <... stat resumed> 0x7ffdac33d580) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.676262 <... getgid resumed> ) = 12
[pid 25491] 10:12:36.676284 <... open resumed> ) = 16
[pid 25473] 10:12:36.676303 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.676335 getegid( <unfinished ...>
[pid 25491] 10:12:36.676357 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25473] 10:12:36.676379 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.676427 <... getegid resumed> ) = 12
[pid 25491] 10:12:36.676516 <... lseek resumed> ) = 14
[pid 25473] 10:12:36.676540 write(8, "2015-12-30 10:12:36 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25503] 10:12:36.676578 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.676610 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25473] 10:12:36.676636 <... write resumed> ) = 126
[pid 25503] 10:12:36.676864 <... open resumed> ) = 8
[pid 25491] 10:12:36.676892 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25473] 10:12:36.676913 write(8, "2015-12-30 10:12:36 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25503] 10:12:36.676948 read(8,  <unfinished ...>
[pid 25491] 10:12:36.676972 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25473] 10:12:36.676995 <... write resumed> ) = 77
[pid 25503] 10:12:36.677028 <... read resumed> "F7\177/", 4) = 4
[pid 25491] 10:12:36.677051 <... lseek resumed> ) = 14
[pid 25473] 10:12:36.677070 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.677103 close(8 <unfinished ...>
[pid 25491] 10:12:36.677126 fstat(16,  <unfinished ...>
[pid 25473] 10:12:36.677149 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.677194 <... close resumed> ) = 0
[pid 25491] 10:12:36.677296 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=14, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25473] 10:12:36.677535 stat("/etc/localtime",  <unfinished ...>
[pid 25503] 10:12:36.677580 readlink("/proc/self/exe",  <unfinished ...>
[pid 25502] 10:12:36.677626 read(11,  <unfinished ...>
[pid 25491] 10:12:36.677647 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.677671 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.677711 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25491] 10:12:36.677850 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.677884 close(7 <unfinished ...>
[pid 25503] 10:12:36.677916 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.677941 write(16, "1", 1 <unfinished ...>
[pid 25473] 10:12:36.677971 <... close resumed> ) = 0
[pid 25503] 10:12:36.677995 <... ioctl resumed> , 0x7ffdc4d27b10) = -1 EINVAL (Invalid argument)
[pid 25491] 10:12:36.678018 <... write resumed> ) = 1
[pid 25473] 10:12:36.678042 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25503] 10:12:36.678082 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.678105 close(16 <unfinished ...>
[pid 25473] 10:12:36.678129 <... open resumed> ) = 7
[pid 25503] 10:12:36.678149 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25491] 10:12:36.678170 <... close resumed> ) = 0
[pid 25473] 10:12:36.678214 fcntl(7, F_GETFD <unfinished ...>
[pid 25503] 10:12:36.678247 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.678270 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.678300 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.678344 <... ioctl resumed> , 0x7ffdc4d27b10) = -1 EINVAL (Invalid argument)
[pid 25491] 10:12:36.678370 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.678395 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25503] 10:12:36.678426 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.678449 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25491] 10:12:36.678467 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:36.678721 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.678748 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25502] 10:12:36.678770 brk(0x1211000 <unfinished ...>
[pid 25491] 10:12:36.678877 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:36.678932 fstat(7,  <unfinished ...>
[pid 25503] 10:12:36.678966 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.678990 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25473] 10:12:36.679022 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5379122, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.679059 <... ioctl resumed> , 0x7ffdc4d27b20) = -1 EINVAL (Invalid argument)
[pid 25491] 10:12:36.679077 <... socket resumed> ) = 16
[pid 25473] 10:12:36.679094 write(7, "2015-12-30 10:12:36 [25473] 1aEJMZ-0006ce-8t => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2571 QT=1s "..., 262 <unfinished ...>
[pid 25503] 10:12:36.679129 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.679152 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25473] 10:12:36.679184 <... write resumed> ) = 262
[pid 25503] 10:12:36.679246 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25491] 10:12:36.679272 <... connect resumed> ) = 0
[pid 25473] 10:12:36.679291 pipe( <unfinished ...>
[pid 25503] 10:12:36.679322 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25491] 10:12:36.679354 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25473] 10:12:36.679382 <... pipe resumed> [11, 12]) = 0
[pid 25503] 10:12:36.679410 <... open resumed> ) = 8
[pid 25502] 10:12:36.679429 <... brk resumed> ) = 0x1211000
[pid 25491] 10:12:36.679443 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25473] 10:12:36.679849 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25503] 10:12:36.679893 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:36.679918 sendto(16, "kJ\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\0\0\17\0\1", 31, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25473] 10:12:36.679978 <... fcntl resumed> ) = 0
[pid 25503] 10:12:36.680011 <... ioctl resumed> , 0x7ffdc4d27bf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:36.680031 <... sendto resumed> ) = 31
[pid 25473] 10:12:36.680048 close(10 <unfinished ...>
[pid 25503] 10:12:36.680077 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:36.680100 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25473] 10:12:36.680127 <... close resumed> ) = 0
[pid 25503] 10:12:36.680146 <... lseek resumed> ) = 0
[pid 25473] 10:12:36.680165 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25503] 10:12:36.680200 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:36.680223 <... munmap resumed> ) = 0
[pid 25503] 10:12:36.680247 <... fcntl resumed> ) = 0
[pid 25473] 10:12:36.680268 clone( <unfinished ...>
[pid 25503] 10:12:36.680573 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff4d929e790}, 8) = 0
[pid 25473] 10:12:36.680620 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25520
[pid 25503] 10:12:36.680663 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790},  <unfinished ...>
[pid 25473] 10:12:36.680692 close(12 <unfinished ...>
[pid 25503] 10:12:36.680718 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7ff4d929e790}, 8) = 0
[pid 25473] 10:12:36.681046 <... close resumed> ) = 0
[pid 25503] 10:12:36.681100 read(8,  <unfinished ...>
[pid 25473] 10:12:36.681127 wait4(-1,  <unfinished ...>
[pid 25503] 10:12:36.681153 <... read resumed> "", 8192) = 0
[pid 25473] 10:12:36.681176 <... wait4 resumed> 0x7ffdac33eb30, WNOHANG, NULL) = 0
[pid 25503] 10:12:36.681209 close(8 <unfinished ...>
[pid 25473] 10:12:36.681235 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25503] 10:12:36.681267 <... close resumed> ) = 0
[pid 25503] 10:12:36.681461 brk(0x1d00000) = 0x1d00000
[pid 25503] 10:12:36.681606 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25503] 10:12:36.681669 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25503] 10:12:36.681710 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc4d27a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.681747 lseek(8, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.681856 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25503] 10:12:36.682932 brk(0x1d21000) = 0x1d21000
[pid 25503] 10:12:36.683174 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25503] 10:12:36.684147 brk(0x1d42000) = 0x1d42000
[pid 25503] 10:12:36.684729 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25503] 10:12:36.685655 brk(0x1d63000) = 0x1d63000
[pid 25503] 10:12:36.686000 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25503] 10:12:36.686315 read(8, "", 8192) = 0
[pid 25503] 10:12:36.686407 close(8)    = 0
[pid 25503] 10:12:36.686473 stat("/usr/share/amavis/amavis-filter", 0x7ff4d8a85880) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.686609 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25502] 10:12:36.686641 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.686673 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25503] 10:12:36.686709 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25503] 10:12:36.686760 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25502] 10:12:36.686865 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.686894 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25502] 10:12:36.686917 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.686951 <... ioctl resumed> , 0x7ffdc4d27a20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.686966 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.686992 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.687014 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.687047 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.687060 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.687102 read(8,  <unfinished ...>
[pid 25502] 10:12:36.687126 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.687161 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25502] 10:12:36.687179 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.687614 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.687649 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.687686 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.687702 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.687726 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.687747 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.687855 <... stat resumed> 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.687873 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.687904 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.687928 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.687973 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.687988 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688010 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.688032 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.688071 <... stat resumed> 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688086 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688114 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.688138 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.688186 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688201 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688223 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.688245 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.688284 <... stat resumed> 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688298 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688325 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.688353 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.688410 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688425 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688460 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.688483 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.688523 <... stat resumed> 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688537 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688565 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.688588 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.688628 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688642 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.688665 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.688687 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25503] 10:12:36.688726 <... stat resumed> 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688740 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.688879 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25502] 10:12:36.688909 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25503] 10:12:36.688953 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.688968 <... open resumed> ) = 12
[pid 25503] 10:12:36.688993 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.689015 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25503] 10:12:36.689051 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25502] 10:12:36.689077 <... ioctl resumed> , 0x7ffced974880) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.689103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.689126 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.689162 <... open resumed> ) = 9
[pid 25502] 10:12:36.689181 <... lseek resumed> ) = 0
[pid 25503] 10:12:36.689227 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25502] 10:12:36.689253 read(12,  <unfinished ...>
[pid 25503] 10:12:36.689284 <... ioctl resumed> , 0x7ffdc4d27430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.689299 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25503] 10:12:36.689516 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.689548 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.689579 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.689593 <... lseek resumed> ) = 878
[pid 25503] 10:12:36.689628 brk(0x1d84000 <unfinished ...>
[pid 25502] 10:12:36.689651 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.689681 <... brk resumed> ) = 0x1d84000
[pid 25502] 10:12:36.689695 <... lseek resumed> ) = 878
[pid 25503] 10:12:36.689732 read(9,  <unfinished ...>
[pid 25502] 10:12:36.689754 close(12 <unfinished ...>
[pid 25503] 10:12:36.689862 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25502] 10:12:36.689885 <... close resumed> ) = 0
[pid 25503] 10:12:36.690423 read(9,  <unfinished ...>
[pid 25502] 10:12:36.690474 read(11,  <unfinished ...>
[pid 25503] 10:12:36.690510 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25503] 10:12:36.691302 read(9,  <unfinished ...>
[pid 25502] 10:12:36.691337 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25503] 10:12:36.691833 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25503] 10:12:36.691960 brk(0x1da5000) = 0x1da5000
[pid 25503] 10:12:36.692314 read(9, "", 8192) = 0
[pid 25503] 10:12:36.692372 close(9)    = 0
[pid 25503] 10:12:36.693135 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25503] 10:12:36.693932 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25502] 10:12:36.694456 brk(0x1232000) = 0x1232000
[pid 25502] 10:12:36.694612 read(11, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25502] 10:12:36.695658 brk(0x1253000 <unfinished ...>
[pid 25503] 10:12:36.696171 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25502] 10:12:36.696836 <... brk resumed> ) = 0x1253000
[pid 25502] 10:12:36.696995 read(11,  <unfinished ...>
[pid 25503] 10:12:36.697074 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25503] 10:12:36.697285 brk(0x1dc6000 <unfinished ...>
[pid 25502] 10:12:36.697324 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25503] 10:12:36.697837 <... brk resumed> ) = 0x1dc6000
[pid 25503] 10:12:36.698312 read(8, Process 25519 attached
 <unfinished ...>
[pid 25519] 10:12:36.698532 set_robust_list(0x7f43504bfaa0, 24) = 0
[pid 25519] 10:12:36.698917 close(9 <unfinished ...>
[pid 25503] 10:12:36.698955 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25503] 10:12:36.699735 brk(0x1de7000 <unfinished ...>
[pid 25519] 10:12:36.699832 <... close resumed> ) = 0
[pid 25519] 10:12:36.699870 geteuid()   = 0
[pid 25519] 10:12:36.699908 getegid()   = 12
[pid 25519] 10:12:36.699945 setgid(494) = 0
[pid 25519] 10:12:36.699981 setuid(495) = 0
[pid 25519] 10:12:36.700040 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25519] 10:12:36.700094 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25519] 10:12:36.700189 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25519] 10:12:36.700242 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25519] 10:12:36.700284 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25519] 10:12:36.700332 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25519] 10:12:36.700753 close(9)    = 0
[pid 25519] 10:12:36.700874 munmap(0x7f43504d5000, 4096) = 0
[pid 25519] 10:12:36.700964 brk(0x1fd5000Process 25520 attached
 <unfinished ...>
[pid 25520] 10:12:36.701029 set_robust_list(0x7f7c15c92aa0, 24) = 0
[pid 25520] 10:12:36.701091 fcntl(12, F_GETFD <unfinished ...>
[pid 25519] 10:12:36.701122 <... brk resumed> ) = 0x1fd5000
[pid 25519] 10:12:36.701241 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25520] 10:12:36.701277 <... fcntl resumed> ) = 0
[pid 25520] 10:12:36.701297 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25520] 10:12:36.701335 close(6)    = 0
[pid 25520] 10:12:36.701395 open("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-D", O_RDWR|O_APPEND) = 6
[pid 25520] 10:12:36.701464 fcntl(6, F_GETFD) = 0
[pid 25520] 10:12:36.701502 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25520] 10:12:36.701571 geteuid( <unfinished ...>
[pid 25519] 10:12:36.701612 <... write resumed> ) = 4
[pid 25507] 10:12:36.701626 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25507] 10:12:36.701649 read(9,  <unfinished ...>
[pid 25519] 10:12:36.701677 write(10, "\1\0\0\0", 4) = 4
[pid 25507] 10:12:36.701712 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25507] 10:12:36.701732 read(9,  <unfinished ...>
[pid 25520] 10:12:36.701759 <... geteuid resumed> ) = 0
[pid 25519] 10:12:36.701832 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25520] 10:12:36.701868 getegid()   = 12
[pid 25519] 10:12:36.701907 <... write resumed> ) = 4
[pid 25507] 10:12:36.701921 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25507] 10:12:36.701941 read(9,  <unfinished ...>
[pid 25520] 10:12:36.701971 setgid(12 <unfinished ...>
[pid 25519] 10:12:36.701998 write(10, "\377\377\377\377", 4) = 4
[pid 25507] 10:12:36.702031 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25507] 10:12:36.702051 read(9,  <unfinished ...>
[pid 25520] 10:12:36.702078 <... setgid resumed> ) = 0
[pid 25519] 10:12:36.702097 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25520] 10:12:36.702125 setuid(47 <unfinished ...>
[pid 25519] 10:12:36.702155 <... write resumed> ) = 4
[pid 25507] 10:12:36.702168 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25507] 10:12:36.702187 read(9,  <unfinished ...>
[pid 25520] 10:12:36.702215 <... setuid resumed> ) = 0
[pid 25519] 10:12:36.702234 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25520] 10:12:36.702263 close(11 <unfinished ...>
[pid 25519] 10:12:36.702296 <... write resumed> ) = 40
[pid 25507] 10:12:36.702310 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25507] 10:12:36.702331 read(9,  <unfinished ...>
[pid 25520] 10:12:36.702367 <... close resumed> ) = 0
[pid 25519] 10:12:36.702394 write(10, "\0\0\0\0", 4) = 4
[pid 25507] 10:12:36.702488 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25507] 10:12:36.702514 wait4(-1,  <unfinished ...>
[pid 25519] 10:12:36.702543 close(10)   = 0
[pid 25519] 10:12:36.702588 exit_group(0) = ?
[pid 25520] 10:12:36.702953 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25502] 10:12:36.703114 brk(0x1274000 <unfinished ...>
[pid 25520] 10:12:36.703152 <... socket resumed> ) = 10
[pid 25520] 10:12:36.703172 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.703226 close(10)   = 0
[pid 25519] 10:12:36.703307 +++ exited with 0 +++
[pid 25507] 10:12:36.703323 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25519
[pid 25507] 10:12:36.703345 close(9)    = 0
[pid 25507] 10:12:36.703383 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, 8) = 0
[pid 25507] 10:12:36.703442 brk(0x1fd4000) = 0x1fd4000
[pid 25507] 10:12:36.703488 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25507] 10:12:36.703537 alarm(60)   = 0
[pid 25507] 10:12:36.703572 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25507] 10:12:36.703609 alarm(0)    = 60
[pid 25507] 10:12:36.703687 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.703736 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25507] 10:12:36.703838 read(10, "cpu  123078 1342441 395210 67343098 2509 0 0 0\ncpu0 123078 1342441 395210 67343098 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58482827\nbtime 1450798266\nprocesses 892998\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25507] 10:12:36.703901 close(10)   = 0
[pid 25507] 10:12:36.703991 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.704060 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25507] 10:12:36.704104 fcntl(10, F_GETFD) = 0
[pid 25507] 10:12:36.704136 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25507] 10:12:36.704173 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25507] 10:12:36.704225 close(10)   = 0
[pid 25507] 10:12:36.704274 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.704317 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25507] 10:12:36.704418 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f435048e000
[pid 25507] 10:12:36.704591 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25507] 10:12:36.704637 fcntl(10, F_GETFD) = 0
[pid 25507] 10:12:36.704669 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25507] 10:12:36.704704 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.704850 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25507] 10:12:36.704941 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25507] 10:12:36.705008 close(10)   = 0
[pid 25507] 10:12:36.705068 munmap(0x7f435048e000, 200704) = 0
[pid 25507] 10:12:36.705136 close(9)    = 0
[pid 25507] 10:12:36.705193 open("/etc/localdomains", O_RDONLY) = 9
[pid 25507] 10:12:36.705239 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.705293 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.705338 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d5000
[pid 25507] 10:12:36.705376 lseek(9, 0, SEEK_SET) = 0
[pid 25507] 10:12:36.705409 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25507] 10:12:36.705481 stat("/jail_owner", 0x7ffd396b9b10) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.705532 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25507] 10:12:36.705605 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.705654 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25507] 10:12:36.705712 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.705755 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.705908 open("/etc/demouids", O_RDONLY) = 10
[pid 25507] 10:12:36.705951 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.705999 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.706044 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d4000
[pid 25507] 10:12:36.706081 lseek(10, 0, SEEK_SET) = 0
[pid 25507] 10:12:36.706115 read(10, "", 4096) = 0
[pid 25507] 10:12:36.706156 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25507] 10:12:36.706251 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.706311 open("/etc/userdomains", O_RDONLY) = 11
[pid 25507] 10:12:36.706354 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.706401 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.706446 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d3000
[pid 25507] 10:12:36.706483 lseek(11, 0, SEEK_SET) = 0
[pid 25507] 10:12:36.706518 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25507] 10:12:36.706587 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25507] 10:12:36.706635 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25507] 10:12:36.706681 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d2000
[pid 25507] 10:12:36.706718 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25507] 10:12:36.706765 close(12)   = 0
[pid 25507] 10:12:36.706885 munmap(0x7f43504d2000, 4096) = 0
[pid 25507] 10:12:36.706946 stat("//etc/fin.finestweddingsites.com", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.706997 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.707061 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.707123 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.707190 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.707250 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.707305 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.707370 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.707415 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.707472 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25507] 10:12:36.707514 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.707562 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.707607 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d2000
[pid 25507] 10:12:36.707651 lseek(12, 0, SEEK_SET) = 0
[pid 25507] 10:12:36.707685 read(12, "", 4096) = 0
[pid 25507] 10:12:36.707734 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25507] 10:12:36.707867 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25507] 10:12:36.707923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f43504d1000
[pid 25507] 10:12:36.707960 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25507] 10:12:36.708007 close(13)   = 0
[pid 25507] 10:12:36.708043 munmap(0x7f43504d1000, 4096) = 0
[pid 25507] 10:12:36.708096 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.708162 stat("//.spamassassinboxenable", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.708207 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.708261 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25507] 10:12:36.708321 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.708364 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.708422 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffd396bc900) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.708465 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.708521 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25507] 10:12:36.708649 getuid()    = 0
[pid 25507] 10:12:36.708689 geteuid()   = 0
[pid 25507] 10:12:36.708724 getgid()    = 12
[pid 25507] 10:12:36.708758 getegid()   = 12
[pid 25507] 10:12:36.708935 open("/dev/urandom", O_RDONLY) = 13
[pid 25507] 10:12:36.708988 read(13, "\34e\201\257", 4) = 4
[pid 25507] 10:12:36.709029 close(13)   = 0
[pid 25507] 10:12:36.709141 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25507] 10:12:36.709251 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9760) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.709298 lseek(0, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.709335 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9760) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.709373 lseek(1, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.709413 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9770) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.709449 lseek(2, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.709485 open("/dev/null", O_RDONLY) = 13
[pid 25507] 10:12:36.709530 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9840) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.709579 lseek(13, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.709614 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25507] 10:12:36.709650 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0}, 8) = 0
[pid 25507] 10:12:36.709986 brk(0x1ff6000) = 0x1ff6000
[pid 25507] 10:12:36.710044 read(13, "", 8192) = 0
[pid 25507] 10:12:36.710086 close(13)   = 0
[pid 25507] 10:12:36.710374 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25507] 10:12:36.710441 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25507] 10:12:36.710484 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9670) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.710523 lseek(13, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.710578 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25520] 10:12:36.711524 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25507] 10:12:36.711571 brk(0x2017000 <unfinished ...>
[pid 25502] 10:12:36.711597 <... brk resumed> ) = 0x1274000
[pid 25520] 10:12:36.711616 <... socket resumed> ) = 10
[pid 25507] 10:12:36.711886 <... brk resumed> ) = 0x2017000
[pid 25520] 10:12:36.711924 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25503] 10:12:36.712318 <... brk resumed> ) = 0x1de7000
[pid 25502] 10:12:36.712337 read(11,  <unfinished ...>
[pid 25520] 10:12:36.712549 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.712567 read(13,  <unfinished ...>
[pid 25503] 10:12:36.712595 read(8,  <unfinished ...>
[pid 25520] 10:12:36.712620 close(10 <unfinished ...>
[pid 25507] 10:12:36.712640 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25520] 10:12:36.713493 <... close resumed> ) = 0
[pid 25507] 10:12:36.713522 brk(0x2038000 <unfinished ...>
[pid 25520] 10:12:36.713610 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.713635 <... brk resumed> ) = 0x2038000
[pid 25520] 10:12:36.714093 <... open resumed> ) = 10
[pid 25507] 10:12:36.714118 read(13,  <unfinished ...>
[pid 25520] 10:12:36.714163 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.714184 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25520] 10:12:36.714919 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25507] 10:12:36.714975 brk(0x2059000 <unfinished ...>
[pid 25520] 10:12:36.715011 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.715047 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25502] 10:12:36.715067 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25520] 10:12:36.715614 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25507] 10:12:36.715854 <... brk resumed> ) = 0x2059000
[pid 25503] 10:12:36.715883 read(8,  <unfinished ...>
[pid 25520] 10:12:36.716355 read(10,  <unfinished ...>
[pid 25507] 10:12:36.716381 read(13,  <unfinished ...>
[pid 25520] 10:12:36.716419 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25507] 10:12:36.716439 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25520] 10:12:36.716822 close(10 <unfinished ...>
[pid 25507] 10:12:36.716856 read(13,  <unfinished ...>
[pid 25520] 10:12:36.717696 <... close resumed> ) = 0
[pid 25507] 10:12:36.717719 <... read resumed> "", 8192) = 0
[pid 25520] 10:12:36.717757 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25507] 10:12:36.717840 close(13 <unfinished ...>
[pid 25520] 10:12:36.717867 <... munmap resumed> ) = 0
[pid 25520] 10:12:36.717940 stat("/etc/mailips",  <unfinished ...>
[pid 25507] 10:12:36.717967 <... close resumed> ) = 0
[pid 25520] 10:12:36.718013 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.718045 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25520] 10:12:36.718108 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.718131 <... stat resumed> 0x7f434eb73880) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.718164 <... open resumed> ) = 10
[pid 25507] 10:12:36.718179 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25520] 10:12:36.718216 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.718236 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25520] 10:12:36.718274 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.718300 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25520] 10:12:36.718354 fstat(10,  <unfinished ...>
[pid 25507] 10:12:36.718375 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25520] 10:12:36.718411 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25507] 10:12:36.718443 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.718480 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.718503 <... open resumed> ) = 13
[pid 25520] 10:12:36.718529 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25507] 10:12:36.718544 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25520] 10:12:36.718577 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.718598 <... ioctl resumed> , 0x7ffd396b9670) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25520] 10:12:36.718622 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.718637 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25520] 10:12:36.718680 read(10,  <unfinished ...>
[pid 25507] 10:12:36.718701 <... lseek resumed> ) = 0
[pid 25520] 10:12:36.718751 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.718770 read(13,  <unfinished ...>
[pid 25520] 10:12:36.719045 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 11
[pid 25507] 10:12:36.719090 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25520] 10:12:36.719397 fstat(11,  <unfinished ...>
[pid 25507] 10:12:36.719428 brk(0x207a000 <unfinished ...>
[pid 25520] 10:12:36.719462 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25507] 10:12:36.719491 <... brk resumed> ) = 0x207a000
[pid 25520] 10:12:36.719674 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25507] 10:12:36.719722 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.719761 <... mmap resumed> ) = 0x7f7c15ca7000
[pid 25503] 10:12:36.719830 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25520] 10:12:36.719861 read(11,  <unfinished ...>
[pid 25507] 10:12:36.720392 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.720419 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25503] 10:12:36.720442 brk(0x1e08000 <unfinished ...>
[pid 25520] 10:12:36.720483 close(11 <unfinished ...>
[pid 25507] 10:12:36.720505 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25520] 10:12:36.720539 <... close resumed> ) = 0
[pid 25507] 10:12:36.720553 <... stat resumed> 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.720580 munmap(0x7f7c15ca7000, 4096 <unfinished ...>
[pid 25507] 10:12:36.720602 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.720650 <... munmap resumed> ) = 0
[pid 25507] 10:12:36.720669 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.720730 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.720763 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25520] 10:12:36.720878 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25507] 10:12:36.720894 <... stat resumed> 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721023 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.721057 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.721103 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.721116 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721141 read(10,  <unfinished ...>
[pid 25507] 10:12:36.721162 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25520] 10:12:36.721198 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.721212 <... stat resumed> 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721241 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.721262 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.721297 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.721311 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721334 read(10,  <unfinished ...>
[pid 25507] 10:12:36.721356 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25520] 10:12:36.721392 <... read resumed> "", 4096) = 0
[pid 25507] 10:12:36.721405 <... stat resumed> 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721455 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25507] 10:12:36.721482 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.721536 <... open resumed> ) = 11
[pid 25507] 10:12:36.721550 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721573 alarm(60 <unfinished ...>
[pid 25507] 10:12:36.721594 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25520] 10:12:36.721630 <... alarm resumed> ) = 0
[pid 25507] 10:12:36.721649 <... stat resumed> 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721683 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25507] 10:12:36.721708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25520] 10:12:36.721747 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.721765 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.721943 alarm(0 <unfinished ...>
[pid 25507] 10:12:36.721976 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25502] 10:12:36.722006 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.722031 <... alarm resumed> ) = 60
[pid 25507] 10:12:36.722044 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25520] 10:12:36.722156 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25507] 10:12:36.722185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.722229 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25507] 10:12:36.722261 <... open resumed> ) = 14
[pid 25520] 10:12:36.722291 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.722331 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.722352 <... open resumed> ) = 13
[pid 25507] 10:12:36.722368 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25503] 10:12:36.722393 <... brk resumed> ) = 0x1e08000
[pid 25520] 10:12:36.722412 fcntl(13, F_GETFD <unfinished ...>
[pid 25507] 10:12:36.722588 <... ioctl resumed> , 0x7ffd396b9080) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.722607 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.722649 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.722670 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.722695 read(8,  <unfinished ...>
[pid 25520] 10:12:36.722725 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25507] 10:12:36.722755 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.722768 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.722888 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.722911 read(14,  <unfinished ...>
[pid 25520] 10:12:36.722944 read(13,  <unfinished ...>
[pid 25502] 10:12:36.722967 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.722996 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25507] 10:12:36.723022 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25520] 10:12:36.723053 close(13 <unfinished ...>
[pid 25503] 10:12:36.723371 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25502] 10:12:36.723393 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.723679 <... close resumed> ) = 0
[pid 25507] 10:12:36.723708 read(14,  <unfinished ...>
[pid 25520] 10:12:36.723767 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.723878 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25502] 10:12:36.723899 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.724487 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.724507 brk(0x209b000 <unfinished ...>
[pid 25520] 10:12:36.724540 stat("/var/tmp",  <unfinished ...>
[pid 25502] 10:12:36.724573 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.724592 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25507] 10:12:36.724626 <... brk resumed> ) = 0x209b000
[pid 25520] 10:12:36.724910 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.725126 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.725162 <... open resumed> ) = 13
[pid 25507] 10:12:36.725176 read(14,  <unfinished ...>
[pid 25520] 10:12:36.725204 fcntl(13, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.725227 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.725246 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.725268 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25520] 10:12:36.725293 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.725688 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.725742 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.725757 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.726242 fstat(13,  <unfinished ...>
[pid 25503] 10:12:36.726286 read(8,  <unfinished ...>
[pid 25520] 10:12:36.726313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25502] 10:12:36.726343 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.726418 pread(13,  <unfinished ...>
[pid 25502] 10:12:36.726439 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.726466 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25502] 10:12:36.726490 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.726574 pread(13,  <unfinished ...>
[pid 25507] 10:12:36.726599 read(14,  <unfinished ...>
[pid 25502] 10:12:36.726621 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.726644 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25507] 10:12:36.726681 <... read resumed> "", 8192) = 0
[pid 25520] 10:12:36.726722 close(13 <unfinished ...>
[pid 25502] 10:12:36.726758 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.726873 <... close resumed> ) = 0
[pid 25507] 10:12:36.726888 close(14 <unfinished ...>
[pid 25520] 10:12:36.726943 close(11 <unfinished ...>
[pid 25502] 10:12:36.726970 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.726989 <... close resumed> ) = 0
[pid 25507] 10:12:36.727005 <... close resumed> ) = 0
[pid 25520] 10:12:36.727050 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25502] 10:12:36.727689 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.727755 <... socket resumed> ) = 11
[pid 25502] 10:12:36.727770 <... stat resumed> 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.727856 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4) = 0
[pid 25502] 10:12:36.727900 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.727959 alarm(300 <unfinished ...>
[pid 25502] 10:12:36.727979 <... stat resumed> 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.728005 <... alarm resumed> ) = 0
[pid 25502] 10:12:36.728019 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25520] 10:12:36.728062 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("64.233.160.26")}, 16 <unfinished ...>
[pid 25502] 10:12:36.728088 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25502] 10:12:36.728182 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25502] 10:12:36.728237 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffced974880) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.728277 lseek(12, 0, SEEK_CUR) = 0
[pid 25502] 10:12:36.728344 read(12, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25502] 10:12:36.728476 brk(0x1295000 <unfinished ...>
[pid 25503] 10:12:36.728518 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25502] 10:12:36.728541 <... brk resumed> ) = 0x1295000
[pid 25502] 10:12:36.729278 lseek(12, 4868, SEEK_SET) = 4868
[pid 25502] 10:12:36.729330 lseek(12, 0, SEEK_CUR) = 4868
[pid 25502] 10:12:36.729367 close(12)   = 0
[pid 25502] 10:12:36.729417 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729464 stat("/usr/local/cpanel/Exporter.pm", 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729509 stat("/etc/exim/perl/Exporter.pmc", 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729548 stat("/etc/exim/perl/Exporter.pm", 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729705 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729760 stat("/usr/local/cpanel/Exporter.pm", 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729873 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729920 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffced974a90) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.729963 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffced974b30) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.730005 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25503] 10:12:36.730360 brk(0x1e29000 <unfinished ...>
[pid 25502] 10:12:36.730385 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25502] 10:12:36.730425 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25502] 10:12:36.730474 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffced974880) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.730521 lseek(12, 0, SEEK_CUR) = 0
[pid 25502] 10:12:36.730571 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25502] 10:12:36.731195 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.731313 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25503] 10:12:36.731676 <... brk resumed> ) = 0x1e29000
[pid 25502] 10:12:36.731745 <... lseek resumed> ) = 2366
[pid 25502] 10:12:36.731825 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25503] 10:12:36.732179 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25502] 10:12:36.732214 <... lseek resumed> ) = 2366
[pid 25502] 10:12:36.732235 close(12)   = 0
[pid 25502] 10:12:36.732561 read(11, "", 8192) = 0
[pid 25502] 10:12:36.732830 close(11 <unfinished ...>
[pid 25503] 10:12:36.732870 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.732895 <... close resumed> ) = 0
[pid 25503] 10:12:36.732916 stat("/usr/local/cpanel/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.733148 stat("/etc/userdomains",  <unfinished ...>
[pid 25507] 10:12:36.733531 read(13,  <unfinished ...>
[pid 25503] 10:12:36.733568 stat("/etc/exim/perl/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733611 stat("/etc/exim/perl/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733665 stat("/usr/local/cpanel/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733710 stat("/usr/local/cpanel/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733762 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733867 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733915 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.733958 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.734002 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.734045 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.734088 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.734130 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.734188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25503] 10:12:36.734236 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc4d27430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.734275 lseek(9, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.734332 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25503] 10:12:36.734570 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.734612 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.734669 open("/etc/userdomains", O_RDONLY) = 11
[pid 25502] 10:12:36.734720 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.734853 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.734909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4a000
[pid 25502] 10:12:36.734951 lseek(11, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.734987 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25502] 10:12:36.735059 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25502] 10:12:36.735110 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.735160 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be49000
[pid 25502] 10:12:36.735199 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.735254 close(12)   = 0
[pid 25502] 10:12:36.735292 munmap(0x7f3c0be49000, 4096) = 0
[pid 25502] 10:12:36.735353 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25507] 10:12:36.735389 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25503] 10:12:36.735681 <... lseek resumed> ) = 878
[pid 25502] 10:12:36.735725 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25503] 10:12:36.735838 lseek(9, 0, SEEK_CUR) = 878
[pid 25502] 10:12:36.735894 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25503] 10:12:36.735927 close(9)    = 0
[pid 25503] 10:12:36.736190 read(8,  <unfinished ...>
[pid 25502] 10:12:36.736230 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.736277 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25502] 10:12:36.736368 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.736441 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.736491 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be49000
[pid 25502] 10:12:36.736531 lseek(12, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.736566 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25502] 10:12:36.736615 read(12, "", 4096) = 0
[pid 25502] 10:12:36.736685 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2957, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.736768 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY) = 13
[pid 25502] 10:12:36.736889 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffced977970) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:36.736931 lseek(13, 0, SEEK_CUR) = 0
[pid 25502] 10:12:36.736970 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2957, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.737019 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:36.737089 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2957
[pid 25503] 10:12:36.737414 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25507] 10:12:36.738270 read(13,  <unfinished ...>
[pid 25502] 10:12:36.738603 read(13, "", 8192) = 0
[pid 25502] 10:12:36.738871 close(13)   = 0
[pid 25502] 10:12:36.738951 stat("/etc/userdomains",  <unfinished ...>
[pid 25503] 10:12:36.739116 read(8,  <unfinished ...>
[pid 25507] 10:12:36.739149 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25502] 10:12:36.739679 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.739754 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:36.739886 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:36.739977 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25502] 10:12:36.740027 fstat(13,  <unfinished ...>
[pid 25503] 10:12:36.740059 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25502] 10:12:36.740084 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.740116 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25503] 10:12:36.740268 brk(0x1e4a000 <unfinished ...>
[pid 25502] 10:12:36.740301 <... mmap resumed> ) = 0x7f3c0be48000
[pid 25502] 10:12:36.740321 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.740376 close(13)   = 0
[pid 25502] 10:12:36.740414 munmap(0x7f3c0be48000, 4096) = 0
[pid 25502] 10:12:36.740464 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:36.740520 pipe([13, 14]) = 0
[pid 25502] 10:12:36.740561 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:36.740606 close(10)   = 0
[pid 25502] 10:12:36.740649 munmap(0x7f3c0be4b000, 4096) = 0
[pid 25502] 10:12:36.740697 close(11)   = 0
[pid 25502] 10:12:36.740744 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25520] 10:12:36.740863 <... connect resumed> ) = 0
[pid 25520] 10:12:36.740891 alarm(0)    = 300
[pid 25520] 10:12:36.740945 getsockname(11, {sa_family=AF_INET, sin_port=htons(37965), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25520] 10:12:36.740998 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25520] 10:12:36.741042 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25520] 10:12:36.741102 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25520] 10:12:36.741144 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25520] 10:12:36.741201 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25520] 10:12:36.741248 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca7000
[pid 25520] 10:12:36.741287 lseek(13, 0, SEEK_SET) = 0
[pid 25520] 10:12:36.741322 read(13, "", 4096) = 0
[pid 25520] 10:12:36.741409 lseek(13, 0, SEEK_SET) = 0
[pid 25520] 10:12:36.741450 read(13, "", 4096) = 0
[pid 25520] 10:12:36.741489 lseek(13, 0, SEEK_SET) = 0
[pid 25520] 10:12:36.741524 read(13, "", 4096) = 0
[pid 25520] 10:12:36.741572 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25502] 10:12:36.741617 close(12)   = 0
[pid 25502] 10:12:36.741669 munmap(0x7f3c0be49000, 4096) = 0
[pid 25503] 10:12:36.741710 <... brk resumed> ) = 0x1e4a000
[pid 25502] 10:12:36.741732 close(9)    = 0
[pid 25502] 10:12:36.741868 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:36.741912 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25521
[pid 25507] 10:12:36.742913 brk(0x20bc000 <unfinished ...>
[pid 25502] 10:12:36.742979 close(14)   = 0
[pid 25502] 10:12:36.743018 read(13,  <unfinished ...>
[pid 25507] 10:12:36.743049 <... brk resumed> ) = 0x20bc000
[pid 25507] 10:12:36.743109 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25507] 10:12:36.743701 read(13,  <unfinished ...>
[pid 25503] 10:12:36.744290 read(8,  <unfinished ...>
[pid 25507] 10:12:36.744328 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25503] 10:12:36.744838 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25503] 10:12:36.745082 brk(0x1e6b000) = 0x1e6b000
[pid 25507] 10:12:36.745649 brk(0x20dd000) = 0x20dd000
[pid 25507] 10:12:36.746192 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25507] 10:12:36.747185 read(13,  <unfinished ...>
[pid 25503] 10:12:36.747614 read(8,  <unfinished ...>
[pid 25507] 10:12:36.747652 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25503] 10:12:36.747833 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25503] 10:12:36.747956 brk(0x1e8c000 <unfinished ...>
[pid 25507] 10:12:36.748266 brk(0x20fe000 <unfinished ...>
[pid 25503] 10:12:36.748300 <... brk resumed> ) = 0x1e8c000
[pid 25507] 10:12:36.748836 <... brk resumed> ) = 0x20fe000
[pid 25507] 10:12:36.749135 read(13,  <unfinished ...>
[pid 25503] 10:12:36.749531 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25507] 10:12:36.749570 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25507] 10:12:36.750255 read(13,  <unfinished ...>
[pid 25503] 10:12:36.750303 <... stat resumed> 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750328 stat("/usr/local/cpanel/Errno.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750375 stat("/etc/exim/perl/Errno.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750416 stat("/etc/exim/perl/Errno.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750463 stat("/usr/local/cpanel/Errno.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750503 stat("/usr/local/cpanel/Errno.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750543 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750593 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750637 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750722 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.750765 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25503] 10:12:36.750910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25503] 10:12:36.750963 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc4d27430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.751009 lseek(9, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.751069 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25503] 10:12:36.751280 brk(0x1ead000 <unfinished ...>
[pid 25507] 10:12:36.751318 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25503] 10:12:36.751474 <... brk resumed> ) = 0x1ead000
[pid 25507] 10:12:36.752007 brk(0x211f000) = 0x211f000
[pid 25507] 10:12:36.752538 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.752767 lseek(9, 4868, SEEK_SET) = 4868
[pid 25503] 10:12:36.752861 lseek(9, 0, SEEK_CUR) = 4868
[pid 25503] 10:12:36.752898 close(9)    = 0
[pid 25503] 10:12:36.752950 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.752996 stat("/usr/local/cpanel/Exporter.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753038 stat("/etc/exim/perl/Exporter.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753076 stat("/etc/exim/perl/Exporter.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753114 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753152 stat("/usr/local/cpanel/Exporter.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753192 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753235 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffdc4d27640) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753278 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffdc4d276e0) = -1 ENOENT (No such file or directory)
[pid 25503] 10:12:36.753327 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25503] 10:12:36.753384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25503] 10:12:36.753430 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffdc4d27430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25503] 10:12:36.753468 lseek(9, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.753518 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25507] 10:12:36.753766 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.753865 stat("/usr/local/cpanel/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.753913 stat("/etc/exim/perl/strict.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.753951 stat("/etc/exim/perl/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.753990 stat("/usr/local/cpanel/strict.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754029 stat("/usr/local/cpanel/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754069 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754112 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754155 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25503] 10:12:36.754445 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25507] 10:12:36.754483 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754505 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754551 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754594 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754638 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.754694 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25507] 10:12:36.754764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25507] 10:12:36.754882 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9080) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.754923 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25520] 10:12:36.754955 <... select resumed> ) = 1 (in [11], left {299, 986652})
[pid 25520] 10:12:36.754987 recvfrom(11, "220 mx.google.com ESMTP y10si49955832oif.18 - gsmtp\r\n", 4096, 0, NULL, NULL) = 53
[pid 25520] 10:12:36.755048 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25520] 10:12:36.755119 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25507] 10:12:36.755156 <... lseek resumed> ) = 0
[pid 25507] 10:12:36.755198 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25507] 10:12:36.755428 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.755466 <... lseek resumed> ) = 2366
[pid 25503] 10:12:36.755487 lseek(9, 0, SEEK_CUR) = 2366
[pid 25503] 10:12:36.755522 close(9)    = 0
[pid 25507] 10:12:36.755679 <... lseek resumed> ) = 878
[pid 25507] 10:12:36.755708 lseek(14, 0, SEEK_CUR) = 878
[pid 25507] 10:12:36.755757 close(14)   = 0
[pid 25507] 10:12:36.756099 read(13,  <unfinished ...>
[pid 25503] 10:12:36.756348 read(8, Process 25521 attached
 <unfinished ...>
[pid 25507] 10:12:36.756410 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25521] 10:12:36.756456 set_robust_list(0x7f3c0be36aa0, 24) = 0
[pid 25521] 10:12:36.756617 close(13 <unfinished ...>
[pid 25503] 10:12:36.756650 <... read resumed> "", 8192) = 0
[pid 25503] 10:12:36.756674 close(8)    = 0
[pid 25521] 10:12:36.756835 <... close resumed> ) = 0
[pid 25521] 10:12:36.756873 geteuid()   = 0
[pid 25521] 10:12:36.756910 getegid()   = 12
[pid 25521] 10:12:36.756948 setgid(500 <unfinished ...>
[pid 25507] 10:12:36.757401 brk(0x2140000 <unfinished ...>
[pid 25521] 10:12:36.757436 <... setgid resumed> ) = 0
[pid 25521] 10:12:36.757458 setuid(503) = 0
[pid 25521] 10:12:36.757531 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25521] 10:12:36.757731 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25521] 10:12:36.757886 brk(0x12b6000) = 0x12b6000
[pid 25521] 10:12:36.758003 fstat(9,  <unfinished ...>
[pid 25503] 10:12:36.758053 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25521] 10:12:36.758085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25503] 10:12:36.758123 <... open resumed> ) = 8
[pid 25521] 10:12:36.758145 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4c000
[pid 25503] 10:12:36.758188 fstat(8,  <unfinished ...>
[pid 25521] 10:12:36.758214 read(9,  <unfinished ...>
[pid 25503] 10:12:36.758240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25521] 10:12:36.758284 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25503] 10:12:36.758309 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4da3e6000
[pid 25503] 10:12:36.758346 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25521] 10:12:36.758396 read(9,  <unfinished ...>
[pid 25503] 10:12:36.758430 close(8 <unfinished ...>
[pid 25521] 10:12:36.758461 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25503] 10:12:36.758488 <... close resumed> ) = 0
[pid 25521] 10:12:36.758512 close(9 <unfinished ...>
[pid 25503] 10:12:36.758538 munmap(0x7ff4da3e6000, 4096 <unfinished ...>
[pid 25521] 10:12:36.758565 <... close resumed> ) = 0
[pid 25503] 10:12:36.758589 <... munmap resumed> ) = 0
[pid 25521] 10:12:36.758610 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25503] 10:12:36.758693 lseek(6, 19, SEEK_SET) = 19
[pid 25503] 10:12:36.758871 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.758916 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.758953 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.758988 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25521] 10:12:36.759357 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25503] 10:12:36.759392 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759434 alarm(300)  = 0
[pid 25503] 10:12:36.759471 alarm(0)    = 300
[pid 25503] 10:12:36.759504 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759540 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759576 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759612 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759647 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7ff4d929e790}, NULL, 8) = 0
[pid 25503] 10:12:36.759684 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, 8) = 0
[pid 25503] 10:12:36.759724 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, 8) = 0
[pid 25503] 10:12:36.759769 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.759901 open("/var/spool/exim/input/a/hdr.25503", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25507] 10:12:36.760002 <... brk resumed> ) = 0x2140000
[pid 25507] 10:12:36.760119 read(13,  <unfinished ...>
[pid 25503] 10:12:36.760152 fchown(8, 47, 12) = 0
[pid 25503] 10:12:36.760192 fchmod(8, 0640) = 0
[pid 25503] 10:12:36.760228 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25503] 10:12:36.760268 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.760319 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4da3e6000
[pid 25503] 10:12:36.760358 lseek(8, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.760408 write(8, "1aEJMa-0006dL-LG-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 420) = 420
[pid 25503] 10:12:36.760459 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=420, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.760515 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dL-LG; Wed, 30 Dec 2015 10:12:36 -0600\n062T To:  ltoms@rmrcc.com, redmountainranch@finestweddingsites.co"..., 545) = 545
[pid 25503] 10:12:36.760557 fsync(8 <unfinished ...>
[pid 25507] 10:12:36.760638 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25521] 10:12:36.760854 <... lseek resumed> ) = 19
[pid 25503] 10:12:36.761318 <... fsync resumed> ) = 0
[pid 25503] 10:12:36.761353 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=965, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.761418 close(8)    = 0
[pid 25503] 10:12:36.761455 munmap(0x7ff4da3e6000, 4096) = 0
[pid 25503] 10:12:36.761500 rename("/var/spool/exim/input/a/hdr.25503", "/var/spool/exim/input/a/1aEJMa-0006dL-LG-H") = 0
[pid 25503] 10:12:36.761569 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25503] 10:12:36.761612 fsync(8)    = 0
[pid 25503] 10:12:36.761648 close(8)    = 0
[pid 25521] 10:12:36.761684 read(6,  <unfinished ...>
[pid 25503] 10:12:36.761712 fstat(6,  <unfinished ...>
[pid 25521] 10:12:36.761739 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2372) = 1858
[pid 25503] 10:12:36.761764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25521] 10:12:36.762308 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25503] 10:12:36.762356 open("/var/spool/exim/msglog/a/1aEJMa-0006dL-LG", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25503] 10:12:36.762426 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25503] 10:12:36.762464 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.762514 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4da3e6000
[pid 25503] 10:12:36.762552 lseek(8, 0, SEEK_CUR) = 0
[pid 25503] 10:12:36.762588 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.762651 write(8, "2015-12-30 10:12:36 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2364 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25503] 10:12:36.762708 close(8)    = 0
[pid 25503] 10:12:36.762754 munmap(0x7ff4da3e6000, 4096) = 0
[pid 25503] 10:12:36.762864 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.762927 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25503] 10:12:36.762987 close(7)    = 0
[pid 25503] 10:12:36.763028 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25503] 10:12:36.763074 fcntl(7, F_GETFD) = 0
[pid 25503] 10:12:36.763109 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25503] 10:12:36.763143 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5379384, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25503] 10:12:36.763190 write(7, "2015-12-30 10:12:36 [25503] 1aEJMa-0006dL-LG <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2364 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for ltoms@rmrcc.com redmountainranch@finestweddings"..., 299) = 299
[pid 25503] 10:12:36.763235 close(6)    = 0
[pid 25503] 10:12:36.763273 munmap(0x7ff4da3e7000, 4096) = 0
[pid 25503] 10:12:36.763313 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, 8) = 0
[pid 25503] 10:12:36.763356 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff4d7fe76a0}, 8) = 0
[pid 25503] 10:12:36.763397 open("/proc/loadavg", O_RDONLY) = 6
[pid 25503] 10:12:36.763449 read(6, "0.18 0.08 0.01 3/253 25521\n", 40) = 27
[pid 25503] 10:12:36.763495 close(6)    = 0
[pid 25503] 10:12:36.763546 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff4da3d1a90) = 25522
[pid 25507] 10:12:36.764586 brk(0x2161000 <unfinished ...>
[pid 25502] 10:12:36.764638 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25502] 10:12:36.764665 read(13,  <unfinished ...>
[pid 25521] 10:12:36.764696 <... write resumed> ) = 4
[pid 25521] 10:12:36.764716 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25502] 10:12:36.764747 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25502] 10:12:36.764768 read(13,  <unfinished ...>
[pid 25521] 10:12:36.764858 <... write resumed> ) = 4
[pid 25521] 10:12:36.764881 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25502] 10:12:36.764912 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:36.764936 read(13,  <unfinished ...>
[pid 25521] 10:12:36.764965 <... write resumed> ) = 4
[pid 25521] 10:12:36.764984 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25502] 10:12:36.765018 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25502] 10:12:36.765041 read(13,  <unfinished ...>
[pid 25521] 10:12:36.765068 <... write resumed> ) = 40
[pid 25521] 10:12:36.765089 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25502] 10:12:36.765119 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:36.765140 wait4(-1,  <unfinished ...>
[pid 25521] 10:12:36.765168 <... write resumed> ) = 4
[pid 25521] 10:12:36.765188 close(14)   = 0
[pid 25521] 10:12:36.765238 exit_group(0) = ?
[pid 25503] 10:12:36.765495 exit_group(0) = ?
[pid 25520] 10:12:36.773688 <... select resumed> ) = 1 (in [11], left {299, 981473})
[pid 25520] 10:12:36.773755 recvfrom(11, "250-mx.google.com at your service, [50.116.78.207]\r\n250-SIZE 35882577\r\n250-8BITMIME\r\n250-STARTTLS\r\n250-ENHANCEDSTATUSCODES\r\n250-PIPELINING\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n", 4096, 0, NULL, NULL) = 168
[pid 25520] 10:12:36.773835 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25520] 10:12:36.773925 select(12, [11], NULL, NULL, {300, 0}Process 25522 attached
 <unfinished ...>
[pid 25507] 10:12:36.773985 <... brk resumed> ) = 0x2161000
[pid 25507] 10:12:36.774149 read(13,  <unfinished ...>
[pid 25522] 10:12:36.774190 set_robust_list(0x7ff4da3d1aa0, 24) = 0
[pid 25522] 10:12:36.774253 close(0)    = 0
[pid 25522] 10:12:36.774297 close(1)    = 0
[pid 25522] 10:12:36.774347 close(2)    = 0
[pid 25522] 10:12:36.774436 setsid()    = 25522
[pid 25521] 10:12:36.779417 +++ exited with 0 +++
[pid 25503] 10:12:36.779446 +++ exited with 0 +++
[pid 25502] 10:12:36.779578 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25521
[pid 25389] 10:12:36.779614 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25503
[pid 25502] 10:12:36.779656 close(13 <unfinished ...>
[pid 25389] 10:12:36.779687 munmap(0x7ff3d4f3d000, 4096 <unfinished ...>
[pid 25502] 10:12:36.779752 <... close resumed> ) = 0
[pid 25389] 10:12:36.779764 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.779923 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25389] 10:12:36.779951 pipe2( <unfinished ...>
[pid 25502] 10:12:36.780023 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25389] 10:12:36.780047 <... pipe2 resumed> [5, 6], O_CLOEXEC) = 0
[pid 25502] 10:12:36.780116 stat("/etc/userdomains",  <unfinished ...>
[pid 25389] 10:12:36.780149 clone( <unfinished ...>
[pid 25502] 10:12:36.780538 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.780678 open("/etc/userdomains", O_RDONLY) = 9
[pid 25502] 10:12:36.780732 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.780840 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.781146 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25523
[pid 25502] 10:12:36.781188 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4c000
[pid 25502] 10:12:36.781228 lseek(9, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.781277 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25502] 10:12:36.781359 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.781576 close(5 <unfinished ...>
[pid 25502] 10:12:36.781635 stat("/etc/userdomains",  <unfinished ...>
[pid 25389] 10:12:36.781660 <... close resumed> ) = 0
[pid 25502] 10:12:36.781706 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25389] 10:12:36.781795 fcntl(6, F_SETFD, 0 <unfinished ...>
[pid 25502] 10:12:36.781878 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25389] 10:12:36.781907 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.781970 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25389] 10:12:36.781993 fstat(6,  <unfinished ...>
[pid 25502] 10:12:36.782041 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25389] 10:12:36.782074 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130168684, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.782215 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25389] 10:12:36.782361 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.782394 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25389] 10:12:36.782455 <... mmap resumed> ) = 0x7ff3d4f3d000
[pid 25502] 10:12:36.782566 fstat(10,  <unfinished ...>
[pid 25389] 10:12:36.782596 write(6, "To:  antiquewedding@gmail.com, antiqueweddinghouse@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style "..., 2095 <unfinished ...>
[pid 25502] 10:12:36.782647 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25389] 10:12:36.782760 <... write resumed> ) = 2095
[pid 25502] 10:12:36.782813 fstat(10,  <unfinished ...>
[pid 25389] 10:12:36.782847 close(6 <unfinished ...>
[pid 25502] 10:12:36.782892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25389] 10:12:36.782988 <... close resumed> ) = 0
[pid 25502] 10:12:36.783036 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25389] 10:12:36.783048 wait4(25523,  <unfinished ...>
[pid 25502] 10:12:36.783091 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25502] 10:12:36.783117 lseek(10, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.783161 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25502] 10:12:36.783253 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25502] 10:12:36.783316 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.783432 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4a000
[pid 25502] 10:12:36.783544 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.783614 close(11)   = 0
[pid 25502] 10:12:36.783675 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25502] 10:12:36.783754 open("/etc/localdomains", O_RDONLY) = 11
[pid 25502] 10:12:36.783809 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.783930 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.784045 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4a000
[pid 25502] 10:12:36.784091 lseek(11, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.784154 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25502] 10:12:36.784227 stat("/jail_owner", 0x7ffced97a9d0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.784291 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:36.784462 stat("/usr/local/cpanel/3rdparty/mailman/lists/westernsky_finestweddingsites.com/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.784652 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:36.784820 stat("/usr/local/cpanel/3rdparty/mailman/lists/westernsky/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.784974 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.785110 open("/etc/demouids", O_RDONLY) = 12
[pid 25502] 10:12:36.785170 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.785298 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.785416 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be49000
[pid 25502] 10:12:36.785465 lseek(12, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.785589 read(12, "", 4096) = 0
[pid 25502] 10:12:36.785655 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:36.785913 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.786048 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.786194 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.786356 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25502] 10:12:36.786402 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.786577 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:36.786720 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be48000
[pid 25502] 10:12:36.786772 lseek(13, 0, SEEK_SET) = 0
[pid 25502] 10:12:36.786829 read(13,  <unfinished ...>
[pid 25520] 10:12:36.786890 <... select resumed> ) = 1 (in [11], left {299, 987077})
[pid 25502] 10:12:36.786933 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25520] 10:12:36.786989 recvfrom(11,  <unfinished ...>
[pid 25502] 10:12:36.787025 read(13,  <unfinished ...>
[pid 25520] 10:12:36.787075 <... recvfrom resumed> "220 2.0.0 Ready to start TLS\r\n", 4096, 0, NULL, NULL) = 30
[pid 25502] 10:12:36.787089 <... read resumed> "", 4096) = 0
[pid 25520] 10:12:36.789116 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25502] 10:12:36.789146 stat("/etc/userdomains",  <unfinished ...>
[pid 25520] 10:12:36.789224 <... open resumed> ) = 14
[pid 25502] 10:12:36.789247 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25520] 10:12:36.789412 fstat(14,  <unfinished ...>
[pid 25502] 10:12:36.789456 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25520] 10:12:36.789587 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25502] 10:12:36.789718 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25520] 10:12:36.789879 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25502] 10:12:36.789949 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25520] 10:12:36.790035 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25502] 10:12:36.790066 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25520] 10:12:36.790240 read(14,  <unfinished ...>
[pid 25502] 10:12:36.790277 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25520] 10:12:36.790330 <... read resumed> "\30\376\\\241\320\372\271\321\17\7\252\n\323\217\3355\213\215\243\204\34\200\254\251L\231]\233fX&\366\n\301\271\243J:]\16bA\260=\320D>\336", 48) = 48
[pid 25502] 10:12:36.790372 <... open resumed> ) = 14
[pid 25520] 10:12:36.790414 close(14 <unfinished ...>
[pid 25502] 10:12:36.790564 fstat(14,  <unfinished ...>
[pid 25520] 10:12:36.790615 <... close resumed> ) = 0
[pid 25502] 10:12:36.790658 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25520] 10:12:36.790826 getuid( <unfinished ...>
[pid 25502] 10:12:36.790874 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.790926 <... getuid resumed> ) = 47
[pid 25502] 10:12:36.790969 <... mmap resumed> ) = 0x7f3c0be47000
[pid 25502] 10:12:36.795386 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.795504 close(14)   = 0
[pid 25502] 10:12:36.795605 munmap(0x7f3c0be47000, 4096) = 0
[pid 25502] 10:12:36.795672 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:36.795865 pipe([14, 15]) = 0
[pid 25502] 10:12:36.795944 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:36.796002 close(12)   = 0
[pid 25502] 10:12:36.796068 munmap(0x7f3c0be49000, 4096) = 0
[pid 25502] 10:12:36.796109 close(9)    = 0
[pid 25502] 10:12:36.796181 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:36.796222 close(11)   = 0
[pid 25502] 10:12:36.796294 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25502] 10:12:36.796335 close(13)   = 0
[pid 25502] 10:12:36.796436 munmap(0x7f3c0be48000, 4096) = 0
[pid 25502] 10:12:36.796555 close(10)   = 0
[pid 25502] 10:12:36.796608 munmap(0x7f3c0be4b000, 4096) = 0
[pid 25502] 10:12:36.796683 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25524
[pid 25502] 10:12:36.797048 close(15)   = 0
[pid 25502] 10:12:36.797102 read(14,  <unfinished ...>
[pid 25507] 10:12:36.797543 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25520] 10:12:36.799399 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25507] 10:12:36.799813 brk(0x2182000 <unfinished ...>
[pid 25520] 10:12:36.799900 <... open resumed> ) = 14
[pid 25520] 10:12:36.799951 fstat(14, {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25520] 10:12:36.800102 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca6000
[pid 25507] 10:12:36.800163 <... brk resumed> ) = 0x2182000
[pid 25520] 10:12:36.800222 read(14,  <unfinished ...>
[pid 25507] 10:12:36.800470 read(13,  <unfinished ...>
[pid 25520] 10:12:36.800567 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25520] 10:12:36.800645 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25520] 10:12:36.800822 read(14, "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25520] 10:12:36.800900 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25520] 10:12:36.801034 read(14,  <unfinished ...>
[pid 25507] 10:12:36.801076 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25520] 10:12:36.801554 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25520] 10:12:36.801622 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25520] 10:12:36.801756 read(14, "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25520] 10:12:36.801871 read(14, "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25520] 10:12:36.801990 read(14, " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25520] 10:12:36.802067 read(14, "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25520] 10:12:36.802188 read(14, "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25520] 10:12:36.802310 read(14, "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25520] 10:12:36.802434 read(14, "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25520] 10:12:36.802834 read(14, "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25520] 10:12:36.802968 read(14, "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25520] 10:12:36.803052 read(14, "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25520] 10:12:36.803206 read(14, "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25520] 10:12:36.803626 read(14, "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25520] 10:12:36.803725 read(14, "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25520] 10:12:36.803835 read(14, "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25520] 10:12:36.803963 read(14, "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25520] 10:12:36.804087 read(14,  <unfinished ...>
[pid 25507] 10:12:36.804343 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.804409 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25520] 10:12:36.804564 read(14, "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25520] 10:12:36.804640 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25520] 10:12:36.804760 read(14,  <unfinished ...>
[pid 25507] 10:12:36.804854 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.804906 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25520] 10:12:36.804991 read(14,  <unfinished ...>
[pid 25507] 10:12:36.805038 stat("/usr/local/cpanel/Errno.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.805119 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25520] 10:12:36.805169 read(14,  <unfinished ...>
[pid 25507] 10:12:36.805210 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25520] 10:12:36.805249 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25507] 10:12:36.805313 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.805423 read(14,  <unfinished ...>
[pid 25507] 10:12:36.805463 stat("/etc/exim/perl/Errno.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.805594 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.805677 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25520] 10:12:36.805778 read(14,  <unfinished ...>
[pid 25507] 10:12:36.805852 stat("/usr/local/cpanel/Errno.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.805936 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.806020 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25520] 10:12:36.806070 read(14, "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25520] 10:12:36.806177 read(14,  <unfinished ...>
[pid 25507] 10:12:36.806238 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.806325 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.806414 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25507] 10:12:36.806543 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.806665 read(14,  <unfinished ...>
[pid 25507] 10:12:36.806727 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.806809 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25520] 10:12:36.806861 read(14, "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25520] 10:12:36.806963 read(14,  <unfinished ...>
[pid 25507] 10:12:36.807030 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25507] 10:12:36.807251 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25507] 10:12:36.807312 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25520] 10:12:36.807384 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25520] 10:12:36.807472 read(14,  <unfinished ...>
[pid 25507] 10:12:36.807610 <... ioctl resumed> , 0x7ffd396b9080) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.807640 lseek(14, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.807719 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25507] 10:12:36.807884 brk(0x21a3000 <unfinished ...>
[pid 25520] 10:12:36.807960 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25520] 10:12:36.808062 read(14,  <unfinished ...>
[pid 25507] 10:12:36.808141 <... brk resumed> ) = 0x21a3000
[pid 25520] 10:12:36.808178 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25520] 10:12:36.808602 read(14, ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25520] 10:12:36.808675 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25520] 10:12:36.808807 read(14, "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25520] 10:12:36.808937 read(14, "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25520] 10:12:36.809072 read(14,  <unfinished ...>
[pid 25507] 10:12:36.809367 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25520] 10:12:36.809441 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25520] 10:12:36.809557 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25520] 10:12:36.809700 read(14, "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25520] 10:12:36.809831 read(14, "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25520] 10:12:36.809950 read(14, "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25520] 10:12:36.810076 read(14,  <unfinished ...>
[pid 25507] 10:12:36.810110 <... lseek resumed> ) = 4868
[pid 25507] 10:12:36.810145 lseek(14, 0, SEEK_CUR) = 4868
[pid 25507] 10:12:36.810205 close(14)   = 0
[pid 25520] 10:12:36.810285 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25520] 10:12:36.810387 read(14,  <unfinished ...>
[pid 25507] 10:12:36.810444 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.810604 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.810692 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25520] 10:12:36.810744 read(14, "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25520] 10:12:36.810807 read(14,  <unfinished ...>
[pid 25507] 10:12:36.810876 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.810961 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25520] 10:12:36.811079 read(14,  <unfinished ...>
[pid 25507] 10:12:36.811146 stat("/etc/exim/perl/Exporter.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.811235 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.811339 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25520] 10:12:36.811427 read(14, Process 25523 attached
 <unfinished ...>
[pid 25523] 10:12:36.811574 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25507] 10:12:36.811645 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.811734 <... set_robust_list resumed> ) = 0
[pid 25523] 10:12:36.811793 close(6 <unfinished ...>
[pid 25507] 10:12:36.811831 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25520] 10:12:36.811880 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25523] 10:12:36.811915 <... close resumed> ) = 0
[pid 25520] 10:12:36.812007 read(14,  <unfinished ...>
[pid 25507] 10:12:36.812084 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.812136 dup2(5, 0)  = 0
[pid 25523] 10:12:36.812195 close(5)    = 0
[pid 25523] 10:12:36.812247 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25507] 10:12:36.812394 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd396b9290) = -1 ENOENT (No such file or directory)
[pid 25507] 10:12:36.812691 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25520] 10:12:36.812732 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25520] 10:12:36.812839 read(14,  <unfinished ...>
[pid 25507] 10:12:36.812947 <... stat resumed> 0x7ffd396b9330) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.813318 <... execve resumed> ) = 0
[pid 25507] 10:12:36.813373 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25520] 10:12:36.813680 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25520] 10:12:36.813806 read(14,  <unfinished ...>
[pid 25507] 10:12:36.813879 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25507] 10:12:36.813941 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd396b9080) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25507] 10:12:36.814028 lseek(14, 0, SEEK_CUR) = 0
[pid 25507] 10:12:36.814087 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25520] 10:12:36.814541 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25520] 10:12:36.814655 read(14, "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25520] 10:12:36.814789 read(14, "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25520] 10:12:36.814887 read(14, Process 25524 attached
"IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25520] 10:12:36.815043 read(14,  <unfinished ...>
[pid 25524] 10:12:36.815117 set_robust_list(0x7f3c0be36aa0, 24) = 0
[pid 25524] 10:12:36.815217 close(14 <unfinished ...>
[pid 25523] 10:12:36.815300 brk(0 <unfinished ...>
[pid 25524] 10:12:36.815390 <... close resumed> ) = 0
[pid 25524] 10:12:36.815429 geteuid( <unfinished ...>
[pid 25520] 10:12:36.815595 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25507] 10:12:36.815782 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25522] 10:12:36.815842 fstat(0,  <unfinished ...>
[pid 25524] 10:12:36.815917 <... geteuid resumed> ) = 0
[pid 25520] 10:12:36.816015 brk(0x1161000 <unfinished ...>
[pid 25524] 10:12:36.816064 getegid( <unfinished ...>
[pid 25522] 10:12:36.816108 <... fstat resumed> 0x7ffdc4d2bf60) = -1 EBADF (Bad file descriptor)
[pid 25523] 10:12:36.816153 <... brk resumed> ) = 0x117d000
[pid 25524] 10:12:36.816199 <... getegid resumed> ) = 12
[pid 25522] 10:12:36.816250 open("/dev/null", O_RDWR <unfinished ...>
[pid 25523] 10:12:36.816325 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25524] 10:12:36.816405 setgid(500) = 0
[pid 25522] 10:12:36.816478 <... open resumed> ) = 0
[pid 25524] 10:12:36.816544 setuid(503) = 0
[pid 25524] 10:12:36.816644 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.816693 <... mmap resumed> ) = 0x7f7d7f604000
[pid 25523] 10:12:36.816735 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25522] 10:12:36.816786 fstat(1,  <unfinished ...>
[pid 25523] 10:12:36.816865 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.816918 <... fstat resumed> 0x7ffdc4d2bf60) = -1 EBADF (Bad file descriptor)
[pid 25522] 10:12:36.816977 dup2(0, 1 <unfinished ...>
[pid 25524] 10:12:36.817030 <... open resumed> ) = 9
[pid 25522] 10:12:36.817069 <... dup2 resumed> ) = 1
[pid 25520] 10:12:36.817114 <... brk resumed> ) = 0x1161000
[pid 25522] 10:12:36.817161 fstat(2, 0x7ffdc4d2bf60) = -1 EBADF (Bad file descriptor)
[pid 25520] 10:12:36.817241 read(14,  <unfinished ...>
[pid 25524] 10:12:36.817322 fstat(9,  <unfinished ...>
[pid 25522] 10:12:36.817370 dup2(0, 2)  = 2
[pid 25522] 10:12:36.817430 geteuid()   = 47
[pid 25524] 10:12:36.817480 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:36.817675 fstat(0,  <unfinished ...>
[pid 25524] 10:12:36.817742 brk(0x12b6000 <unfinished ...>
[pid 25523] 10:12:36.817783 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.817826 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25522] 10:12:36.817869 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25520] 10:12:36.818220 read(14,  <unfinished ...>
[pid 25522] 10:12:36.818281 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25523] 10:12:36.818468 <... open resumed> ) = 5
[pid 25522] 10:12:36.818518 fstat(2,  <unfinished ...>
[pid 25524] 10:12:36.818575 <... brk resumed> ) = 0x12b6000
[pid 25522] 10:12:36.818616 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25522] 10:12:36.818867 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMa-0006dL-LG"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25524] 10:12:36.819135 fstat(9,  <unfinished ...>
[pid 25523] 10:12:36.819171 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25523] 10:12:36.819374 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f7d7f5fa000
[pid 25523] 10:12:36.819518 close(5)    = 0
[pid 25523] 10:12:36.819608 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25507] 10:12:36.819688 <... lseek resumed> ) = 2366
[pid 25507] 10:12:36.819734 lseek(14, 0, SEEK_CUR) = 2366
[pid 25507] 10:12:36.819850 close(14)   = 0
[pid 25520] 10:12:36.819937 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25520] 10:12:36.820041 read(14,  <unfinished ...>
[pid 25522] 10:12:36.820628 <... execve resumed> ) = 0
[pid 25524] 10:12:36.820685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25523] 10:12:36.820896 read(5,  <unfinished ...>
[pid 25524] 10:12:36.820950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.821000 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.821050 fstat(5,  <unfinished ...>
[pid 25524] 10:12:36.821102 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25523] 10:12:36.821142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25524] 10:12:36.821373 read(9,  <unfinished ...>
[pid 25523] 10:12:36.821509 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25524] 10:12:36.821606 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25523] 10:12:36.821648 <... mmap resumed> ) = 0x7f7d7f1c5000
[pid 25523] 10:12:36.821691 mprotect(0x7f7d7f1e2000, 2093056, PROT_NONE) = 0
[pid 25524] 10:12:36.821763 read(9,  <unfinished ...>
[pid 25523] 10:12:36.821873 mmap(0x7f7d7f3e1000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000 <unfinished ...>
[pid 25524] 10:12:36.821913 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25523] 10:12:36.821963 <... mmap resumed> ) = 0x7f7d7f3e1000
[pid 25520] 10:12:36.822002 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25524] 10:12:36.822057 close(9 <unfinished ...>
[pid 25520] 10:12:36.822173 read(14,  <unfinished ...>
[pid 25523] 10:12:36.822212 mmap(0x7f7d7f3e5000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25524] 10:12:36.822296 <... close resumed> ) = 0
[pid 25523] 10:12:36.822355 <... mmap resumed> ) = 0x7f7d7f3e5000
[pid 25523] 10:12:36.822406 close(5)    = 0
[pid 25523] 10:12:36.822481 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25524] 10:12:36.822851 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25524] 10:12:36.823328 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25520] 10:12:36.823403 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25520] 10:12:36.823501 read(14,  <unfinished ...>
[pid 25523] 10:12:36.823545 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.823609 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25523] 10:12:36.823863 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f7d7efc1000
[pid 25523] 10:12:36.823927 mprotect(0x7f7d7efc3000, 2097152, PROT_NONE) = 0
[pid 25523] 10:12:36.823976 mmap(0x7f7d7f1c3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f7d7f1c3000
[pid 25523] 10:12:36.824039 close(5)    = 0
[pid 25523] 10:12:36.824085 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25520] 10:12:36.824172 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25520] 10:12:36.824285 read(14,  <unfinished ...>
[pid 25523] 10:12:36.824332 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.824399 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25523] 10:12:36.824588 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.824651 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25523] 10:12:36.824863 <... mmap resumed> ) = 0x7f7d7f5f9000
[pid 25520] 10:12:36.824905 read(14,  <unfinished ...>
[pid 25523] 10:12:36.825048 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25520] 10:12:36.825114 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25507] 10:12:36.825163 read(13,  <unfinished ...>
[pid 25523] 10:12:36.825296 <... mmap resumed> ) = 0x7f7d7ec2d000
[pid 25520] 10:12:36.825315 read(14,  <unfinished ...>
[pid 25507] 10:12:36.825389 <... read resumed> "", 8192) = 0
[pid 25524] 10:12:36.825447 <... lseek resumed> ) = 19
[pid 25523] 10:12:36.825511 mprotect(0x7f7d7edb7000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.825560 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25507] 10:12:36.825602 close(13 <unfinished ...>
[pid 25524] 10:12:36.825745 read(6,  <unfinished ...>
[pid 25523] 10:12:36.825871 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.825922 brk(0 <unfinished ...>
[pid 25520] 10:12:36.825985 read(14,  <unfinished ...>
[pid 25524] 10:12:36.826042 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2372) = 1858
[pid 25523] 10:12:36.826085 mmap(0x7f7d7efb7000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25522] 10:12:36.826610 <... brk resumed> ) = 0x16ea000
[pid 25507] 10:12:36.826660 <... close resumed> ) = 0
[pid 25524] 10:12:36.826721 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25523] 10:12:36.827015 <... mmap resumed> ) = 0x7f7d7efb7000
[pid 25522] 10:12:36.827081 fcntl(0, F_GETFD <unfinished ...>
[pid 25520] 10:12:36.827160 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25524] 10:12:36.827200 <... write resumed> ) = 4
[pid 25523] 10:12:36.827300 mmap(0x7f7d7efbc000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.827375 <... fcntl resumed> ) = 0
[pid 25507] 10:12:36.827407 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.827488 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25524] 10:12:36.827535 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25523] 10:12:36.827584 <... mmap resumed> ) = 0x7f7d7efbc000
[pid 25522] 10:12:36.827627 fcntl(1, F_GETFD <unfinished ...>
[pid 25520] 10:12:36.827695 read(14,  <unfinished ...>
[pid 25507] 10:12:36.827741 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.827783 read(14,  <unfinished ...>
[pid 25524] 10:12:36.827912 <... write resumed> ) = 4
[pid 25523] 10:12:36.827940 close(5 <unfinished ...>
[pid 25522] 10:12:36.828003 <... fcntl resumed> ) = 0
[pid 25520] 10:12:36.828046 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25507] 10:12:36.828114 read(12,  <unfinished ...>
[pid 25502] 10:12:36.828228 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25524] 10:12:36.828275 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25523] 10:12:36.828325 <... close resumed> ) = 0
[pid 25522] 10:12:36.828368 fcntl(2, F_GETFD <unfinished ...>
[pid 25520] 10:12:36.828455 read(14,  <unfinished ...>
[pid 25507] 10:12:36.828485 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.828528 read(14,  <unfinished ...>
[pid 25524] 10:12:36.828631 <... write resumed> ) = 4
[pid 25523] 10:12:36.828707 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.828775 <... fcntl resumed> ) = 0
[pid 25520] 10:12:36.828874 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25507] 10:12:36.828944 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:36.829029 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25524] 10:12:36.829119 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25523] 10:12:36.829160 <... mmap resumed> ) = 0x7f7d7f5f8000
[pid 25522] 10:12:36.829200 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25520] 10:12:36.829298 read(14,  <unfinished ...>
[pid 25507] 10:12:36.829370 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:36.829575 read(14,  <unfinished ...>
[pid 25524] 10:12:36.829668 <... write resumed> ) = 40
[pid 25523] 10:12:36.829683 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.829750 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.829860 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25507] 10:12:36.829924 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.830039 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25524] 10:12:36.830076 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25523] 10:12:36.830127 <... mmap resumed> ) = 0x7f7d7f5f7000
[pid 25522] 10:12:36.830170 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.830240 read(14,  <unfinished ...>
[pid 25507] 10:12:36.830286 <... open resumed> ) = 13
[pid 25502] 10:12:36.830336 read(14,  <unfinished ...>
[pid 25524] 10:12:36.830408 <... write resumed> ) = 4
[pid 25523] 10:12:36.830444 arch_prctl(ARCH_SET_FS, 0x7f7d7f5f8700 <unfinished ...>
[pid 25522] 10:12:36.830508 <... mmap resumed> ) = 0x7f2e40b15000
[pid 25520] 10:12:36.830552 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25507] 10:12:36.830680 fstat(13,  <unfinished ...>
[pid 25502] 10:12:36.830863 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25524] 10:12:36.830946 close(15 <unfinished ...>
[pid 25523] 10:12:36.830994 <... arch_prctl resumed> ) = 0
[pid 25522] 10:12:36.831045 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25520] 10:12:36.831246 read(14,  <unfinished ...>
[pid 25507] 10:12:36.831331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:36.831538 wait4(-1,  <unfinished ...>
[pid 25524] 10:12:36.831615 <... close resumed> ) = 0
[pid 25523] 10:12:36.831650 mprotect(0x7f7d7efb7000, 16384, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.831733 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.831764 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25507] 10:12:36.831881 fstat(13,  <unfinished ...>
[pid 25524] 10:12:36.831950 exit_group(0) = ?
[pid 25523] 10:12:36.831977 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.832277 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.832348 read(14,  <unfinished ...>
[pid 25524] 10:12:36.832445 +++ exited with 0 +++
[pid 25523] 10:12:36.832462 mprotect(0x7f7d7f1c3000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.832531 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.832576 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25507] 10:12:36.832648 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:36.832988 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25524
[pid 25523] 10:12:36.833050 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.833087 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.833239 read(14,  <unfinished ...>
[pid 25507] 10:12:36.833314 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.833369 close(14 <unfinished ...>
[pid 25523] 10:12:36.833475 mprotect(0x7f7d7f605000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.833532 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.833576 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25507] 10:12:36.833636 <... mmap resumed> ) = 0x7f43504d1000
[pid 25502] 10:12:36.833699 <... close resumed> ) = 0
[pid 25523] 10:12:36.833754 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.833861 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.833960 read(14,  <unfinished ...>
[pid 25507] 10:12:36.834032 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.834086 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25523] 10:12:36.834175 munmap(0x7f7d7f5fa000, 39387 <unfinished ...>
[pid 25522] 10:12:36.834293 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.834367 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25507] 10:12:36.834434 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.834563 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25523] 10:12:36.834637 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.834702 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25520] 10:12:36.834911 read(14,  <unfinished ...>
[pid 25507] 10:12:36.834985 read(13,  <unfinished ...>
[pid 25502] 10:12:36.835037 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.835106 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.835147 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.835196 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25507] 10:12:36.835255 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.835370 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.835622 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.835645 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.835742 read(14,  <unfinished ...>
[pid 25507] 10:12:36.835867 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:36.835932 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.835996 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25522] 10:12:36.836081 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.836141 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25507] 10:12:36.836201 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:36.836526 <... open resumed> ) = 9
[pid 25523] 10:12:36.836599 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25522] 10:12:36.836633 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.836724 read(14,  <unfinished ...>
[pid 25507] 10:12:36.836855 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.836919 fstat(9,  <unfinished ...>
[pid 25523] 10:12:36.836974 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:36.837025 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.837071 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25507] 10:12:36.837132 <... open resumed> ) = 14
[pid 25502] 10:12:36.837260 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.837496 <... ioctl resumed> , 0x7ffe14ae9130) = -1 EINVAL (Invalid argument)
[pid 25522] 10:12:36.837560 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.837637 read(14,  <unfinished ...>
[pid 25507] 10:12:36.837704 fstat(14,  <unfinished ...>
[pid 25502] 10:12:36.837759 fstat(9,  <unfinished ...>
[pid 25523] 10:12:36.837875 brk(0 <unfinished ...>
[pid 25522] 10:12:36.837929 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.837980 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25507] 10:12:36.838108 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:36.838322 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.838575 <... brk resumed> ) = 0x117d000
[pid 25522] 10:12:36.838666 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25520] 10:12:36.838749 read(14,  <unfinished ...>
[pid 25507] 10:12:36.838856 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.838919 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.838982 brk(0x119e000 <unfinished ...>
[pid 25522] 10:12:36.839030 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25520] 10:12:36.839254 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25507] 10:12:36.839399 <... mmap resumed> ) = 0x7f43504d0000
[pid 25502] 10:12:36.839436 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25523] 10:12:36.839494 <... brk resumed> ) = 0x119e000
[pid 25522] 10:12:36.839566 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.839658 read(14,  <unfinished ...>
[pid 25507] 10:12:36.839727 read(14,  <unfinished ...>
[pid 25502] 10:12:36.839835 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.839914 getuid( <unfinished ...>
[pid 25522] 10:12:36.839957 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.840012 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25507] 10:12:36.840129 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:36.840200 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.840253 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.840308 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.840421 read(14,  <unfinished ...>
[pid 25507] 10:12:36.840491 close(14 <unfinished ...>
[pid 25502] 10:12:36.840604 read(9,  <unfinished ...>
[pid 25523] 10:12:36.840686 getgid( <unfinished ...>
[pid 25522] 10:12:36.840732 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.840785 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25507] 10:12:36.840957 <... close resumed> ) = 0
[pid 25502] 10:12:36.841020 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25523] 10:12:36.841106 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.841139 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.841247 read(14,  <unfinished ...>
[pid 25507] 10:12:36.841317 munmap(0x7f43504d0000, 4096 <unfinished ...>
[pid 25502] 10:12:36.841390 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.841449 geteuid( <unfinished ...>
[pid 25522] 10:12:36.841495 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.841548 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25507] 10:12:36.841658 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.841746 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.842044 <... geteuid resumed> ) = 503
[pid 25522] 10:12:36.842080 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25520] 10:12:36.842187 brk(0x1182000 <unfinished ...>
[pid 25507] 10:12:36.842257 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.842323 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.842396 getegid( <unfinished ...>
[pid 25522] 10:12:36.842434 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.842489 <... brk resumed> ) = 0x1182000
[pid 25507] 10:12:36.842561 <... open resumed> ) = 14
[pid 25502] 10:12:36.842609 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.842927 <... getegid resumed> ) = 500
[pid 25522] 10:12:36.842971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.843070 read(14,  <unfinished ...>
[pid 25507] 10:12:36.843139 fstat(14,  <unfinished ...>
[pid 25502] 10:12:36.843194 stat("/home/finest09/etc/finestweddingsites.com/westernsky/filter",  <unfinished ...>
[pid 25523] 10:12:36.843490 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.843552 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.843607 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25507] 10:12:36.843732 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25502] 10:12:36.843972 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.844038 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.844127 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.844257 read(14,  <unfinished ...>
[pid 25507] 10:12:36.844327 fstat(14,  <unfinished ...>
[pid 25502] 10:12:36.844386 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.844454 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:36.844862 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.844935 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25507] 10:12:36.845059 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25502] 10:12:36.845300 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.845560 <... open resumed> ) = 5
[pid 25522] 10:12:36.845608 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.845717 read(14,  <unfinished ...>
[pid 25507] 10:12:36.845835 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.845917 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.845983 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.846029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.846084 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25507] 10:12:36.846213 <... mmap resumed> ) = 0x7f43504d0000
[pid 25502] 10:12:36.846269 <... open resumed> ) = 10
[pid 25523] 10:12:36.846335 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:36.846577 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25520] 10:12:36.846647 read(14,  <unfinished ...>
[pid 25507] 10:12:36.846701 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.846761 fstat(10,  <unfinished ...>
[pid 25523] 10:12:36.846878 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.846945 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25520] 10:12:36.847180 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25507] 10:12:36.847249 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.847295 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.847548 <... mmap resumed> ) = 0x7f7d7f603000
[pid 25522] 10:12:36.847598 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.847714 read(14,  <unfinished ...>
[pid 25507] 10:12:36.847785 read(14,  <unfinished ...>
[pid 25502] 10:12:36.847895 fstat(10,  <unfinished ...>
[pid 25523] 10:12:36.847971 read(5,  <unfinished ...>
[pid 25522] 10:12:36.848057 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.848079 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25507] 10:12:36.848201 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25502] 10:12:36.848280 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.848514 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          241220 kB\nCached:           333708 kB\nBuffers:               0 kB\nActive:           308452 kB\nInactive:         467644 kB\nActive(anon):     172588 kB\nInactive(anon):   277604 kB\nActive(file):     135864 kB\nInac"..., 1024) = 588
[pid 25522] 10:12:36.848584 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.848684 read(14,  <unfinished ...>
[pid 25507] 10:12:36.848757 read(14,  <unfinished ...>
[pid 25502] 10:12:36.848876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.848953 close(5 <unfinished ...>
[pid 25522] 10:12:36.849055 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.849121 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25507] 10:12:36.849243 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.849338 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25523] 10:12:36.849388 <... close resumed> ) = 0
[pid 25522] 10:12:36.849438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.849556 read(14,  <unfinished ...>
[pid 25507] 10:12:36.849629 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.849694 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.849757 munmap(0x7f7d7f603000, 4096 <unfinished ...>
[pid 25522] 10:12:36.849865 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.849931 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25507] 10:12:36.850055 <... open resumed> ) = 15
[pid 25502] 10:12:36.850117 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.850182 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.850270 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25520] 10:12:36.850354 read(14,  <unfinished ...>
[pid 25507] 10:12:36.850437 fstat(15,  <unfinished ...>
[pid 25502] 10:12:36.850505 read(10,  <unfinished ...>
[pid 25523] 10:12:36.850578 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.850635 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.850684 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25507] 10:12:36.850860 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:36.851116 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25523] 10:12:36.851189 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25522] 10:12:36.851237 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.851352 read(14,  <unfinished ...>
[pid 25507] 10:12:36.851423 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.851488 read(10,  <unfinished ...>
[pid 25523] 10:12:36.851564 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.851616 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.851666 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25507] 10:12:36.851848 <... mmap resumed> ) = 0x7f43504cf000
[pid 25502] 10:12:36.851916 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.852000 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.852040 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25520] 10:12:36.852178 read(14,  <unfinished ...>
[pid 25507] 10:12:36.852252 read(15,  <unfinished ...>
[pid 25502] 10:12:36.852319 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.852410 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.852461 <... stat resumed> 0x7ffd5c5fe9f0) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.852514 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25507] 10:12:36.852633 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:36.852724 <... open resumed> ) = 11
[pid 25523] 10:12:36.852771 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25522] 10:12:36.852884 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.853002 read(14,  <unfinished ...>
[pid 25507] 10:12:36.853075 close(15 <unfinished ...>
[pid 25502] 10:12:36.853186 fstat(11,  <unfinished ...>
[pid 25523] 10:12:36.853267 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.853326 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.853378 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25507] 10:12:36.853493 <... close resumed> ) = 0
[pid 25502] 10:12:36.853563 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.853866 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.853939 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25520] 10:12:36.854007 read(14,  <unfinished ...>
[pid 25507] 10:12:36.854065 munmap(0x7f43504cf000, 4096 <unfinished ...>
[pid 25502] 10:12:36.854129 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.854198 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.854252 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25520] 10:12:36.854498 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25507] 10:12:36.854571 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.854669 <... mmap resumed> ) = 0x7f3c0be4a000
[pid 25523] 10:12:36.854734 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25522] 10:12:36.854847 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.854933 read(14,  <unfinished ...>
[pid 25507] 10:12:36.854987 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25502] 10:12:36.855054 read(11,  <unfinished ...>
[pid 25523] 10:12:36.855136 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.855236 <... open resumed> ) = 6
[pid 25520] 10:12:36.855303 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25507] 10:12:36.855452 <... open resumed> ) = 15
[pid 25502] 10:12:36.855499 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.855582 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.855629 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.855692 read(14,  <unfinished ...>
[pid 25507] 10:12:36.855764 fstat(15,  <unfinished ...>
[pid 25502] 10:12:36.855867 close(11 <unfinished ...>
[pid 25523] 10:12:36.856006 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.856071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25520] 10:12:36.856320 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25507] 10:12:36.856441 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:36.856726 <... close resumed> ) = 0
[pid 25523] 10:12:36.856840 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.856921 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.856984 read(14,  <unfinished ...>
[pid 25507] 10:12:36.857043 fstat(15,  <unfinished ...>
[pid 25502] 10:12:36.857105 munmap(0x7f3c0be4a000, 4096 <unfinished ...>
[pid 25523] 10:12:36.857182 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.857237 <... mmap resumed> ) = 0x7f2e40b0b000
[pid 25520] 10:12:36.857292 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25507] 10:12:36.857422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:36.857682 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.857764 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.857864 close(6 <unfinished ...>
[pid 25520] 10:12:36.857942 read(14,  <unfinished ...>
[pid 25507] 10:12:36.858006 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.858072 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.858145 uname( <unfinished ...>
[pid 25522] 10:12:36.858197 <... close resumed> ) = 0
[pid 25520] 10:12:36.858265 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25507] 10:12:36.858401 <... mmap resumed> ) = 0x7f43504cf000
[pid 25502] 10:12:36.858461 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.858756 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25522] 10:12:36.858902 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.859038 read(14,  <unfinished ...>
[pid 25507] 10:12:36.859112 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:36.859177 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25523] 10:12:36.859303 getcwd( <unfinished ...>
[pid 25522] 10:12:36.859425 <... open resumed> ) = 6
[pid 25520] 10:12:36.859495 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25507] 10:12:36.859615 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.859692 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25523] 10:12:36.859978 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25522] 10:12:36.860028 read(6,  <unfinished ...>
[pid 25520] 10:12:36.860084 read(14,  <unfinished ...>
[pid 25507] 10:12:36.860147 read(15,  <unfinished ...>
[pid 25502] 10:12:36.860211 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25523] 10:12:36.860291 getpid( <unfinished ...>
[pid 25522] 10:12:36.860343 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.860425 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25507] 10:12:36.860552 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.860622 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.860954 <... getpid resumed> ) = 25523
[pid 25522] 10:12:36.861005 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.861061 read(14,  <unfinished ...>
[pid 25507] 10:12:36.861124 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:36.861191 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.861269 getppid( <unfinished ...>
[pid 25522] 10:12:36.861318 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.861580 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25507] 10:12:36.861657 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.861922 <... open resumed> ) = 11
[pid 25523] 10:12:36.861979 <... getppid resumed> ) = 25389
[pid 25522] 10:12:36.862045 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.862111 read(14,  <unfinished ...>
[pid 25507] 10:12:36.862178 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:36.862242 fstat(11,  <unfinished ...>
[pid 25523] 10:12:36.862314 stat(".",  <unfinished ...>
[pid 25522] 10:12:36.862374 <... mmap resumed> ) = 0x7f2e406dd000
[pid 25520] 10:12:36.862431 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25507] 10:12:36.862558 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.862890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.863181 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25522] 10:12:36.863519 mprotect(0x7f2e406f3000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.863588 read(14,  <unfinished ...>
[pid 25507] 10:12:36.863651 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:36.863719 fstat(11,  <unfinished ...>
[pid 25523] 10:12:36.863841 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.863981 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.864051 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25507] 10:12:36.864133 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.864399 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.864675 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.864939 mmap(0x7f2e408f3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25520] 10:12:36.865015 read(14,  <unfinished ...>
[pid 25507] 10:12:36.865073 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:36.865143 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.865217 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.865329 <... mmap resumed> ) = 0x7f2e408f3000
[pid 25520] 10:12:36.865403 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25507] 10:12:36.865526 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:36.865884 <... mmap resumed> ) = 0x7f3c0be4a000
[pid 25523] 10:12:36.865947 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.866201 mmap(0x7f2e408f5000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.866282 read(14,  <unfinished ...>
[pid 25507] 10:12:36.866344 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.866470 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.866553 geteuid( <unfinished ...>
[pid 25522] 10:12:36.866615 <... mmap resumed> ) = 0x7f2e408f5000
[pid 25520] 10:12:36.866682 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25507] 10:12:36.866762 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.867050 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.867102 <... geteuid resumed> ) = 503
[pid 25522] 10:12:36.867159 close(6 <unfinished ...>
[pid 25520] 10:12:36.867234 read(14,  <unfinished ...>
[pid 25507] 10:12:36.867304 write(8, "2015-12-30 10:12:36 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25502] 10:12:36.867381 read(11,  <unfinished ...>
[pid 25523] 10:12:36.867450 getegid( <unfinished ...>
[pid 25522] 10:12:36.867505 <... close resumed> ) = 0
[pid 25520] 10:12:36.867573 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25507] 10:12:36.867699 <... write resumed> ) = 101
[pid 25502] 10:12:36.867777 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25523] 10:12:36.867922 <... getegid resumed> ) = 500
[pid 25522] 10:12:36.867983 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.868114 read(14,  <unfinished ...>
[pid 25507] 10:12:36.868191 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.868317 read(11,  <unfinished ...>
[pid 25523] 10:12:36.868404 getuid( <unfinished ...>
[pid 25522] 10:12:36.868468 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.868530 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25507] 10:12:36.868668 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.868953 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.869031 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.869073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.869211 read(14,  <unfinished ...>
[pid 25507] 10:12:36.869284 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.869422 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.869518 getgid( <unfinished ...>
[pid 25522] 10:12:36.869570 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.869638 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25507] 10:12:36.869722 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.869987 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.870270 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.870321 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.870454 read(14,  <unfinished ...>
[pid 25507] 10:12:36.870535 close(7 <unfinished ...>
[pid 25502] 10:12:36.870604 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25523] 10:12:36.870736 access("/bin/sh", X_OK <unfinished ...>
[pid 25522] 10:12:36.870871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.870949 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25507] 10:12:36.871092 <... close resumed> ) = 0
[pid 25502] 10:12:36.871154 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25523] 10:12:36.871469 <... access resumed> ) = 0
[pid 25522] 10:12:36.871521 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.871650 read(14,  <unfinished ...>
[pid 25507] 10:12:36.871729 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25502] 10:12:36.871969 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25523] 10:12:36.872024 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.872136 <... open resumed> ) = 6
[pid 25520] 10:12:36.872208 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25507] 10:12:36.872344 <... open resumed> ) = 7
[pid 25502] 10:12:36.872423 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.872742 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.872982 read(6,  <unfinished ...>
[pid 25520] 10:12:36.873052 brk(0x11a3000 <unfinished ...>
[pid 25507] 10:12:36.873123 fcntl(7, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.873192 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.873280 geteuid( <unfinished ...>
[pid 25522] 10:12:36.873330 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.873415 <... brk resumed> ) = 0x11a3000
[pid 25507] 10:12:36.873503 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.873552 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.873896 <... geteuid resumed> ) = 503
[pid 25522] 10:12:36.873965 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.874037 read(14,  <unfinished ...>
[pid 25507] 10:12:36.874109 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.874177 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25523] 10:12:36.874260 getegid( <unfinished ...>
[pid 25522] 10:12:36.874314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.874586 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25507] 10:12:36.874727 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.874840 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.875177 <... getegid resumed> ) = 500
[pid 25522] 10:12:36.875223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.875309 read(14,  <unfinished ...>
[pid 25507] 10:12:36.875379 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.875459 stat("/etc/userdomains",  <unfinished ...>
[pid 25523] 10:12:36.875554 getuid( <unfinished ...>
[pid 25522] 10:12:36.875623 <... mmap resumed> ) = 0x7f2e40b0a000
[pid 25520] 10:12:36.875691 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25507] 10:12:36.875893 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5379683, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.876189 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.876480 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.876536 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.876618 read(14,  <unfinished ...>
[pid 25507] 10:12:36.876683 write(7, "2015-12-30 10:12:36 [25507] 1aEJMa-0006dD-AR ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25502] 10:12:36.876769 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.876883 getgid( <unfinished ...>
[pid 25522] 10:12:36.876962 <... mmap resumed> ) = 0x7f2e404c4000
[pid 25520] 10:12:36.877027 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25507] 10:12:36.877112 <... write resumed> ) = 110
[pid 25502] 10:12:36.877171 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.877544 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.877612 mprotect(0x7f2e404da000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.877688 read(14,  <unfinished ...>
[pid 25507] 10:12:36.877779 close(14 <unfinished ...>
[pid 25502] 10:12:36.877909 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.877998 access("/bin/sh", R_OK <unfinished ...>
[pid 25522] 10:12:36.878121 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.878198 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25507] 10:12:36.878331 <... close resumed> ) = 0
[pid 25502] 10:12:36.878415 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.878493 <... access resumed> ) = 0
[pid 25522] 10:12:36.878556 mmap(0x7f2e406d9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25520] 10:12:36.878644 read(14,  <unfinished ...>
[pid 25507] 10:12:36.878708 munmap(0x7f43504d0000, 4096 <unfinished ...>
[pid 25502] 10:12:36.878782 read(10,  <unfinished ...>
[pid 25523] 10:12:36.878905 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.879047 <... mmap resumed> ) = 0x7f2e406d9000
[pid 25520] 10:12:36.879127 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25507] 10:12:36.879263 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.879339 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25523] 10:12:36.879437 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.879709 mmap(0x7f2e406db000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.879834 read(14,  <unfinished ...>
[pid 25507] 10:12:36.879931 close(15 <unfinished ...>
[pid 25502] 10:12:36.880056 read(10,  <unfinished ...>
[pid 25523] 10:12:36.880146 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.880270 <... mmap resumed> ) = 0x7f2e406db000
[pid 25520] 10:12:36.880353 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25507] 10:12:36.880444 <... close resumed> ) = 0
[pid 25502] 10:12:36.880494 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.880609 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.880913 close(6 <unfinished ...>
[pid 25520] 10:12:36.880942 read(14,  <unfinished ...>
[pid 25507] 10:12:36.881013 munmap(0x7f43504cf000, 4096 <unfinished ...>
[pid 25502] 10:12:36.881089 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.881169 geteuid( <unfinished ...>
[pid 25522] 10:12:36.881226 <... close resumed> ) = 0
[pid 25520] 10:12:36.881303 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25507] 10:12:36.881488 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.881528 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25523] 10:12:36.881880 <... geteuid resumed> ) = 503
[pid 25522] 10:12:36.881953 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.882090 read(14,  <unfinished ...>
[pid 25507] 10:12:36.882172 close(10 <unfinished ...>
[pid 25502] 10:12:36.882245 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.882332 getegid( <unfinished ...>
[pid 25522] 10:12:36.882401 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.882466 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25507] 10:12:36.882554 <... close resumed> ) = 0
[pid 25502] 10:12:36.882614 <... open resumed> ) = 12
[pid 25523] 10:12:36.882691 <... getegid resumed> ) = 500
[pid 25522] 10:12:36.882755 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.882969 read(14,  <unfinished ...>
[pid 25507] 10:12:36.883055 munmap(0x7f43504d4000, 4096 <unfinished ...>
[pid 25502] 10:12:36.883131 fstat(12,  <unfinished ...>
[pid 25523] 10:12:36.883208 getuid( <unfinished ...>
[pid 25522] 10:12:36.883270 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.883340 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25507] 10:12:36.883493 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.883568 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25523] 10:12:36.883914 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.883999 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.884141 read(14,  <unfinished ...>
[pid 25507] 10:12:36.884223 close(11 <unfinished ...>
[pid 25502] 10:12:36.884296 fstat(12,  <unfinished ...>
[pid 25523] 10:12:36.884384 getgid( <unfinished ...>
[pid 25522] 10:12:36.884453 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.884525 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25507] 10:12:36.884652 <... close resumed> ) = 0
[pid 25502] 10:12:36.884739 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25523] 10:12:36.885044 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.885102 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.885244 read(14,  <unfinished ...>
[pid 25507] 10:12:36.885328 munmap(0x7f43504d3000, 4096 <unfinished ...>
[pid 25502] 10:12:36.885420 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.885497 access("/bin/sh", X_OK <unfinished ...>
[pid 25522] 10:12:36.885627 <... open resumed> ) = 6
[pid 25520] 10:12:36.885702 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25507] 10:12:36.885841 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.885931 <... mmap resumed> ) = 0x7f3c0be49000
[pid 25523] 10:12:36.886007 <... access resumed> ) = 0
[pid 25522] 10:12:36.886071 read(6,  <unfinished ...>
[pid 25520] 10:12:36.886152 read(14,  <unfinished ...>
[pid 25507] 10:12:36.886225 close(9 <unfinished ...>
[pid 25502] 10:12:36.886298 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.886402 stat("/bin/sh",  <unfinished ...>
[pid 25522] 10:12:36.886529 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.886615 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25507] 10:12:36.886742 <... close resumed> ) = 0
[pid 25502] 10:12:36.886879 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.886911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25522] 10:12:36.887199 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.887278 read(14,  <unfinished ...>
[pid 25507] 10:12:36.887348 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25502] 10:12:36.887426 read(12,  <unfinished ...>
[pid 25523] 10:12:36.887505 geteuid( <unfinished ...>
[pid 25522] 10:12:36.887567 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.887910 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25507] 10:12:36.887965 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.888020 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.888114 <... geteuid resumed> ) = 503
[pid 25522] 10:12:36.888167 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.888254 read(14,  <unfinished ...>
[pid 25507] 10:12:36.888324 close(13 <unfinished ...>
[pid 25502] 10:12:36.888468 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.888565 getegid( <unfinished ...>
[pid 25522] 10:12:36.888627 <... mmap resumed> ) = 0x7f2e4028d000
[pid 25520] 10:12:36.888697 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25507] 10:12:36.888899 <... close resumed> ) = 0
[pid 25502] 10:12:36.888929 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25523] 10:12:36.889251 <... getegid resumed> ) = 500
[pid 25522] 10:12:36.889299 mprotect(0x7f2e40294000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.889386 read(14,  <unfinished ...>
[pid 25507] 10:12:36.889456 munmap(0x7f43504d1000, 4096 <unfinished ...>
[pid 25502] 10:12:36.889539 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.889625 getuid( <unfinished ...>
[pid 25522] 10:12:36.889682 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.889762 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25507] 10:12:36.889903 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.889994 <... open resumed> ) = 13
[pid 25523] 10:12:36.890077 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.890143 mmap(0x7f2e40494000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25520] 10:12:36.890233 read(14,  <unfinished ...>
[pid 25507] 10:12:36.890301 close(12 <unfinished ...>
[pid 25502] 10:12:36.890438 fstat(13,  <unfinished ...>
[pid 25523] 10:12:36.890542 getgid( <unfinished ...>
[pid 25522] 10:12:36.890610 <... mmap resumed> ) = 0x7f2e40494000
[pid 25520] 10:12:36.890684 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25507] 10:12:36.890886 <... close resumed> ) = 0
[pid 25502] 10:12:36.890922 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.891223 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.891295 mmap(0x7f2e40496000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.891382 read(14,  <unfinished ...>
[pid 25507] 10:12:36.891456 munmap(0x7f43504d2000, 4096 <unfinished ...>
[pid 25502] 10:12:36.891529 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.891617 access("/bin/sh", R_OK <unfinished ...>
[pid 25522] 10:12:36.891748 <... mmap resumed> ) = 0x7f2e40496000
[pid 25520] 10:12:36.891879 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25507] 10:12:36.892032 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.892087 <... mmap resumed> ) = 0x7f3c0be48000
[pid 25523] 10:12:36.892142 <... access resumed> ) = 0
[pid 25522] 10:12:36.892227 close(6 <unfinished ...>
[pid 25520] 10:12:36.892288 read(14,  <unfinished ...>
[pid 25507] 10:12:36.892369 geteuid( <unfinished ...>
[pid 25502] 10:12:36.892447 read(13,  <unfinished ...>
[pid 25523] 10:12:36.892543 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.892744 <... close resumed> ) = 0
[pid 25520] 10:12:36.892924 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25507] 10:12:36.893073 <... geteuid resumed> ) = 0
[pid 25502] 10:12:36.893168 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.893267 <... socket resumed> ) = 5
[pid 25522] 10:12:36.893322 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.893471 read(14,  <unfinished ...>
[pid 25507] 10:12:36.893567 getegid( <unfinished ...>
[pid 25502] 10:12:36.893633 close(13 <unfinished ...>
[pid 25523] 10:12:36.893781 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.893927 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.894005 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25507] 10:12:36.894095 <... getegid resumed> ) = 12
[pid 25502] 10:12:36.894158 <... close resumed> ) = 0
[pid 25523] 10:12:36.894184 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.894263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.894364 read(14,  <unfinished ...>
[pid 25507] 10:12:36.894454 setgid(12 <unfinished ...>
[pid 25502] 10:12:36.894549 munmap(0x7f3c0be48000, 4096 <unfinished ...>
[pid 25523] 10:12:36.894637 close(5 <unfinished ...>
[pid 25522] 10:12:36.894765 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.894890 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25507] 10:12:36.894993 <... setgid resumed> ) = 0
[pid 25502] 10:12:36.895032 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.895140 <... close resumed> ) = 0
[pid 25522] 10:12:36.895184 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.895330 read(14,  <unfinished ...>
[pid 25507] 10:12:36.895417 setuid(47 <unfinished ...>
[pid 25502] 10:12:36.895489 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.895578 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.895782 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.895923 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25507] 10:12:36.896076 <... setuid resumed> ) = 0
[pid 25502] 10:12:36.896174 <... open resumed> ) = 13
[pid 25523] 10:12:36.896250 <... socket resumed> ) = 5
[pid 25522] 10:12:36.896267 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.896302 read(14,  <unfinished ...>
[pid 25507] 10:12:36.896326 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f434e0d56a0},  <unfinished ...>
[pid 25502] 10:12:36.896358 fstat(13,  <unfinished ...>
[pid 25523] 10:12:36.896403 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.896440 <... open resumed> ) = 6
[pid 25520] 10:12:36.896460 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25507] 10:12:36.896614 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:36.896721 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.897028 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.897090 read(6,  <unfinished ...>
[pid 25520] 10:12:36.897171 read(14,  <unfinished ...>
[pid 25507] 10:12:36.897243 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25502] 10:12:36.897279 fstat(13,  <unfinished ...>
[pid 25523] 10:12:36.897312 close(5 <unfinished ...>
[pid 25522] 10:12:36.897341 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.897366 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25507] 10:12:36.897445 <... write resumed> ) = 36
[pid 25502] 10:12:36.897470 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.897512 <... close resumed> ) = 0
[pid 25522] 10:12:36.897536 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.897561 read(14,  <unfinished ...>
[pid 25507] 10:12:36.897585 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.897612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.897647 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.897676 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.897708 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25507] 10:12:36.897850 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.898250 <... mmap resumed> ) = 0x7f3c0be48000
[pid 25523] 10:12:36.898322 <... open resumed> ) = 5
[pid 25522] 10:12:36.898408 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.898497 read(14,  <unfinished ...>
[pid 25507] 10:12:36.898533 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:36.898615 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.898646 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.898668 <... mmap resumed> ) = 0x7f2e40009000
[pid 25520] 10:12:36.898684 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25507] 10:12:36.898759 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:36.898853 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.898885 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25522] 10:12:36.898916 mprotect(0x7f2e4008c000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.898944 read(14,  <unfinished ...>
[pid 25507] 10:12:36.898968 close(7 <unfinished ...>
[pid 25502] 10:12:36.898992 read(13,  <unfinished ...>
[pid 25523] 10:12:36.899027 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.899053 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.899069 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25507] 10:12:36.899141 <... close resumed> ) = 0
[pid 25502] 10:12:36.899165 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25523] 10:12:36.899198 <... mmap resumed> ) = 0x7f7d7f603000
[pid 25522] 10:12:36.899216 mmap(0x7f2e4028b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25520] 10:12:36.899245 read(14,  <unfinished ...>
[pid 25507] 10:12:36.899269 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25502] 10:12:36.899303 read(13,  <unfinished ...>
[pid 25523] 10:12:36.899334 read(5,  <unfinished ...>
[pid 25522] 10:12:36.899360 <... mmap resumed> ) = 0x7f2e4028b000
[pid 25520] 10:12:36.899385 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25507] 10:12:36.899464 <... open resumed> ) = 7
[pid 25502] 10:12:36.899486 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.899523 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25522] 10:12:36.899561 close(6 <unfinished ...>
[pid 25520] 10:12:36.899585 read(14,  <unfinished ...>
[pid 25507] 10:12:36.899610 fcntl(7, F_GETFD <unfinished ...>
[pid 25502] 10:12:36.899632 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25523] 10:12:36.899672 read(5,  <unfinished ...>
[pid 25522] 10:12:36.899695 <... close resumed> ) = 0
[pid 25520] 10:12:36.899719 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25507] 10:12:36.899748 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.899765 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25523] 10:12:36.899893 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:36.899917 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.899949 read(14,  <unfinished ...>
[pid 25507] 10:12:36.899974 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:36.899997 stat("/usr/local/cpanel/3rdparty/mailman/lists/ljacques_westernskiesgolf.com/config.pck",  <unfinished ...>
[pid 25523] 10:12:36.900037 close(5 <unfinished ...>
[pid 25522] 10:12:36.900061 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.900079 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25507] 10:12:36.900157 <... fcntl resumed> ) = 0
[pid 25502] 10:12:36.900178 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.900215 <... close resumed> ) = 0
[pid 25522] 10:12:36.900234 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.900270 read(14,  <unfinished ...>
[pid 25507] 10:12:36.900294 fstat(7,  <unfinished ...>
[pid 25502] 10:12:36.900316 stat("/etc/demouids",  <unfinished ...>
[pid 25523] 10:12:36.900351 munmap(0x7f7d7f603000, 4096 <unfinished ...>
[pid 25522] 10:12:36.900382 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.900408 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25507] 10:12:36.900440 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5379793, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.900491 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.900554 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.900587 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.900625 brk(0x11c4000 <unfinished ...>
[pid 25507] 10:12:36.900649 write(7, "2015-12-30 10:12:36 [25507] 1aEJMa-0006dD-AR Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25502] 10:12:36.900679 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.900716 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.900745 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.900766 <... brk resumed> ) = 0x11c4000
[pid 25507] 10:12:36.900914 <... write resumed> ) = 77
[pid 25502] 10:12:36.900943 <... open resumed> ) = 14
[pid 25523] 10:12:36.900969 <... open resumed> ) = 5
[pid 25522] 10:12:36.900985 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.901019 read(14,  <unfinished ...>
[pid 25507] 10:12:36.901043 open("/var/spool/exim/input/a/hdr.25507", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25502] 10:12:36.901113 fstat(14,  <unfinished ...>
[pid 25523] 10:12:36.901146 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.901168 <... open resumed> ) = 6
[pid 25520] 10:12:36.901183 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25507] 10:12:36.901214 <... open resumed> ) = 9
[pid 25502] 10:12:36.901231 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.901272 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25522] 10:12:36.901300 read(6,  <unfinished ...>
[pid 25520] 10:12:36.901323 read(14,  <unfinished ...>
[pid 25507] 10:12:36.901347 fchown(9, 47, 12 <unfinished ...>
[pid 25502] 10:12:36.901379 fstat(14,  <unfinished ...>
[pid 25523] 10:12:36.901410 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.901436 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.901459 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25507] 10:12:36.901538 <... fchown resumed> ) = 0
[pid 25502] 10:12:36.901558 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.901595 <... mmap resumed> ) = 0x7f7d7f5fa000
[pid 25522] 10:12:36.901612 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.901634 read(14,  <unfinished ...>
[pid 25507] 10:12:36.901658 fchmod(9, 0640 <unfinished ...>
[pid 25502] 10:12:36.901683 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.901717 close(5 <unfinished ...>
[pid 25522] 10:12:36.901745 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25520] 10:12:36.901773 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25507] 10:12:36.901910 <... fchmod resumed> ) = 0
[pid 25502] 10:12:36.901933 <... mmap resumed> ) = 0x7f3c0be47000
[pid 25523] 10:12:36.901959 <... close resumed> ) = 0
[pid 25522] 10:12:36.901986 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.902014 read(14,  <unfinished ...>
[pid 25507] 10:12:36.902037 fcntl(9, F_GETFL <unfinished ...>
[pid 25502] 10:12:36.902059 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.902090 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.902123 <... mmap resumed> ) = 0x7f2e40b09000
[pid 25520] 10:12:36.902143 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25507] 10:12:36.902222 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25502] 10:12:36.902245 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.902270 <... open resumed> ) = 5
[pid 25522] 10:12:36.902287 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.902315 read(14,  <unfinished ...>
[pid 25507] 10:12:36.902339 fstat(9,  <unfinished ...>
[pid 25502] 10:12:36.902361 read(14,  <unfinished ...>
[pid 25523] 10:12:36.902405 read(5,  <unfinished ...>
[pid 25522] 10:12:36.902429 <... mmap resumed> ) = 0x7f2e3fdfb000
[pid 25520] 10:12:36.902449 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25507] 10:12:36.902529 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080166, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.902563 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.902598 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.902623 mprotect(0x7f2e3fe07000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.902652 read(14,  <unfinished ...>
[pid 25507] 10:12:36.902675 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:36.902701 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25523] 10:12:36.902738 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.902761 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.902776 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25507] 10:12:36.902952 <... mmap resumed> ) = 0x7f43504d5000
[pid 25502] 10:12:36.902976 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25523] 10:12:36.903142 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.903188 mmap(0x7f2e40007000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25520] 10:12:36.903222 read(14,  <unfinished ...>
[pid 25507] 10:12:36.903246 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25502] 10:12:36.903269 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.903306 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.903336 <... mmap resumed> ) = 0x7f2e40007000
[pid 25520] 10:12:36.903362 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25507] 10:12:36.903450 <... lseek resumed> ) = 0
[pid 25502] 10:12:36.903493 <... open resumed> ) = 15
[pid 25523] 10:12:36.903522 <... mmap resumed> ) = 0x7f7d7ea1f000
[pid 25522] 10:12:36.903540 close(6 <unfinished ...>
[pid 25520] 10:12:36.903563 read(14,  <unfinished ...>
[pid 25507] 10:12:36.903586 write(9, "1aEJMa-0006dD-AR-H\nmailnull 47 12\n<>\n1451491956 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491956\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25502] 10:12:36.903632 fstat(15,  <unfinished ...>
[pid 25523] 10:12:36.903668 mprotect(0x7f7d7ea2b000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.903704 <... close resumed> ) = 0
[pid 25520] 10:12:36.903731 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25507] 10:12:36.903764 <... write resumed> ) = 268
[pid 25502] 10:12:36.903782 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.903895 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.903912 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.903948 read(14,  <unfinished ...>
[pid 25507] 10:12:36.903973 fstat(9,  <unfinished ...>
[pid 25502] 10:12:36.903995 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.904030 mmap(0x7f7d7ec2b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25522] 10:12:36.904058 <... open resumed> ) = 6
[pid 25520] 10:12:36.904073 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25507] 10:12:36.904168 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080166, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.904214 <... mmap resumed> ) = 0x7f3c0be46000
[pid 25523] 10:12:36.904240 <... mmap resumed> ) = 0x7f7d7ec2b000
[pid 25522] 10:12:36.904266 read(6,  <unfinished ...>
[pid 25520] 10:12:36.904292 read(14,  <unfinished ...>
[pid 25507] 10:12:36.904316 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMa-0006dD-AR\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:36 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692 <unfinished ...>
[pid 25502] 10:12:36.904346 read(15,  <unfinished ...>
[pid 25523] 10:12:36.904381 close(5 <unfinished ...>
[pid 25522] 10:12:36.904404 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.904427 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25507] 10:12:36.904456 <... write resumed> ) = 692
[pid 25502] 10:12:36.904480 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.904516 <... close resumed> ) = 0
[pid 25522] 10:12:36.904549 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.904574 read(14,  <unfinished ...>
[pid 25507] 10:12:36.904598 fsync(9 <unfinished ...>
[pid 25502] 10:12:36.904669 close(15 <unfinished ...>
[pid 25523] 10:12:36.904873 mprotect(0x7f7d7ec2b000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.904892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25520] 10:12:36.904915 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25502] 10:12:36.905021 <... close resumed> ) = 0
[pid 25523] 10:12:36.905051 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.905071 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.905100 read(14,  <unfinished ...>
[pid 25507] 10:12:36.905124 <... fsync resumed> ) = 0
[pid 25502] 10:12:36.905140 munmap(0x7f3c0be46000, 4096 <unfinished ...>
[pid 25523] 10:12:36.905176 munmap(0x7f7d7f5fa000, 39387 <unfinished ...>
[pid 25522] 10:12:36.905202 <... mmap resumed> ) = 0x7f2e3fbd8000
[pid 25520] 10:12:36.905219 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25507] 10:12:36.905249 fstat(9,  <unfinished ...>
[pid 25502] 10:12:36.905278 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.905352 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.905383 mprotect(0x7f2e3fbf9000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.905414 read(14,  <unfinished ...>
[pid 25507] 10:12:36.905438 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080166, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:36.905469 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25523] 10:12:36.905504 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:36.905533 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.905549 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25507] 10:12:36.905637 close(9 <unfinished ...>
[pid 25502] 10:12:36.905673 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25523] 10:12:36.905734 <... open resumed> ) = 5
[pid 25522] 10:12:36.905757 mmap(0x7f2e3fdf9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25520] 10:12:36.905863 read(14,  <unfinished ...>
[pid 25507] 10:12:36.905896 <... close resumed> ) = 0
[pid 25502] 10:12:36.905913 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.905951 fcntl(5, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.905974 <... mmap resumed> ) = 0x7f2e3fdf9000
[pid 25520] 10:12:36.905995 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25507] 10:12:36.906028 munmap(0x7f43504d5000, 4096 <unfinished ...>
[pid 25502] 10:12:36.906058 <... open resumed> ) = 15
[pid 25523] 10:12:36.906083 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25522] 10:12:36.906104 close(6 <unfinished ...>
[pid 25520] 10:12:36.906127 read(14,  <unfinished ...>
[pid 25507] 10:12:36.906151 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.906174 fstat(15,  <unfinished ...>
[pid 25523] 10:12:36.906206 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.906228 <... close resumed> ) = 0
[pid 25520] 10:12:36.906251 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25507] 10:12:36.906329 rename("/var/spool/exim/input/a/hdr.25507", "/var/spool/exim/input/a/1aEJMa-0006dD-AR-H" <unfinished ...>
[pid 25502] 10:12:36.906422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.906461 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:36.906491 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.906523 read(14,  <unfinished ...>
[pid 25507] 10:12:36.906546 <... rename resumed> ) = 0
[pid 25502] 10:12:36.906564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.906611 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.906645 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.906663 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25507] 10:12:36.906695 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25502] 10:12:36.906728 <... mmap resumed> ) = 0x7f3c0be46000
[pid 25523] 10:12:36.906752 <... mmap resumed> ) = 0x7f7d7f603000
[pid 25522] 10:12:36.906769 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.906887 read(14,  <unfinished ...>
[pid 25507] 10:12:36.906913 <... open resumed> ) = 9
[pid 25502] 10:12:36.906929 read(15,  <unfinished ...>
[pid 25523] 10:12:36.906965 read(5,  <unfinished ...>
[pid 25522] 10:12:36.906991 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.907009 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25507] 10:12:36.907092 fsync(9 <unfinished ...>
[pid 25502] 10:12:36.907120 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.907156 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:36.907192 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.907225 read(14,  <unfinished ...>
[pid 25507] 10:12:36.907249 <... fsync resumed> ) = 0
[pid 25502] 10:12:36.907265 close(15 <unfinished ...>
[pid 25523] 10:12:36.907298 close(5 <unfinished ...>
[pid 25522] 10:12:36.907321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.907341 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25507] 10:12:36.907424 close(9 <unfinished ...>
[pid 25502] 10:12:36.907452 <... close resumed> ) = 0
[pid 25523] 10:12:36.907478 <... close resumed> ) = 0
[pid 25522] 10:12:36.907494 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.907528 read(14,  <unfinished ...>
[pid 25507] 10:12:36.907552 <... close resumed> ) = 0
[pid 25502] 10:12:36.907569 munmap(0x7f3c0be46000, 4096 <unfinished ...>
[pid 25523] 10:12:36.907605 munmap(0x7f7d7f603000, 4096 <unfinished ...>
[pid 25522] 10:12:36.907630 <... open resumed> ) = 6
[pid 25520] 10:12:36.907646 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25507] 10:12:36.907674 close(8 <unfinished ...>
[pid 25502] 10:12:36.907700 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.907740 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.907878 read(6,  <unfinished ...>
[pid 25520] 10:12:36.907911 read(14,  <unfinished ...>
[pid 25507] 10:12:36.907936 <... close resumed> ) = 0
[pid 25502] 10:12:36.907952 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.908006 getpgrp( <unfinished ...>
[pid 25522] 10:12:36.908030 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.908053 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25507] 10:12:36.908137 munmap(0x7f43504d6000, 4096 <unfinished ...>
[pid 25502] 10:12:36.908169 <... open resumed> ) = 15
[pid 25523] 10:12:36.908194 <... getpgrp resumed> ) = 29163
[pid 25522] 10:12:36.908212 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.908235 read(14,  <unfinished ...>
[pid 25507] 10:12:36.908259 <... munmap resumed> ) = 0
[pid 25502] 10:12:36.908285 fstat(15,  <unfinished ...>
[pid 25523] 10:12:36.908317 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.908347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.908379 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25507] 10:12:36.908410 unlink("/var/spool/exim/input/a/1aEJMa-0006dD-AR-J" <unfinished ...>
[pid 25502] 10:12:36.908442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.908479 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.908504 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.908534 read(14,  <unfinished ...>
[pid 25507] 10:12:36.908558 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:36.908576 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.908610 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25522] 10:12:36.908632 <... mmap resumed> ) = 0x7f2e3f9bb000
[pid 25520] 10:12:36.908648 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25507] 10:12:36.908731 close(6 <unfinished ...>
[pid 25502] 10:12:36.908763 <... mmap resumed> ) = 0x7f3c0be46000
[pid 25523] 10:12:36.908865 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25522] 10:12:36.908953 mprotect(0x7f2e3f9d2000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.908993 read(14,  <unfinished ...>
[pid 25507] 10:12:36.909017 <... close resumed> ) = 0
[pid 25502] 10:12:36.909167 read(15,  <unfinished ...>
[pid 25523] 10:12:36.909207 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.909230 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.909246 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25507] 10:12:36.909327 exit_group(0) = ?
[pid 25502] 10:12:36.909959 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.910064 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.910098 mmap(0x7f2e3fbd2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25520] 10:12:36.910132 read(14,  <unfinished ...>
[pid 25507] 10:12:36.910155 +++ exited with 0 +++
[pid 25502] 10:12:36.910167 close(15 <unfinished ...>
[pid 25523] 10:12:36.910198 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.910220 <... mmap resumed> ) = 0x7f2e3fbd2000
[pid 25520] 10:12:36.910242 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25502] 10:12:36.910328 <... close resumed> ) = 0
[pid 25523] 10:12:36.910354 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.910384 mmap(0x7f2e3fbd4000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.910414 read(14,  <unfinished ...>
[pid 25502] 10:12:36.910438 munmap(0x7f3c0be46000, 4096 <unfinished ...>
[pid 25523] 10:12:36.910471 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25522] 10:12:36.910495 <... mmap resumed> ) = 0x7f2e3fbd4000
[pid 25520] 10:12:36.910516 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25502] 10:12:36.910601 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.910732 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25522] 10:12:36.910884 close(6 <unfinished ...>
[pid 25520] 10:12:36.910916 read(14,  <unfinished ...>
[pid 25502] 10:12:36.910940 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.910978 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.911006 <... close resumed> ) = 0
[pid 25520] 10:12:36.911031 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25502] 10:12:36.911066 <... open resumed> ) = 15
[pid 25523] 10:12:36.911092 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.911112 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.911144 read(14,  <unfinished ...>
[pid 25502] 10:12:36.911168 fstat(15,  <unfinished ...>
[pid 25523] 10:12:36.911203 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.911229 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.911246 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25502] 10:12:36.911327 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.911374 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.911395 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.911439 read(14,  <unfinished ...>
[pid 25502] 10:12:36.911471 fstat(15,  <unfinished ...>
[pid 25523] 10:12:36.911501 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0},  <unfinished ...>
[pid 25522] 10:12:36.911527 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.911544 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25502] 10:12:36.911628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.911668 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f7d7ec5f6a0}, 8) = 0
[pid 25522] 10:12:36.911692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.911724 read(14,  <unfinished ...>
[pid 25502] 10:12:36.911748 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.911781 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25522] 10:12:36.912130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.912155 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25502] 10:12:36.912244 <... mmap resumed> ) = 0x7f3c0be46000
[pid 25522] 10:12:36.912274 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.912305 read(14,  <unfinished ...>
[pid 25502] 10:12:36.912329 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.912358 <... execve resumed> ) = 0
[pid 25522] 10:12:36.912391 <... open resumed> ) = 6
[pid 25520] 10:12:36.912409 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25502] 10:12:36.912478 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.912506 brk(0 <unfinished ...>
[pid 25522] 10:12:36.912530 read(6,  <unfinished ...>
[pid 25520] 10:12:36.912553 brk(0x11e5000 <unfinished ...>
[pid 25502] 10:12:36.912576 read(15,  <unfinished ...>
[pid 25523] 10:12:36.912609 <... brk resumed> ) = 0x824000
[pid 25522] 10:12:36.912629 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.912654 <... brk resumed> ) = 0x11e5000
[pid 25502] 10:12:36.912690 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25523] 10:12:36.912720 fcntl(0, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.912744 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.912767 read(14,  <unfinished ...>
[pid 25502] 10:12:36.912893 read(15,  <unfinished ...>
[pid 25523] 10:12:36.912931 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.912947 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25520] 10:12:36.912979 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25502] 10:12:36.913010 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.913109 fcntl(1, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.913140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.913167 read(14,  <unfinished ...>
[pid 25502] 10:12:36.913190 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.913220 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.913236 <... mmap resumed> ) = 0x7f2e40b08000
[pid 25520] 10:12:36.913256 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25502] 10:12:36.913361 <... lseek resumed> ) = 353
[pid 25523] 10:12:36.913395 fcntl(2, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.913420 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.913449 read(14,  <unfinished ...>
[pid 25502] 10:12:36.913475 read(9,  <unfinished ...>
[pid 25523] 10:12:36.913505 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.913526 <... mmap resumed> ) = 0x7f2e3f647000
[pid 25520] 10:12:36.913543 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25502] 10:12:36.913623 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.913682 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25522] 10:12:36.913722 mprotect(0x7f2e3f7b6000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.913750 read(14,  <unfinished ...>
[pid 25502] 10:12:36.913774 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25523] 10:12:36.913880 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.913913 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.913930 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25502] 10:12:36.914004 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.914031 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.914059 mmap(0x7f2e3f9b5000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25520] 10:12:36.914088 read(14,  <unfinished ...>
[pid 25502] 10:12:36.914111 read(9,  <unfinished ...>
[pid 25523] 10:12:36.914141 <... mmap resumed> ) = 0x7f3ec584f000
[pid 25522] 10:12:36.914164 <... mmap resumed> ) = 0x7f2e3f9b5000
[pid 25520] 10:12:36.914189 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25502] 10:12:36.914221 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25523] 10:12:36.914281 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25522] 10:12:36.914315 close(6 <unfinished ...>
[pid 25520] 10:12:36.914338 read(14,  <unfinished ...>
[pid 25502] 10:12:36.914361 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.914403 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.914426 <... close resumed> ) = 0
[pid 25520] 10:12:36.914451 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25502] 10:12:36.914524 <... stat resumed> 0x7f3c0a4ea880) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.914565 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.914599 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.914636 read(14,  <unfinished ...>
[pid 25502] 10:12:36.914673 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25523] 10:12:36.914707 <... open resumed> ) = 5
[pid 25522] 10:12:36.914728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.914753 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25502] 10:12:36.914939 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25523] 10:12:36.915027 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.915068 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.915123 read(14,  <unfinished ...>
[pid 25502] 10:12:36.915160 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.915224 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25522] 10:12:36.915275 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.915302 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25502] 10:12:36.915352 <... open resumed> ) = 16
[pid 25523] 10:12:36.915398 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.915442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.915492 read(14,  <unfinished ...>
[pid 25502] 10:12:36.915530 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25523] 10:12:36.915580 <... mmap resumed> ) = 0x7f3ec5845000
[pid 25522] 10:12:36.915607 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.915643 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25502] 10:12:36.915993 <... ioctl resumed> , 0x7ffced97a4d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:36.916047 close(5 <unfinished ...>
[pid 25522] 10:12:36.916086 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.916141 read(14,  <unfinished ...>
[pid 25502] 10:12:36.916180 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25523] 10:12:36.916227 <... close resumed> ) = 0
[pid 25522] 10:12:36.916270 <... open resumed> ) = 6
[pid 25520] 10:12:36.916298 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25502] 10:12:36.916345 <... lseek resumed> ) = 0
[pid 25523] 10:12:36.916391 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.916442 read(6,  <unfinished ...>
[pid 25520] 10:12:36.916478 read(14,  <unfinished ...>
[pid 25502] 10:12:36.916519 fstat(16,  <unfinished ...>
[pid 25523] 10:12:36.916569 <... open resumed> ) = 5
[pid 25522] 10:12:36.916594 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.916642 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25502] 10:12:36.916877 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25523] 10:12:36.916948 read(5,  <unfinished ...>
[pid 25522] 10:12:36.916989 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.917026 read(14,  <unfinished ...>
[pid 25502] 10:12:36.917064 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.917113 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.917152 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25520] 10:12:36.917285 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25502] 10:12:36.917463 <... fcntl resumed> ) = 0
[pid 25523] 10:12:36.917511 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.917549 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.917598 read(14,  <unfinished ...>
[pid 25502] 10:12:36.917640 fstat(16,  <unfinished ...>
[pid 25523] 10:12:36.917698 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.917751 <... mmap resumed> ) = 0x7f2e3f3b8000
[pid 25520] 10:12:36.917776 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25502] 10:12:36.918023 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25523] 10:12:36.918116 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.918168 mprotect(0x7f2e3f443000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.918224 read(14,  <unfinished ...>
[pid 25502] 10:12:36.918260 read(16,  <unfinished ...>
[pid 25523] 10:12:36.918315 <... mmap resumed> ) = 0x7f3ec529d000
[pid 25522] 10:12:36.918341 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.918371 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25502] 10:12:36.918533 <... read resumed> "0", 8192) = 1
[pid 25523] 10:12:36.918582 mprotect(0x7f3ec5427000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.918631 mmap(0x7f2e3f643000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25520] 10:12:36.918669 read(14,  <unfinished ...>
[pid 25502] 10:12:36.918702 read(16,  <unfinished ...>
[pid 25523] 10:12:36.918733 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.918749 <... mmap resumed> ) = 0x7f2e3f643000
[pid 25520] 10:12:36.918771 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25502] 10:12:36.918880 <... read resumed> "", 8192) = 0
[pid 25523] 10:12:36.918917 mmap(0x7f3ec5627000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25522] 10:12:36.918950 mmap(0x7f2e3f646000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.918978 read(14,  <unfinished ...>
[pid 25502] 10:12:36.919002 close(16 <unfinished ...>
[pid 25523] 10:12:36.919033 <... mmap resumed> ) = 0x7f3ec5627000
[pid 25522] 10:12:36.919055 <... mmap resumed> ) = 0x7f2e3f646000
[pid 25520] 10:12:36.919078 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25502] 10:12:36.919895 <... close resumed> ) = 0
[pid 25523] 10:12:36.920021 mmap(0x7f3ec562c000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.920065 close(6 <unfinished ...>
[pid 25520] 10:12:36.920089 read(14,  <unfinished ...>
[pid 25502] 10:12:36.920114 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.920156 <... mmap resumed> ) = 0x7f3ec562c000
[pid 25522] 10:12:36.920179 <... close resumed> ) = 0
[pid 25520] 10:12:36.920208 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25502] 10:12:36.920309 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25523] 10:12:36.920374 close(5 <unfinished ...>
[pid 25522] 10:12:36.920402 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.920435 read(14,  <unfinished ...>
[pid 25502] 10:12:36.920459 stat("/etc/localtime",  <unfinished ...>
[pid 25523] 10:12:36.920497 <... close resumed> ) = 0
[pid 25522] 10:12:36.920529 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.920549 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25502] 10:12:36.920643 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:36.920698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.920736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.920773 read(14,  <unfinished ...>
[pid 25502] 10:12:36.920797 stat("/etc/localtime",  <unfinished ...>
[pid 25523] 10:12:36.920829 <... mmap resumed> ) = 0x7f3ec5844000
[pid 25522] 10:12:36.920852 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.920870 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25502] 10:12:36.920958 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:36.921002 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.921030 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.921060 read(14,  <unfinished ...>
[pid 25502] 10:12:36.921084 close(7 <unfinished ...>
[pid 25523] 10:12:36.921116 <... mmap resumed> ) = 0x7f3ec5843000
[pid 25522] 10:12:36.921135 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.921156 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25502] 10:12:36.921233 <... close resumed> ) = 0
[pid 25523] 10:12:36.921263 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.921290 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.921324 read(14,  <unfinished ...>
[pid 25502] 10:12:36.921348 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25523] 10:12:36.921388 <... mmap resumed> ) = 0x7f3ec5842000
[pid 25522] 10:12:36.921407 <... open resumed> ) = 6
[pid 25520] 10:12:36.921424 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25502] 10:12:36.921513 <... open resumed> ) = 7
[pid 25523] 10:12:36.921532 arch_prctl(ARCH_SET_FS, 0x7f3ec5843700 <unfinished ...>
[pid 25522] 10:12:36.921543 read(6,  <unfinished ...>
[pid 25520] 10:12:36.921552 read(14,  <unfinished ...>
[pid 25502] 10:12:36.921563 fcntl(7, F_GETFD <unfinished ...>
[pid 25523] 10:12:36.921579 <... arch_prctl resumed> ) = 0
[pid 25522] 10:12:36.921664 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.921679 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25502] 10:12:36.921699 <... fcntl resumed> ) = 0
[pid 25523] 10:12:36.921718 mprotect(0x7f3ec5627000, 16384, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.921732 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.921741 read(14,  <unfinished ...>
[pid 25502] 10:12:36.921751 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.921766 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.921780 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25520] 10:12:36.921806 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25502] 10:12:36.921883 <... fcntl resumed> ) = 0
[pid 25523] 10:12:36.921902 mprotect(0x7f3ec5850000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.921916 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.921935 read(14,  <unfinished ...>
[pid 25502] 10:12:36.921951 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.921977 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.921991 <... mmap resumed> ) = 0x7f2e3f1b2000
[pid 25520] 10:12:36.922004 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25502] 10:12:36.922033 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5379870, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.922075 munmap(0x7f3ec5845000, 39387 <unfinished ...>
[pid 25522] 10:12:36.922099 mprotect(0x7f2e3f1b8000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.922120 read(14,  <unfinished ...>
[pid 25502] 10:12:36.922133 write(7, "2015-12-30 10:12:36 [25502] 1aEJMa-0006dB-67 SMTP connection outbound 1451491956 1aEJMa-0006dB-67 finestweddingsites.com ljacques@westernskiesgolf.com\n", 151 <unfinished ...>
[pid 25523] 10:12:36.922160 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.922207 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.922219 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25502] 10:12:36.922294 <... write resumed> ) = 151
[pid 25523] 10:12:36.922360 getuid( <unfinished ...>
[pid 25522] 10:12:36.922373 mmap(0x7f2e3f3b7000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25520] 10:12:36.922389 read(14,  <unfinished ...>
[pid 25502] 10:12:36.922399 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25523] 10:12:36.922429 <... getuid resumed> ) = 503
[pid 25522] 10:12:36.922440 <... mmap resumed> ) = 0x7f2e3f3b7000
[pid 25520] 10:12:36.922456 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25502] 10:12:36.922532 <... open resumed> ) = 16
[pid 25523] 10:12:36.922553 getgid( <unfinished ...>
[pid 25522] 10:12:36.922563 close(6 <unfinished ...>
[pid 25520] 10:12:36.922571 read(14,  <unfinished ...>
[pid 25502] 10:12:36.922581 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25523] 10:12:36.922597 <... getgid resumed> ) = 500
[pid 25522] 10:12:36.922606 <... close resumed> ) = 0
[pid 25520] 10:12:36.922622 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25502] 10:12:36.922967 <... lseek resumed> ) = 15
[pid 25523] 10:12:36.923001 getegid( <unfinished ...>
[pid 25522] 10:12:36.923026 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.923059 brk(0x1206000 <unfinished ...>
[pid 25502] 10:12:36.923083 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25523] 10:12:36.923116 <... getegid resumed> ) = 499
[pid 25522] 10:12:36.923134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.923152 <... brk resumed> ) = 0x1206000
[pid 25502] 10:12:36.923183 <... ioctl resumed> , 0x7ffced97a4d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:36.923210 getppid( <unfinished ...>
[pid 25522] 10:12:36.923233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.923269 read(14,  <unfinished ...>
[pid 25502] 10:12:36.923293 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25523] 10:12:36.923322 <... getppid resumed> ) = 25389
[pid 25522] 10:12:36.923341 <... open resumed> ) = 6
[pid 25520] 10:12:36.923358 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25502] 10:12:36.923392 <... lseek resumed> ) = 15
[pid 25523] 10:12:36.923417 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25522] 10:12:36.923451 read(6,  <unfinished ...>
[pid 25520] 10:12:36.923477 read(14,  <unfinished ...>
[pid 25502] 10:12:36.923501 fstat(16,  <unfinished ...>
[pid 25523] 10:12:36.923530 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25522] 10:12:36.923602 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.923628 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25502] 10:12:36.923707 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=15, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.923837 brk(0 <unfinished ...>
[pid 25522] 10:12:36.923863 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.923885 read(14,  <unfinished ...>
[pid 25502] 10:12:36.923909 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.923938 <... brk resumed> ) = 0x824000
[pid 25522] 10:12:36.923954 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25520] 10:12:36.923983 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25502] 10:12:36.924074 <... fcntl resumed> ) = 0
[pid 25523] 10:12:36.924115 brk(0x845000 <unfinished ...>
[pid 25522] 10:12:36.924142 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.924169 read(14,  <unfinished ...>
[pid 25502] 10:12:36.924193 write(16, "1", 1 <unfinished ...>
[pid 25523] 10:12:36.924230 <... brk resumed> ) = 0x845000
[pid 25522] 10:12:36.924264 <... mmap resumed> ) = 0x7f2e40b07000
[pid 25520] 10:12:36.924284 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25502] 10:12:36.924362 <... write resumed> ) = 1
[pid 25523] 10:12:36.924392 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.924425 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.924454 read(14,  <unfinished ...>
[pid 25502] 10:12:36.924504 close(16 <unfinished ...>
[pid 25523] 10:12:36.924536 <... socket resumed> ) = 5
[pid 25522] 10:12:36.924553 <... mmap resumed> ) = 0x7f2e3ee7c000
[pid 25520] 10:12:36.924570 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25502] 10:12:36.924660 <... close resumed> ) = 0
[pid 25523] 10:12:36.924794 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.924843 mprotect(0x7f2e3efa8000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.924874 read(14,  <unfinished ...>
[pid 25502] 10:12:36.924898 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.924935 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.924952 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.924968 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25502] 10:12:36.925067 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.925103 close(5 <unfinished ...>
[pid 25522] 10:12:36.925132 mmap(0x7f2e3f1a8000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25520] 10:12:36.925166 read(14,  <unfinished ...>
[pid 25502] 10:12:36.925191 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25523] 10:12:36.925231 <... close resumed> ) = 0
[pid 25522] 10:12:36.925248 <... mmap resumed> ) = 0x7f2e3f1a8000
[pid 25520] 10:12:36.925269 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25502] 10:12:36.925374 <... stat resumed> 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.925435 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.925486 mmap(0x7f2e3f1b1000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.925517 read(14,  <unfinished ...>
[pid 25502] 10:12:36.925541 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.925579 <... socket resumed> ) = 5
[pid 25522] 10:12:36.925595 <... mmap resumed> ) = 0x7f2e3f1b1000
[pid 25520] 10:12:36.925617 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25502] 10:12:36.925694 <... open resumed> ) = 16
[pid 25523] 10:12:36.925791 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.925831 close(6 <unfinished ...>
[pid 25520] 10:12:36.925854 read(14,  <unfinished ...>
[pid 25502] 10:12:36.925878 fstat(16,  <unfinished ...>
[pid 25523] 10:12:36.925908 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.925925 <... close resumed> ) = 0
[pid 25520] 10:12:36.925949 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25502] 10:12:36.926041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25523] 10:12:36.926082 close(5 <unfinished ...>
[pid 25522] 10:12:36.926109 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.926141 read(14,  <unfinished ...>
[pid 25502] 10:12:36.926164 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.926198 <... close resumed> ) = 0
[pid 25522] 10:12:36.926227 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.926246 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25502] 10:12:36.926334 <... mmap resumed> ) = 0x7f3c0be45000
[pid 25523] 10:12:36.926361 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.926392 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.926426 read(14,  <unfinished ...>
[pid 25502] 10:12:36.926450 read(16,  <unfinished ...>
[pid 25523] 10:12:36.926488 <... open resumed> ) = 5
[pid 25522] 10:12:36.926513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.926531 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25502] 10:12:36.926638 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25523] 10:12:36.926678 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.926703 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.926816 read(14,  <unfinished ...>
[pid 25502] 10:12:36.926844 read(16,  <unfinished ...>
[pid 25523] 10:12:36.926873 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25522] 10:12:36.926906 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.926926 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25502] 10:12:36.927072 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.927101 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.927129 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.927163 read(14,  <unfinished ...>
[pid 25502] 10:12:36.927187 close(16 <unfinished ...>
[pid 25523] 10:12:36.927218 <... mmap resumed> ) = 0x7f3ec584e000
[pid 25522] 10:12:36.927235 <... open resumed> ) = 6
[pid 25520] 10:12:36.927251 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25502] 10:12:36.927341 <... close resumed> ) = 0
[pid 25523] 10:12:36.927367 read(5,  <unfinished ...>
[pid 25522] 10:12:36.927395 read(6,  <unfinished ...>
[pid 25520] 10:12:36.927419 read(14,  <unfinished ...>
[pid 25502] 10:12:36.927443 munmap(0x7f3c0be45000, 4096 <unfinished ...>
[pid 25523] 10:12:36.927484 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25522] 10:12:36.927524 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.927548 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25502] 10:12:36.927630 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.927657 read(5,  <unfinished ...>
[pid 25522] 10:12:36.927681 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.927703 read(14,  <unfinished ...>
[pid 25502] 10:12:36.927806 uname( <unfinished ...>
[pid 25523] 10:12:36.927838 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:36.927858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.927896 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25502] 10:12:36.928009 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25523] 10:12:36.928114 close(5 <unfinished ...>
[pid 25522] 10:12:36.928146 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.928176 read(14,  <unfinished ...>
[pid 25502] 10:12:36.928200 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25523] 10:12:36.928234 <... close resumed> ) = 0
[pid 25522] 10:12:36.928250 <... mmap resumed> ) = 0x7f2e3ec78000
[pid 25520] 10:12:36.928266 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25502] 10:12:36.928335 <... socket resumed> ) = 16
[pid 25523] 10:12:36.928368 munmap(0x7f3ec584e000, 4096 <unfinished ...>
[pid 25522] 10:12:36.928399 mprotect(0x7f2e3ec7a000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.928427 read(14,  <unfinished ...>
[pid 25502] 10:12:36.928450 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25523] 10:12:36.928487 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.928515 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.928533 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25502] 10:12:36.928612 <... connect resumed> ) = 0
[pid 25523] 10:12:36.928644 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.928676 mmap(0x7f2e3ee7a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25520] 10:12:36.928706 read(14,  <unfinished ...>
[pid 25502] 10:12:36.928811 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25523] 10:12:36.928847 <... open resumed> ) = 5
[pid 25522] 10:12:36.928864 <... mmap resumed> ) = 0x7f2e3ee7a000
[pid 25520] 10:12:36.928890 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:36.928922 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25523] 10:12:36.928951 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.928975 close(6 <unfinished ...>
[pid 25520] 10:12:36.928997 close(14 <unfinished ...>
[pid 25502] 10:12:36.929021 sendto(16, "&\344\1\0\0\1\0\0\0\0\0\0\20westernskiesgolf\3com\0\0\17\0\1", 38, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25523] 10:12:36.929084 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25522] 10:12:36.929116 <... close resumed> ) = 0
[pid 25520] 10:12:36.929139 <... close resumed> ) = 0
[pid 25502] 10:12:36.929156 <... sendto resumed> ) = 38
[pid 25523] 10:12:36.929179 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.929205 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.929236 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25502] 10:12:36.929264 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25523] 10:12:36.929295 <... mmap resumed> ) = 0x7f3ec5845000
[pid 25522] 10:12:36.929317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.929336 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.930238 close(5 <unfinished ...>
[pid 25522] 10:12:36.930277 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.930314 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.930359 <... close resumed> ) = 0
[pid 25522] 10:12:36.930388 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.930407 <... open resumed> ) = 14
[pid 25523] 10:12:36.930429 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.930462 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.930491 fstat(14,  <unfinished ...>
[pid 25523] 10:12:36.930522 <... open resumed> ) = 5
[pid 25522] 10:12:36.930537 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.930555 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.930591 read(5,  <unfinished ...>
[pid 25522] 10:12:36.930614 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.930645 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.930676 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.930700 <... open resumed> ) = 6
[pid 25520] 10:12:36.930782 <... mmap resumed> ) = 0x7f7c15ca6000
[pid 25523] 10:12:36.930808 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.930832 read(6,  <unfinished ...>
[pid 25520] 10:12:36.930855 read(14,  <unfinished ...>
[pid 25523] 10:12:36.930922 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.930960 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.930985 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          243404 kB\nCached:           333864 kB\nBuffers:               0 kB\nActive:           306464 kB\nInactive:         467656 kB\nActive(anon):     170456 kB\nInactive(anon):   277604 kB\nActive(file):     136008 kB\nInac"..., 1024) = 588
[pid 25523] 10:12:36.931021 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25522] 10:12:36.931051 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.931074 close(14 <unfinished ...>
[pid 25523] 10:12:36.931105 <... mmap resumed> ) = 0x7f3ec508f000
[pid 25522] 10:12:36.931121 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25520] 10:12:36.931157 <... close resumed> ) = 0
[pid 25523] 10:12:36.931179 mprotect(0x7f3ec509b000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.931207 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.931236 munmap(0x7f7c15ca6000, 4096 <unfinished ...>
[pid 25523] 10:12:36.931269 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.931285 <... mmap resumed> ) = 0x7f2e3ea75000
[pid 25520] 10:12:36.931301 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.932085 mmap(0x7f3ec529b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25522] 10:12:36.932130 mprotect(0x7f2e3ea77000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.932158 alarm(300 <unfinished ...>
[pid 25523] 10:12:36.932189 <... mmap resumed> ) = 0x7f3ec529b000
[pid 25522] 10:12:36.932215 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.932234 <... alarm resumed> ) = 0
[pid 25523] 10:12:36.932276 close(5 <unfinished ...>
[pid 25522] 10:12:36.932301 mmap(0x7f2e3ec76000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25520] 10:12:36.932331 brk(0x1229000 <unfinished ...>
[pid 25523] 10:12:36.932360 <... close resumed> ) = 0
[pid 25522] 10:12:36.932392 <... mmap resumed> ) = 0x7f2e3ec76000
[pid 25520] 10:12:36.932419 <... brk resumed> ) = 0x1229000
[pid 25523] 10:12:36.932488 mprotect(0x7f3ec529b000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:36.932520 close(6 <unfinished ...>
[pid 25520] 10:12:36.932543 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2t\242\\\326\306\276\250w\266\34\34e\317\370\365\235w~\347A\243\v\363\206\233.:\327e\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25523] 10:12:36.932605 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.932627 <... close resumed> ) = 0
[pid 25520] 10:12:36.932652 <... write resumed> ) = 258
[pid 25523] 10:12:36.932678 munmap(0x7f3ec5845000, 39387 <unfinished ...>
[pid 25522] 10:12:36.932708 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.932808 read(11,  <unfinished ...>
[pid 25523] 10:12:36.932836 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.932860 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.932884 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:36.932914 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.932950 <... open resumed> ) = 5
[pid 25522] 10:12:36.932970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.932992 fcntl(5, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.933015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.933048 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25522] 10:12:36.933069 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.933092 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.933116 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.933150 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:36.933186 <... open resumed> ) = 6
[pid 25523] 10:12:36.933206 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.933232 read(6,  <unfinished ...>
[pid 25523] 10:12:36.933259 <... mmap resumed> ) = 0x7f3ec584e000
[pid 25522] 10:12:36.933275 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.933302 read(5,  <unfinished ...>
[pid 25522] 10:12:36.933329 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.933355 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:36.933393 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25523] 10:12:36.933428 close(5 <unfinished ...>
[pid 25522] 10:12:36.933453 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.933483 <... close resumed> ) = 0
[pid 25522] 10:12:36.933499 <... mmap resumed> ) = 0x7f2e40b06000
[pid 25523] 10:12:36.933524 munmap(0x7f3ec584e000, 4096 <unfinished ...>
[pid 25522] 10:12:36.933554 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.933593 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.933625 <... mmap resumed> ) = 0x7f2e3e6e1000
[pid 25523] 10:12:36.933648 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.933678 mprotect(0x7f2e3e86b000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.933784 <... socket resumed> ) = 5
[pid 25522] 10:12:36.933808 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.933828 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.933866 mmap(0x7f2e3ea6b000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25523] 10:12:36.933901 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.933918 <... mmap resumed> ) = 0x7f2e3ea6b000
[pid 25523] 10:12:36.933943 close(5 <unfinished ...>
[pid 25522] 10:12:36.933970 mmap(0x7f2e3ea70000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.934001 <... close resumed> ) = 0
[pid 25522] 10:12:36.934018 <... mmap resumed> ) = 0x7f2e3ea70000
[pid 25523] 10:12:36.934042 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25522] 10:12:36.934070 close(6 <unfinished ...>
[pid 25523] 10:12:36.934096 <... socket resumed> ) = 5
[pid 25522] 10:12:36.934163 <... close resumed> ) = 0
[pid 25523] 10:12:36.934196 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25522] 10:12:36.934231 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.934266 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.934283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.934303 close(5 <unfinished ...>
[pid 25522] 10:12:36.934329 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.934371 <... close resumed> ) = 0
[pid 25522] 10:12:36.934393 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.934415 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:36.934445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.934477 <... open resumed> ) = 5
[pid 25522] 10:12:36.934495 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.934518 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.934541 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.934577 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:36.934609 <... open resumed> ) = 6
[pid 25523] 10:12:36.934638 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.934665 read(6,  <unfinished ...>
[pid 25523] 10:12:36.934691 <... mmap resumed> ) = 0x7f3ec584e000
[pid 25522] 10:12:36.934708 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.934801 read(5,  <unfinished ...>
[pid 25522] 10:12:36.934831 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.934857 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:36.934892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25523] 10:12:36.934927 close(5 <unfinished ...>
[pid 25522] 10:12:36.934952 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.934984 <... close resumed> ) = 0
[pid 25522] 10:12:36.935000 <... mmap resumed> ) = 0x7f2e3e475000
[pid 25523] 10:12:36.935019 munmap(0x7f3ec584e000, 4096 <unfinished ...>
[pid 25522] 10:12:36.935046 mprotect(0x7f2e3e4d7000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.935076 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.935099 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.935120 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:36.935149 mmap(0x7f2e3e6d6000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25523] 10:12:36.935181 <... open resumed> ) = 5
[pid 25522] 10:12:36.935197 <... mmap resumed> ) = 0x7f2e3e6d6000
[pid 25523] 10:12:36.935226 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.935251 close(6 <unfinished ...>
[pid 25523] 10:12:36.935276 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:36.935305 <... close resumed> ) = 0
[pid 25523] 10:12:36.935334 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.935361 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.935401 <... mmap resumed> ) = 0x7f3ec584e000
[pid 25522] 10:12:36.935417 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.935439 read(5,  <unfinished ...>
[pid 25522] 10:12:36.935466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.935501 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:36.935534 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.935556 close(5 <unfinished ...>
[pid 25522] 10:12:36.935580 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.935614 <... close resumed> ) = 0
[pid 25522] 10:12:36.935630 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.935652 munmap(0x7f3ec584e000, 4096 <unfinished ...>
[pid 25522] 10:12:36.935679 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.935819 <... munmap resumed> ) = 0
[pid 25522] 10:12:36.935857 <... open resumed> ) = 6
[pid 25523] 10:12:36.935879 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25522] 10:12:36.935920 read(6,  <unfinished ...>
[pid 25523] 10:12:36.935948 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25522] 10:12:36.935972 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.936000 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25522] 10:12:36.936029 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.936055 <... readlink resumed> 0x7ffefd21d060, 4095) = -1 EINVAL (Invalid argument)
[pid 25522] 10:12:36.936080 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25523] 10:12:36.936115 getcwd( <unfinished ...>
[pid 25522] 10:12:36.936141 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.936173 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25522] 10:12:36.936198 <... mmap resumed> ) = 0x7f2e3e092000
[pid 25523] 10:12:36.936220 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25522] 10:12:36.936248 mprotect(0x7f2e3e24b000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.936277 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25522] 10:12:36.936352 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.936376 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.936405 mmap(0x7f2e3e44a000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25523] 10:12:36.936439 <... open resumed> ) = 5
[pid 25522] 10:12:36.936457 <... mmap resumed> ) = 0x7f2e3e44a000
[pid 25523] 10:12:36.936482 fstat(5,  <unfinished ...>
[pid 25522] 10:12:36.936505 mmap(0x7f2e3e471000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.936542 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25522] 10:12:36.936570 <... mmap resumed> ) = 0x7f2e3e471000
[pid 25523] 10:12:36.936595 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.936634 close(6 <unfinished ...>
[pid 25523] 10:12:36.936662 <... mmap resumed> ) = 0x7f3ec584e000
[pid 25522] 10:12:36.936679 <... close resumed> ) = 0
[pid 25523] 10:12:36.936707 read(5,  <unfinished ...>
[pid 25522] 10:12:36.936818 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.936855 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25522] 10:12:36.936877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.936900 read(5,  <unfinished ...>
[pid 25522] 10:12:36.936926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.936961 <... read resumed> "", 1024) = 0
[pid 25522] 10:12:36.936983 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.937004 setregid(499, 499 <unfinished ...>
[pid 25522] 10:12:36.937028 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.937061 <... setregid resumed> ) = 0
[pid 25522] 10:12:36.937079 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.937103 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25522] 10:12:36.937330 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25523] 10:12:36.937384 <... execve resumed> ) = 0
[pid 25522] 10:12:36.937416 read(6,  <unfinished ...>
[pid 25523] 10:12:36.937446 brk(0 <unfinished ...>
[pid 25522] 10:12:36.937468 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.937494 <... brk resumed> ) = 0x13a2000
[pid 25522] 10:12:36.937513 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.937539 fcntl(0, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.937563 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25523] 10:12:36.937599 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.937621 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.937957 fcntl(1, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.937984 <... mmap resumed> ) = 0x7f2e40b05000
[pid 25523] 10:12:36.938008 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.938025 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.938058 fcntl(2, F_GETFD <unfinished ...>
[pid 25522] 10:12:36.938080 <... mmap resumed> ) = 0x7f2e3de65000
[pid 25523] 10:12:36.938100 <... fcntl resumed> ) = 0
[pid 25522] 10:12:36.938121 mprotect(0x7f2e3de91000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.938152 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25522] 10:12:36.938182 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.938201 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938232 mmap(0x7f2e3e091000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25523] 10:12:36.938267 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.938293 <... mmap resumed> ) = 0x7f2e3e091000
[pid 25523] 10:12:36.938316 <... mmap resumed> ) = 0x7fd745964000
[pid 25522] 10:12:36.938347 close(6 <unfinished ...>
[pid 25523] 10:12:36.938375 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25522] 10:12:36.938404 <... close resumed> ) = 0
[pid 25523] 10:12:36.938430 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938456 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.938494 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.938523 <... open resumed> ) = 6
[pid 25523] 10:12:36.938545 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938563 read(6,  <unfinished ...>
[pid 25523] 10:12:36.938591 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.938623 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.938657 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938675 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.938708 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.938816 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25523] 10:12:36.938851 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938870 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.938903 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25522] 10:12:36.938930 <... mmap resumed> ) = 0x7f2e3dc60000
[pid 25523] 10:12:36.938949 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.938966 mprotect(0x7f2e3dc65000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.938996 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.939025 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.939044 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939061 mmap(0x7f2e3de64000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25523] 10:12:36.939093 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.939120 <... mmap resumed> ) = 0x7f2e3de64000
[pid 25523] 10:12:36.939149 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939169 close(6 <unfinished ...>
[pid 25523] 10:12:36.939195 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.939224 <... close resumed> ) = 0
[pid 25523] 10:12:36.939253 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939271 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.939303 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25522] 10:12:36.939329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.939349 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25522] 10:12:36.939377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.939414 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.939444 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.939464 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939480 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.939513 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.939541 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.939563 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939580 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.939612 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.939642 <... open resumed> ) = 6
[pid 25523] 10:12:36.939661 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939677 read(6,  <unfinished ...>
[pid 25523] 10:12:36.939704 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25522] 10:12:36.939824 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.939859 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939878 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.939904 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.939936 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25523] 10:12:36.939969 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.939986 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.940019 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.940048 <... mmap resumed> ) = 0x7f2e3da5d000
[pid 25523] 10:12:36.940068 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940084 mprotect(0x7f2e3da5f000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.940114 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.940145 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.940165 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940182 mmap(0x7f2e3dc5e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25523] 10:12:36.940214 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25522] 10:12:36.940243 <... mmap resumed> ) = 0x7f2e3dc5e000
[pid 25523] 10:12:36.940272 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:36.940303 close(6 <unfinished ...>
[pid 25523] 10:12:36.940329 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.940359 <... close resumed> ) = 0
[pid 25523] 10:12:36.940387 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940406 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.940439 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.940466 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.940486 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940503 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.940537 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.940565 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.940584 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940601 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.940635 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25522] 10:12:36.940669 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.940691 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940807 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.940853 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.940882 <... open resumed> ) = 6
[pid 25523] 10:12:36.940902 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.940919 read(6,  <unfinished ...>
[pid 25523] 10:12:36.940945 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25522] 10:12:36.940972 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.940998 <... stat resumed> 0x7ffe0e876320) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.941015 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.941042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.941070 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.941102 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.941119 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.941149 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25522] 10:12:36.941176 <... mmap resumed> ) = 0x7f2e40b04000
[pid 25523] 10:12:36.941200 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:36.941231 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.941263 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.941292 <... mmap resumed> ) = 0x7f2e3d83a000
[pid 25523] 10:12:36.941311 <... open resumed> ) = 6
[pid 25522] 10:12:36.941327 mprotect(0x7f2e3d851000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.941356 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.941378 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.941398 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25522] 10:12:36.941426 mmap(0x7f2e3da51000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25523] 10:12:36.941458 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.941483 <... mmap resumed> ) = 0x7f2e3da51000
[pid 25523] 10:12:36.941512 <... mmap resumed> ) = 0x7fd74595a000
[pid 25522] 10:12:36.941531 close(6 <unfinished ...>
[pid 25523] 10:12:36.941556 close(6 <unfinished ...>
[pid 25522] 10:12:36.941578 <... close resumed> ) = 0
[pid 25523] 10:12:36.941622 <... close resumed> ) = 0
[pid 25522] 10:12:36.941655 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.941691 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.941807 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.941830 <... open resumed> ) = 6
[pid 25522] 10:12:36.941846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.941881 read(6,  <unfinished ...>
[pid 25522] 10:12:36.941905 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.941925 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.941950 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.941983 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.942006 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.942028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.942058 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.942093 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.942120 <... open resumed> ) = 6
[pid 25523] 10:12:36.942140 <... mmap resumed> ) = 0x7fd74552c000
[pid 25522] 10:12:36.942155 read(6,  <unfinished ...>
[pid 25523] 10:12:36.942182 mprotect(0x7fd745542000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.942209 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.942235 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.942251 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.942277 mmap(0x7fd745742000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25522] 10:12:36.942306 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.942339 <... mmap resumed> ) = 0x7fd745742000
[pid 25522] 10:12:36.942361 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.942394 mmap(0x7fd745744000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.942421 <... mmap resumed> ) = 0x7f2e3d5f6000
[pid 25523] 10:12:36.942441 <... mmap resumed> ) = 0x7fd745744000
[pid 25522] 10:12:36.942463 mprotect(0x7f2e3d637000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.942495 close(6 <unfinished ...>
[pid 25522] 10:12:36.942518 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.942537 <... close resumed> ) = 0
[pid 25522] 10:12:36.942559 mmap(0x7f2e3d837000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25523] 10:12:36.942591 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.942627 <... mmap resumed> ) = 0x7f2e3d837000
[pid 25523] 10:12:36.942655 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.942675 close(6 <unfinished ...>
[pid 25523] 10:12:36.942701 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.942851 <... close resumed> ) = 0
[pid 25523] 10:12:36.942881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.942900 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.942933 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.942962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.942982 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.943002 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.943036 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.943066 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.943087 <... open resumed> ) = 6
[pid 25522] 10:12:36.943102 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.943134 read(6,  <unfinished ...>
[pid 25522] 10:12:36.943157 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.943179 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.943203 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.943237 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.943260 <... open resumed> ) = 6
[pid 25523] 10:12:36.943280 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.943309 read(6,  <unfinished ...>
[pid 25523] 10:12:36.943337 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.943363 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.943389 <... mmap resumed> ) = 0x7fd745959000
[pid 25522] 10:12:36.943410 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.943438 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.943473 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.943514 <... mmap resumed> ) = 0x7fd745313000
[pid 25522] 10:12:36.943531 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.943567 mprotect(0x7fd745329000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.943594 <... mmap resumed> ) = 0x7f2e40b03000
[pid 25523] 10:12:36.943617 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.943634 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.943665 mmap(0x7fd745528000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25522] 10:12:36.943693 <... mmap resumed> ) = 0x7f2e3d30f000
[pid 25523] 10:12:36.943808 <... mmap resumed> ) = 0x7fd745528000
[pid 25522] 10:12:36.943836 mprotect(0x7f2e3d3ea000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.943868 mmap(0x7fd74552a000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.943896 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.943915 <... mmap resumed> ) = 0x7fd74552a000
[pid 25522] 10:12:36.943937 mmap(0x7f2e3d5ea000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25523] 10:12:36.943969 close(6 <unfinished ...>
[pid 25522] 10:12:36.943992 <... mmap resumed> ) = 0x7f2e3d5ea000
[pid 25523] 10:12:36.944019 <... close resumed> ) = 0
[pid 25522] 10:12:36.944043 close(6 <unfinished ...>
[pid 25523] 10:12:36.944071 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.944101 <... close resumed> ) = 0
[pid 25523] 10:12:36.944128 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.944147 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.944181 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.944211 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.944231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.944248 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.944281 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.944310 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.944329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.944350 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.944383 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.944413 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.944434 <... open resumed> ) = 6
[pid 25522] 10:12:36.944450 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.944483 read(6,  <unfinished ...>
[pid 25522] 10:12:36.944507 <... open resumed> ) = 6
[pid 25523] 10:12:36.944525 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.944547 read(6,  <unfinished ...>
[pid 25523] 10:12:36.944574 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.944597 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.944628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.944659 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.944685 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.944811 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.944852 <... mmap resumed> ) = 0x7fd7450dc000
[pid 25522] 10:12:36.944870 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.944904 mprotect(0x7fd7450e3000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.944931 <... mmap resumed> ) = 0x7f2e3d10b000
[pid 25523] 10:12:36.944951 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.944967 mprotect(0x7f2e3d10e000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.944996 mmap(0x7fd7452e3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25522] 10:12:36.945025 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.945044 <... mmap resumed> ) = 0x7fd7452e3000
[pid 25522] 10:12:36.945065 mmap(0x7f2e3d30d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25523] 10:12:36.945096 mmap(0x7fd7452e5000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.945123 <... mmap resumed> ) = 0x7f2e3d30d000
[pid 25523] 10:12:36.945151 <... mmap resumed> ) = 0x7fd7452e5000
[pid 25522] 10:12:36.945174 close(6 <unfinished ...>
[pid 25523] 10:12:36.945201 close(6 <unfinished ...>
[pid 25522] 10:12:36.945222 <... close resumed> ) = 0
[pid 25523] 10:12:36.945249 <... close resumed> ) = 0
[pid 25522] 10:12:36.945271 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.945306 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.945336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.945356 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.945373 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.945408 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.945438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.945457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.945474 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.945507 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.945535 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.945556 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.945574 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.945610 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.945640 <... open resumed> ) = 6
[pid 25523] 10:12:36.945659 <... open resumed> ) = 6
[pid 25522] 10:12:36.945675 read(6,  <unfinished ...>
[pid 25523] 10:12:36.945701 read(6,  <unfinished ...>
[pid 25522] 10:12:36.945799 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.945835 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.945859 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.945886 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.945908 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.945942 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.945971 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.946004 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.946030 <... mmap resumed> ) = 0x7f2e3cedf000
[pid 25523] 10:12:36.946049 <... mmap resumed> ) = 0x7fd744e58000
[pid 25522] 10:12:36.946064 mprotect(0x7f2e3cf08000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.946094 mprotect(0x7fd744edb000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.946120 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.946139 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.946155 mmap(0x7f2e3d108000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25523] 10:12:36.946189 mmap(0x7fd7450da000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25522] 10:12:36.946229 <... mmap resumed> ) = 0x7f2e3d108000
[pid 25523] 10:12:36.946255 <... mmap resumed> ) = 0x7fd7450da000
[pid 25522] 10:12:36.946281 mmap(0x7f2e3d10a000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.946315 close(6 <unfinished ...>
[pid 25522] 10:12:36.946337 <... mmap resumed> ) = 0x7f2e3d10a000
[pid 25523] 10:12:36.946361 <... close resumed> ) = 0
[pid 25522] 10:12:36.946385 close(6 <unfinished ...>
[pid 25523] 10:12:36.946461 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.946493 <... close resumed> ) = 0
[pid 25520] 10:12:36.946521 <... read resumed> "\26\3\3\0;\2\0", 7) = 7
[pid 25523] 10:12:36.946592 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.946616 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.946648 read(11,  <unfinished ...>
[pid 25523] 10:12:36.946678 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.946792 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.946817 <... read resumed> "\0007\3\3V\204\2t\305\272\370\235\207D\373Q\241#7\266\352.\233x\rH\254}n\223#\305\336.\211\235\0\300/\0\0\17\377\1\0\1\0\0#\0\0\0\v\0\2\1\0", 57) = 57
[pid 25523] 10:12:36.946874 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.946894 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.946927 read(11,  <unfinished ...>
[pid 25523] 10:12:36.946956 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.946984 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.947001 <... read resumed> "\26\3\3\16*", 5) = 5
[pid 25523] 10:12:36.947024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.947042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.947070 read(11,  <unfinished ...>
[pid 25523] 10:12:36.947104 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.947134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:36.947153 <... read resumed> "\v\0\16&\0\16#\0\6\2450\202\6\2410\202\5\211\240\3\2\1\2\2\10R\357\363\340\22\17\266\0040\r\6\t*\206H\206\367\r\1\1\v\5\0000I1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\n\23\nGoogle Inc1%0#\6\3U\4\3\23\34Google Internet Authority G20\36\27\r151210182812Z\27\r160309000000Z0g1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\10\f\nCalifornia1\0260\24\6\3U\4\7\f\rMountain View1\0230\21\6\3U\4\n\f\nGoogle Inc1\0260\24\6\3U\4\3\f\rmx.google"..., 3626) = 3626
[pid 25523] 10:12:36.948026 <... open resumed> ) = 6
[pid 25522] 10:12:36.948058 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.948095 read(11,  <unfinished ...>
[pid 25523] 10:12:36.948125 read(6,  <unfinished ...>
[pid 25522] 10:12:36.948149 <... open resumed> ) = 6
[pid 25520] 10:12:36.948165 <... read resumed> "\26\3\3\1M", 5) = 5
[pid 25523] 10:12:36.948189 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.948213 read(6,  <unfinished ...>
[pid 25520] 10:12:36.948237 read(11,  <unfinished ...>
[pid 25523] 10:12:36.948265 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.948288 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25520] 10:12:36.948310 <... read resumed> "\f\0\1I\3\0\27A\4{\221\17&<\251M\337\214\252\n|ml=w\277\207+\275\351\210\215\36.A\36L'3]\224_\305L\270\30\321\222[\35\302'G\371\355\320k2\"d\243\304\321\265\33\277\334\232\363*rE\212\4\1\1\0\33>\220\326`\362\7\\\357#7b^\3^\257\314\2\355\364\241\\\35\1\373/[\274\256\305\212\307\203\313\377\322\266\255\306\247\211\271\352-\336b\201\353F\37)\tX[@Am4\260\5{\242\304+#a\244\235\376bx\207\"z\317\304C\332\213\363,L\372\257N\2540\17F\200Vi\262\311\276\276\315\252\277\274\223\352\260\331\34\334\330\f[D<\317\320n\326\334:\353\371\20404\273\302\213t\267M\f\225\246M\332\275m^\271&\f\342=\301C\300Y\24\344\267\266p\315*\303 \242\204\216\202\3\212\206}\300\337\2048T\335\315\0\342\275\221\"\357\223\222`\211"..., 333) = 333
[pid 25523] 10:12:36.948499 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25522] 10:12:36.948546 fstat(6,  <unfinished ...>
[pid 25520] 10:12:36.948571 read(11,  <unfinished ...>
[pid 25523] 10:12:36.948600 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.948627 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25520] 10:12:36.948657 <... read resumed> "\26\3\3\0\4", 5) = 5
[pid 25523] 10:12:36.948685 <... mmap resumed> ) = 0x7fd745958000
[pid 25522] 10:12:36.948788 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25520] 10:12:36.948823 read(11,  <unfinished ...>
[pid 25523] 10:12:36.948853 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.948881 <... mmap resumed> ) = 0x7f2e40b02000
[pid 25520] 10:12:36.948901 <... read resumed> "\16\0\0\0", 4) = 4
[pid 25523] 10:12:36.951137 <... mmap resumed> ) = 0x7fd744c4a000
[pid 25522] 10:12:36.951171 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:36.951206 write(11, "\26\3\3\0F\20\0\0BA\4.\221\33ND\366yB>\347\375\241\210\30\347Gi7\274\373\245*\342\373\222\366R?d}\362d\365\316\00637l\300\227\225\340/\32\324<E\302\232y\5)G\215\226b\4lX\3221_\252\311\24\3\3\0\1\1\26\3\3\0(\270\216\27\217\177l\231\315`\233\265)\371\21\2126Ut\26E\336\5N\3705\226\206\221\5\31\374s\3333\316\275P\335\202,", 126 <unfinished ...>
[pid 25523] 10:12:36.951259 mprotect(0x7fd744c56000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.951292 <... mmap resumed> ) = 0x7f2e3ccc9000
[pid 25523] 10:12:36.951314 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.951331 mprotect(0x7f2e3ccde000, 2093056, PROT_NONE <unfinished ...>
[pid 25520] 10:12:36.951360 <... write resumed> ) = 126
[pid 25523] 10:12:36.951377 mmap(0x7fd744e56000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25522] 10:12:36.951410 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.951430 <... mmap resumed> ) = 0x7fd744e56000
[pid 25522] 10:12:36.951456 mmap(0x7f2e3cedd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25520] 10:12:36.951487 read(11,  <unfinished ...>
[pid 25523] 10:12:36.951513 close(6 <unfinished ...>
[pid 25522] 10:12:36.951536 <... mmap resumed> ) = 0x7f2e3cedd000
[pid 25523] 10:12:36.951565 <... close resumed> ) = 0
[pid 25522] 10:12:36.951590 close(6 <unfinished ...>
[pid 25523] 10:12:36.951617 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.951655 <... close resumed> ) = 0
[pid 25523] 10:12:36.951696 <... open resumed> ) = 6
[pid 25522] 10:12:36.951781 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.951822 read(6,  <unfinished ...>
[pid 25522] 10:12:36.951846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.951867 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.951891 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.951935 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.951958 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.951978 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25522] 10:12:36.952010 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.952043 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.952070 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.952093 <... mmap resumed> ) = 0x7fd744a27000
[pid 25522] 10:12:36.952110 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.952144 mprotect(0x7fd744a48000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.952171 <... open resumed> ) = 6
[pid 25523] 10:12:36.952192 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.952208 read(6,  <unfinished ...>
[pid 25523] 10:12:36.952235 mmap(0x7fd744c48000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25522] 10:12:36.952266 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.952304 <... mmap resumed> ) = 0x7fd744c48000
[pid 25522] 10:12:36.952327 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.952354 close(6 <unfinished ...>
[pid 25522] 10:12:36.952378 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.952411 <... close resumed> ) = 0
[pid 25522] 10:12:36.952434 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.952474 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.952505 <... mmap resumed> ) = 0x7f2e3cabe000
[pid 25523] 10:12:36.952525 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.952542 mprotect(0x7f2e3cac8000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.952573 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.952604 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.952624 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.952642 mmap(0x7f2e3ccc7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25523] 10:12:36.952674 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.952704 <... mmap resumed> ) = 0x7f2e3ccc7000
[pid 25523] 10:12:36.952837 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.952865 close(6 <unfinished ...>
[pid 25523] 10:12:36.952892 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.952923 <... close resumed> ) = 0
[pid 25523] 10:12:36.952953 <... open resumed> ) = 6
[pid 25522] 10:12:36.952970 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.953003 read(6,  <unfinished ...>
[pid 25522] 10:12:36.953032 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.953053 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.953076 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.953111 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.953133 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.953153 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.953186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.953219 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.953247 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.953270 <... mmap resumed> ) = 0x7fd74480a000
[pid 25522] 10:12:36.953286 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.953323 mprotect(0x7fd744821000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.953353 <... open resumed> ) = 6
[pid 25523] 10:12:36.953380 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.953396 read(6,  <unfinished ...>
[pid 25523] 10:12:36.953427 mmap(0x7fd744a21000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25522] 10:12:36.953493 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.953535 <... mmap resumed> ) = 0x7fd744a21000
[pid 25522] 10:12:36.953562 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.953593 mmap(0x7fd744a23000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.953624 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.953662 <... mmap resumed> ) = 0x7fd744a23000
[pid 25522] 10:12:36.953687 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.953814 close(6 <unfinished ...>
[pid 25522] 10:12:36.953841 <... mmap resumed> ) = 0x7f2e3c8bb000
[pid 25523] 10:12:36.953862 <... close resumed> ) = 0
[pid 25522] 10:12:36.953887 mprotect(0x7f2e3c8bd000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.953921 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.953954 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.953974 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.953993 mmap(0x7f2e3cabc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25523] 10:12:36.954034 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.954068 <... mmap resumed> ) = 0x7f2e3cabc000
[pid 25523] 10:12:36.954097 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.954116 close(6 <unfinished ...>
[pid 25523] 10:12:36.954143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.954174 <... close resumed> ) = 0
[pid 25523] 10:12:36.954200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.954221 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.954252 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.954282 <... mmap resumed> ) = 0x7f2e40b01000
[pid 25523] 10:12:36.954318 <... open resumed> ) = 6
[pid 25522] 10:12:36.954336 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.954369 read(6,  <unfinished ...>
[pid 25522] 10:12:36.954393 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.954412 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.954437 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.954477 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.954501 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.954521 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:36.954551 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.954584 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.954612 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.954635 <... mmap resumed> ) = 0x7fd745957000
[pid 25522] 10:12:36.954655 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.954688 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.954722 <... open resumed> ) = 6
[pid 25523] 10:12:36.954742 <... mmap resumed> ) = 0x7fd744496000
[pid 25522] 10:12:36.954758 read(6,  <unfinished ...>
[pid 25523] 10:12:36.954785 mprotect(0x7fd744605000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.954811 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.954838 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.954855 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.954882 mmap(0x7fd744804000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25522] 10:12:36.954917 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.954952 <... mmap resumed> ) = 0x7fd744804000
[pid 25522] 10:12:36.954978 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25523] 10:12:36.955014 close(6 <unfinished ...>
[pid 25522] 10:12:36.955037 <... mmap resumed> ) = 0x7f2e3c69c000
[pid 25523] 10:12:36.955056 <... close resumed> ) = 0
[pid 25522] 10:12:36.955079 mprotect(0x7f2e3c6b9000, 2093056, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.955111 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.955141 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.955161 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.955179 mmap(0x7f2e3c8b8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25523] 10:12:36.955212 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.955244 <... mmap resumed> ) = 0x7f2e3c8b8000
[pid 25523] 10:12:36.955268 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.955283 mmap(0x7f2e3c8ba000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.955299 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.955315 <... mmap resumed> ) = 0x7f2e3c8ba000
[pid 25523] 10:12:36.955333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.955349 close(6 <unfinished ...>
[pid 25523] 10:12:36.955361 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.955384 <... close resumed> ) = 0
[pid 25523] 10:12:36.955433 <... open resumed> ) = 6
[pid 25522] 10:12:36.955442 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.955637 read(6,  <unfinished ...>
[pid 25522] 10:12:36.955663 <... mmap resumed> ) = 0x7f2e40b00000
[pid 25523] 10:12:36.955725 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.955753 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.955783 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.955806 <... mmap resumed> ) = 0x7f2e40aff000
[pid 25523] 10:12:36.955835 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25522] 10:12:36.955868 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.955897 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.955924 <... mmap resumed> ) = 0x7f2e40afd000
[pid 25523] 10:12:36.955949 <... mmap resumed> ) = 0x7fd744207000
[pid 25522] 10:12:36.955966 arch_prctl(ARCH_SET_FS, 0x7f2e40afd7c0 <unfinished ...>
[pid 25523] 10:12:36.955993 mprotect(0x7fd744292000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.956021 <... arch_prctl resumed> ) = 0
[pid 25523] 10:12:36.956085 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.956104 mprotect(0x7f2e3c8b8000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956134 mmap(0x7fd744492000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25522] 10:12:36.956165 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956189 <... mmap resumed> ) = 0x7fd744492000
[pid 25522] 10:12:36.956211 mprotect(0x7f2e3cabc000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956241 mmap(0x7fd744495000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.956269 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956304 <... mmap resumed> ) = 0x7fd744495000
[pid 25522] 10:12:36.956327 mprotect(0x7f2e3ccc7000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956360 close(6 <unfinished ...>
[pid 25522] 10:12:36.956383 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956411 <... close resumed> ) = 0
[pid 25522] 10:12:36.956436 mprotect(0x7f2e3cedd000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956546 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.956579 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956613 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.956633 mprotect(0x7f2e3d108000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.956696 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.956746 mprotect(0x7f2e3d30d000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956776 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.956805 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.956933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.956956 mprotect(0x7f2e3d5ea000, 40960, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.956986 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.957018 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.957119 <... open resumed> ) = 6
[pid 25522] 10:12:36.957138 mprotect(0x7f2e3d837000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.957167 read(6,  <unfinished ...>
[pid 25522] 10:12:36.957191 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.957223 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.957248 mprotect(0x7f2e3da51000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.957278 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.957301 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.957324 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25522] 10:12:36.957355 mprotect(0x7f2e3dc5e000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.957386 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.957414 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.957694 <... mmap resumed> ) = 0x7fd744001000
[pid 25522] 10:12:36.957721 mprotect(0x7f2e3e44a000, 110592, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.957754 mprotect(0x7fd744007000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.957785 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.957869 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.957888 mprotect(0x7f2e3e6d6000, 16384, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.957918 mmap(0x7fd744206000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25522] 10:12:36.957948 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.958050 <... mmap resumed> ) = 0x7fd744206000
[pid 25522] 10:12:36.958075 mprotect(0x7f2e3ea6b000, 16384, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.958106 close(6 <unfinished ...>
[pid 25522] 10:12:36.958129 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.958153 <... close resumed> ) = 0
[pid 25522] 10:12:36.958176 mprotect(0x7f2e3ec76000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.958207 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.958239 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.958267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.958286 mprotect(0x7f2e3ee7a000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.958316 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.958350 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959050 <... open resumed> ) = 6
[pid 25522] 10:12:36.959077 mprotect(0x7f2e3fbd2000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959109 read(6,  <unfinished ...>
[pid 25522] 10:12:36.959133 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959174 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.959201 mprotect(0x7f2e40007000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959231 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.959254 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959278 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:36.959310 mprotect(0x7f2e4028b000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959340 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.959367 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959391 <... mmap resumed> ) = 0x7fd745956000
[pid 25522] 10:12:36.959412 mprotect(0x7f2e40494000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959446 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.959475 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959511 <... mmap resumed> ) = 0x7fd743ccb000
[pid 25522] 10:12:36.959529 mprotect(0x7f2e406d9000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959559 mprotect(0x7fd743df7000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.959585 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959612 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.959630 mprotect(0x7f2e408f3000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959660 mmap(0x7fd743ff7000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25522] 10:12:36.959690 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959739 <... mmap resumed> ) = 0x7fd743ff7000
[pid 25522] 10:12:36.959763 mprotect(0x7f2e40b16000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.959800 mmap(0x7fd744000000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.959828 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.959848 <... mmap resumed> ) = 0x7fd744000000
[pid 25522] 10:12:36.959869 munmap(0x7f2e40b0b000, 39387 <unfinished ...>
[pid 25523] 10:12:36.959904 close(6 <unfinished ...>
[pid 25522] 10:12:36.959927 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.959948 <... close resumed> ) = 0
[pid 25522] 10:12:36.959970 set_tid_address(0x7f2e40afda90 <unfinished ...>
[pid 25523] 10:12:36.959998 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.960030 <... set_tid_address resumed> ) = 25522
[pid 25523] 10:12:36.960049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.960067 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25523] 10:12:36.960093 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.960124 <... set_robust_list resumed> ) = 0
[pid 25523] 10:12:36.960143 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.960161 futex(0x7ffd5c5ff2ec, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25523] 10:12:36.960189 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.960219 <... futex resumed> ) = 0
[pid 25523] 10:12:36.960239 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.960258 futex(0x7ffd5c5ff2ec, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f2e40afd7c0 <unfinished ...>
[pid 25523] 10:12:36.960287 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.960318 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25523] 10:12:36.960343 <... open resumed> ) = 6
[pid 25522] 10:12:36.960360 rt_sigaction(SIGRTMIN, {0x7f2e3f9c0c60, [], SA_RESTORER|SA_SIGINFO, 0x7f2e3f9ca790},  <unfinished ...>
[pid 25523] 10:12:36.960393 read(6,  <unfinished ...>
[pid 25522] 10:12:36.960416 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:36.960435 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.960577 rt_sigaction(SIGRT_1, {0x7f2e3f9c0cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f2e3f9ca790},  <unfinished ...>
[pid 25523] 10:12:36.960616 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.960647 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:36.960668 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.960706 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25523] 10:12:36.960737 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.960767 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25523] 10:12:36.960797 <... mmap resumed> ) = 0x7fd743ac7000
[pid 25522] 10:12:36.960814 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25523] 10:12:36.960841 mprotect(0x7fd743ac9000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.960868 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25523] 10:12:36.960927 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.960946 statfs("/selinux",  <unfinished ...>
[pid 25523] 10:12:36.960988 mmap(0x7fd743cc9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25522] 10:12:36.961019 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350331, f_bavail=6350331, f_files=1000000, f_ffree=691087, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25523] 10:12:36.961090 <... mmap resumed> ) = 0x7fd743cc9000
[pid 25522] 10:12:36.961119 brk(0 <unfinished ...>
[pid 25523] 10:12:36.961147 close(6 <unfinished ...>
[pid 25522] 10:12:36.961170 <... brk resumed> ) = 0x16ea000
[pid 25523] 10:12:36.961189 <... close resumed> ) = 0
[pid 25522] 10:12:36.961211 brk(0x170b000 <unfinished ...>
[pid 25523] 10:12:36.961240 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.961272 <... brk resumed> ) = 0x170b000
[pid 25523] 10:12:36.961302 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.961321 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.961361 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.961396 <... open resumed> ) = 6
[pid 25523] 10:12:36.961427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.961450 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.961478 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.961509 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.961543 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.961562 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.961592 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.961626 <... mmap resumed> ) = 0x7f2e40b14000
[pid 25523] 10:12:36.961646 <... open resumed> ) = 6
[pid 25522] 10:12:36.961662 read(6,  <unfinished ...>
[pid 25523] 10:12:36.961770 read(6,  <unfinished ...>
[pid 25522] 10:12:36.961807 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25523] 10:12:36.961855 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.961892 read(6,  <unfinished ...>
[pid 25523] 10:12:36.961928 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.961952 <... read resumed> "", 1024) = 0
[pid 25523] 10:12:36.961980 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.962012 close(6 <unfinished ...>
[pid 25523] 10:12:36.962043 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.962073 <... close resumed> ) = 0
[pid 25523] 10:12:36.962092 <... mmap resumed> ) = 0x7fd7438c4000
[pid 25522] 10:12:36.962109 munmap(0x7f2e40b14000, 4096 <unfinished ...>
[pid 25523] 10:12:36.962140 mprotect(0x7fd7438c6000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.962172 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.962246 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.962267 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25523] 10:12:36.962306 mmap(0x7fd743ac5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25522] 10:12:36.962337 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.962432 <... mmap resumed> ) = 0x7fd743ac5000
[pid 25522] 10:12:36.962594 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2e3f9ca790},  <unfinished ...>
[pid 25523] 10:12:36.962634 close(6 <unfinished ...>
[pid 25522] 10:12:36.962657 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:36.962687 <... close resumed> ) = 0
[pid 25522] 10:12:36.962715 fstat(2,  <unfinished ...>
[pid 25523] 10:12:36.962744 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.962776 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25523] 10:12:36.962839 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.962861 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f2e3f9ca790},  <unfinished ...>
[pid 25523] 10:12:36.962892 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.962924 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:36.962948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.962966 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25523] 10:12:36.962996 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.963032 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25523] 10:12:36.963059 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.963080 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25523] 10:12:36.963110 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.963141 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25523] 10:12:36.963163 <... open resumed> ) = 6
[pid 25522] 10:12:36.963179 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2e3f9ca790},  <unfinished ...>
[pid 25523] 10:12:36.963208 read(6,  <unfinished ...>
[pid 25522] 10:12:36.963231 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:36.963261 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.963286 umask(0 <unfinished ...>
[pid 25523] 10:12:36.963313 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.963336 <... umask resumed> ) = 0
[pid 25523] 10:12:36.963396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25522] 10:12:36.963429 geteuid( <unfinished ...>
[pid 25523] 10:12:36.963536 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.963566 <... geteuid resumed> ) = 0
[pid 25523] 10:12:36.963588 <... mmap resumed> ) = 0x7fd745955000
[pid 25522] 10:12:36.963609 getuid( <unfinished ...>
[pid 25523] 10:12:36.963641 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.963669 <... getuid resumed> ) = 47
[pid 25523] 10:12:36.963691 <... mmap resumed> ) = 0x7fd743530000
[pid 25522] 10:12:36.963712 getgid( <unfinished ...>
[pid 25523] 10:12:36.963738 mprotect(0x7fd7436ba000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.963767 <... getgid resumed> ) = 12
[pid 25523] 10:12:36.963815 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.963835 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25523] 10:12:36.963861 mmap(0x7fd7438ba000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25522] 10:12:36.963891 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25523] 10:12:36.963914 <... mmap resumed> ) = 0x7fd7438ba000
[pid 25522] 10:12:36.963935 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25523] 10:12:36.963962 mmap(0x7fd7438bf000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.963990 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25523] 10:12:36.964014 <... mmap resumed> ) = 0x7fd7438bf000
[pid 25522] 10:12:36.964035 getgroups(65536,  <unfinished ...>
[pid 25523] 10:12:36.964064 close(6 <unfinished ...>
[pid 25522] 10:12:36.964086 <... getgroups resumed> [12]) = 1
[pid 25523] 10:12:36.964123 <... close resumed> ) = 0
[pid 25522] 10:12:36.964149 setgroups(0, [] <unfinished ...>
[pid 25520] 10:12:36.964175 <... read resumed> "\26\3\3\0\256", 5) = 5
[pid 25523] 10:12:36.964201 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.964232 <... setgroups resumed> ) = 0
[pid 25520] 10:12:36.964250 read(11,  <unfinished ...>
[pid 25523] 10:12:36.964280 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.964297 getegid( <unfinished ...>
[pid 25520] 10:12:36.964319 <... read resumed> "\4\0\0\252\0\1\211\300\0\244C\34\306\3156\251\362MsK\235\215e\353\211V\34 \347)\200\372\340~\10\v\257,\231F*\2\370%\347\20P\206\35,\252\277w6\374K\274\222a5\205w\35\33\265kb\214\33\310[aFR\23\255A\257\237\24\276Q\364;\364\6|\262-\247z\3070\233\6*\312&\7\274\243uh\212\253t\332\357h0\346rfl\314\351>\36\263\255\233(%xQ\254z%\355\242\206\r\221hs\265\266Z \2429\t$\200\26\321x\261\32p\363\364U\330(&J\3520\322P\277bq\235\331\215.k\276@\257f\347", 174) = 174
[pid 25523] 10:12:36.964377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.964414 <... getegid resumed> ) = 12
[pid 25520] 10:12:36.964430 read(11,  <unfinished ...>
[pid 25523] 10:12:36.964536 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.964556 geteuid( <unfinished ...>
[pid 25520] 10:12:36.964579 <... read resumed> "\24\3\3\0\1", 5) = 5
[pid 25523] 10:12:36.964603 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.964633 <... geteuid resumed> ) = 0
[pid 25520] 10:12:36.964654 read(11,  <unfinished ...>
[pid 25523] 10:12:36.964684 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.964705 geteuid( <unfinished ...>
[pid 25520] 10:12:36.964729 <... read resumed> "\1", 1) = 1
[pid 25523] 10:12:36.964787 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.964825 <... geteuid resumed> ) = 0
[pid 25520] 10:12:36.964842 read(11,  <unfinished ...>
[pid 25523] 10:12:36.964871 <... open resumed> ) = 6
[pid 25522] 10:12:36.964887 getegid( <unfinished ...>
[pid 25520] 10:12:36.964909 <... read resumed> "\26\3\3\0(", 5) = 5
[pid 25523] 10:12:36.964932 read(6,  <unfinished ...>
[pid 25522] 10:12:36.964955 <... getegid resumed> ) = 12
[pid 25520] 10:12:36.964974 read(11,  <unfinished ...>
[pid 25523] 10:12:36.965004 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.965034 setgid(12 <unfinished ...>
[pid 25520] 10:12:36.965058 <... read resumed> "\0\0\0\0\0\0\0\0\35C\267\301\377\31<\f\202\332\246A;\337Aj\277\207\362\31\310B\365\355\274y\223p\304m\21\23", 40) = 40
[pid 25523] 10:12:36.965116 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.965144 <... setgid resumed> ) = 0
[pid 25520] 10:12:36.965163 alarm(0 <unfinished ...>
[pid 25523] 10:12:36.965193 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25522] 10:12:36.965224 setuid(0 <unfinished ...>
[pid 25520] 10:12:36.965248 <... alarm resumed> ) = 300
[pid 25523] 10:12:36.965299 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.965334 <... setuid resumed> ) = 0
[pid 25520] 10:12:36.965390 write(11, "\27\3\3\0009\270\216\27\217\177l\231\316\304\247\5\276G\21,\r\237\301\31}\367J\255\310\276\316\300\366\200f{\265\0!\366f\253\223\250lUD?|\377\364\265'\320\344$\216\223\267:\"\300", 62 <unfinished ...>
[pid 25523] 10:12:36.965523 <... mmap resumed> ) = 0x7fd7432c4000
[pid 25522] 10:12:36.965544 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25520] 10:12:36.965576 <... write resumed> ) = 62
[pid 25523] 10:12:36.965601 mprotect(0x7fd743326000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.965630 <... open resumed> ) = 6
[pid 25520] 10:12:36.965664 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25523] 10:12:36.965706 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.965723 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.965750 mmap(0x7fd743525000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25522] 10:12:36.965780 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:36.965818 <... mmap resumed> ) = 0x7fd743525000
[pid 25522] 10:12:36.965845 fstat(6,  <unfinished ...>
[pid 25523] 10:12:36.965874 close(6 <unfinished ...>
[pid 25522] 10:12:36.965896 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:36.965927 <... close resumed> ) = 0
[pid 25522] 10:12:36.965953 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.965985 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.966015 <... mmap resumed> ) = 0x7f2e40b14000
[pid 25523] 10:12:36.966035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.966053 read(6,  <unfinished ...>
[pid 25523] 10:12:36.966084 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.966116 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25523] 10:12:36.966242 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.966273 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25523] 10:12:36.966309 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.966340 <... socket resumed> ) = 7
[pid 25523] 10:12:36.966359 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.966378 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25523] 10:12:36.966419 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.966456 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.966477 <... open resumed> ) = 6
[pid 25522] 10:12:36.966493 close(7 <unfinished ...>
[pid 25523] 10:12:36.966522 read(6,  <unfinished ...>
[pid 25522] 10:12:36.966546 <... close resumed> ) = 0
[pid 25523] 10:12:36.966565 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.966588 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25523] 10:12:36.966619 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.966642 <... socket resumed> ) = 7
[pid 25523] 10:12:36.966661 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25522] 10:12:36.966691 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25523] 10:12:36.966730 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.966760 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.966780 <... mmap resumed> ) = 0x7fd742ee1000
[pid 25522] 10:12:36.966797 close(7 <unfinished ...>
[pid 25523] 10:12:36.966826 mprotect(0x7fd74309a000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.966853 <... close resumed> ) = 0
[pid 25523] 10:12:36.966880 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.966898 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.966933 mmap(0x7fd743299000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25522] 10:12:36.966965 <... open resumed> ) = 7
[pid 25523] 10:12:36.967099 <... mmap resumed> ) = 0x7fd743299000
[pid 25522] 10:12:36.967129 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.967158 mmap(0x7fd7432c0000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.967187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25523] 10:12:36.967221 <... mmap resumed> ) = 0x7fd7432c0000
[pid 25522] 10:12:36.967243 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.967274 close(6 <unfinished ...>
[pid 25522] 10:12:36.967297 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25523] 10:12:36.967323 <... close resumed> ) = 0
[pid 25522] 10:12:36.967354 read(7,  <unfinished ...>
[pid 25523] 10:12:36.967387 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.967419 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25523] 10:12:36.967513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.967538 read(7,  <unfinished ...>
[pid 25523] 10:12:36.967566 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.967599 <... read resumed> "", 4096) = 0
[pid 25523] 10:12:36.967620 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.967637 close(7 <unfinished ...>
[pid 25523] 10:12:36.967666 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.967695 <... close resumed> ) = 0
[pid 25523] 10:12:36.967717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.967736 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25523] 10:12:36.967768 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.967800 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.967833 <... open resumed> ) = 6
[pid 25522] 10:12:36.967851 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.967885 read(6,  <unfinished ...>
[pid 25522] 10:12:36.967908 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.967928 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.967951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.967985 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.968009 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.968028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25522] 10:12:36.968058 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.968091 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.968117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.968137 <... mmap resumed> ) = 0x7fd745954000
[pid 25522] 10:12:36.968157 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.968190 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.968219 <... open resumed> ) = 7
[pid 25523] 10:12:36.968238 <... mmap resumed> ) = 0x7fd742cb4000
[pid 25522] 10:12:36.968254 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.968280 mprotect(0x7fd742ce0000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.968308 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25523] 10:12:36.968341 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.968357 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25523] 10:12:36.968386 mmap(0x7fd742ee0000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25522] 10:12:36.968420 <... mmap resumed> ) = 0x7f2e40af3000
[pid 25523] 10:12:36.968440 <... mmap resumed> ) = 0x7fd742ee0000
[pid 25522] 10:12:36.968540 close(7 <unfinished ...>
[pid 25523] 10:12:36.968570 close(6 <unfinished ...>
[pid 25522] 10:12:36.968592 <... close resumed> ) = 0
[pid 25523] 10:12:36.968620 <... close resumed> ) = 0
[pid 25522] 10:12:36.968643 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25523] 10:12:36.968681 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.968717 <... open resumed> ) = 7
[pid 25523] 10:12:36.968736 <... open resumed> ) = 6
[pid 25522] 10:12:36.968752 read(7,  <unfinished ...>
[pid 25523] 10:12:36.968779 read(6,  <unfinished ...>
[pid 25522] 10:12:36.968802 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.968828 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.968851 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.968877 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.968900 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25523] 10:12:36.968935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25522] 10:12:36.968966 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25523] 10:12:36.969001 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.969029 <... mmap resumed> ) = 0x7f2e3c48e000
[pid 25523] 10:12:36.969049 <... mmap resumed> ) = 0x7fd742aaf000
[pid 25522] 10:12:36.969065 mprotect(0x7f2e3c49a000, 2097152, PROT_NONE <unfinished ...>
[pid 25523] 10:12:36.969095 mprotect(0x7fd742ab4000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.969121 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.969140 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.969155 mmap(0x7f2e3c69a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25523] 10:12:36.969187 mmap(0x7fd742cb3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25522] 10:12:36.969214 <... mmap resumed> ) = 0x7f2e3c69a000
[pid 25523] 10:12:36.969242 <... mmap resumed> ) = 0x7fd742cb3000
[pid 25522] 10:12:36.969265 close(7 <unfinished ...>
[pid 25523] 10:12:36.969292 close(6 <unfinished ...>
[pid 25522] 10:12:36.969314 <... close resumed> ) = 0
[pid 25523] 10:12:36.969352 <... close resumed> ) = 0
[pid 25522] 10:12:36.969382 mprotect(0x7f2e3c69a000, 4096, PROT_READ <unfinished ...>
[pid 25523] 10:12:36.969414 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.969533 <... mprotect resumed> ) = 0
[pid 25523] 10:12:36.969563 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.969582 munmap(0x7f2e40af3000, 39387 <unfinished ...>
[pid 25523] 10:12:36.969615 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.969648 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.969676 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.969696 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.969732 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.969762 <... open resumed> ) = 7
[pid 25523] 10:12:36.969786 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.969806 fcntl(7, F_GETFD <unfinished ...>
[pid 25523] 10:12:36.969833 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.969861 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25523] 10:12:36.969884 <... open resumed> ) = 6
[pid 25522] 10:12:36.969901 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.969927 read(6,  <unfinished ...>
[pid 25522] 10:12:36.969950 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.969984 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.970007 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.970037 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.970060 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25523] 10:12:36.970079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25522] 10:12:36.970108 read(7,  <unfinished ...>
[pid 25523] 10:12:36.970140 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.970171 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.970213 <... mmap resumed> ) = 0x7fd7428ac000
[pid 25522] 10:12:36.970232 close(7 <unfinished ...>
[pid 25523] 10:12:36.970259 mprotect(0x7fd7428ae000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.970286 <... close resumed> ) = 0
[pid 25523] 10:12:36.970305 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.970321 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25523] 10:12:36.970351 mmap(0x7fd742aad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25522] 10:12:36.970379 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.970420 <... mmap resumed> ) = 0x7fd742aad000
[pid 25522] 10:12:36.970453 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25523] 10:12:36.970487 close(6 <unfinished ...>
[pid 25522] 10:12:36.970510 <... socket resumed> ) = 7
[pid 25523] 10:12:36.970535 <... close resumed> ) = 0
[pid 25522] 10:12:36.970562 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25523] 10:12:36.970601 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.970631 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.970652 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.970669 close(7 <unfinished ...>
[pid 25523] 10:12:36.970700 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.970732 <... close resumed> ) = 0
[pid 25523] 10:12:36.970751 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.970768 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25523] 10:12:36.970798 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.970827 <... socket resumed> ) = 7
[pid 25523] 10:12:36.970846 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.970865 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25523] 10:12:36.970898 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.970930 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.970950 <... open resumed> ) = 6
[pid 25522] 10:12:36.970966 close(7 <unfinished ...>
[pid 25523] 10:12:36.970994 read(6,  <unfinished ...>
[pid 25522] 10:12:36.971018 <... close resumed> ) = 0
[pid 25523] 10:12:36.971043 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.971063 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.971082 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.971091 <... open resumed> ) = 7
[pid 25523] 10:12:36.971103 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:36.971123 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.971135 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:36.971148 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.971169 <... mmap resumed> ) = 0x7fd745953000
[pid 25522] 10:12:36.971183 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.971198 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.971212 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25523] 10:12:36.971223 <... mmap resumed> ) = 0x7fd742689000
[pid 25522] 10:12:36.971231 read(7,  <unfinished ...>
[pid 25523] 10:12:36.971246 mprotect(0x7fd7426a0000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.971259 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.971285 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.971294 close(7 <unfinished ...>
[pid 25523] 10:12:36.971307 mmap(0x7fd7428a0000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25522] 10:12:36.971321 <... close resumed> ) = 0
[pid 25523] 10:12:36.971333 <... mmap resumed> ) = 0x7fd7428a0000
[pid 25522] 10:12:36.971350 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25523] 10:12:36.971367 close(6 <unfinished ...>
[pid 25522] 10:12:36.971375 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.971404 <... close resumed> ) = 0
[pid 25522] 10:12:36.971434 read(6,  <unfinished ...>
[pid 25523] 10:12:36.971665 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.971706 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25523] 10:12:36.971788 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.971812 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25523] 10:12:36.971846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.971878 <... open resumed> ) = 7
[pid 25523] 10:12:36.971898 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.971915 fstat(7,  <unfinished ...>
[pid 25523] 10:12:36.971942 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.971971 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.972003 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.972022 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25523] 10:12:36.972052 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.972084 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25523] 10:12:36.972105 <... open resumed> ) = 6
[pid 25522] 10:12:36.972121 read(7,  <unfinished ...>
[pid 25523] 10:12:36.972151 read(6,  <unfinished ...>
[pid 25522] 10:12:36.972175 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.972201 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:36.972225 close(7 <unfinished ...>
[pid 25523] 10:12:36.972253 fstat(6,  <unfinished ...>
[pid 25522] 10:12:36.972275 <... close resumed> ) = 0
[pid 25523] 10:12:36.972295 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:36.972325 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25523] 10:12:36.972356 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:36.972391 <... munmap resumed> ) = 0
[pid 25523] 10:12:36.972418 <... mmap resumed> ) = 0x7fd742445000
[pid 25522] 10:12:36.972436 read(6,  <unfinished ...>
[pid 25523] 10:12:36.972469 mprotect(0x7fd742486000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:36.972497 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25523] 10:12:36.972541 <... mprotect resumed> ) = 0
[pid 25522] 10:12:36.972560 uname( <unfinished ...>
[pid 25523] 10:12:36.972589 mmap(0x7fd742686000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25522] 10:12:36.972618 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25523] 10:12:36.972674 <... mmap resumed> ) = 0x7fd742686000
[pid 25522] 10:12:36.972704 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25523] 10:12:36.972740 close(6 <unfinished ...>
[pid 25522] 10:12:36.972763 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f2e3f9ca790}, 8) = 0
[pid 25523] 10:12:36.972794 <... close resumed> ) = 0
[pid 25522] 10:12:36.972820 clone( <unfinished ...>
[pid 25523] 10:12:36.973052 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.973098 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25525
[pid 25523] 10:12:36.973144 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:36.973180 wait4(25525,  <unfinished ...>
[pid 25523] 10:12:36.973205 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.973225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.973266 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25523] 10:12:36.973308 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.973345 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.973385 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745952000
[pid 25523] 10:12:36.973414 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd74215e000
[pid 25523] 10:12:36.973438 mprotect(0x7fd742239000, 2097152, PROT_NONE) = 0
[pid 25523] 10:12:36.973629 mmap(0x7fd742439000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fd742439000
[pid 25523] 10:12:36.973681 close(6)    = 0
[pid 25523] 10:12:36.973729 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.973775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.973825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.973868 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25523] 10:12:36.973911 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.973953 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.974002 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd741f5a000
[pid 25523] 10:12:36.974044 mprotect(0x7fd741f5d000, 2093056, PROT_NONE) = 0
[pid 25523] 10:12:36.974081 mmap(0x7fd74215c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fd74215c000
[pid 25523] 10:12:36.974128 close(6)    = 0
[pid 25523] 10:12:36.974171 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974258 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974301 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25523] 10:12:36.974343 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.974384 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.974432 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd741d2e000
[pid 25523] 10:12:36.974476 mprotect(0x7fd741d57000, 2097152, PROT_NONE) = 0
[pid 25523] 10:12:36.974513 mmap(0x7fd741f57000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fd741f57000
[pid 25523] 10:12:36.974557 mmap(0x7fd741f59000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd741f59000
[pid 25523] 10:12:36.974601 close(6)    = 0
[pid 25523] 10:12:36.974648 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974741 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.974784 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25523] 10:12:36.974826 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.974872 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.974921 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745951000
[pid 25523] 10:12:36.974961 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd741b18000
[pid 25523] 10:12:36.975001 mprotect(0x7fd741b2d000, 2093056, PROT_NONE) = 0
[pid 25523] 10:12:36.975038 mmap(0x7fd741d2c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fd741d2c000
[pid 25523] 10:12:36.975088 close(6)    = 0
[pid 25523] 10:12:36.975136 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975163 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975189 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975213 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25523] 10:12:36.975238 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.975259 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25523] 10:12:36.975289 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd74190d000
[pid 25523] 10:12:36.975313 mprotect(0x7fd741917000, 2093056, PROT_NONE) = 0
[pid 25523] 10:12:36.975333 mmap(0x7fd741b16000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fd741b16000
[pid 25523] 10:12:36.975362 close(6)    = 0
[pid 25523] 10:12:36.975387 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975437 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.975643 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25523] 10:12:36.975689 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.975733 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.975787 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd74170a000
[pid 25523] 10:12:36.975829 mprotect(0x7fd74170c000, 2093056, PROT_NONE) = 0
[pid 25523] 10:12:36.975865 mmap(0x7fd74190b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fd74190b000
[pid 25523] 10:12:36.975911 close(6)    = 0
[pid 25523] 10:12:36.975953 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745950000
[pid 25523] 10:12:36.976005 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.976049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.976091 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.976132 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25523] 10:12:36.976171 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.976211 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25523] 10:12:36.976258 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd7414eb000
[pid 25523] 10:12:36.976297 mprotect(0x7fd741508000, 2093056, PROT_NONE) = 0
[pid 25523] 10:12:36.976334 mmap(0x7fd741707000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fd741707000
[pid 25523] 10:12:36.976377 mmap(0x7fd741709000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd741709000
[pid 25523] 10:12:36.976420 close(6)    = 0
[pid 25523] 10:12:36.976566 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd74594f000
[pid 25523] 10:12:36.976644 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd74594e000
[pid 25523] 10:12:36.976690 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd74594c000
[pid 25523] 10:12:36.976736 arch_prctl(ARCH_SET_FS, 0x7fd74594c7c0) = 0
[pid 25523] 10:12:36.976808 mprotect(0x7fd741707000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.976850 mprotect(0x7fd74190b000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.976900 mprotect(0x7fd741b16000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.976944 mprotect(0x7fd741d2c000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.976992 mprotect(0x7fd741f57000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.977036 mprotect(0x7fd74215c000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.977175 mprotect(0x7fd742439000, 40960, PROT_READ) = 0
[pid 25523] 10:12:36.977292 mprotect(0x7fd742686000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.977342 mprotect(0x7fd7428a0000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.977381 mprotect(0x7fd742aad000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.977672 mprotect(0x7fd743299000, 110592, PROT_READ) = 0
[pid 25523] 10:12:36.977787 mprotect(0x7fd743525000, 16384, PROT_READ) = 0
[pid 25523] 10:12:36.977907 mprotect(0x7fd7438ba000, 16384, PROT_READ) = 0
[pid 25523] 10:12:36.977950 mprotect(0x7fd743ac5000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.978000 mprotect(0x7fd743cc9000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.978696 mprotect(0x7fd744a21000, 4096, PROT_READ <unfinished ...>
[pid 25520] 10:12:36.978736 <... select resumed> ) = 1 (in [11], left {299, 987001})
[pid 25523] 10:12:36.978772 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.978810 read(11,  <unfinished ...>
[pid 25523] 10:12:36.978841 mprotect(0x7fd744e56000, 4096, PROT_READ <unfinished ...>
[pid 25520] 10:12:36.978868 <... read resumed> "\27\3\3\0\262", 5) = 5
[pid 25523] 10:12:36.978892 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.978913 read(11,  <unfinished ...>
[pid 25523] 10:12:36.978942 mprotect(0x7fd7450da000, 4096, PROT_READ <unfinished ...>
[pid 25520] 10:12:36.978968 <... read resumed> "\0\0\0\0\0\0\0\1<$\n\212^\31Q\365\23\301S\321\344\370\v\271#w\16\307\261\372\326\\C\326\217`\273\373#B\241\304y\244p\4\350z\315\\\20({A\375\311Q\303\220\26\220=\377\314\372\351\303G\347V9\244\211\271\201\0074\340\321\212\263\260\211\350\336\310\1\203\270_2\362\227z{\213\317v\276\203\355K\207\331]q\34\10\21\357X\226~\3521\372c&}\331m\330k\215\252\225\215i\340\7\363W\24L\332#\33\353Q\241\26\3^\350\332R\345\2633Q!\34/el@\v\330\233\312\273\5\371SBH\37G\30\252\372z\365\325\231*^\372", 178) = 178
[pid 25523] 10:12:36.979033 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.979058 write(11, "\27\3\3\0\300\270\216\27\217\177l\231\317{`\35\327\37]\202Z\300\302h\220\226\245&\370\16\246\264\374&\2622~\216\225\247D\224\226\205\270\201\267\33\333\272M\2162\2672\313F(\212\270\237\206\340r\265\310\16\v\256\322\336\352\345\306\350\267\300\346\346\246\361\371\27\277n\234\376\313\304\317\311\326~\271K\350q\35&R\267o\375c1G\340~z\337_\342\244i\220\227C\364\25)\276\205t\223\224!\245\304a$\\;\334\356`\t\211%;\4\2475\235\236=\260\327\243w\271\236\277\256\"q1\346l,\237\337\227\322\277\201\361b\t\313Y\242Fd\206\241N\226K\303\354\275G\361I\223WX\354\"\nj\4P\266\31in", 197 <unfinished ...>
[pid 25523] 10:12:36.979116 mprotect(0x7fd7452e3000, 4096, PROT_READ <unfinished ...>
[pid 25520] 10:12:36.979145 <... write resumed> ) = 197
[pid 25523] 10:12:36.979169 <... mprotect resumed> ) = 0
[pid 25520] 10:12:36.979202 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25523] 10:12:36.979236 mprotect(0x7fd745528000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.979281 mprotect(0x7fd745742000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.979345 mprotect(0x7fd745965000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.979383 munmap(0x7fd74595a000, 39387) = 0
[pid 25523] 10:12:36.979425 set_tid_address(0x7fd74594ca90) = 25523
[pid 25523] 10:12:36.979525 set_robust_list(0x7fd74594caa0, 24) = 0
[pid 25523] 10:12:36.979560 futex(0x7ffe0e876c1c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25523] 10:12:36.979594 futex(0x7ffe0e876c1c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fd74594c7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25523] 10:12:36.979635 rt_sigaction(SIGRTMIN, {0x7fd74480fc60, [], SA_RESTORER|SA_SIGINFO, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:36.979677 rt_sigaction(SIGRT_1, {0x7fd74480fcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:36.979719 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25523] 10:12:36.979765 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25523] 10:12:36.979838 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350331, f_bavail=6350331, f_files=1000000, f_ffree=691087, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25523] 10:12:36.979939 brk(0)      = 0x13a2000
[pid 25523] 10:12:36.979977 brk(0x13c3000) = 0x13c3000
[pid 25523] 10:12:36.980022 open("/proc/filesystems", O_RDONLY) = 6
[pid 25523] 10:12:36.980085 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.980136 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745963000
[pid 25523] 10:12:36.980181 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25523] 10:12:36.980298 read(6, "", 1024) = 0
[pid 25523] 10:12:36.980342 close(6)    = 0
[pid 25523] 10:12:36.980381 munmap(0x7fd745963000, 4096) = 0
[pid 25523] 10:12:36.980536 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.980659 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:36.980714 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25523] 10:12:36.980793 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:36.980837 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25523] 10:12:36.980878 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25523] 10:12:36.980917 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:36.980962 umask(0)    = 022
[pid 25523] 10:12:36.981034 geteuid()   = 0
[pid 25523] 10:12:36.981073 getuid()    = 503
[pid 25523] 10:12:36.981108 getgid()    = 499
[pid 25523] 10:12:36.981156 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25523] 10:12:36.981195 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25523] 10:12:36.981232 getgroups(65536, [500]) = 1
[pid 25523] 10:12:36.981272 setgroups(0, []) = 0
[pid 25523] 10:12:36.981309 getegid()   = 499
[pid 25523] 10:12:36.981342 geteuid()   = 0
[pid 25523] 10:12:36.981380 geteuid()   = 0
[pid 25523] 10:12:36.981414 getegid()   = 499
[pid 25523] 10:12:36.981510 setgid(499) = 0
[pid 25523] 10:12:36.981553 setuid(0)   = 0
[pid 25523] 10:12:36.981617 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25523] 10:12:36.981679 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:36.981738 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:36.981786 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745963000
[pid 25523] 10:12:36.981824 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25523] 10:12:36.981961 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25523] 10:12:36.982009 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.982060 close(7)    = 0
[pid 25523] 10:12:36.982099 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25523] 10:12:36.982212 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.982258 close(7)    = 0
[pid 25523] 10:12:36.982302 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25523] 10:12:36.982346 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25523] 10:12:36.982413 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.982502 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25523] 10:12:36.982567 read(7, "", 4096) = 0
[pid 25523] 10:12:36.982603 close(7)    = 0
[pid 25523] 10:12:36.982638 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.982694 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.982745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.982791 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.982832 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25523] 10:12:36.982871 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25523] 10:12:36.982917 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fd745942000
[pid 25523] 10:12:36.982956 close(7)    = 0
[pid 25523] 10:12:36.982999 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25523] 10:12:36.983041 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25523] 10:12:36.983082 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25523] 10:12:36.983132 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fd7412dd000
[pid 25523] 10:12:36.983174 mprotect(0x7fd7412e9000, 2097152, PROT_NONE) = 0
[pid 25523] 10:12:36.983212 mmap(0x7fd7414e9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fd7414e9000
[pid 25523] 10:12:36.983259 close(7)    = 0
[pid 25523] 10:12:36.983312 mprotect(0x7fd7414e9000, 4096, PROT_READ) = 0
[pid 25523] 10:12:36.983355 munmap(0x7fd745942000, 39387) = 0
[pid 25523] 10:12:36.983401 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25523] 10:12:36.983451 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25523] 10:12:36.983492 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.983541 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.983578 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.983638 close(7)    = 0
[pid 25523] 10:12:36.983674 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.983732 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25523] 10:12:36.983782 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.983828 close(7)    = 0
[pid 25523] 10:12:36.983865 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25523] 10:12:36.983901 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:36.983942 close(7)    = 0
[pid 25523] 10:12:36.983982 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25523] 10:12:36.984023 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.984070 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.984107 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.984160 close(7)    = 0
[pid 25523] 10:12:36.984197 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.984250 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25523] 10:12:36.984324 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25523] 10:12:36.984368 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.984414 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.984573 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.984638 close(7)    = 0
[pid 25523] 10:12:36.984675 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.984722 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25523] 10:12:36.984781 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25523] 10:12:36.984844 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, 8) = 0
[pid 25523] 10:12:36.984896 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fd74594ca90) = 25526
[pid 25523] 10:12:36.985155 wait4(25526, Process 25525 attached
 <unfinished ...>
[pid 25525] 10:12:36.985227 set_robust_list(0x7f2e40afdaa0, 24) = 0
[pid 25525] 10:12:36.985287 geteuid()   = 0
[pid 25525] 10:12:36.985330 geteuid()   = 0
[pid 25525] 10:12:36.985366 getegid()   = 12
[pid 25525] 10:12:36.985404 setgid(12)  = 0
[pid 25525] 10:12:36.985440 setuid(47)  = 0
[pid 25525] 10:12:36.987105 brk(0x172c000) = 0x172c000
Process 25526 attached
[pid 25526] 10:12:36.987542 set_robust_list(0x7fd74594caa0, 24) = 0
[pid 25526] 10:12:36.987602 geteuid()   = 0
[pid 25526] 10:12:36.987643 geteuid()   = 0
[pid 25526] 10:12:36.987677 getegid()   = 499
[pid 25526] 10:12:36.987711 setgid(12)  = 0
[pid 25526] 10:12:36.987750 setuid(47)  = 0
[pid 25526] 10:12:36.989288 brk(0x13e4000 <unfinished ...>
[pid 25525] 10:12:36.989411 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25525] 10:12:36.989527 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25525] 10:12:36.989587 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25525] 10:12:36.989633 read(7, "\311\7\355\236\277&$\345\30\250\360\n\220\362\23\323\\\22\356\27=S\n\\\2427\302\246?\303!\261R\316\17\363\311\302\363\200\201^\23#\221,i\212", 48) = 48
[pid 25525] 10:12:36.989677 close(7)    = 0
[pid 25525] 10:12:36.989731 getuid()    = 47
[pid 25525] 10:12:36.989903 exit_group(0) = ?
[pid 25525] 10:12:36.990140 +++ exited with 0 +++
[pid 25522] 10:12:36.990171 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25525
[pid 25522] 10:12:36.990196 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:36.990263 getcwd("/var/spool/exim", 16380) = 16
[pid 25522] 10:12:36.990339 open("/etc/localtime", O_RDONLY) = 7
[pid 25522] 10:12:36.990383 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:36.990431 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:36.990544 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:36.990583 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25522] 10:12:36.990633 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25522] 10:12:36.990668 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25522] 10:12:36.990717 close(7)    = 0
[pid 25522] 10:12:36.990752 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:36.990802 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25522] 10:12:36.990853 fcntl(7, F_GETFD) = 0
[pid 25522] 10:12:36.990887 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:36.990920 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5380021, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:36.990974 write(7, "2015-12-30 10:12:36 [25522] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMa-0006dL-LG\n", 92) = 92
[pid 25522] 10:12:36.991019 chdir("/var/spool/exim") = 0
[pid 25522] 10:12:36.991062 setgid(12)  = 0
[pid 25522] 10:12:36.991125 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25522] 10:12:36.991208 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25522] 10:12:36.991292 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25522] 10:12:36.991365 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25522] 10:12:36.991440 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25522] 10:12:36.991658 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25522] 10:12:36.991775 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25522] 10:12:36.991850 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25522] 10:12:36.991896 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:36.991943 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:36.991980 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:36.992027 close(8)    = 0
[pid 25522] 10:12:36.992062 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:36.992158 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25522] 10:12:36.992264 read(6,  <unfinished ...>
[pid 25520] 10:12:36.992273 <... select resumed> ) = 1 (in [11], left {299, 987023})
[pid 25522] 10:12:36.992314 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25520] 10:12:36.992324 read(11,  <unfinished ...>
[pid 25522] 10:12:36.992432 read(6,  <unfinished ...>
[pid 25520] 10:12:36.992440 <... read resumed> "\27\3\3\0B", 5) = 5
[pid 25522] 10:12:36.992535 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25522] 10:12:36.992663 read(6,  <unfinished ...>
[pid 25520] 10:12:36.992673 read(11,  <unfinished ...>
[pid 25522] 10:12:36.992703 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25520] 10:12:36.992712 <... read resumed> "\0\0\0\0\0\0\0\2\221\5\336gI\3744[\3202f\2148\376\356\6\321\262\27\10\244\316\350e\255K\253\22\366\304,\333\200$\20Xw\327\237i\226ZU4\275\273\t\327\304r \237\263\227\16\342+,", 66) = 66
[pid 25522] 10:12:36.992825 read(6,  <unfinished ...>
[pid 25520] 10:12:36.992835 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25522] 10:12:36.992867 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25522] 10:12:36.992913 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25522] 10:12:36.992956 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:36.993003 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:36.993040 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:36.993090 close(8)    = 0
[pid 25522] 10:12:36.993125 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:36.993171 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25522] 10:12:36.993213 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:36.993258 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:36.993293 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:36.993342 close(8)    = 0
[pid 25522] 10:12:36.993376 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:36.993435 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25522] 10:12:36.993481 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:36.993534 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:36.993570 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:36.993624 close(8)    = 0
[pid 25522] 10:12:36.993665 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:36.993773 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25522] 10:12:36.993909 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25522] 10:12:36.994018 read(6, "", 4096) = 0
[pid 25522] 10:12:36.994058 read(6, "", 4096) = 0
[pid 25522] 10:12:36.994094 close(6)    = 0
[pid 25522] 10:12:36.994129 munmap(0x7f2e40b14000, 4096) = 0
[pid 25522] 10:12:36.994183 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2e3f9ca790}, NULL, 8) = 0
[pid 25522] 10:12:36.994233 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-D", O_RDWR|O_APPEND) = 6
[pid 25522] 10:12:36.994282 fcntl(6, F_GETFD) = 0
[pid 25522] 10:12:36.994315 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:36.994347 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25522] 10:12:36.994385 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:36.994437 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-H", O_RDONLY) = 8
[pid 25522] 10:12:36.994638 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=965, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:36.994687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b14000
[pid 25522] 10:12:36.994724 read(8, "1aEJMa-0006dL-LG-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 965
[pid 25522] 10:12:36.994799 read(8, "", 4096) = 0
[pid 25522] 10:12:36.994835 close(8)    = 0
[pid 25522] 10:12:36.994869 munmap(0x7f2e40b14000, 4096) = 0
[pid 25522] 10:12:36.994909 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:36.994964 open("/var/spool/exim/msglog/a/1aEJMa-0006dL-LG", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25522] 10:12:36.995011 fcntl(8, F_GETFD) = 0
[pid 25522] 10:12:36.995044 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:36.995080 fchown(8, 47, 12) = 0
[pid 25522] 10:12:36.995122 fchmod(8, 0640) = 0
[pid 25522] 10:12:36.995161 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25522] 10:12:36.995197 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:36.995243 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b14000
[pid 25522] 10:12:36.995278 lseek(8, 0, SEEK_CUR) = 0
[pid 25522] 10:12:36.995318 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:36.995378 pipe([9, 10]) = 0
[pid 25522] 10:12:36.995420 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [], SA_RESTORER, 0x7f2e3f9ca790}, 8) = 0
[pid 25522] 10:12:36.995543 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25527
[pid 25522] 10:12:36.995781 close(10)   = 0
[pid 25522] 10:12:36.995819 read(9,  <unfinished ...>
[pid 25526] 10:12:36.995844 <... brk resumed> ) = 0x13e4000
[pid 25526] 10:12:36.996256 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25526] 10:12:36.996316 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25526] 10:12:36.996370 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25526] 10:12:36.996413 read(7, "z\204v\372\254\334B\336\355\263\331\261\207\t\177\357)U\351\345j\325c\372\227\357\277\337\314\314\342\244/N\0\226\37\340-e#\335\1\250IB|\374", 48) = 48
[pid 25526] 10:12:36.996461 close(7)    = 0
[pid 25526] 10:12:36.996510 getuid()    = 47
[pid 25526] 10:12:36.996676 exit_group(0) = ?
[pid 25526] 10:12:36.996926 +++ exited with 0 +++
[pid 25523] 10:12:36.996955 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25526
[pid 25523] 10:12:36.996981 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, 8) = 0
[pid 25523] 10:12:36.997046 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25523] 10:12:36.997120 open("/etc/localtime", O_RDONLY) = 7
[pid 25523] 10:12:36.997163 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:36.997210 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:36.997255 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.997292 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25523] 10:12:36.997339 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25523] 10:12:36.997373 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25523] 10:12:36.997429 close(7)    = 0
[pid 25523] 10:12:36.997553 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.997606 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25523] 10:12:36.997654 fcntl(7, F_GETFD) = 0
[pid 25523] 10:12:36.997688 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25523] 10:12:36.997722 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5380113, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:36.997771 write(7, "2015-12-30 10:12:36 [25523] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25523] 10:12:36.997815 chdir("/var/spool/exim") = 0
[pid 25523] 10:12:36.997855 geteuid()   = 0
[pid 25523] 10:12:36.997888 getegid()   = 499
[pid 25523] 10:12:36.997934 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:36.997978 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.998023 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.998060 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.998108 close(8)    = 0
[pid 25523] 10:12:36.998143 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.998183 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25523] 10:12:36.998226 read(8, "65536\n", 31) = 6
[pid 25523] 10:12:36.998262 close(8)    = 0
[pid 25523] 10:12:36.998300 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:36.998341 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:36.998387 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.998424 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:36.998529 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:36.998585 read(8, "", 4096) = 0
[pid 25523] 10:12:36.998622 close(8)    = 0
[pid 25523] 10:12:36.998657 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.998696 setgroups(1, [12]) = 0
[pid 25523] 10:12:36.998734 setgid(12)  = 0
[pid 25523] 10:12:36.998768 setuid(47)  = 0
[pid 25523] 10:12:36.998827 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25523] 10:12:36.998911 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25523] 10:12:36.999002 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25523] 10:12:36.999077 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25523] 10:12:36.999154 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25523] 10:12:36.999244 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25523] 10:12:36.999356 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25523] 10:12:36.999430 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:36.999554 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:36.999611 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:36.999657 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:36.999707 close(8)    = 0
[pid 25523] 10:12:36.999742 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:36.999839 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25523] 10:12:36.999935 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25523] 10:12:37.000055 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25523] 10:12:37.000176 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25523] 10:12:37.000290 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25523] 10:12:37.000354 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:37.000400 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:37.000514 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:37.000560 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:37.000612 close(8)    = 0
[pid 25523] 10:12:37.000648 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:37.000696 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:37.000738 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:37.000784 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:37.000820 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:37.000870 close(8)    = 0
[pid 25523] 10:12:37.000904 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:37.000963 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25523] 10:12:37.001006 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25523] 10:12:37.001052 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:37.001088 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25523] 10:12:37.001136 close(8)    = 0
[pid 25523] 10:12:37.001170 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:37.001274 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25523] 10:12:37.001402 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25523] 10:12:37.001506 read(6, "", 4096) = 0
[pid 25523] 10:12:37.001549 read(6, "", 4096) = 0
[pid 25523] 10:12:37.001588 close(6)    = 0
[pid 25523] 10:12:37.001623 munmap(0x7fd745963000, 4096) = 0
[pid 25523] 10:12:37.001663 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25523] 10:12:37.001704 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:37.001751 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745963000
[pid 25523] 10:12:37.001788 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:37.001844 close(6)    = 0
[pid 25523] 10:12:37.001879 munmap(0x7fd745963000, 4096) = 0
[pid 25523] 10:12:37.001930 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25523] 10:12:37.001993 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.002046 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25523] 10:12:37.002088 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25523] 10:12:37.002130 fstat(0, {st_dev=makedev(0, 8), st_ino=2130168684, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:37.002176 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745963000
[pid 25523] 10:12:37.002212 read(0, "To:  antiquewedding@gmail.com, antiqueweddinghouse@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style "..., 4096) = 2095
[pid 25523] 10:12:37.002314 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:37.002387 open("/var/spool/exim/input/b/1aEJMb-0006df-04-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25523] 10:12:37.002611 fchown(6, 47, 12) = 0
[pid 25523] 10:12:37.002655 fchmod(6, 0640) = 0
[pid 25523] 10:12:37.002693 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25523] 10:12:37.002729 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.002775 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745962000
[pid 25523] 10:12:37.002811 lseek(6, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.002845 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25523] 10:12:37.002938 read(0, "", 4096) = 0
[pid 25523] 10:12:37.002974 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.003011 write(6, "1aEJMb-0006df-04-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25523] 10:12:37.003059 fsync(6Process 25527 attached
 <unfinished ...>
[pid 25527] 10:12:37.003169 set_robust_list(0x7f2e40afdaa0, 24) = 0
[pid 25527] 10:12:37.003369 close(9)    = 0
[pid 25527] 10:12:37.003413 geteuid()   = 0
[pid 25527] 10:12:37.003451 getegid()   = 12
[pid 25527] 10:12:37.003489 setgid(494) = 0
[pid 25527] 10:12:37.003522 setuid(495) = 0
[pid 25527] 10:12:37.003577 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25523] 10:12:37.003609 <... fsync resumed> ) = 0
[pid 25523] 10:12:37.003648 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:37.003744 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.003882 brk(0x13e4000) = 0x13e4000
[pid 25523] 10:12:37.003947 getuid()    = 47
[pid 25523] 10:12:37.003983 geteuid()   = 47
[pid 25523] 10:12:37.004017 getgid()    = 12
[pid 25523] 10:12:37.004051 getegid()   = 12
[pid 25523] 10:12:37.004149 open("/dev/urandom", O_RDONLY) = 8
[pid 25523] 10:12:37.004198 read(8, "\233\345\25\230", 4) = 4
[pid 25523] 10:12:37.004238 close(8)    = 0
[pid 25523] 10:12:37.004355 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25523] 10:12:37.004546 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831eb0) = -1 EINVAL (Invalid argument)
[pid 25523] 10:12:37.004609 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25523] 10:12:37.004649 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831eb0) = -1 EINVAL (Invalid argument)
[pid 25523] 10:12:37.004685 lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25523] 10:12:37.004720 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831ec0) = -1 EINVAL (Invalid argument)
[pid 25523] 10:12:37.004755 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25523] 10:12:37.004791 open("/dev/null", O_RDONLY) = 8
[pid 25523] 10:12:37.004835 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831f90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.004870 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.004905 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25523] 10:12:37.004941 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fd744819790}, 8) = 0
[pid 25523] 10:12:37.004982 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fd744819790}, 8) = 0
[pid 25523] 10:12:37.005255 read(8, "", 8192) = 0
[pid 25523] 10:12:37.005302 close(8)    = 0
[pid 25523] 10:12:37.005522 brk(0x1405000) = 0x1405000
[pid 25523] 10:12:37.005664 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:37.005727 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25523] 10:12:37.005769 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831dc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.005807 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.005860 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25523] 10:12:37.006904 brk(0x1426000) = 0x1426000
[pid 25523] 10:12:37.007156 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25523] 10:12:37.008123 brk(0x1447000) = 0x1447000
[pid 25523] 10:12:37.008506 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25523] 10:12:37.009338 brk(0x1468000) = 0x1468000
[pid 25523] 10:12:37.009670 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25523] 10:12:37.009983 read(8, "", 8192) = 0
[pid 25523] 10:12:37.010030 close(8)    = 0
[pid 25523] 10:12:37.010084 stat("/usr/share/amavis/amavis-filter", 0x7fd744000880) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.010134 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:37.010188 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25523] 10:12:37.010238 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25523] 10:12:37.010278 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e831dc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.010317 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.010369 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25523] 10:12:37.010886 stat("/etc/exim/perl/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.010941 stat("/etc/exim/perl/warnings.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.010982 stat("/usr/local/cpanel/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011024 stat("/usr/local/cpanel/warnings.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011064 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011113 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011156 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011196 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011238 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011281 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011323 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.011363 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25523] 10:12:37.011419 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25523] 10:12:37.011467 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e8317d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.011507 lseek(9, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.011553 brk(0x1489000) = 0x1489000
[pid 25523] 10:12:37.011604 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25523] 10:12:37.011946 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25523] 10:12:37.012756 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25523] 10:12:37.012880 brk(0x14aa000) = 0x14aa000
[pid 25523] 10:12:37.013216 read(9,  <unfinished ...>
[pid 25527] 10:12:37.013253 <... open resumed> ) = 9
[pid 25527] 10:12:37.013287 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25527] 10:12:37.013389 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25527] 10:12:37.013441 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25527] 10:12:37.013488 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25527] 10:12:37.013537 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25527] 10:12:37.013584 close(9)    = 0
[pid 25527] 10:12:37.013620 munmap(0x7f2e40b13000, 4096) = 0
[pid 25527] 10:12:37.013707 brk(0x172d000) = 0x172d000
[pid 25527] 10:12:37.013914 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25523] 10:12:37.013941 <... read resumed> "", 8192) = 0
[pid 25523] 10:12:37.013964 close(9)    = 0
[pid 25527] 10:12:37.014529 <... lseek resumed> ) = 19
[pid 25527] 10:12:37.014569 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2364) = 1858
[pid 25527] 10:12:37.014837 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25522] 10:12:37.014870 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25522] 10:12:37.014894 read(9,  <unfinished ...>
[pid 25527] 10:12:37.014914 <... write resumed> ) = 4
[pid 25527] 10:12:37.014933 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25522] 10:12:37.014955 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25522] 10:12:37.014974 read(9,  <unfinished ...>
[pid 25527] 10:12:37.014994 <... write resumed> ) = 4
[pid 25527] 10:12:37.015013 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25522] 10:12:37.015034 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25522] 10:12:37.015053 read(9,  <unfinished ...>
[pid 25527] 10:12:37.015073 <... write resumed> ) = 4
[pid 25527] 10:12:37.015091 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25522] 10:12:37.015114 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25522] 10:12:37.015133 read(9,  <unfinished ...>
[pid 25527] 10:12:37.015152 <... write resumed> ) = 4
[pid 25527] 10:12:37.015170 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25522] 10:12:37.015197 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25522] 10:12:37.015217 read(9,  <unfinished ...>
[pid 25527] 10:12:37.015237 <... write resumed> ) = 4
[pid 25527] 10:12:37.015255 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25522] 10:12:37.015281 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25522] 10:12:37.015302 read(9,  <unfinished ...>
[pid 25527] 10:12:37.015322 <... write resumed> ) = 40
[pid 25527] 10:12:37.015342 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25522] 10:12:37.015365 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25522] 10:12:37.015387 wait4(-1,  <unfinished ...>
[pid 25527] 10:12:37.015408 <... write resumed> ) = 4
[pid 25527] 10:12:37.015427 close(10)   = 0
[pid 25527] 10:12:37.015558 exit_group(0) = ?
[pid 25527] 10:12:37.015772 +++ exited with 0 +++
[pid 25522] 10:12:37.015800 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25527
[pid 25522] 10:12:37.015823 close(9)    = 0
[pid 25522] 10:12:37.015860 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:37.015922 brk(0x172c000) = 0x172c000
[pid 25522] 10:12:37.015968 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25522] 10:12:37.016022 alarm(60)   = 0
[pid 25522] 10:12:37.016058 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25522] 10:12:37.016097 alarm(0)    = 60
[pid 25522] 10:12:37.016174 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.016224 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25522] 10:12:37.016270 read(10, "cpu  123081 1342449 395228 67343099 2509 0 0 0\ncpu0 123081 1342449 395228 67343099 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58506800\nbtime 1450798266\nprocesses 893005\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25522] 10:12:37.016329 close(10)   = 0
[pid 25522] 10:12:37.016419 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25522] 10:12:37.016488 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25522] 10:12:37.016532 fcntl(10, F_GETFD) = 0
[pid 25522] 10:12:37.016565 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:37.016603 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25522] 10:12:37.016656 close(10)   = 0
[pid 25522] 10:12:37.016707 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.016750 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25522] 10:12:37.016852 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40acc000
[pid 25522] 10:12:37.017005 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25522] 10:12:37.017049 fcntl(10, F_GETFD) = 0
[pid 25522] 10:12:37.017081 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:37.017117 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25522] 10:12:37.017203 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25522] 10:12:37.017290 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25522] 10:12:37.017348 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25522] 10:12:37.017427 close(10)   = 0
[pid 25522] 10:12:37.017623 munmap(0x7f2e40acc000, 200704) = 0
[pid 25522] 10:12:37.017693 close(9)    = 0
[pid 25522] 10:12:37.017760 open("/etc/localdomains", O_RDONLY) = 9
[pid 25522] 10:12:37.017807 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.017864 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.017910 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:37.017948 lseek(9, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.017982 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25522] 10:12:37.018049 stat("/jail_owner", 0x7ffd5c5bb110) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.018099 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.018174 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.018224 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.018283 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.018333 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.018401 open("/etc/demouids", O_RDONLY) = 10
[pid 25522] 10:12:37.018446 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.018496 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.018542 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b12000
[pid 25522] 10:12:37.018579 lseek(10, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.018613 read(10, "", 4096) = 0
[pid 25522] 10:12:37.018653 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.018806 getuid()    = 0
[pid 25522] 10:12:37.018847 geteuid()   = 0
[pid 25522] 10:12:37.018882 getgid()    = 12
[pid 25522] 10:12:37.018916 getegid()   = 12
[pid 25522] 10:12:37.019016 open("/dev/urandom", O_RDONLY) = 11
[pid 25522] 10:12:37.019065 read(11, "2\246ok", 4) = 4
[pid 25522] 10:12:37.019104 close(11)   = 0
[pid 25522] 10:12:37.019218 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25522] 10:12:37.019324 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b56a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.019371 lseek(0, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.019416 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b56a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.019590 lseek(1, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.019629 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b56b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.019665 lseek(2, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.019701 open("/dev/null", O_RDONLY) = 11
[pid 25522] 10:12:37.019744 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b5780) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.019780 lseek(11, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.019814 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:37.019849 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:37.020111 brk(0x174d000) = 0x174d000
[pid 25522] 10:12:37.020170 read(11, "", 8192) = 0
[pid 25522] 10:12:37.020212 close(11)   = 0
[pid 25522] 10:12:37.020588 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.020656 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25522] 10:12:37.020697 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b55b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.020734 lseek(11, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.020793 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25522] 10:12:37.021689 brk(0x176e000) = 0x176e000
[pid 25522] 10:12:37.022072 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25522] 10:12:37.022832 brk(0x178f000) = 0x178f000
[pid 25520] 10:12:37.023165 <... select resumed> ) = 1 (in [11], left {299, 969728})
[pid 25520] 10:12:37.023206 read(11, "\27\3\3\0B", 5) = 5
[pid 25520] 10:12:37.023248 read(11, "\0\0\0\0\0\0\0\3\311\"\0\rw\241\244\356\371\342\215p\37534\323aZ\376\202$\262\233K\356E\370\370\3x\377p\261@\251<\307<\362\226\337VX\237\225y\373\300q\36\222\352&\23\200\213t\236", 66) = 66
[pid 25520] 10:12:37.023300 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25522] 10:12:37.023544 read(11, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25522] 10:12:37.024201 brk(0x17b0000) = 0x17b0000
[pid 25522] 10:12:37.024762 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25522] 10:12:37.025075 read(11, "", 8192) = 0
[pid 25522] 10:12:37.025121 close(11)   = 0
[pid 25522] 10:12:37.025175 stat("/usr/share/amavis/amavis-filter", 0x7f2e3f1b1880) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.025223 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.025277 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.025326 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25522] 10:12:37.025368 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b55b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.025406 lseek(11, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.025525 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25522] 10:12:37.025831 brk(0x17d1000) = 0x17d1000
[pid 25522] 10:12:37.026036 stat("/etc/exim/perl/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026086 stat("/etc/exim/perl/warnings.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026126 stat("/usr/local/cpanel/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026166 stat("/usr/local/cpanel/warnings.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026205 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026293 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026340 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026382 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026424 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026549 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.026594 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:37.026648 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25522] 10:12:37.026691 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b4fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.026728 lseek(12, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.026781 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25522] 10:12:37.027096 read(12, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25522] 10:12:37.028026 brk(0x17f2000 <unfinished ...>
[pid 25523] 10:12:37.028136 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25522] 10:12:37.028665 <... brk resumed> ) = 0x17f2000
[pid 25522] 10:12:37.028895 read(12,  <unfinished ...>
[pid 25523] 10:12:37.029286 read(8,  <unfinished ...>
[pid 25522] 10:12:37.029319 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25522] 10:12:37.029778 read(12,  <unfinished ...>
[pid 25523] 10:12:37.029814 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25522] 10:12:37.030508 <... read resumed> "", 8192) = 0
[pid 25522] 10:12:37.030545 close(12)   = 0
[pid 25522] 10:12:37.031222 read(11,  <unfinished ...>
[pid 25523] 10:12:37.031351 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25523] 10:12:37.031962 read(8,  <unfinished ...>
[pid 25522] 10:12:37.031997 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25523] 10:12:37.032736 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25523] 10:12:37.033083 brk(0x14cb000 <unfinished ...>
[pid 25522] 10:12:37.033339 read(11,  <unfinished ...>
[pid 25523] 10:12:37.033390 <... brk resumed> ) = 0x14cb000
[pid 25523] 10:12:37.034289 read(8,  <unfinished ...>
[pid 25522] 10:12:37.034342 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25523] 10:12:37.035535 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25522] 10:12:37.036641 read(11, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25523] 10:12:37.037391 brk(0x14ec000 <unfinished ...>
[pid 25522] 10:12:37.038061 brk(0x1813000) = 0x1813000
[pid 25522] 10:12:37.038184 read(11, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25522] 10:12:37.038792 read(11,  <unfinished ...>
[pid 25523] 10:12:37.038827 <... brk resumed> ) = 0x14ec000
[pid 25523] 10:12:37.039011 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25523] 10:12:37.039567 read(8,  <unfinished ...>
[pid 25522] 10:12:37.039686 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25522] 10:12:37.040180 brk(0x1834000 <unfinished ...>
[pid 25523] 10:12:37.040215 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25522] 10:12:37.040646 <... brk resumed> ) = 0x1834000
[pid 25523] 10:12:37.040900 brk(0x150d000 <unfinished ...>
[pid 25522] 10:12:37.041295 read(11,  <unfinished ...>
[pid 25523] 10:12:37.041328 <... brk resumed> ) = 0x150d000
[pid 25523] 10:12:37.041487 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25523] 10:12:37.042215 read(8,  <unfinished ...>
[pid 25522] 10:12:37.042250 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25522] 10:12:37.042887 read(11,  <unfinished ...>
[pid 25523] 10:12:37.042923 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25523] 10:12:37.043388 brk(0x152e000 <unfinished ...>
[pid 25522] 10:12:37.043422 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25522] 10:12:37.043877 brk(0x1855000 <unfinished ...>
[pid 25523] 10:12:37.043912 <... brk resumed> ) = 0x152e000
[pid 25523] 10:12:37.044249 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25522] 10:12:37.044284 <... brk resumed> ) = 0x1855000
[pid 25522] 10:12:37.044645 read(11, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25523] 10:12:37.044727 <... stat resumed> 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.045332 read(11,  <unfinished ...>
[pid 25523] 10:12:37.045364 stat("/usr/local/cpanel/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045415 stat("/etc/exim/perl/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045454 stat("/etc/exim/perl/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045492 stat("/usr/local/cpanel/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045587 stat("/usr/local/cpanel/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045631 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045692 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045747 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045792 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045834 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045876 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045918 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.045958 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25523] 10:12:37.046015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25523] 10:12:37.046061 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e8317d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.046105 lseek(9, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.046160 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25523] 10:12:37.046389 lseek(9, 878, SEEK_SET) = 878
[pid 25523] 10:12:37.046433 lseek(9, 0, SEEK_CUR) = 878
[pid 25523] 10:12:37.046466 close(9)    = 0
[pid 25523] 10:12:37.046807 read(8,  <unfinished ...>
[pid 25522] 10:12:37.046840 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25522] 10:12:37.047090 brk(0x1876000 <unfinished ...>
[pid 25523] 10:12:37.047122 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25522] 10:12:37.047573 <... brk resumed> ) = 0x1876000
[pid 25522] 10:12:37.048154 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25523] 10:12:37.048385 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25523] 10:12:37.048609 brk(0x154f000) = 0x154f000
[pid 25522] 10:12:37.049571 <... stat resumed> 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049604 stat("/usr/local/cpanel/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049651 stat("/etc/exim/perl/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049688 stat("/etc/exim/perl/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049726 stat("/usr/local/cpanel/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049763 stat("/usr/local/cpanel/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049801 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049842 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049901 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049942 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.049983 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.050022 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.050062 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.050101 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:37.050162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25522] 10:12:37.050206 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b4fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.050244 lseek(12, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.050298 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25522] 10:12:37.050609 lseek(12, 878, SEEK_SET) = 878
[pid 25522] 10:12:37.050655 lseek(12, 0, SEEK_CUR) = 878
[pid 25522] 10:12:37.050689 close(12)   = 0
[pid 25522] 10:12:37.050930 read(11, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25522] 10:12:37.051413 brk(0x1897000 <unfinished ...>
[pid 25523] 10:12:37.051670 read(8,  <unfinished ...>
[pid 25522] 10:12:37.051704 <... brk resumed> ) = 0x1897000
[pid 25523] 10:12:37.051729 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25522] 10:12:37.051862 read(11,  <unfinished ...>
[pid 25523] 10:12:37.052084 brk(0x1570000 <unfinished ...>
[pid 25522] 10:12:37.052114 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25523] 10:12:37.052573 <... brk resumed> ) = 0x1570000
[pid 25523] 10:12:37.053763 read(8,  <unfinished ...>
[pid 25522] 10:12:37.054473 brk(0x18b8000) = 0x18b8000
[pid 25522] 10:12:37.054681 read(11, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25522] 10:12:37.055733 brk(0x18d9000 <unfinished ...>
[pid 25523] 10:12:37.055777 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25523] 10:12:37.055903 brk(0x1591000) = 0x1591000
[pid 25523] 10:12:37.056773 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.056835 stat("/usr/local/cpanel/Errno.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.056878 stat("/etc/exim/perl/Errno.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.056916 stat("/etc/exim/perl/Errno.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.056953 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.056990 stat("/usr/local/cpanel/Errno.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.057028 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.057072 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.057122 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.057162 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.057203 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25522] 10:12:37.057225 <... brk resumed> ) = 0x18d9000
[pid 25523] 10:12:37.057250 <... stat resumed> 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25520] 10:12:37.057349 <... select resumed> ) = 1 (in [11], left {299, 965973})
[pid 25520] 10:12:37.057394 read(11, "\27\3\3\0B", 5) = 5
[pid 25520] 10:12:37.057441 read(11, "\0\0\0\0\0\0\0\4\312d\255X\304F\227+\fN\352\275\265\335\311<a\247\36\16\232 \375\244\207\26\1\216\362z\267\257m\366\231\\\266\210\2126\2060VT\33\370\372\317\325{\3254\354\350XD\326\356", 66) = 66
[pid 25520] 10:12:37.057491 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25523] 10:12:37.057596 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25523] 10:12:37.057660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25523] 10:12:37.057705 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e8317d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.057743 lseek(9, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.057801 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25523] 10:12:37.058006 brk(0x15b2000 <unfinished ...>
[pid 25522] 10:12:37.058210 read(11,  <unfinished ...>
[pid 25523] 10:12:37.058241 <... brk resumed> ) = 0x15b2000
[pid 25520] 10:12:37.058307 <... select resumed> ) = 1 (in [11], left {299, 999283})
[pid 25520] 10:12:37.058338 read(11, "\27\3\3\0C", 5) = 5
[pid 25520] 10:12:37.058376 read(11, "\0\0\0\0\0\0\0\5c\22\376`\332!w`.\30\270k\272\v\301&Wd\33\362\262\10nd\206\247L\260\230\16G\221h\352\203\32t\243>;\364\5-\370\305\237\351\336<A.\364\212\312\33\234A\243 ", 67) = 67
[pid 25520] 10:12:37.058460 lseek(6, 19, SEEK_SET) = 19
[pid 25520] 10:12:37.058500 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25520] 10:12:37.058620 read(6, "", 8192) = 0
[pid 25520] 10:12:37.058658 alarm(300)  = 0
[pid 25520] 10:12:37.058704 write(11, "\27\3\3\f{\270\216\27\217\177l\231\320j]\7,\277\"\242^0\16\316r\344\323\234\341L\252W\233_\354I\207h\36\27\223C\5\35R\212\253\205\210\237UrY\211\4\337\243\347\231U\326tL\27L\361\344Q\211.Al~\220\326\2034\260\177\247\374\32\rz\371\302\314S6\230u/\274\243\317\325\245*V\234\v\207\200\0319\243f\37\241X2x1@'\26\34\376E82\302\311K\"\355Fq\270\260\315 \213\3779u\270V\376\262\7\244p\227\341Mhqe}\325\371\355\336\344\373\201j\3772o\276\346^\245\320h\324\233\311\267\210\267\332O2\321/v\30\253.\322U\306\333\324\35\370\241\306\3008\362\275\225s\320\200e\376K&\21\364\244\342G&\200G\323Ml\231\207\275\226\310w(\3470\365Gk\366C\246\2\2\v:\307\203\320hxk\326\312\267\232\275\214S\364b1\1\v\2713,v\200"..., 3200) = 3200
[pid 25520] 10:12:37.058783 alarm(0)    = 300
[pid 25520] 10:12:37.058819 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25522] 10:12:37.058854 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25523] 10:12:37.059846 lseek(9, 4868, SEEK_SET) = 4868
[pid 25523] 10:12:37.059898 lseek(9, 0, SEEK_CUR) = 4868
[pid 25523] 10:12:37.059933 close(9)    = 0
[pid 25523] 10:12:37.059983 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060028 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060068 stat("/etc/exim/perl/Exporter.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060106 stat("/etc/exim/perl/Exporter.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060143 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060181 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060220 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060262 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffe0e8319e0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060575 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffe0e831a80) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.060630 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25523] 10:12:37.060688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25523] 10:12:37.060733 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe0e8317d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25523] 10:12:37.060770 lseek(9, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.060819 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25502] 10:12:37.061111 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25502] 10:12:37.061151 recvfrom(16, "&\344\201\200\0\1\0\1\0\0\0\0\20westernskiesgolf\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\7\7\0\t\0\n\4mail\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 59
[pid 25502] 10:12:37.061213 close(16)   = 0
[pid 25502] 10:12:37.061288 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25502] 10:12:37.061331 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25502] 10:12:37.061375 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25502] 10:12:37.061414 sendto(16, "\366\362\1\0\0\1\0\0\0\0\0\0\4mail\20westernskiesgolf\3com\0\0\1\0\1", 43, MSG_NOSIGNAL, NULL, 0) = 43
[pid 25502] 10:12:37.061482 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25522] 10:12:37.061743 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25523] 10:12:37.061971 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.062004 <... stat resumed> 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062027 stat("/usr/local/cpanel/Errno.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062070 stat("/etc/exim/perl/Errno.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062114 stat("/etc/exim/perl/Errno.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062152 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062188 stat("/usr/local/cpanel/Errno.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062227 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062266 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062307 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062346 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062388 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.062428 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:37.062483 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25522] 10:12:37.062598 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b4fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.062638 lseek(12, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.062673 <... lseek resumed> ) = 2366
[pid 25522] 10:12:37.062715 read(12,  <unfinished ...>
[pid 25523] 10:12:37.062738 lseek(9, 0, SEEK_CUR) = 2366
[pid 25523] 10:12:37.062771 close(9)    = 0
[pid 25523] 10:12:37.063090 read(8,  <unfinished ...>
[pid 25522] 10:12:37.063122 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25522] 10:12:37.063231 brk(0x18fa000) = 0x18fa000
[pid 25523] 10:12:37.063575 <... read resumed> "", 8192) = 0
[pid 25523] 10:12:37.063609 close(8)    = 0
[pid 25523] 10:12:37.063842 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.064132 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25523] 10:12:37.064174 <... open resumed> ) = 8
[pid 25523] 10:12:37.064203 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25523] 10:12:37.064254 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745961000
[pid 25523] 10:12:37.064293 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25523] 10:12:37.064341 close(8)    = 0
[pid 25523] 10:12:37.064378 munmap(0x7fd745961000, 4096) = 0
[pid 25523] 10:12:37.064465 lseek(6, 19, SEEK_SET) = 19
[pid 25523] 10:12:37.064505 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.064608 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.064645 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fd744819790},  <unfinished ...>
[pid 25522] 10:12:37.064676 <... lseek resumed> ) = 4868
[pid 25523] 10:12:37.064695 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.064714 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25523] 10:12:37.064734 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fd744819790},  <unfinished ...>
[pid 25522] 10:12:37.064756 <... lseek resumed> ) = 4868
[pid 25523] 10:12:37.064774 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.064793 close(12 <unfinished ...>
[pid 25523] 10:12:37.064812 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fd744819790},  <unfinished ...>
[pid 25522] 10:12:37.064835 <... close resumed> ) = 0
[pid 25523] 10:12:37.064854 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25523] 10:12:37.064875 alarm(300 <unfinished ...>
[pid 25522] 10:12:37.064910 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25523] 10:12:37.064936 <... alarm resumed> ) = 0
[pid 25523] 10:12:37.064954 alarm(0)    = 300
[pid 25523] 10:12:37.064986 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.065021 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25522] 10:12:37.065058 <... stat resumed> 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.065078 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25523] 10:12:37.065113 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790},  <unfinished ...>
[pid 25522] 10:12:37.065135 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25523] 10:12:37.065155 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.065175 <... stat resumed> 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.065195 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fd744819790}, NULL, 8) = 0
[pid 25522] 10:12:37.065232 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25523] 10:12:37.065255 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7435626a0},  <unfinished ...>
[pid 25522] 10:12:37.065279 <... stat resumed> 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.065298 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, 8) = 0
[pid 25522] 10:12:37.065321 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25523] 10:12:37.065342 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fd7435626a0},  <unfinished ...>
[pid 25522] 10:12:37.065365 <... stat resumed> 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25523] 10:12:37.065390 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, 8) = 0
[pid 25523] 10:12:37.065422 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.065448 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.065492 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25523] 10:12:37.065598 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.065636 <... stat resumed> 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.065660 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25523] 10:12:37.065695 open("/var/spool/exim/input/b/hdr.25523", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25522] 10:12:37.065724 <... stat resumed> 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.065744 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25523] 10:12:37.065813 <... open resumed> ) = 8
[pid 25522] 10:12:37.065839 <... stat resumed> 0x7ffd5c5b51d0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.065868 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd5c5b5270) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.065910 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25522] 10:12:37.065962 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25522] 10:12:37.066004 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b4fc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.066041 lseek(12, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.066088 read(12,  <unfinished ...>
[pid 25523] 10:12:37.066111 fchown(8, 47, 12) = 0
[pid 25523] 10:12:37.066149 fchmod(8, 0640) = 0
[pid 25522] 10:12:37.066186 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25523] 10:12:37.066210 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25523] 10:12:37.066615 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.066670 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745961000
[pid 25523] 10:12:37.066709 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.066758 write(8, "1aEJMb-0006df-04-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 432) = 432
[pid 25523] 10:12:37.066808 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=432, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.066858 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006df-04; Wed, 30 Dec 2015 10:12:37 -0600\n074T To:  antiquewedding@gmail.com, antiqueweddinghouse@finestwed"..., 557) = 557
[pid 25523] 10:12:37.066897 fsync(8 <unfinished ...>
[pid 25522] 10:12:37.067090 lseek(12, 2366, SEEK_SET) = 2366
[pid 25522] 10:12:37.067227 lseek(12, 0, SEEK_CUR) = 2366
[pid 25522] 10:12:37.067261 close(12)   = 0
[pid 25523] 10:12:37.067583 <... fsync resumed> ) = 0
[pid 25523] 10:12:37.067614 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=989, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.067665 close(8)    = 0
[pid 25523] 10:12:37.067700 munmap(0x7fd745961000, 4096) = 0
[pid 25523] 10:12:37.067743 rename("/var/spool/exim/input/b/hdr.25523", "/var/spool/exim/input/b/1aEJMb-0006df-04-H") = 0
[pid 25523] 10:12:37.067809 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25523] 10:12:37.067851 fsync(8)    = 0
[pid 25523] 10:12:37.067885 close(8)    = 0
[pid 25523] 10:12:37.067920 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.067979 open("/var/spool/exim/msglog/b/1aEJMb-0006df-04", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25523] 10:12:37.068054 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25523] 10:12:37.068091 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25523] 10:12:37.068136 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd745961000
[pid 25523] 10:12:37.068173 lseek(8, 0, SEEK_CUR) = 0
[pid 25523] 10:12:37.068207 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:37.068263 write(8, "2015-12-30 10:12:37 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2376 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25523] 10:12:37.068307 close(8)    = 0
[pid 25523] 10:12:37.068341 munmap(0x7fd745961000, 4096) = 0
[pid 25523] 10:12:37.068381 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:37.068439 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25523] 10:12:37.068490 close(7)    = 0
[pid 25523] 10:12:37.068607 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25523] 10:12:37.068653 fcntl(7, F_GETFD) = 0
[pid 25523] 10:12:37.068686 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25523] 10:12:37.068718 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5380214, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25523] 10:12:37.068762 write(7, "2015-12-30 10:12:37 [25523] 1aEJMb-0006df-04 <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2376 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for antiquewedding@gmail.com antiqueweddinghouse@fi"..., 311) = 311
[pid 25523] 10:12:37.068806 close(6)    = 0
[pid 25523] 10:12:37.068842 munmap(0x7fd745962000, 4096) = 0
[pid 25523] 10:12:37.068879 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, 8) = 0
[pid 25523] 10:12:37.068919 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fd7435626a0}, 8) = 0
[pid 25523] 10:12:37.068958 open("/proc/loadavg", O_RDONLY) = 6
[pid 25502] 10:12:37.068999 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25502] 10:12:37.069022 recvfrom(16, "\366\362\201\200\0\1\0\1\0\0\0\0\4mail\20westernskiesgolf\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\7\10\0\4l\250\250K", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 59
[pid 25502] 10:12:37.069069 close(16)   = 0
[pid 25502] 10:12:37.069130 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25502] 10:12:37.069172 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25502] 10:12:37.069218 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25502] 10:12:37.069262 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25502] 10:12:37.069307 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25502] 10:12:37.069349 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25502] 10:12:37.069386 close(16)   = 0
[pid 25502] 10:12:37.069425 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25502] 10:12:37.069488 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25502] 10:12:37.069610 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be45000
[pid 25502] 10:12:37.069649 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25502] 10:12:37.069711 read(16, "", 1024) = 0
[pid 25502] 10:12:37.069759 read(16, "", 1024) = 0
[pid 25502] 10:12:37.069797 close(16)   = 0
[pid 25502] 10:12:37.069833 munmap(0x7f3c0be45000, 4096) = 0
[pid 25502] 10:12:37.069958 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25502] 10:12:37.070032 open("/etc/passwd", O_RDONLY) = 16
[pid 25502] 10:12:37.070075 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffced97bff0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:37.070113 lseek(16, 0, SEEK_CUR) = 0
[pid 25502] 10:12:37.070148 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:37.070194 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.070239 read(16, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25502] 10:12:37.070484 close(16)   = 0
[pid 25502] 10:12:37.070618 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 16
[pid 25502] 10:12:37.070671 alarm(60)   = 0
[pid 25502] 10:12:37.070707 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25502] 10:12:37.070746 alarm(0)    = 60
[pid 25502] 10:12:37.070791 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.070839 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 17
[pid 25502] 10:12:37.070881 read(17, "cpu  123082 1342452 395230 67343099 2509 0 0 0\ncpu0 123082 1342452 395230 67343099 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58509187\nbtime 1450798266\nprocesses 893005\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25502] 10:12:37.070941 close(17)   = 0
[pid 25502] 10:12:37.070991 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25502] 10:12:37.071048 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25502] 10:12:37.071088 fcntl(17, F_GETFD) = 0
[pid 25502] 10:12:37.071121 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.071155 read(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25502] 10:12:37.071205 close(17)   = 0
[pid 25502] 10:12:37.071244 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.071285 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25502] 10:12:37.071358 brk(0x12e3000) = 0x12e3000
[pid 25502] 10:12:37.071595 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25502] 10:12:37.071646 fcntl(17, F_GETFD) = 0
[pid 25502] 10:12:37.071680 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.071714 fstat(17, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25502] 10:12:37.071774 pread(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25502] 10:12:37.071838 pread(17, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25502] 10:12:37.071896 pread(17, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25502] 10:12:37.071961 close(17)   = 0
[pid 25502] 10:12:37.072014 close(16)   = 0
[pid 25502] 10:12:37.072063 lseek(13, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.072100 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25502] 10:12:37.072153 stat("/jail_owner", 0x7ffced97a9d0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.072200 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:37.072263 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.072312 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:37.072383 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.072437 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.072612 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.072737 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.072809 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.072871 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.072931 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 16
[pid 25502] 10:12:37.072973 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.073022 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.073067 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be45000
[pid 25502] 10:12:37.073104 lseek(16, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.073138 read(16, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25502] 10:12:37.073213 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4130, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:37.073288 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY) = 17
[pid 25502] 10:12:37.073337 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffced977970) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25502] 10:12:37.073377 lseek(17, 0, SEEK_CUR) = 0
[pid 25502] 10:12:37.073418 fstat(17, {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4130, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:37.073474 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.073602 read(17, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4130
[pid 25502] 10:12:37.074246 read(17, "", 8192) = 0
[pid 25502] 10:12:37.074289 close(17)   = 0
[pid 25502] 10:12:37.074345 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.074416 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:37.074478 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:37.074557 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25502] 10:12:37.074604 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:37.074651 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be44000
[pid 25502] 10:12:37.074690 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:37.074744 close(17)   = 0
[pid 25502] 10:12:37.074779 munmap(0x7f3c0be44000, 4096) = 0
[pid 25502] 10:12:37.074829 open("/etc/group", O_RDONLY|O_CLOEXEC) = 17
[pid 25502] 10:12:37.074871 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:37.074917 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be44000
[pid 25502] 10:12:37.074954 read(17, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:37.075004 close(17)   = 0
[pid 25502] 10:12:37.075039 munmap(0x7f3c0be44000, 4096) = 0
[pid 25502] 10:12:37.075083 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25502] 10:12:37.075134 pipe([17, 18]) = 0
[pid 25502] 10:12:37.075172 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:37.075214 close(15)   = 0
[pid 25502] 10:12:37.075249 munmap(0x7f3c0be46000, 4096) = 0
[pid 25502] 10:12:37.075286 close(14)   = 0
[pid 25502] 10:12:37.075320 munmap(0x7f3c0be47000, 4096) = 0
[pid 25502] 10:12:37.075357 close(9)    = 0
[pid 25502] 10:12:37.075398 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:37.075443 close(13)   = 0
[pid 25502] 10:12:37.075483 munmap(0x7f3c0be48000, 4096) = 0
[pid 25502] 10:12:37.075640 close(12)   = 0
[pid 25502] 10:12:37.075678 munmap(0x7f3c0be49000, 4096) = 0
[pid 25502] 10:12:37.075713 close(16)   = 0
[pid 25502] 10:12:37.075747 munmap(0x7f3c0be45000, 4096) = 0
[pid 25502] 10:12:37.075783 close(11)   = 0
[pid 25502] 10:12:37.075817 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25502] 10:12:37.075853 close(10)   = 0
[pid 25502] 10:12:37.075886 munmap(0x7f3c0be4b000, 4096) = 0
[pid 25502] 10:12:37.075922 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25528
[pid 25502] 10:12:37.076246 close(18)   = 0
[pid 25502] 10:12:37.076283 read(17,  <unfinished ...>
[pid 25523] 10:12:37.076306 read(6, "0.18 0.08 0.01 3/253 25528\n", 40) = 27
[pid 25523] 10:12:37.076347 close(6)    = 0
[pid 25523] 10:12:37.076394 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fd74594ca90) = 25529
[pid 25522] 10:12:37.076841 read(11,  <unfinished ...>
[pid 25523] 10:12:37.077103 exit_group(0) = ?
[pid 25522] 10:12:37.077129 <... read resumed> "", 8192) = 0
[pid 25522] 10:12:37.077152 close(11)   = 0
[pid 25522] 10:12:37.077374 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.077618 open("/etc/userdomains", O_RDONLY) = 11
[pid 25522] 10:12:37.077660 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.077710 fstat(11,  <unfinished ...>
[pid 25523] 10:12:37.077878 +++ exited with 0 +++
[pid 25389] 10:12:37.077913 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25523
[pid 25389] 10:12:37.077939 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:37.078086 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:37.078128 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25530
[pid 25389] 10:12:37.078726 close(5)    = 0
[pid 25389] 10:12:37.078762 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:37.078798 fstat(6, {st_dev=makedev(0, 8), st_ino=2130169144, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25389] 10:12:37.078846 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:37.078892 write(6, "To:  wendy.laws@hilton.com, embassy-airport@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"t"..., 2088) = 2088
[pid 25389] 10:12:37.078933 close(6)    = 0
[pid 25389] 10:12:37.078966 wait4(25530,  <unfinished ...>
[pid 25522] 10:12:37.078987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.079020 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b11000
[pid 25522] 10:12:37.079055 lseek(11, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.079088 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25522] 10:12:37.079154 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25522] 10:12:37.079201 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.079253 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b10000
[pid 25522] 10:12:37.079289 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.079341 close(12)   = 0
[pid 25522] 10:12:37.079376 munmap(0x7f2e40b10000, 4096) = 0
[pid 25522] 10:12:37.079433 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.079496 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.079562 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25522] 10:12:37.079605 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.079653 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.079697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b10000
[pid 25522] 10:12:37.079732 lseek(12, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.079765 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25522] 10:12:37.079811 read(12, "", 4096) = 0
[pid 25522] 10:12:37.079876 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2957, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:37.079956 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY) = 13
[pid 25522] 10:12:37.080002 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd5c5b80b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.080040 lseek(13, 0, SEEK_CUR) = 0
[pid 25522] 10:12:37.080077 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2957, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:37.080123 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:37.080187 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2957
[pid 25522] 10:12:37.080872 read(13, "", 8192) = 0
[pid 25522] 10:12:37.080925 close(13)   = 0
[pid 25522] 10:12:37.080995 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.081076 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.081137 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.081217 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25522] 10:12:37.081269 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.081317 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b0f000
[pid 25522] 10:12:37.081354 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.081405 close(13)   = 0
[pid 25522] 10:12:37.081441 munmap(0x7f2e40b0f000, 4096) = 0
[pid 25522] 10:12:37.081486 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.081542 pipe([13, 14]) = 0
[pid 25522] 10:12:37.081579 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:37.081620 close(10)   = 0
[pid 25522] 10:12:37.081653 munmap(0x7f2e40b12000, 4096) = 0
[pid 25522] 10:12:37.081689 close(11)   = 0
[pid 25522] 10:12:37.081722 munmap(0x7f2e40b11000, 4096) = 0
[pid 25522] 10:12:37.081757 close(12)   = 0
[pid 25522] 10:12:37.081790 munmap(0x7f2e40b10000, 4096) = 0
[pid 25522] 10:12:37.081824 close(9)    = 0
[pid 25522] 10:12:37.081857 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:37.081892 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25531
[pid 25522] 10:12:37.082200 close(14)   = 0
[pid 25522] 10:12:37.082235 read(13, Process 25530 attached
 <unfinished ...>
[pid 25530] 10:12:37.082288 set_robust_list(0x7ff3d4f3fac0, 24) = 0
[pid 25530] 10:12:37.082341 close(6)    = 0
[pid 25530] 10:12:37.082375 dup2(5, 0)  = 0
[pid 25530] 10:12:37.082408 close(5)    = 0
[pid 25530] 10:12:37.082444 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"]) = 0
[pid 25530] 10:12:37.082966 brk(0)      = 0x1f83000
[pid 25530] 10:12:37.083020 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe2c000
[pid 25530] 10:12:37.083066 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.083187 open("/etc/ld.so.cache", O_RDONLY) = 5
[pid 25530] 10:12:37.083233 fstat(5, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25530] 10:12:37.083281 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f71ebe22000
[pid 25530] 10:12:37.083318 close(5)    = 0
[pid 25530] 10:12:37.083360 open("/lib64/libtinfo.so.5", O_RDONLY) = 5
[pid 25530] 10:12:37.083401 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.083442 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.083492 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f71eb9ed000
[pid 25530] 10:12:37.083592 mprotect(0x7f71eba0a000, 2093056, PROT_NONE) = 0
[pid 25530] 10:12:37.083630 mmap(0x7f71ebc09000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000) = 0x7f71ebc09000
[pid 25530] 10:12:37.083674 mmap(0x7f71ebc0d000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f71ebc0d000
[pid 25530] 10:12:37.083713 close(5)    = 0
[pid 25530] 10:12:37.083770 open("/lib64/libdl.so.2", O_RDONLY) = 5
[pid 25530] 10:12:37.083815 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.083855 fstat(5, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.083907 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f71eb7e9000
[pid 25530] 10:12:37.083944 mprotect(0x7f71eb7eb000, 2097152, PROT_NONE) = 0
[pid 25530] 10:12:37.083981 mmap(0x7f71eb9eb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f71eb9eb000
[pid 25530] 10:12:37.084025 close(5)    = 0
[pid 25530] 10:12:37.084065 open("/lib64/libc.so.6", O_RDONLY) = 5
[pid 25530] 10:12:37.084106 read(5, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.084146 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.084192 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe21000
[pid 25530] 10:12:37.084232 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f71eb455000
[pid 25530] 10:12:37.084268 mprotect(0x7f71eb5df000, 2097152, PROT_NONE) = 0
[pid 25530] 10:12:37.084304 mmap(0x7f71eb7df000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000) = 0x7f71eb7df000
[pid 25530] 10:12:37.084345 mmap(0x7f71eb7e4000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f71eb7e4000
[pid 25530] 10:12:37.084386 close(5)    = 0
[pid 25530] 10:12:37.084439 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe20000
[pid 25530] 10:12:37.084478 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe1f000
[pid 25530] 10:12:37.084519 arch_prctl(ARCH_SET_FS, 0x7f71ebe20700) = 0
[pid 25530] 10:12:37.084639 mprotect(0x7f71eb7df000, 16384, PROT_READ) = 0
[pid 25530] 10:12:37.084683 mprotect(0x7f71eb9eb000, 4096, PROT_READ) = 0
[pid 25530] 10:12:37.084769 mprotect(0x7f71ebe2d000, 4096, PROT_READ) = 0
[pid 25530] 10:12:37.084807 munmap(0x7f71ebe22000, 39387) = 0
[pid 25530] 10:12:37.084874 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.084921 open("/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address)
[pid 25530] 10:12:37.084974 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd8919c7e0) = -1 EINVAL (Invalid argument)
[pid 25530] 10:12:37.085036 brk(0)      = 0x1f83000
[pid 25530] 10:12:37.085109 brk(0x1fa4000) = 0x1fa4000
[pid 25530] 10:12:37.085166 getuid()    = 503
[pid 25530] 10:12:37.085202 getgid()    = 500
[pid 25530] 10:12:37.085234 geteuid(Process 25528 attached
Process 25529 attached
)   = 503
[pid 25530] 10:12:37.085308 getegid( <unfinished ...>
[pid 25529] 10:12:37.085343 set_robust_list(0x7fd74594caa0, 24 <unfinished ...>
[pid 25530] 10:12:37.085366 <... getegid resumed> ) = 500
[pid 25528] 10:12:37.085397 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25530] 10:12:37.085428 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25529] 10:12:37.085449 <... set_robust_list resumed> ) = 0
[pid 25529] 10:12:37.085487 close(0 <unfinished ...>
[pid 25530] 10:12:37.085623 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.085686 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25528] 10:12:37.085711 <... set_robust_list resumed> ) = 0
[pid 25528] 10:12:37.085751 close(17 <unfinished ...>
[pid 25529] 10:12:37.085777 <... close resumed> ) = 0
[pid 25529] 10:12:37.085801 close(1 <unfinished ...>
[pid 25528] 10:12:37.085821 <... close resumed> ) = 0
[pid 25529] 10:12:37.085839 <... close resumed> ) = 0
[pid 25528] 10:12:37.085866 geteuid( <unfinished ...>
[pid 25529] 10:12:37.085887 close(2)    = 0
[pid 25529] 10:12:37.085976 setsid( <unfinished ...>
[pid 25530] 10:12:37.086010 <... open resumed> ) = 5
[pid 25528] 10:12:37.086030 <... geteuid resumed> ) = 0
[pid 25528] 10:12:37.086048 getegid()   = 12
[pid 25528] 10:12:37.086083 setgid(500) = 0
[pid 25530] 10:12:37.086122 fstat(5,  <unfinished ...>
[pid 25528] 10:12:37.086143 setuid(503) = 0
[pid 25528] 10:12:37.086204 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.086229 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.086262 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe2b000
[pid 25530] 10:12:37.086299 read(5, "MemTotal:        1048576 kB\nMemFree:          236296 kB\nCached:           334184 kB\nBuffers:               0 kB\nActive:           312708 kB\nInactive:         467656 kB\nActive(anon):     176380 kB\nInactive(anon):   277604 kB\nActive(file):     136328 kB\nInac"..., 1024) = 588
[pid 25528] 10:12:37.086375 <... open resumed> ) = 9
[pid 25529] 10:12:37.086395 <... setsid resumed> ) = 25529
[pid 25528] 10:12:37.086420 fstat(9,  <unfinished ...>
[pid 25529] 10:12:37.086445 fstat(0,  <unfinished ...>
[pid 25530] 10:12:37.086480 close(5 <unfinished ...>
[pid 25528] 10:12:37.086500 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.086538 <... fstat resumed> 0x7ffe0e836300) = -1 EBADF (Bad file descriptor)
[pid 25529] 10:12:37.086563 open("/dev/null", O_RDWR <unfinished ...>
[pid 25528] 10:12:37.086674 fstat(9,  <unfinished ...>
[pid 25529] 10:12:37.086709 <... open resumed> ) = 0
[pid 25530] 10:12:37.086733 <... close resumed> ) = 0
[pid 25529] 10:12:37.086754 fstat(1, 0x7ffe0e836300) = -1 EBADF (Bad file descriptor)
[pid 25530] 10:12:37.086787 munmap(0x7f71ebe2b000, 4096 <unfinished ...>
[pid 25529] 10:12:37.086815 dup2(0, 1 <unfinished ...>
[pid 25530] 10:12:37.086840 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.086892 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0},  <unfinished ...>
[pid 25529] 10:12:37.086920 <... dup2 resumed> ) = 1
[pid 25529] 10:12:37.086939 fstat(2, 0x7ffe0e836300) = -1 EBADF (Bad file descriptor)
[pid 25529] 10:12:37.086973 dup2(0, 2)  = 2
[pid 25529] 10:12:37.087006 geteuid()   = 47
[pid 25529] 10:12:37.087045 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25529] 10:12:37.087094 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25529] 10:12:37.087138 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25530] 10:12:37.087182 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25529] 10:12:37.087208 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMb-0006df-04"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25530] 10:12:37.087306 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0}, 8) = 0
[pid 25530] 10:12:37.087334 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.087896 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, 8) = 0
[pid 25530] 10:12:37.087941 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.087978 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, 8) = 0
[pid 25528] 10:12:37.088015 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25530] 10:12:37.088049 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25528] 10:12:37.088070 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.088092 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.088116 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f71eb4876a0},  <unfinished ...>
[pid 25528] 10:12:37.088140 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25530] 10:12:37.088159 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, 8) = 0
[pid 25528] 10:12:37.088180 read(9,  <unfinished ...>
[pid 25530] 10:12:37.088202 uname( <unfinished ...>
[pid 25528] 10:12:37.088236 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25530] 10:12:37.088261 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25530] 10:12:37.088333 getcwd( <unfinished ...>
[pid 25528] 10:12:37.088357 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25528] 10:12:37.088403 close(9)    = 0
[pid 25528] 10:12:37.088438 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25530] 10:12:37.088584 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25530] 10:12:37.088623 getpid()    = 25530
[pid 25530] 10:12:37.088668 getppid( <unfinished ...>
[pid 25528] 10:12:37.089050 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.089077 <... getppid resumed> ) = 25389
[pid 25530] 10:12:37.089106 stat(".", {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25530] 10:12:37.089164 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.089217 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.089265 geteuid()   = 503
[pid 25530] 10:12:37.089296 getegid()   = 500
[pid 25530] 10:12:37.089326 getuid()    = 503
[pid 25530] 10:12:37.089359 getgid()    = 500
[pid 25530] 10:12:37.089390 access("/bin/sh", X_OK) = 0
[pid 25530] 10:12:37.089579 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.089638 geteuid()   = 503
[pid 25530] 10:12:37.089669 getegid()   = 500
[pid 25530] 10:12:37.089700 getuid()    = 503
[pid 25530] 10:12:37.089730 getgid()    = 500
[pid 25530] 10:12:37.089761 access("/bin/sh", R_OK) = 0
[pid 25530] 10:12:37.089798 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.089845 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.089891 geteuid()   = 503
[pid 25530] 10:12:37.089921 getegid()   = 500
[pid 25530] 10:12:37.089952 getuid()    = 503
Process 25531 attached
[pid 25530] 10:12:37.090004 getgid()    = 500
[pid 25530] 10:12:37.090035 access("/bin/sh", X_OK) = 0
[pid 25531] 10:12:37.090084 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25530] 10:12:37.090106 stat("/bin/sh", {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25530] 10:12:37.090153 geteuid()   = 503
[pid 25530] 10:12:37.090184 getegid( <unfinished ...>
[pid 25531] 10:12:37.090202 <... set_robust_list resumed> ) = 0
[pid 25530] 10:12:37.090220 <... getegid resumed> ) = 500
[pid 25531] 10:12:37.090259 close(13 <unfinished ...>
[pid 25530] 10:12:37.090286 getuid()    = 503
[pid 25530] 10:12:37.090317 getgid()    = 500
[pid 25530] 10:12:37.090349 access("/bin/sh", R_OK) = 0
[pid 25530] 10:12:37.090399 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.090450 <... execve resumed> ) = 0
[pid 25531] 10:12:37.090472 <... close resumed> ) = 0
[pid 25531] 10:12:37.090498 geteuid( <unfinished ...>
[pid 25530] 10:12:37.090602 <... socket resumed> ) = 5
[pid 25531] 10:12:37.090627 <... geteuid resumed> ) = 0
[pid 25530] 10:12:37.090646 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25531] 10:12:37.090670 getegid( <unfinished ...>
[pid 25530] 10:12:37.090700 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.090720 <... getegid resumed> ) = 12
[pid 25531] 10:12:37.090741 setgid(500 <unfinished ...>
[pid 25529] 10:12:37.090778 brk(0 <unfinished ...>
[pid 25531] 10:12:37.090800 <... setgid resumed> ) = 0
[pid 25531] 10:12:37.090819 setuid(503) = 0
[pid 25530] 10:12:37.090859 close(5)    = 0
[pid 25531] 10:12:37.090929 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.090954 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5
[pid 25530] 10:12:37.090990 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.091012 <... brk resumed> ) = 0x21ca000
[pid 25530] 10:12:37.091036 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.091057 fcntl(0, F_GETFD) = 0
[pid 25529] 10:12:37.091090 fcntl(1, F_GETFD <unfinished ...>
[pid 25530] 10:12:37.091109 close(5 <unfinished ...>
[pid 25529] 10:12:37.091127 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.091145 fcntl(2, F_GETFD <unfinished ...>
[pid 25530] 10:12:37.091166 <... close resumed> ) = 0
[pid 25529] 10:12:37.091184 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.091206 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25530] 10:12:37.091234 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.091259 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.091282 <... open resumed> ) = 5
[pid 25529] 10:12:37.091314 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25531] 10:12:37.091341 <... open resumed> ) = 9
[pid 25530] 10:12:37.091362 fstat(5,  <unfinished ...>
[pid 25531] 10:12:37.091389 fstat(9,  <unfinished ...>
[pid 25530] 10:12:37.091410 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25530] 10:12:37.091443 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe2b000
[pid 25529] 10:12:37.091481 <... mmap resumed> ) = 0x7f21d336f000
[pid 25531] 10:12:37.091501 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25530] 10:12:37.091538 read(5,  <unfinished ...>
[pid 25531] 10:12:37.091593 brk(0x191b000 <unfinished ...>
[pid 25529] 10:12:37.091628 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25530] 10:12:37.091656 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25530] 10:12:37.091692 read(5,  <unfinished ...>
[pid 25529] 10:12:37.091714 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.091741 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.091762 <... read resumed> "", 4096) = 0
[pid 25530] 10:12:37.091788 close(5)    = 0
[pid 25529] 10:12:37.091830 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.091849 munmap(0x7f71ebe2b000, 4096) = 0
[pid 25531] 10:12:37.091887 <... brk resumed> ) = 0x191b000
[pid 25530] 10:12:37.091915 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.091937 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25531] 10:12:37.092021 fstat(9,  <unfinished ...>
[pid 25529] 10:12:37.092046 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.092066 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.092109 <... open resumed> ) = 5
[pid 25529] 10:12:37.092127 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25530] 10:12:37.092148 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.092169 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.092188 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25530] 10:12:37.092219 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0) = 0x7f71ebe22000
[pid 25529] 10:12:37.092255 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.092294 close(5)    = 0
[pid 25530] 10:12:37.092337 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.092358 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.092395 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.092440 <... open resumed> ) = 5
[pid 25529] 10:12:37.092460 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25530] 10:12:37.092670 read(5,  <unfinished ...>
[pid 25529] 10:12:37.092693 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.092744 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.092771 fstat(5, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.092822 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25529] 10:12:37.092844 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25530] 10:12:37.092868 <... mmap resumed> ) = 0x7f71eb247000
[pid 25529] 10:12:37.092893 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.092913 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25531] 10:12:37.092950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.092972 mprotect(0x7f71eb253000, 2097152, PROT_NONE) = 0
[pid 25529] 10:12:37.093010 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25531] 10:12:37.093033 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25529] 10:12:37.093058 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.093078 read(9,  <unfinished ...>
[pid 25530] 10:12:37.093096 mmap(0x7f71eb453000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25531] 10:12:37.093129 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25530] 10:12:37.093156 <... mmap resumed> ) = 0x7f71eb453000
[pid 25529] 10:12:37.093176 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.093225 close(5 <unfinished ...>
[pid 25529] 10:12:37.093246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25531] 10:12:37.093270 read(9,  <unfinished ...>
[pid 25529] 10:12:37.093296 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.093320 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25530] 10:12:37.093344 <... close resumed> ) = 0
[pid 25528] 10:12:37.093364 <... lseek resumed> ) = 19
[pid 25530] 10:12:37.093407 mprotect(0x7f71eb453000, 4096, PROT_READ <unfinished ...>
[pid 25528] 10:12:37.093431 read(6,  <unfinished ...>
[pid 25529] 10:12:37.093451 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25531] 10:12:37.093475 close(9 <unfinished ...>
[pid 25529] 10:12:37.093499 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25528] 10:12:37.093630 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2372) = 1858
[pid 25531] 10:12:37.093658 <... close resumed> ) = 0
[pid 25528] 10:12:37.094136 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25531] 10:12:37.094165 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25529] 10:12:37.094185 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25531] 10:12:37.094211 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.094237 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.094260 <... mprotect resumed> ) = 0
[pid 25531] 10:12:37.094656 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.094685 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25530] 10:12:37.094711 munmap(0x7f71ebe22000, 39387 <unfinished ...>
[pid 25529] 10:12:37.094737 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.094775 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.094800 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.094850 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.094872 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.094916 <... open resumed> ) = 5
[pid 25529] 10:12:37.094934 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.094976 fcntl(5, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.094996 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25530] 10:12:37.095016 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25529] 10:12:37.095039 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.095062 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.095082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.095103 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.095139 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.095158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71ebe2b000
[pid 25529] 10:12:37.095195 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25530] 10:12:37.095215 read(5,  <unfinished ...>
[pid 25529] 10:12:37.095238 <... stat resumed> 0x7ffce2d446a0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.095261 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.095284 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.095338 close(5 <unfinished ...>
[pid 25529] 10:12:37.095358 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.095410 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.095432 <... close resumed> ) = 0
[pid 25529] 10:12:37.095453 <... open resumed> ) = 6
[pid 25530] 10:12:37.095471 munmap(0x7f71ebe2b000, 4096 <unfinished ...>
[pid 25529] 10:12:37.095490 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.095646 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.095669 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.095701 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f21d3365000
[pid 25530] 10:12:37.095774 getpgrp( <unfinished ...>
[pid 25529] 10:12:37.095796 close(6)    = 0
[pid 25529] 10:12:37.095836 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25529] 10:12:37.095878 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.095925 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.095973 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f21d2f37000
[pid 25530] 10:12:37.096011 <... getpgrp resumed> ) = 29163
[pid 25529] 10:12:37.096029 mprotect(0x7f21d2f4d000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.096049 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0},  <unfinished ...>
[pid 25529] 10:12:37.096078 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.096097 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0}, 8) = 0
[pid 25530] 10:12:37.096123 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25529] 10:12:37.096144 mmap(0x7f21d314d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f21d314d000
[pid 25530] 10:12:37.096183 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25530] 10:12:37.096263 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25529] 10:12:37.096292 mmap(0x7f21d314f000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f21d314f000
[pid 25529] 10:12:37.096335 close(6)    = 0
[pid 25529] 10:12:37.096376 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.096419 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.096460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.096503 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25530] 10:12:37.096557 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.096587 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25529] 10:12:37.096606 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.096646 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.096676 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25529] 10:12:37.096696 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.096742 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3364000
[pid 25529] 10:12:37.096782 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.096803 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25530] 10:12:37.096878 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0},  <unfinished ...>
[pid 25529] 10:12:37.096908 <... mmap resumed> ) = 0x7f21d2d1e000
[pid 25529] 10:12:37.096928 mprotect(0x7f21d2d34000, 2093056, PROT_NONE) = 0
[pid 25529] 10:12:37.096964 mmap(0x7f21d2f33000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f21d2f33000
[pid 25529] 10:12:37.097013 mmap(0x7f21d2f35000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f21d2f35000
[pid 25529] 10:12:37.097056 close(6)    = 0
[pid 25529] 10:12:37.097096 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.097138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.097160 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, 8) = 0
[pid 25529] 10:12:37.097189 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.097209 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f71eb4876a0}, {SIG_IGN, [], SA_RESTORER, 0x7f71eb4876a0}, 8) = 0
[pid 25530] 10:12:37.097242 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0}, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7f71eb4876a0}, 8) = 0
[pid 25530] 10:12:37.097269 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25529] 10:12:37.097336 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.097670 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25529] 10:12:37.097718 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.097759 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.097807 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f21d2ae7000
[pid 25529] 10:12:37.097851 mprotect(0x7f21d2aee000, 2097152, PROT_NONE) = 0
[pid 25529] 10:12:37.097887 mmap(0x7f21d2cee000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f21d2cee000
[pid 25529] 10:12:37.097931 mmap(0x7f21d2cf0000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f21d2cf0000
[pid 25529] 10:12:37.097973 close(6)    = 0
[pid 25529] 10:12:37.098012 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.098054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.098096 <... lseek resumed> ) = 19
[pid 25531] 10:12:37.098115 read(6,  <unfinished ...>
[pid 25529] 10:12:37.098134 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25531] 10:12:37.098156 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2364) = 1858
[pid 25529] 10:12:37.098183 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25531] 10:12:37.098644 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.098675 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25529] 10:12:37.098717 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.098757 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.098805 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f21d2863000
[pid 25529] 10:12:37.098842 mprotect(0x7f21d28e6000, 2093056, PROT_NONE) = 0
[pid 25530] 10:12:37.098882 <... execve resumed> ) = 0
[pid 25529] 10:12:37.098900 mmap(0x7f21d2ae5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f21d2ae5000
[pid 25530] 10:12:37.098953 brk(0 <unfinished ...>
[pid 25529] 10:12:37.098982 close(6)    = 0
[pid 25529] 10:12:37.099021 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.099043 <... brk resumed> ) = 0xb1d000
[pid 25530] 10:12:37.099063 fcntl(0, F_GETFD) = 0
[pid 25529] 10:12:37.099100 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.099117 fcntl(1, F_GETFD) = 0
[pid 25530] 10:12:37.099135 fcntl(2, F_GETFD) = 0
[pid 25502] 10:12:37.099161 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25502] 10:12:37.099176 read(17,  <unfinished ...>
[pid 25528] 10:12:37.099190 <... write resumed> ) = 4
[pid 25529] 10:12:37.099201 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.099219 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25529] 10:12:37.099239 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25528] 10:12:37.099252 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.099268 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.099283 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25502] 10:12:37.099296 read(17,  <unfinished ...>
[pid 25528] 10:12:37.099309 <... write resumed> ) = 4
[pid 25528] 10:12:37.099320 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.099333 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.099357 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.099374 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:37.099389 read(17,  <unfinished ...>
[pid 25528] 10:12:37.099402 <... write resumed> ) = 4
[pid 25529] 10:12:37.099418 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25528] 10:12:37.099430 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25502] 10:12:37.099448 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25502] 10:12:37.099460 read(17,  <unfinished ...>
[pid 25528] 10:12:37.099473 <... write resumed> ) = 40
[pid 25529] 10:12:37.099486 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25528] 10:12:37.099498 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25502] 10:12:37.099685 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:37.099711 wait4(-1,  <unfinished ...>
[pid 25528] 10:12:37.099733 <... write resumed> ) = 4
[pid 25530] 10:12:37.099752 <... mmap resumed> ) = 0x7f07e6069000
[pid 25528] 10:12:37.099772 close(18 <unfinished ...>
[pid 25529] 10:12:37.099798 <... open resumed> ) = 6
[pid 25530] 10:12:37.099824 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25528] 10:12:37.099848 <... close resumed> ) = 0
[pid 25528] 10:12:37.099880 exit_group(0) = ?
[pid 25529] 10:12:37.099899 read(6,  <unfinished ...>
[pid 25530] 10:12:37.099921 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.099941 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.099966 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.099990 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.100012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25529] 10:12:37.100044 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3363000
[pid 25530] 10:12:37.100083 <... open resumed> ) = 5
[pid 25528] 10:12:37.100358 +++ exited with 0 +++
[pid 25502] 10:12:37.100390 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25528
[pid 25502] 10:12:37.100413 close(17)   = 0
[pid 25502] 10:12:37.100451 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:37.100661 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.100734 open("/etc/userdomains", O_RDONLY) = 9
[pid 25502] 10:12:37.100775 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.100826 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.100876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4c000
[pid 25502] 10:12:37.100914 lseek(9, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.100947 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25502] 10:12:37.101016 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.101075 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.101158 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.101211 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.101268 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25502] 10:12:37.101308 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.101356 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.101400 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4b000
[pid 25502] 10:12:37.101437 lseek(10, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.101471 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25502] 10:12:37.101600 read(10, "", 4096) = 0
[pid 25502] 10:12:37.101665 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25502] 10:12:37.101714 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:37.101760 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4a000
[pid 25502] 10:12:37.101797 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:37.101848 close(11)   = 0
[pid 25502] 10:12:37.101883 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25502] 10:12:37.101934 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.102003 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25502] 10:12:37.102066 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.102139 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25502] 10:12:37.102182 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.102230 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.102275 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4a000
[pid 25502] 10:12:37.102311 lseek(11, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.102344 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25502] 10:12:37.102409 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.102466 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.102610 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.102688 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable", 0x7ffced979420) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.102736 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.102796 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.102876 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.102937 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25502] 10:12:37.103000 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.103064 lseek(11, 2781, SEEK_SET) = 2781
[pid 25502] 10:12:37.103115 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.103170 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.103229 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.103301 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable", 0x7ffced979420) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.103350 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.103409 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.103481 open("/etc/localdomains", O_RDONLY) = 12
[pid 25502] 10:12:37.103528 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.103576 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.103621 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be49000
[pid 25502] 10:12:37.103660 lseek(12, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.103694 read(12, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25502] 10:12:37.103746 stat("/jail_owner", 0x7ffced97a9d0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.103791 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:37.103848 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.103883 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:37.103921 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.103950 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.103992 open("/etc/demouids", O_RDONLY) = 13
[pid 25502] 10:12:37.104018 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.104051 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.104230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be48000
[pid 25502] 10:12:37.104275 lseek(13, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.104311 read(13, "", 4096) = 0
[pid 25502] 10:12:37.104356 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.104444 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.104503 lseek(9, 353, SEEK_SET) = 353
[pid 25502] 10:12:37.104650 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25502] 10:12:37.104699 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:37.104749 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be47000
[pid 25502] 10:12:37.104788 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:37.104838 close(14)   = 0
[pid 25502] 10:12:37.104875 munmap(0x7f3c0be47000, 4096) = 0
[pid 25502] 10:12:37.104928 stat("//etc/fin.finestweddingsites.com", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.104977 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.105040 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.105103 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.105170 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.105238 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.105297 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.105363 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.105409 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.105470 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25502] 10:12:37.105519 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.105571 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.105619 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be47000
[pid 25502] 10:12:37.105658 lseek(14, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.105697 read(14, "", 4096) = 0
[pid 25502] 10:12:37.105743 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25502] 10:12:37.105788 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:37.105836 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be46000
[pid 25502] 10:12:37.105917 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:37.105986 close(15)   = 0
[pid 25502] 10:12:37.106025 munmap(0x7f3c0be46000, 4096) = 0
[pid 25502] 10:12:37.106076 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.106143 stat("//.spamassassinboxenable", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.106186 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.106224 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.106266 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.106293 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.106334 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffced97d7c0) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.106361 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.106397 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.106492 lseek(14, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.106672 read(14, "", 4096) = 0
[pid 25502] 10:12:37.106732 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.106800 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 15
[pid 25502] 10:12:37.106844 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.106894 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.106941 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be46000
[pid 25502] 10:12:37.106979 lseek(15, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.107015 read(15, "", 4096) = 0
[pid 25502] 10:12:37.107056 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25502] 10:12:37.107119 open("/etc/group", O_RDONLY|O_CLOEXEC) = 16
[pid 25502] 10:12:37.107162 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:37.107209 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be45000
[pid 25502] 10:12:37.107246 read(16, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:37.107304 close(16)   = 0
[pid 25502] 10:12:37.107347 munmap(0x7f3c0be45000, 4096) = 0
[pid 25502] 10:12:37.107398 open("/etc/aliases", O_RDONLY) = 16
[pid 25502] 10:12:37.107442 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25502] 10:12:37.107495 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25502] 10:12:37.107660 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be45000
[pid 25502] 10:12:37.107700 lseek(16, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.107735 read(16, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25502] 10:12:37.107792 read(16, "", 4096) = 0
[pid 25502] 10:12:37.107838 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25502] 10:12:37.107882 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:37.107930 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be44000
[pid 25502] 10:12:37.107968 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:37.108022 close(17)   = 0
[pid 25502] 10:12:37.108058 munmap(0x7f3c0be44000, 4096) = 0
[pid 25502] 10:12:37.108106 open("/etc/localaliases", O_RDONLY) = 17
[pid 25502] 10:12:37.108151 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:37.108201 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25502] 10:12:37.108247 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be44000
[pid 25502] 10:12:37.108284 lseek(17, 0, SEEK_SET) = 0
[pid 25502] 10:12:37.108322 read(17, "", 4096) = 0
[pid 25502] 10:12:37.108366 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.108427 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.108486 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.108646 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.108709 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.108783 write(8, "2015-12-30 10:12:37 routing failed for finest09@fin.finestweddingsites.com <westernsky@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 172) = 172
[pid 25502] 10:12:37.108837 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.108903 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.108957 close(7)    = 0
[pid 25502] 10:12:37.108997 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25502] 10:12:37.109047 fcntl(7, F_GETFD) = 0
[pid 25502] 10:12:37.109083 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.109117 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5380525, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25502] 10:12:37.109165 write(7, "2015-12-30 10:12:37 [25502] 1aEJMa-0006dB-67 ** finest09@fin.finestweddingsites.com <westernsky@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 181) = 181
[pid 25502] 10:12:37.109209 close(16)   = 0
[pid 25502] 10:12:37.109244 munmap(0x7f3c0be45000, 4096) = 0
[pid 25502] 10:12:37.109285 close(17)   = 0
[pid 25502] 10:12:37.109338 munmap(0x7f3c0be44000, 4096) = 0
[pid 25502] 10:12:37.109382 close(13)   = 0
[pid 25502] 10:12:37.109418 munmap(0x7f3c0be48000, 4096) = 0
[pid 25502] 10:12:37.109455 close(14)   = 0
[pid 25502] 10:12:37.109491 munmap(0x7f3c0be47000, 4096) = 0
[pid 25502] 10:12:37.109630 close(9)    = 0
[pid 25502] 10:12:37.109676 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:37.109717 close(12)   = 0
[pid 25502] 10:12:37.109754 munmap(0x7f3c0be49000, 4096) = 0
[pid 25502] 10:12:37.109793 close(15)   = 0
[pid 25502] 10:12:37.109830 munmap(0x7f3c0be46000, 4096) = 0
[pid 25502] 10:12:37.109867 close(11)   = 0
[pid 25502] 10:12:37.109903 munmap(0x7f3c0be4a000, 4096) = 0
[pid 25502] 10:12:37.109941 close(10)   = 0
[pid 25502] 10:12:37.109978 munmap(0x7f3c0be4b000, 4096) = 0
[pid 25502] 10:12:37.110022 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-J", O_WRONLY|O_CREAT|O_APPEND, 0640) = 9
[pid 25502] 10:12:37.110110 fcntl(9, F_GETFD) = 0
[pid 25502] 10:12:37.110147 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.110182 fchown(9, 47, 12) = 0
[pid 25502] 10:12:37.110226 fchmod(9, 0640) = 0
[pid 25502] 10:12:37.110295 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 10
[pid 25502] 10:12:37.110349 alarm(60)   = 0
[pid 25502] 10:12:37.110387 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25502] 10:12:37.110430 alarm(0)    = 60
[pid 25502] 10:12:37.110493 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25502] 10:12:37.110626 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25502] 10:12:37.110674 fcntl(11, F_GETFD) = 0
[pid 25502] 10:12:37.110710 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:37.110746 read(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25502] 10:12:37.110793 close(11)   = 0
[pid 25502] 10:12:37.110837 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.110882 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25502] 10:12:37.111048 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25520] 10:12:37.111090 <... select resumed> ) = 1 (in [11], left {599, 947768})
[pid 25520] 10:12:37.111122 read(11, "\27\3\3\1l", 5) = 5
[pid 25520] 10:12:37.111161 read(11, "\0\0\0\0\0\0\0\6\255\330\2>B\353F8\335\366\234\245\213\312\302\354sh;O\r5\216\315\26e$\376\276R\363\231\267F\260\31\301\312\344n\307\244\32r\224~\"\352\346\330\224\234X\307\303)\3\354\305:\267\334\256\262\37T\301l+s|\213\6\334\337Jb\264.r9\306\240\331\240r\244\343\335\274f\350\353\270|\341\245\4\311\375\342\224j\312\230\"@a\25\323{[C\3F7\365d\360NQ\261\256)\5\305\270 \273\274\366Yp5\17\300\33\306M\211\241\355\0\342\203G\272;z'\267m\336\226\300\354\vG!O\f\250NK\275\300LDb\345\323\340\\o\366\0\320\f*\214\f\253\325\345\242\262\202 x\310Abs\364\1\20\216g\25y\3516U\262{\203\2230\210\17w\31O\310\276\23w2\256\0009'&\371L\226\311\26\325\260\357%\202/}c\350\325El\f\206Q2\263\31\320S"..., 364) = 364
[pid 25520] 10:12:37.111233 write(11, "\27\3\3\0\36\270\216\27\217\177l\231\321?\177\371\"-\300\216-\243\"K\225Ci\225CB\253\371\26f,", 35) = 35
[pid 25520] 10:12:37.111305 write(11, "\25\3\3\0\32\270\216\27\217\177l\231\322\272wgJ\201G \24_w\263\260\212c\335@\n\210", 31) = 31
[pid 25520] 10:12:37.111393 close(11)   = 0
[pid 25520] 10:12:37.111466 close(13)   = 0
[pid 25520] 10:12:37.111505 munmap(0x7f7c15ca7000, 4096) = 0
[pid 25520] 10:12:37.111550 close(10)   = 0
[pid 25520] 10:12:37.111586 munmap(0x7f7c15ca8000, 4096) = 0
[pid 25520] 10:12:37.111631 write(12, "S000004c\f\0\0", 11) = 11
[pid 25473] 10:12:37.111687 <... select resumed> ) = 1 (in [11], left {59, 569596})
[pid 25520] 10:12:37.111715 write(12, "X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 113 <unfinished ...>
[pid 25473] 10:12:37.111743 read(11,  <unfinished ...>
[pid 25520] 10:12:37.111774 <... write resumed> ) = 113
[pid 25473] 10:12:37.111845 <... read resumed> "S000004c\f\0\0X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 16384) = 124
[pid 25520] 10:12:37.111881 write(12, "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 2404 <unfinished ...>
[pid 25473] 10:12:37.111912 wait4(-1,  <unfinished ...>
[pid 25520] 10:12:37.111939 <... write resumed> ) = 2404
[pid 25473] 10:12:37.111958 <... wait4 resumed> 0x7ffdac33eb30, WNOHANG, NULL) = 0
[pid 25520] 10:12:37.111981 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25473] 10:12:37.112006 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25520] 10:12:37.112038 <... write resumed> ) = 9
[pid 25473] 10:12:37.112057 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25520] 10:12:37.112080 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25473] 10:12:37.112106 read(11,  <unfinished ...>
[pid 25520] 10:12:37.112133 <... write resumed> ) = 11
[pid 25473] 10:12:37.112153 <... read resumed> "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 16384) = 2424
[pid 25520] 10:12:37.112409 write(12, "A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 451 <unfinished ...>
[pid 25473] 10:12:37.112445 wait4(-1,  <unfinished ...>
[pid 25520] 10:12:37.112478 <... write resumed> ) = 451
[pid 25473] 10:12:37.112499 <... wait4 resumed> 0x7ffdac33eb30, WNOHANG, NULL) = 0
[pid 25520] 10:12:37.112642 write(12, "X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 113 <unfinished ...>
[pid 25473] 10:12:37.112674 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25520] 10:12:37.112706 <... write resumed> ) = 113
[pid 25473] 10:12:37.112756 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25520] 10:12:37.112782 write(12, "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 2404 <unfinished ...>
[pid 25473] 10:12:37.112812 read(11,  <unfinished ...>
[pid 25520] 10:12:37.112839 <... write resumed> ) = 2404
[pid 25473] 10:12:37.112857 <... read resumed> "A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 16384) = 2968
[pid 25520] 10:12:37.112976 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25473] 10:12:37.113007 wait4(-1,  <unfinished ...>
[pid 25520] 10:12:37.113034 <... write resumed> ) = 9
[pid 25473] 10:12:37.113052 <... wait4 resumed> 0x7ffdac33eb30, WNOHANG, NULL) = 0
[pid 25520] 10:12:37.113075 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25473] 10:12:37.113100 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25520] 10:12:37.113131 <... write resumed> ) = 11
[pid 25473] 10:12:37.113152 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25520] 10:12:37.113176 write(12, "A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 451 <unfinished ...>
[pid 25473] 10:12:37.113204 read(11,  <unfinished ...>
[pid 25520] 10:12:37.113231 <... write resumed> ) = 451
[pid 25473] 10:12:37.113250 <... read resumed> "X4000021\0D000004\2\0\0\0A000444\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5."..., 16384) = 471
[pid 25520] 10:12:37.113278 write(12, "I00002050.116.78.207\00037965\0", 27 <unfinished ...>
[pid 25473] 10:12:37.113304 wait4(-1,  <unfinished ...>
[pid 25520] 10:12:37.113333 <... write resumed> ) = 27
[pid 25473] 10:12:37.113351 <... wait4 resumed> 0x7ffdac33eb30, WNOHANG, NULL) = 0
[pid 25520] 10:12:37.113373 write(12, "Z0000010", 8 <unfinished ...>
[pid 25473] 10:12:37.113398 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25520] 10:12:37.113429 <... write resumed> ) = 8
[pid 25473] 10:12:37.113445 <... select resumed> ) = 1 (in [11], left {59, 999999})
[pid 25520] 10:12:37.113467 close(12 <unfinished ...>
[pid 25473] 10:12:37.113605 read(11,  <unfinished ...>
[pid 25530] 10:12:37.113639 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.113663 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25520] 10:12:37.113693 <... close resumed> ) = 0
[pid 25502] 10:12:37.114017 <... open resumed> ) = 11
[pid 25473] 10:12:37.114036 <... read resumed> "I00002050.116.78.207\00037965\0Z0000010", 16384) = 35
[pid 25530] 10:12:37.114068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.114097 <... mmap resumed> ) = 0x7f21d2655000
[pid 25520] 10:12:37.114120 exit_group(0) = ?
[pid 25502] 10:12:37.114619 fcntl(11, F_GETFD <unfinished ...>
[pid 25473] 10:12:37.114657 close(11 <unfinished ...>
[pid 25530] 10:12:37.114698 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25529] 10:12:37.114731 mprotect(0x7f21d2661000, 2097152, PROT_NONE <unfinished ...>
[pid 25520] 10:12:37.114762 +++ exited with 0 +++
[pid 25502] 10:12:37.114775 <... fcntl resumed> ) = 0
[pid 25473] 10:12:37.114791 <... close resumed> ) = 0
[pid 25530] 10:12:37.114814 <... mmap resumed> ) = 0x7f07e605f000
[pid 25529] 10:12:37.114828 <... mprotect resumed> ) = 0
[pid 25502] 10:12:37.114842 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25473] 10:12:37.114867 wait4(25520,  <unfinished ...>
[pid 25530] 10:12:37.114905 close(5 <unfinished ...>
[pid 25529] 10:12:37.114926 mmap(0x7f21d2861000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25502] 10:12:37.114954 <... fcntl resumed> ) = 0
[pid 25473] 10:12:37.114972 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25520
[pid 25530] 10:12:37.115009 <... close resumed> ) = 0
[pid 25529] 10:12:37.115026 <... mmap resumed> ) = 0x7f21d2861000
[pid 25502] 10:12:37.115054 fstat(11,  <unfinished ...>
[pid 25473] 10:12:37.115089 stat("/etc/localtime",  <unfinished ...>
[pid 25530] 10:12:37.115122 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.115156 close(6 <unfinished ...>
[pid 25502] 10:12:37.115178 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25473] 10:12:37.115227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.115285 <... open resumed> ) = 5
[pid 25529] 10:12:37.115302 <... close resumed> ) = 0
[pid 25502] 10:12:37.115317 pread(11,  <unfinished ...>
[pid 25473] 10:12:37.115355 write(8, "2015-12-30 10:12:37 gretchen.murry@onehospitalitygroup.com F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=aspmx.l.google.com [64.233.160.26]:25 X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes D"..., 720 <unfinished ...>
[pid 25530] 10:12:37.115396 read(5,  <unfinished ...>
[pid 25529] 10:12:37.115419 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.115456 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25473] 10:12:37.115495 <... write resumed> ) = 720
[pid 25531] 10:12:37.115643 <... write resumed> ) = 4
[pid 25530] 10:12:37.115667 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.115697 <... open resumed> ) = 6
[pid 25522] 10:12:37.115720 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25502] 10:12:37.115753 pread(11,  <unfinished ...>
[pid 25473] 10:12:37.115780 stat("/etc/localtime",  <unfinished ...>
[pid 25531] 10:12:37.115816 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.115840 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.115861 read(6,  <unfinished ...>
[pid 25522] 10:12:37.115883 read(13,  <unfinished ...>
[pid 25502] 10:12:37.115906 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25473] 10:12:37.115936 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25531] 10:12:37.115990 <... write resumed> ) = 4
[pid 25530] 10:12:37.116006 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.116034 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.116057 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25502] 10:12:37.116078 close(11 <unfinished ...>
[pid 25473] 10:12:37.116103 stat("/etc/localtime",  <unfinished ...>
[pid 25531] 10:12:37.116137 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.116160 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25529] 10:12:37.116186 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.116208 read(13,  <unfinished ...>
[pid 25502] 10:12:37.116231 <... close resumed> ) = 0
[pid 25473] 10:12:37.116266 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25531] 10:12:37.116310 <... write resumed> ) = 4
[pid 25530] 10:12:37.116325 <... mmap resumed> ) = 0x7f07e5ab7000
[pid 25529] 10:12:37.116341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25522] 10:12:37.116368 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:37.116390 close(10 <unfinished ...>
[pid 25473] 10:12:37.116420 close(7 <unfinished ...>
[pid 25531] 10:12:37.116453 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25530] 10:12:37.116479 mprotect(0x7f07e5c41000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.116505 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.116565 read(13,  <unfinished ...>
[pid 25502] 10:12:37.116592 <... close resumed> ) = 0
[pid 25473] 10:12:37.116632 <... close resumed> ) = 0
[pid 25531] 10:12:37.116669 <... write resumed> ) = 40
[pid 25530] 10:12:37.116688 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.116704 <... mmap resumed> ) = 0x7f21d2432000
[pid 25522] 10:12:37.116724 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25502] 10:12:37.116750 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:37.116781 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25531] 10:12:37.116824 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.116849 mmap(0x7f07e5e41000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25529] 10:12:37.116877 mprotect(0x7f21d2453000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.116903 read(13,  <unfinished ...>
[pid 25502] 10:12:37.116926 <... open resumed> ) = 10
[pid 25473] 10:12:37.116943 <... open resumed> ) = 7
[pid 25531] 10:12:37.116968 <... write resumed> ) = 4
[pid 25530] 10:12:37.116981 <... mmap resumed> ) = 0x7f07e5e41000
[pid 25529] 10:12:37.116994 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.116999 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25502] 10:12:37.117018 fstat(10,  <unfinished ...>
[pid 25473] 10:12:37.117028 fcntl(7, F_GETFD <unfinished ...>
[pid 25531] 10:12:37.117045 close(14 <unfinished ...>
[pid 25530] 10:12:37.117051 mmap(0x7f07e5e46000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.117058 mmap(0x7f21d2653000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25522] 10:12:37.117065 wait4(-1,  <unfinished ...>
[pid 25502] 10:12:37.117073 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.117096 <... fcntl resumed> ) = 0
[pid 25502] 10:12:37.117108 fstat(10,  <unfinished ...>
[pid 25473] 10:12:37.117117 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25502] 10:12:37.117130 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.117147 <... fcntl resumed> ) = 0
[pid 25502] 10:12:37.117159 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:37.117170 fstat(7,  <unfinished ...>
[pid 25502] 10:12:37.117182 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25473] 10:12:37.117191 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5380706, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25502] 10:12:37.117212 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:37.117222 write(7, "2015-12-30 10:12:37 [25473] 1aEJMZ-0006ce-8t ** gretchen.murry@onehospitalitygroup.com F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=aspmx.l.google.com [64.233.160.26]:25 X=TLSv1.2:ECDHE-RSA-AE"..., 748 <unfinished ...>
[pid 25502] 10:12:37.117242 <... lseek resumed> ) = 0
[pid 25473] 10:12:37.117251 <... write resumed> ) = 748
[pid 25502] 10:12:37.117266 read(10,  <unfinished ...>
[pid 25473] 10:12:37.117279 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:37.117294 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:37.117325 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.117362 pipe( <unfinished ...>
[pid 25473] 10:12:37.117375 write(8, "2015-12-30 10:12:37 jennifer.gonzales@onehospitalitygroup.com <Jennifer.Gonzales@onehospitalitygroup.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=aspmx.l.google.com [64.233.160.26]:25 X=T"..., 767 <unfinished ...>
[pid 25502] 10:12:37.117396 <... pipe resumed> [11, 12]) = 0
[pid 25473] 10:12:37.117407 <... write resumed> ) = 767
[pid 25502] 10:12:37.117421 close(10 <unfinished ...>
[pid 25473] 10:12:37.117431 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:37.117445 <... close resumed> ) = 0
[pid 25473] 10:12:37.117453 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.117486 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25473] 10:12:37.117500 stat("/etc/localtime",  <unfinished ...>
[pid 25502] 10:12:37.117699 <... munmap resumed> ) = 0
[pid 25473] 10:12:37.117720 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:37.117757 clone( <unfinished ...>
[pid 25473] 10:12:37.118027 close(7)    = 0
[pid 25502] 10:12:37.118070 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25532
[pid 25473] 10:12:37.118107 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25502] 10:12:37.118145 close(12 <unfinished ...>
[pid 25473] 10:12:37.118168 <... open resumed> ) = 7
[pid 25502] 10:12:37.118188 <... close resumed> ) = 0
[pid 25473] 10:12:37.118204 fcntl(7, F_GETFD <unfinished ...>
[pid 25502] 10:12:37.118231 read(11,  <unfinished ...>
[pid 25473] 10:12:37.118253 <... fcntl resumed> ) = 0
[pid 25473] 10:12:37.118271 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:37.118304 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10520, st_size=5381454, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25473] 10:12:37.118351 write(7, "2015-12-30 10:12:37 [25473] 1aEJMZ-0006ce-8t ** jennifer.gonzales@onehospitalitygroup.com <Jennifer.Gonzales@onehospitalitygroup.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=aspmx.l.googl"..., 795) = 795
[pid 25473] 10:12:37.118401 geteuid()   = 0
[pid 25473] 10:12:37.118435 getegid()   = 12
[pid 25473] 10:12:37.118469 setgid(12)  = 0
[pid 25473] 10:12:37.118502 setuid(47 <unfinished ...>
[pid 25531] 10:12:37.118679 <... close resumed> ) = 0
[pid 25530] 10:12:37.118697 <... mmap resumed> ) = 0x7f07e5e46000
[pid 25529] 10:12:37.118733 <... mmap resumed> ) = 0x7f21d2653000
[pid 25473] 10:12:37.118760 <... setuid resumed> ) = 0
[pid 25531] 10:12:37.118795 exit_group(0) = ?
[pid 25530] 10:12:37.118810 close(5 <unfinished ...>
[pid 25529] 10:12:37.119066 close(6 <unfinished ...>
[pid 25473] 10:12:37.119090 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25531] 10:12:37.119136 +++ exited with 0 +++
[pid 25530] 10:12:37.119149 <... close resumed> ) = 0
[pid 25529] 10:12:37.119162 <... close resumed> ) = 0
[pid 25522] 10:12:37.119192 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25531
[pid 25473] 10:12:37.119220 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.119255 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.119288 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.119319 close(13 <unfinished ...>
[pid 25473] 10:12:37.119345 stat("/etc/localtime",  <unfinished ...>
[pid 25530] 10:12:37.119383 <... mmap resumed> ) = 0x7f07e605e000
[pid 25529] 10:12:37.119397 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.119420 <... close resumed> ) = 0
[pid 25473] 10:12:37.119441 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.119486 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.119584 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.119628 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25473] 10:12:37.119656 pipe( <unfinished ...>
[pid 25530] 10:12:37.119699 <... mmap resumed> ) = 0x7f07e605d000
[pid 25529] 10:12:37.119715 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.119735 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25473] 10:12:37.119777 <... pipe resumed> [10, 11]) = 0
[pid 25530] 10:12:37.119805 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.119831 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.119860 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:37.119887 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0},  <unfinished ...>
[pid 25530] 10:12:37.119919 <... mmap resumed> ) = 0x7f07e605c000
[pid 25529] 10:12:37.119933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.119951 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.120000 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25530] 10:12:37.120030 arch_prctl(ARCH_SET_FS, 0x7f07e605d700 <unfinished ...>
[pid 25529] 10:12:37.120053 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.120084 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25473] 10:12:37.120111 clone( <unfinished ...>
[pid 25530] 10:12:37.120329 <... arch_prctl resumed> ) = 0
[pid 25529] 10:12:37.120344 <... open resumed> ) = 6
[pid 25522] 10:12:37.120358 <... open resumed> ) = 9
[pid 25522] 10:12:37.120380 fstat(9,  <unfinished ...>
[pid 25473] 10:12:37.120405 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f7c15c92a90) = 25533
[pid 25522] 10:12:37.120444 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.120481 close(10 <unfinished ...>
[pid 25522] 10:12:37.120577 fstat(9,  <unfinished ...>
[pid 25473] 10:12:37.120606 <... close resumed> ) = 0
[pid 25522] 10:12:37.120631 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.120758 fcntl(11, F_GETFL <unfinished ...>
[pid 25530] 10:12:37.120789 mprotect(0x7f07e5e41000, 16384, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.120817 read(6,  <unfinished ...>
[pid 25522] 10:12:37.120837 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:37.120863 <... fcntl resumed> ) = 0x1 (flags O_WRONLY)
[pid 25522] 10:12:37.120892 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25473] 10:12:37.120911 fstat(11,  <unfinished ...>
[pid 25522] 10:12:37.120939 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:37.120962 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130169202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.120995 <... lseek resumed> ) = 0
[pid 25473] 10:12:37.121013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.121043 read(9,  <unfinished ...>
[pid 25473] 10:12:37.121070 <... mmap resumed> ) = 0x7f7c15ca8000
[pid 25522] 10:12:37.121091 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25473] 10:12:37.121129 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.121159 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:37.121186 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25522] 10:12:37.121359 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.121408 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.121439 stat("/etc/userdomains",  <unfinished ...>
[pid 25473] 10:12:37.121465 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25522] 10:12:37.121497 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25473] 10:12:37.121562 write(11, "X-Failed-Recipients: Jennifer.Gonzales@onehospitalitygroup.com,\n  gretchen.murry@onehospitalitygroup.com,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@"..., 3122 <unfinished ...>
[pid 25522] 10:12:37.121601 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25473] 10:12:37.121634 <... write resumed> ) = 3122
[pid 25522] 10:12:37.121669 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25473] 10:12:37.121696 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.121725 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25473] 10:12:37.121753 <... lseek resumed> ) = 19
[pid 25522] 10:12:37.121773 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:37.121810 read(6,  <unfinished ...>
[pid 25522] 10:12:37.121845 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25473] 10:12:37.121875 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25522] 10:12:37.121913 <... open resumed> ) = 10
[pid 25473] 10:12:37.121931 read(6,  <unfinished ...>
[pid 25522] 10:12:37.121958 fstat(10,  <unfinished ...>
[pid 25473] 10:12:37.121981 <... read resumed> "", 8192) = 0
[pid 25522] 10:12:37.122001 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:37.122032 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006ce-8t; Wed, 30 Dec 2015 10:12:35 -0600\nTo:  gretchen.murry"..., 2477 <unfinished ...>
[pid 25522] 10:12:37.122065 fstat(10,  <unfinished ...>
[pid 25473] 10:12:37.122088 <... write resumed> ) = 2477
[pid 25522] 10:12:37.122111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25473] 10:12:37.122139 write(11, "\n--1451491957-eximdsn-1488136355--\n", 35 <unfinished ...>
[pid 25522] 10:12:37.122168 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25473] 10:12:37.122195 <... write resumed> ) = 35
[pid 25522] 10:12:37.122214 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25473] 10:12:37.122232 close(11 <unfinished ...>
[pid 25522] 10:12:37.122258 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25473] 10:12:37.122281 <... close resumed> ) = 0
[pid 25522] 10:12:37.122300 <... lseek resumed> ) = 0
[pid 25473] 10:12:37.122317 munmap(0x7f7c15ca8000, 4096 <unfinished ...>
[pid 25522] 10:12:37.122349 read(10,  <unfinished ...>
[pid 25473] 10:12:37.122376 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.122401 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25473] 10:12:37.122447 wait4(25533,  <unfinished ...>
[pid 25522] 10:12:37.122476 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25522] 10:12:37.122626 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25530] 10:12:37.122705 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.122720 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.122741 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b11000
[pid 25522] 10:12:37.122778 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.122831 close(11)   = 0
[pid 25522] 10:12:37.122867 munmap(0x7f2e40b11000, 4096) = 0
[pid 25522] 10:12:37.122935 open("/etc/localdomains", O_RDONLY) = 11
[pid 25522] 10:12:37.122986 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.123036 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.123081 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b11000
[pid 25522] 10:12:37.123118 lseek(11, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.123151 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25522] 10:12:37.123204 stat("/jail_owner", 0x7ffd5c5bb110) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.123251 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.123312 stat("/usr/local/cpanel/3rdparty/mailman/lists/redmountainranch_finestweddingsites.com/config.pck", 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.123364 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.123420 stat("/usr/local/cpanel/3rdparty/mailman/lists/redmountainranch/config.pck", 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.123467 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.123628 open("/etc/demouids", O_RDONLY) = 12
[pid 25522] 10:12:37.123674 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.123723 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.123768 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b10000
[pid 25522] 10:12:37.123804 lseek(12, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.123837 read(12, "", 4096) = 0
[pid 25522] 10:12:37.123878 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.124029 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.124100 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.124165 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.124226 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25522] 10:12:37.124270 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.124319 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.124364 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b0f000
[pid 25522] 10:12:37.124400 lseek(13, 0, SEEK_SET) = 0
[pid 25522] 10:12:37.124436 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25522] 10:12:37.124482 read(13, "", 4096) = 0
[pid 25522] 10:12:37.124615 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.124684 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.124746 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.124818 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25522] 10:12:37.124863 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.124911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b0e000
[pid 25522] 10:12:37.124948 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.125002 close(14)   = 0
[pid 25522] 10:12:37.125038 munmap(0x7f2e40b0e000, 4096) = 0
[pid 25522] 10:12:37.125084 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25522] 10:12:37.125136 pipe([14, 15]) = 0
[pid 25522] 10:12:37.125175 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:37.125217 close(12)   = 0
[pid 25522] 10:12:37.125253 munmap(0x7f2e40b10000, 4096) = 0
[pid 25522] 10:12:37.125297 close(9)    = 0
[pid 25522] 10:12:37.125332 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:37.125370 close(11)   = 0
[pid 25522] 10:12:37.125405 munmap(0x7f2e40b11000, 4096) = 0
[pid 25522] 10:12:37.125441 close(13)   = 0
[pid 25522] 10:12:37.125476 munmap(0x7f2e40b0f000, 4096) = 0
[pid 25522] 10:12:37.125516 close(10)   = 0
[pid 25522] 10:12:37.125552 munmap(0x7f2e40b12000, 4096) = 0
[pid 25522] 10:12:37.125589 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25534
[pid 25522] 10:12:37.125866 close(15)   = 0
[pid 25522] 10:12:37.125903 read(14,  <unfinished ...>
[pid 25530] 10:12:37.125945 mprotect(0x7f07e606a000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.125967 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.126001 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.126015 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.126053 munmap(0x7f07e605f000, 39387 <unfinished ...>
[pid 25529] 10:12:37.126074 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.126115 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.126129 <... mmap resumed> ) = 0x7f21d2215000
[pid 25530] 10:12:37.126184 getuid( <unfinished ...>
[pid 25529] 10:12:37.126206 mprotect(0x7f21d222c000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.126239 <... getuid resumed> ) = 503
[pid 25529] 10:12:37.126253 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.126276 getgid( <unfinished ...>
[pid 25529] 10:12:37.126296 mmap(0x7f21d242c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25530] 10:12:37.126346 <... getgid resumed> ) = 500
[pid 25529] 10:12:37.126360 <... mmap resumed> ) = 0x7f21d242c000
[pid 25530] 10:12:37.126389 getegid( <unfinished ...>
[pid 25529] 10:12:37.126410 mmap(0x7f21d242e000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.126444 <... getegid resumed> ) = 499
[pid 25529] 10:12:37.126458 <... mmap resumed> ) = 0x7f21d242e000
[pid 25530] 10:12:37.126486 getppid( <unfinished ...>
[pid 25529] 10:12:37.126616 close(6 <unfinished ...>
[pid 25530] 10:12:37.126652 <... getppid resumed> ) = 25389
[pid 25529] 10:12:37.126666 <... close resumed> ) = 0
[pid 25530] 10:12:37.126699 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25529] 10:12:37.126723 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.126767 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25529] 10:12:37.126794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.126859 brk(0 <unfinished ...>
[pid 25529] 10:12:37.126882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.126926 <... brk resumed> ) = 0xb1d000
[pid 25529] 10:12:37.126940 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.126963 brk(0xb3e000 <unfinished ...>
[pid 25529] 10:12:37.126983 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.127019 <... brk resumed> ) = 0xb3e000
[pid 25529] 10:12:37.127033 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.127075 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.127098 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.127140 <... socket resumed> ) = 5
[pid 25529] 10:12:37.127153 <... open resumed> ) = 6
[pid 25530] 10:12:37.127183 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.127209 read(6,  <unfinished ...>
[pid 25530] 10:12:37.127250 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.127264 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.127294 close(5 <unfinished ...>
[pid 25529] 10:12:37.127315 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.127347 <... close resumed> ) = 0
[pid 25529] 10:12:37.127361 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.127396 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.127418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.127453 <... socket resumed> ) = 5
[pid 25529] 10:12:37.127466 <... mmap resumed> ) = 0x7f21d3362000
[pid 25530] 10:12:37.127492 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.127613 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.127658 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.127673 <... mmap resumed> ) = 0x7f21d1ea1000
[pid 25530] 10:12:37.127696 close(5 <unfinished ...>
[pid 25529] 10:12:37.127716 mprotect(0x7f21d2010000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.127751 <... close resumed> ) = 0
[pid 25529] 10:12:37.127765 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.127797 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.127821 mmap(0x7f21d220f000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25530] 10:12:37.127862 <... open resumed> ) = 5
[pid 25529] 10:12:37.127876 <... mmap resumed> ) = 0x7f21d220f000
[pid 25530] 10:12:37.127916 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.127939 close(6 <unfinished ...>
[pid 25530] 10:12:37.127968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25529] 10:12:37.127994 <... close resumed> ) = 0
[pid 25530] 10:12:37.128024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.128047 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.128085 <... mmap resumed> ) = 0x7f07e6068000
[pid 25529] 10:12:37.128099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.128122 read(5,  <unfinished ...>
[pid 25529] 10:12:37.128143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.128184 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25529] 10:12:37.128202 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.128249 read(5,  <unfinished ...>
[pid 25529] 10:12:37.128270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.128307 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.128321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.128348 close(5 <unfinished ...>
[pid 25529] 10:12:37.128369 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.128419 <... close resumed> ) = 0
[pid 25529] 10:12:37.128436 <... open resumed> ) = 6
[pid 25530] 10:12:37.128463 munmap(0x7f07e6068000, 4096 <unfinished ...>
[pid 25529] 10:12:37.128484 read(6,  <unfinished ...>
[pid 25530] 10:12:37.128595 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.128611 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.128653 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.128677 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.128711 <... open resumed> ) = 5
[pid 25529] 10:12:37.128724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25530] 10:12:37.128760 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.128781 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.128815 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.128840 <... mmap resumed> ) = 0x7f21d1c12000
[pid 25530] 10:12:37.128863 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25529] 10:12:37.128884 mprotect(0x7f21d1c9d000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.128919 <... mmap resumed> ) = 0x7f07e605f000
[pid 25529] 10:12:37.128932 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.128954 close(5 <unfinished ...>
[pid 25529] 10:12:37.128975 mmap(0x7f21d1e9d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25530] 10:12:37.129010 <... close resumed> ) = 0
[pid 25529] 10:12:37.129023 <... mmap resumed> ) = 0x7f21d1e9d000
[pid 25530] 10:12:37.129059 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.129083 mmap(0x7f21d1ea0000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.129124 <... open resumed> ) = 5
[pid 25529] 10:12:37.129138 <... mmap resumed> ) = 0x7f21d1ea0000
[pid 25530] 10:12:37.129166 read(5,  <unfinished ...>
[pid 25529] 10:12:37.129188 close(6 <unfinished ...>
[pid 25530] 10:12:37.129217 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.129237 <... close resumed> ) = 0
[pid 25530] 10:12:37.129272 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.129295 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.129334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.129360 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.129393 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25529] 10:12:37.129416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.129458 <... mmap resumed> ) = 0x7f07e58a9000
[pid 25529] 10:12:37.129472 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.129495 mprotect(0x7f07e58b5000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.129620 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.129665 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.129679 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.129705 mmap(0x7f07e5ab5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25529] 10:12:37.129728 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.129771 <... mmap resumed> ) = 0x7f07e5ab5000
[pid 25529] 10:12:37.129785 <... open resumed> ) = 6
[pid 25530] 10:12:37.129817 close(5 <unfinished ...>
[pid 25529] 10:12:37.129840 read(6,  <unfinished ...>
[pid 25530] 10:12:37.129870 <... close resumed> ) = 0
[pid 25529] 10:12:37.129884 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.129927 mprotect(0x7f07e5ab5000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.129951 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.129983 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.129997 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25530] 10:12:37.130036 munmap(0x7f07e605f000, 39387 <unfinished ...>
[pid 25529] 10:12:37.130058 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.130096 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.130110 <... mmap resumed> ) = 0x7f21d1a0c000
[pid 25530] 10:12:37.130138 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.130162 mprotect(0x7f21d1a12000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.130198 <... open resumed> ) = 5
[pid 25529] 10:12:37.130212 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.130237 fcntl(5, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.130259 mmap(0x7f21d1c11000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25530] 10:12:37.130293 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25529] 10:12:37.130307 <... mmap resumed> ) = 0x7f21d1c11000
[pid 25530] 10:12:37.130336 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.130358 close(6 <unfinished ...>
[pid 25530] 10:12:37.130387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.130419 <... close resumed> ) = 0
[pid 25530] 10:12:37.130447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.130470 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.130512 <... mmap resumed> ) = 0x7f07e6068000
[pid 25529] 10:12:37.130527 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.130551 read(5,  <unfinished ...>
[pid 25529] 10:12:37.130571 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.130615 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.130633 <... open resumed> ) = 6
[pid 25530] 10:12:37.130672 close(5 <unfinished ...>
[pid 25529] 10:12:37.130696 read(6,  <unfinished ...>
[pid 25530] 10:12:37.130727 <... close resumed> ) = 0
[pid 25529] 10:12:37.130741 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.130770 munmap(0x7f07e6068000, 4096 <unfinished ...>
[pid 25529] 10:12:37.130790 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.130824 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.130837 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.130878 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.130901 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.130937 <... socket resumed> ) = 5
[pid 25529] 10:12:37.130950 <... mmap resumed> ) = 0x7f21d3361000
[pid 25530] 10:12:37.130975 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.131000 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.131040 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.131055 <... mmap resumed> ) = 0x7f21d16d6000
[pid 25530] 10:12:37.131074 close(5 <unfinished ...>
[pid 25529] 10:12:37.131080 mprotect(0x7f21d1802000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.131101 <... close resumed> ) = 0
[pid 25529] 10:12:37.131106 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.131119 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.131126 mmap(0x7f21d1a02000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25530] 10:12:37.131147 <... socket resumed> ) = 5
[pid 25529] 10:12:37.131153 <... mmap resumed> ) = 0x7f21d1a02000
[pid 25530] 10:12:37.131171 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.131179 mmap(0x7f21d1a0b000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0Process 25532 attached
 <unfinished ...>
[pid 25530] 10:12:37.131216 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.131223 <... mmap resumed> ) = 0x7f21d1a0b000
[pid 25532] 10:12:37.131258 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25530] 10:12:37.131264 close(5 <unfinished ...>
[pid 25529] 10:12:37.131270 close(6 <unfinished ...>
[pid 25532] 10:12:37.131289 <... set_robust_list resumed> ) = 0
[pid 25530] 10:12:37.131295 <... close resumed> ) = 0
[pid 25529] 10:12:37.131299 <... close resumed> ) = 0
[pid 25532] 10:12:37.131400 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25530] 10:12:37.131411 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.131418 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.131443 <... open resumed> ) = 5
[pid 25529] 10:12:37.131449 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.131465 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.131471 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.131494 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.131682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.131702 <... setrlimit resumed> ) = 0
[pid 25530] 10:12:37.131767 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.131799 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.131929 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.131953 <... mmap resumed> ) = 0x7f07e6068000
[pid 25529] 10:12:37.131967 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.131992 read(5,  <unfinished ...>
[pid 25529] 10:12:37.132013 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.132054 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.132072 <... open resumed> ) = 6
[pid 25530] 10:12:37.132108 close(5 <unfinished ...>
[pid 25529] 10:12:37.132129 read(6,  <unfinished ...>
[pid 25532] 10:12:37.132168 <... open resumed> ) = 10
[pid 25530] 10:12:37.132182 <... close resumed> ) = 0
[pid 25529] 10:12:37.132195 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25532] 10:12:37.132234 fstat(10,  <unfinished ...>
[pid 25530] 10:12:37.132256 munmap(0x7f07e6068000, 4096 <unfinished ...>
[pid 25529] 10:12:37.132276 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.132324 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f21d14d2000
[pid 25529] 10:12:37.132364 mprotect(0x7f21d14d4000, 2097152, PROT_NONE) = 0
[pid 25529] 10:12:37.132400 mmap(0x7f21d16d4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f21d16d4000
[pid 25529] 10:12:37.132448 close(6)    = 0
[pid 25529] 10:12:37.132496 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.132558 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.132602 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.132624 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.132647 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.132675 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.132711 <... open resumed> ) = 5
[pid 25529] 10:12:37.132728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.132750 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.132773 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.132807 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.132835 <... open resumed> ) = 6
[pid 25530] 10:12:37.132854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.132880 read(6,  <unfinished ...>
[pid 25530] 10:12:37.132907 <... mmap resumed> ) = 0x7f07e6068000
[pid 25529] 10:12:37.132920 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.132936 read(5,  <unfinished ...>
[pid 25529] 10:12:37.132948 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.132960 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.132981 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.133005 close(5 <unfinished ...>
[pid 25529] 10:12:37.133016 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.133033 <... close resumed> ) = 0
[pid 25529] 10:12:37.133041 <... mmap resumed> ) = 0x7f21d12cf000
[pid 25530] 10:12:37.133052 munmap(0x7f07e6068000, 4096 <unfinished ...>
[pid 25529] 10:12:37.133064 mprotect(0x7f21d12d1000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.133079 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.133102 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.133114 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25529] 10:12:37.133138 mmap(0x7f21d14d0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25530] 10:12:37.133156 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25529] 10:12:37.133170 <... mmap resumed> ) = 0x7f21d14d0000
[pid 25530] 10:12:37.133190 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25529] 10:12:37.133205 close(6 <unfinished ...>
[pid 25530] 10:12:37.133217 <... readlink resumed> 0x7ffc15eaeca0, 4095) = -1 EINVAL (Invalid argument)
[pid 25529] 10:12:37.133233 <... close resumed> ) = 0
[pid 25530] 10:12:37.133251 getcwd( <unfinished ...>
[pid 25529] 10:12:37.133262 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.133281 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25529] 10:12:37.133297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.133310 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25529] 10:12:37.133323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.133342 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25529] 10:12:37.133362 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.133374 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.133387 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.133404 <... open resumed> ) = 5
[pid 25529] 10:12:37.133414 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.133427 fstat(5,  <unfinished ...>
[pid 25529] 10:12:37.133436 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.133455 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25529] 10:12:37.133474 <... open resumed> ) = 6
[pid 25530] 10:12:37.133485 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.133496 read(6,  <unfinished ...>
[pid 25530] 10:12:37.133699 <... mmap resumed> ) = 0x7f07e6068000
[pid 25532] 10:12:37.133720 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.133747 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.133774 read(5,  <unfinished ...>
[pid 25529] 10:12:37.133804 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.133831 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25529] 10:12:37.133852 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.133885 read(5,  <unfinished ...>
[pid 25529] 10:12:37.133909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.133940 <... read resumed> "", 1024) = 0
[pid 25529] 10:12:37.133960 <... mmap resumed> ) = 0x7f21d3360000
[pid 25530] 10:12:37.133977 setregid(499, 499 <unfinished ...>
[pid 25529] 10:12:37.133987 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.134004 <... setregid resumed> ) = 0
[pid 25529] 10:12:37.134014 <... mmap resumed> ) = 0x7f21d0f3b000
[pid 25530] 10:12:37.134026 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25529] 10:12:37.134217 mprotect(0x7f21d10c5000, 2097152, PROT_NONE) = 0
[pid 25530] 10:12:37.134245 <... execve resumed> ) = 0
[pid 25529] 10:12:37.134267 mmap(0x7f21d12c5000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25530] 10:12:37.134287 brk(0 <unfinished ...>
[pid 25529] 10:12:37.134295 <... mmap resumed> ) = 0x7f21d12c5000
[pid 25530] 10:12:37.134311 <... brk resumed> ) = 0x1f44000
[pid 25529] 10:12:37.134320 mmap(0x7f21d12ca000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.134338 fcntl(0, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.134347 <... mmap resumed> ) = 0x7f21d12ca000
[pid 25530] 10:12:37.134362 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.134370 close(6 <unfinished ...>
[pid 25530] 10:12:37.134382 fcntl(1, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.134391 <... close resumed> ) = 0
[pid 25530] 10:12:37.134409 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.134417 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.134436 fcntl(2, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.134445 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.134458 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.134470 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.134490 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25529] 10:12:37.134503 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.134709 fstat(10,  <unfinished ...>
[pid 25530] 10:12:37.134733 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.134763 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.134800 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.134831 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.134853 <... mmap resumed> ) = 0x7f2293dc8000
[pid 25529] 10:12:37.134883 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.134922 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25529] 10:12:37.134950 <... open resumed> ) = 6
[pid 25530] 10:12:37.134969 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.134992 read(6,  <unfinished ...>
[pid 25530] 10:12:37.135020 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.135049 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.135076 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135093 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.135119 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.135146 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25530] 10:12:37.135179 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135197 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.135229 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.135257 <... mmap resumed> ) = 0x7f21d0ccf000
[pid 25530] 10:12:37.135277 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135290 mprotect(0x7f21d0d31000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.135307 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25529] 10:12:37.135320 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.135331 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135339 mmap(0x7f21d0f30000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25530] 10:12:37.135357 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.135370 <... mmap resumed> ) = 0x7f21d0f30000
[pid 25530] 10:12:37.135390 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135399 close(6 <unfinished ...>
[pid 25530] 10:12:37.135411 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.135424 <... close resumed> ) = 0
[pid 25530] 10:12:37.135444 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135453 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.135471 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.135485 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.135501 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135695 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.135736 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25530] 10:12:37.135769 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25529] 10:12:37.135797 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.135817 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25529] 10:12:37.135846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.135879 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.135909 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.135930 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.135947 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.135982 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.136087 <... open resumed> ) = 6
[pid 25530] 10:12:37.136108 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.136126 read(6,  <unfinished ...>
[pid 25530] 10:12:37.136154 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.136185 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.136211 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.136228 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.136255 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25529] 10:12:37.136283 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25530] 10:12:37.136346 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.136388 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0Process 25534 attached
Process 25533 attached
 <unfinished ...>
[pid 25532] 10:12:37.136481 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.136584 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.136624 <... mmap resumed> ) = 0x7f21d08ec000
[pid 25534] 10:12:37.136649 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25533] 10:12:37.136672 set_robust_list(0x7f7c15c92aa0, 24 <unfinished ...>
[pid 25532] 10:12:37.136694 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25530] 10:12:37.136707 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.136727 mprotect(0x7f21d0aa5000, 2093056, PROT_NONE <unfinished ...>
[pid 25534] 10:12:37.136763 <... set_robust_list resumed> ) = 0
[pid 25533] 10:12:37.136777 <... set_robust_list resumed> ) = 0
[pid 25532] 10:12:37.136814 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.136862 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.136898 <... mprotect resumed> ) = 0
[pid 25534] 10:12:37.136922 close(14 <unfinished ...>
[pid 25533] 10:12:37.136944 close(0 <unfinished ...>
[pid 25532] 10:12:37.136966 <... lseek resumed> ) = 0
[pid 25530] 10:12:37.136979 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.137000 mmap(0x7f21d0ca4000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25534] 10:12:37.137038 <... close resumed> ) = 0
[pid 25533] 10:12:37.137052 <... close resumed> ) = 0
[pid 25532] 10:12:37.137075 read(10,  <unfinished ...>
[pid 25530] 10:12:37.137156 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.137189 <... mmap resumed> ) = 0x7f21d0ca4000
[pid 25534] 10:12:37.137217 geteuid( <unfinished ...>
[pid 25533] 10:12:37.137240 dup2(10, 0 <unfinished ...>
[pid 25532] 10:12:37.137262 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25530] 10:12:37.137280 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.137344 mmap(0x7f21d0ccb000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25534] 10:12:37.137386 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.137399 <... dup2 resumed> ) = 0
[pid 25532] 10:12:37.137415 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25530] 10:12:37.137446 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25529] 10:12:37.137475 <... mmap resumed> ) = 0x7f21d0ccb000
[pid 25534] 10:12:37.137504 getegid( <unfinished ...>
[pid 25533] 10:12:37.137532 close(10 <unfinished ...>
[pid 25532] 10:12:37.137554 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25530] 10:12:37.137581 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.137634 close(6 <unfinished ...>
[pid 25534] 10:12:37.137668 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.137682 <... close resumed> ) = 0
[pid 25532] 10:12:37.137702 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.137733 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.137763 <... close resumed> ) = 0
[pid 25534] 10:12:37.137795 setgid(500 <unfinished ...>
[pid 25533] 10:12:37.137819 close(11 <unfinished ...>
[pid 25532] 10:12:37.137842 <... open resumed> ) = 13
[pid 25530] 10:12:37.137856 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.137875 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.137912 <... setgid resumed> ) = 0
[pid 25533] 10:12:37.137926 <... close resumed> ) = 0
[pid 25532] 10:12:37.137941 fstat(13,  <unfinished ...>
[pid 25530] 10:12:37.137979 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.138008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25534] 10:12:37.138033 setuid(503 <unfinished ...>
[pid 25533] 10:12:37.138057 fstat(0,  <unfinished ...>
[pid 25532] 10:12:37.138079 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25530] 10:12:37.138110 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.138132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.138173 <... setuid resumed> ) = 0
[pid 25533] 10:12:37.138187 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130169202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25532] 10:12:37.138244 fstat(13,  <unfinished ...>
[pid 25530] 10:12:37.138270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.138300 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25534] 10:12:37.138324 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.138354 fstat(1,  <unfinished ...>
[pid 25532] 10:12:37.138377 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25530] 10:12:37.138405 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.138422 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.138446 <... open resumed> ) = 9
[pid 25533] 10:12:37.138451 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25532] 10:12:37.138466 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.138473 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25529] 10:12:37.138486 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.138501 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.138670 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.138715 fstat(9,  <unfinished ...>
[pid 25533] 10:12:37.138738 fstat(2,  <unfinished ...>
[pid 25532] 10:12:37.138760 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25530] 10:12:37.138773 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.138805 <... open resumed> ) = 6
[pid 25534] 10:12:37.138828 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25533] 10:12:37.138855 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25532] 10:12:37.138898 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.138930 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.138948 read(6,  <unfinished ...>
[pid 25534] 10:12:37.138979 brk(0x191b000 <unfinished ...>
[pid 25533] 10:12:37.139002 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMZ-0006ce-8t"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25532] 10:12:37.139395 <... lseek resumed> ) = 0
[pid 25530] 10:12:37.139417 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25529] 10:12:37.139449 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25534] 10:12:37.139480 <... brk resumed> ) = 0x191b000
[pid 25532] 10:12:37.139496 read(13,  <unfinished ...>
[pid 25530] 10:12:37.139704 <... stat resumed> 0x7ffd127af330) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.139726 fstat(6,  <unfinished ...>
[pid 25534] 10:12:37.139758 fstat(9,  <unfinished ...>
[pid 25533] 10:12:37.139780 <... execve resumed> ) = 0
[pid 25532] 10:12:37.139793 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25530] 10:12:37.139829 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.139871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25534] 10:12:37.139909 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25533] 10:12:37.139935 brk(0 <unfinished ...>
[pid 25532] 10:12:37.139960 read(13,  <unfinished ...>
[pid 25530] 10:12:37.139988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.140005 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25534] 10:12:37.140040 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.140065 <... brk resumed> ) = 0x8dc000
[pid 25532] 10:12:37.140079 <... read resumed> "", 4096) = 0
[pid 25530] 10:12:37.140096 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25529] 10:12:37.140161 <... mmap resumed> ) = 0x7f21d335f000
[pid 25534] 10:12:37.140188 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25533] 10:12:37.140203 fcntl(0, F_GETFD <unfinished ...>
[pid 25532] 10:12:37.140228 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25530] 10:12:37.140257 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.140287 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25534] 10:12:37.140325 read(9,  <unfinished ...>
[pid 25533] 10:12:37.140359 <... fcntl resumed> ) = 0
[pid 25532] 10:12:37.140374 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.140392 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.140422 <... mmap resumed> ) = 0x7f21d06bf000
[pid 25534] 10:12:37.140446 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25533] 10:12:37.140463 fcntl(1, F_GETFD <unfinished ...>
[pid 25532] 10:12:37.140487 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25530] 10:12:37.140516 <... open resumed> ) = 6
[pid 25529] 10:12:37.140533 mprotect(0x7f21d06eb000, 2097152, PROT_NONE <unfinished ...>
[pid 25534] 10:12:37.140573 read(9,  <unfinished ...>
[pid 25533] 10:12:37.140600 <... fcntl resumed> ) = 0
[pid 25532] 10:12:37.140615 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.140633 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.140657 <... mprotect resumed> ) = 0
[pid 25534] 10:12:37.140680 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25533] 10:12:37.140698 fcntl(2, F_GETFD <unfinished ...>
[pid 25532] 10:12:37.140727 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25530] 10:12:37.140753 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.140781 mmap(0x7f21d08eb000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25534] 10:12:37.140818 close(9 <unfinished ...>
[pid 25533] 10:12:37.140842 <... fcntl resumed> ) = 0
[pid 25532] 10:12:37.140855 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f3c0ad03790}, 8) = 0
[pid 25530] 10:12:37.140880 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.140909 <... mmap resumed> ) = 0x7f21d08eb000
[pid 25534] 10:12:37.140937 <... close resumed> ) = 0
[pid 25533] 10:12:37.140952 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25532] 10:12:37.140981 close(11 <unfinished ...>
[pid 25530] 10:12:37.141008 <... mmap resumed> ) = 0x7f2293dbe000
[pid 25529] 10:12:37.141025 close(6 <unfinished ...>
[pid 25534] 10:12:37.141055 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25533] 10:12:37.141080 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.141092 <... close resumed> ) = 0
[pid 25530] 10:12:37.141098 close(6 <unfinished ...>
[pid 25529] 10:12:37.141126 <... close resumed> ) = 0
[pid 25534] 10:12:37.141148 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.141154 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25532] 10:12:37.141161 fcntl(12, F_GETFD <unfinished ...>
[pid 25530] 10:12:37.141167 <... close resumed> ) = 0
[pid 25529] 10:12:37.141184 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.141207 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.141223 <... open resumed> ) = 6
[pid 25530] 10:12:37.141235 <... open resumed> ) = 6
[pid 25529] 10:12:37.141243 read(6,  <unfinished ...>
[pid 25530] 10:12:37.141256 read(6,  <unfinished ...>
[pid 25529] 10:12:37.141264 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.141280 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.141293 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.141305 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.141314 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25530] 10:12:37.141337 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.141355 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.141374 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.141385 <... mmap resumed> ) = 0x7f21d04ba000
[pid 25530] 10:12:37.141396 <... mmap resumed> ) = 0x7f2293990000
[pid 25529] 10:12:37.141404 mprotect(0x7f21d04bf000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.141420 mprotect(0x7f22939a6000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.141431 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.141443 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.141450 mmap(0x7f21d06be000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25530] 10:12:37.141467 mmap(0x7f2293ba6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25529] 10:12:37.141479 <... mmap resumed> ) = 0x7f21d06be000
[pid 25530] 10:12:37.141494 <... mmap resumed> ) = 0x7f2293ba6000
[pid 25529] 10:12:37.142063 close(6 <unfinished ...>
[pid 25534] 10:12:37.142110 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.142134 <... mmap resumed> ) = 0x7f403840f000
[pid 25532] 10:12:37.142149 <... fcntl resumed> ) = 0
[pid 25530] 10:12:37.142185 mmap(0x7f2293ba8000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.142218 <... close resumed> ) = 0
[pid 25534] 10:12:37.142253 <... lseek resumed> ) = 19
[pid 25533] 10:12:37.142269 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25532] 10:12:37.142299 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25530] 10:12:37.142324 <... mmap resumed> ) = 0x7f2293ba8000
[pid 25529] 10:12:37.142346 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.142385 read(6,  <unfinished ...>
[pid 25533] 10:12:37.142408 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.142423 <... fcntl resumed> ) = 0
[pid 25530] 10:12:37.142445 close(6 <unfinished ...>
[pid 25529] 10:12:37.142484 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25534] 10:12:37.142613 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2364) = 1858
[pid 25533] 10:12:37.142638 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.143126 geteuid( <unfinished ...>
[pid 25530] 10:12:37.143149 <... close resumed> ) = 0
[pid 25529] 10:12:37.143172 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25534] 10:12:37.143215 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.143246 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.143262 <... geteuid resumed> ) = 0
[pid 25530] 10:12:37.143277 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.143309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25534] 10:12:37.143336 <... write resumed> ) = 4
[pid 25533] 10:12:37.143350 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.143384 getegid( <unfinished ...>
[pid 25530] 10:12:37.143407 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.143428 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.143464 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25534] 10:12:37.143497 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.143592 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.143609 <... getegid resumed> ) = 12
[pid 25530] 10:12:37.143625 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.143662 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.143681 read(14,  <unfinished ...>
[pid 25534] 10:12:37.143713 <... write resumed> ) = 4
[pid 25533] 10:12:37.143727 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.143756 setgid(500 <unfinished ...>
[pid 25530] 10:12:37.143779 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.143797 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.143826 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25534] 10:12:37.143852 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.143875 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.143889 <... setgid resumed> ) = 0
[pid 25530] 10:12:37.143904 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.143934 <... open resumed> ) = 6
[pid 25522] 10:12:37.143956 read(14,  <unfinished ...>
[pid 25534] 10:12:37.143988 <... write resumed> ) = 4
[pid 25533] 10:12:37.144001 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25532] 10:12:37.144029 setuid(503 <unfinished ...>
[pid 25530] 10:12:37.144052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.144071 read(6,  <unfinished ...>
[pid 25522] 10:12:37.144095 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25534] 10:12:37.144123 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25533] 10:12:37.144149 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.144163 <... setuid resumed> ) = 0
[pid 25530] 10:12:37.144178 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.144211 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.144234 read(14,  <unfinished ...>
[pid 25534] 10:12:37.144269 <... write resumed> ) = 40
[pid 25533] 10:12:37.144282 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.144312 chdir("/" <unfinished ...>
[pid 25530] 10:12:37.144336 <... open resumed> ) = 6
[pid 25529] 10:12:37.144351 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.144374 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25534] 10:12:37.144402 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.144427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.144441 <... chdir resumed> ) = 0
[pid 25530] 10:12:37.144456 read(6,  <unfinished ...>
[pid 25529] 10:12:37.144494 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25522] 10:12:37.144609 read(14,  <unfinished ...>
[pid 25534] 10:12:37.144643 <... write resumed> ) = 4
[pid 25533] 10:12:37.144656 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.144685 geteuid( <unfinished ...>
[pid 25530] 10:12:37.144706 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.144728 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.144760 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25534] 10:12:37.144787 close(15 <unfinished ...>
[pid 25533] 10:12:37.144810 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.144825 <... geteuid resumed> ) = 503
[pid 25530] 10:12:37.144841 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.144865 <... mmap resumed> ) = 0x7f21d02b7000
[pid 25522] 10:12:37.144880 wait4(-1,  <unfinished ...>
[pid 25534] 10:12:37.144910 <... close resumed> ) = 0
[pid 25533] 10:12:37.144923 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.144970 getegid( <unfinished ...>
[pid 25530] 10:12:37.144992 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.145021 mprotect(0x7f21d02b9000, 2093056, PROT_NONE <unfinished ...>
[pid 25534] 10:12:37.145057 exit_group(0) = ?
[pid 25533] 10:12:37.145071 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.145351 <... getegid resumed> ) = 500
[pid 25530] 10:12:37.145373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.145443 <... mprotect resumed> ) = 0
[pid 25534] 10:12:37.145482 +++ exited with 0 +++
[pid 25533] 10:12:37.145496 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25532] 10:12:37.145594 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25530] 10:12:37.145627 <... mmap resumed> ) = 0x7f2293dbd000
[pid 25529] 10:12:37.145647 mmap(0x7f21d04b8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25522] 10:12:37.145679 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25534
[pid 25533] 10:12:37.145706 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25532] 10:12:37.145733 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25530] 10:12:37.145760 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.145788 <... mmap resumed> ) = 0x7f21d04b8000
[pid 25522] 10:12:37.145812 close(14 <unfinished ...>
[pid 25533] 10:12:37.145850 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.145883 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25530] 10:12:37.145909 <... mmap resumed> ) = 0x7f2293777000
[pid 25529] 10:12:37.145925 close(6 <unfinished ...>
[pid 25522] 10:12:37.145947 <... close resumed> ) = 0
[pid 25533] 10:12:37.145972 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.145988 <... chdir resumed> ) = 0
[pid 25530] 10:12:37.146003 mprotect(0x7f229378d000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.146032 <... close resumed> ) = 0
[pid 25522] 10:12:37.146057 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25533] 10:12:37.146095 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.146124 stat("tmp",  <unfinished ...>
[pid 25530] 10:12:37.146151 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.146166 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.146196 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25533] 10:12:37.146244 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.146262 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25530] 10:12:37.146290 mmap(0x7f229398c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25529] 10:12:37.146321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.146344 stat("/etc/userdomains",  <unfinished ...>
[pid 25533] 10:12:37.146379 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.146409 stat("new",  <unfinished ...>
[pid 25530] 10:12:37.146434 <... mmap resumed> ) = 0x7f229398c000
[pid 25529] 10:12:37.146454 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.146485 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.146539 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.146557 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25530] 10:12:37.146584 mmap(0x7f229398e000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.146615 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.146632 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.146668 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25532] 10:12:37.146700 stat("cur",  <unfinished ...>
[pid 25530] 10:12:37.146724 <... mmap resumed> ) = 0x7f229398e000
[pid 25529] 10:12:37.146745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.146777 <... open resumed> ) = 9
[pid 25533] 10:12:37.146801 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.146816 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25530] 10:12:37.146843 close(6 <unfinished ...>
[pid 25529] 10:12:37.146932 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.146953 fstat(9,  <unfinished ...>
[pid 25533] 10:12:37.146984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.147016 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25530] 10:12:37.147048 <... close resumed> ) = 0
[pid 25529] 10:12:37.147071 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.147102 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.147134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.147141 <... open resumed> ) = 11
[pid 25530] 10:12:37.147146 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.147166 <... open resumed> ) = 6
[pid 25522] 10:12:37.147174 fstat(9,  <unfinished ...>
[pid 25533] 10:12:37.147190 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.147197 read(11,  <unfinished ...>
[pid 25530] 10:12:37.147202 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.147221 read(6,  <unfinished ...>
[pid 25522] 10:12:37.147230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.147255 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.147261 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2957
[pid 25530] 10:12:37.147269 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.147347 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.147361 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.147388 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.147396 stat("tmp/1451491957.H147336P25532.fin.finestweddingsites.com",  <unfinished ...>
[pid 25530] 10:12:37.147402 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.147434 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.147445 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25533] 10:12:37.147462 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.147469 <... stat resumed> 0x7ffced97d9c0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.147474 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.147494 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.147800 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.147834 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25532] 10:12:37.147862 open("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25530] 10:12:37.147923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.147949 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.147977 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.148002 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25532] 10:12:37.148029 <... open resumed> ) = 14
[pid 25530] 10:12:37.148044 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.148090 <... mmap resumed> ) = 0x7f21d335e000
[pid 25522] 10:12:37.148111 read(9,  <unfinished ...>
[pid 25533] 10:12:37.148146 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.148176 chown("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25530] 10:12:37.148207 <... open resumed> ) = 6
[pid 25529] 10:12:37.148223 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.148259 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25533] 10:12:37.148305 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.148324 <... chown resumed> ) = 0
[pid 25530] 10:12:37.148340 read(6,  <unfinished ...>
[pid 25529] 10:12:37.148370 <... mmap resumed> ) = 0x7f21d0094000
[pid 25522] 10:12:37.148386 stat("/etc/userdomains",  <unfinished ...>
[pid 25533] 10:12:37.148420 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.148446 chmod("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25530] 10:12:37.148475 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.148497 mprotect(0x7f21d00ab000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.148529 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.148577 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.148594 <... chmod resumed> ) = 0
[pid 25530] 10:12:37.148610 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.148634 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.148650 stat("/etc/userdomains",  <unfinished ...>
[pid 25533] 10:12:37.148685 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.148714 chown("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25530] 10:12:37.148742 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.148771 mmap(0x7f21d02ab000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25522] 10:12:37.148802 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.148871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.148891 <... chown resumed> ) = 0
[pid 25530] 10:12:37.148906 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.148935 <... mmap resumed> ) = 0x7f21d02ab000
[pid 25522] 10:12:37.148962 stat("/home/finest09/etc/finestweddingsites.com/redmountainranch/filter",  <unfinished ...>
[pid 25533] 10:12:37.149004 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25532] 10:12:37.149032 chmod("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25530] 10:12:37.149059 <... mmap resumed> ) = 0x7f2293540000
[pid 25529] 10:12:37.149076 close(6 <unfinished ...>
[pid 25522] 10:12:37.149098 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.149127 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.149271 <... chmod resumed> ) = 0
[pid 25530] 10:12:37.149298 mprotect(0x7f2293547000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.149362 <... close resumed> ) = 0
[pid 25522] 10:12:37.149402 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.149442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.149472 stat("/etc/localtime",  <unfinished ...>
[pid 25530] 10:12:37.149497 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.149559 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.149596 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.149646 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.149664 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.149692 mmap(0x7f2293747000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25529] 10:12:37.149759 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.149778 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.149815 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25532] 10:12:37.149842 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.149865 <... mmap resumed> ) = 0x7f2293747000
[pid 25529] 10:12:37.149886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.149920 <... open resumed> ) = 10
[pid 25533] 10:12:37.149945 <... stat resumed> 0x7ffe92d8b950) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.149960 <... lseek resumed> ) = 19
[pid 25530] 10:12:37.149975 mmap(0x7f2293749000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.150005 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.150022 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.150052 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.150080 read(6,  <unfinished ...>
[pid 25530] 10:12:37.150107 <... mmap resumed> ) = 0x7f2293749000
[pid 25529] 10:12:37.150129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.150160 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.150199 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.150214 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25530] 10:12:37.150233 close(6 <unfinished ...>
[pid 25529] 10:12:37.150266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.150286 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.150316 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25532] 10:12:37.150342 read(6,  <unfinished ...>
[pid 25530] 10:12:37.150364 <... close resumed> ) = 0
[pid 25529] 10:12:37.150385 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.150423 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.150459 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25532] 10:12:37.150483 <... read resumed> "", 8192) = 0
[pid 25530] 10:12:37.150501 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.150537 <... open resumed> ) = 6
[pid 25522] 10:12:37.150553 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.150587 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.150613 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2517 <unfinished ...>
[pid 25530] 10:12:37.150649 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.150666 read(6,  <unfinished ...>
[pid 25522] 10:12:37.150692 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25533] 10:12:37.150716 <... open resumed> ) = 6
[pid 25532] 10:12:37.150729 <... write resumed> ) = 2517
[pid 25530] 10:12:37.150751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.150783 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.150806 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.150837 fstat(6,  <unfinished ...>
[pid 25532] 10:12:37.150859 fsync(14 <unfinished ...>
[pid 25530] 10:12:37.150923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.150942 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.151072 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.151096 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25530] 10:12:37.151119 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.151137 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.151156 read(10,  <unfinished ...>
[pid 25533] 10:12:37.151175 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.151182 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.151197 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.151211 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25533] 10:12:37.151232 <... mmap resumed> ) = 0x7f4038405000
[pid 25530] 10:12:37.151238 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.151255 <... mmap resumed> ) = 0x7f21cfe50000
[pid 25522] 10:12:37.151263 read(10,  <unfinished ...>
[pid 25533] 10:12:37.151278 close(6 <unfinished ...>
[pid 25530] 10:12:37.151285 <... open resumed> ) = 6
[pid 25529] 10:12:37.151299 mprotect(0x7f21cfe91000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.151312 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.151347 <... close resumed> ) = 0
[pid 25532] 10:12:37.151354 <... fsync resumed> ) = 0
[pid 25530] 10:12:37.151377 read(6,  <unfinished ...>
[pid 25529] 10:12:37.151387 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.151395 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.151418 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.151425 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25530] 10:12:37.151444 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.151457 mmap(0x7f21d0091000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25522] 10:12:37.151471 <... open resumed> ) = 11
[pid 25533] 10:12:37.151489 <... open resumed> ) = 6
[pid 25532] 10:12:37.151495 <... lseek resumed> ) = 2957
[pid 25530] 10:12:37.151505 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.151754 <... mmap resumed> ) = 0x7f21d0091000
[pid 25522] 10:12:37.151782 fstat(11,  <unfinished ...>
[pid 25533] 10:12:37.151827 read(6,  <unfinished ...>
[pid 25532] 10:12:37.151853 write(11, "2517 1\n", 7 <unfinished ...>
[pid 25530] 10:12:37.151886 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.151917 close(6 <unfinished ...>
[pid 25522] 10:12:37.151941 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.151977 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25532] 10:12:37.151997 <... write resumed> ) = 7
[pid 25530] 10:12:37.152017 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.152045 <... close resumed> ) = 0
[pid 25522] 10:12:37.152070 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.152104 fstat(6,  <unfinished ...>
[pid 25532] 10:12:37.152127 close(11 <unfinished ...>
[pid 25530] 10:12:37.152152 <... mmap resumed> ) = 0x7f22932bc000
[pid 25529] 10:12:37.152168 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.152205 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25533] 10:12:37.152229 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25532] 10:12:37.152255 <... close resumed> ) = 0
[pid 25530] 10:12:37.152276 mprotect(0x7f229333f000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.152304 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.152321 read(11,  <unfinished ...>
[pid 25533] 10:12:37.152355 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25532] 10:12:37.152381 fstat(14,  <unfinished ...>
[pid 25530] 10:12:37.152407 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.152423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.152455 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.152493 <... mmap resumed> ) = 0x7f4037fd7000
[pid 25532] 10:12:37.152593 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016476, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2517, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.152631 mmap(0x7f229353e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25529] 10:12:37.152661 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.152678 close(11 <unfinished ...>
[pid 25533] 10:12:37.152710 mprotect(0x7f4037fed000, 2097152, PROT_NONE <unfinished ...>
[pid 25532] 10:12:37.152738 close(14 <unfinished ...>
[pid 25530] 10:12:37.152762 <... mmap resumed> ) = 0x7f229353e000
[pid 25529] 10:12:37.152786 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.152819 <... close resumed> ) = 0
[pid 25533] 10:12:37.152843 <... mprotect resumed> ) = 0
[pid 25532] 10:12:37.152856 <... close resumed> ) = 0
[pid 25530] 10:12:37.152886 close(6 <unfinished ...>
[pid 25529] 10:12:37.152910 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.152928 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25533] 10:12:37.152964 mmap(0x7f40381ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25532] 10:12:37.152992 rename("tmp/1451491957.H147336P25532.fin.finestweddingsites.com", "new/1451491957.H147336P25532.fin.finestweddingsites.com,S=2517" <unfinished ...>
[pid 25530] 10:12:37.153047 <... close resumed> ) = 0
[pid 25529] 10:12:37.153070 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.153103 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.153143 <... mmap resumed> ) = 0x7f40381ed000
[pid 25532] 10:12:37.153160 <... rename resumed> ) = 0
[pid 25530] 10:12:37.153186 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.153217 <... open resumed> ) = 6
[pid 25522] 10:12:37.153233 stat("/etc/userdomains",  <unfinished ...>
[pid 25533] 10:12:37.153267 mmap(0x7f40381ef000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25532] 10:12:37.153294 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.153329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.153346 read(6,  <unfinished ...>
[pid 25522] 10:12:37.153370 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.153441 <... mmap resumed> ) = 0x7f40381ef000
[pid 25532] 10:12:37.153459 <... write resumed> ) = 4
[pid 25530] 10:12:37.153488 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.153608 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.153634 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25502] 10:12:37.153662 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.153693 close(6 <unfinished ...>
[pid 25532] 10:12:37.153717 write(12, "\325\t\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.153742 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.153759 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.153782 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25502] 10:12:37.153823 read(11,  <unfinished ...>
[pid 25533] 10:12:37.153861 <... close resumed> ) = 0
[pid 25532] 10:12:37.153875 <... write resumed> ) = 4
[pid 25530] 10:12:37.153900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.153931 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.153960 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25502] 10:12:37.153989 <... read resumed> "\325\t\0\0", 4) = 4
[pid 25533] 10:12:37.154016 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.154044 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25530] 10:12:37.154069 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.154088 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.154115 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.154165 read(11,  <unfinished ...>
[pid 25533] 10:12:37.154203 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.154218 <... write resumed> ) = 4
[pid 25530] 10:12:37.154236 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.154267 <... mmap resumed> ) = 0x7f21d335d000
[pid 25522] 10:12:37.154287 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.154317 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25533] 10:12:37.154344 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.154374 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.154398 <... open resumed> ) = 6
[pid 25529] 10:12:37.154414 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.154444 <... open resumed> ) = 11
[pid 25502] 10:12:37.154466 read(11,  <unfinished ...>
[pid 25533] 10:12:37.154500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.154595 <... write resumed> ) = 4
[pid 25530] 10:12:37.154618 read(6,  <unfinished ...>
[pid 25529] 10:12:37.154643 <... mmap resumed> ) = 0x7f21cfb69000
[pid 25522] 10:12:37.154659 fstat(11,  <unfinished ...>
[pid 25502] 10:12:37.154682 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.154708 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.154738 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.154762 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.154786 mprotect(0x7f21cfc44000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.154814 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.154846 read(11,  <unfinished ...>
[pid 25533] 10:12:37.154879 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.154893 <... write resumed> ) = 4
[pid 25530] 10:12:37.154914 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.154937 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.154953 fstat(11,  <unfinished ...>
[pid 25502] 10:12:37.154975 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.155001 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.155031 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.155055 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25529] 10:12:37.155083 mmap(0x7f21cfe44000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25522] 10:12:37.155113 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.155141 read(11,  <unfinished ...>
[pid 25533] 10:12:37.155174 <... open resumed> ) = 6
[pid 25532] 10:12:37.155187 <... write resumed> ) = 4
[pid 25530] 10:12:37.155205 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.155232 <... mmap resumed> ) = 0x7f21cfe44000
[pid 25522] 10:12:37.155257 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.155285 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.155312 read(6,  <unfinished ...>
[pid 25532] 10:12:37.155336 write(12, "\260\343\t\1\0\0\0\0", 8 <unfinished ...>
[pid 25530] 10:12:37.155360 <... mmap resumed> ) = 0x7f2293dbc000
[pid 25529] 10:12:37.155384 close(6 <unfinished ...>
[pid 25522] 10:12:37.155411 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25502] 10:12:37.155431 read(11,  <unfinished ...>
[pid 25533] 10:12:37.155469 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25532] 10:12:37.155499 <... write resumed> ) = 8
[pid 25530] 10:12:37.155623 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.155658 <... close resumed> ) = 0
[pid 25522] 10:12:37.155684 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:37.155709 <... read resumed> "\260\343\t\1\0\0\0\0", 8) = 8
[pid 25533] 10:12:37.155737 fstat(6,  <unfinished ...>
[pid 25532] 10:12:37.155760 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.155784 <... mmap resumed> ) = 0x7f22930ae000
[pid 25529] 10:12:37.155800 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.155830 <... lseek resumed> ) = 0
[pid 25502] 10:12:37.155847 read(11,  <unfinished ...>
[pid 25533] 10:12:37.155879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25532] 10:12:37.155905 <... write resumed> ) = 4
[pid 25530] 10:12:37.155923 mprotect(0x7f22930ba000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.155950 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.155968 read(11,  <unfinished ...>
[pid 25502] 10:12:37.155994 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.156021 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25532] 10:12:37.156048 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25530] 10:12:37.156072 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.156087 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.156119 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25502] 10:12:37.156145 read(11,  <unfinished ...>
[pid 25533] 10:12:37.156177 <... mmap resumed> ) = 0x7f4038404000
[pid 25532] 10:12:37.156198 <... write resumed> ) = 4
[pid 25530] 10:12:37.156214 mmap(0x7f22932ba000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25529] 10:12:37.156243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.156261 read(11,  <unfinished ...>
[pid 25502] 10:12:37.156283 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25533] 10:12:37.156309 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25532] 10:12:37.156336 close(12 <unfinished ...>
[pid 25530] 10:12:37.156359 <... mmap resumed> ) = 0x7f22932ba000
[pid 25529] 10:12:37.156384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.156419 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:37.156449 close(11 <unfinished ...>
[pid 25533] 10:12:37.156487 <... mmap resumed> ) = 0x7f4037dbe000
[pid 25532] 10:12:37.156504 <... close resumed> ) = 0
[pid 25530] 10:12:37.156600 close(6 <unfinished ...>
[pid 25529] 10:12:37.156624 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.156644 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:37.156671 <... close resumed> ) = 0
[pid 25533] 10:12:37.156705 mprotect(0x7f4037dd4000, 2093056, PROT_NONE <unfinished ...>
[pid 25532] 10:12:37.156736 close(10 <unfinished ...>
[pid 25530] 10:12:37.156760 <... close resumed> ) = 0
[pid 25529] 10:12:37.156783 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.156822 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.156859 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25533] 10:12:37.156908 <... mprotect resumed> ) = 0
[pid 25532] 10:12:37.156924 <... close resumed> ) = 0
[pid 25530] 10:12:37.156940 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.156972 <... open resumed> ) = 6
[pid 25522] 10:12:37.156988 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25502] 10:12:37.157016 <... write resumed> ) = 55
[pid 25533] 10:12:37.157048 mmap(0x7f4037fd3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25532] 10:12:37.157082 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25530] 10:12:37.157111 <... open resumed> ) = 6
[pid 25529] 10:12:37.157126 read(6,  <unfinished ...>
[pid 25522] 10:12:37.157150 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.157191 fsync(9 <unfinished ...>
[pid 25533] 10:12:37.157266 <... mmap resumed> ) = 0x7f4037fd3000
[pid 25532] 10:12:37.157295 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.157414 read(6,  <unfinished ...>
[pid 25529] 10:12:37.157442 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.157465 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25533] 10:12:37.157584 mmap(0x7f4037fd5000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25532] 10:12:37.157626 close(13 <unfinished ...>
[pid 25530] 10:12:37.157651 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.157675 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.157699 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.157765 <... mmap resumed> ) = 0x7f4037fd5000
[pid 25532] 10:12:37.157792 <... close resumed> ) = 0
[pid 25530] 10:12:37.157810 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.157833 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.157862 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:37.157889 <... fsync resumed> ) = 0
[pid 25533] 10:12:37.157920 close(6 <unfinished ...>
[pid 25532] 10:12:37.157943 munmap(0x7f3c0be4b000, 4096 <unfinished ...>
[pid 25530] 10:12:37.157971 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25529] 10:12:37.158000 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.158032 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.158074 wait4(-1,  <unfinished ...>
[pid 25533] 10:12:37.158107 <... close resumed> ) = 0
[pid 25532] 10:12:37.158130 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.158599 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.158639 <... mmap resumed> ) = 0x7f21cf965000
[pid 25522] 10:12:37.158656 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25533] 10:12:37.158693 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25532] 10:12:37.158724 exit_group(0) = ?
[pid 25530] 10:12:37.159039 <... mmap resumed> ) = 0x7f2292e8b000
[pid 25529] 10:12:37.159059 mprotect(0x7f21cf968000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.159087 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.159164 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25532] 10:12:37.159186 +++ exited with 0 +++
[pid 25530] 10:12:37.159199 mprotect(0x7f2292eac000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.159225 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.159242 stat("/etc/userdomains",  <unfinished ...>
[pid 25502] 10:12:37.159269 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25532
[pid 25533] 10:12:37.159327 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.159367 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.159383 mmap(0x7f21cfb67000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25522] 10:12:37.159414 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.159452 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.159492 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.159584 mmap(0x7f22930ac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25529] 10:12:37.159621 <... mmap resumed> ) = 0x7f21cfb67000
[pid 25522] 10:12:37.159654 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:37.159690 <... open resumed> ) = 10
[pid 25533] 10:12:37.159716 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.159754 <... mmap resumed> ) = 0x7f22930ac000
[pid 25529] 10:12:37.159782 close(6 <unfinished ...>
[pid 25522] 10:12:37.159808 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.159902 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.159941 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.159971 close(6 <unfinished ...>
[pid 25529] 10:12:37.159995 <... close resumed> ) = 0
[pid 25522] 10:12:37.160021 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:37.160046 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.160087 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.160122 <... close resumed> ) = 0
[pid 25529] 10:12:37.160145 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.160176 <... lseek resumed> ) = 0
[pid 25502] 10:12:37.160194 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.160225 <... open resumed> ) = 6
[pid 25530] 10:12:37.160242 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.160270 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.160288 read(10,  <unfinished ...>
[pid 25502] 10:12:37.160312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.160348 read(6,  <unfinished ...>
[pid 25530] 10:12:37.160371 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.160388 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.160421 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25502] 10:12:37.160447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.160483 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.160583 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.160623 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.160642 read(10,  <unfinished ...>
[pid 25502] 10:12:37.160665 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25533] 10:12:37.160697 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.160726 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.160744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.160775 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:37.160820 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.160867 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.160899 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.160931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.160951 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:37.160985 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.161010 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.161039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.161059 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.161091 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25502] 10:12:37.161130 read(10,  <unfinished ...>
[pid 25533] 10:12:37.161168 <... mmap resumed> ) = 0x7f4037b87000
[pid 25530] 10:12:37.161185 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.161217 <... open resumed> ) = 6
[pid 25522] 10:12:37.161233 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.161261 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25533] 10:12:37.161313 mprotect(0x7f4037b8e000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.161346 <... open resumed> ) = 6
[pid 25529] 10:12:37.161363 read(6,  <unfinished ...>
[pid 25522] 10:12:37.161387 <... open resumed> ) = 12
[pid 25502] 10:12:37.161404 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.161443 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.161460 read(6,  <unfinished ...>
[pid 25529] 10:12:37.161483 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.161583 fstat(12,  <unfinished ...>
[pid 25502] 10:12:37.161614 <... stat resumed> 0x7ffced97c710) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.161650 mmap(0x7f4037d8e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25530] 10:12:37.161685 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.161710 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.161733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25502] 10:12:37.161766 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.161800 <... mmap resumed> ) = 0x7f4037d8e000
[pid 25530] 10:12:37.161823 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.161846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.161883 fstat(12,  <unfinished ...>
[pid 25502] 10:12:37.161906 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.161957 mmap(0x7f4037d90000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.161989 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.162022 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.162053 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25502] 10:12:37.162082 write(8, "2015-12-30 10:12:37 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25533] 10:12:37.162122 <... mmap resumed> ) = 0x7f4037d90000
[pid 25530] 10:12:37.162144 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.162173 <... mmap resumed> ) = 0x7f21cf739000
[pid 25522] 10:12:37.162190 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.162216 <... write resumed> ) = 132
[pid 25533] 10:12:37.162249 close(6 <unfinished ...>
[pid 25530] 10:12:37.162274 <... mmap resumed> ) = 0x7f2292c6e000
[pid 25529] 10:12:37.162291 mprotect(0x7f21cf762000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.162319 <... mmap resumed> ) = 0x7f2e40b10000
[pid 25502] 10:12:37.162336 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.162370 <... close resumed> ) = 0
[pid 25530] 10:12:37.162399 mprotect(0x7f2292c85000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.162432 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.162449 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:37.162479 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.162638 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.162677 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.162694 mmap(0x7f21cf962000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25522] 10:12:37.162725 <... lseek resumed> ) = 0
[pid 25502] 10:12:37.162743 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.162777 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.162795 mmap(0x7f2292e85000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25529] 10:12:37.162823 <... mmap resumed> ) = 0x7f21cf962000
[pid 25522] 10:12:37.162845 read(12,  <unfinished ...>
[pid 25502] 10:12:37.162870 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.162961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.163000 <... mmap resumed> ) = 0x7f2292e85000
[pid 25529] 10:12:37.163022 mmap(0x7f21cf964000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.163058 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:37.163083 close(7 <unfinished ...>
[pid 25533] 10:12:37.163119 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.163137 mmap(0x7f2292e87000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.163165 <... mmap resumed> ) = 0x7f21cf964000
[pid 25522] 10:12:37.163187 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25502] 10:12:37.163216 <... close resumed> ) = 0
[pid 25533] 10:12:37.163244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.163275 <... mmap resumed> ) = 0x7f2292e87000
[pid 25529] 10:12:37.163297 close(6 <unfinished ...>
[pid 25522] 10:12:37.163321 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25502] 10:12:37.163366 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.163413 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.163435 close(6 <unfinished ...>
[pid 25529] 10:12:37.163460 <... close resumed> ) = 0
[pid 25522] 10:12:37.163487 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:37.163581 <... open resumed> ) = 7
[pid 25533] 10:12:37.163608 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.163641 <... close resumed> ) = 0
[pid 25529] 10:12:37.163665 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.163696 <... open resumed> ) = 13
[pid 25502] 10:12:37.163713 fcntl(7, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.163745 <... open resumed> ) = 6
[pid 25530] 10:12:37.163761 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.163790 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.163808 fstat(13,  <unfinished ...>
[pid 25502] 10:12:37.163831 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.163856 read(6,  <unfinished ...>
[pid 25530] 10:12:37.163880 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.163897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.163929 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25502] 10:12:37.163958 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.163990 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.164013 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.164045 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.164062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.164089 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.164113 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.164137 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.164160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.164190 <... mmap resumed> ) = 0x7f2e40b0f000
[pid 25502] 10:12:37.164207 fstat(7,  <unfinished ...>
[pid 25533] 10:12:37.164239 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.164269 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.164298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.164317 read(13,  <unfinished ...>
[pid 25502] 10:12:37.164345 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5382249, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.164388 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.164425 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.164448 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.164490 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25502] 10:12:37.164630 write(7, "2015-12-30 10:12:37 [25502] 1aEJMa-0006dB-67 => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2517 QT=1s DT=0s\n", 232 <unfinished ...>
[pid 25533] 10:12:37.164680 <... mmap resumed> ) = 0x7f4037903000
[pid 25530] 10:12:37.164698 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.164727 <... open resumed> ) = 6
[pid 25522] 10:12:37.164743 close(13 <unfinished ...>
[pid 25502] 10:12:37.164768 <... write resumed> ) = 232
[pid 25533] 10:12:37.164801 mprotect(0x7f4037986000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.164832 <... open resumed> ) = 6
[pid 25529] 10:12:37.164848 read(6,  <unfinished ...>
[pid 25522] 10:12:37.164872 <... close resumed> ) = 0
[pid 25502] 10:12:37.164888 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25533] 10:12:37.164935 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.164951 read(6,  <unfinished ...>
[pid 25529] 10:12:37.164975 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.164998 munmap(0x7f2e40b0f000, 4096 <unfinished ...>
[pid 25502] 10:12:37.165026 <... open resumed> ) = 11
[pid 25533] 10:12:37.165051 mmap(0x7f4037b85000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25530] 10:12:37.165080 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.165109 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.165134 <... munmap resumed> ) = 0
[pid 25502] 10:12:37.165172 alarm(60 <unfinished ...>
[pid 25533] 10:12:37.165209 <... mmap resumed> ) = 0x7f4037b85000
[pid 25530] 10:12:37.165236 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.165261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.165292 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.165322 <... alarm resumed> ) = 0
[pid 25533] 10:12:37.165348 close(6 <unfinished ...>
[pid 25530] 10:12:37.165373 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25529] 10:12:37.165409 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.165440 <... open resumed> ) = 13
[pid 25502] 10:12:37.165458 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25533] 10:12:37.165504 <... close resumed> ) = 0
[pid 25530] 10:12:37.165615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.165645 <... mmap resumed> ) = 0x7f21d335c000
[pid 25522] 10:12:37.165665 fstat(13,  <unfinished ...>
[pid 25502] 10:12:37.165690 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.165714 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.165746 <... mmap resumed> ) = 0x7f2293dbb000
[pid 25529] 10:12:37.165765 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.165796 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.165828 alarm(0 <unfinished ...>
[pid 25533] 10:12:37.165860 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.165879 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.165906 <... mmap resumed> ) = 0x7f21cf523000
[pid 25522] 10:12:37.165922 fstat(13,  <unfinished ...>
[pid 25502] 10:12:37.165945 <... alarm resumed> ) = 60
[pid 25533] 10:12:37.166023 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.166060 <... mmap resumed> ) = 0x7f22928fa000
[pid 25529] 10:12:37.166077 mprotect(0x7f21cf538000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.166105 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.166133 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25533] 10:12:37.166171 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.166189 mprotect(0x7f2292a69000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.166215 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.166231 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.166257 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25533] 10:12:37.166303 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.166336 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.166352 mmap(0x7f21cf737000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25522] 10:12:37.166382 <... mmap resumed> ) = 0x7f2e40b0f000
[pid 25502] 10:12:37.166399 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.166438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.166457 mmap(0x7f2292c68000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25529] 10:12:37.166485 <... mmap resumed> ) = 0x7f21cf737000
[pid 25522] 10:12:37.166515 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:37.166542 <... open resumed> ) = 12
[pid 25533] 10:12:37.166567 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.166599 <... mmap resumed> ) = 0x7f2292c68000
[pid 25529] 10:12:37.166625 close(6 <unfinished ...>
[pid 25522] 10:12:37.166651 <... lseek resumed> ) = 0
[pid 25502] 10:12:37.166668 fcntl(12, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.166699 <... open resumed> ) = 6
[pid 25530] 10:12:37.166715 close(6 <unfinished ...>
[pid 25529] 10:12:37.166737 <... close resumed> ) = 0
[pid 25522] 10:12:37.166773 read(13,  <unfinished ...>
[pid 25502] 10:12:37.166802 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.166826 read(6,  <unfinished ...>
[pid 25530] 10:12:37.166850 <... close resumed> ) = 0
[pid 25529] 10:12:37.166873 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.166905 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25502] 10:12:37.166929 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.166961 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.166985 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.167014 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.167032 read(13,  <unfinished ...>
[pid 25502] 10:12:37.167055 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.167079 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.167103 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.167120 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.167152 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:37.167179 read(12,  <unfinished ...>
[pid 25533] 10:12:37.167214 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25530] 10:12:37.167241 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.167258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.167268 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25502] 10:12:37.167284 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25533] 10:12:37.167307 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.167320 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.167329 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.167348 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25502] 10:12:37.167374 close(12 <unfinished ...>
[pid 25533] 10:12:37.167399 <... mmap resumed> ) = 0x7f4038403000
[pid 25530] 10:12:37.167416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.167432 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.167443 stat("/usr/local/cpanel/3rdparty/mailman/lists/ltoms_rmrcc.com/config.pck",  <unfinished ...>
[pid 25502] 10:12:37.167464 <... close resumed> ) = 0
[pid 25533] 10:12:37.167490 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.167706 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.167733 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.167767 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.167796 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.167835 <... mmap resumed> ) = 0x7f40376f5000
[pid 25530] 10:12:37.167851 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.167883 <... open resumed> ) = 6
[pid 25522] 10:12:37.167898 stat("/etc/demouids",  <unfinished ...>
[pid 25502] 10:12:37.167925 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.167951 mprotect(0x7f4037701000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.167979 <... open resumed> ) = 6
[pid 25529] 10:12:37.167995 read(6,  <unfinished ...>
[pid 25522] 10:12:37.168018 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.168060 stat("/var/tmp",  <unfinished ...>
[pid 25533] 10:12:37.168101 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.168117 read(6,  <unfinished ...>
[pid 25529] 10:12:37.168140 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.168163 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.168191 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25533] 10:12:37.168327 mmap(0x7f4037901000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25530] 10:12:37.168363 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.168387 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.168410 <... open resumed> ) = 14
[pid 25502] 10:12:37.168427 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.168467 <... mmap resumed> ) = 0x7f4037901000
[pid 25530] 10:12:37.168492 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.168594 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.168628 fstat(14,  <unfinished ...>
[pid 25502] 10:12:37.168651 <... open resumed> ) = 12
[pid 25533] 10:12:37.168675 close(6 <unfinished ...>
[pid 25530] 10:12:37.168697 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25529] 10:12:37.168726 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.168756 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.168788 fcntl(12, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.168819 <... close resumed> ) = 0
[pid 25530] 10:12:37.168842 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.168870 <... mmap resumed> ) = 0x7f21cf318000
[pid 25522] 10:12:37.168886 fstat(14,  <unfinished ...>
[pid 25502] 10:12:37.168909 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.168932 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.168966 <... mmap resumed> ) = 0x7f229266b000
[pid 25529] 10:12:37.168982 mprotect(0x7f21cf322000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.169010 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25502] 10:12:37.169037 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.169068 <... open resumed> ) = 6
[pid 25530] 10:12:37.169084 mprotect(0x7f22926f6000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.169110 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.169125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.169151 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.169175 read(6,  <unfinished ...>
[pid 25530] 10:12:37.169199 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.169214 mmap(0x7f21cf521000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25522] 10:12:37.169243 <... mmap resumed> ) = 0x7f2e40b0e000
[pid 25502] 10:12:37.169259 fstat(12,  <unfinished ...>
[pid 25533] 10:12:37.169295 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.169319 mmap(0x7f22928f6000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25529] 10:12:37.169349 <... mmap resumed> ) = 0x7f21cf521000
[pid 25522] 10:12:37.169374 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25502] 10:12:37.169399 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25533] 10:12:37.169451 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.169477 <... mmap resumed> ) = 0x7f22928f6000
[pid 25529] 10:12:37.169497 close(6 <unfinished ...>
[pid 25522] 10:12:37.169525 <... lseek resumed> ) = 0
[pid 25502] 10:12:37.169543 pread(12,  <unfinished ...>
[pid 25533] 10:12:37.169576 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25530] 10:12:37.169614 mmap(0x7f22928f9000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.169644 <... close resumed> ) = 0
[pid 25522] 10:12:37.169675 read(14,  <unfinished ...>
[pid 25502] 10:12:37.169704 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25533] 10:12:37.169750 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.169781 <... mmap resumed> ) = 0x7f22928f9000
[pid 25529] 10:12:37.169802 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.169835 <... read resumed> "", 4096) = 0
[pid 25502] 10:12:37.169859 pread(12,  <unfinished ...>
[pid 25533] 10:12:37.169893 <... mmap resumed> ) = 0x7f40374d2000
[pid 25530] 10:12:37.169909 close(6 <unfinished ...>
[pid 25529] 10:12:37.169931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.169949 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25502] 10:12:37.169977 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25533] 10:12:37.170011 mprotect(0x7f40374f3000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.170025 <... close resumed> ) = 0
[pid 25529] 10:12:37.170040 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.170057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25502] 10:12:37.170195 close(12 <unfinished ...>
[pid 25533] 10:12:37.170219 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.170228 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.170243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.170252 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:37.170267 <... close resumed> ) = 0
[pid 25533] 10:12:37.170298 mmap(0x7f40376f3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25530] 10:12:37.170314 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.170324 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.170339 <... open resumed> ) = 15
[pid 25502] 10:12:37.170349 close(11 <unfinished ...>
[pid 25533] 10:12:37.170370 <... mmap resumed> ) = 0x7f40376f3000
[pid 25530] 10:12:37.170383 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.170399 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.170410 fstat(15,  <unfinished ...>
[pid 25502] 10:12:37.170419 <... close resumed> ) = 0
[pid 25533] 10:12:37.170455 close(6 <unfinished ...>
[pid 25530] 10:12:37.170464 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.170473 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.170490 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25502] 10:12:37.170731 pipe( <unfinished ...>
[pid 25533] 10:12:37.170776 <... close resumed> ) = 0
[pid 25530] 10:12:37.170801 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.170833 <... open resumed> ) = 6
[pid 25522] 10:12:37.170849 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.170876 <... pipe resumed> [11, 12]) = 0
[pid 25533] 10:12:37.170903 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.170934 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.170954 read(6,  <unfinished ...>
[pid 25522] 10:12:37.170978 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25502] 10:12:37.170995 close(10 <unfinished ...>
[pid 25533] 10:12:37.171028 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.171045 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.171076 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.171100 read(15,  <unfinished ...>
[pid 25502] 10:12:37.171128 <... close resumed> ) = 0
[pid 25533] 10:12:37.171152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.171190 <... open resumed> ) = 6
[pid 25529] 10:12:37.171207 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.171230 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25502] 10:12:37.171257 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25533] 10:12:37.171295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.171313 read(6,  <unfinished ...>
[pid 25529] 10:12:37.171337 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.171368 close(15 <unfinished ...>
[pid 25502] 10:12:37.171399 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.171430 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.171464 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.171487 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.171600 <... close resumed> ) = 0
[pid 25502] 10:12:37.171620 clone( <unfinished ...>
[pid 25533] 10:12:37.171916 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.171937 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.171961 <... mmap resumed> ) = 0x7f21cf115000
[pid 25522] 10:12:37.171978 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.172015 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.172048 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25529] 10:12:37.172079 mprotect(0x7f21cf117000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.172108 <... munmap resumed> ) = 0
[pid 25502] 10:12:37.172172 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25535
[pid 25533] 10:12:37.172223 <... open resumed> ) = 6
[pid 25530] 10:12:37.172242 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.172271 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.172287 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25502] 10:12:37.172314 close(12 <unfinished ...>
[pid 25533] 10:12:37.172347 read(6,  <unfinished ...>
[pid 25530] 10:12:37.172370 <... mmap resumed> ) = 0x7f2292465000
[pid 25529] 10:12:37.172386 mmap(0x7f21cf316000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25522] 10:12:37.172415 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25502] 10:12:37.172460 <... close resumed> ) = 0
[pid 25533] 10:12:37.172488 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.172587 mprotect(0x7f229246b000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.172619 <... mmap resumed> ) = 0x7f21cf316000
[pid 25522] 10:12:37.172645 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25502] 10:12:37.172677 read(11,  <unfinished ...>
[pid 25533] 10:12:37.172706 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.172728 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.172744 close(6 <unfinished ...>
[pid 25522] 10:12:37.172766 <... open resumed> ) = 15
[pid 25533] 10:12:37.172789 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.172819 mmap(0x7f229266a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25529] 10:12:37.172849 <... close resumed> ) = 0
[pid 25522] 10:12:37.172872 fstat(15,  <unfinished ...>
[pid 25533] 10:12:37.172903 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.172930 <... mmap resumed> ) = 0x7f229266a000
[pid 25529] 10:12:37.172950 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.172977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.173011 <... mmap resumed> ) = 0x7f40372b5000
[pid 25530] 10:12:37.173027 close(6 <unfinished ...>
[pid 25529] 10:12:37.173049 <... mmap resumed> ) = 0x7f21d335b000
[pid 25522] 10:12:37.173081 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.173114 mprotect(0x7f40372cc000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.173140 <... close resumed> ) = 0
[pid 25529] 10:12:37.173162 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.173193 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25533] 10:12:37.173216 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.173232 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.173261 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.173278 read(15,  <unfinished ...>
[pid 25533] 10:12:37.173311 mmap(0x7f40374cc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25530] 10:12:37.173341 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.173358 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.173390 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.173424 <... mmap resumed> ) = 0x7f40374cc000
[pid 25530] 10:12:37.173447 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.173481 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.173498 close(15 <unfinished ...>
[pid 25533] 10:12:37.173624 mmap(0x7f40374ce000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.173672 <... open resumed> ) = 6
[pid 25529] 10:12:37.173692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.173723 <... close resumed> ) = 0
[pid 25533] 10:12:37.173746 <... mmap resumed> ) = 0x7f40374ce000
[pid 25530] 10:12:37.173768 read(6,  <unfinished ...>
[pid 25529] 10:12:37.173794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.173812 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.173845 close(6 <unfinished ...>
[pid 25530] 10:12:37.173868 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.173892 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.173921 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.173954 <... close resumed> ) = 0
[pid 25530] 10:12:37.173980 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.174005 <... open resumed> ) = 6
[pid 25522] 10:12:37.174020 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.174054 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.174083 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.174113 read(6,  <unfinished ...>
[pid 25522] 10:12:37.174137 <... open resumed> ) = 15
[pid 25533] 10:12:37.174159 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.174177 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.174203 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.174226 fstat(15,  <unfinished ...>
[pid 25533] 10:12:37.174255 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.174286 <... mmap resumed> ) = 0x7f2293dba000
[pid 25529] 10:12:37.174305 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.174329 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.174363 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.174380 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.174407 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.174437 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.174474 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.174504 <... mmap resumed> ) = 0x7f229212f000
[pid 25529] 10:12:37.174525 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.174555 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25533] 10:12:37.174577 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.174597 mprotect(0x7f229225b000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.174625 <... mmap resumed> ) = 0x7f21ceef6000
[pid 25522] 10:12:37.174640 read(15,  <unfinished ...>
[pid 25533] 10:12:37.174673 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.174702 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.174718 mprotect(0x7f21cef13000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.174745 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.174776 <... open resumed> ) = 6
[pid 25530] 10:12:37.174792 mmap(0x7f229245b000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25529] 10:12:37.174823 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.174839 close(15 <unfinished ...>
[pid 25533] 10:12:37.174869 read(6,  <unfinished ...>
[pid 25530] 10:12:37.174892 <... mmap resumed> ) = 0x7f229245b000
[pid 25529] 10:12:37.174912 mmap(0x7f21cf112000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25522] 10:12:37.174941 <... close resumed> ) = 0
[pid 25533] 10:12:37.174963 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.174983 mmap(0x7f2292464000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.174997 <... mmap resumed> ) = 0x7f21cf112000
[pid 25522] 10:12:37.175010 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.175029 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.175039 <... mmap resumed> ) = 0x7f2292464000
[pid 25529] 10:12:37.175051 mmap(0x7f21cf114000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.175064 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.175168 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.175193 close(6 <unfinished ...>
[pid 25529] 10:12:37.175203 <... mmap resumed> ) = 0x7f21cf114000
[pid 25522] 10:12:37.175217 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.175238 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.175250 <... close resumed> ) = 0
[pid 25529] 10:12:37.175265 close(6 <unfinished ...>
[pid 25522] 10:12:37.175273 <... open resumed> ) = 15
[pid 25533] 10:12:37.175288 <... mmap resumed> ) = 0x7f4038402000
[pid 25530] 10:12:37.175300 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.175315 <... close resumed> ) = 0
[pid 25522] 10:12:37.175359 fstat(15,  <unfinished ...>
[pid 25533] 10:12:37.175382 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.175396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.175408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.175422 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.175451 <... mmap resumed> ) = 0x7f4036f41000
[pid 25530] 10:12:37.175464 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.175481 <... mmap resumed> ) = 0x7f21d335a000
[pid 25522] 10:12:37.175767 fstat(15,  <unfinished ...>
[pid 25533] 10:12:37.175806 mprotect(0x7f40370b0000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.175834 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.175852 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.175879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.175914 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.175931 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.175960 <... mmap resumed> ) = 0x7f21d3359000
[pid 25522] 10:12:37.175986 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.176019 mmap(0x7f40372af000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25530] 10:12:37.176049 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.176068 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.176093 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25533] 10:12:37.176116 <... mmap resumed> ) = 0x7f40372af000
[pid 25530] 10:12:37.176142 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.176175 <... mmap resumed> ) = 0x7f21d3357000
[pid 25522] 10:12:37.176196 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.176226 close(6 <unfinished ...>
[pid 25530] 10:12:37.176248 <... open resumed> ) = 6
[pid 25529] 10:12:37.176264 arch_prctl(ARCH_SET_FS, 0x7f21d33577c0 <unfinished ...>
[pid 25522] 10:12:37.176288 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.176310 <... close resumed> ) = 0
[pid 25530] 10:12:37.176334 read(6,  <unfinished ...>
[pid 25529] 10:12:37.176358 <... arch_prctl resumed> ) = 0
[pid 25522] 10:12:37.176414 read(15,  <unfinished ...>
[pid 25533] 10:12:37.176448 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.176479 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.176502 mprotect(0x7f21cf112000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.176534 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25533] 10:12:37.176561 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.176586 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.176609 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.176629 read(15,  <unfinished ...>
[pid 25533] 10:12:37.176659 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.176692 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.176723 mprotect(0x7f21cf316000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.176750 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.176835 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.176861 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.176891 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.176924 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.176955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.176986 <... mmap resumed> ) = 0x7f2291f2b000
[pid 25529] 10:12:37.177002 mprotect(0x7f21cf521000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.177029 <... lseek resumed> ) = 353
[pid 25533] 10:12:37.177055 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.177074 mprotect(0x7f2291f2d000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.177101 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.177126 read(9,  <unfinished ...>
[pid 25533] 10:12:37.177157 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.177189 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.177204 mprotect(0x7f21cf737000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.177231 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.177386 <... open resumed> ) = 6
[pid 25530] 10:12:37.177417 mmap(0x7f229212d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25529] 10:12:37.177449 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.177480 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.177525 read(6,  <unfinished ...>
[pid 25530] 10:12:37.177556 <... mmap resumed> ) = 0x7f229212d000
[pid 25529] 10:12:37.177585 mprotect(0x7f21cf962000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.177615 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.177639 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.177664 close(6 <unfinished ...>
[pid 25529] 10:12:37.177687 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.177712 read(9,  <unfinished ...>
[pid 25533] 10:12:37.177743 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.177766 <... close resumed> ) = 0
[pid 25529] 10:12:37.177788 mprotect(0x7f21cfb67000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.177816 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25533] 10:12:37.177873 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25530] 10:12:37.177915 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.177947 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.178069 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.178111 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.178139 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.178157 mprotect(0x7f21cfe44000, 40960, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.178184 <... stat resumed> 0x7f2e3f1b1880) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.178221 <... mmap resumed> ) = 0x7f4036cb2000
[pid 25530] 10:12:37.178241 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.178274 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.178372 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25533] 10:12:37.178408 mprotect(0x7f4036d3d000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.178435 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.178453 mprotect(0x7f21d0091000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.178478 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.178540 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.178565 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.178596 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.178627 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.178666 mmap(0x7f4036f3d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25530] 10:12:37.178698 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.178717 mprotect(0x7f21d02ab000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.178745 <... open resumed> ) = 16
[pid 25533] 10:12:37.178774 <... mmap resumed> ) = 0x7f4036f3d000
[pid 25530] 10:12:37.178797 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.178829 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.178850 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25533] 10:12:37.178882 mmap(0x7f4036f40000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.178911 <... open resumed> ) = 6
[pid 25529] 10:12:37.178926 mprotect(0x7f21d04b8000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.178952 <... ioctl resumed> , 0x7ffd5c5bac10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.178976 <... mmap resumed> ) = 0x7f4036f40000
[pid 25530] 10:12:37.178999 read(6,  <unfinished ...>
[pid 25529] 10:12:37.179023 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.179226 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25533] 10:12:37.179258 close(6 <unfinished ...>
[pid 25530] 10:12:37.179281 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.179304 mprotect(0x7f21d0ca4000, 110592, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.179350 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.179375 <... close resumed> ) = 0
[pid 25530] 10:12:37.179397 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.179406 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.179482 fstat(16,  <unfinished ...>
[pid 25533] 10:12:37.179498 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.179666 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.179701 mprotect(0x7f21d0f30000, 16384, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.179729 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25533] 10:12:37.179764 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.179782 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.179812 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.179910 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.179944 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.179977 <... mmap resumed> ) = 0x7f2291d28000
[pid 25529] 10:12:37.179993 mprotect(0x7f21d12c5000, 16384, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.180020 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.180044 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.180062 mprotect(0x7f2291d2a000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.180088 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.180108 fstat(16,  <unfinished ...>
[pid 25533] 10:12:37.180137 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.180167 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.180182 mprotect(0x7f21d14d0000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.180208 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25533] 10:12:37.180259 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.180281 mmap(0x7f2291f29000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25529] 10:12:37.180315 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.180339 read(16,  <unfinished ...>
[pid 25533] 10:12:37.180370 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.180403 <... mmap resumed> ) = 0x7f2291f29000
[pid 25529] 10:12:37.180428 mprotect(0x7f21d16d4000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.180456 <... read resumed> "0", 8192) = 1
[pid 25533] 10:12:37.180481 <... open resumed> ) = 6
[pid 25530] 10:12:37.180498 close(6 <unfinished ...>
[pid 25529] 10:12:37.180596 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.181225 read(16,  <unfinished ...>
[pid 25533] 10:12:37.181261 read(6,  <unfinished ...>
[pid 25530] 10:12:37.181285 <... close resumed> ) = 0
[pid 25529] 10:12:37.181308 mprotect(0x7f21d242c000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.181337 <... read resumed> "", 8192) = 0
[pid 25533] 10:12:37.181365 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.181396 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.181428 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.181466 close(16 <unfinished ...>
[pid 25533] 10:12:37.181498 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.181577 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.181596 mprotect(0x7f21d2861000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.181624 <... close resumed> ) = 0
[pid 25533] 10:12:37.181710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25530] 10:12:37.181749 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.181783 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.181804 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.181841 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.181871 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.181888 mprotect(0x7f21d2ae5000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.181915 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25533] 10:12:37.181975 <... mmap resumed> ) = 0x7f4036aac000
[pid 25530] 10:12:37.182001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.182037 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.182058 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.182091 mprotect(0x7f4036ab2000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.182124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.182144 mprotect(0x7f21d2cee000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.182171 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.182218 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.182237 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.182270 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.182303 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.182336 mmap(0x7f4036cb1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25530] 10:12:37.182366 <... open resumed> ) = 6
[pid 25529] 10:12:37.182382 mprotect(0x7f21d2f33000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.182408 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.182447 <... mmap resumed> ) = 0x7f4036cb1000
[pid 25530] 10:12:37.182470 read(6,  <unfinished ...>
[pid 25529] 10:12:37.182494 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.182523 close(7 <unfinished ...>
[pid 25533] 10:12:37.182572 close(6 <unfinished ...>
[pid 25530] 10:12:37.182614 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.182653 mprotect(0x7f21d314d000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.182681 <... close resumed> ) = 0
[pid 25533] 10:12:37.182708 <... close resumed> ) = 0
[pid 25530] 10:12:37.182732 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.182756 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.182802 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.182846 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.182876 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.182906 mprotect(0x7f21d3370000, 4096, PROT_READ <unfinished ...>
[pid 25522] 10:12:37.182938 <... open resumed> ) = 7
[pid 25533] 10:12:37.182962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.182980 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.183008 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.183024 fcntl(7, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.183054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.183088 <... mmap resumed> ) = 0x7f2293db9000
[pid 25529] 10:12:37.183109 munmap(0x7f21d3365000, 39387 <unfinished ...>
[pid 25522] 10:12:37.183141 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.183164 <... open resumed> ) = 6
[pid 25530] 10:12:37.183181 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.183209 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.183226 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.183255 read(6,  <unfinished ...>
[pid 25530] 10:12:37.183279 <... mmap resumed> ) = 0x7f2291994000
[pid 25529] 10:12:37.183294 set_tid_address(0x7f21d3357a90 <unfinished ...>
[pid 25522] 10:12:37.183319 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.183341 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.183362 mprotect(0x7f2291b1e000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.183376 <... set_tid_address resumed> ) = 25529
[pid 25522] 10:12:37.183384 fstat(7,  <unfinished ...>
[pid 25533] 10:12:37.183399 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.183408 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.183415 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25522] 10:12:37.183424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5382481, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.183449 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.183467 mmap(0x7f2291d1e000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25529] 10:12:37.183482 <... set_robust_list resumed> ) = 0
[pid 25522] 10:12:37.183490 write(7, "2015-12-30 10:12:37 [25522] 1aEJMa-0006dL-LG SMTP connection outbound 1451491957 1aEJMa-0006dL-LG finestweddingsites.com ltoms@rmrcc.com\n", 137 <unfinished ...>
[pid 25533] 10:12:37.183722 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.183753 <... mmap resumed> ) = 0x7f2291d1e000
[pid 25529] 10:12:37.183775 futex(0x7ffce2d44f9c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25522] 10:12:37.183802 <... write resumed> ) = 137
[pid 25533] 10:12:37.183871 <... mmap resumed> ) = 0x7f4038401000
[pid 25530] 10:12:37.183898 mmap(0x7f2291d23000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.183934 <... futex resumed> ) = 0
[pid 25522] 10:12:37.183954 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25533] 10:12:37.184003 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.184032 <... mmap resumed> ) = 0x7f2291d23000
[pid 25529] 10:12:37.184054 futex(0x7ffce2d44f9c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f21d33577c0 <unfinished ...>
[pid 25522] 10:12:37.184081 <... open resumed> ) = 16
[pid 25533] 10:12:37.184108 <... mmap resumed> ) = 0x7f4036776000
[pid 25530] 10:12:37.184126 close(6 <unfinished ...>
[pid 25529] 10:12:37.184149 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25522] 10:12:37.184172 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25533] 10:12:37.184203 mprotect(0x7f40368a2000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.184231 <... close resumed> ) = 0
[pid 25529] 10:12:37.184255 rt_sigaction(SIGRTMIN, {0x7f21d221ac60, [], SA_RESTORER|SA_SIGINFO, 0x7f21d2224790},  <unfinished ...>
[pid 25522] 10:12:37.184286 <... lseek resumed> ) = 16
[pid 25533] 10:12:37.184309 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.184326 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.184356 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.184375 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25533] 10:12:37.184407 mmap(0x7f4036aa2000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25530] 10:12:37.184437 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.184455 rt_sigaction(SIGRT_1, {0x7f21d221acf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f21d2224790},  <unfinished ...>
[pid 25522] 10:12:37.184482 <... ioctl resumed> , 0x7ffd5c5bac10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.184572 <... mmap resumed> ) = 0x7f4036aa2000
[pid 25530] 10:12:37.184602 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.184637 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.184653 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25533] 10:12:37.184683 mmap(0x7f4036aab000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.184711 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.184728 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25522] 10:12:37.184754 <... lseek resumed> ) = 16
[pid 25533] 10:12:37.184777 <... mmap resumed> ) = 0x7f4036aab000
[pid 25530] 10:12:37.184803 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.184835 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25522] 10:12:37.184862 fstat(16,  <unfinished ...>
[pid 25533] 10:12:37.184893 close(6 <unfinished ...>
[pid 25530] 10:12:37.184915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.184940 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25522] 10:12:37.184964 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=16, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25533] 10:12:37.185000 <... close resumed> ) = 0
[pid 25530] 10:12:37.185028 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.185063 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25522] 10:12:37.185121 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.185153 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.185183 <... open resumed> ) = 6
[pid 25529] 10:12:37.185198 statfs("/selinux",  <unfinished ...>
[pid 25522] 10:12:37.185231 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.185266 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.185287 read(6,  <unfinished ...>
[pid 25529] 10:12:37.185312 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350327, f_bavail=6350327, f_files=1000000, f_ffree=691082, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25522] 10:12:37.185387 write(16, "1", 1 <unfinished ...>
[pid 25533] 10:12:37.185434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.185473 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.185502 brk(0 <unfinished ...>
[pid 25522] 10:12:37.185605 <... write resumed> ) = 1
[pid 25533] 10:12:37.185631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.185649 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.185671 <... brk resumed> ) = 0x21ca000
[pid 25522] 10:12:37.185687 close(16 <unfinished ...>
[pid 25533] 10:12:37.185717 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.185748 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25529] 10:12:37.185778 brk(0x21eb000 <unfinished ...>
[pid 25522] 10:12:37.185803 <... close resumed> ) = 0
[pid 25533] 10:12:37.185855 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.185879 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.185908 <... brk resumed> ) = 0x21eb000
[pid 25522] 10:12:37.185936 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.185974 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.186006 <... mmap resumed> ) = 0x7f2291728000
[pid 25529] 10:12:37.186022 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.186059 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.186089 <... open resumed> ) = 6
[pid 25530] 10:12:37.186107 mprotect(0x7f229178a000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.186135 <... open resumed> ) = 6
[pid 25522] 10:12:37.186163 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.186204 read(6,  <unfinished ...>
[pid 25530] 10:12:37.186228 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.186243 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.186266 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.186319 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.186350 mmap(0x7f2291989000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25529] 10:12:37.186387 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.186426 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.186468 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.186497 <... mmap resumed> ) = 0x7f2291989000
[pid 25529] 10:12:37.186601 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.186635 <... open resumed> ) = 16
[pid 25533] 10:12:37.186659 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.186692 close(6 <unfinished ...>
[pid 25529] 10:12:37.186715 <... mmap resumed> ) = 0x7f21d336e000
[pid 25522] 10:12:37.186731 fstat(16,  <unfinished ...>
[pid 25533] 10:12:37.186760 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.186789 <... close resumed> ) = 0
[pid 25529] 10:12:37.186815 read(6,  <unfinished ...>
[pid 25522] 10:12:37.186909 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25533] 10:12:37.186945 <... mmap resumed> ) = 0x7f4036572000
[pid 25530] 10:12:37.186962 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.186992 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25522] 10:12:37.187021 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.187055 mprotect(0x7f4036574000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.187082 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.187100 read(6,  <unfinished ...>
[pid 25522] 10:12:37.187123 <... mmap resumed> ) = 0x7f2e40b0c000
[pid 25533] 10:12:37.187144 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.187160 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.187192 <... read resumed> "", 1024) = 0
[pid 25522] 10:12:37.187216 read(16,  <unfinished ...>
[pid 25533] 10:12:37.187250 mmap(0x7f4036774000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25530] 10:12:37.187279 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.187297 close(6 <unfinished ...>
[pid 25522] 10:12:37.187332 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25533] 10:12:37.187370 <... mmap resumed> ) = 0x7f4036774000
[pid 25530] 10:12:37.187405 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.187442 <... close resumed> ) = 0
[pid 25522] 10:12:37.187464 read(16,  <unfinished ...>
[pid 25533] 10:12:37.187499 close(6 <unfinished ...>
[pid 25530] 10:12:37.187600 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.187623 munmap(0x7f21d336e000, 4096 <unfinished ...>
[pid 25522] 10:12:37.187652 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.187676 <... close resumed> ) = 0
[pid 25530] 10:12:37.187700 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.187733 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.187809 close(16 <unfinished ...>
[pid 25533] 10:12:37.187843 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.187873 <... open resumed> ) = 6
[pid 25529] 10:12:37.187889 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25522] 10:12:37.187922 <... close resumed> ) = 0
[pid 25533] 10:12:37.187944 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.187962 read(6,  <unfinished ...>
[pid 25529] 10:12:37.187985 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.188072 munmap(0x7f2e40b0c000, 4096 <unfinished ...>
[pid 25533] 10:12:37.188110 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.188143 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.188166 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f21d2224790},  <unfinished ...>
[pid 25522] 10:12:37.188194 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.188216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.188236 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.188259 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.188285 uname( <unfinished ...>
[pid 25533] 10:12:37.188315 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.188347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25529] 10:12:37.188383 fstat(2,  <unfinished ...>
[pid 25522] 10:12:37.188410 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25533] 10:12:37.188590 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.188619 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.188651 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25522] 10:12:37.188715 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25533] 10:12:37.188763 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.188803 <... mmap resumed> ) = 0x7f2291345000
[pid 25529] 10:12:37.188820 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f21d2224790},  <unfinished ...>
[pid 25522] 10:12:37.188847 <... socket resumed> ) = 16
[pid 25533] 10:12:37.188877 <... open resumed> ) = 6
[pid 25530] 10:12:37.188896 mprotect(0x7f22914fe000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.188923 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.188944 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25533] 10:12:37.188984 read(6,  <unfinished ...>
[pid 25530] 10:12:37.189007 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.189023 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25522] 10:12:37.189049 <... connect resumed> ) = 0
[pid 25533] 10:12:37.189076 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.189100 mmap(0x7f22916fd000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25529] 10:12:37.189132 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25522] 10:12:37.189151 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25533] 10:12:37.189184 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.189207 <... mmap resumed> ) = 0x7f22916fd000
[pid 25529] 10:12:37.189228 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25522] 10:12:37.189254 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25533] 10:12:37.189281 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.189312 mmap(0x7f2291724000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.189342 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25522] 10:12:37.189361 sendto(16, "\316\360\1\0\0\1\0\0\0\0\0\0\5rmrcc\3com\0\0\17\0\1", 27, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25533] 10:12:37.189438 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.189476 <... mmap resumed> ) = 0x7f2291724000
[pid 25529] 10:12:37.189503 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f21d2224790},  <unfinished ...>
[pid 25522] 10:12:37.189616 <... sendto resumed> ) = 27
[pid 25533] 10:12:37.189641 <... mmap resumed> ) = 0x7f403636f000
[pid 25530] 10:12:37.189658 close(6 <unfinished ...>
[pid 25529] 10:12:37.189681 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.189708 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25533] 10:12:37.189742 mprotect(0x7f4036371000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.189771 <... close resumed> ) = 0
[pid 25529] 10:12:37.189796 umask(0 <unfinished ...>
[pid 25533] 10:12:37.189825 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.189841 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.189872 <... umask resumed> ) = 0
[pid 25533] 10:12:37.189932 mmap(0x7f4036570000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25530] 10:12:37.189965 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.189989 geteuid( <unfinished ...>
[pid 25533] 10:12:37.190020 <... mmap resumed> ) = 0x7f4036570000
[pid 25530] 10:12:37.190045 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.190080 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.190105 close(6 <unfinished ...>
[pid 25530] 10:12:37.190129 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.190146 getuid( <unfinished ...>
[pid 25533] 10:12:37.190173 <... close resumed> ) = 0
[pid 25530] 10:12:37.190196 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.190227 <... getuid resumed> ) = 47
[pid 25533] 10:12:37.190251 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.190282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.190302 getgid( <unfinished ...>
[pid 25533] 10:12:37.190329 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.190346 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.190378 <... getgid resumed> ) = 12
[pid 25533] 10:12:37.190425 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.190461 <... open resumed> ) = 6
[pid 25529] 10:12:37.190477 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25533] 10:12:37.190569 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.190594 read(6,  <unfinished ...>
[pid 25529] 10:12:37.190619 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25533] 10:12:37.190644 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.190675 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.190699 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25533] 10:12:37.190727 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.190746 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.190769 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25533] 10:12:37.190795 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.190827 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25529] 10:12:37.190858 getgroups(65536,  <unfinished ...>
[pid 25533] 10:12:37.190886 <... open resumed> ) = 6
[pid 25530] 10:12:37.190903 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.190930 <... getgroups resumed> [12]) = 1
[pid 25533] 10:12:37.190959 read(6,  <unfinished ...>
[pid 25530] 10:12:37.190984 <... mmap resumed> ) = 0x7f2293db8000
[pid 25529] 10:12:37.191007 setgroups(0, [] <unfinished ...>
[pid 25533] 10:12:37.191038 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.191068 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.191097 <... setgroups resumed> ) = 0
[pid 25533] 10:12:37.191121 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.191146 <... mmap resumed> ) = 0x7f2291118000
[pid 25529] 10:12:37.191162 getegid( <unfinished ...>
[pid 25533] 10:12:37.191189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.191219 mprotect(0x7f2291144000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.191247 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.191269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.191295 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.191312 geteuid( <unfinished ...>
[pid 25533] 10:12:37.191341 <... mmap resumed> ) = 0x7f4038400000
[pid 25530] 10:12:37.191361 mmap(0x7f2291344000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25529] 10:12:37.191391 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.191425 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.191461 <... mmap resumed> ) = 0x7f2291344000
[pid 25529] 10:12:37.191487 geteuid( <unfinished ...>
[pid 25533] 10:12:37.191631 <... mmap resumed> ) = 0x7f4035fdb000
[pid 25530] 10:12:37.191651 close(6 <unfinished ...>
[pid 25529] 10:12:37.191676 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.191697 mprotect(0x7f4036165000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.191725 <... close resumed> ) = 0
[pid 25529] 10:12:37.191749 getegid( <unfinished ...>
[pid 25533] 10:12:37.191778 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.191794 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.191828 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.191853 mmap(0x7f4036365000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25530] 10:12:37.191884 <... open resumed> ) = 6
[pid 25529] 10:12:37.191901 setgid(12 <unfinished ...>
[pid 25533] 10:12:37.191980 <... mmap resumed> ) = 0x7f4036365000
[pid 25530] 10:12:37.192005 read(6,  <unfinished ...>
[pid 25529] 10:12:37.192030 <... setgid resumed> ) = 0
[pid 25533] 10:12:37.192054 mmap(0x7f403636a000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.192084 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.192109 setuid(0 <unfinished ...>
[pid 25533] 10:12:37.192139 <... mmap resumed> ) = 0x7f403636a000
[pid 25530] 10:12:37.192161 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.192186 <... setuid resumed> ) = 0
[pid 25533] 10:12:37.192238 close(6 <unfinished ...>
[pid 25530] 10:12:37.192265 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25529] 10:12:37.192296 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.192335 <... close resumed> ) = 0
[pid 25530] 10:12:37.192367 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.192411 <... open resumed> ) = 6
[pid 25533] 10:12:37.192454 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.192499 <... mmap resumed> ) = 0x7f2290f13000
[pid 25529] 10:12:37.192580 fstat(6,  <unfinished ...>
[pid 25533] 10:12:37.192613 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.192631 mprotect(0x7f2290f18000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.192659 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.192699 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.192735 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.192751 fstat(6,  <unfinished ...>
[pid 25533] 10:12:37.192779 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.192797 mmap(0x7f2291117000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25529] 10:12:37.192826 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.192860 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.192890 <... mmap resumed> ) = 0x7f2291117000
[pid 25529] 10:12:37.192911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.192943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.192963 close(6 <unfinished ...>
[pid 25529] 10:12:37.192986 <... mmap resumed> ) = 0x7f21d336e000
[pid 25533] 10:12:37.193008 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.193041 <... close resumed> ) = 0
[pid 25529] 10:12:37.193067 read(6,  <unfinished ...>
[pid 25533] 10:12:37.193101 <... open resumed> ) = 6
[pid 25530] 10:12:37.193118 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.193147 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25533] 10:12:37.193280 read(6,  <unfinished ...>
[pid 25530] 10:12:37.193310 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.193328 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25533] 10:12:37.193364 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.193388 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.193420 <... socket resumed> ) = 7
[pid 25533] 10:12:37.193441 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.193465 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.193482 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25533] 10:12:37.193536 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25530] 10:12:37.193568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.193599 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.193621 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.193651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.193671 close(7 <unfinished ...>
[pid 25533] 10:12:37.193705 <... mmap resumed> ) = 0x7f4035d6f000
[pid 25530] 10:12:37.193723 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.193753 <... close resumed> ) = 0
[pid 25533] 10:12:37.193774 mprotect(0x7f4035dd1000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.193803 <... open resumed> ) = 6
[pid 25529] 10:12:37.193820 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25533] 10:12:37.193851 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.193868 read(6,  <unfinished ...>
[pid 25529] 10:12:37.193893 <... socket resumed> ) = 7
[pid 25533] 10:12:37.193914 mmap(0x7f4035fd0000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25530] 10:12:37.193944 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.193968 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25533] 10:12:37.194005 <... mmap resumed> ) = 0x7f4035fd0000
[pid 25530] 10:12:37.194031 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.194057 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.194079 close(6 <unfinished ...>
[pid 25530] 10:12:37.194103 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25529] 10:12:37.194130 close(7 <unfinished ...>
[pid 25533] 10:12:37.194147 <... close resumed> ) = 0
[pid 25530] 10:12:37.194166 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.194181 <... close resumed> ) = 0
[pid 25533] 10:12:37.194201 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.194217 <... mmap resumed> ) = 0x7f2290d10000
[pid 25529] 10:12:37.194225 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.194243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.194252 mprotect(0x7f2290d12000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.194264 <... open resumed> ) = 7
[pid 25533] 10:12:37.194280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.194297 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.194305 fstat(7, Process 25535 attached
 <unfinished ...>
[pid 25533] 10:12:37.194333 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.194357 mmap(0x7f2290f11000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25529] 10:12:37.194372 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25535] 10:12:37.194405 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25533] 10:12:37.194415 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.194433 <... mmap resumed> ) = 0x7f2290f11000
[pid 25529] 10:12:37.194449 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25535] 10:12:37.194467 <... set_robust_list resumed> ) = 0
[pid 25533] 10:12:37.194472 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.194768 close(6 <unfinished ...>
[pid 25529] 10:12:37.194800 <... mmap resumed> ) = 0x7f21d336d000
[pid 25535] 10:12:37.194823 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25533] 10:12:37.194848 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.194881 <... close resumed> ) = 0
[pid 25529] 10:12:37.194908 read(7,  <unfinished ...>
[pid 25535] 10:12:37.194943 <... setrlimit resumed> ) = 0
[pid 25533] 10:12:37.194956 <... open resumed> ) = 6
[pid 25530] 10:12:37.195091 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.195125 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25535] 10:12:37.195169 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.195192 read(6,  <unfinished ...>
[pid 25530] 10:12:37.195216 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.195233 read(7,  <unfinished ...>
[pid 25533] 10:12:37.195261 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.195284 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.195315 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.195338 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.195361 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.195379 close(7 <unfinished ...>
[pid 25533] 10:12:37.195411 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25530] 10:12:37.195447 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.195477 <... close resumed> ) = 0
[pid 25535] 10:12:37.195499 <... open resumed> ) = 10
[pid 25533] 10:12:37.195580 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.195624 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.195643 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25535] 10:12:37.195678 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.195701 <... mmap resumed> ) = 0x7f403598c000
[pid 25530] 10:12:37.195717 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.195755 <... munmap resumed> ) = 0
[pid 25535] 10:12:37.195794 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.195822 mprotect(0x7f4035b45000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.195867 <... open resumed> ) = 6
[pid 25529] 10:12:37.195884 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.195920 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.195942 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.195958 read(6,  <unfinished ...>
[pid 25529] 10:12:37.195981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.196004 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.196030 mmap(0x7f4035d44000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25530] 10:12:37.196064 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.196087 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.196125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.196151 <... mmap resumed> ) = 0x7f4035d44000
[pid 25530] 10:12:37.196172 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.196196 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.196219 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25533] 10:12:37.196233 mmap(0x7f4035d6b000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.196264 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25529] 10:12:37.196293 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.196332 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.196355 <... mmap resumed> ) = 0x7f4035d6b000
[pid 25530] 10:12:37.196377 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.196405 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.196428 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.196441 close(6 <unfinished ...>
[pid 25530] 10:12:37.196468 <... mmap resumed> ) = 0x7f2293db7000
[pid 25529] 10:12:37.196487 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.196627 read(10,  <unfinished ...>
[pid 25533] 10:12:37.196656 <... close resumed> ) = 0
[pid 25530] 10:12:37.196682 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.196713 <... open resumed> ) = 7
[pid 25535] 10:12:37.196736 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25533] 10:12:37.196760 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.196840 <... mmap resumed> ) = 0x7f2290aed000
[pid 25529] 10:12:37.196858 fstat(7,  <unfinished ...>
[pid 25535] 10:12:37.196887 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25533] 10:12:37.196918 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.196935 mprotect(0x7f2290b04000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.196962 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25535] 10:12:37.196998 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.197032 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.197098 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.197115 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25535] 10:12:37.197148 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.197177 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.197195 mmap(0x7f2290d04000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25529] 10:12:37.197223 <... mmap resumed> ) = 0x7f21d334d000
[pid 25535] 10:12:37.197246 <... open resumed> ) = 13
[pid 25533] 10:12:37.197259 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.197292 <... mmap resumed> ) = 0x7f2290d04000
[pid 25529] 10:12:37.197316 close(7 <unfinished ...>
[pid 25535] 10:12:37.197349 fstat(13,  <unfinished ...>
[pid 25533] 10:12:37.197371 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.197397 close(6 <unfinished ...>
[pid 25529] 10:12:37.197423 <... close resumed> ) = 0
[pid 25535] 10:12:37.197458 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.197485 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.197613 <... close resumed> ) = 0
[pid 25529] 10:12:37.197655 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.197696 fstat(13,  <unfinished ...>
[pid 25533] 10:12:37.197718 <... open resumed> ) = 6
[pid 25530] 10:12:37.197734 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.197763 <... open resumed> ) = 7
[pid 25535] 10:12:37.197784 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25533] 10:12:37.197810 read(6,  <unfinished ...>
[pid 25530] 10:12:37.197835 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.197852 read(7,  <unfinished ...>
[pid 25535] 10:12:37.197882 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.197907 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.197936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.197970 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25535] 10:12:37.197999 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25533] 10:12:37.198014 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.198039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.198056 fstat(7,  <unfinished ...>
[pid 25535] 10:12:37.198085 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.198108 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25530] 10:12:37.198137 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.198167 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25535] 10:12:37.198204 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.198219 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.198247 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.198266 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25535] 10:12:37.198305 read(13,  <unfinished ...>
[pid 25533] 10:12:37.198331 <... mmap resumed> ) = 0x7f40383ff000
[pid 25530] 10:12:37.198353 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.198386 <... mmap resumed> ) = 0x7f21cece8000
[pid 25535] 10:12:37.198408 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25533] 10:12:37.198426 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.198492 <... open resumed> ) = 6
[pid 25529] 10:12:37.198611 mprotect(0x7f21cecf4000, 2097152, PROT_NONE <unfinished ...>
[pid 25535] 10:12:37.198661 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25533] 10:12:37.198696 <... mmap resumed> ) = 0x7f403575f000
[pid 25530] 10:12:37.198713 read(6,  <unfinished ...>
[pid 25529] 10:12:37.198737 <... mprotect resumed> ) = 0
[pid 25535] 10:12:37.198759 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25533] 10:12:37.198775 mprotect(0x7f403578b000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.198805 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.198834 mmap(0x7f21ceef4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25535] 10:12:37.198870 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25533] 10:12:37.198897 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.198913 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.198936 <... mmap resumed> ) = 0x7f21ceef4000
[pid 25535] 10:12:37.198967 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25533] 10:12:37.198985 mmap(0x7f403598b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25530] 10:12:37.199016 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25529] 10:12:37.199046 close(7 <unfinished ...>
[pid 25535] 10:12:37.199076 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0},  <unfinished ...>
[pid 25533] 10:12:37.199101 <... mmap resumed> ) = 0x7f403598b000
[pid 25530] 10:12:37.199122 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.199151 <... close resumed> ) = 0
[pid 25535] 10:12:37.199197 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f3c0ad03790}, 8) = 0
[pid 25533] 10:12:37.199217 close(6 <unfinished ...>
[pid 25530] 10:12:37.199244 <... mmap resumed> ) = 0x7f22908a9000
[pid 25529] 10:12:37.199260 mprotect(0x7f21ceef4000, 4096, PROT_READ <unfinished ...>
[pid 25535] 10:12:37.199292 close(11 <unfinished ...>
[pid 25533] 10:12:37.199314 <... close resumed> ) = 0
[pid 25530] 10:12:37.199337 mprotect(0x7f22908ea000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.199365 <... mprotect resumed> ) = 0
[pid 25535] 10:12:37.199395 <... close resumed> ) = 0
[pid 25533] 10:12:37.199413 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.199456 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.199472 munmap(0x7f21d334d000, 39387 <unfinished ...>
[pid 25535] 10:12:37.199588 fcntl(12, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.199618 <... open resumed> ) = 6
[pid 25530] 10:12:37.199635 mmap(0x7f2290aea000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25529] 10:12:37.199663 <... munmap resumed> ) = 0
[pid 25535] 10:12:37.199695 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.199710 read(6,  <unfinished ...>
[pid 25530] 10:12:37.199736 <... mmap resumed> ) = 0x7f2290aea000
[pid 25529] 10:12:37.199760 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25535] 10:12:37.199798 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.199821 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.199845 close(6 <unfinished ...>
[pid 25529] 10:12:37.199867 <... open resumed> ) = 7
[pid 25535] 10:12:37.199894 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.199908 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.199947 <... close resumed> ) = 0
[pid 25529] 10:12:37.199976 fcntl(7, F_GETFD <unfinished ...>
[pid 25535] 10:12:37.200007 geteuid( <unfinished ...>
[pid 25533] 10:12:37.200028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25530] 10:12:37.200059 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.200089 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25535] 10:12:37.200116 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.200130 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.200162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.200180 fstat(7,  <unfinished ...>
[pid 25535] 10:12:37.200209 getegid( <unfinished ...>
[pid 25533] 10:12:37.200230 <... mmap resumed> ) = 0x7f403555a000
[pid 25530] 10:12:37.200246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.200277 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25535] 10:12:37.200310 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.200324 mprotect(0x7f403555f000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.200356 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.200373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25535] 10:12:37.200414 setgid(500 <unfinished ...>
[pid 25533] 10:12:37.200442 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.200460 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.200500 <... mmap resumed> ) = 0x7f21d336d000
[pid 25535] 10:12:37.200602 <... setgid resumed> ) = 0
[pid 25533] 10:12:37.200618 mmap(0x7f403575e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25530] 10:12:37.200650 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.200669 read(7,  <unfinished ...>
[pid 25535] 10:12:37.200703 setuid(503 <unfinished ...>
[pid 25533] 10:12:37.200726 <... mmap resumed> ) = 0x7f403575e000
[pid 25530] 10:12:37.200748 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.200780 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25535] 10:12:37.200826 <... setuid resumed> ) = 0
[pid 25533] 10:12:37.200842 close(6 <unfinished ...>
[pid 25530] 10:12:37.200866 <... open resumed> ) = 6
[pid 25529] 10:12:37.200882 close(7 <unfinished ...>
[pid 25535] 10:12:37.200911 chdir("/" <unfinished ...>
[pid 25533] 10:12:37.200936 <... close resumed> ) = 0
[pid 25530] 10:12:37.200962 read(6,  <unfinished ...>
[pid 25529] 10:12:37.200986 <... close resumed> ) = 0
[pid 25535] 10:12:37.201008 <... chdir resumed> ) = 0
[pid 25533] 10:12:37.201022 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.201066 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.201095 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25535] 10:12:37.201130 geteuid( <unfinished ...>
[pid 25533] 10:12:37.201151 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.201169 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.201191 <... munmap resumed> ) = 0
[pid 25535] 10:12:37.201237 <... geteuid resumed> ) = 503
[pid 25533] 10:12:37.201253 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.201288 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25529] 10:12:37.201318 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25535] 10:12:37.201355 getegid( <unfinished ...>
[pid 25533] 10:12:37.201377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.201395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.201422 <... socket resumed> ) = 7
[pid 25535] 10:12:37.201444 <... getegid resumed> ) = 500
[pid 25533] 10:12:37.201458 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.201522 <... mmap resumed> ) = 0x7f2293db6000
[pid 25529] 10:12:37.201543 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25535] 10:12:37.201590 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25533] 10:12:37.201620 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.201639 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.201671 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.201694 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25533] 10:12:37.201721 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.201756 <... mmap resumed> ) = 0x7f22905c2000
[pid 25529] 10:12:37.201772 close(7 <unfinished ...>
[pid 25535] 10:12:37.201804 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25533] 10:12:37.201831 <... open resumed> ) = 6
[pid 25530] 10:12:37.201847 mprotect(0x7f229069d000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.201873 <... close resumed> ) = 0
[pid 25535] 10:12:37.201896 <... chdir resumed> ) = 0
[pid 25533] 10:12:37.201909 read(6,  <unfinished ...>
[pid 25530] 10:12:37.201934 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.201949 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25535] 10:12:37.201981 stat("tmp",  <unfinished ...>
[pid 25533] 10:12:37.202008 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.202030 mmap(0x7f229089d000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25529] 10:12:37.202059 <... socket resumed> ) = 7
[pid 25535] 10:12:37.202081 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25533] 10:12:37.202113 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.202138 <... mmap resumed> ) = 0x7f229089d000
[pid 25529] 10:12:37.202162 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25535] 10:12:37.202199 stat("new",  <unfinished ...>
[pid 25533] 10:12:37.202207 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25530] 10:12:37.202231 close(6 <unfinished ...>
[pid 25529] 10:12:37.202240 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.202254 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25533] 10:12:37.202269 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.202286 <... close resumed> ) = 0
[pid 25529] 10:12:37.202302 close(7 <unfinished ...>
[pid 25535] 10:12:37.202320 stat("cur",  <unfinished ...>
[pid 25533] 10:12:37.202327 <... mmap resumed> ) = 0x7f4035357000
[pid 25530] 10:12:37.202338 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.202352 <... close resumed> ) = 0
[pid 25535] 10:12:37.202372 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25533] 10:12:37.202388 mprotect(0x7f4035359000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.202475 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.202487 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25535] 10:12:37.202710 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.202746 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.202763 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.202794 <... open resumed> ) = 7
[pid 25535] 10:12:37.202817 <... open resumed> ) = 11
[pid 25533] 10:12:37.202831 mmap(0x7f4035558000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25530] 10:12:37.202865 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.202883 fstat(7,  <unfinished ...>
[pid 25535] 10:12:37.202912 read(11,  <unfinished ...>
[pid 25533] 10:12:37.202935 <... mmap resumed> ) = 0x7f4035558000
[pid 25530] 10:12:37.202961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.202992 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25535] 10:12:37.203027 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4130
[pid 25533] 10:12:37.203045 close(6 <unfinished ...>
[pid 25530] 10:12:37.203142 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.203162 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25535] 10:12:37.203201 stat("tmp/1451491957.H203121P25535.fin.finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.203233 <... close resumed> ) = 0
[pid 25530] 10:12:37.203261 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.203294 <... mmap resumed> ) = 0x7f21d336d000
[pid 25535] 10:12:37.203317 <... stat resumed> 0x7ffced97d9c0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.203332 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.203365 <... open resumed> ) = 6
[pid 25529] 10:12:37.203381 read(7,  <unfinished ...>
[pid 25535] 10:12:37.203414 open("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25533] 10:12:37.203470 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.203490 read(6,  <unfinished ...>
[pid 25529] 10:12:37.203518 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25535] 10:12:37.203558 <... open resumed> ) = 14
[pid 25533] 10:12:37.203573 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.203614 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.203636 close(7 <unfinished ...>
[pid 25535] 10:12:37.203667 chown("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25533] 10:12:37.203700 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.203718 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.203740 <... close resumed> ) = 0
[pid 25535] 10:12:37.203762 <... chown resumed> ) = 0
[pid 25533] 10:12:37.203776 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.203812 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25529] 10:12:37.203842 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25535] 10:12:37.203877 chmod("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25533] 10:12:37.203905 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.203924 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.203956 <... munmap resumed> ) = 0
[pid 25535] 10:12:37.203996 <... chmod resumed> ) = 0
[pid 25533] 10:12:37.204012 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.204047 <... mmap resumed> ) = 0x7f22903be000
[pid 25529] 10:12:37.204063 read(6,  <unfinished ...>
[pid 25535] 10:12:37.204095 chown("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25533] 10:12:37.204122 <... open resumed> ) = 6
[pid 25530] 10:12:37.204138 mprotect(0x7f22903c1000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.204166 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25535] 10:12:37.204234 <... chown resumed> ) = 0
[pid 25533] 10:12:37.204252 read(6,  <unfinished ...>
[pid 25530] 10:12:37.204277 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.204292 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25535] 10:12:37.204327 chmod("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25533] 10:12:37.204354 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.204373 mmap(0x7f22905c0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25529] 10:12:37.204388 <... open resumed> ) = 7
[pid 25535] 10:12:37.204405 <... chmod resumed> ) = 0
[pid 25533] 10:12:37.204411 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.204451 <... mmap resumed> ) = 0x7f22905c0000
[pid 25529] 10:12:37.204468 fstat(7,  <unfinished ...>
[pid 25535] 10:12:37.204483 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.204490 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25530] 10:12:37.204683 close(6 <unfinished ...>
[pid 25529] 10:12:37.204712 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25535] 10:12:37.204748 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.204774 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.204837 <... close resumed> ) = 0
[pid 25529] 10:12:37.204862 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25535] 10:12:37.204896 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.204918 <... mmap resumed> ) = 0x7f40383fe000
[pid 25530] 10:12:37.204938 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.204970 <... mmap resumed> ) = 0x7f21d336d000
[pid 25535] 10:12:37.204993 <... lseek resumed> ) = 19
[pid 25533] 10:12:37.205007 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.205038 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.205056 read(7,  <unfinished ...>
[pid 25535] 10:12:37.205089 read(6,  <unfinished ...>
[pid 25533] 10:12:37.205117 <... mmap resumed> ) = 0x7f4035134000
[pid 25530] 10:12:37.205135 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.205167 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25535] 10:12:37.205196 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25533] 10:12:37.205219 mprotect(0x7f403514b000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.205258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.205275 close(7 <unfinished ...>
[pid 25535] 10:12:37.205306 read(6,  <unfinished ...>
[pid 25533] 10:12:37.205328 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.205345 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.205375 <... close resumed> ) = 0
[pid 25535] 10:12:37.205398 <... read resumed> "", 8192) = 0
[pid 25533] 10:12:37.205412 mmap(0x7f403534b000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25530] 10:12:37.205445 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.205464 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25535] 10:12:37.205498 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2517 <unfinished ...>
[pid 25533] 10:12:37.205537 <... mmap resumed> ) = 0x7f403534b000
[pid 25530] 10:12:37.205565 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.205599 <... munmap resumed> ) = 0
[pid 25535] 10:12:37.205629 <... write resumed> ) = 2517
[pid 25533] 10:12:37.205644 close(6 <unfinished ...>
[pid 25530] 10:12:37.205669 <... open resumed> ) = 6
[pid 25529] 10:12:37.205685 read(6,  <unfinished ...>
[pid 25535] 10:12:37.205716 fsync(14 <unfinished ...>
[pid 25533] 10:12:37.205784 <... close resumed> ) = 0
[pid 25530] 10:12:37.205827 read(6,  <unfinished ...>
[pid 25529] 10:12:37.206054 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25533] 10:12:37.206108 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.206148 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.206172 uname( <unfinished ...>
[pid 25535] 10:12:37.206201 <... fsync resumed> ) = 0
[pid 25533] 10:12:37.206214 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.206236 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.206259 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25535] 10:12:37.206313 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25533] 10:12:37.206341 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.206375 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25529] 10:12:37.206412 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25535] 10:12:37.206447 <... lseek resumed> ) = 4130
[pid 25533] 10:12:37.206461 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.206480 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.206572 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f21d2224790}, 8) = 0
[pid 25535] 10:12:37.206612 write(11, "2517 1\n", 7 <unfinished ...>
[pid 25533] 10:12:37.206656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.206689 <... mmap resumed> ) = 0x7f2290192000
[pid 25529] 10:12:37.206705 clone( <unfinished ...>
[pid 25535] 10:12:37.206946 <... write resumed> ) = 7
[pid 25533] 10:12:37.206961 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.206983 mprotect(0x7f22901bb000, 2097152, PROT_NONE <unfinished ...>
[pid 25535] 10:12:37.207019 close(11 <unfinished ...>
[pid 25533] 10:12:37.207043 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.207074 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.207090 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25536
[pid 25535] 10:12:37.207139 <... close resumed> ) = 0
[pid 25533] 10:12:37.207155 <... open resumed> ) = 6
[pid 25530] 10:12:37.207178 mmap(0x7f22903bb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25529] 10:12:37.207211 wait4(25536,  <unfinished ...>
[pid 25535] 10:12:37.207238 fstat(14,  <unfinished ...>
[pid 25533] 10:12:37.207260 read(6,  <unfinished ...>
[pid 25530] 10:12:37.207283 <... mmap resumed> ) = 0x7f22903bb000
[pid 25535] 10:12:37.207309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179982, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2517, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.207337 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.207362 mmap(0x7f22903bd000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25535] 10:12:37.207395 close(14 <unfinished ...>
[pid 25533] 10:12:37.207419 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.207442 <... mmap resumed> ) = 0x7f22903bd000
[pid 25535] 10:12:37.207468 <... close resumed> ) = 0
[pid 25533] 10:12:37.207483 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.207530 close(6 <unfinished ...>
[pid 25535] 10:12:37.207561 rename("tmp/1451491957.H203121P25535.fin.finestweddingsites.com", "new/1451491957.H203121P25535.fin.finestweddingsites.com,S=2517" <unfinished ...>
[pid 25533] 10:12:37.207611 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.207643 <... close resumed> ) = 0
[pid 25535] 10:12:37.207674 <... rename resumed> ) = 0
[pid 25533] 10:12:37.207691 <... mmap resumed> ) = 0x7f4034ef0000
[pid 25530] 10:12:37.207712 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.207747 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.207783 mprotect(0x7f4034f31000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.207812 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.207836 <... write resumed> ) = 4
[pid 25533] 10:12:37.207849 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.207867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.207899 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.207927 write(12, "\325\t\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.207953 mmap(0x7f4035131000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25530] 10:12:37.207983 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.208000 read(11,  <unfinished ...>
[pid 25535] 10:12:37.208032 <... write resumed> ) = 4
[pid 25533] 10:12:37.208046 <... mmap resumed> ) = 0x7f4035131000
[pid 25530] 10:12:37.208073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.208105 <... read resumed> "\325\t\0\0", 4) = 4
[pid 25535] 10:12:37.208129 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.208153 close(6 <unfinished ...>
[pid 25530] 10:12:37.208175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.208193 read(11,  <unfinished ...>
[pid 25535] 10:12:37.208222 <... write resumed> ) = 4
[pid 25533] 10:12:37.208235 <... close resumed> ) = 0
[pid 25530] 10:12:37.208261 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.208293 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25535] 10:12:37.208317 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.208342 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.208371 <... open resumed> ) = 6
[pid 25502] 10:12:37.208387 read(11,  <unfinished ...>
[pid 25535] 10:12:37.208422 <... write resumed> ) = 4
[pid 25533] 10:12:37.208436 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.208461 read(6,  <unfinished ...>
[pid 25502] 10:12:37.208485 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.208648 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.208681 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.208713 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:37.208736 read(11,  <unfinished ...>
[pid 25535] 10:12:37.208767 <... write resumed> ) = 4
[pid 25533] 10:12:37.208780 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.208799 fstat(6,  <unfinished ...>
[pid 25502] 10:12:37.208822 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.208845 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.208868 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.208897 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25502] 10:12:37.208927 read(11,  <unfinished ...>
[pid 25535] 10:12:37.208956 <... write resumed> ) = 4
[pid 25533] 10:12:37.208969 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.208988 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.209022 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.209046 write(12, "\260\343\t\1\0\0\0\0", 8 <unfinished ...>
[pid 25533] 10:12:37.209070 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.209100 <... mmap resumed> ) = 0x7f2293db5000
[pid 25502] 10:12:37.209120 read(11,  <unfinished ...>
[pid 25535] 10:12:37.209153 <... write resumed> ) = 8
[pid 25533] 10:12:37.209166 <... open resumed> ) = 6
[pid 25530] 10:12:37.209184 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:37.209214 <... read resumed> "\260\343\t\1\0\0\0\0", 8) = 8
[pid 25535] 10:12:37.209239 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.209263 read(6,  <unfinished ...>
[pid 25530] 10:12:37.209286 <... mmap resumed> ) = 0x7f228ff7c000
[pid 25502] 10:12:37.209302 read(11,  <unfinished ...>
[pid 25535] 10:12:37.209331 <... write resumed> ) = 4
[pid 25533] 10:12:37.209344 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.209368 mprotect(0x7f228ff91000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:37.209395 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.209420 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25533] 10:12:37.209445 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.209468 <... mprotect resumed> ) = 0
[pid 25502] 10:12:37.209483 read(11,  <unfinished ...>
[pid 25535] 10:12:37.209590 <... write resumed> ) = 4
[pid 25533] 10:12:37.209610 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.209644 mmap(0x7f2290190000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25502] 10:12:37.209674 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25535] 10:12:37.209699 close(12 <unfinished ...>
[pid 25533] 10:12:37.209722 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.209748 <... mmap resumed> ) = 0x7f2290190000
[pid 25502] 10:12:37.209773 close(11 <unfinished ...>
[pid 25535] 10:12:37.209810 <... close resumed> ) = 0
[pid 25533] 10:12:37.209823 <... mmap resumed> ) = 0x7f40383fd000
[pid 25530] 10:12:37.209846 close(6 <unfinished ...>
[pid 25502] 10:12:37.209871 <... close resumed> ) = 0
[pid 25535] 10:12:37.209901 close(10 <unfinished ...>
[pid 25533] 10:12:37.209927 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.209955 <... close resumed> ) = 0
[pid 25502] 10:12:37.209989 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25535] 10:12:37.210030 <... close resumed> ) = 0
[pid 25533] 10:12:37.210044 <... mmap resumed> ) = 0x7f4034c09000
[pid 25530] 10:12:37.210062 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.210092 <... write resumed> ) = 28
[pid 25535] 10:12:37.210114 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25533] 10:12:37.210141 mprotect(0x7f4034ce4000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.210169 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.210186 fsync(9 <unfinished ...>
[pid 25535] 10:12:37.210231 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.210245 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.210281 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.210330 close(13 <unfinished ...>
[pid 25533] 10:12:37.210354 mmap(0x7f4034ee4000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25530] 10:12:37.210385 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25535] 10:12:37.210408 <... close resumed> ) = 0
[pid 25533] 10:12:37.210421 <... mmap resumed> ) = 0x7f4034ee4000
[pid 25530] 10:12:37.210456 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25535] 10:12:37.210502 munmap(0x7f3c0be4b000, 4096 <unfinished ...>
[pid 25533] 10:12:37.210605 close(6 <unfinished ...>
[pid 25530] 10:12:37.210631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.210650 <... fsync resumed> ) = 0
[pid 25535] 10:12:37.210673 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.210687 <... close resumed> ) = 0
[pid 25530] 10:12:37.211073 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.211111 wait4(-1,  <unfinished ...>
[pid 25535] 10:12:37.211139 exit_group(0) = ?
[pid 25533] 10:12:37.211153 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.211449 <... open resumed> ) = 6
[pid 25535] 10:12:37.211482 +++ exited with 0 +++
[pid 25533] 10:12:37.211495 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.211563 read(6,  <unfinished ...>
[pid 25502] 10:12:37.211594 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25535
[pid 25533] 10:12:37.211655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.211699 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:37.211724 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.211758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.211775 fstat(6,  <unfinished ...>
[pid 25502] 10:12:37.211798 <... open resumed> ) = 10
[pid 25533] 10:12:37.211821 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.211851 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25502] 10:12:37.211883 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.211911 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.211929 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:37.211960 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.211998 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.212031 <... mmap resumed> ) = 0x7f228fd71000
[pid 25502] 10:12:37.212048 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.212076 <... open resumed> ) = 6
[pid 25530] 10:12:37.212091 mprotect(0x7f228fd7b000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:37.212118 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.212157 read(6,  <unfinished ...>
[pid 25530] 10:12:37.212181 <... mprotect resumed> ) = 0
[pid 25502] 10:12:37.212197 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.212229 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.212252 mmap(0x7f228ff7a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25502] 10:12:37.212281 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25533] 10:12:37.212303 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.212326 <... mmap resumed> ) = 0x7f228ff7a000
[pid 25502] 10:12:37.212351 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.212381 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.212411 close(6 <unfinished ...>
[pid 25502] 10:12:37.212433 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.212455 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.212485 <... close resumed> ) = 0
[pid 25502] 10:12:37.212521 read(10,  <unfinished ...>
[pid 25533] 10:12:37.212555 <... mmap resumed> ) = 0x7f4034a05000
[pid 25530] 10:12:37.212572 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.212601 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25533] 10:12:37.212650 mprotect(0x7f4034a08000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.212682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.212700 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25533] 10:12:37.212737 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.212753 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.212784 <... stat resumed> 0x7ffced97c710) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.212815 mmap(0x7f4034c07000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25530] 10:12:37.212847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.212861 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.212879 <... mmap resumed> ) = 0x7f4034c07000
[pid 25530] 10:12:37.212895 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.212911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.212946 close(6 <unfinished ...>
[pid 25530] 10:12:37.212956 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.212966 write(8, "2015-12-30 10:12:37 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25533] 10:12:37.212989 <... close resumed> ) = 0
[pid 25530] 10:12:37.213005 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.213023 <... write resumed> ) = 126
[pid 25533] 10:12:37.213044 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.213060 <... open resumed> ) = 6
[pid 25502] 10:12:37.213068 write(8, "2015-12-30 10:12:37 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25533] 10:12:37.213087 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.213096 read(6,  <unfinished ...>
[pid 25502] 10:12:37.213105 <... write resumed> ) = 77
[pid 25533] 10:12:37.213128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.213145 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:37.213157 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.213174 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.213182 fstat(6,  <unfinished ...>
[pid 25502] 10:12:37.213191 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.213223 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.213238 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25502] 10:12:37.213258 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.213273 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.213284 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25502] 10:12:37.213300 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.213327 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.213343 <... mmap resumed> ) = 0x7f228fb6e000
[pid 25502] 10:12:37.213351 close(7 <unfinished ...>
[pid 25533] 10:12:37.213367 <... open resumed> ) = 6
[pid 25530] 10:12:37.213375 mprotect(0x7f228fb70000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:37.213388 <... close resumed> ) = 0
[pid 25533] 10:12:37.213404 read(6,  <unfinished ...>
[pid 25530] 10:12:37.213414 <... mprotect resumed> ) = 0
[pid 25502] 10:12:37.213427 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.213457 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.213471 mmap(0x7f228fd6f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25502] 10:12:37.213485 <... open resumed> ) = 7
[pid 25533] 10:12:37.213499 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.213561 <... mmap resumed> ) = 0x7f228fd6f000
[pid 25502] 10:12:37.213592 fcntl(7, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.213612 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.213638 close(6 <unfinished ...>
[pid 25502] 10:12:37.213648 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.213661 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.213679 <... close resumed> ) = 0
[pid 25502] 10:12:37.213696 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.213711 <... mmap resumed> ) = 0x7f40347d9000
[pid 25530] 10:12:37.213719 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.213731 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.213745 mprotect(0x7f4034802000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.213758 <... mmap resumed> ) = 0x7f2293db4000
[pid 25502] 10:12:37.213789 fstat(7,  <unfinished ...>
[pid 25533] 10:12:37.213804 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.213812 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.213829 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5382618, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.213854 mmap(0x7f4034a02000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25530] 10:12:37.213870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.213880 write(7, "2015-12-30 10:12:37 [25502] 1aEJMa-0006dB-67 => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2517 QT=1s "..., 262 <unfinished ...>
[pid 25533] 10:12:37.213907 <... mmap resumed> ) = 0x7f4034a02000
[pid 25530] 10:12:37.213921 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.213939 <... write resumed> ) = 262
[pid 25533] 10:12:37.213987 mmap(0x7f4034a04000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.214003 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.214012 pipe( <unfinished ...>
[pid 25533] 10:12:37.214030 <... mmap resumed> ) = 0x7f4034a04000
[pid 25530] 10:12:37.214043 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.214059 <... pipe resumed> [11, 12]) = 0
[pid 25533] 10:12:37.214073 close(6 <unfinished ...>
[pid 25530] 10:12:37.214082 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25502] 10:12:37.214092 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25533] 10:12:37.214107 <... close resumed> ) = 0
[pid 25530] 10:12:37.214125 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25502] 10:12:37.214141 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.214156 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.214171 <... open resumed> ) = 6
[pid 25502] 10:12:37.214178 close(10 <unfinished ...>
[pid 25533] 10:12:37.214194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.214202 read(6,  <unfinished ...>
[pid 25502] 10:12:37.214212 <... close resumed> ) = 0
[pid 25533] 10:12:37.214225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.214241 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25502] 10:12:37.214254 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25533] 10:12:37.214271 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.214280 fstat(6,  <unfinished ...>
[pid 25502] 10:12:37.214290 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.214308 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.214324 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25502] 10:12:37.214345 clone( <unfinished ...>
[pid 25533] 10:12:37.214563 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.214577 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25533] 10:12:37.214602 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.214620 <... mmap resumed> ) = 0x7f228f94f000
[pid 25502] 10:12:37.214628 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25537
[pid 25533] 10:12:37.214664 <... open resumed> ) = 6
[pid 25530] 10:12:37.214675 mprotect(0x7f228f96c000, 2093056, PROT_NONE <unfinished ...>
[pid 25502] 10:12:37.214689 close(12 <unfinished ...>
[pid 25533] 10:12:37.214703 read(6,  <unfinished ...>
[pid 25530] 10:12:37.214713 <... mprotect resumed> ) = 0
[pid 25502] 10:12:37.214721 <... close resumed> ) = 0
[pid 25533] 10:12:37.214754 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.214768 mmap(0x7f228fb6b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25502] 10:12:37.214788 wait4(-1,  <unfinished ...>
[pid 25533] 10:12:37.214803 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.214813 <... mmap resumed> ) = 0x7f228fb6b000
[pid 25502] 10:12:37.214824 <... wait4 resumed> 0x7ffced97dcc0, WNOHANG, NULL) = 0
[pid 25533] 10:12:37.214850 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25530] 10:12:37.214888 mmap(0x7f228fb6d000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25502] 10:12:37.214902 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25533] 10:12:37.214921 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.214933 <... mmap resumed> ) = 0x7f228fb6d000
[pid 25533] 10:12:37.214950 <... mmap resumed> ) = 0x7f40383fc000
[pid 25530] 10:12:37.214961 close(6 <unfinished ...>
[pid 25533] 10:12:37.214973 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.214987 <... close resumed> ) = 0
[pid 25533] 10:12:37.215033 <... mmap resumed> ) = 0x7f40345c3000
[pid 25530] 10:12:37.215042 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.215056 mprotect(0x7f40345d8000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.215069 <... mmap resumed> ) = 0x7f2293db3000
[pid 25533] 10:12:37.215115 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.215124 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.215138 mmap(0x7f40347d7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25530] 10:12:37.215151 <... mmap resumed> ) = 0x7f2293db2000
[pid 25533] 10:12:37.215170 <... mmap resumed> ) = 0x7f40347d7000
[pid 25530] 10:12:37.215186 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.215200 close(6 <unfinished ...>
[pid 25530] 10:12:37.215209 <... mmap resumed> ) = 0x7f2293db0000
[pid 25533] 10:12:37.215224 <... close resumed> ) = 0
[pid 25530] 10:12:37.215251 arch_prctl(ARCH_SET_FS, 0x7f2293db07c0 <unfinished ...>
[pid 25533] 10:12:37.215267 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.215283 <... arch_prctl resumed> ) = 0
[pid 25533] 10:12:37.215332 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.215342 mprotect(0x7f228fb6b000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215358 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.215374 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215389 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.215399 mprotect(0x7f228fd6f000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215413 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.215428 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215454 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.215465 mprotect(0x7f228ff7a000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215481 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.215496 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215516 <... open resumed> ) = 6
[pid 25530] 10:12:37.215525 mprotect(0x7f2290190000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215540 read(6,  <unfinished ...>
[pid 25530] 10:12:37.215550 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215572 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.215586 mprotect(0x7f22903bb000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215601 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.215610 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215630 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25530] 10:12:37.215652 mprotect(0x7f22905c0000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215666 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.215681 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215801 <... mmap resumed> ) = 0x7f40343b8000
[pid 25530] 10:12:37.215810 mprotect(0x7f229089d000, 40960, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215825 mprotect(0x7f40343c2000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.215838 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215928 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.215937 mprotect(0x7f2290aea000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.215951 mmap(0x7f40345c1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25530] 10:12:37.215965 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.215988 <... mmap resumed> ) = 0x7f40345c1000
[pid 25530] 10:12:37.216150 mprotect(0x7f2290d04000, 4096, PROT_READProcess 25536 attached
 <unfinished ...>
[pid 25533] 10:12:37.216194 close(6 <unfinished ...>
[pid 25530] 10:12:37.216221 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.216242 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25533] 10:12:37.216249 <... close resumed> ) = 0
[pid 25530] 10:12:37.216270 mprotect(0x7f2290f11000, 4096, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.216290 <... set_robust_list resumed> ) = 0
[pid 25533] 10:12:37.216295 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.216335 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.216540 geteuid( <unfinished ...>
[pid 25533] 10:12:37.216547 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.216559 mprotect(0x7f22916fd000, 110592, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.216577 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.216582 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.216607 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.216707 geteuid( <unfinished ...>
[pid 25533] 10:12:37.216715 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.216727 mprotect(0x7f2291989000, 16384, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.216750 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.216756 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.216774 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.216870 getegid( <unfinished ...>
[pid 25533] 10:12:37.216878 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.216890 mprotect(0x7f2291d1e000, 16384, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.216907 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.216913 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.216934 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.216952 setgid(12 <unfinished ...>
[pid 25533] 10:12:37.216958 <... open resumed> ) = 6
[pid 25530] 10:12:37.216968 mprotect(0x7f2291f29000, 4096, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.216988 <... setgid resumed> ) = 0
[pid 25533] 10:12:37.216994 read(6,  <unfinished ...>
[pid 25530] 10:12:37.217005 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.217026 setuid(47 <unfinished ...>
[pid 25533] 10:12:37.217032 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.217050 mprotect(0x7f229212d000, 4096, PROT_READ <unfinished ...>
[pid 25536] 10:12:37.217067 <... setuid resumed> ) = 0
[pid 25533] 10:12:37.217072 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.219192 <... mprotect resumed> ) = 0
[pid 25536] 10:12:37.219877 brk(0x220c000 <unfinished ...>
[pid 25533] 10:12:37.219910 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25530] 10:12:37.219946 mprotect(0x7f2292e85000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.219979 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.220012 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.220053 <... mmap resumed> ) = 0x7f40341b5000
[pid 25530] 10:12:37.220072 mprotect(0x7f22932ba000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.220102 mprotect(0x7f40341b7000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.220129 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.220154 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.220170 mprotect(0x7f229353e000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.220200 mmap(0x7f40343b6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25530] 10:12:37.220231 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.220255 <... mmap resumed> ) = 0x7f40343b6000
[pid 25530] 10:12:37.220281 mprotect(0x7f2293747000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.220316 close(6 <unfinished ...>
[pid 25530] 10:12:37.220342 <... mprotect resumed> ) = 0
[pid 25533] 10:12:37.220376 <... close resumed> ) = 0
[pid 25530] 10:12:37.220400 mprotect(0x7f229398c000, 4096, PROT_READ <unfinished ...>
[pid 25533] 10:12:37.220435 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.220514 <... mprotect resumed> ) = 0
Process 25537 attached
[pid 25533] 10:12:37.220568 <... mmap resumed> ) = 0x7f40383fb000
[pid 25530] 10:12:37.220617 mprotect(0x7f2293ba6000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.220655 set_robust_list(0x7f3c0be36aa0, 24 <unfinished ...>
[pid 25533] 10:12:37.220678 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.220711 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.220819 <... set_robust_list resumed> ) = 0
[pid 25533] 10:12:37.220840 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.220885 mprotect(0x7f2293dc9000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.220921 fcntl(12, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.220944 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.220979 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.221001 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.221015 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.221034 munmap(0x7f2293dbe000, 39387 <unfinished ...>
[pid 25537] 10:12:37.221069 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.221092 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.221122 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.221143 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.221157 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.221179 set_tid_address(0x7f2293db0a90 <unfinished ...>
[pid 25537] 10:12:37.221208 close(6 <unfinished ...>
[pid 25533] 10:12:37.221231 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.221259 <... set_tid_address resumed> ) = 25530
[pid 25537] 10:12:37.221280 <... close resumed> ) = 0
[pid 25533] 10:12:37.221294 <... open resumed> ) = 6
[pid 25530] 10:12:37.221337 set_robust_list(0x7f2293db0aa0, 24 <unfinished ...>
[pid 25537] 10:12:37.221368 open("/var/spool/exim/input/a/1aEJMa-0006dB-67-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.221407 read(6,  <unfinished ...>
[pid 25530] 10:12:37.221431 <... set_robust_list resumed> ) = 0
[pid 25537] 10:12:37.221452 <... open resumed> ) = 6
[pid 25533] 10:12:37.221465 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.221495 futex(0x7ffd127afc2c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25537] 10:12:37.221532 fcntl(6, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.221554 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.221577 <... futex resumed> ) = 0
[pid 25537] 10:12:37.221597 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.221611 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25530] 10:12:37.221644 futex(0x7ffd127afc2c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f2293db07c0 <unfinished ...>
[pid 25537] 10:12:37.221675 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.221700 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25530] 10:12:37.221732 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25537] 10:12:37.221759 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.221774 <... mmap resumed> ) = 0x7f4033f96000
[pid 25530] 10:12:37.221825 rt_sigaction(SIGRTMIN, {0x7f2292c73c60, [], SA_RESTORER|SA_SIGINFO, 0x7f2292c7d790},  <unfinished ...>
[pid 25537] 10:12:37.221861 geteuid( <unfinished ...>
[pid 25533] 10:12:37.221883 mprotect(0x7f4033fb3000, 2093056, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.221911 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.221932 <... geteuid resumed> ) = 0
[pid 25533] 10:12:37.221946 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.221963 rt_sigaction(SIGRT_1, {0x7f2292c73cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f2292c7d790},  <unfinished ...>
[pid 25537] 10:12:37.221996 getegid( <unfinished ...>
[pid 25533] 10:12:37.222017 mmap(0x7f40341b2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25530] 10:12:37.222049 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.222070 <... getegid resumed> ) = 12
[pid 25533] 10:12:37.222083 <... mmap resumed> ) = 0x7f40341b2000
[pid 25530] 10:12:37.222107 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25537] 10:12:37.222139 setgid(12 <unfinished ...>
[pid 25533] 10:12:37.222161 mmap(0x7f40341b4000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.222189 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25537] 10:12:37.222218 <... setgid resumed> ) = 0
[pid 25533] 10:12:37.222233 <... mmap resumed> ) = 0x7f40341b4000
[pid 25530] 10:12:37.222256 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25537] 10:12:37.222286 setuid(47 <unfinished ...>
[pid 25533] 10:12:37.222308 close(6 <unfinished ...>
[pid 25530] 10:12:37.222331 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25537] 10:12:37.222388 <... setuid resumed> ) = 0
[pid 25533] 10:12:37.222404 <... close resumed> ) = 0
[pid 25530] 10:12:37.222456 statfs("/selinux",  <unfinished ...>
[pid 25537] 10:12:37.222499 close(11 <unfinished ...>
[pid 25533] 10:12:37.222664 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.222702 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350326, f_bavail=6350326, f_files=1000000, f_ffree=691081, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25537] 10:12:37.222780 <... close resumed> ) = 0
[pid 25533] 10:12:37.222798 <... mmap resumed> ) = 0x7f40383fa000
[pid 25530] 10:12:37.223008 brk(0 <unfinished ...>
[pid 25537] 10:12:37.223040 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25533] 10:12:37.223069 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.223096 <... brk resumed> ) = 0x1f44000
[pid 25537] 10:12:37.223118 <... socket resumed> ) = 10
[pid 25533] 10:12:37.223131 <... mmap resumed> ) = 0x7f40383f9000
[pid 25530] 10:12:37.223157 brk(0x1f65000 <unfinished ...>
[pid 25537] 10:12:37.223187 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25533] 10:12:37.223223 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.223250 <... brk resumed> ) = 0x1f65000
[pid 25537] 10:12:37.223282 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.223299 <... mmap resumed> ) = 0x7f40383f7000
[pid 25530] 10:12:37.223321 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.223365 close(10 <unfinished ...>
[pid 25533] 10:12:37.223391 arch_prctl(ARCH_SET_FS, 0x7f40383f77c0 <unfinished ...>
[pid 25530] 10:12:37.223416 <... open resumed> ) = 6
[pid 25537] 10:12:37.223447 <... close resumed> ) = 0
[pid 25533] 10:12:37.223462 <... arch_prctl resumed> ) = 0
[pid 25530] 10:12:37.223521 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.223551 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25533] 10:12:37.223577 mprotect(0x7f40341b2000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.223604 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25537] 10:12:37.223640 <... socket resumed> ) = 10
[pid 25533] 10:12:37.223654 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.223676 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.223709 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25533] 10:12:37.223740 mprotect(0x7f40343b6000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.223766 <... mmap resumed> ) = 0x7f2293dc7000
[pid 25537] 10:12:37.223788 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.223803 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.223834 read(6,  <unfinished ...>
[pid 25537] 10:12:37.223931 close(10 <unfinished ...>
[pid 25533] 10:12:37.223956 mprotect(0x7f40345c1000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.223983 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25537] 10:12:37.224016 <... close resumed> ) = 0
[pid 25533] 10:12:37.224031 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.224094 read(6,  <unfinished ...>
[pid 25537] 10:12:37.224125 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.224155 mprotect(0x7f40347d7000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.224181 <... read resumed> "", 1024) = 0
[pid 25537] 10:12:37.224209 <... open resumed> ) = 10
[pid 25533] 10:12:37.224224 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.224260 close(6 <unfinished ...>
[pid 25537] 10:12:37.224294 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.224316 mprotect(0x7f4034a02000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.224349 <... close resumed> ) = 0
[pid 25537] 10:12:37.224370 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.224397 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.224425 munmap(0x7f2293dc7000, 4096 <unfinished ...>
[pid 25537] 10:12:37.224460 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.224486 mprotect(0x7f4034c07000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.224638 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.224724 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25533] 10:12:37.224747 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.224867 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25537] 10:12:37.224910 read(10,  <unfinished ...>
[pid 25533] 10:12:37.224938 mprotect(0x7f4034ee4000, 40960, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.224965 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.225054 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25533] 10:12:37.225077 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.225198 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2292c7d790},  <unfinished ...>
[pid 25537] 10:12:37.225234 close(10 <unfinished ...>
[pid 25533] 10:12:37.225258 mprotect(0x7f4035131000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.225284 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.225314 <... close resumed> ) = 0
[pid 25533] 10:12:37.225329 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.225359 fstat(2,  <unfinished ...>
[pid 25537] 10:12:37.225389 munmap(0x7f3c0be4c000, 4096 <unfinished ...>
[pid 25533] 10:12:37.225415 mprotect(0x7f403534b000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.225442 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25537] 10:12:37.225503 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.225586 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.225662 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f2292c7d790},  <unfinished ...>
[pid 25537] 10:12:37.225709 stat("/etc/mailips",  <unfinished ...>
[pid 25533] 10:12:37.225741 mprotect(0x7f4035558000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.225768 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.225793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.225821 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.226105 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f22919c66a0},  <unfinished ...>
[pid 25537] 10:12:37.226149 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25536] 10:12:37.226177 <... brk resumed> ) = 0x220c000
[pid 25533] 10:12:37.226192 mprotect(0x7f4035d44000, 110592, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.226604 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25537] 10:12:37.226635 <... open resumed> ) = 10
[pid 25536] 10:12:37.226650 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25533] 10:12:37.226679 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.226760 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f22919c66a0},  <unfinished ...>
[pid 25537] 10:12:37.226803 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.226827 mprotect(0x7f4035fd0000, 16384, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.226854 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25537] 10:12:37.226878 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.226906 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.227010 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790},  <unfinished ...>
[pid 25537] 10:12:37.227046 fstat(10,  <unfinished ...>
[pid 25533] 10:12:37.227069 mprotect(0x7f4036365000, 16384, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.227095 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.227126 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25533] 10:12:37.227155 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.227177 umask(0 <unfinished ...>
[pid 25537] 10:12:37.227205 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.227231 mprotect(0x7f4036570000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.227258 <... umask resumed> ) = 022
[pid 25537] 10:12:37.227315 <... mmap resumed> ) = 0x7f3c0be4c000
[pid 25533] 10:12:37.227334 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.227362 geteuid( <unfinished ...>
[pid 25537] 10:12:37.227390 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.227413 mprotect(0x7f4036774000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.227439 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.227461 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.227475 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.228153 getuid( <unfinished ...>
[pid 25537] 10:12:37.228192 read(10,  <unfinished ...>
[pid 25533] 10:12:37.228216 mprotect(0x7f40374cc000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.228243 <... getuid resumed> ) = 503
[pid 25537] 10:12:37.228267 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.228282 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.228334 getgid( <unfinished ...>
[pid 25537] 10:12:37.228366 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.228388 mprotect(0x7f4037901000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.228415 <... getgid resumed> ) = 499
[pid 25537] 10:12:37.228451 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.228466 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.228490 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25537] 10:12:37.228523 read(10,  <unfinished ...>
[pid 25533] 10:12:37.228546 mprotect(0x7f4037b85000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.228585 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25537] 10:12:37.228611 <... read resumed> "", 4096) = 0
[pid 25536] 10:12:37.228625 <... open resumed> ) = 7
[pid 25533] 10:12:37.228808 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.228844 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25537] 10:12:37.228875 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25536] 10:12:37.228904 fstat(7,  <unfinished ...>
[pid 25533] 10:12:37.228927 mprotect(0x7f4037d8e000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.228954 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25537] 10:12:37.228980 <... open resumed> ) = 11
[pid 25536] 10:12:37.228995 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25533] 10:12:37.229026 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.229064 getgroups(65536,  <unfinished ...>
[pid 25537] 10:12:37.229101 fstat(11,  <unfinished ...>
[pid 25536] 10:12:37.229123 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25533] 10:12:37.229149 mprotect(0x7f4037fd3000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.229176 <... getgroups resumed> [500]) = 1
[pid 25537] 10:12:37.229205 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25536] 10:12:37.229232 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25533] 10:12:37.229249 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.229279 setgroups(0, [] <unfinished ...>
[pid 25537] 10:12:37.229311 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25536] 10:12:37.229337 read(7,  <unfinished ...>
[pid 25533] 10:12:37.229364 mprotect(0x7f40381ed000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.229392 <... setgroups resumed> ) = 0
[pid 25537] 10:12:37.229416 <... mmap resumed> ) = 0x7f3c0be4b000
[pid 25536] 10:12:37.229430 <... read resumed> "\334Llc\365;\3021\262\"\313\351#x\211\347\337\227d\300\371\243\213\27\202&$\223\203Yn\257b\34\27\17Ag6t\354\4\230\206\237\17k\246", 48) = 48
[pid 25533] 10:12:37.229449 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.229491 getegid( <unfinished ...>
[pid 25537] 10:12:37.229605 read(11,  <unfinished ...>
[pid 25536] 10:12:37.229644 close(7 <unfinished ...>
[pid 25533] 10:12:37.229673 mprotect(0x7f4038410000, 4096, PROT_READ <unfinished ...>
[pid 25530] 10:12:37.229700 <... getegid resumed> ) = 499
[pid 25537] 10:12:37.229723 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25536] 10:12:37.229742 <... close resumed> ) = 0
[pid 25533] 10:12:37.229769 <... mprotect resumed> ) = 0
[pid 25530] 10:12:37.229804 geteuid( <unfinished ...>
[pid 25537] 10:12:37.229835 close(11 <unfinished ...>
[pid 25536] 10:12:37.229858 getuid( <unfinished ...>
[pid 25533] 10:12:37.229879 munmap(0x7f4038405000, 39387 <unfinished ...>
[pid 25530] 10:12:37.229908 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.229936 <... close resumed> ) = 0
[pid 25536] 10:12:37.229950 <... getuid resumed> ) = 47
[pid 25533] 10:12:37.229965 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.230116 geteuid( <unfinished ...>
[pid 25537] 10:12:37.230150 munmap(0x7f3c0be4b000, 4096 <unfinished ...>
[pid 25536] 10:12:37.230176 exit_group(0) = ?
[pid 25533] 10:12:37.230190 set_tid_address(0x7f40383f7a90 <unfinished ...>
[pid 25530] 10:12:37.230445 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.230483 <... munmap resumed> ) = 0
[pid 25536] 10:12:37.230498 +++ exited with 0 +++
[pid 25533] 10:12:37.230535 <... set_tid_address resumed> ) = 25533
[pid 25530] 10:12:37.230555 getegid( <unfinished ...>
[pid 25529] 10:12:37.230577 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25536
[pid 25537] 10:12:37.230605 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.230633 set_robust_list(0x7f40383f7aa0, 24 <unfinished ...>
[pid 25530] 10:12:37.230657 <... getegid resumed> ) = 499
[pid 25529] 10:12:37.230676 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25537] 10:12:37.230711 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25533] 10:12:37.230727 <... set_robust_list resumed> ) = 0
[pid 25530] 10:12:37.230848 setgid(499 <unfinished ...>
[pid 25529] 10:12:37.230877 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25537] 10:12:37.230927 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.230954 futex(0x7ffe92d8c24c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25530] 10:12:37.230979 <... setgid resumed> ) = 0
[pid 25529] 10:12:37.231003 getcwd( <unfinished ...>
[pid 25537] 10:12:37.231035 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.231049 <... futex resumed> ) = 0
[pid 25530] 10:12:37.231067 setuid(0 <unfinished ...>
[pid 25529] 10:12:37.231091 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25537] 10:12:37.231149 read(10,  <unfinished ...>
[pid 25533] 10:12:37.231176 futex(0x7ffe92d8c24c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f40383f77c0 <unfinished ...>
[pid 25530] 10:12:37.231201 <... setuid resumed> ) = 0
[pid 25529] 10:12:37.231243 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.231283 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.231297 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25530] 10:12:37.231324 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.231354 <... open resumed> ) = 7
[pid 25537] 10:12:37.231377 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.231399 rt_sigaction(SIGRTMIN, {0x7f40372bac60, [], SA_RESTORER|SA_SIGINFO, 0x7f40372c4790},  <unfinished ...>
[pid 25530] 10:12:37.231426 <... open resumed> ) = 6
[pid 25529] 10:12:37.231457 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.231489 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.231502 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25530] 10:12:37.231612 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.231637 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25537] 10:12:37.231675 read(10,  <unfinished ...>
[pid 25533] 10:12:37.231698 rt_sigaction(SIGRT_1, {0x7f40372bacf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f40372c4790},  <unfinished ...>
[pid 25530] 10:12:37.231725 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.231758 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.231788 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.231802 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25530] 10:12:37.231844 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.231870 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25537] 10:12:37.231905 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25533] 10:12:37.231940 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25530] 10:12:37.231966 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.231994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.232027 <... open resumed> ) = 11
[pid 25533] 10:12:37.232041 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25530] 10:12:37.232067 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.232093 <... mmap resumed> ) = 0x7f21d336d000
[pid 25537] 10:12:37.232115 alarm(60 <unfinished ...>
[pid 25533] 10:12:37.232139 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25530] 10:12:37.232162 <... mmap resumed> ) = 0x7f2293dc7000
[pid 25529] 10:12:37.232177 read(7,  <unfinished ...>
[pid 25537] 10:12:37.232211 <... alarm resumed> ) = 0
[pid 25533] 10:12:37.232225 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25530] 10:12:37.232277 read(6,  <unfinished ...>
[pid 25529] 10:12:37.232305 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25537] 10:12:37.232343 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25533] 10:12:37.232374 statfs("/selinux",  <unfinished ...>
[pid 25530] 10:12:37.232406 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25529] 10:12:37.232629 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25537] 10:12:37.232669 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.232683 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350326, f_bavail=6350326, f_files=1000000, f_ffree=691081, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25530] 10:12:37.232751 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.232782 <... lseek resumed> ) = 1279
[pid 25537] 10:12:37.232806 alarm(0 <unfinished ...>
[pid 25533] 10:12:37.232828 brk(0 <unfinished ...>
[pid 25530] 10:12:37.232851 <... socket resumed> ) = 7
[pid 25529] 10:12:37.232866 read(7,  <unfinished ...>
[pid 25537] 10:12:37.232895 <... alarm resumed> ) = 60
[pid 25533] 10:12:37.232908 <... brk resumed> ) = 0x8dc000
[pid 25530] 10:12:37.232997 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.233035 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25537] 10:12:37.233074 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25533] 10:12:37.233104 brk(0x8fd000 <unfinished ...>
[pid 25530] 10:12:37.233129 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.233146 close(7 <unfinished ...>
[pid 25537] 10:12:37.233177 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25533] 10:12:37.233204 <... brk resumed> ) = 0x8fd000
[pid 25530] 10:12:37.233235 close(7 <unfinished ...>
[pid 25529] 10:12:37.233263 <... close resumed> ) = 0
[pid 25537] 10:12:37.233285 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.233314 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.233347 <... close resumed> ) = 0
[pid 25529] 10:12:37.233368 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.233404 <... open resumed> ) = 13
[pid 25533] 10:12:37.233418 <... open resumed> ) = 6
[pid 25530] 10:12:37.233447 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.233475 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.233515 fcntl(13, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.233541 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.233564 <... socket resumed> ) = 7
[pid 25529] 10:12:37.233579 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25537] 10:12:37.233619 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.233633 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.233664 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.233696 <... open resumed> ) = 7
[pid 25537] 10:12:37.233720 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.233745 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.233771 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.233788 fcntl(7, F_GETFD <unfinished ...>
[pid 25537] 10:12:37.233817 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.233830 <... mmap resumed> ) = 0x7f403840e000
[pid 25530] 10:12:37.233851 close(7 <unfinished ...>
[pid 25529] 10:12:37.233877 <... fcntl resumed> ) = 0
[pid 25537] 10:12:37.233898 read(13,  <unfinished ...>
[pid 25533] 10:12:37.233921 read(6,  <unfinished ...>
[pid 25530] 10:12:37.233986 <... close resumed> ) = 0
[pid 25529] 10:12:37.234007 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.234038 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25533] 10:12:37.234058 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25530] 10:12:37.234093 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.234123 <... fcntl resumed> ) = 0
[pid 25537] 10:12:37.234146 close(13 <unfinished ...>
[pid 25533] 10:12:37.234169 read(6,  <unfinished ...>
[pid 25530] 10:12:37.234192 <... open resumed> ) = 7
[pid 25529] 10:12:37.234210 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.234240 <... close resumed> ) = 0
[pid 25533] 10:12:37.234253 <... read resumed> "", 1024) = 0
[pid 25530] 10:12:37.234287 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.234312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5382880, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25537] 10:12:37.234346 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.234354 close(6 <unfinished ...>
[pid 25530] 10:12:37.234372 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25529] 10:12:37.234392 write(7, "2015-12-30 10:12:37 [25529] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMb-0006df-04\n", 92 <unfinished ...>
[pid 25537] 10:12:37.234416 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.234423 <... close resumed> ) = 0
[pid 25530] 10:12:37.234434 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.234447 <... write resumed> ) = 92
[pid 25537] 10:12:37.234463 stat("/var/tmp",  <unfinished ...>
[pid 25533] 10:12:37.234471 munmap(0x7f403840e000, 4096 <unfinished ...>
[pid 25530] 10:12:37.234491 <... mmap resumed> ) = 0x7f2293dc6000
[pid 25529] 10:12:37.234500 chdir("/var/spool/exim" <unfinished ...>
[pid 25537] 10:12:37.234697 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25533] 10:12:37.234727 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.234971 read(7,  <unfinished ...>
[pid 25529] 10:12:37.235004 <... chdir resumed> ) = 0
[pid 25537] 10:12:37.235030 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.235062 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25530] 10:12:37.235094 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25529] 10:12:37.235130 setgid(12 <unfinished ...>
[pid 25537] 10:12:37.235160 <... open resumed> ) = 13
[pid 25533] 10:12:37.235174 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.235251 read(7,  <unfinished ...>
[pid 25529] 10:12:37.235278 <... setgid resumed> ) = 0
[pid 25537] 10:12:37.235327 fcntl(13, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.235352 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f40372c4790},  <unfinished ...>
[pid 25530] 10:12:37.235380 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.235397 read(6,  <unfinished ...>
[pid 25537] 10:12:37.235430 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.235453 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25530] 10:12:37.235485 close(7 <unfinished ...>
[pid 25529] 10:12:37.235577 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25537] 10:12:37.235655 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.235686 fstat(2,  <unfinished ...>
[pid 25530] 10:12:37.235711 <... close resumed> ) = 0
[pid 25529] 10:12:37.235727 read(6,  <unfinished ...>
[pid 25537] 10:12:37.235757 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.235771 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25530] 10:12:37.235837 munmap(0x7f2293dc6000, 4096 <unfinished ...>
[pid 25529] 10:12:37.235868 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25537] 10:12:37.235941 fstat(13,  <unfinished ...>
[pid 25533] 10:12:37.235966 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f40372c4790},  <unfinished ...>
[pid 25530] 10:12:37.235994 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.236023 read(6,  <unfinished ...>
[pid 25537] 10:12:37.236056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25533] 10:12:37.236088 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25530] 10:12:37.236140 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.236176 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25537] 10:12:37.236239 pread(13,  <unfinished ...>
[pid 25533] 10:12:37.236265 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f403600d6a0},  <unfinished ...>
[pid 25530] 10:12:37.236293 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.236340 read(6,  <unfinished ...>
[pid 25537] 10:12:37.236373 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25533] 10:12:37.236394 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25530] 10:12:37.236442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.236482 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25537] 10:12:37.236635 pread(13,  <unfinished ...>
[pid 25533] 10:12:37.236671 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f403600d6a0},  <unfinished ...>
[pid 25530] 10:12:37.236707 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.236728 read(6,  <unfinished ...>
[pid 25537] 10:12:37.236761 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25533] 10:12:37.236781 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25530] 10:12:37.236818 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.236851 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25537] 10:12:37.236932 close(13 <unfinished ...>
[pid 25533] 10:12:37.236961 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790},  <unfinished ...>
[pid 25530] 10:12:37.236988 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.237006 read(6,  <unfinished ...>
[pid 25537] 10:12:37.237036 <... close resumed> ) = 0
[pid 25533] 10:12:37.237050 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25530] 10:12:37.237108 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.237142 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25537] 10:12:37.237241 close(11 <unfinished ...>
[pid 25533] 10:12:37.237273 umask(0 <unfinished ...>
[pid 25530] 10:12:37.237296 <... open resumed> ) = 7
[pid 25529] 10:12:37.237312 read(6,  <unfinished ...>
[pid 25537] 10:12:37.237342 <... close resumed> ) = 0
[pid 25533] 10:12:37.237355 <... umask resumed> ) = 0
[pid 25530] 10:12:37.237427 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.237457 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25537] 10:12:37.237601 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25533] 10:12:37.237649 geteuid( <unfinished ...>
[pid 25530] 10:12:37.237675 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.237712 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.237753 <... socket resumed> ) = 11
[pid 25533] 10:12:37.237767 <... geteuid resumed> ) = 0
[pid 25530] 10:12:37.237793 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25529] 10:12:37.237822 <... open resumed> ) = 8
[pid 25537] 10:12:37.237845 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25533] 10:12:37.237872 getuid( <unfinished ...>
[pid 25530] 10:12:37.237894 <... mmap resumed> ) = 0x7f2293da6000
[pid 25529] 10:12:37.237910 fstat(8,  <unfinished ...>
[pid 25537] 10:12:37.237939 <... setsockopt resumed> ) = 0
[pid 25533] 10:12:37.237953 <... getuid resumed> ) = 47
[pid 25530] 10:12:37.237983 close(7 <unfinished ...>
[pid 25529] 10:12:37.238007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25537] 10:12:37.238043 alarm(300 <unfinished ...>
[pid 25533] 10:12:37.238066 getgid( <unfinished ...>
[pid 25530] 10:12:37.238088 <... close resumed> ) = 0
[pid 25529] 10:12:37.238114 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.238147 <... alarm resumed> ) = 0
[pid 25533] 10:12:37.238161 <... getgid resumed> ) = 12
[pid 25530] 10:12:37.238234 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.238271 <... mmap resumed> ) = 0x7f21d336d000
[pid 25537] 10:12:37.238295 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("108.168.168.75")}, 16 <unfinished ...>
[pid 25533] 10:12:37.238376 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25530] 10:12:37.238406 <... open resumed> ) = 7
[pid 25529] 10:12:37.238423 read(8,  <unfinished ...>
[pid 25533] 10:12:37.238456 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25530] 10:12:37.238476 read(7,  <unfinished ...>
[pid 25529] 10:12:37.238499 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.238601 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25530] 10:12:37.238635 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.238670 close(8 <unfinished ...>
[pid 25533] 10:12:37.238709 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25530] 10:12:37.238733 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.238758 <... close resumed> ) = 0
[pid 25533] 10:12:37.238779 getgroups(65536,  <unfinished ...>
[pid 25530] 10:12:37.238802 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.238835 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.238869 <... getgroups resumed> []) = 0
[pid 25530] 10:12:37.238891 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25529] 10:12:37.238925 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.239011 setgroups(0, [] <unfinished ...>
[pid 25530] 10:12:37.239039 <... mmap resumed> ) = 0x7f228f741000
[pid 25529] 10:12:37.239056 read(6,  <unfinished ...>
[pid 25533] 10:12:37.239086 <... setgroups resumed> ) = 0
[pid 25530] 10:12:37.239105 mprotect(0x7f228f74d000, 2097152, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.239134 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25533] 10:12:37.239218 getegid( <unfinished ...>
[pid 25530] 10:12:37.239244 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.239261 read(6,  <unfinished ...>
[pid 25533] 10:12:37.239290 <... getegid resumed> ) = 12
[pid 25530] 10:12:37.239307 mmap(0x7f228f94d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25529] 10:12:37.239337 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25533] 10:12:37.239443 geteuid( <unfinished ...>
[pid 25530] 10:12:37.239471 <... mmap resumed> ) = 0x7f228f94d000
[pid 25529] 10:12:37.239497 read(6,  <unfinished ...>
[pid 25533] 10:12:37.239621 <... geteuid resumed> ) = 0
[pid 25530] 10:12:37.239649 close(7 <unfinished ...>
[pid 25529] 10:12:37.239675 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25533] 10:12:37.239800 geteuid( <unfinished ...>
[pid 25530] 10:12:37.239828 <... close resumed> ) = 0
[pid 25529] 10:12:37.239865 read(6,  <unfinished ...>
[pid 25533] 10:12:37.239898 <... geteuid resumed> ) = 0
[pid 25530] 10:12:37.239915 mprotect(0x7f228f94d000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.239943 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25533] 10:12:37.240044 getegid( <unfinished ...>
[pid 25530] 10:12:37.240077 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.240098 read(6,  <unfinished ...>
[pid 25533] 10:12:37.240128 <... getegid resumed> ) = 12
[pid 25530] 10:12:37.240148 munmap(0x7f2293da6000, 39387 <unfinished ...>
[pid 25529] 10:12:37.240178 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25533] 10:12:37.240219 setgid(12 <unfinished ...>
[pid 25530] 10:12:37.240246 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.240270 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.240307 <... setgid resumed> ) = 0
[pid 25530] 10:12:37.240327 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.240354 <... open resumed> ) = 8
[pid 25533] 10:12:37.240377 setuid(0 <unfinished ...>
[pid 25530] 10:12:37.240401 <... open resumed> ) = 7
[pid 25529] 10:12:37.240422 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.240453 <... setuid resumed> ) = 0
[pid 25530] 10:12:37.240493 fcntl(7, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.240591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.240638 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.240673 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25529] 10:12:37.240698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.240736 <... open resumed> ) = 6
[pid 25530] 10:12:37.240763 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.240787 <... mmap resumed> ) = 0x7f21d336d000
[pid 25533] 10:12:37.240809 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.240833 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.240862 read(8,  <unfinished ...>
[pid 25533] 10:12:37.240895 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25530] 10:12:37.240927 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.240954 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.240990 fstat(6,  <unfinished ...>
[pid 25530] 10:12:37.241014 <... mmap resumed> ) = 0x7f2293dc6000
[pid 25529] 10:12:37.241031 close(8 <unfinished ...>
[pid 25533] 10:12:37.241061 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25530] 10:12:37.241089 read(7,  <unfinished ...>
[pid 25529] 10:12:37.241115 <... close resumed> ) = 0
[pid 25533] 10:12:37.241137 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.241163 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.241205 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.241241 <... mmap resumed> ) = 0x7f403840e000
[pid 25530] 10:12:37.241258 close(7 <unfinished ...>
[pid 25529] 10:12:37.241283 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.241314 read(6,  <unfinished ...>
[pid 25530] 10:12:37.241344 <... close resumed> ) = 0
[pid 25529] 10:12:37.241361 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.241396 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25530] 10:12:37.241513 munmap(0x7f2293dc6000, 4096 <unfinished ...>
[pid 25529] 10:12:37.241547 <... open resumed> ) = 8
[pid 25533] 10:12:37.241571 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25530] 10:12:37.241601 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.241635 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.241667 <... socket resumed> ) = 7
[pid 25530] 10:12:37.241684 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.241712 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.241747 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25530] 10:12:37.241782 <... socket resumed> ) = 7
[pid 25529] 10:12:37.241798 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.241831 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.241849 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.241996 <... mmap resumed> ) = 0x7f21d336d000
[pid 25533] 10:12:37.242022 close(7 <unfinished ...>
[pid 25530] 10:12:37.242050 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.242068 read(8,  <unfinished ...>
[pid 25533] 10:12:37.242101 <... close resumed> ) = 0
[pid 25530] 10:12:37.242118 close(7 <unfinished ...>
[pid 25529] 10:12:37.242143 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.242179 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25530] 10:12:37.242207 <... close resumed> ) = 0
[pid 25529] 10:12:37.242223 close(8 <unfinished ...>
[pid 25533] 10:12:37.242253 <... socket resumed> ) = 7
[pid 25530] 10:12:37.242270 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.242295 <... close resumed> ) = 0
[pid 25533] 10:12:37.242316 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25530] 10:12:37.242347 <... socket resumed> ) = 7
[pid 25529] 10:12:37.242364 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.242396 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.242414 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.242444 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.242491 close(7 <unfinished ...>
[pid 25530] 10:12:37.242525 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.242544 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.242580 <... close resumed> ) = 0
[pid 25530] 10:12:37.242604 close(7 <unfinished ...>
[pid 25529] 10:12:37.242641 <... open resumed> ) = 8
[pid 25533] 10:12:37.242673 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.242709 <... close resumed> ) = 0
[pid 25529] 10:12:37.242735 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.242766 <... open resumed> ) = 7
[pid 25530] 10:12:37.242786 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.242814 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.242849 fstat(7,  <unfinished ...>
[pid 25530] 10:12:37.242873 <... open resumed> ) = 7
[pid 25529] 10:12:37.242890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.242921 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25530] 10:12:37.242950 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.242973 <... mmap resumed> ) = 0x7f21d336d000
[pid 25533] 10:12:37.242994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.243020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.243047 read(8,  <unfinished ...>
[pid 25533] 10:12:37.243079 <... mmap resumed> ) = 0x7f403840d000
[pid 25530] 10:12:37.243097 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.243121 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.243155 read(7,  <unfinished ...>
[pid 25530] 10:12:37.243183 <... mmap resumed> ) = 0x7f2293dc6000
[pid 25529] 10:12:37.243200 close(8 <unfinished ...>
[pid 25533] 10:12:37.243229 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25530] 10:12:37.243266 read(7,  <unfinished ...>
[pid 25529] 10:12:37.243293 <... close resumed> ) = 0
[pid 25533] 10:12:37.243315 read(7,  <unfinished ...>
[pid 25530] 10:12:37.243338 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.243370 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25533] 10:12:37.243403 <... read resumed> "", 4096) = 0
[pid 25530] 10:12:37.243422 close(7 <unfinished ...>
[pid 25529] 10:12:37.243447 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.243673 close(7 <unfinished ...>
[pid 25530] 10:12:37.243714 <... close resumed> ) = 0
[pid 25529] 10:12:37.243736 read(6,  <unfinished ...>
[pid 25533] 10:12:37.243767 <... close resumed> ) = 0
[pid 25530] 10:12:37.243784 munmap(0x7f2293dc6000, 4096 <unfinished ...>
[pid 25529] 10:12:37.243811 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25533] 10:12:37.243933 munmap(0x7f403840d000, 4096 <unfinished ...>
[pid 25530] 10:12:37.243965 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.243999 read(6,  <unfinished ...>
[pid 25533] 10:12:37.244031 <... munmap resumed> ) = 0
[pid 25530] 10:12:37.244060 read(6,  <unfinished ...>
[pid 25529] 10:12:37.244087 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25533] 10:12:37.244174 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.244211 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25529] 10:12:37.244267 read(6,  <unfinished ...>
[pid 25533] 10:12:37.244300 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.244319 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.244348 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.244371 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.244407 <... open resumed> ) = 7
[pid 25529] 10:12:37.244424 read(6,  <unfinished ...>
[pid 25533] 10:12:37.244453 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.244470 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.244493 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.244532 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.244565 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.244595 close(6 <unfinished ...>
[pid 25533] 10:12:37.244624 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.244643 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.244671 <... close resumed> ) = 0
[pid 25533] 10:12:37.244692 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.244720 <... mmap resumed> ) = 0x7f2293dc6000
[pid 25529] 10:12:37.244738 munmap(0x7f21d336e000, 4096 <unfinished ...>
[pid 25533] 10:12:37.244770 <... open resumed> ) = 7
[pid 25530] 10:12:37.244787 read(7,  <unfinished ...>
[pid 25529] 10:12:37.244814 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.244852 fstat(7,  <unfinished ...>
[pid 25530] 10:12:37.244879 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.244902 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f21d2224790},  <unfinished ...>
[pid 25533] 10:12:37.244935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25530] 10:12:37.244965 close(7 <unfinished ...>
[pid 25529] 10:12:37.244989 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25533] 10:12:37.245020 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25530] 10:12:37.245050 <... close resumed> ) = 0
[pid 25529] 10:12:37.245066 open("/var/spool/exim/input/b/1aEJMb-0006df-04-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25533] 10:12:37.245116 <... mmap resumed> ) = 0x7f40383ed000
[pid 25530] 10:12:37.245134 munmap(0x7f2293dc6000, 4096 <unfinished ...>
[pid 25529] 10:12:37.245161 <... open resumed> ) = 6
[pid 25533] 10:12:37.245182 close(7 <unfinished ...>
[pid 25530] 10:12:37.245205 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.245229 fcntl(6, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.245258 <... close resumed> ) = 0
[pid 25530] 10:12:37.245285 read(6,  <unfinished ...>
[pid 25529] 10:12:37.245311 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.245332 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.245365 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25529] 10:12:37.245402 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.245433 <... open resumed> ) = 7
[pid 25530] 10:12:37.245451 uname( <unfinished ...>
[pid 25529] 10:12:37.245475 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.245496 read(7,  <unfinished ...>
[pid 25530] 10:12:37.245649 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25529] 10:12:37.245703 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25533] 10:12:37.245752 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25530] 10:12:37.245778 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f22919c66a0},  <unfinished ...>
[pid 25529] 10:12:37.245806 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.245828 fstat(7,  <unfinished ...>
[pid 25530] 10:12:37.245852 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, 8) = 0
[pid 25529] 10:12:37.245879 fstat(6,  <unfinished ...>
[pid 25533] 10:12:37.245909 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25530] 10:12:37.245943 clone( <unfinished ...>
[pid 25529] 10:12:37.246165 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.246209 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25529] 10:12:37.246247 open("/var/spool/exim/input/b/1aEJMb-0006df-04-H", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.246285 <... mmap resumed> ) = 0x7f4033d88000
[pid 25530] 10:12:37.246303 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2293db0a90) = 25538
[pid 25529] 10:12:37.246346 <... open resumed> ) = 8
[pid 25533] 10:12:37.246371 mprotect(0x7f4033d94000, 2097152, PROT_NONE <unfinished ...>
[pid 25530] 10:12:37.246400 wait4(25538,  <unfinished ...>
[pid 25529] 10:12:37.246424 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.246451 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.246467 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=989, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.246505 mmap(0x7f4033f94000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25529] 10:12:37.246626 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.246664 <... mmap resumed> ) = 0x7f4033f94000
[pid 25529] 10:12:37.246696 <... mmap resumed> ) = 0x7f21d336e000
[pid 25533] 10:12:37.246724 close(7 <unfinished ...>
[pid 25529] 10:12:37.246749 read(8,  <unfinished ...>
[pid 25533] 10:12:37.246780 <... close resumed> ) = 0
[pid 25529] 10:12:37.246816 <... read resumed> "1aEJMb-0006df-04-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 989
[pid 25533] 10:12:37.246876 mprotect(0x7f4033f94000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.246906 read(8,  <unfinished ...>
[pid 25533] 10:12:37.246933 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.246952 <... read resumed> "", 4096) = 0
[pid 25533] 10:12:37.246974 munmap(0x7f40383ed000, 39387 <unfinished ...>
[pid 25529] 10:12:37.247002 close(8 <unfinished ...>
[pid 25533] 10:12:37.247030 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.247054 <... close resumed> ) = 0
[pid 25533] 10:12:37.247075 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.247105 munmap(0x7f21d336e000, 4096 <unfinished ...>
[pid 25533] 10:12:37.247135 <... open resumed> ) = 7
[pid 25529] 10:12:37.247156 <... munmap resumed> ) = 0
[pid 25533] 10:12:37.247180 fcntl(7, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.247205 open("/var/spool/exim/input/b/1aEJMb-0006df-04-J", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.247246 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25529] 10:12:37.247267 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.247294 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.247319 open("/var/spool/exim/msglog/b/1aEJMb-0006df-04", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25533] 10:12:37.247358 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.247388 <... open resumed> ) = 8
[pid 25533] 10:12:37.247408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.247435 fcntl(8, F_GETFD <unfinished ...>
[pid 25533] 10:12:37.247461 <... mmap resumed> ) = 0x7f403840d000
[pid 25529] 10:12:37.247477 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.247497 read(7,  <unfinished ...>
[pid 25529] 10:12:37.247530 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.247558 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.247596 <... fcntl resumed> ) = 0
[pid 25533] 10:12:37.247622 close(7 <unfinished ...>
[pid 25529] 10:12:37.247656 fchown(8, 47, 12 <unfinished ...>
[pid 25533] 10:12:37.247692 <... close resumed> ) = 0
[pid 25529] 10:12:37.247715 <... fchown resumed> ) = 0
[pid 25533] 10:12:37.247739 munmap(0x7f403840d000, 4096 <unfinished ...>
[pid 25529] 10:12:37.247769 fchmod(8, 0640 <unfinished ...>
[pid 25533] 10:12:37.247799 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.247835 <... fchmod resumed> ) = 0
[pid 25533] 10:12:37.247862 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.247891 fcntl(8, F_GETFL <unfinished ...>
[pid 25533] 10:12:37.247918 <... socket resumed> ) = 7
[pid 25529] 10:12:37.247939 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25533] 10:12:37.247962 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.247997 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.248024 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.248041 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.248073 close(7 <unfinished ...>
[pid 25529] 10:12:37.248100 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.248129 <... close resumed> ) = 0
[pid 25529] 10:12:37.248146 <... mmap resumed> ) = 0x7f21d336e000
[pid 25533] 10:12:37.248166 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25529] 10:12:37.248193 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25533] 10:12:37.248220 <... socket resumed> ) = 7
[pid 25529] 10:12:37.248236 <... lseek resumed> ) = 0
[pid 25533] 10:12:37.248262 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25529] 10:12:37.248295 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25533] 10:12:37.248326 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.248343 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.248379 close(7 <unfinished ...>
[pid 25529] 10:12:37.248406 pipe( <unfinished ...>
[pid 25533] 10:12:37.248438 <... close resumed> ) = 0
[pid 25529] 10:12:37.248459 <... pipe resumed> [9, 10]) = 0
[pid 25533] 10:12:37.248481 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.248659 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25533] 10:12:37.248708 <... open resumed> ) = 7
[pid 25529] 10:12:37.248730 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f21d2224790}, 8) = 0
[pid 25533] 10:12:37.248759 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.248784 clone( <unfinished ...>
[pid 25533] 10:12:37.249001 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.249037 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.249064 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25539
[pid 25533] 10:12:37.249111 <... mmap resumed> ) = 0x7f403840d000
[pid 25529] 10:12:37.249132 close(10 <unfinished ...>
[pid 25533] 10:12:37.249159 read(7,  <unfinished ...>
[pid 25529] 10:12:37.249185 <... close resumed> ) = 0
[pid 25533] 10:12:37.249207 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.249240 read(9,  <unfinished ...>
[pid 25533] 10:12:37.249266 close(7)    = 0
[pid 25533] 10:12:37.249301 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.249357 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25533] 10:12:37.249435 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25533] 10:12:37.249478 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.249596 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.249647 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.249696 close(7)    = 0
[pid 25533] 10:12:37.249733 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.249777 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25533] 10:12:37.249834 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25533] 10:12:37.249899 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, 8) = 0
[pid 25533] 10:12:37.249950 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f40383f7a90) = 25540
[pid 25533] 10:12:37.250221 wait4(25540, Process 25540 attached
 <unfinished ...>
[pid 25540] 10:12:37.250287 set_robust_list(0x7f40383f7aa0, 24) = 0
[pid 25540] 10:12:37.250343 geteuid()   = 0
[pid 25540] 10:12:37.250385 geteuid()   = 0
[pid 25540] 10:12:37.250420 getegid()   = 12
[pid 25540] 10:12:37.250457 setgid(12)  = 0
[pid 25540] 10:12:37.250493 setuid(47)  = 0
Process 25539 attached
[pid 25539] 10:12:37.251626 set_robust_list(0x7f21d3357aa0, 24) = 0
[pid 25539] 10:12:37.251715 close(9)    = 0
[pid 25539] 10:12:37.251760 geteuid()   = 0
[pid 25539] 10:12:37.251794 getegid()   = 12
[pid 25539] 10:12:37.251828 setgid(494) = 0
[pid 25539] 10:12:37.251861 setuid(495) = 0
[pid 25539] 10:12:37.251914 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25539] 10:12:37.251962 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25539] 10:12:37.252044 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25539] 10:12:37.252094 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336d000
[pid 25539] 10:12:37.252132 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25539] 10:12:37.252176 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25539] 10:12:37.252220 close(9)    = 0
[pid 25539] 10:12:37.252255 munmap(0x7f21d336d000, 4096) = 0
[pid 25539] 10:12:37.252332 brk(0x220d000) = 0x220d000
[pid 25539] 10:12:37.252583 lseek(6, 19, SEEK_SET) = 19
[pid 25539] 10:12:37.252631 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2376) = 1858
[pid 25539] 10:12:37.252901 write(10, "\2\0\0\0", 4Process 25538 attached
 <unfinished ...>
[pid 25538] 10:12:37.252961 set_robust_list(0x7f2293db0aa0, 24) = 0
[pid 25538] 10:12:37.253609 geteuid()   = 0
[pid 25538] 10:12:37.253653 geteuid()   = 0
[pid 25538] 10:12:37.253687 getegid()   = 499
[pid 25538] 10:12:37.253721 setgid(12)  = 0
[pid 25538] 10:12:37.253754 setuid(47)  = 0
[pid 25529] 10:12:37.254562 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25529] 10:12:37.254594 read(9,  <unfinished ...>
[pid 25539] 10:12:37.254617 <... write resumed> ) = 4
[pid 25539] 10:12:37.254642 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.254672 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25529] 10:12:37.254695 read(9,  <unfinished ...>
[pid 25539] 10:12:37.254715 <... write resumed> ) = 4
[pid 25539] 10:12:37.254734 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.254755 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.254775 read(9,  <unfinished ...>
[pid 25539] 10:12:37.254795 <... write resumed> ) = 4
[pid 25539] 10:12:37.254813 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25529] 10:12:37.254834 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25529] 10:12:37.254854 read(9,  <unfinished ...>
[pid 25539] 10:12:37.254874 <... write resumed> ) = 4
[pid 25539] 10:12:37.254892 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.254913 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.254932 read(9,  <unfinished ...>
[pid 25539] 10:12:37.254952 <... write resumed> ) = 4
[pid 25539] 10:12:37.254969 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25529] 10:12:37.254994 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25529] 10:12:37.255016 read(9,  <unfinished ...>
[pid 25539] 10:12:37.255035 <... write resumed> ) = 40
[pid 25539] 10:12:37.255053 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25529] 10:12:37.255076 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.255097 wait4(-1,  <unfinished ...>
[pid 25539] 10:12:37.255118 <... write resumed> ) = 4
[pid 25539] 10:12:37.255135 close(10)   = 0
[pid 25539] 10:12:37.255177 exit_group(0) = ?
[pid 25539] 10:12:37.255359 +++ exited with 0 +++
[pid 25529] 10:12:37.255387 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25539
[pid 25529] 10:12:37.255409 close(9)    = 0
[pid 25529] 10:12:37.255446 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:37.255503 brk(0x220c000) = 0x220c000
[pid 25529] 10:12:37.255552 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25529] 10:12:37.255602 alarm(60)   = 0
[pid 25529] 10:12:37.255638 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25529] 10:12:37.255675 alarm(0)    = 60
[pid 25529] 10:12:37.255753 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.255804 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25529] 10:12:37.255851 read(10, "cpu  123085 1342455 395243 67343099 2509 0 0 0\ncpu0 123085 1342455 395243 67343099 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58532813\nbtime 1450798266\nprocesses 893018\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25529] 10:12:37.255911 close(10)   = 0
[pid 25529] 10:12:37.256001 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.256063 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25529] 10:12:37.256114 fcntl(10, F_GETFD) = 0
[pid 25529] 10:12:37.256147 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.256184 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25529] 10:12:37.256237 close(10)   = 0
[pid 25529] 10:12:37.256286 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.256328 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25529] 10:12:37.256431 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3326000
[pid 25529] 10:12:37.256692 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25529] 10:12:37.256743 fcntl(10, F_GETFD) = 0
[pid 25529] 10:12:37.256776 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.256812 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.256894 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25529] 10:12:37.256981 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25529] 10:12:37.257041 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25529] 10:12:37.257112 close(10)   = 0
[pid 25529] 10:12:37.257173 munmap(0x7f21d3326000, 200704) = 0
[pid 25529] 10:12:37.257240 close(9)    = 0
[pid 25529] 10:12:37.257297 open("/etc/localdomains", O_RDONLY) = 9
[pid 25529] 10:12:37.257344 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.257398 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.257450 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336d000
[pid 25529] 10:12:37.257489 lseek(9, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.257614 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25529] 10:12:37.257687 stat("/jail_owner", 0x7ffce2d00dc0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.257737 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.257806 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.257856 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.257912 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.257956 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.258021 open("/etc/demouids", O_RDONLY) = 10
[pid 25529] 10:12:37.258063 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.258111 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.258155 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336c000
[pid 25529] 10:12:37.258192 lseek(10, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.258225 read(10, "", 4096) = 0
[pid 25529] 10:12:37.258266 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:37.258418 getuid()    = 0
[pid 25529] 10:12:37.258459 geteuid()   = 0
[pid 25529] 10:12:37.258494 getgid()    = 12
[pid 25529] 10:12:37.258533 getegid()   = 12
[pid 25529] 10:12:37.258631 open("/dev/urandom", O_RDONLY) = 11
[pid 25529] 10:12:37.258680 read(11, "\232b\266w", 4) = 4
[pid 25529] 10:12:37.258719 close(11)   = 0
[pid 25529] 10:12:37.258836 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25529] 10:12:37.258946 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.258991 lseek(0, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.259028 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.259064 lseek(1, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.259097 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.259138 lseek(2, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.259174 open("/dev/null", O_RDONLY) = 11
[pid 25529] 10:12:37.259220 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.259258 lseek(11, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.259293 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.259331 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:37.259709 brk(0x222d000) = 0x222d000
[pid 25529] 10:12:37.259769 read(11, "", 8192) = 0
[pid 25529] 10:12:37.259813 close(11)   = 0
[pid 25529] 10:12:37.260114 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.260182 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25529] 10:12:37.260226 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.260266 lseek(11, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.260322 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25529] 10:12:37.261141 brk(0x224e000) = 0x224e000
[pid 25529] 10:12:37.261580 read(11, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25529] 10:12:37.262380 brk(0x226f000) = 0x226f000
[pid 25529] 10:12:37.262904 read(11, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25529] 10:12:37.263616 brk(0x2290000) = 0x2290000
[pid 25529] 10:12:37.264103 read(11, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25529] 10:12:37.264413 read(11, "", 8192) = 0
[pid 25529] 10:12:37.264465 close(11)   = 0
[pid 25529] 10:12:37.264526 stat("/usr/share/amavis/amavis-filter", 0x7f21d1a0b880) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.264579 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.264637 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.264689 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25529] 10:12:37.264735 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfb260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.264776 lseek(11, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.264830 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25529] 10:12:37.265131 brk(0x22b1000) = 0x22b1000
[pid 25529] 10:12:37.265340 stat("/etc/exim/perl/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265395 stat("/etc/exim/perl/warnings.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265439 stat("/usr/local/cpanel/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265481 stat("/usr/local/cpanel/warnings.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265611 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265667 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265713 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265757 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265802 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265848 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265894 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.265937 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.265995 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 12
[pid 25529] 10:12:37.266043 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfac70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.266085 lseek(12, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.266141 read(12, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25529] 10:12:37.266470 read(12, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25529] 10:12:37.267063 brk(0x22d2000 <unfinished ...>
[pid 25540] 10:12:37.267156 brk(0x91e000) = 0x91e000
[pid 25538] 10:12:37.268420 brk(0x1f86000 <unfinished ...>
[pid 25540] 10:12:37.268551 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25529] 10:12:37.268588 <... brk resumed> ) = 0x22d2000
[pid 25529] 10:12:37.268809 read(12,  <unfinished ...>
[pid 25540] 10:12:37.268856 <... open resumed> ) = 7
[pid 25540] 10:12:37.268885 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25540] 10:12:37.268943 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25540] 10:12:37.268998 read(7, "U\352\237\230H\3677\333i\357c\324\22}|\204\370.\203\6\255\335z\300w=\ru\224  \36`\241Q\3\240U\351\t9=\17\267\2010\365\201", 48) = 48
[pid 25540] 10:12:37.269046 close(7)    = 0
[pid 25540] 10:12:37.269099 getuid()    = 47
[pid 25540] 10:12:37.269274 exit_group(0) = ?
[pid 25529] 10:12:37.269302 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25540] 10:12:37.269799 +++ exited with 0 +++
[pid 25533] 10:12:37.269841 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25540
[pid 25533] 10:12:37.269871 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, 8) = 0
[pid 25533] 10:12:37.269942 getcwd("/var/spool/exim", 16380) = 16
[pid 25533] 10:12:37.270023 open("/etc/localtime", O_RDONLY) = 7
[pid 25533] 10:12:37.270069 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.270120 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.270167 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.270214 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25533] 10:12:37.270265 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25533] 10:12:37.270302 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25533] 10:12:37.270353 close(7)    = 0
[pid 25533] 10:12:37.270391 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.270444 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25533] 10:12:37.270496 fcntl(7, F_GETFD) = 0
[pid 25533] 10:12:37.270537 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25533] 10:12:37.270573 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5382972, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.270643 write(7, "2015-12-30 10:12:37 [25533] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMZ-0006ce-8t\n", 108) = 108
[pid 25533] 10:12:37.270702 chdir("/var/spool/exim") = 0
[pid 25533] 10:12:37.270749 geteuid()   = 0
[pid 25533] 10:12:37.270785 getegid()   = 12
[pid 25533] 10:12:37.270831 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.270879 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.270928 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.270967 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.271017 close(8)    = 0
[pid 25533] 10:12:37.271055 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.271098 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25533] 10:12:37.271145 read(8, "65536\n", 31) = 6
[pid 25533] 10:12:37.271184 close(8)    = 0
[pid 25533] 10:12:37.271224 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.271269 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.271318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.271356 lseek(8, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.271394 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.271448 read(8, "", 4096) = 0
[pid 25533] 10:12:37.271489 close(8)    = 0
[pid 25533] 10:12:37.271667 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.271718 setgroups(1, [12]) = 0
[pid 25533] 10:12:37.271759 setgid(12)  = 0
[pid 25533] 10:12:37.271795 setuid(47)  = 0
[pid 25533] 10:12:37.271858 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25533] 10:12:37.271944 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25533] 10:12:37.272032 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25533] 10:12:37.272108 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25533] 10:12:37.272188 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25533] 10:12:37.272288 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25533] 10:12:37.272408 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25533] 10:12:37.272483 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.272535 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.272585 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.272625 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.272677 close(8)    = 0
[pid 25533] 10:12:37.272718 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.272819 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25533] 10:12:37.272918 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25533] 10:12:37.273041 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25533] 10:12:37.273166 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25533] 10:12:37.273282 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25533] 10:12:37.273341 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.273386 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.273433 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.273457 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.273493 close(8)    = 0
[pid 25533] 10:12:37.273693 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.273750 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.273803 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.273853 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25537] 10:12:37.273896 <... connect resumed> ) = 0
[pid 25537] 10:12:37.273918 alarm(0)    = 300
[pid 25537] 10:12:37.273962 getsockname(11, {sa_family=AF_INET, sin_port=htons(51220), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25537] 10:12:37.274013 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25537] 10:12:37.274058 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25537] 10:12:37.274126 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25537] 10:12:37.274168 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25537] 10:12:37.274216 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25537] 10:12:37.274262 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4b000
[pid 25537] 10:12:37.274299 lseek(13, 0, SEEK_SET) = 0
[pid 25537] 10:12:37.274333 read(13, "", 4096) = 0
[pid 25537] 10:12:37.274382 lseek(13, 0, SEEK_SET) = 0
[pid 25537] 10:12:37.274419 read(13, "", 4096) = 0
[pid 25537] 10:12:37.274591 lseek(13, 0, SEEK_SET) = 0
[pid 25533] 10:12:37.274652 read(8,  <unfinished ...>
[pid 25537] 10:12:37.274685 read(13, "", 4096) = 0
[pid 25537] 10:12:37.274725 lseek(13, 0, SEEK_SET) = 0
[pid 25537] 10:12:37.274758 read(13, "", 4096) = 0
[pid 25537] 10:12:37.274807 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25533] 10:12:37.274851 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.274885 close(8)    = 0
[pid 25533] 10:12:37.274923 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.274989 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25533] 10:12:37.275036 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25533] 10:12:37.275086 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.275125 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25533] 10:12:37.275176 close(8)    = 0
[pid 25533] 10:12:37.275213 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.275322 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25533] 10:12:37.275455 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25533] 10:12:37.275644 read(6, "", 4096) = 0
[pid 25533] 10:12:37.275701 read(6, "", 4096) = 0
[pid 25533] 10:12:37.275743 close(6)    = 0
[pid 25533] 10:12:37.275780 munmap(0x7f403840e000, 4096) = 0
[pid 25533] 10:12:37.275825 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25533] 10:12:37.275871 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.275920 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840e000
[pid 25533] 10:12:37.275959 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.276009 close(6)    = 0
[pid 25533] 10:12:37.276046 munmap(0x7f403840e000, 4096) = 0
[pid 25533] 10:12:37.276094 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25533] 10:12:37.276158 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.276213 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25533] 10:12:37.276256 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25533] 10:12:37.276300 fstat(0, {st_dev=makedev(0, 8), st_ino=2130169202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.276348 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840e000
[pid 25533] 10:12:37.276386 read(0, "X-Failed-Recipients: Jennifer.Gonzales@onehospitalitygroup.com,\n  gretchen.murry@onehospitalitygroup.com,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@"..., 4096) = 4096
[pid 25533] 10:12:37.276477 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.276639 open("/var/spool/exim/input/b/1aEJMb-0006dp-8u-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25533] 10:12:37.276744 fchown(6, 47, 12) = 0
[pid 25533] 10:12:37.276790 fchmod(6, 0640) = 0
[pid 25533] 10:12:37.276830 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25533] 10:12:37.276869 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080174, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.276917 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840d000
[pid 25533] 10:12:37.276956 lseek(6, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.276992 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25533] 10:12:37.277124 read(0, "\" cellpadding=\"3\">      <tr>        <td height=\"32\" colspan=\"2\" bgcolor=\"#FFFFFF\" class=\"style4\"><div align=\"center\">You have a request for more information from:</div></td>        </tr>      <tr>        <td width=\"50%\" align=\"right\" bgcolor=\"#FFFFFF\"><spa"..., 4096) = 1538
[pid 25533] 10:12:37.277183 write(6, "1aEJMb-0006dp-8u-D\n--1451491957-eximdsn-1488136355\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 4096) = 4096
[pid 25533] 10:12:37.277253 read(0, "", 4096) = 0
[pid 25533] 10:12:37.277290 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.277329 write(6, "\" bgcolor=\"#FFFFFF\"><span class=\"style3\">Email Address : </span></td>        <td width=\"50%\" bgcolor=\"#FFFFFF\" class=\"style3\">&nbsp;Tylerrutt9@yahoo.com</td>      </tr>      <tr>        <td width=\"50%\" align=\"right\" bgcolor=\"#FFFFFF\"><span class=\"style3\">P"..., 1096) = 1096
[pid 25533] 10:12:37.277378 fsync(6 <unfinished ...>
[pid 25529] 10:12:37.277786 read(12, "", 8192) = 0
[pid 25529] 10:12:37.277836 close(12)   = 0
[pid 25533] 10:12:37.277876 <... fsync resumed> ) = 0
[pid 25533] 10:12:37.277914 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.278009 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080174, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=5192, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.278151 brk(0x91e000) = 0x91e000
[pid 25533] 10:12:37.278222 getuid()    = 47
[pid 25533] 10:12:37.278261 geteuid()   = 47
[pid 25533] 10:12:37.278297 getgid()    = 12
[pid 25533] 10:12:37.278335 getegid()   = 12
[pid 25533] 10:12:37.278435 open("/dev/urandom", O_RDONLY) = 8
[pid 25533] 10:12:37.278486 read(8, "\363*\376\354", 4) = 4
[pid 25533] 10:12:37.278586 close(8)    = 0
[pid 25533] 10:12:37.278706 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25533] 10:12:37.278836 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d474e0) = -1 EINVAL (Invalid argument)
[pid 25533] 10:12:37.278885 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25533] 10:12:37.278926 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d474e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.278965 lseek(1, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.279002 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d474f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.279040 lseek(2, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.279079 open("/dev/null", O_RDONLY) = 8
[pid 25533] 10:12:37.279125 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d475c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.279163 lseek(8, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.279201 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25533] 10:12:37.279240 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f40372c4790}, 8) = 0
[pid 25533] 10:12:37.279284 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f40372c4790}, 8) = 0
[pid 25533] 10:12:37.279568 read(8, "", 8192) = 0
[pid 25533] 10:12:37.279620 close(8)    = 0
[pid 25533] 10:12:37.279834 brk(0x93f000) = 0x93f000
[pid 25533] 10:12:37.279976 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.280042 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25533] 10:12:37.280087 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d473f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.280128 lseek(8, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.280190 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25533] 10:12:37.281226 brk(0x960000) = 0x960000
[pid 25533] 10:12:37.281459 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25533] 10:12:37.282415 brk(0x981000) = 0x981000
[pid 25533] 10:12:37.282820 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25533] 10:12:37.283746 brk(0x9a2000) = 0x9a2000
[pid 25533] 10:12:37.284021 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25533] 10:12:37.284323 read(8,  <unfinished ...>
[pid 25538] 10:12:37.284585 <... brk resumed> ) = 0x1f86000
[pid 25538] 10:12:37.285023 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25533] 10:12:37.285399 <... read resumed> "", 8192) = 0
[pid 25533] 10:12:37.285437 close(8)    = 0
[pid 25533] 10:12:37.285502 stat("/usr/share/amavis/amavis-filter", 0x7f4036aab880) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.285618 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.285677 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25533] 10:12:37.285729 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25533] 10:12:37.285774 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d473f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.285815 lseek(8, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.285870 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25533] 10:12:37.286311 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25538] 10:12:37.286360 <... open resumed> ) = 7
[pid 25538] 10:12:37.286588 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25538] 10:12:37.286660 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25538] 10:12:37.286710 read(7, "<\372\346\317\314\242 Y\267\177R\24\220j*'\334\277\343\305\274\f\31\23\325\16\374`k\355s\26\210\376\303\261<C\36\200\301\252>\373N\370e\344", 48) = 48
[pid 25538] 10:12:37.286756 close(7)    = 0
[pid 25538] 10:12:37.286810 getuid()    = 47
[pid 25538] 10:12:37.286980 exit_group(0) = ?
[pid 25529] 10:12:37.287161 read(11,  <unfinished ...>
[pid 25533] 10:12:37.287421 <... stat resumed> 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.287463 stat("/etc/exim/perl/warnings.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.287565 stat("/usr/local/cpanel/warnings.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.287621 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25529] 10:12:37.288336 read(11,  <unfinished ...>
[pid 25533] 10:12:37.288385 stat("/usr/local/cpanel/warnings.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288450 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288559 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288617 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288662 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288754 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.288800 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25538] 10:12:37.288901 +++ exited with 0 +++
[pid 25530] 10:12:37.288915 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25538
[pid 25530] 10:12:37.288940 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, 8) = 0
[pid 25530] 10:12:37.289007 getcwd("/home/finest09/public_html/includes", 16380) = 36
[pid 25530] 10:12:37.289083 open("/etc/localtime", O_RDONLY) = 7
[pid 25530] 10:12:37.289126 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.289176 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.289221 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.289259 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25530] 10:12:37.289307 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25530] 10:12:37.289342 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25530] 10:12:37.289397 close(7)    = 0
[pid 25530] 10:12:37.289434 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.289487 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25530] 10:12:37.289627 fcntl(7, F_GETFD) = 0
[pid 25530] 10:12:37.289663 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25530] 10:12:37.289696 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5383080, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.289745 write(7, "2015-12-30 10:12:37 [25530] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101) = 101
[pid 25530] 10:12:37.289788 chdir("/var/spool/exim") = 0
[pid 25530] 10:12:37.289832 geteuid()   = 0
[pid 25530] 10:12:37.289866 getegid()   = 499
[pid 25530] 10:12:37.289911 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.289956 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25530] 10:12:37.290004 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.290041 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25530] 10:12:37.290089 close(8)    = 0
[pid 25530] 10:12:37.290125 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.290166 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25530] 10:12:37.290211 read(8, "65536\n", 31) = 6
[pid 25530] 10:12:37.290248 close(8)    = 0
[pid 25530] 10:12:37.290286 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.290328 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25530] 10:12:37.290382 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.290425 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.290462 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25530] 10:12:37.290588 read(8, "", 4096) = 0
[pid 25530] 10:12:37.290635 close(8)    = 0
[pid 25530] 10:12:37.290671 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.290711 setgroups(1, [12]) = 0
[pid 25530] 10:12:37.290750 setgid(12)  = 0
[pid 25530] 10:12:37.290784 setuid(47)  = 0
[pid 25530] 10:12:37.290845 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25530] 10:12:37.290935 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25530] 10:12:37.291020 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25530] 10:12:37.291095 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25530] 10:12:37.291173 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25530] 10:12:37.291264 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25530] 10:12:37.291378 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25530] 10:12:37.291453 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.291498 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25530] 10:12:37.291554 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.291592 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25530] 10:12:37.291640 close(8)    = 0
[pid 25530] 10:12:37.291675 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.291772 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25530] 10:12:37.291869 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25530] 10:12:37.291989 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25530] 10:12:37.292112 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25530] 10:12:37.292233 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25530] 10:12:37.292291 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.292334 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25530] 10:12:37.292392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.292417 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25530] 10:12:37.292451 close(8)    = 0
[pid 25530] 10:12:37.292470 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.292500 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.292673 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25530] 10:12:37.292721 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.292757 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25530] 10:12:37.292807 close(8)    = 0
[pid 25530] 10:12:37.292840 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.292900 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25530] 10:12:37.292944 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25530] 10:12:37.292989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.293024 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25530] 10:12:37.293071 close(8)    = 0
[pid 25530] 10:12:37.293105 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.293208 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25530] 10:12:37.293335 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25530] 10:12:37.293433 read(6, "", 4096) = 0
[pid 25530] 10:12:37.293471 read(6, "", 4096) = 0
[pid 25530] 10:12:37.293596 close(6)    = 0
[pid 25530] 10:12:37.293639 munmap(0x7f2293dc7000, 4096) = 0
[pid 25530] 10:12:37.293680 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25530] 10:12:37.293721 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25530] 10:12:37.293773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc7000
[pid 25530] 10:12:37.293810 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25530] 10:12:37.293861 close(6)    = 0
[pid 25530] 10:12:37.293895 munmap(0x7f2293dc7000, 4096) = 0
[pid 25530] 10:12:37.293945 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25530] 10:12:37.294006 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.294057 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.294098 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25530] 10:12:37.294139 fstat(0, {st_dev=makedev(0, 8), st_ino=2130169144, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.294195 <... stat resumed> 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.294211 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25533] 10:12:37.294243 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25530] 10:12:37.294273 <... mmap resumed> ) = 0x7f2293dc7000
[pid 25533] 10:12:37.294293 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.294319 read(0,  <unfinished ...>
[pid 25533] 10:12:37.294353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.294385 <... read resumed> "To:  wendy.laws@hilton.com, embassy-airport@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head><style type=\"t"..., 4096) = 2088
[pid 25533] 10:12:37.294471 <... open resumed> ) = 9
[pid 25530] 10:12:37.294489 stat("/etc/localtime",  <unfinished ...>
[pid 25533] 10:12:37.294606 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25530] 10:12:37.294632 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.294681 <... ioctl resumed> , 0x7ffe92d46e00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.294699 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25533] 10:12:37.294776 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25530] 10:12:37.294801 <... open resumed> ) = 6
[pid 25533] 10:12:37.294824 <... lseek resumed> ) = 0
[pid 25530] 10:12:37.294839 fchown(6, 47, 12 <unfinished ...>
[pid 25533] 10:12:37.294890 brk(0x9c3000 <unfinished ...>
[pid 25530] 10:12:37.294915 <... fchown resumed> ) = 0
[pid 25533] 10:12:37.294937 <... brk resumed> ) = 0x9c3000
[pid 25530] 10:12:37.294951 fchmod(6, 0640 <unfinished ...>
[pid 25533] 10:12:37.294996 read(9,  <unfinished ...>
[pid 25530] 10:12:37.295027 <... fchmod resumed> ) = 0
[pid 25533] 10:12:37.295050 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25530] 10:12:37.295069 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25530] 10:12:37.295409 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.295462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc6000
[pid 25530] 10:12:37.295499 lseek(6, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.295625 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25530] 10:12:37.295765 read(0, "", 4096) = 0
[pid 25530] 10:12:37.295808 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.295846 write(6, "1aEJMb-0006dm-9U-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25530] 10:12:37.295895 fsync(6 <unfinished ...>
[pid 25533] 10:12:37.295992 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25530] 10:12:37.296302 <... fsync resumed> ) = 0
[pid 25530] 10:12:37.296346 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.296439 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.296574 brk(0x1f86000) = 0x1f86000
[pid 25530] 10:12:37.296641 getuid()    = 47
[pid 25530] 10:12:37.296677 geteuid()   = 47
[pid 25530] 10:12:37.296710 getgid()    = 12
[pid 25530] 10:12:37.296746 getegid()   = 12
[pid 25530] 10:12:37.296841 open("/dev/urandom", O_RDONLY) = 8
[pid 25530] 10:12:37.296891 read(8, "\264\351\24\342", 4) = 4
[pid 25530] 10:12:37.297007 close(8)    = 0
[pid 25530] 10:12:37.297125 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25530] 10:12:37.297238 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276aec0) = -1 EINVAL (Invalid argument)
[pid 25530] 10:12:37.297596 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25530] 10:12:37.297640 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276aec0) = -1 EINVAL (Invalid argument)
[pid 25530] 10:12:37.297685 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.297710 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25530] 10:12:37.297732 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25530] 10:12:37.298456 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.298498 read(11,  <unfinished ...>
[pid 25530] 10:12:37.298582 <... ioctl resumed> , 0x7ffd1276aed0) = -1 EINVAL (Invalid argument)
[pid 25530] 10:12:37.298615 lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25530] 10:12:37.298655 open("/dev/null", O_RDONLY) = 8
[pid 25530] 10:12:37.298701 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276afa0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.298737 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.298771 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25530] 10:12:37.298806 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2292c7d790}, 8) = 0
[pid 25530] 10:12:37.298847 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f2292c7d790}, 8) = 0
[pid 25530] 10:12:37.299119 read(8, "", 8192) = 0
[pid 25530] 10:12:37.299166 close(8)    = 0
[pid 25530] 10:12:37.299374 brk(0x1fa7000) = 0x1fa7000
[pid 25530] 10:12:37.299517 stat("/etc/exim.pl",  <unfinished ...>
[pid 25533] 10:12:37.299889 read(9,  <unfinished ...>
[pid 25530] 10:12:37.299912 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25530] 10:12:37.299949 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25530] 10:12:37.299991 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276add0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.300028 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.300084 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25530] 10:12:37.301206 brk(0x1fc8000) = 0x1fc8000
[pid 25530] 10:12:37.301451 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25530] 10:12:37.302343 brk(0x1fe9000) = 0x1fe9000
[pid 25530] 10:12:37.302737 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25530] 10:12:37.303582 brk(0x200a000) = 0x200a000
[pid 25530] 10:12:37.303869 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25530] 10:12:37.304173 read(8, "", 8192) = 0
[pid 25530] 10:12:37.304222 close(8)    = 0
[pid 25530] 10:12:37.304278 stat("/usr/share/amavis/amavis-filter", 0x7f2292464880) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.304329 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25530] 10:12:37.304400 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25530] 10:12:37.304454 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25533] 10:12:37.304560 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25530] 10:12:37.304591 <... open resumed> ) = 8
[pid 25533] 10:12:37.304708 brk(0x9e4000 <unfinished ...>
[pid 25530] 10:12:37.304743 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276add0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.304784 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.304838 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25530] 10:12:37.305282 stat("/etc/exim/perl/warnings.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.305338 <... brk resumed> ) = 0x9e4000
[pid 25530] 10:12:37.305366 stat("/etc/exim/perl/warnings.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.305558 stat("/usr/local/cpanel/warnings.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.305615 stat("/usr/local/cpanel/warnings.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.305664 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.305710 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25530] 10:12:37.305732 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.306371 brk(0x22f3000 <unfinished ...>
[pid 25530] 10:12:37.306417 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.306524 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.306576 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.306622 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.306873 read(9,  <unfinished ...>
[pid 25530] 10:12:37.306903 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.306953 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.306996 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.307054 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25530] 10:12:37.307100 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276a7e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.307139 lseek(9, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.307185 brk(0x202b000) = 0x202b000
[pid 25530] 10:12:37.307234 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25530] 10:12:37.307653 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25530] 10:12:37.308363 read(9,  <unfinished ...>
[pid 25533] 10:12:37.308405 <... read resumed> "", 8192) = 0
[pid 25533] 10:12:37.308432 close(9)    = 0
[pid 25533] 10:12:37.309210 read(8,  <unfinished ...>
[pid 25529] 10:12:37.309255 <... brk resumed> ) = 0x22f3000
[pid 25529] 10:12:37.309356 read(11, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25530] 10:12:37.309535 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25530] 10:12:37.309668 brk(0x204c000 <unfinished ...>
[pid 25529] 10:12:37.310238 read(11,  <unfinished ...>
[pid 25530] 10:12:37.310274 <... brk resumed> ) = 0x204c000
[pid 25530] 10:12:37.310679 read(9,  <unfinished ...>
[pid 25533] 10:12:37.310727 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25530] 10:12:37.311383 <... read resumed> "", 8192) = 0
[pid 25530] 10:12:37.311423 close(9)    = 0
[pid 25537] 10:12:37.312051 <... select resumed> ) = 1 (in [11], left {299, 962789})
[pid 25537] 10:12:37.312099 recvfrom(11, "220 inbound.coursetrends.com ESMTP\r\n", 4096, 0, NULL, NULL) = 36
[pid 25537] 10:12:37.312162 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25537] 10:12:37.312231 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25529] 10:12:37.312274 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25529] 10:12:37.312845 brk(0x2314000 <unfinished ...>
[pid 25533] 10:12:37.313006 read(8,  <unfinished ...>
[pid 25530] 10:12:37.313217 read(8,  <unfinished ...>
[pid 25529] 10:12:37.313253 <... brk resumed> ) = 0x2314000
[pid 25533] 10:12:37.313386 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25533] 10:12:37.314154 read(8,  <unfinished ...>
[pid 25530] 10:12:37.314536 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25530] 10:12:37.315266 read(8,  <unfinished ...>
[pid 25529] 10:12:37.315435 read(11, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25529] 10:12:37.316038 read(11,  <unfinished ...>
[pid 25533] 10:12:37.316090 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25530] 10:12:37.316522 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25530] 10:12:37.317235 read(8,  <unfinished ...>
[pid 25529] 10:12:37.317281 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25533] 10:12:37.317775 read(8,  <unfinished ...>
[pid 25529] 10:12:37.318031 brk(0x2335000 <unfinished ...>
[pid 25533] 10:12:37.318068 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25533] 10:12:37.318264 brk(0xa05000 <unfinished ...>
[pid 25529] 10:12:37.318303 <... brk resumed> ) = 0x2335000
[pid 25530] 10:12:37.318521 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25530] 10:12:37.319132 read(8,  <unfinished ...>
[pid 25533] 10:12:37.319176 <... brk resumed> ) = 0xa05000
[pid 25529] 10:12:37.319414 read(11,  <unfinished ...>
[pid 25533] 10:12:37.319925 read(8,  <unfinished ...>
[pid 25529] 10:12:37.319963 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25533] 10:12:37.320389 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25533] 10:12:37.321245 brk(0xa26000 <unfinished ...>
[pid 25530] 10:12:37.321290 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25529] 10:12:37.321730 read(11,  <unfinished ...>
[pid 25530] 10:12:37.321913 brk(0x206d000) = 0x206d000
[pid 25529] 10:12:37.322372 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25529] 10:12:37.322706 brk(0x2356000) = 0x2356000
[pid 25529] 10:12:37.323270 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25530] 10:12:37.323334 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25533] 10:12:37.323521 <... brk resumed> ) = 0xa26000
[pid 25533] 10:12:37.323705 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25533] 10:12:37.324988 read(8,  <unfinished ...>
[pid 25529] 10:12:37.325036 <... stat resumed> 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325061 stat("/usr/local/cpanel/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325107 stat("/etc/exim/perl/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325147 stat("/etc/exim/perl/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325188 stat("/usr/local/cpanel/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325228 stat("/usr/local/cpanel/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325269 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325319 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325371 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325428 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325538 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325588 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325648 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.325692 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.325752 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 12
[pid 25529] 10:12:37.325801 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfac70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.325841 lseek(12, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.325898 read(12, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25529] 10:12:37.326128 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.326285 brk(0x208e000 <unfinished ...>
[pid 25533] 10:12:37.326320 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25529] 10:12:37.326535 <... lseek resumed> ) = 878
[pid 25529] 10:12:37.326566 lseek(12, 0, SEEK_CUR) = 878
[pid 25529] 10:12:37.326613 close(12)   = 0
[pid 25529] 10:12:37.326874 read(11,  <unfinished ...>
[pid 25530] 10:12:37.326914 <... brk resumed> ) = 0x208e000
[pid 25530] 10:12:37.327088 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25529] 10:12:37.327525 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25529] 10:12:37.328019 brk(0x2377000 <unfinished ...>
[pid 25533] 10:12:37.328696 brk(0xa47000) = 0xa47000
[pid 25533] 10:12:37.328887 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25529] 10:12:37.329447 <... brk resumed> ) = 0x2377000
[pid 25529] 10:12:37.329644 read(11,  <unfinished ...>
[pid 25530] 10:12:37.329715 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25530] 10:12:37.330222 brk(0x20af000 <unfinished ...>
[pid 25529] 10:12:37.330256 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25529] 10:12:37.331355 brk(0x2398000 <unfinished ...>
[pid 25533] 10:12:37.331589 read(8,  <unfinished ...>
[pid 25530] 10:12:37.331622 <... brk resumed> ) = 0x20af000
[pid 25533] 10:12:37.331647 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25530] 10:12:37.331814 read(8,  <unfinished ...>
[pid 25533] 10:12:37.332270 brk(0xa68000 <unfinished ...>
[pid 25530] 10:12:37.332304 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25530] 10:12:37.333006 read(8,  <unfinished ...>
[pid 25533] 10:12:37.333043 <... brk resumed> ) = 0xa68000
[pid 25533] 10:12:37.333382 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.333419 <... brk resumed> ) = 0x2398000
[pid 25529] 10:12:37.333637 read(11, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25533] 10:12:37.334381 <... stat resumed> 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334419 stat("/usr/local/cpanel/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.334517 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25533] 10:12:37.334553 stat("/etc/exim/perl/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334731 stat("/etc/exim/perl/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334782 stat("/usr/local/cpanel/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334822 stat("/usr/local/cpanel/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334863 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334911 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334955 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.334996 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.335039 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.335082 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.335124 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.335571 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25533] 10:12:37.335635 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25533] 10:12:37.335683 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d46e00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.335726 lseek(9, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.335782 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25533] 10:12:37.336009 lseek(9, 878, SEEK_SET) = 878
[pid 25533] 10:12:37.336053 lseek(9, 0, SEEK_CUR) = 878
[pid 25533] 10:12:37.336088 close(9)    = 0
[pid 25533] 10:12:37.336366 read(8,  <unfinished ...>
[pid 25530] 10:12:37.336530 brk(0x20d0000) = 0x20d0000
[pid 25530] 10:12:37.336890 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25533] 10:12:37.336927 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25529] 10:12:37.337866 brk(0x23b9000 <unfinished ...>
[pid 25530] 10:12:37.337906 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.337930 stat("/usr/local/cpanel/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.337974 stat("/etc/exim/perl/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338012 stat("/etc/exim/perl/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338050 stat("/usr/local/cpanel/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338088 stat("/usr/local/cpanel/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338127 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338175 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338218 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338257 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338298 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338338 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338379 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.338420 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.338549 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25530] 10:12:37.338597 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276a7e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.338634 lseek(9, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.338688 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25530] 10:12:37.338914 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.339076 read(8,  <unfinished ...>
[pid 25529] 10:12:37.339105 <... brk resumed> ) = 0x23b9000
[pid 25530] 10:12:37.339380 <... lseek resumed> ) = 878
[pid 25530] 10:12:37.339416 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25533] 10:12:37.339441 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25530] 10:12:37.339535 <... lseek resumed> ) = 878
[pid 25533] 10:12:37.339674 brk(0xa89000 <unfinished ...>
[pid 25530] 10:12:37.339702 close(9)    = 0
[pid 25530] 10:12:37.339952 read(8,  <unfinished ...>
[pid 25533] 10:12:37.339983 <... brk resumed> ) = 0xa89000
[pid 25529] 10:12:37.340521 read(11, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25529] 10:12:37.341388 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25530] 10:12:37.341427 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25530] 10:12:37.342042 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25530] 10:12:37.342672 brk(0x20f1000) = 0x20f1000
[pid 25529] 10:12:37.343526 <... stat resumed> 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343560 stat("/usr/local/cpanel/Errno.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343608 stat("/etc/exim/perl/Errno.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343789 stat("/etc/exim/perl/Errno.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343834 stat("/usr/local/cpanel/Errno.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343873 stat("/usr/local/cpanel/Errno.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343913 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343956 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.343998 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.344039 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.344081 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.344122 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.344178 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 12
[pid 25529] 10:12:37.344224 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfac70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.344262 lseek(12, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.344318 read(12,  <unfinished ...>
[pid 25533] 10:12:37.344454 read(8,  <unfinished ...>
[pid 25529] 10:12:37.344567 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25529] 10:12:37.344872 brk(0x23da000 <unfinished ...>
[pid 25533] 10:12:37.344915 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25529] 10:12:37.344958 <... brk resumed> ) = 0x23da000
[pid 25533] 10:12:37.345185 brk(0xaaa000) = 0xaaa000
[pid 25529] 10:12:37.346774 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.347074 read(8,  <unfinished ...>
[pid 25529] 10:12:37.347106 <... lseek resumed> ) = 4868
[pid 25529] 10:12:37.347128 lseek(12, 0, SEEK_CUR) = 4868
[pid 25529] 10:12:37.347163 close(12)   = 0
[pid 25529] 10:12:37.347214 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347259 stat("/usr/local/cpanel/Exporter.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347300 stat("/etc/exim/perl/Exporter.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347337 stat("/etc/exim/perl/Exporter.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347377 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347421 stat("/usr/local/cpanel/Exporter.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347526 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347579 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffce2cfae80) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347622 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffce2cfaf20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.347662 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25529] 10:12:37.347718 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 12
[pid 25529] 10:12:37.347762 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25537] 10:12:37.347846 <... select resumed> ) = 1 (in [11], left {299, 964455})
[pid 25537] 10:12:37.347878 recvfrom(11, "250-inbound.coursetrends.com\r\n250-STARTTLS\r\n250-PIPELINING\r\n250-8BITMIME\r\n250-SIZE 0\r\n250 AUTH LOGIN PLAIN\r\n", 4096, 0, NULL, NULL) = 108
[pid 25537] 10:12:37.347947 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25537] 10:12:37.348006 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25529] 10:12:37.348035 <... ioctl resumed> , 0x7ffce2cfac70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.348057 lseek(12, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.348105 read(12, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25530] 10:12:37.348524 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25530] 10:12:37.348785 brk(0x2112000) = 0x2112000
[pid 25529] 10:12:37.349630 lseek(12, 2366, SEEK_SET) = 2366
[pid 25529] 10:12:37.349681 lseek(12, 0, SEEK_CUR) = 2366
[pid 25529] 10:12:37.349716 close(12)   = 0
[pid 25533] 10:12:37.349978 read(8,  <unfinished ...>
[pid 25529] 10:12:37.350277 read(11,  <unfinished ...>
[pid 25533] 10:12:37.350310 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25533] 10:12:37.350428 brk(0xacb000) = 0xacb000
[pid 25533] 10:12:37.351267 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25529] 10:12:37.351305 <... read resumed> "", 8192) = 0
[pid 25529] 10:12:37.351330 close(11)   = 0
[pid 25482] 10:12:37.351537 <... select resumed> ) = 1 (in [11], left {598, 957865})
[pid 25482] 10:12:37.351578 read(11, "\27\3\3\0\360", 5) = 5
[pid 25482] 10:12:37.351618 read(11, "\25\0ma\366\262h\300\346h\243\373\33\270\253/\357\370\25\334N\235\335\320\365\343\2163M%r\372\177$\374\10\26\305\212\216|\240\332\203\321\37\264\357\345\\\3\206\306{*~G\301\301\314\313y\22#D\314\321'\327\264\273\372@7Igz\v\302'\365\r\204\353\267\245g\271\3066\207\22\262\376\336q\356z\350\6\3212\272\1\254\370\22\25\1\270\7K\206\233\0\264\377\227\24\302\34\36\350\366\0309\37\36\3{>\363XY\32\367\314\257\311\321\356\226\240\217\217|T\344\f\366\230Mb\270HO\20_\37T|e\330/1?\0037\177\3428<\235\245\334\225\r\313\326\230\225\32K\204X\3048F\270\256g5T\21\300\32j^\21\333\33%\26~jz\16\232\321\355\211X\323yk\n\311\220]+L2\302\333%[*\3\270\255\342\347Mz\313\244\332;\207\243", 240) = 240
[pid 25482] 10:12:37.351705 write(9, "rochelle.samms@radisson.com\n", 28) = 28
[pid 25482] 10:12:37.351753 fsync(9 <unfinished ...>
[pid 25529] 10:12:37.352014 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.352094 open("/etc/userdomains", O_RDONLY) = 11
[pid 25482] 10:12:37.352139 <... fsync resumed> ) = 0
[pid 25482] 10:12:37.352166 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25482] 10:12:37.352217 alarm(60)   = 0
[pid 25482] 10:12:37.352252 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25482] 10:12:37.352291 alarm(0)    = 60
[pid 25482] 10:12:37.352340 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:37.352391 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25482] 10:12:37.352438 read(15, "cpu  123086 1342460 395246 67343099 2509 0 0 0\ncpu0 123086 1342460 395246 67343099 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58538094\nbtime 1450798266\nprocesses 893018\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25482] 10:12:37.352572 close(15)   = 0
[pid 25482] 10:12:37.352635 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25482] 10:12:37.352707 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25482] 10:12:37.352749 fcntl(15, F_GETFD) = 0
[pid 25482] 10:12:37.352782 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25482] 10:12:37.352815 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25482] 10:12:37.352858 close(15)   = 0
[pid 25482] 10:12:37.352899 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25482] 10:12:37.352940 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25482] 10:12:37.353008 brk(0x1fd7000) = 0x1fd7000
[pid 25482] 10:12:37.353149 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25482] 10:12:37.353195 fcntl(15, F_GETFD) = 0
[pid 25482] 10:12:37.353227 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25482] 10:12:37.353260 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25482] 10:12:37.353317 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25482] 10:12:37.353377 pread(15, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25482] 10:12:37.353439 close(15)   = 0
[pid 25482] 10:12:37.353575 close(14)   = 0
[pid 25482] 10:12:37.353646 write(11, "\27\3\3\0P#\376\21\265\17\377\333\343\t\210|\307X\221;\221\274\200\326\3602\227\274\246^\330J\374\272h\362\265\261B\37$\25\"\210\374\354b\307Dt\314\207\223\nt\370\35\235\343\276\303{U\304\2/\0kj9\352\252\357\237\320\356E\7\4\20V\322B^\35", 85) = 85
[pid 25482] 10:12:37.353733 write(11, "\25\3\3\0PQ\226\272\0205J\212\35\277LT\237%\2225zc\212I\276\227\314\213\23\352\304\354<\234[\313\375\0079S[\f\302\2670\366\202\237J\355\373\203\207(\233\227\360\316\fc\272!k\231\2014\225\303wy3\372\357\223\5\234\ra\22\26\206\214\376\220Q", 85) = 85
[pid 25482] 10:12:37.353929 close(11)   = 0
[pid 25482] 10:12:37.354001 close(13)   = 0
[pid 25482] 10:12:37.354038 munmap(0x7fdec5ab7000, 4096) = 0
[pid 25482] 10:12:37.354076 close(10)   = 0
[pid 25482] 10:12:37.354110 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25482] 10:12:37.354152 write(12, "S000004'\f\0\0", 11) = 11
[pid 25443] 10:12:37.354189 <... select resumed> ) = 1 (in [11], left {58, 214901})
[pid 25443] 10:12:37.354216 read(11, "S000004'\f\0\0", 16384) = 11
[pid 25443] 10:12:37.354400 wait4(-1, 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25443] 10:12:37.354441 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.354532 write(12, "X100145TLSv1.2:ECDHE-RSA-AES256-SHA384:256\0/C=US/ST=WA/L=Redmond/O=Microsoft/OU=Forefront Online Protection for Exchange/CN=mail.protection.outlook.com\0", 152) = 152
[pid 25443] 10:12:37.354568 <... select resumed> ) = 1 (in [11], left {59, 999896})
[pid 25443] 10:12:37.354596 read(11, "X100145TLSv1.2:ECDHE-RSA-AES256-SHA384:256\0/C=US/ST=WA/L=Redmond/O=Microsoft/OU=Forefront Online Protection for Exchange/CN=mail.protection.outlook.com\0", 16384) = 152
[pid 25443] 10:12:37.354652 wait4(-1, 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25443] 10:12:37.354696 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.354775 write(12, "X202575-----BEGIN CERTIFICATE-----\\nMIIHITCCBgmgAwIBAgIKaJVJ8AABAADfvjANBgkqhkiG9w0BAQUFADCBgDETMBEG\\nCgmSJomT8ixkARkWA2NvbTEZMBcGCgmSJomT8ixkARkWCW1pY3Jvc29mdDEUMBIG\\nCgmSJomT8ixkARkWBGNvcnAxFzAVBgoJkiaJk/IsZAEZFgdyZWRtb25kMR8wHQYD\\nVQQDExZNU0lUIE1hY2hpbm"..., 2582) = 2582
[pid 25443] 10:12:37.354810 <... select resumed> ) = 1 (in [11], left {59, 999909})
[pid 25443] 10:12:37.354833 read(11, "X202575-----BEGIN CERTIFICATE-----\\nMIIHITCCBgmgAwIBAgIKaJVJ8AABAADfvjANBgkqhkiG9w0BAQUFADCBgDETMBEG\\nCgmSJomT8ixkARkWA2NvbTEZMBcGCgmSJomT8ixkARkWCW1pY3Jvc29mdDEUMBIG\\nCgmSJomT8ixkARkWBGNvcnAxFzAVBgoJkiaJk/IsZAEZFgdyZWRtb25kMR8wHQYD\\nVQQDExZNU0lUIE1hY2hpbm"..., 16384) = 2582
[pid 25443] 10:12:37.355116 wait4(-1, 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25443] 10:12:37.355153 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.355183 write(12, "X4000021\0", 9) = 9
[pid 25443] 10:12:37.355211 <... select resumed> ) = 1 (in [11], left {59, 999962})
[pid 25443] 10:12:37.355233 read(11, "X4000021\0", 16384) = 9
[pid 25443] 10:12:37.355268 wait4(-1, 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25443] 10:12:37.355302 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.355328 write(12, "D000004\1\0\0\0", 11) = 11
[pid 25443] 10:12:37.355356 <... select resumed> ) = 1 (in [11], left {59, 999965})
[pid 25443] 10:12:37.355383 read(11, "D000004\1\0\0\0", 16384) = 11
[pid 25443] 10:12:37.355422 wait4(-1, 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25443] 10:12:37.355456 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.355559 write(12, "A000233\0=\0\0\2\0\0\0\0\0\0\001250 2.6.0 <E1aEJMY-0006cE-He@fin.finestweddingsites.com> [InternalId=78645146158546, Hostname=DM2PR05MB573.namprd05.prod.outlook.com] Queued mail for delivery\0\0radisson-com.mail.protection.outlook.com\000207.46.163.215\0\31\0\0\0000", 240) = 240
[pid 25443] 10:12:37.355593 <... select resumed> ) = 1 (in [11], left {59, 999950})
[pid 25443] 10:12:37.355632 read(11, "A000233\0=\0\0\2\0\0\0\0\0\0\001250 2.6.0 <E1aEJMY-0006cE-He@fin.finestweddingsites.com> [InternalId=78645146158546, Hostname=DM2PR05MB573.namprd05.prod.outlook.com] Queued mail for delivery\0\0radisson-com.mail.protection.outlook.com\000207.46.163.215\0\31\0\0\0000", 16384) = 240
[pid 25443] 10:12:37.355685 wait4(-1,  <unfinished ...>
[pid 25482] 10:12:37.355717 write(12, "I00002050.116.78.207\00041115\0", 27 <unfinished ...>
[pid 25443] 10:12:37.355726 <... wait4 resumed> 0x7ffd9471ca70, WNOHANG, NULL) = 0
[pid 25482] 10:12:37.355751 <... write resumed> ) = 27
[pid 25443] 10:12:37.355758 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25482] 10:12:37.355786 write(12, "Z0000010", 8 <unfinished ...>
[pid 25443] 10:12:37.355794 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25482] 10:12:37.355819 <... write resumed> ) = 8
[pid 25443] 10:12:37.355825 read(11,  <unfinished ...>
[pid 25482] 10:12:37.355847 close(12 <unfinished ...>
[pid 25443] 10:12:37.355853 <... read resumed> "I00002050.116.78.207\00041115\0Z0000010", 16384) = 35
[pid 25482] 10:12:37.355880 <... close resumed> ) = 0
[pid 25443] 10:12:37.355886 close(11 <unfinished ...>
[pid 25482] 10:12:37.356219 exit_group(0) = ?
[pid 25443] 10:12:37.356227 <... close resumed> ) = 0
[pid 25443] 10:12:37.356249 wait4(25482,  <unfinished ...>
[pid 25482] 10:12:37.356876 +++ exited with 0 +++
[pid 25443] 10:12:37.356913 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25482
[pid 25443] 10:12:37.356951 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.357018 write(8, "2015-12-30 10:12:37 rochelle.samms@radisson.com: remote_smtp transport succeeded\n", 81) = 81
[pid 25443] 10:12:37.357080 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.357142 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.357193 close(7)    = 0
[pid 25443] 10:12:37.357232 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25443] 10:12:37.357277 fcntl(7, F_GETFD) = 0
[pid 25443] 10:12:37.357309 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:37.357342 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5383181, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25443] 10:12:37.357388 write(7, "2015-12-30 10:12:37 [25443] 1aEJMY-0006cE-He => rochelle.samms@radisson.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3111 H=radisson-com.mail.protection.outlook.com [207."..., 605) = 605
[pid 25443] 10:12:37.357525 geteuid()   = 0
[pid 25443] 10:12:37.357567 getegid()   = 12
[pid 25443] 10:12:37.357607 setgid(12)  = 0
[pid 25443] 10:12:37.357654 setuid(47)  = 0
[pid 25443] 10:12:37.357705 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25443] 10:12:37.357757 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.357812 pipe([10, 11]) = 0
[pid 25443] 10:12:37.357850 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25443] 10:12:37.357891 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdec5aa2a90) = 25541
[pid 25443] 10:12:37.358133 close(10)   = 0
[pid 25443] 10:12:37.358170 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25443] 10:12:37.358211 fstat(11, {st_dev=makedev(0, 8), st_ino=2130169392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25443] 10:12:37.358258 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:37.358296 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25443] 10:12:37.358392 fstat(6, {st_dev=makedev(144, 4215), st_ino=124799976, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:34, st_mtime=2015/12/30-10:12:34, st_ctime=2015/12/30-10:12:34}) = 0
[pid 25443] 10:12:37.358445 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1056) = 1056
[pid 25443] 10:12:37.358572 lseek(6, 19, SEEK_SET) = 19
[pid 25443] 10:12:37.358616 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25443] 10:12:37.358684 read(6, "", 8192) = 0
[pid 25443] 10:12:37.358727 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006cE-He; Wed, 30 Dec 2015 10:12:34 -0600\nTo:  rochelle.samms"..., 2428) = 2428
[pid 25443] 10:12:37.358768 write(11, "\n--1451491957-eximdsn-2019261844--\n", 35) = 35
[pid 25443] 10:12:37.358803 close(11)   = 0
[pid 25443] 10:12:37.358836 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:37.358878 wait4(25541,  <unfinished ...>
[pid 25530] 10:12:37.359342 read(8,  <unfinished ...>
[pid 25529] 10:12:37.359375 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.359433 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.359548 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336b000
[pid 25529] 10:12:37.359600 lseek(11, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.359644 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25529] 10:12:37.359732 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25529] 10:12:37.359783 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.359831 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336a000
[pid 25529] 10:12:37.359867 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.359920 close(12)   = 0
[pid 25529] 10:12:37.359955 munmap(0x7f21d336a000, 4096) = 0
[pid 25529] 10:12:37.360013 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.360079 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.360139 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 12
[pid 25529] 10:12:37.360186 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.360234 fstat(12, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.360279 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336a000
[pid 25529] 10:12:37.360315 lseek(12, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.360348 read(12, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25529] 10:12:37.360394 read(12, "", 4096) = 0
[pid 25529] 10:12:37.360477 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2964, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:37.360635 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY) = 13
[pid 25529] 10:12:37.360682 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffce2cfdd60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.360722 lseek(13, 0, SEEK_CUR) = 0
[pid 25529] 10:12:37.360758 fstat(13, {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2964, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:37.360805 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.360888 read(13, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2964
[pid 25530] 10:12:37.361380 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25530] 10:12:37.361638 brk(0x2133000 <unfinished ...>
[pid 25533] 10:12:37.361685 <... stat resumed> 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361711 stat("/usr/local/cpanel/Errno.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361762 stat("/etc/exim/perl/Errno.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361803 stat("/etc/exim/perl/Errno.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361843 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361881 stat("/usr/local/cpanel/Errno.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361922 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.361970 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.362014 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.362058 <... brk resumed> ) = 0x2133000
[pid 25530] 10:12:37.362854 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25533] 10:12:37.362892 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.362944 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.362991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25533] 10:12:37.363050 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25533] 10:12:37.363098 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe92d46e00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25533] 10:12:37.363137 lseek(9, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.363199 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25533] 10:12:37.363425 brk(0xaec000 <unfinished ...>
[pid 25529] 10:12:37.363553 read(13,  <unfinished ...>
[pid 25533] 10:12:37.363580 <... brk resumed> ) = 0xaec000
[pid 25533] 10:12:37.364012 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.364045 <... read resumed> "", 8192) = 0
[pid 25529] 10:12:37.364077 close(13)   = 0
[pid 25529] 10:12:37.364153 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.364231 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.364304 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.364393 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25529] 10:12:37.364521 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.364577 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3369000
[pid 25529] 10:12:37.364616 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.364670 close(13)   = 0
[pid 25529] 10:12:37.364705 munmap(0x7f21d3369000, 4096) = 0
[pid 25529] 10:12:37.364753 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.364804 pipe([13, 14]) = 0
[pid 25529] 10:12:37.364843 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:37.364885 close(10)   = 0
[pid 25529] 10:12:37.364920 munmap(0x7f21d336c000, 4096) = 0
[pid 25529] 10:12:37.364957 close(11)   = 0
[pid 25529] 10:12:37.364991 munmap(0x7f21d336b000, 4096) = 0
[pid 25529] 10:12:37.365026 close(12)   = 0
[pid 25529] 10:12:37.365060 munmap(0x7f21d336a000, 4096) = 0
[pid 25529] 10:12:37.365096 close(9)    = 0
[pid 25529] 10:12:37.365129 munmap(0x7f21d336d000, 4096) = 0
[pid 25529] 10:12:37.365165 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25542
[pid 25533] 10:12:37.365461 <... lseek resumed> ) = 4868
[pid 25533] 10:12:37.365483 lseek(9, 0, SEEK_CUR) = 4868
[pid 25533] 10:12:37.365517 close(9)    = 0
[pid 25533] 10:12:37.365638 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365686 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365729 stat("/etc/exim/perl/Exporter.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365767 stat("/etc/exim/perl/Exporter.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365806 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365845 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365884 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.365928 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffe92d47010) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.365993 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.366017 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25530] 10:12:37.366040 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25533] 10:12:37.366066 <... stat resumed> 0x7ffe92d470b0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.366087 <... stat resumed> 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.366117 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25533] 10:12:37.366140 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25530] 10:12:37.366196 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.366216 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25533] 10:12:37.366238 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25530] 10:12:37.366261 <... stat resumed> 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.366288 <... open resumed> ) = 9
[pid 25530] 10:12:37.366310 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.366347 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25533] 10:12:37.366370 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25530] 10:12:37.366393 <... stat resumed> 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.366413 <... ioctl resumed> , 0x7ffe92d46e00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.366438 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25533] 10:12:37.366460 lseek(9, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.366498 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.366605 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.366671 close(14 <unfinished ...>
[pid 25533] 10:12:37.366702 read(9,  <unfinished ...>
[pid 25530] 10:12:37.366727 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.366772 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25529] 10:12:37.366797 <... close resumed> ) = 0
[pid 25533] 10:12:37.367214 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25530] 10:12:37.367247 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25529] 10:12:37.367272 read(13,  <unfinished ...>
[pid 25530] 10:12:37.367298 <... stat resumed> 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.367325 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.367368 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25530] 10:12:37.367426 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25530] 10:12:37.367471 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276a7e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.367509 lseek(9, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.367650 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25530] 10:12:37.367863 brk(0x2154000) = 0x2154000
[pid 25530] 10:12:37.368301 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.368334 <... lseek resumed> ) = 2366
[pid 25533] 10:12:37.368356 lseek(9, 0, SEEK_CUR) = 2366
[pid 25533] 10:12:37.368391 close(9)    = 0
[pid 25533] 10:12:37.368788 read(8,  <unfinished ...>
[pid 25530] 10:12:37.368820 <... lseek resumed> ) = 4868
[pid 25530] 10:12:37.368841 lseek(9, 0, SEEK_CUR) = 4868
[pid 25530] 10:12:37.368875 close(9)    = 0
[pid 25530] 10:12:37.368926 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.368970 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369011 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369048 stat("/etc/exim/perl/Exporter.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369087 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369125 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369164 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369205 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd1276a9f0) = -1 ENOENT (No such file or directory)
[pid 25533] 10:12:37.369246 <... read resumed> "", 8192) = 0
[pid 25533] 10:12:37.369269 close(8 <unfinished ...>
[pid 25530] 10:12:37.369291 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25533] 10:12:37.369314 <... close resumed> ) = 0
[pid 25530] 10:12:37.369337 <... stat resumed> 0x7ffd1276aa90) = -1 ENOENT (No such file or directory)
[pid 25530] 10:12:37.369391 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25530] 10:12:37.369459 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25530] 10:12:37.369600 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd1276a7e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25530] 10:12:37.369645 lseek(9, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.369700 read(9,  <unfinished ...>
[pid 25533] 10:12:37.369881 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25530] 10:12:37.369914 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25530] 10:12:37.370343 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25533] 10:12:37.370382 <... open resumed> ) = 8
[pid 25533] 10:12:37.370406 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25533] 10:12:37.370459 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840c000
[pid 25533] 10:12:37.370499 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25533] 10:12:37.370622 close(8)    = 0
[pid 25533] 10:12:37.370667 munmap(0x7f403840c000, 4096) = 0
[pid 25533] 10:12:37.370753 lseek(6, 19, SEEK_SET) = 19
[pid 25533] 10:12:37.370794 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.370834 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.370871 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.370908 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.370944 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.370987 alarm(300)  = 0
[pid 25533] 10:12:37.371023 alarm(0)    = 300
[pid 25533] 10:12:37.371056 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.371092 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.371127 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.371163 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.371198 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f40372c4790}, NULL, 8) = 0
[pid 25533] 10:12:37.371235 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, 8) = 0
[pid 25533] 10:12:37.371274 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, 8) = 0
[pid 25533] 10:12:37.371321 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.371391 open("/var/spool/exim/input/b/hdr.25533", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25533] 10:12:37.371495 fchown(8, 47, 12) = 0
[pid 25533] 10:12:37.371613 fchmod(8, 0640) = 0
[pid 25533] 10:12:37.371653 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25533] 10:12:37.371692 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080178, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.371741 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25530] 10:12:37.371763 <... lseek resumed> ) = 2366
[pid 25533] 10:12:37.371784 <... mmap resumed> ) = 0x7f403840c000
[pid 25530] 10:12:37.371804 lseek(9, 0, SEEK_CUR) = 2366
[pid 25533] 10:12:37.371837 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25530] 10:12:37.371858 close(9 <unfinished ...>
[pid 25533] 10:12:37.371877 <... lseek resumed> ) = 0
[pid 25530] 10:12:37.371898 <... close resumed> ) = 0
[pid 25533] 10:12:37.371932 write(8, "1aEJMb-0006dp-8u-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 75\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25530] 10:12:37.372240 read(8,  <unfinished ...>
[pid 25533] 10:12:37.372278 <... write resumed> ) = 268
[pid 25533] 10:12:37.372300 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080178, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.372356 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMb-0006dp-8u\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:37 -0600\n144  X-Failed-Recipients: Jennifer.Gonzales@onehospitalitygroup.com,\n  gretchen"..., 779) = 779
[pid 25533] 10:12:37.372398 fsync(8 <unfinished ...>
[pid 25530] 10:12:37.372463 <... read resumed> "", 8192) = 0
[pid 25530] 10:12:37.372499 close(8)    = 0
[pid 25530] 10:12:37.372827 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25533] 10:12:37.372860 <... fsync resumed> ) = 0
[pid 25533] 10:12:37.372881 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080178, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1047, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.372930 close(8)    = 0
[pid 25533] 10:12:37.372966 munmap(0x7f403840c000, 4096) = 0
[pid 25533] 10:12:37.373011 rename("/var/spool/exim/input/b/hdr.25533", "/var/spool/exim/input/b/1aEJMb-0006dp-8u-H") = 0
[pid 25533] 10:12:37.373079 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25533] 10:12:37.373122 fsync(8)    = 0
[pid 25533] 10:12:37.373158 close(8)    = 0
[pid 25533] 10:12:37.373195 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080174, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=5192, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.373256 open("/var/spool/exim/msglog/b/1aEJMb-0006dp-8u", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25533] 10:12:37.373325 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25533] 10:12:37.373373 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080180, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.373437 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f403840c000
[pid 25533] 10:12:37.373476 lseek(8, 0, SEEK_CUR) = 0
[pid 25533] 10:12:37.373512 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.373645 write(8, "2015-12-30 10:12:37 Received from <> R=1aEJMZ-0006ce-8t U=mailnull P=local S=5903 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25533] 10:12:37.373693 close(8)    = 0
[pid 25533] 10:12:37.373728 munmap(0x7f403840c000, 4096) = 0
[pid 25533] 10:12:37.373770 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.373829 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25533] 10:12:37.373880 close(7)    = 0
[pid 25533] 10:12:37.373919 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25533] 10:12:37.373965 fcntl(7, F_GETFD) = 0
[pid 25533] 10:12:37.373999 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25533] 10:12:37.374033 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5383786, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25533] 10:12:37.374079 write(7, "2015-12-30 10:12:37 [25533] 1aEJMb-0006dp-8u <= <> R=1aEJMZ-0006ce-8t U=mailnull P=local S=5903 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25533] 10:12:37.374122 close(6)    = 0
[pid 25533] 10:12:37.374159 munmap(0x7f403840d000, 4096) = 0
[pid 25533] 10:12:37.374197 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, 8) = 0
[pid 25533] 10:12:37.374244 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f403600d6a0}, 8) = 0
[pid 25533] 10:12:37.374285 open("/proc/loadavg", O_RDONLY) = 6
[pid 25533] 10:12:37.374336 read(6, "0.18 0.08 0.01 4/255 25542\n", 40) = 27
[pid 25533] 10:12:37.374378 close(6)    = 0
[pid 25533] 10:12:37.374427 clone( <unfinished ...>
[pid 25530] 10:12:37.374602 <... open resumed> ) = 8
[pid 25530] 10:12:37.374627 fstat(8,  <unfinished ...>
[pid 25533] 10:12:37.374833 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f40383f7a90) = 25543
[pid 25530] 10:12:37.374859 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25530] 10:12:37.374892 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc5000
[pid 25530] 10:12:37.374930 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25530] 10:12:37.374977 close(8)    = 0
[pid 25530] 10:12:37.375012 munmap(0x7f2293dc5000, 4096) = 0
[pid 25530] 10:12:37.375090 lseek(6, 19, SEEK_SET) = 19
[pid 25530] 10:12:37.375130 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375168 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375203 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375238 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375272 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375309 alarm(300)  = 0
[pid 25530] 10:12:37.375343 alarm(0)    = 300
[pid 25530] 10:12:37.375376 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375413 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375447 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375482 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375516 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f2292c7d790}, NULL, 8) = 0
[pid 25530] 10:12:37.375625 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, 8) = 0
[pid 25530] 10:12:37.375667 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, 8) = 0
[pid 25530] 10:12:37.375711 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.375772 open("/var/spool/exim/input/b/hdr.25530", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25533] 10:12:37.376091 exit_group(0) = ?
[pid 25530] 10:12:37.376117 fchown(8, 47, 12) = 0
[pid 25530] 10:12:37.376155 fchmod(8, 0640) = 0
[pid 25530] 10:12:37.376191 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25530] 10:12:37.376229 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.376276 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc5000
[pid 25530] 10:12:37.376316 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.376372 write(8, "1aEJMb-0006dm-9U-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 425) = 425
[pid 25530] 10:12:37.376419 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=425, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.376470 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006dm-9U; Wed, 30 Dec 2015 10:12:37 -0600\n067T To:  wendy.laws@hilton.com, embassy-airport@finestweddingsit"..., 550) = 550
[pid 25530] 10:12:37.376509 fsync(8 <unfinished ...>
[pid 25533] 10:12:37.376891 +++ exited with 0 +++
[pid 25473] 10:12:37.376929 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25533
[pid 25473] 10:12:37.376956 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f7c138a86a0}, 8) = 0
[pid 25473] 10:12:37.377015 write(8, "2015-12-30 10:12:37 embassytempe@finestweddingsites.com: children all complete\n", 79) = 79
[pid 25473] 10:12:37.377064 open("/var/spool/exim/input/Z/hdr.25473", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25473] 10:12:37.377131 fchown(10, 47, 12) = 0
[pid 25473] 10:12:37.377169 fchmod(10, 0640) = 0
[pid 25473] 10:12:37.377205 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25473] 10:12:37.377244 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25473] 10:12:37.377292 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7c15ca8000
[pid 25473] 10:12:37.377328 lseek(10, 0, SEEK_CUR) = 0
[pid 25473] 10:12:37.377376 write(10, "1aEJMZ-0006ce-8t-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 829) = 829
[pid 25473] 10:12:37.377423 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=829, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25473] 10:12:37.377480 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006ce-8t; Wed, 30 Dec 2015 10:12:35 -0600\n124T To:  gretchen.murry@onehospitalitygroup.com, Jennifer.Gonzal"..., 607) = 607
[pid 25473] 10:12:37.377612 fsync(10Process 25541 attached
 <unfinished ...>
[pid 25541] 10:12:37.377734 set_robust_list(0x7fdec5aa2aa0, 24) = 0
[pid 25541] 10:12:37.377793 close(0)    = 0
[pid 25473] 10:12:37.377879 <... fsync resumed> ) = 0
[pid 25473] 10:12:37.377900 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1436, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25473] 10:12:37.377947 close(10)   = 0
[pid 25473] 10:12:37.377981 munmap(0x7f7c15ca8000, 4096) = 0
[pid 25473] 10:12:37.378024 rename("/var/spool/exim/input/Z/hdr.25473", "/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-H") = 0
[pid 25473] 10:12:37.378110 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25473] 10:12:37.378153 fsync(10)   = 0
[pid 25473] 10:12:37.378186 close(10)   = 0
[pid 25473] 10:12:37.378225 unlink("/var/spool/exim/msglog/Z/1aEJMZ-0006ce-8t") = 0
[pid 25473] 10:12:37.378282 unlink("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-D") = 0
[pid 25473] 10:12:37.378329 unlink("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-H") = 0
[pid 25473] 10:12:37.378397 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:37.378462 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25473] 10:12:37.378515 close(7)    = 0
[pid 25473] 10:12:37.378643 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25473] 10:12:37.378688 fcntl(7, F_GETFD) = 0
[pid 25473] 10:12:37.378722 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25473] 10:12:37.378754 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5383990, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25473] 10:12:37.378800 write(7, "2015-12-30 10:12:37 [25473] 1aEJMZ-0006ce-8t Completed QT=2s\n", 61) = 61
[pid 25473] 10:12:37.378842 close(8)    = 0
[pid 25473] 10:12:37.378891 munmap(0x7f7c15ca9000, 4096) = 0
[pid 25473] 10:12:37.378930 close(9)    = 0
[pid 25473] 10:12:37.379017 unlink("/var/spool/exim/input/Z/1aEJMZ-0006ce-8t-J") = 0
[pid 25473] 10:12:37.379091 close(6)    = 0
[pid 25473] 10:12:37.379266 exit_group(0) = ?
[pid 25473] 10:12:37.380014 +++ exited with 0 +++
[pid 25530] 10:12:37.380094 <... fsync resumed> ) = 0
[pid 25530] 10:12:37.380118 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=975, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.380168 close(8)    = 0
[pid 25530] 10:12:37.380203 munmap(0x7f2293dc5000, 4096) = 0
[pid 25530] 10:12:37.380245 rename("/var/spool/exim/input/b/hdr.25530", "/var/spool/exim/input/b/1aEJMb-0006dm-9U-H") = 0
[pid 25530] 10:12:37.380308 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25530] 10:12:37.380350 fsync(8)    = 0
[pid 25530] 10:12:37.380385 close(8)    = 0
[pid 25530] 10:12:37.380419 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.380480 open("/var/spool/exim/msglog/b/1aEJMb-0006dm-9U", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25530] 10:12:37.380598 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25530] 10:12:37.380636 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.380682 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2293dc5000
[pid 25530] 10:12:37.380719 lseek(8, 0, SEEK_CUR) = 0
[pid 25530] 10:12:37.380755 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.380812 write(8, "2015-12-30 10:12:37 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2369 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148) = 148
[pid 25530] 10:12:37.380858 close(8)    = 0
[pid 25530] 10:12:37.380892 munmap(0x7f2293dc5000, 4096) = 0
[pid 25530] 10:12:37.380932 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.380995 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25530] 10:12:37.381049 close(7)    = 0
[pid 25530] 10:12:37.381087 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25530] 10:12:37.381127 fcntl(7, F_GETFD) = 0
[pid 25530] 10:12:37.381159 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25530] 10:12:37.381191 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384051, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25530] 10:12:37.381236 write(7, "2015-12-30 10:12:37 [25530] 1aEJMb-0006dm-9U <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2369 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for wendy.laws@hilton.com embassy-airport@finestwed"..., 304) = 304
[pid 25530] 10:12:37.381278 close(6)    = 0
[pid 25530] 10:12:37.381315 munmap(0x7f2293dc6000, 4096) = 0
[pid 25530] 10:12:37.381352 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, 8) = 0
[pid 25530] 10:12:37.381399 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f22919c66a0}, 8) = 0
[pid 25530] 10:12:37.381446 open("/proc/loadavg", O_RDONLY) = 6
[pid 25530] 10:12:37.381492 read(6, "0.18 0.08 0.01 4/254 25543\n", 40) = 27
[pid 25530] 10:12:37.381610 close(6)    = 0
[pid 25530] 10:12:37.381659 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2293db0a90) = 25544
[pid 25541] 10:12:37.381916 dup2(10, 0) = 0
[pid 25541] 10:12:37.381953 close(10)   = 0
[pid 25541] 10:12:37.381986 close(11)   = 0
[pid 25541] 10:12:37.382031 fstat(0, {st_dev=makedev(0, 8), st_ino=2130169392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.382080 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25541] 10:12:37.382125 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25541] 10:12:37.382175 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMY-0006cE-He"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25530] 10:12:37.382812 exit_group(0) = ?
[pid 25541] 10:12:37.382886 <... execve resumed> ) = 0
[pid 25541] 10:12:37.382925 brk(0 <unfinished ...>
[pid 25530] 10:12:37.383160 +++ exited with 0 +++
[pid 25389] 10:12:37.383194 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25530
[pid 25389] 10:12:37.383220 munmap(0x7ff3d4f3d000, 4096) = 0
[pid 25389] 10:12:37.383364 pipe2([5, 6], O_CLOEXEC) = 0
[pid 25389] 10:12:37.383410 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff3d4f3fab0) = 25545
[pid 25389] 10:12:37.384014 close(5)    = 0
[pid 25389] 10:12:37.384052 fcntl(6, F_SETFD, 0) = 0
[pid 25389] 10:12:37.384089 fstat(6, {st_dev=makedev(0, 8), st_ino=2130169415, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25389] 10:12:37.384137 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3d4f3d000
[pid 25389] 10:12:37.384182 write(6, "To:  kgallagher@mcdowellmountaingc.com, mcdowell-mountain@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head>"..., 2102) = 2102
[pid 25389] 10:12:37.384224 close(6)    = 0
[pid 25537] 10:12:37.384267 <... select resumed> ) = 1 (in [11], left {299, 963765})
[pid 25389] 10:12:37.384279 wait4(25545,  <unfinished ...>
[pid 25537] 10:12:37.384304 recvfrom(11, "220 ready for tls\r\n", 4096, 0, NULL, NULL) = 19
[pid 25537] 10:12:37.386603 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25537] 10:12:37.386681 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25537] 10:12:37.386753 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25537] 10:12:37.386799 read(14, "\226\na\345\370\31\207\32\256\303\277\377\342r\364\313\26\311\230\245\274\311\204\253\365\265\344\256\37%\336\372\264B^\367o\201GY\242'B\333;\264e\370", 48) = 48
[pid 25537] 10:12:37.386844 close(14)   = 0
[pid 25537] 10:12:37.386894 getuid()    = 47
[pid 25541] 10:12:37.391586 <... brk resumed> ) = 0x13c0000
[pid 25541] 10:12:37.391623 fcntl(0, F_GETFD) = 0
[pid 25541] 10:12:37.391664 fcntl(1, F_GETFD) = 0
[pid 25541] 10:12:37.391704 fcntl(2, F_GETFD) = 0
[pid 25541] 10:12:37.391751 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.391812 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f974f000
[pid 25541] 10:12:37.391873 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.391927 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.391975 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392014 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392052 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392090 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392129 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392167 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392206 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25541] 10:12:37.392258 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392305 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392345 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392386 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392429 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392471 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392603 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392660 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25541] 10:12:37.392758 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392800 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.392839 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.393580 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.393630 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.393677 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffea6d53d50) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.393725 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.393771 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25541] 10:12:37.393842 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25541] 10:12:37.393882 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25541] 10:12:37.393930 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fa5f9745000
[pid 25541] 10:12:37.393969 close(6)    = 0
[pid 25541] 10:12:37.394013 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25541] 10:12:37.394058 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.394104 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.394154 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f9317000
[pid 25541] 10:12:37.394193 mprotect(0x7fa5f932d000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.394234 mmap(0x7fa5f952d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fa5f952d000
[pid 25541] 10:12:37.394281 mmap(0x7fa5f952f000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f952f000
[pid 25541] 10:12:37.394326 close(6)    = 0
[pid 25541] 10:12:37.394369 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.394419 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.394465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.394511 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25541] 10:12:37.394637 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.394698 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.394749 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9744000
[pid 25541] 10:12:37.394792 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f90fe000
[pid 25541] 10:12:37.394832 mprotect(0x7fa5f9114000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.394871 mmap(0x7fa5f9313000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fa5f9313000
[pid 25541] 10:12:37.394916 mmap(0x7fa5f9315000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9315000
[pid 25541] 10:12:37.394967 close(6)    = 0
[pid 25541] 10:12:37.395010 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395055 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395147 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25541] 10:12:37.395191 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.395234 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.395283 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f8ec7000
[pid 25541] 10:12:37.395323 mprotect(0x7fa5f8ece000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.395361 mmap(0x7fa5f90ce000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fa5f90ce000
[pid 25541] 10:12:37.395406 mmap(0x7fa5f90d0000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f90d0000
[pid 25541] 10:12:37.395453 close(6)    = 0
[pid 25541] 10:12:37.395496 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395628 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395676 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.395720 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25541] 10:12:37.395763 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.395806 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.395855 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f8c43000
[pid 25541] 10:12:37.395895 mprotect(0x7fa5f8cc6000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.395933 mmap(0x7fa5f8ec5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fa5f8ec5000
[pid 25541] 10:12:37.395982 close(6)    = 0
[pid 25541] 10:12:37.396025 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.396069 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.396115 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.396181 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25541] 10:12:37.396228 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.396271 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25541] 10:12:37.396321 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9743000
[pid 25541] 10:12:37.396364 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f8a35000
[pid 25541] 10:12:37.396404 mprotect(0x7fa5f8a41000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.396444 mmap(0x7fa5f8c41000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fa5f8c41000
[pid 25541] 10:12:37.396494 close(6)    = 0
[pid 25541] 10:12:37.396629 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25541] 10:12:37.396683 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.396727 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25541] 10:12:37.396778 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f8812000
[pid 25541] 10:12:37.396819 mprotect(0x7fa5f8833000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.396858 mmap(0x7fa5f8a33000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fa5f8a33000
[pid 25541] 10:12:37.396904 close(6)    = 0
[pid 25541] 10:12:37.396946 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.396992 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.397037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.397082 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25541] 10:12:37.397125 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.397169 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.397224 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f85f5000
[pid 25541] 10:12:37.397265 mprotect(0x7fa5f860c000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.397304 mmap(0x7fa5f880c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fa5f880c000
[pid 25541] 10:12:37.397351 mmap(0x7fa5f880e000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f880e000
[pid 25541] 10:12:37.397397 close(6)    = 0
[pid 25541] 10:12:37.397629 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.397678 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.397723 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.397768 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25541] 10:12:37.397810 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.397853 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25541] 10:12:37.397903 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9742000
[pid 25541] 10:12:37.397945 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f8281000
[pid 25541] 10:12:37.397985 mprotect(0x7fa5f83f0000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.398026 mmap(0x7fa5f85ef000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fa5f85ef000
[pid 25541] 10:12:37.398076 close(6)    = 0
[pid 25541] 10:12:37.398120 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.398165 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.398490 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.398610 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.398665 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25541] 10:12:37.398711 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.398755 fstat(6, Process 25542 attached
{st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25541] 10:12:37.398832 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f7ff2000
[pid 25542] 10:12:37.398895 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25541] 10:12:37.398926 mprotect(0x7fa5f807d000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.398966 mmap(0x7fa5f827d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fa5f827d000
[pid 25542] 10:12:37.399010 <... set_robust_list resumed> ) = 0
[pid 25542] 10:12:37.399053 close(13 <unfinished ...>
[pid 25541] 10:12:37.399087 mmap(0x7fa5f8280000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f8280000
[pid 25541] 10:12:37.399133 close(6)    = 0
[pid 25541] 10:12:37.399176 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.399207 <... close resumed> ) = 0
[pid 25542] 10:12:37.399235 geteuid( <unfinished ...>
[pid 25541] 10:12:37.399269 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.399290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.399319 <... geteuid resumed> ) = 0
[pid 25541] 10:12:37.399347 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25542] 10:12:37.399370 getegid()   = 12
[pid 25542] 10:12:37.399407 setgid(500 <unfinished ...>
[pid 25541] 10:12:37.399435 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25542] 10:12:37.399478 <... setgid resumed> ) = 0
[pid 25542] 10:12:37.399498 setuid(503) = 0
[pid 25541] 10:12:37.399605 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25541] 10:12:37.399689 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.399745 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25542] 10:12:37.399811 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.399844 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f7dec000
[pid 25541] 10:12:37.399884 mprotect(0x7fa5f7df2000, 2093056, PROT_NONE) = 0
[pid 25542] 10:12:37.399931 <... open resumed> ) = 9
[pid 25541] 10:12:37.399951 mmap(0x7fa5f7ff1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fa5f7ff1000
[pid 25542] 10:12:37.399999 fstat(9,  <unfinished ...>
[pid 25541] 10:12:37.400031 close(6)    = 0
[pid 25541] 10:12:37.400071 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.400101 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25542] 10:12:37.400172 brk(0x23fb000 <unfinished ...>
[pid 25541] 10:12:37.400208 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.400228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25541] 10:12:37.400273 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.400323 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25541] 10:12:37.400373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9741000
[pid 25541] 10:12:37.400415 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25542] 10:12:37.400445 <... brk resumed> ) = 0x23fb000
[pid 25541] 10:12:37.400470 <... mmap resumed> ) = 0x7fa5f7ab6000
[pid 25541] 10:12:37.400602 mprotect(0x7fa5f7be2000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.400657 mmap(0x7fa5f7de2000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fa5f7de2000
[pid 25541] 10:12:37.400714 mmap(0x7fa5f7deb000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f7deb000
[pid 25541] 10:12:37.400760 close(6)    = 0
[pid 25542] 10:12:37.400828 fstat(9,  <unfinished ...>
[pid 25541] 10:12:37.400864 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.400909 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.400965 <... open resumed> ) = 14
[pid 25541] 10:12:37.400985 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25542] 10:12:37.401029 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25542] 10:12:37.401063 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.401093 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.401124 <... mmap resumed> ) = 0x7f21d336d000
[pid 25537] 10:12:37.401155 fstat(14,  <unfinished ...>
[pid 25541] 10:12:37.401193 <... open resumed> ) = 6
[pid 25542] 10:12:37.401213 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25541] 10:12:37.401265 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.401309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.401343 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.401370 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.401399 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25537] 10:12:37.401441 <... mmap resumed> ) = 0x7f3c0be4a000
[pid 25542] 10:12:37.401463 read(9,  <unfinished ...>
[pid 25541] 10:12:37.401491 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.401520 read(14,  <unfinished ...>
[pid 25542] 10:12:37.401639 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25541] 10:12:37.401669 <... mmap resumed> ) = 0x7fa5f78b2000
[pid 25537] 10:12:37.401695 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25541] 10:12:37.401720 mprotect(0x7fa5f78b4000, 2097152, PROT_NONE <unfinished ...>
[pid 25542] 10:12:37.401751 close(9 <unfinished ...>
[pid 25537] 10:12:37.401792 read(14,  <unfinished ...>
[pid 25541] 10:12:37.401823 <... mprotect resumed> ) = 0
[pid 25542] 10:12:37.401845 <... close resumed> ) = 0
[pid 25541] 10:12:37.401865 mmap(0x7fa5f7ab4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25542] 10:12:37.401893 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25541] 10:12:37.401925 <... mmap resumed> ) = 0x7fa5f7ab4000
[pid 25542] 10:12:37.401949 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.401971 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25542] 10:12:37.402382 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25541] 10:12:37.402429 close(6)    = 0
[pid 25541] 10:12:37.402621 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.402672 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.402718 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.402762 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25541] 10:12:37.402806 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.402850 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.402901 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f76af000
[pid 25537] 10:12:37.402965 read(14,  <unfinished ...>
[pid 25541] 10:12:37.402993 mprotect(0x7fa5f76b1000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.403034 mmap(0x7fa5f78b0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fa5f78b0000
[pid 25541] 10:12:37.403084 close(6 <unfinished ...>
[pid 25537] 10:12:37.403121 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25537] 10:12:37.403157 read(14,  <unfinished ...>
[pid 25541] 10:12:37.403185 <... close resumed> ) = 0
[pid 25541] 10:12:37.403212 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.403244 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25541] 10:12:37.403274 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.403362 read(14,  <unfinished ...>
[pid 25541] 10:12:37.403394 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.403441 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.403485 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25541] 10:12:37.403609 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.403660 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.403711 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f9740000
[pid 25541] 10:12:37.403755 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f731b000
[pid 25537] 10:12:37.403814 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25537] 10:12:37.403850 read(14,  <unfinished ...>
[pid 25541] 10:12:37.403878 mprotect(0x7fa5f74a5000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.403918 mmap(0x7fa5f76a5000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25537] 10:12:37.403949 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25541] 10:12:37.403976 <... mmap resumed> ) = 0x7fa5f76a5000
[pid 25537] 10:12:37.404055 read(14,  <unfinished ...>
[pid 25541] 10:12:37.404091 mmap(0x7fa5f76aa000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f76aa000
[pid 25541] 10:12:37.404137 close(6)    = 0
[pid 25541] 10:12:37.404182 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.404228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.404273 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.404324 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25537] 10:12:37.404406 read(14,  <unfinished ...>
[pid 25541] 10:12:37.404440 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25541] 10:12:37.404485 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.404606 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25541] 10:12:37.404665 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f70af000
[pid 25541] 10:12:37.404707 mprotect(0x7fa5f7111000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.404746 mmap(0x7fa5f7310000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fa5f7310000
[pid 25541] 10:12:37.404797 close(6 <unfinished ...>
[pid 25537] 10:12:37.404828 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25537] 10:12:37.404912 read(14,  <unfinished ...>
[pid 25541] 10:12:37.404943 <... close resumed> ) = 0
[pid 25541] 10:12:37.404973 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.405019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.405065 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.405110 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.405140 <... lseek resumed> ) = 19
[pid 25541] 10:12:37.405166 <... open resumed> ) = 6
[pid 25542] 10:12:37.405187 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2376) = 1858
[pid 25541] 10:12:37.405592 read(6,  <unfinished ...>
[pid 25537] 10:12:37.405632 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25541] 10:12:37.405659 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.405703 read(14,  <unfinished ...>
[pid 25541] 10:12:37.405733 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25541] 10:12:37.405783 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f6ccc000
[pid 25537] 10:12:37.405828 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25541] 10:12:37.405852 mprotect(0x7fa5f6e85000, 2093056, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.405947 read(14,  <unfinished ...>
[pid 25541] 10:12:37.405988 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.406009 mmap(0x7fa5f7084000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fa5f7084000
[pid 25541] 10:12:37.406057 mmap(0x7fa5f70ab000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fa5f70ab000
[pid 25541] 10:12:37.406104 close(6)    = 0
[pid 25541] 10:12:37.406149 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.406196 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.406264 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25537] 10:12:37.406362 read(14,  <unfinished ...>
[pid 25541] 10:12:37.406395 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.406444 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25541] 10:12:37.406490 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.406621 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25541] 10:12:37.406676 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f973f000
[pid 25541] 10:12:37.406720 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f6a9f000
[pid 25537] 10:12:37.406764 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25537] 10:12:37.406853 read(14,  <unfinished ...>
[pid 25541] 10:12:37.406884 mprotect(0x7fa5f6acb000, 2097152, PROT_NONE) = 0
[pid 25541] 10:12:37.406924 mmap(0x7fa5f6ccb000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fa5f6ccb000
[pid 25541] 10:12:37.407031 close(6)    = 0
[pid 25541] 10:12:37.407081 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25541] 10:12:37.407136 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.407180 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25537] 10:12:37.407232 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25541] 10:12:37.407258 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.407340 read(14,  <unfinished ...>
[pid 25541] 10:12:37.407374 <... mmap resumed> ) = 0x7fa5f689a000
[pid 25541] 10:12:37.407395 mprotect(0x7fa5f689f000, 2093056, PROT_NONE) = 0
[pid 25541] 10:12:37.407436 mmap(0x7fa5f6a9e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7fa5f6a9e000
[pid 25541] 10:12:37.407485 close(6)    = 0
[pid 25541] 10:12:37.407592 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.407648 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25537] 10:12:37.407722 read(14,  <unfinished ...>
[pid 25541] 10:12:37.407754 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.407815 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.407863 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.408051 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25541] 10:12:37.408087 <... open resumed> ) = 6
[pid 25541] 10:12:37.408108 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.408151 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25541] 10:12:37.408203 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.408235 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25541] 10:12:37.408271 <... mmap resumed> ) = 0x7fa5f6697000
[pid 25537] 10:12:37.408303 read(14,  <unfinished ...>
[pid 25541] 10:12:37.408331 mprotect(0x7fa5f6699000, 2093056, PROT_NONE) = 0
[pid 25537] 10:12:37.408372 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25541] 10:12:37.408398 mmap(0x7fa5f6898000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25537] 10:12:37.408509 read(14,  <unfinished ...>
[pid 25541] 10:12:37.408620 <... mmap resumed> ) = 0x7fa5f6898000
[pid 25541] 10:12:37.408651 close(6)    = 0
[pid 25541] 10:12:37.408709 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.408758 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.408803 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.408847 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25541] 10:12:37.408893 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.408938 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25541] 10:12:37.408962 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.409042 read(14,  <unfinished ...>
[pid 25541] 10:12:37.409071 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25541] 10:12:37.409106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f973e000
[pid 25541] 10:12:37.409150 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fa5f6474000
[pid 25541] 10:12:37.409193 mprotect(0x7fa5f648b000, 2097152, PROT_NONE) = 0
[pid 25542] 10:12:37.409245 <... write resumed> ) = 4
[pid 25529] 10:12:37.409261 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25529] 10:12:37.409284 read(13,  <unfinished ...>
[pid 25541] 10:12:37.409313 mmap(0x7fa5f668b000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25542] 10:12:37.409342 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25541] 10:12:37.409374 <... mmap resumed> ) = 0x7fa5f668b000
[pid 25542] 10:12:37.409399 <... write resumed> ) = 4
[pid 25529] 10:12:37.409413 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25529] 10:12:37.409436 read(13,  <unfinished ...>
[pid 25542] 10:12:37.409464 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25541] 10:12:37.409503 close(6 <unfinished ...>
[pid 25542] 10:12:37.409622 <... write resumed> ) = 4
[pid 25529] 10:12:37.409638 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.409663 read(13,  <unfinished ...>
[pid 25542] 10:12:37.409693 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25529] 10:12:37.409732 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25529] 10:12:37.409760 read(13,  <unfinished ...>
[pid 25537] 10:12:37.409790 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25541] 10:12:37.409815 <... close resumed> ) = 0
[pid 25542] 10:12:37.409836 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25541] 10:12:37.409888 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25542] 10:12:37.409923 <... write resumed> ) = 4
[pid 25529] 10:12:37.409936 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.409958 wait4(-1,  <unfinished ...>
[pid 25537] 10:12:37.409999 read(14,  <unfinished ...>
[pid 25542] 10:12:37.410025 close(14)   = 0
[pid 25542] 10:12:37.410074 exit_group(0) = ?
[pid 25537] 10:12:37.410097 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25537] 10:12:37.410170 read(14,  <unfinished ...>
[pid 25542] 10:12:37.410462 +++ exited with 0 +++
[pid 25529] 10:12:37.410496 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25542
[pid 25529] 10:12:37.410592 close(13)   = 0
[pid 25529] 10:12:37.410641 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:37.410712 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.410786 open("/etc/userdomains", O_RDONLY) = 9
[pid 25529] 10:12:37.410831 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.410884 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.410933 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336d000
[pid 25529] 10:12:37.410973 lseek(9, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.411010 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25529] 10:12:37.411069 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.411132 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.411217 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.411275 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.411366 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25529] 10:12:37.411413 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.411466 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.411514 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.411626 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25522] 10:12:37.411658 recvfrom(16, "\316\360\201\200\0\1\0\2\0\0\0\0\5rmrcc\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\16\17\0\22\0\24\3mx2\temailsrvr\300\22\300\f\0\17\0\1\0\0\16\17\0\10\0\n\3mx1\300-", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 77
[pid 25522] 10:12:37.411721 close(16)   = 0
[pid 25522] 10:12:37.411798 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25522] 10:12:37.411842 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25522] 10:12:37.411885 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25522] 10:12:37.411925 sendto(16, "\216\366\1\0\0\1\0\0\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0) = 35
[pid 25522] 10:12:37.411990 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25529] 10:12:37.412029 <... mmap resumed> ) = 0x7f21d336c000
[pid 25529] 10:12:37.412050 lseek(10, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.412086 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25529] 10:12:37.412155 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25529] 10:12:37.412204 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.412256 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336b000
[pid 25529] 10:12:37.412296 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.412352 close(11)   = 0
[pid 25529] 10:12:37.412391 munmap(0x7f21d336b000, 4096) = 0
[pid 25529] 10:12:37.412464 open("/etc/localdomains", O_RDONLY) = 11
[pid 25529] 10:12:37.412513 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.412652 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.412702 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336b000
[pid 25529] 10:12:37.412742 lseek(11, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.412779 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25529] 10:12:37.412843 stat("/jail_owner", 0x7ffce2d00dc0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.412894 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.412960 stat("/usr/local/cpanel/3rdparty/mailman/lists/antiqueweddinghouse_finestweddingsites.com/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.413014 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.413073 stat("/usr/local/cpanel/3rdparty/mailman/lists/antiqueweddinghouse/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.413122 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.413197 open("/etc/demouids", O_RDONLY) = 12
[pid 25529] 10:12:37.413243 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.413295 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.413352 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336a000
[pid 25529] 10:12:37.413392 lseek(12, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.413429 read(12, "", 4096) = 0
[pid 25529] 10:12:37.413473 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:37.413698 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.413778 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.413840 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.413905 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25529] 10:12:37.413952 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.414003 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.414060 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3369000
[pid 25529] 10:12:37.414100 lseek(13, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.414137 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25529] 10:12:37.414187 read(13, "", 4096) = 0
[pid 25529] 10:12:37.414239 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.414307 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.414372 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.414465 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25529] 10:12:37.414514 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.414647 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d3368000
[pid 25529] 10:12:37.414688 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.414743 close(14)   = 0
[pid 25529] 10:12:37.414781 munmap(0x7f21d3368000, 4096) = 0
[pid 25529] 10:12:37.414830 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25529] 10:12:37.414884 pipe([14, 15]) = 0
[pid 25529] 10:12:37.414925 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:37.414970 close(12)   = 0
[pid 25529] 10:12:37.415007 munmap(0x7f21d336a000, 4096) = 0
[pid 25541] 10:12:37.415057 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.415075 close(9 <unfinished ...>
[pid 25541] 10:12:37.415107 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.415131 <... close resumed> ) = 0
[pid 25541] 10:12:37.415162 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.415177 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25541] 10:12:37.415217 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.415240 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25529] 10:12:37.415263 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.415284 close(11)   = 0
[pid 25529] 10:12:37.415318 munmap(0x7f21d336b000, 4096) = 0
[pid 25529] 10:12:37.415356 close(13)   = 0
[pid 25529] 10:12:37.415391 munmap(0x7f21d3369000, 4096) = 0
[pid 25529] 10:12:37.415429 close(10)   = 0
[pid 25529] 10:12:37.415465 munmap(0x7f21d336c000, 4096) = 0
[pid 25529] 10:12:37.415501 clone( <unfinished ...>
[pid 25541] 10:12:37.415923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.415941 read(14,  <unfinished ...>
[pid 25529] 10:12:37.415966 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25546
[pid 25541] 10:12:37.416016 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.416043 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25529] 10:12:37.416061 close(15 <unfinished ...>
[pid 25541] 10:12:37.416160 <... open resumed> ) = 6
[pid 25537] 10:12:37.416175 read(14,  <unfinished ...>
[pid 25529] 10:12:37.416196 <... close resumed> ) = 0
[pid 25541] 10:12:37.416223 read(6,  <unfinished ...>
[pid 25537] 10:12:37.416244 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25529] 10:12:37.416262 read(14,  <unfinished ...>
[pid 25541] 10:12:37.416358 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.416383 read(14,  <unfinished ...>
[pid 25541] 10:12:37.416416 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.416436 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25541] 10:12:37.416470 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25537] 10:12:37.416499 read(14,  <unfinished ...>
[pid 25541] 10:12:37.416613 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.416639 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25541] 10:12:37.416740 <... mmap resumed> ) = 0x7fa5f6230000
[pid 25537] 10:12:37.416760 read(14,  <unfinished ...>
[pid 25541] 10:12:37.416791 mprotect(0x7fa5f6271000, 2097152, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.416812 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25541] 10:12:37.416896 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.416914 read(14,  <unfinished ...>
[pid 25541] 10:12:37.416945 mmap(0x7fa5f6471000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25537] 10:12:37.416969 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25541] 10:12:37.417009 <... mmap resumed> ) = 0x7fa5f6471000
[pid 25537] 10:12:37.417025 read(14,  <unfinished ...>
[pid 25541] 10:12:37.417067 close(6 <unfinished ...>
[pid 25537] 10:12:37.417089 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25541] 10:12:37.417165 <... close resumed> ) = 0
[pid 25537] 10:12:37.417182 read(14,  <unfinished ...>
[pid 25541] 10:12:37.417224 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.417248 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25541] 10:12:37.417332 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.417350 read(14,  <unfinished ...>
[pid 25541] 10:12:37.417384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.417407 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25541] 10:12:37.417457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.417473 read(14,  <unfinished ...>
[pid 25522] 10:12:37.417493 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25522] 10:12:37.417515 recvfrom(16, "\216\366\201\200\0\1\0\1\0\0\0\0\3mx1\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0F\0\4b\201\271\203", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 51
[pid 25522] 10:12:37.417647 close(16)   = 0
[pid 25522] 10:12:37.417713 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25522] 10:12:37.417758 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25522] 10:12:37.417805 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25522] 10:12:37.417848 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.417888 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.417927 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.417965 close(16)   = 0
[pid 25522] 10:12:37.418005 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25522] 10:12:37.418075 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.418131 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b0c000
[pid 25522] 10:12:37.418170 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25522] 10:12:37.418231 read(16, "", 1024) = 0
[pid 25522] 10:12:37.418277 read(16, "", 1024) = 0
[pid 25522] 10:12:37.418317 close(16)   = 0
[pid 25522] 10:12:37.418354 munmap(0x7f2e40b0c000, 4096) = 0
[pid 25522] 10:12:37.418421 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25522] 10:12:37.418464 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16Process 25543 attached
) = 0
[pid 25541] 10:12:37.418619 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.418646 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25522] 10:12:37.418667 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25522] 10:12:37.418706 sendto(16, "\212\205\1\0\0\1\0\0\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1", 35, MSG_NOSIGNAL, NULL, 0) = 35
[pid 25522] 10:12:37.418770 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25543] 10:12:37.418898 set_robust_list(0x7f40383f7aa0, 24 <unfinished ...>
[pid 25541] 10:12:37.418922 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.418937 read(14,  <unfinished ...>
[pid 25543] 10:12:37.418974 <... set_robust_list resumed> ) = 0
[pid 25541] 10:12:37.418988 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.419010 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25543] 10:12:37.419123 close(0 <unfinished ...>
[pid 25541] 10:12:37.419149 <... open resumed> ) = 6
[pid 25537] 10:12:37.419163 read(14,  <unfinished ...>
[pid 25543] 10:12:37.419202 <... close resumed> ) = 0
[pid 25541] 10:12:37.419216 read(6,  <unfinished ...>
[pid 25537] 10:12:37.419236 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25543] 10:12:37.419275 close(1 <unfinished ...>
[pid 25541] 10:12:37.419296 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.419316 read(14,  <unfinished ...>
[pid 25543] 10:12:37.419351 <... close resumed> ) = 0
[pid 25541] 10:12:37.419365 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.419385 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25543] 10:12:37.419465 close(2 <unfinished ...>
[pid 25541] 10:12:37.419490 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25537] 10:12:37.419606 read(14,  <unfinished ...>
[pid 25543] 10:12:37.419637 <... close resumed> ) = 0
[pid 25543] 10:12:37.419738 setsid( <unfinished ...>
[pid 25541] 10:12:37.419763 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.419786 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25543] 10:12:37.419872 <... setsid resumed> ) = 25543
[pid 25541] 10:12:37.419890 <... mmap resumed> ) = 0x7fa5f973d000
[pid 25537] 10:12:37.419904 read(14,  <unfinished ...>
[pid 25543] 10:12:37.419947 fstat(0,  <unfinished ...>
[pid 25541] 10:12:37.419968 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.419992 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25543] 10:12:37.420091 <... fstat resumed> 0x7ffe92d4b930) = -1 EBADF (Bad file descriptor)
[pid 25541] 10:12:37.420111 <... mmap resumed> ) = 0x7fa5f5f49000
[pid 25537] 10:12:37.420125 read(14,  <unfinished ...>
[pid 25543] 10:12:37.420163 open("/dev/null", O_RDWR <unfinished ...>
[pid 25541] 10:12:37.420187 mprotect(0x7fa5f6024000, 2097152, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.420207 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25543] 10:12:37.420310 <... open resumed> ) = 0
[pid 25541] 10:12:37.420328 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.420341 read(14,  <unfinished ...>
[pid 25543] 10:12:37.420378 fstat(1,  <unfinished ...>
[pid 25541] 10:12:37.420399 mmap(0x7fa5f6224000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25537] 10:12:37.420422 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25543] 10:12:37.420467 <... fstat resumed> 0x7ffe92d4b930) = -1 EBADF (Bad file descriptor)
[pid 25541] 10:12:37.420484 <... mmap resumed> ) = 0x7fa5f6224000
[pid 25537] 10:12:37.420497 read(14,  <unfinished ...>
[pid 25543] 10:12:37.420627 dup2(0, 1 <unfinished ...>
[pid 25541] 10:12:37.420651 close(6 <unfinished ...>
[pid 25537] 10:12:37.420671 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25543] 10:12:37.420771 <... dup2 resumed> ) = 1
[pid 25541] 10:12:37.420788 <... close resumed> ) = 0
[pid 25537] 10:12:37.420802 read(14,  <unfinished ...>
[pid 25543] 10:12:37.420847 fstat(2,  <unfinished ...>
[pid 25541] 10:12:37.420868 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.420890 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25543] 10:12:37.420995 <... fstat resumed> 0x7ffe92d4b930) = -1 EBADF (Bad file descriptor)
[pid 25541] 10:12:37.421015 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.421029 read(14,  <unfinished ...>
[pid 25543] 10:12:37.421064 dup2(0, 2 <unfinished ...>
[pid 25541] 10:12:37.421084 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.421107 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25543] 10:12:37.421204 <... dup2 resumed> ) = 2
[pid 25541] 10:12:37.421221 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.421236 read(14,  <unfinished ...>
[pid 25543] 10:12:37.421271 geteuid( <unfinished ...>
[pid 25541] 10:12:37.421291 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.421314 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
Process 25544 attached
[pid 25543] 10:12:37.421385 <... geteuid resumed> ) = 47
[pid 25541] 10:12:37.421400 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.421415 read(14,  <unfinished ...>
[pid 25544] 10:12:37.421475 set_robust_list(0x7f2293db0aa0, 24 <unfinished ...>
[pid 25543] 10:12:37.421497 fstat(0,  <unfinished ...>
[pid 25541] 10:12:37.421517 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.421624 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25544] 10:12:37.421649 <... set_robust_list resumed> ) = 0
[pid 25543] 10:12:37.421663 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
Process 25545 attached
[pid 25544] 10:12:37.421811 close(0 <unfinished ...>
[pid 25543] 10:12:37.421858 fstat(1,  <unfinished ...>
[pid 25541] 10:12:37.421882 <... open resumed> ) = 6
[pid 25537] 10:12:37.421895 read(14,  <unfinished ...>
[pid 25545] 10:12:37.421927 set_robust_list(0x7ff3d4f3fac0, 24 <unfinished ...>
[pid 25544] 10:12:37.421949 <... close resumed> ) = 0
[pid 25543] 10:12:37.421963 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25541] 10:12:37.421991 read(6,  <unfinished ...>
[pid 25545] 10:12:37.422022 <... set_robust_list resumed> ) = 0
[pid 25544] 10:12:37.422036 close(1 <unfinished ...>
[pid 25543] 10:12:37.422079 fstat(2,  <unfinished ...>
[pid 25537] 10:12:37.422102 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25545] 10:12:37.422126 close(6 <unfinished ...>
[pid 25544] 10:12:37.422213 <... close resumed> ) = 0
[pid 25543] 10:12:37.422233 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25541] 10:12:37.422262 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.422297 <... close resumed> ) = 0
[pid 25544] 10:12:37.422314 close(2 <unfinished ...>
[pid 25543] 10:12:37.422338 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMb-0006dp-8u"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25537] 10:12:37.423109 read(14,  <unfinished ...>
[pid 25545] 10:12:37.423153 dup2(5, 0 <unfinished ...>
[pid 25544] 10:12:37.423177 <... close resumed> ) = 0
[pid 25541] 10:12:37.423192 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.423274 <... dup2 resumed> ) = 0
[pid 25544] 10:12:37.423289 setsid( <unfinished ...>
[pid 25543] 10:12:37.423312 <... execve resumed> ) = 0
[pid 25537] 10:12:37.423326 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25545] 10:12:37.423373 close(5 <unfinished ...>
[pid 25544] 10:12:37.423460 <... setsid resumed> ) = 25544
[pid 25543] 10:12:37.423475 brk(0 <unfinished ...>
[pid 25541] 10:12:37.423503 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.423603 <... close resumed> ) = 0
[pid 25544] 10:12:37.423627 fstat(0,  <unfinished ...>
[pid 25543] 10:12:37.423660 <... brk resumed> ) = 0x2010000
[pid 25537] 10:12:37.423675 read(14,  <unfinished ...>
[pid 25545] 10:12:37.423709 execve("/bin/sh", ["sh", "-c", "/usr/sbin/sendmail -t -i"], ["CONTENT_LENGTH=0", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "CONTEXT_PREFIX=", "DOCUMENT_ROOT=/home/finest09/public_html", "GATEWAY_INTERFACE=CGI/1.1", "HTTP_ACCEPT=*/*", "HTTP_ACCEPT_ENCODING=gzip, deflate", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_CONNECTION=keep-alive", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "HTTP_HOST=www.finestweddingsites.com", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "PATH=/bin:/usr/bin", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "REDIRECT_STATUS=200", "REMOTE_ADDR=68.109.176.77", "REMOTE_PORT=61266", "REQUEST_METHOD=POST", "REQUEST_SCHEME=http", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "SERVER_ADDR=50.116.78.207", "SERVER_ADMIN=webmaster@finestweddingsites.com", "SERVER_NAME=www.finestweddingsites.com", "SERVER_PORT=80", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_SIGNATURE=", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK"] <unfinished ...>
[pid 25544] 10:12:37.424219 <... fstat resumed> 0x7ffd1276f310) = -1 EBADF (Bad file descriptor)
[pid 25543] 10:12:37.424243 fcntl(0, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.424266 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.424292 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25544] 10:12:37.424449 open("/dev/null", O_RDWR <unfinished ...>
[pid 25543] 10:12:37.424487 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.424502 <... mmap resumed> ) = 0x7fa5f5d45000
[pid 25537] 10:12:37.424516 read(14,  <unfinished ...>
[pid 25544] 10:12:37.424614 <... open resumed> ) = 0
[pid 25543] 10:12:37.424665 fcntl(1, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.424695 mprotect(0x7fa5f5d48000, 2093056, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.424723 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25544] 10:12:37.424751 fstat(1,  <unfinished ...>
[pid 25543] 10:12:37.424839 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.424854 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.424876 <... execve resumed> ) = 0
[pid 25544] 10:12:37.424891 <... fstat resumed> 0x7ffd1276f310) = -1 EBADF (Bad file descriptor)
[pid 25543] 10:12:37.424928 fcntl(2, F_GETFD <unfinished ...>
[pid 25537] 10:12:37.424964 read(14,  <unfinished ...>
[pid 25545] 10:12:37.424995 brk(0 <unfinished ...>
[pid 25544] 10:12:37.425017 dup2(0, 1 <unfinished ...>
[pid 25543] 10:12:37.425039 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.425053 mmap(0x7fa5f5f47000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25545] 10:12:37.425097 <... brk resumed> ) = 0x1f21000
[pid 25544] 10:12:37.425112 <... dup2 resumed> ) = 1
[pid 25543] 10:12:37.425146 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25537] 10:12:37.425178 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25545] 10:12:37.425203 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.425240 fstat(2,  <unfinished ...>
[pid 25543] 10:12:37.425262 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.425277 <... mmap resumed> ) = 0x7fa5f5f47000
[pid 25545] 10:12:37.425311 <... mmap resumed> ) = 0x7faa41738000
[pid 25544] 10:12:37.425337 <... fstat resumed> 0x7ffd1276f310) = -1 EBADF (Bad file descriptor)
[pid 25543] 10:12:37.425364 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.425393 read(14,  <unfinished ...>
[pid 25545] 10:12:37.425424 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25544] 10:12:37.425452 dup2(0, 2 <unfinished ...>
[pid 25543] 10:12:37.425477 <... mmap resumed> ) = 0x7fe585edd000
[pid 25541] 10:12:37.425491 close(6 <unfinished ...>
[pid 25545] 10:12:37.425617 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.425635 <... dup2 resumed> ) = 2
[pid 25543] 10:12:37.425658 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25541] 10:12:37.425689 <... close resumed> ) = 0
[pid 25537] 10:12:37.425703 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25545] 10:12:37.425739 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.425784 geteuid( <unfinished ...>
[pid 25543] 10:12:37.425807 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.425821 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.425868 <... open resumed> ) = 5
[pid 25544] 10:12:37.425883 <... geteuid resumed> ) = 47
[pid 25543] 10:12:37.425908 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.425967 read(14,  <unfinished ...>
[pid 25545] 10:12:37.426020 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.426062 fstat(0,  <unfinished ...>
[pid 25543] 10:12:37.426104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.426130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.426170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.426221 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25543] 10:12:37.426269 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.426323 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25545] 10:12:37.426374 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.426633 fstat(1,  <unfinished ...>
[pid 25543] 10:12:37.426677 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.426703 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.426776 <... mmap resumed> ) = 0x7faa4172e000
[pid 25544] 10:12:37.426803 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25543] 10:12:37.426863 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.426915 read(14,  <unfinished ...>
[pid 25545] 10:12:37.426969 close(5 <unfinished ...>
[pid 25544] 10:12:37.427008 fstat(2,  <unfinished ...>
[pid 25543] 10:12:37.427048 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.427074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.427112 <... close resumed> ) = 0
[pid 25544] 10:12:37.427136 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25543] 10:12:37.427198 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25537] 10:12:37.427255 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25545] 10:12:37.427283 open("/lib64/libtinfo.so.5", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.427383 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMb-0006dm-9U"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25543] 10:12:37.428148 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.428176 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.428219 <... open resumed> ) = 5
[pid 25543] 10:12:37.428234 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.428264 read(14,  <unfinished ...>
[pid 25545] 10:12:37.428295 read(5,  <unfinished ...>
[pid 25544] 10:12:37.428317 <... execve resumed> ) = 0
[pid 25543] 10:12:37.428331 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.428362 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.428386 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\310\0\0\0\0\0\0@\0\0\0\0\0\0\0x\376\1\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\302\1\0\0\0\0\0\\\302\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`\302\1\0\0\0\0\0`\302!\0\0\0\0\0`\302!\0\0\0\0\0\20;\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\340\361\1\0\0\0\0\0\340\361!\0\0\0\0\0\340\361!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.428412 brk(0 <unfinished ...>
[pid 25543] 10:12:37.428438 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.428465 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25545] 10:12:37.428490 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.428642 <... brk resumed> ) = 0x1f05000
[pid 25543] 10:12:37.428665 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.428689 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.428731 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277184, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=264, st_size=132408, st_atime=2015/03/16-03:54:00, st_mtime=2015/03/16-03:54:00, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.428761 fcntl(0, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.428800 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.428830 read(14,  <unfinished ...>
[pid 25545] 10:12:37.428861 mmap(NULL, 2228832, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.428889 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.428903 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.428919 <... open resumed> ) = 6
[pid 25545] 10:12:37.428940 <... mmap resumed> ) = 0x7faa412f9000
[pid 25544] 10:12:37.428956 fcntl(1, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.428979 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25537] 10:12:37.429005 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25545] 10:12:37.429030 mprotect(0x7faa41316000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.429127 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.429148 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25541] 10:12:37.429177 read(6,  <unfinished ...>
[pid 25545] 10:12:37.429209 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.429223 fcntl(2, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.429246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.429278 read(14,  <unfinished ...>
[pid 25545] 10:12:37.429308 mmap(0x7faa41515000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1c000 <unfinished ...>
[pid 25544] 10:12:37.429338 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.429353 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.429376 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.429406 <... mmap resumed> ) = 0x7faa41515000
[pid 25544] 10:12:37.429423 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25543] 10:12:37.429456 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.429487 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25545] 10:12:37.429511 mmap(0x7faa41519000, 608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.429722 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.429745 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.429784 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.429818 <... mmap resumed> ) = 0x7faa41519000
[pid 25544] 10:12:37.429833 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.429860 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.429892 read(14,  <unfinished ...>
[pid 25545] 10:12:37.429922 close(5 <unfinished ...>
[pid 25544] 10:12:37.429944 <... mmap resumed> ) = 0x7fa692c21000
[pid 25543] 10:12:37.429958 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.429987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.430026 <... close resumed> ) = 0
[pid 25544] 10:12:37.430044 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25543] 10:12:37.430085 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25537] 10:12:37.430115 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25545] 10:12:37.430140 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.430246 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.430262 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.430288 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.430331 <... open resumed> ) = 5
[pid 25544] 10:12:37.430346 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.430376 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.430406 read(14,  <unfinished ...>
[pid 25545] 10:12:37.430437 read(5,  <unfinished ...>
[pid 25544] 10:12:37.430459 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.430474 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.430489 <... mmap resumed> ) = 0x7fa5f5b19000
[pid 25545] 10:12:37.430511 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.430622 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.430667 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.430705 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25545] 10:12:37.430735 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.430821 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.430838 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.430854 mprotect(0x7fa5f5b42000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.430890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.430918 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.430948 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.430979 read(14,  <unfinished ...>
[pid 25545] 10:12:37.431009 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.431036 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.431050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.431066 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.431088 <... mmap resumed> ) = 0x7faa410f5000
[pid 25544] 10:12:37.431103 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25543] 10:12:37.431131 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25537] 10:12:37.431159 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25545] 10:12:37.431190 mprotect(0x7faa410f7000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.431229 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.431244 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25541] 10:12:37.431272 mmap(0x7fa5f5d42000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25545] 10:12:37.431310 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.431325 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.431354 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.431382 read(14,  <unfinished ...>
[pid 25545] 10:12:37.431412 mmap(0x7faa412f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000 <unfinished ...>
[pid 25544] 10:12:37.431438 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.431453 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.431470 <... mmap resumed> ) = 0x7fa5f5d42000
[pid 25545] 10:12:37.431492 <... mmap resumed> ) = 0x7faa412f7000
[pid 25544] 10:12:37.431514 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.431696 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.431736 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25545] 10:12:37.431764 close(5 <unfinished ...>
[pid 25544] 10:12:37.431852 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.431868 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.431885 mmap(0x7fa5f5d44000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.431922 <... close resumed> ) = 0
[pid 25544] 10:12:37.431936 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.431973 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.432002 read(14,  <unfinished ...>
[pid 25545] 10:12:37.432032 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.432062 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.432077 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.432092 <... mmap resumed> ) = 0x7fa5f5d44000
[pid 25545] 10:12:37.432114 <... open resumed> ) = 5
[pid 25544] 10:12:37.432135 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25543] 10:12:37.432165 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25537] 10:12:37.432191 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25545] 10:12:37.432216 read(5,  <unfinished ...>
[pid 25544] 10:12:37.432296 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25543] 10:12:37.432325 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.432342 close(6 <unfinished ...>
[pid 25545] 10:12:37.432379 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.432400 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.432433 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.432461 read(14,  <unfinished ...>
[pid 25545] 10:12:37.432493 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.432515 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.432794 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.432816 <... close resumed> ) = 0
[pid 25545] 10:12:37.432838 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.432884 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.432917 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25537] 10:12:37.432944 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25545] 10:12:37.432969 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.433064 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.433081 <... stat resumed> 0x7ffcdc288710) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.433098 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.433145 <... mmap resumed> ) = 0x7faa4172d000
[pid 25544] 10:12:37.433162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.433198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.433227 read(14, Process 25546 attached
 <unfinished ...>
[pid 25545] 10:12:37.433288 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.433318 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.433334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.433349 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.433371 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25546] 10:12:37.433414 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25545] 10:12:37.433519 <... mmap resumed> ) = 0x7faa40d61000
[pid 25544] 10:12:37.433642 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25543] 10:12:37.433708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25541] 10:12:37.433745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.433800 <... set_robust_list resumed> ) = 0
[pid 25545] 10:12:37.433816 mprotect(0x7faa40eeb000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.433871 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.433888 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25537] 10:12:37.433917 brk(0x1304000 <unfinished ...>
[pid 25546] 10:12:37.433955 close(14 <unfinished ...>
[pid 25545] 10:12:37.433978 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.433991 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.434023 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.434051 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25546] 10:12:37.434073 <... close resumed> ) = 0
[pid 25545] 10:12:37.434089 mmap(0x7faa410eb000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25544] 10:12:37.434130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.434146 <... open resumed> ) = 6
[pid 25537] 10:12:37.434161 <... brk resumed> ) = 0x1304000
[pid 25546] 10:12:37.434184 geteuid( <unfinished ...>
[pid 25545] 10:12:37.434226 <... mmap resumed> ) = 0x7faa410eb000
[pid 25544] 10:12:37.434241 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.434276 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.434298 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.434338 <... geteuid resumed> ) = 0
[pid 25545] 10:12:37.434352 mmap(0x7faa410f0000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.434382 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.434397 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25537] 10:12:37.434425 read(14,  <unfinished ...>
[pid 25546] 10:12:37.434458 getegid( <unfinished ...>
[pid 25545] 10:12:37.434479 <... mmap resumed> ) = 0x7faa410f0000
[pid 25544] 10:12:37.434493 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.434612 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.434643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25546] 10:12:37.434679 <... getegid resumed> ) = 12
[pid 25545] 10:12:37.434699 close(5 <unfinished ...>
[pid 25544] 10:12:37.434728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.434742 <... mmap resumed> ) = 0x7fe585ed3000
[pid 25537] 10:12:37.434757 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25546] 10:12:37.434788 setgid(500 <unfinished ...>
[pid 25545] 10:12:37.434888 <... close resumed> ) = 0
[pid 25544] 10:12:37.434904 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25543] 10:12:37.434960 close(6 <unfinished ...>
[pid 25541] 10:12:37.434982 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.435022 <... setgid resumed> ) = 0
[pid 25545] 10:12:37.435042 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.435071 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.435099 <... close resumed> ) = 0
[pid 25537] 10:12:37.435114 read(14,  <unfinished ...>
[pid 25546] 10:12:37.435157 setuid(503 <unfinished ...>
[pid 25545] 10:12:37.435181 <... mmap resumed> ) = 0x7faa4172c000
[pid 25544] 10:12:37.435195 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.435228 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.435258 <... open resumed> ) = 6
[pid 25546] 10:12:37.435279 <... setuid resumed> ) = 0
[pid 25545] 10:12:37.435294 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.435352 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.435368 <... open resumed> ) = 6
[pid 25537] 10:12:37.435383 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25546] 10:12:37.435410 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.435507 <... mmap resumed> ) = 0x7faa4172b000
[pid 25544] 10:12:37.435628 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.435674 read(6,  <unfinished ...>
[pid 25541] 10:12:37.435702 read(6,  <unfinished ...>
[pid 25546] 10:12:37.435733 <... open resumed> ) = 9
[pid 25545] 10:12:37.435747 arch_prctl(ARCH_SET_FS, 0x7faa4172c700 <unfinished ...>
[pid 25544] 10:12:37.435782 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.435798 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.435821 read(14,  <unfinished ...>
[pid 25546] 10:12:37.435868 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.435891 <... arch_prctl resumed> ) = 0
[pid 25544] 10:12:37.435905 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.436028 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.436051 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.436072 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25546] 10:12:37.436099 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.436193 mprotect(0x7faa410eb000, 16384, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.436243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.436259 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.436288 fstat(6,  <unfinished ...>
[pid 25546] 10:12:37.436364 brk(0x23fb000 <unfinished ...>
[pid 25545] 10:12:37.436396 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.436414 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25543] 10:12:37.436456 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.436488 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25537] 10:12:37.436520 read(14,  <unfinished ...>
[pid 25546] 10:12:37.436637 <... brk resumed> ) = 0x23fb000
[pid 25545] 10:12:37.436652 mprotect(0x7faa412f7000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.436751 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.436768 <... mmap resumed> ) = 0x7fe585aa5000
[pid 25541] 10:12:37.436787 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25546] 10:12:37.436825 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.436847 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.436861 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.436939 mprotect(0x7fe585abb000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.436967 <... mmap resumed> ) = 0x7fa5f973c000
[pid 25537] 10:12:37.436987 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25546] 10:12:37.437014 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.437100 mprotect(0x7faa41739000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.437133 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.437148 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.437164 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25546] 10:12:37.437207 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.437233 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.437246 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25543] 10:12:37.437275 mmap(0x7fe585cbb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25541] 10:12:37.437304 <... mmap resumed> ) = 0x7fa5f5903000
[pid 25537] 10:12:37.437321 read(14,  <unfinished ...>
[pid 25546] 10:12:37.437352 <... mmap resumed> ) = 0x7f21d336d000
[pid 25545] 10:12:37.437366 munmap(0x7faa4172e000, 39387 <unfinished ...>
[pid 25544] 10:12:37.437395 <... stat resumed> 0x7ffc5384f160) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.437410 <... mmap resumed> ) = 0x7fe585cbb000
[pid 25541] 10:12:37.437425 mprotect(0x7fa5f5918000, 2093056, PROT_NONE <unfinished ...>
[pid 25546] 10:12:37.437477 read(9,  <unfinished ...>
[pid 25545] 10:12:37.437510 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.437599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.437671 mmap(0x7fe585cbd000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.437700 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.437718 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25546] 10:12:37.437744 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25545] 10:12:37.437830 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.437859 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.437874 <... mmap resumed> ) = 0x7fe585cbd000
[pid 25541] 10:12:37.437889 mmap(0x7fa5f5b17000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25546] 10:12:37.437937 read(9,  <unfinished ...>
[pid 25545] 10:12:37.437964 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.437984 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25543] 10:12:37.438022 close(6 <unfinished ...>
[pid 25541] 10:12:37.438044 <... mmap resumed> ) = 0x7fa5f5b17000
[pid 25537] 10:12:37.438069 read(14,  <unfinished ...>
[pid 25546] 10:12:37.438103 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25545] 10:12:37.438121 open("/dev/tty", O_RDWR|O_NONBLOCK <unfinished ...>
[pid 25544] 10:12:37.438161 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.438189 <... close resumed> ) = 0
[pid 25541] 10:12:37.438206 close(6 <unfinished ...>
[pid 25546] 10:12:37.438248 close(9 <unfinished ...>
[pid 25545] 10:12:37.438271 <... open resumed> ) = -1 ENXIO (No such device or address)
[pid 25544] 10:12:37.438286 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.438320 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.438349 <... close resumed> ) = 0
[pid 25537] 10:12:37.438388 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25546] 10:12:37.438428 <... close resumed> ) = 0
[pid 25545] 10:12:37.438515 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:37.438624 <... open resumed> ) = 6
[pid 25543] 10:12:37.438640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.438657 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.438701 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25545] 10:12:37.438728 <... ioctl resumed> , 0x7ffe26527e10) = -1 EINVAL (Invalid argument)
[pid 25544] 10:12:37.438744 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.438805 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.438838 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.438856 read(14,  <unfinished ...>
[pid 25546] 10:12:37.438889 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.438903 brk(0 <unfinished ...>
[pid 25544] 10:12:37.439329 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25543] 10:12:37.439360 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.439377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.439421 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.439445 <... brk resumed> ) = 0x1f21000
[pid 25544] 10:12:37.439459 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.439604 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.439640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.439658 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25546] 10:12:37.439694 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.439786 brk(0x1f42000 <unfinished ...>
[pid 25544] 10:12:37.439818 <... mmap resumed> ) = 0x7fa692c17000
[pid 25543] 10:12:37.439832 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.439848 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.439895 read(6,  <unfinished ...>
[pid 25545] 10:12:37.439919 <... brk resumed> ) = 0x1f42000
[pid 25544] 10:12:37.439933 close(6 <unfinished ...>
[pid 25543] 10:12:37.439979 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.440024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.440054 read(14,  <unfinished ...>
[pid 25546] 10:12:37.440164 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2376) = 1858
[pid 25545] 10:12:37.440186 getuid( <unfinished ...>
[pid 25544] 10:12:37.440709 <... close resumed> ) = 0
[pid 25543] 10:12:37.440727 <... open resumed> ) = 6
[pid 25541] 10:12:37.440751 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25546] 10:12:37.440798 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.440833 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.440848 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.440883 read(6,  <unfinished ...>
[pid 25541] 10:12:37.440907 <... open resumed> ) = 6
[pid 25537] 10:12:37.440923 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25546] 10:12:37.440950 <... write resumed> ) = 4
[pid 25545] 10:12:37.441031 getgid( <unfinished ...>
[pid 25544] 10:12:37.441057 <... open resumed> ) = 6
[pid 25543] 10:12:37.441071 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.441100 read(6,  <unfinished ...>
[pid 25529] 10:12:37.441126 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25546] 10:12:37.441155 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.441179 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.441193 read(6,  <unfinished ...>
[pid 25543] 10:12:37.441218 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.441241 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.441264 read(14,  <unfinished ...>
[pid 25529] 10:12:37.441287 read(14,  <unfinished ...>
[pid 25546] 10:12:37.441321 <... write resumed> ) = 4
[pid 25545] 10:12:37.441335 geteuid( <unfinished ...>
[pid 25544] 10:12:37.441357 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.441379 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.441410 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.441446 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25529] 10:12:37.441467 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25546] 10:12:37.441516 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.441645 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.441661 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.441687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.441714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25537] 10:12:37.441747 read(14,  <unfinished ...>
[pid 25529] 10:12:37.441771 read(14,  <unfinished ...>
[pid 25546] 10:12:37.441808 <... write resumed> ) = 4
[pid 25545] 10:12:37.441822 getegid( <unfinished ...>
[pid 25544] 10:12:37.441845 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.441871 <... mmap resumed> ) = 0x7fe585ed2000
[pid 25541] 10:12:37.441895 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.441935 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25529] 10:12:37.441954 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25546] 10:12:37.442050 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25545] 10:12:37.442081 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.442094 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.442134 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.442162 <... mmap resumed> ) = 0x7fa5f56f8000
[pid 25537] 10:12:37.442178 read(14,  <unfinished ...>
[pid 25529] 10:12:37.442201 read(14,  <unfinished ...>
[pid 25546] 10:12:37.442238 <... write resumed> ) = 40
[pid 25545] 10:12:37.442251 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.442275 <... mmap resumed> ) = 0x7fa6927e9000
[pid 25543] 10:12:37.442289 <... mmap resumed> ) = 0x7fe58588c000
[pid 25541] 10:12:37.442306 mprotect(0x7fa5f5702000, 2093056, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.442335 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25529] 10:12:37.442353 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25546] 10:12:37.442455 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.442485 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.442503 mprotect(0x7fa6927ff000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.442655 mprotect(0x7fe5858a2000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.442685 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.442701 read(14,  <unfinished ...>
[pid 25529] 10:12:37.442725 read(14,  <unfinished ...>
[pid 25546] 10:12:37.442759 <... write resumed> ) = 4
[pid 25545] 10:12:37.442772 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.442815 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.442830 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.442847 mmap(0x7fa5f5901000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25537] 10:12:37.442878 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25529] 10:12:37.442897 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25546] 10:12:37.442936 close(15 <unfinished ...>
[pid 25545] 10:12:37.442960 <... open resumed> ) = 5
[pid 25544] 10:12:37.442973 mmap(0x7fa6929ff000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25543] 10:12:37.443011 mmap(0x7fe585aa1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25541] 10:12:37.443039 <... mmap resumed> ) = 0x7fa5f5901000
[pid 25537] 10:12:37.443065 read(14,  <unfinished ...>
[pid 25529] 10:12:37.443090 wait4(-1,  <unfinished ...>
[pid 25546] 10:12:37.443122 <... close resumed> ) = 0
[pid 25545] 10:12:37.443135 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.443174 <... mmap resumed> ) = 0x7fa6929ff000
[pid 25543] 10:12:37.443188 <... mmap resumed> ) = 0x7fe585aa1000
[pid 25541] 10:12:37.443214 close(6 <unfinished ...>
[pid 25537] 10:12:37.443243 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25546] 10:12:37.443270 exit_group(0) = ?
[pid 25545] 10:12:37.443347 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.443743 mmap(0x7fa692a01000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.443787 mmap(0x7fe585aa3000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.443816 <... close resumed> ) = 0
[pid 25546] 10:12:37.443873 +++ exited with 0 +++
[pid 25545] 10:12:37.443889 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.443914 <... mmap resumed> ) = 0x7fa692a01000
[pid 25543] 10:12:37.443928 <... mmap resumed> ) = 0x7fe585aa3000
[pid 25541] 10:12:37.443956 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.443994 read(14,  <unfinished ...>
[pid 25529] 10:12:37.444018 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25546
[pid 25545] 10:12:37.444047 <... mmap resumed> ) = 0x7faa41737000
[pid 25544] 10:12:37.444062 close(6 <unfinished ...>
[pid 25543] 10:12:37.444086 close(6 <unfinished ...>
[pid 25541] 10:12:37.444108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.444126 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25529] 10:12:37.444144 close(14 <unfinished ...>
[pid 25545] 10:12:37.444194 read(5,  <unfinished ...>
[pid 25544] 10:12:37.444250 <... close resumed> ) = 0
[pid 25543] 10:12:37.444275 <... close resumed> ) = 0
[pid 25541] 10:12:37.444299 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.444341 read(14,  <unfinished ...>
[pid 25529] 10:12:37.444365 <... close resumed> ) = 0
[pid 25545] 10:12:37.444390 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          241520 kB\nCached:           335084 kB\nBuffers:               0 kB\nActive:           307972 kB\nInactive:         467764 kB\nActive(anon):     170852 kB\nInactive(anon):   277604 kB\nActive(file):     137120 kB\nInac"..., 1024) = 588
[pid 25544] 10:12:37.444409 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.444468 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.444498 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.444590 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25529] 10:12:37.444617 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25545] 10:12:37.444746 close(5 <unfinished ...>
[pid 25544] 10:12:37.444777 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.444798 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.444815 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.444846 read(14,  <unfinished ...>
[pid 25529] 10:12:37.444876 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25545] 10:12:37.444934 <... close resumed> ) = 0
[pid 25544] 10:12:37.444951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.444986 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.445017 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.445038 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25529] 10:12:37.445056 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.445163 munmap(0x7faa41737000, 4096 <unfinished ...>
[pid 25544] 10:12:37.445191 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.445209 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.445226 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.445261 read(14,  <unfinished ...>
[pid 25529] 10:12:37.445284 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.445340 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.445357 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.445431 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.445463 <... open resumed> ) = 6
[pid 25537] 10:12:37.445480 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25529] 10:12:37.445499 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.445689 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.445718 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.445741 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.445765 read(6,  <unfinished ...>
[pid 25537] 10:12:37.445793 read(14,  <unfinished ...>
[pid 25529] 10:12:37.445817 <... open resumed> ) = 9
[pid 25545] 10:12:37.445844 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:37.445861 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.445895 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.445925 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.445948 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25529] 10:12:37.445967 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.446081 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.446108 <... open resumed> ) = 6
[pid 25543] 10:12:37.446125 <... open resumed> ) = 6
[pid 25541] 10:12:37.446141 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.446164 read(14,  <unfinished ...>
[pid 25529] 10:12:37.446187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.446232 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.446251 read(6,  <unfinished ...>
[pid 25543] 10:12:37.446277 read(6,  <unfinished ...>
[pid 25541] 10:12:37.446301 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25537] 10:12:37.446334 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25529] 10:12:37.446352 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.446466 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.446502 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.446618 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.446647 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.446686 read(14,  <unfinished ...>
[pid 25529] 10:12:37.446710 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.446750 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:37.446767 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.446795 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.446818 <... mmap resumed> ) = 0x7fa5f54f5000
[pid 25537] 10:12:37.446834 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25529] 10:12:37.446853 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.446963 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.446990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.447026 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.447058 mprotect(0x7fa5f54f7000, 2093056, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.447088 read(14,  <unfinished ...>
[pid 25529] 10:12:37.447112 <... mmap resumed> ) = 0x7f21d336d000
[pid 25545] 10:12:37.447138 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.447155 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.447184 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.447211 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.447227 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25529] 10:12:37.447245 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.447338 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.447364 <... mmap resumed> ) = 0x7fa692c16000
[pid 25543] 10:12:37.447385 <... mmap resumed> ) = 0x7fe585655000
[pid 25541] 10:12:37.447403 mmap(0x7fa5f56f6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25537] 10:12:37.447433 read(14,  <unfinished ...>
[pid 25529] 10:12:37.447456 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.447484 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:37.447504 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.447639 mprotect(0x7fe58565c000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.447669 <... mmap resumed> ) = 0x7fa5f56f6000
[pid 25537] 10:12:37.447696 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25529] 10:12:37.447718 read(9,  <unfinished ...>
[pid 25545] 10:12:37.447816 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.447845 <... mmap resumed> ) = 0x7fa6925d0000
[pid 25543] 10:12:37.447862 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.447878 close(6 <unfinished ...>
[pid 25537] 10:12:37.447900 read(14,  <unfinished ...>
[pid 25529] 10:12:37.447924 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25545] 10:12:37.447978 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.448005 mprotect(0x7fa6925e6000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.448034 mmap(0x7fe58585c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25541] 10:12:37.448065 <... close resumed> ) = 0
[pid 25537] 10:12:37.448094 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25529] 10:12:37.448120 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.448213 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.448237 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.448253 <... mmap resumed> ) = 0x7fe58585c000
[pid 25541] 10:12:37.448275 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.448304 read(14,  <unfinished ...>
[pid 25529] 10:12:37.448327 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.448381 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.448408 mmap(0x7fa6927e5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25543] 10:12:37.448439 mmap(0x7fe58585e000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.448475 <... mmap resumed> ) = 0x7fa5f973b000
[pid 25537] 10:12:37.448519 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25529] 10:12:37.448630 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.448730 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.448913 <... mmap resumed> ) = 0x7fa6927e5000
[pid 25543] 10:12:37.448938 <... mmap resumed> ) = 0x7fe58585e000
[pid 25541] 10:12:37.448961 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.448999 read(14,  <unfinished ...>
[pid 25529] 10:12:37.449023 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.449100 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.449132 mmap(0x7fa6927e7000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.449164 close(6 <unfinished ...>
[pid 25541] 10:12:37.449187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.449206 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25529] 10:12:37.449225 stat("/home/finest09/etc/finestweddingsites.com/antiqueweddinghouse/filter",  <unfinished ...>
[pid 25545] 10:12:37.449311 uname( <unfinished ...>
[pid 25544] 10:12:37.449336 <... mmap resumed> ) = 0x7fa6927e7000
[pid 25543] 10:12:37.449359 <... close resumed> ) = 0
[pid 25541] 10:12:37.449385 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.449425 brk(0x1325000 <unfinished ...>
[pid 25529] 10:12:37.449449 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.449482 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25544] 10:12:37.449623 close(6 <unfinished ...>
[pid 25543] 10:12:37.449655 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.449693 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.449711 <... brk resumed> ) = 0x1325000
[pid 25529] 10:12:37.449725 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.449799 getcwd( <unfinished ...>
[pid 25544] 10:12:37.449825 <... close resumed> ) = 0
[pid 25543] 10:12:37.449848 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.449867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.449899 read(14,  <unfinished ...>
[pid 25529] 10:12:37.449923 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.449976 <... getcwd resumed> "/home/finest09/public_html/includes", 4096) = 36
[pid 25544] 10:12:37.450009 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.450041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.450072 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.450092 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25529] 10:12:37.450111 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.450217 getpid( <unfinished ...>
[pid 25544] 10:12:37.450241 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.450258 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.450275 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.450307 read(14,  <unfinished ...>
[pid 25529] 10:12:37.450332 <... open resumed> ) = 10
[pid 25545] 10:12:37.450358 <... getpid resumed> ) = 25545
[pid 25544] 10:12:37.450394 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.450435 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.450464 <... open resumed> ) = 6
[pid 25537] 10:12:37.450480 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25529] 10:12:37.450498 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.450620 getppid( <unfinished ...>
[pid 25544] 10:12:37.450645 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.450670 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.450696 read(6,  <unfinished ...>
[pid 25537] 10:12:37.450722 read(14,  <unfinished ...>
[pid 25529] 10:12:37.450745 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.450789 <... getppid resumed> ) = 25389
[pid 25544] 10:12:37.450817 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.450848 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.450879 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.450910 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25529] 10:12:37.450929 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.451023 stat(".",  <unfinished ...>
[pid 25544] 10:12:37.451050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.451074 <... open resumed> ) = 6
[pid 25541] 10:12:37.451090 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.451114 read(14,  <unfinished ...>
[pid 25529] 10:12:37.451137 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.451175 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122182178, st_mode=S_IFDIR|0755, st_nlink=12, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-16:02:22, st_mtime=2015/12/29-13:11:01, st_ctime=2015/12/29-13:11:01}) = 0
[pid 25544] 10:12:37.451211 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.451244 read(6,  <unfinished ...>
[pid 25541] 10:12:37.451268 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25537] 10:12:37.451298 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25529] 10:12:37.451316 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.451424 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.451457 <... open resumed> ) = 6
[pid 25543] 10:12:37.451473 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.451507 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.451661 read(14,  <unfinished ...>
[pid 25529] 10:12:37.451688 <... mmap resumed> ) = 0x7f21d336c000
[pid 25545] 10:12:37.451715 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.451748 read(6,  <unfinished ...>
[pid 25543] 10:12:37.451772 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.451794 <... mmap resumed> ) = 0x7fa5f52d6000
[pid 25537] 10:12:37.451810 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25529] 10:12:37.451834 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.451925 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.451954 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.451977 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.452007 mprotect(0x7fa5f52f3000, 2093056, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.452036 read(14,  <unfinished ...>
[pid 25529] 10:12:37.452060 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.452086 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.452114 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.452137 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.452165 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.452181 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25529] 10:12:37.452198 read(10,  <unfinished ...>
[pid 25545] 10:12:37.452286 geteuid( <unfinished ...>
[pid 25544] 10:12:37.452309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.452339 <... mmap resumed> ) = 0x7fe5853d1000
[pid 25541] 10:12:37.452356 mmap(0x7fa5f54f2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25537] 10:12:37.452388 read(14,  <unfinished ...>
[pid 25529] 10:12:37.452411 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25545] 10:12:37.452446 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.452463 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.452491 mprotect(0x7fe585454000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.452518 <... mmap resumed> ) = 0x7fa5f54f2000
[pid 25537] 10:12:37.452644 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25529] 10:12:37.452666 read(10,  <unfinished ...>
[pid 25545] 10:12:37.452761 getegid( <unfinished ...>
[pid 25544] 10:12:37.452785 <... mmap resumed> ) = 0x7fa692399000
[pid 25543] 10:12:37.452801 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.452822 mmap(0x7fa5f54f4000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.452853 read(14,  <unfinished ...>
[pid 25529] 10:12:37.452876 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.452923 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.452943 mprotect(0x7fa6923a0000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.452971 mmap(0x7fe585653000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25541] 10:12:37.453000 <... mmap resumed> ) = 0x7fa5f54f4000
[pid 25537] 10:12:37.453023 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25529] 10:12:37.453043 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.453142 getuid( <unfinished ...>
[pid 25544] 10:12:37.453166 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.453183 <... mmap resumed> ) = 0x7fe585653000
[pid 25541] 10:12:37.453209 close(6 <unfinished ...>
[pid 25537] 10:12:37.453234 read(14,  <unfinished ...>
[pid 25529] 10:12:37.453258 <... open resumed> ) = 11
[pid 25545] 10:12:37.453287 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.453304 mmap(0x7fa6925a0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25543] 10:12:37.453337 close(6 <unfinished ...>
[pid 25541] 10:12:37.453360 <... close resumed> ) = 0
[pid 25537] 10:12:37.453425 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25529] 10:12:37.453500 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.453607 getgid( <unfinished ...>
[pid 25544] 10:12:37.453632 <... mmap resumed> ) = 0x7fa6925a0000
[pid 25543] 10:12:37.453654 <... close resumed> ) = 0
[pid 25541] 10:12:37.453679 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.453708 read(14,  <unfinished ...>
[pid 25529] 10:12:37.453732 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.453772 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.453788 mmap(0x7fa6925a2000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.453817 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.453848 <... mmap resumed> ) = 0x7fa5f973a000
[pid 25537] 10:12:37.453907 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25529] 10:12:37.453940 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.453976 access("/bin/sh", X_OK <unfinished ...>
[pid 25544] 10:12:37.454006 <... mmap resumed> ) = 0x7fa6925a2000
[pid 25543] 10:12:37.454028 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.454048 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.454074 read(14,  <unfinished ...>
[pid 25529] 10:12:37.454098 <... mmap resumed> ) = 0x7f21d336b000
[pid 25545] 10:12:37.454123 <... access resumed> ) = 0
[pid 25544] 10:12:37.454140 close(6 <unfinished ...>
[pid 25543] 10:12:37.454284 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.454334 <... mmap resumed> ) = 0x7fa5f9739000
[pid 25537] 10:12:37.454362 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25529] 10:12:37.454463 read(11,  <unfinished ...>
[pid 25545] 10:12:37.454506 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.454608 <... close resumed> ) = 0
[pid 25543] 10:12:37.454634 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.454654 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.454681 read(14,  <unfinished ...>
[pid 25529] 10:12:37.454705 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.454747 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.454778 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.454809 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.454839 <... mmap resumed> ) = 0x7fa5f9737000
[pid 25537] 10:12:37.454860 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25529] 10:12:37.454937 close(11 <unfinished ...>
[pid 25545] 10:12:37.454976 geteuid( <unfinished ...>
[pid 25544] 10:12:37.454998 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.455015 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.455034 arch_prctl(ARCH_SET_FS, 0x7fa5f97377c0 <unfinished ...>
[pid 25537] 10:12:37.455059 read(14,  <unfinished ...>
[pid 25529] 10:12:37.455083 <... close resumed> ) = 0
[pid 25545] 10:12:37.455108 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.455124 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.455157 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.455188 <... arch_prctl resumed> ) = 0
[pid 25537] 10:12:37.455246 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25529] 10:12:37.455329 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25545] 10:12:37.455371 getegid( <unfinished ...>
[pid 25544] 10:12:37.455394 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.455411 <... open resumed> ) = 6
[pid 25541] 10:12:37.455427 mprotect(0x7fa5f54f2000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.455454 read(14,  <unfinished ...>
[pid 25529] 10:12:37.455480 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.455622 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.455649 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.455682 read(6,  <unfinished ...>
[pid 25541] 10:12:37.455706 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.455732 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25529] 10:12:37.455816 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.455858 getuid( <unfinished ...>
[pid 25544] 10:12:37.455880 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.455899 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.455923 mprotect(0x7fa5f56f6000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.455951 read(14,  <unfinished ...>
[pid 25529] 10:12:37.455975 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.456104 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.456128 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.456162 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.456185 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.456221 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25529] 10:12:37.456296 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25545] 10:12:37.456339 getgid( <unfinished ...>
[pid 25544] 10:12:37.456361 <... open resumed> ) = 6
[pid 25543] 10:12:37.456377 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25541] 10:12:37.456407 mprotect(0x7fa5f5901000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.456435 read(14,  <unfinished ...>
[pid 25529] 10:12:37.456459 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25545] 10:12:37.456511 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.456594 read(6,  <unfinished ...>
[pid 25543] 10:12:37.456627 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.456655 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.456681 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25529] 10:12:37.456788 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.456834 access("/bin/sh", R_OK <unfinished ...>
[pid 25544] 10:12:37.456863 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.456892 <... mmap resumed> ) = 0x7fe585ed1000
[pid 25541] 10:12:37.456912 mprotect(0x7fa5f5b17000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.456940 read(14,  <unfinished ...>
[pid 25529] 10:12:37.456965 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.457046 <... access resumed> ) = 0
[pid 25544] 10:12:37.457099 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.457149 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.457184 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.457217 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25529] 10:12:37.457249 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.457290 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.457318 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.457349 <... mmap resumed> ) = 0x7fe5851c3000
[pid 25541] 10:12:37.457366 mprotect(0x7fa5f5d42000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.457393 read(14,  <unfinished ...>
[pid 25529] 10:12:37.457418 <... open resumed> ) = 11
[pid 25545] 10:12:37.457444 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.457473 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.457500 mprotect(0x7fe5851cf000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.457608 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.457643 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25529] 10:12:37.457725 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.457763 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.457790 <... mmap resumed> ) = 0x7fa692115000
[pid 25543] 10:12:37.457806 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.457822 mprotect(0x7fa5f5f47000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.457849 read(14,  <unfinished ...>
[pid 25529] 10:12:37.457873 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.457914 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.457942 mprotect(0x7fa692198000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.457975 mmap(0x7fe5853cf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25541] 10:12:37.458006 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.458128 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25529] 10:12:37.458160 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.458194 geteuid( <unfinished ...>
[pid 25544] 10:12:37.458216 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.458231 <... mmap resumed> ) = 0x7fe5853cf000
[pid 25541] 10:12:37.458256 mprotect(0x7fa5f6224000, 40960, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.458284 read(14,  <unfinished ...>
[pid 25529] 10:12:37.458308 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.458347 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.458364 mmap(0x7fa692397000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25543] 10:12:37.458402 close(6 <unfinished ...>
[pid 25541] 10:12:37.458427 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.458612 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25529] 10:12:37.458698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.458740 getegid( <unfinished ...>
[pid 25544] 10:12:37.458762 <... mmap resumed> ) = 0x7fa692397000
[pid 25543] 10:12:37.458788 <... close resumed> ) = 0
[pid 25541] 10:12:37.458814 mprotect(0x7fa5f6471000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.458843 read(14,  <unfinished ...>
[pid 25529] 10:12:37.458867 <... mmap resumed> ) = 0x7f21d336b000
[pid 25545] 10:12:37.458893 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.458909 close(6 <unfinished ...>
[pid 25543] 10:12:37.458932 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.458968 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.458995 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25529] 10:12:37.459029 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.459063 getuid( <unfinished ...>
[pid 25544] 10:12:37.459085 <... close resumed> ) = 0
[pid 25543] 10:12:37.459107 <... open resumed> ) = 6
[pid 25541] 10:12:37.459124 mprotect(0x7fa5f668b000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.459150 read(14,  <unfinished ...>
[pid 25529] 10:12:37.459174 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.459199 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.459215 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.459245 read(6,  <unfinished ...>
[pid 25541] 10:12:37.459268 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.459288 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25529] 10:12:37.459364 read(11,  <unfinished ...>
[pid 25545] 10:12:37.459403 getgid( <unfinished ...>
[pid 25544] 10:12:37.459426 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.459449 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.459475 mprotect(0x7fa5f6898000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.459503 read(14,  <unfinished ...>
[pid 25529] 10:12:37.459603 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25545] 10:12:37.459645 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.459662 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.459697 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.459721 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.459926 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25529] 10:12:37.460014 read(11,  <unfinished ...>
[pid 25545] 10:12:37.460064 access("/bin/sh", X_OK <unfinished ...>
[pid 25544] 10:12:37.460093 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.460111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25541] 10:12:37.460142 mprotect(0x7fa5f7084000, 110592, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.460170 read(14,  <unfinished ...>
[pid 25529] 10:12:37.460194 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.460225 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25545] 10:12:37.460260 <... access resumed> ) = 0
[pid 25544] 10:12:37.460277 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.460308 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.460336 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.460426 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25529] 10:12:37.460472 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.460502 recvfrom(16,  <unfinished ...>
[pid 25545] 10:12:37.460610 stat("/bin/sh",  <unfinished ...>
[pid 25544] 10:12:37.460641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.460661 <... mmap resumed> ) = 0x7fe584fa0000
[pid 25541] 10:12:37.460678 mprotect(0x7fa5f7310000, 16384, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.460705 read(14,  <unfinished ...>
[pid 25529] 10:12:37.460729 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.460767 <... recvfrom resumed> "\212\205\201\200\0\1\0\1\0\0\0\0\3mx2\temailsrvr\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1\204\0\4\255\313\2 ", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 51
[pid 25545] 10:12:37.460816 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108280508, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1776, st_size=906152, st_atime=2015/09/22-11:40:33, st_mtime=2015/09/22-11:40:33, st_ctime=2015/12/22-09:33:07}) = 0
[pid 25544] 10:12:37.460846 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.460877 mprotect(0x7fe584fc1000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.460905 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.461005 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25529] 10:12:37.461107 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25522] 10:12:37.461140 close(16 <unfinished ...>
[pid 25545] 10:12:37.461179 geteuid( <unfinished ...>
[pid 25544] 10:12:37.461202 <... open resumed> ) = 6
[pid 25543] 10:12:37.461218 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.461235 mprotect(0x7fa5f76a5000, 16384, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.461262 read(14,  <unfinished ...>
[pid 25529] 10:12:37.461286 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.461329 <... close resumed> ) = 0
[pid 25545] 10:12:37.461456 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.461481 read(6,  <unfinished ...>
[pid 25543] 10:12:37.461506 mmap(0x7fe5851c1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25541] 10:12:37.461611 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.461635 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25529] 10:12:37.461729 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.461762 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25545] 10:12:37.461800 getegid( <unfinished ...>
[pid 25544] 10:12:37.461822 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.461846 <... mmap resumed> ) = 0x7fe5851c1000
[pid 25541] 10:12:37.461868 mprotect(0x7fa5f78b0000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.461896 read(14,  <unfinished ...>
[pid 25529] 10:12:37.461920 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.461981 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25545] 10:12:37.462046 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.462073 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.462097 close(6 <unfinished ...>
[pid 25541] 10:12:37.462120 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.462145 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25529] 10:12:37.462238 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.462268 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.462309 getuid( <unfinished ...>
[pid 25544] 10:12:37.462331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25543] 10:12:37.462361 <... close resumed> ) = 0
[pid 25541] 10:12:37.462394 mprotect(0x7fa5f7ab4000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.462428 read(14,  <unfinished ...>
[pid 25529] 10:12:37.462453 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.462498 <... open resumed> ) = 16
[pid 25545] 10:12:37.462617 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.462641 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.462669 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.462701 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.463331 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25529] 10:12:37.463368 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.463399 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25545] 10:12:37.463435 getgid( <unfinished ...>
[pid 25544] 10:12:37.463457 <... mmap resumed> ) = 0x7fa692c15000
[pid 25543] 10:12:37.463477 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.463496 mprotect(0x7fa5f880c000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.463575 brk(0x1346000 <unfinished ...>
[pid 25529] 10:12:37.463606 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.463660 <... ioctl resumed> , 0x7ffd5c5bc730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25545] 10:12:37.463693 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.463710 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.463739 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.463772 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.463811 <... brk resumed> ) = 0x1346000
[pid 25529] 10:12:37.463904 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.463934 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.463969 access("/bin/sh", R_OK <unfinished ...>
[pid 25544] 10:12:37.463997 <... mmap resumed> ) = 0x7fa691f07000
[pid 25543] 10:12:37.464014 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.464031 mprotect(0x7fa5f8c41000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.464057 read(14,  <unfinished ...>
[pid 25529] 10:12:37.464088 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.464126 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.464157 <... access resumed> ) = 0
[pid 25544] 10:12:37.464191 mprotect(0x7fa691f13000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.464221 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.464252 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.464273 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25529] 10:12:37.464307 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.464337 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.464376 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.464413 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.464430 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.464453 mprotect(0x7fa5f8ec5000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.464487 read(14,  <unfinished ...>
[pid 25529] 10:12:37.464511 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.464692 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.464740 <... socket resumed> ) = 5
[pid 25544] 10:12:37.464757 mmap(0x7fa692113000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25543] 10:12:37.464788 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.464820 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.464842 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25529] 10:12:37.464920 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.464947 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.464982 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.465020 <... mmap resumed> ) = 0x7fa692113000
[pid 25543] 10:12:37.465046 <... open resumed> ) = 6
[pid 25541] 10:12:37.465064 mprotect(0x7fa5f90ce000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.465091 read(14,  <unfinished ...>
[pid 25529] 10:12:37.465115 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.465132 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.465172 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.465193 close(6 <unfinished ...>
[pid 25543] 10:12:37.465216 read(6,  <unfinished ...>
[pid 25541] 10:12:37.465239 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.465271 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25529] 10:12:37.465358 read(10,  <unfinished ...>
[pid 25522] 10:12:37.465386 read(16,  <unfinished ...>
[pid 25545] 10:12:37.465427 close(5 <unfinished ...>
[pid 25544] 10:12:37.465453 <... close resumed> ) = 0
[pid 25543] 10:12:37.465479 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.465505 mprotect(0x7fa5f9313000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.465612 read(14,  <unfinished ...>
[pid 25529] 10:12:37.465640 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25522] 10:12:37.465667 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25545] 10:12:37.465898 <... close resumed> ) = 0
[pid 25544] 10:12:37.465924 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.465960 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.465984 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.466010 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25529] 10:12:37.466046 read(10,  <unfinished ...>
[pid 25522] 10:12:37.466070 close(16 <unfinished ...>
[pid 25545] 10:12:37.466106 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.466133 <... open resumed> ) = 6
[pid 25543] 10:12:37.466149 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.466181 mprotect(0x7fa5f952d000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.466209 read(14,  <unfinished ...>
[pid 25529] 10:12:37.466233 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.466278 <... close resumed> ) = 0
[pid 25545] 10:12:37.466333 <... socket resumed> ) = 5
[pid 25544] 10:12:37.466355 read(6,  <unfinished ...>
[pid 25543] 10:12:37.466385 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.466422 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.466475 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25529] 10:12:37.466669 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.466706 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25545] 10:12:37.466758 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.466791 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.466824 <... mmap resumed> ) = 0x7fe584d83000
[pid 25541] 10:12:37.466842 mprotect(0x7fa5f9750000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.466870 read(14,  <unfinished ...>
[pid 25529] 10:12:37.466895 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25522] 10:12:37.466937 <... open resumed> ) = 16
[pid 25545] 10:12:37.466966 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.466984 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.467008 mprotect(0x7fe584d9a000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.467036 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.467052 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25529] 10:12:37.467085 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.467115 alarm(60 <unfinished ...>
[pid 25545] 10:12:37.467150 close(5 <unfinished ...>
[pid 25544] 10:12:37.467177 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25543] 10:12:37.467207 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.467224 munmap(0x7fa5f9745000, 39387 <unfinished ...>
[pid 25537] 10:12:37.467254 read(14,  <unfinished ...>
[pid 25529] 10:12:37.467278 <... open resumed> ) = 12
[pid 25522] 10:12:37.467295 <... alarm resumed> ) = 0
[pid 25545] 10:12:37.467321 <... close resumed> ) = 0
[pid 25544] 10:12:37.467345 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.467375 mmap(0x7fe584f9a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25541] 10:12:37.467406 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.467423 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25529] 10:12:37.467511 fstat(12,  <unfinished ...>
[pid 25522] 10:12:37.467620 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25545] 10:12:37.467664 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.467694 <... mmap resumed> ) = 0x7fa691ce4000
[pid 25543] 10:12:37.467711 <... mmap resumed> ) = 0x7fe584f9a000
[pid 25541] 10:12:37.467732 set_tid_address(0x7fa5f9737a90 <unfinished ...>
[pid 25537] 10:12:37.467757 read(14,  <unfinished ...>
[pid 25529] 10:12:37.467781 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25522] 10:12:37.467814 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.467841 <... open resumed> ) = 5
[pid 25544] 10:12:37.467860 mprotect(0x7fa691d05000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.467889 mmap(0x7fe584f9c000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.467925 <... set_tid_address resumed> ) = 25541
[pid 25537] 10:12:37.467941 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25529] 10:12:37.468018 fstat(12,  <unfinished ...>
[pid 25522] 10:12:37.468045 alarm(0 <unfinished ...>
[pid 25545] 10:12:37.468080 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.468102 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.468119 <... mmap resumed> ) = 0x7fe584f9c000
[pid 25541] 10:12:37.468140 set_robust_list(0x7fa5f9737aa0, 24 <unfinished ...>
[pid 25537] 10:12:37.468165 read(14,  <unfinished ...>
[pid 25529] 10:12:37.468189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25522] 10:12:37.468218 <... alarm resumed> ) = 60
[pid 25545] 10:12:37.468270 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25544] 10:12:37.468301 mmap(0x7fa691f05000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25543] 10:12:37.468331 close(6 <unfinished ...>
[pid 25541] 10:12:37.468354 <... set_robust_list resumed> ) = 0
[pid 25537] 10:12:37.468377 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25529] 10:12:37.468413 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.468441 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25545] 10:12:37.468493 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.468519 <... mmap resumed> ) = 0x7fa691f05000
[pid 25543] 10:12:37.468621 <... close resumed> ) = 0
[pid 25541] 10:12:37.468647 futex(0x7ffea6d5464c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25537] 10:12:37.468674 read(14,  <unfinished ...>
[pid 25529] 10:12:37.468698 <... mmap resumed> ) = 0x7f21d336a000
[pid 25522] 10:12:37.468714 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25545] 10:12:37.468758 <... mmap resumed> ) = 0x7faa41737000
[pid 25544] 10:12:37.468775 close(6 <unfinished ...>
[pid 25543] 10:12:37.468798 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.468828 <... futex resumed> ) = 0
[pid 25537] 10:12:37.468844 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25529] 10:12:37.468924 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.468952 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.468994 read(5,  <unfinished ...>
[pid 25544] 10:12:37.469021 <... close resumed> ) = 0
[pid 25543] 10:12:37.469044 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.469063 futex(0x7ffea6d5464c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fa5f97377c0 <unfinished ...>
[pid 25537] 10:12:37.469096 read(14,  <unfinished ...>
[pid 25529] 10:12:37.469121 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.469138 <... open resumed> ) = 17
[pid 25545] 10:12:37.469165 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25544] 10:12:37.469200 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.469230 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.469263 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25537] 10:12:37.469287 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25529] 10:12:37.469317 read(12,  <unfinished ...>
[pid 25522] 10:12:37.469341 fcntl(17, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.469378 read(5,  <unfinished ...>
[pid 25544] 10:12:37.469401 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.469419 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.469436 rt_sigaction(SIGRTMIN, {0x7fa5f85fac60, [], SA_RESTORER|SA_SIGINFO, 0x7fa5f8604790},  <unfinished ...>
[pid 25537] 10:12:37.469466 read(14,  <unfinished ...>
[pid 25529] 10:12:37.469490 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.469514 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.469638 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:37.469660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.469694 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.469723 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.469739 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25529] 10:12:37.469816 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.469848 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.469882 close(5 <unfinished ...>
[pid 25544] 10:12:37.469907 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.469924 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.469943 rt_sigaction(SIGRT_1, {0x7fa5f85facf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fa5f8604790},  <unfinished ...>
[pid 25537] 10:12:37.469972 read(14,  <unfinished ...>
[pid 25529] 10:12:37.469997 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.470045 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.470076 <... close resumed> ) = 0
[pid 25544] 10:12:37.470092 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.470123 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.470152 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.470167 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25529] 10:12:37.470206 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.470236 read(17,  <unfinished ...>
[pid 25545] 10:12:37.470270 munmap(0x7faa41737000, 4096 <unfinished ...>
[pid 25544] 10:12:37.470298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.470320 <... open resumed> ) = 6
[pid 25541] 10:12:37.470336 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25537] 10:12:37.470362 read(14,  <unfinished ...>
[pid 25529] 10:12:37.470391 <... open resumed> ) = 13
[pid 25522] 10:12:37.470415 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25545] 10:12:37.470461 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.470493 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.470611 read(6,  <unfinished ...>
[pid 25541] 10:12:37.470641 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25537] 10:12:37.470668 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25529] 10:12:37.470753 fstat(13,  <unfinished ...>
[pid 25522] 10:12:37.470781 close(17 <unfinished ...>
[pid 25545] 10:12:37.470816 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.470846 <... open resumed> ) = 6
[pid 25543] 10:12:37.470862 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.470885 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25537] 10:12:37.470908 read(14,  <unfinished ...>
[pid 25529] 10:12:37.470932 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.470961 <... close resumed> ) = 0
[pid 25545] 10:12:37.470992 <... open resumed> ) = 5
[pid 25544] 10:12:37.471009 read(6,  <unfinished ...>
[pid 25543] 10:12:37.471032 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.471054 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25537] 10:12:37.471111 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25529] 10:12:37.471187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.471220 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.471260 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.471283 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.471312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25541] 10:12:37.471342 statfs("/selinux",  <unfinished ...>
[pid 25537] 10:12:37.471377 read(14,  <unfinished ...>
[pid 25529] 10:12:37.471401 <... mmap resumed> ) = 0x7f21d3369000
[pid 25522] 10:12:37.471418 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.471448 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.471477 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.471500 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.471641 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350324, f_bavail=6350324, f_files=1000000, f_ffree=691079, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25537] 10:12:37.471718 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25529] 10:12:37.471795 read(13,  <unfinished ...>
[pid 25522] 10:12:37.471833 stat("/var/tmp",  <unfinished ...>
[pid 25545] 10:12:37.471875 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.471902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.471933 <... mmap resumed> ) = 0x7fe585ed0000
[pid 25541] 10:12:37.471953 brk(0 <unfinished ...>
[pid 25537] 10:12:37.471976 read(14,  <unfinished ...>
[pid 25529] 10:12:37.472000 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.472031 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25545] 10:12:37.472090 <... mmap resumed> ) = 0x7faa4172e000
[pid 25544] 10:12:37.472182 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.472214 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.472241 <... brk resumed> ) = 0x13c0000
[pid 25537] 10:12:37.472257 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25529] 10:12:37.472291 close(13 <unfinished ...>
[pid 25522] 10:12:37.472316 brk(0x1948000 <unfinished ...>
[pid 25545] 10:12:37.472358 close(5 <unfinished ...>
[pid 25544] 10:12:37.472390 <... mmap resumed> ) = 0x7fa691ac7000
[pid 25543] 10:12:37.472421 <... mmap resumed> ) = 0x7fe584a0f000
[pid 25541] 10:12:37.472443 brk(0x13e1000 <unfinished ...>
[pid 25537] 10:12:37.472472 read(14,  <unfinished ...>
[pid 25529] 10:12:37.472497 <... close resumed> ) = 0
[pid 25522] 10:12:37.472513 <... brk resumed> ) = 0x1948000
[pid 25545] 10:12:37.472701 <... close resumed> ) = 0
[pid 25544] 10:12:37.472733 mprotect(0x7fa691ade000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.472763 mprotect(0x7fe584b7e000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.472790 <... brk resumed> ) = 0x13e1000
[pid 25537] 10:12:37.472816 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25529] 10:12:37.472910 munmap(0x7f21d3369000, 4096 <unfinished ...>
[pid 25522] 10:12:37.472942 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.472985 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.473018 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.473034 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.473050 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.473086 read(14,  <unfinished ...>
[pid 25529] 10:12:37.473111 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.473152 <... open resumed> ) = 17
[pid 25545] 10:12:37.473183 <... open resumed> ) = 5
[pid 25544] 10:12:37.473199 mmap(0x7fa691cde000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25543] 10:12:37.473230 mmap(0x7fe584d7d000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25541] 10:12:37.473257 <... open resumed> ) = 6
[pid 25537] 10:12:37.473286 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25529] 10:12:37.473359 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.473392 fcntl(17, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.473426 read(5,  <unfinished ...>
[pid 25544] 10:12:37.473450 <... mmap resumed> ) = 0x7fa691cde000
[pid 25543] 10:12:37.473471 <... mmap resumed> ) = 0x7fe584d7d000
[pid 25541] 10:12:37.473498 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.473597 read(14,  <unfinished ...>
[pid 25529] 10:12:37.473629 <... open resumed> ) = 13
[pid 25522] 10:12:37.473646 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.473673 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.473698 mmap(0x7fa691ce0000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.473728 close(6 <unfinished ...>
[pid 25541] 10:12:37.473751 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25537] 10:12:37.473782 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25529] 10:12:37.473865 fstat(13,  <unfinished ...>
[pid 25522] 10:12:37.473893 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.473927 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.473950 <... mmap resumed> ) = 0x7fa691ce0000
[pid 25543] 10:12:37.473978 <... close resumed> ) = 0
[pid 25541] 10:12:37.474004 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.474032 read(14,  <unfinished ...>
[pid 25529] 10:12:37.474056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.474089 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.474117 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.474151 close(6 <unfinished ...>
[pid 25543] 10:12:37.474175 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.474209 <... mmap resumed> ) = 0x7fa5f974e000
[pid 25537] 10:12:37.474226 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25529] 10:12:37.474301 fstat(13,  <unfinished ...>
[pid 25522] 10:12:37.474329 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.474362 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.474398 <... close resumed> ) = 0
[pid 25543] 10:12:37.474428 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.474449 read(6,  <unfinished ...>
[pid 25537] 10:12:37.474665 read(14,  <unfinished ...>
[pid 25529] 10:12:37.474693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.474723 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25545] 10:12:37.474778 <... mmap resumed> ) = 0x7faa40b53000
[pid 25544] 10:12:37.474798 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.474828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.474860 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25537] 10:12:37.474889 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25529] 10:12:37.474967 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.474998 pread(17,  <unfinished ...>
[pid 25545] 10:12:37.475034 mprotect(0x7faa40b5f000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.475068 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.475087 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.475104 read(6,  <unfinished ...>
[pid 25537] 10:12:37.475127 read(14,  <unfinished ...>
[pid 25529] 10:12:37.475150 <... mmap resumed> ) = 0x7f21d3369000
[pid 25522] 10:12:37.475167 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25545] 10:12:37.475223 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.475244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.475277 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.475307 <... read resumed> "", 1024) = 0
[pid 25537] 10:12:37.475330 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25529] 10:12:37.475405 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.475432 pread(17,  <unfinished ...>
[pid 25545] 10:12:37.475469 mmap(0x7faa40d5f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25544] 10:12:37.475500 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.475517 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.475619 close(6 <unfinished ...>
[pid 25537] 10:12:37.475650 read(14,  <unfinished ...>
[pid 25529] 10:12:37.475675 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.475691 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25545] 10:12:37.475746 <... mmap resumed> ) = 0x7faa40d5f000
[pid 25544] 10:12:37.475775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.475808 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.475841 <... close resumed> ) = 0
[pid 25537] 10:12:37.475857 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25529] 10:12:37.475931 read(13,  <unfinished ...>
[pid 25522] 10:12:37.475961 pread(17,  <unfinished ...>
[pid 25545] 10:12:37.475996 close(5 <unfinished ...>
[pid 25544] 10:12:37.476019 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.476037 <... open resumed> ) = 6
[pid 25541] 10:12:37.476053 munmap(0x7fa5f974e000, 4096 <unfinished ...>
[pid 25537] 10:12:37.476081 read(14,  <unfinished ...>
[pid 25529] 10:12:37.476105 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25522] 10:12:37.476136 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25545] 10:12:37.476196 <... close resumed> ) = 0
[pid 25544] 10:12:37.476231 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.476263 read(6,  <unfinished ...>
[pid 25541] 10:12:37.476287 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.476361 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25529] 10:12:37.476453 read(13,  <unfinished ...>
[pid 25522] 10:12:37.476487 close(17 <unfinished ...>
[pid 25545] 10:12:37.476600 mprotect(0x7faa40d5f000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.476634 <... open resumed> ) = 6
[pid 25543] 10:12:37.476651 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.476675 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25537] 10:12:37.476708 read(14,  <unfinished ...>
[pid 25529] 10:12:37.476732 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.476759 <... close resumed> ) = 0
[pid 25545] 10:12:37.476806 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.476828 read(6,  <unfinished ...>
[pid 25543] 10:12:37.476853 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.476876 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.476972 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25529] 10:12:37.477008 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25522] 10:12:37.477039 close(16 <unfinished ...>
[pid 25545] 10:12:37.477078 munmap(0x7faa4172e000, 39387 <unfinished ...>
[pid 25544] 10:12:37.477106 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.477130 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25541] 10:12:37.477168 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25537] 10:12:37.477197 read(14,  <unfinished ...>
[pid 25529] 10:12:37.477221 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.477257 <... close resumed> ) = 0
[pid 25545] 10:12:37.477294 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.477319 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.477344 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.477372 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.477398 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25529] 10:12:37.477481 stat("/usr/local/cpanel/3rdparty/mailman/lists/antiquewedding_gmail.com/config.pck",  <unfinished ...>
[pid 25522] 10:12:37.477520 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.477641 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.477672 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.477702 <... mmap resumed> ) = 0x7fe584780000
[pid 25541] 10:12:37.477719 fstat(2,  <unfinished ...>
[pid 25537] 10:12:37.477742 read(14,  <unfinished ...>
[pid 25529] 10:12:37.477766 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.477796 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.477826 <... open resumed> ) = 5
[pid 25544] 10:12:37.477845 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.477873 mprotect(0x7fe58480b000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.477900 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25537] 10:12:37.477959 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25529] 10:12:37.478040 stat("/etc/demouids",  <unfinished ...>
[pid 25522] 10:12:37.478071 read(13,  <unfinished ...>
[pid 25545] 10:12:37.478105 fcntl(5, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.478128 <... mmap resumed> ) = 0x7fa692c14000
[pid 25543] 10:12:37.478148 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.478165 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fa5f8604790},  <unfinished ...>
[pid 25537] 10:12:37.478192 read(14,  <unfinished ...>
[pid 25529] 10:12:37.478216 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.478258 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25545] 10:12:37.478310 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25544] 10:12:37.478334 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.478365 mmap(0x7fe584a0b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25541] 10:12:37.478407 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.478436 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25529] 10:12:37.478473 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.478504 stat("/jail_owner",  <unfinished ...>
[pid 25545] 10:12:37.478623 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.478649 <... mmap resumed> ) = 0x7fa691753000
[pid 25543] 10:12:37.478666 <... mmap resumed> ) = 0x7fe584a0b000
[pid 25541] 10:12:37.478687 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25537] 10:12:37.478716 read(14,  <unfinished ...>
[pid 25529] 10:12:37.478739 <... open resumed> ) = 14
[pid 25522] 10:12:37.478756 <... stat resumed> 0x7ffd5c5bb110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.478791 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:37.478822 mprotect(0x7fa6918c2000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.478849 mmap(0x7fe584a0e000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.478878 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25537] 10:12:37.478897 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25529] 10:12:37.478969 fstat(14,  <unfinished ...>
[pid 25522] 10:12:37.478997 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25545] 10:12:37.479037 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.479062 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.479078 <... mmap resumed> ) = 0x7fe584a0e000
[pid 25541] 10:12:37.479100 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25537] 10:12:37.479128 brk(0x1367000 <unfinished ...>
[pid 25529] 10:12:37.479152 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.479184 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25545] 10:12:37.479230 <... mmap resumed> ) = 0x7faa41737000
[pid 25544] 10:12:37.479248 mmap(0x7fa691ac1000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25543] 10:12:37.479277 close(6 <unfinished ...>
[pid 25541] 10:12:37.479300 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25537] 10:12:37.479322 <... brk resumed> ) = 0x1367000
[pid 25529] 10:12:37.479355 fstat(14,  <unfinished ...>
[pid 25522] 10:12:37.479386 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25545] 10:12:37.479442 read(5,  <unfinished ...>
[pid 25544] 10:12:37.479475 <... mmap resumed> ) = 0x7fa691ac1000
[pid 25543] 10:12:37.479501 <... close resumed> ) = 0
[pid 25541] 10:12:37.479608 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25537] 10:12:37.479643 read(14,  <unfinished ...>
[pid 25529] 10:12:37.479667 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.479696 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.479732 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:37.479769 close(6 <unfinished ...>
[pid 25543] 10:12:37.479793 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.479823 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25537] 10:12:37.479850 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25529] 10:12:37.479884 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.479911 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25545] 10:12:37.479951 close(5 <unfinished ...>
[pid 25544] 10:12:37.479975 <... close resumed> ) = 0
[pid 25543] 10:12:37.479999 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.480017 umask(0 <unfinished ...>
[pid 25537] 10:12:37.480040 read(14,  <unfinished ...>
[pid 25529] 10:12:37.480064 <... mmap resumed> ) = 0x7f21d3368000
[pid 25522] 10:12:37.480080 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25545] 10:12:37.480125 <... close resumed> ) = 0
[pid 25544] 10:12:37.480142 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.480170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.480202 <... umask resumed> ) = 0
[pid 25537] 10:12:37.480261 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25529] 10:12:37.480346 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.480374 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25545] 10:12:37.480415 munmap(0x7faa41737000, 4096 <unfinished ...>
[pid 25544] 10:12:37.480444 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.480463 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.480481 geteuid( <unfinished ...>
[pid 25537] 10:12:37.480504 read(14,  <unfinished ...>
[pid 25529] 10:12:37.480607 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.480632 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.480665 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.480722 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.480764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.480793 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.480812 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25529] 10:12:37.480892 read(14,  <unfinished ...>
[pid 25522] 10:12:37.480920 stat("/etc/demouids",  <unfinished ...>
[pid 25545] 10:12:37.480957 getpgrp( <unfinished ...>
[pid 25544] 10:12:37.480980 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.480997 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.481016 getuid( <unfinished ...>
[pid 25537] 10:12:37.481038 read(14,  <unfinished ...>
[pid 25529] 10:12:37.481062 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.481087 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.481152 <... getpgrp resumed> ) = 29163
[pid 25544] 10:12:37.481183 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.481231 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.481283 <... getuid resumed> ) = 47
[pid 25537] 10:12:37.481312 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25529] 10:12:37.481457 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25522] 10:12:37.481508 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25545] 10:12:37.481699 rt_sigaction(SIGCHLD, {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.481752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.481785 <... open resumed> ) = 6
[pid 25541] 10:12:37.481814 getgid( <unfinished ...>
[pid 25537] 10:12:37.481849 read(14,  <unfinished ...>
[pid 25529] 10:12:37.481886 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.482101 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25545] 10:12:37.482260 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.482310 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.482366 read(6,  <unfinished ...>
[pid 25541] 10:12:37.482409 <... getgid resumed> ) = 12
[pid 25537] 10:12:37.482508 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25529] 10:12:37.482751 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.482807 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.482867 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25544] 10:12:37.482906 <... open resumed> ) = 6
[pid 25543] 10:12:37.482927 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.482958 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25537] 10:12:37.482982 read(14,  <unfinished ...>
[pid 25529] 10:12:37.483006 <... open resumed> ) = 15
[pid 25522] 10:12:37.483025 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.483087 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25544] 10:12:37.483169 read(6,  <unfinished ...>
[pid 25543] 10:12:37.483197 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.483220 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25537] 10:12:37.483239 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25529] 10:12:37.483271 fstat(15,  <unfinished ...>
[pid 25522] 10:12:37.483295 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.483336 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.483359 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.483390 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25541] 10:12:37.483430 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25537] 10:12:37.483461 read(14,  <unfinished ...>
[pid 25529] 10:12:37.483488 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.483517 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.483651 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.483682 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.483706 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.483736 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25537] 10:12:37.483757 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25529] 10:12:37.483861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.483894 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25545] 10:12:37.483934 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.483957 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25543] 10:12:37.483987 <... mmap resumed> ) = 0x7fe58457a000
[pid 25541] 10:12:37.484004 getgroups(65536,  <unfinished ...>
[pid 25537] 10:12:37.484027 read(14,  <unfinished ...>
[pid 25529] 10:12:37.484051 <... mmap resumed> ) = 0x7f21d3367000
[pid 25522] 10:12:37.484067 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.484116 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.484148 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.484177 mprotect(0x7fe584580000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.484205 <... getgroups resumed> []) = 0
[pid 25537] 10:12:37.484228 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25529] 10:12:37.484259 read(15,  <unfinished ...>
[pid 25522] 10:12:37.484287 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.484328 rt_sigprocmask(SIG_BLOCK, NULL,  <unfinished ...>
[pid 25544] 10:12:37.484350 <... mmap resumed> ) = 0x7fa6914c4000
[pid 25543] 10:12:37.484367 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.484382 setgroups(0, [] <unfinished ...>
[pid 25537] 10:12:37.484406 read(14,  <unfinished ...>
[pid 25529] 10:12:37.484430 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.484456 <... open resumed> ) = 16
[pid 25545] 10:12:37.484485 <... rt_sigprocmask resumed> ~[ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE STOP PROF SYS RTMIN RT_1], 8) = 0
[pid 25544] 10:12:37.484644 mprotect(0x7fa69154f000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.484681 mmap(0x7fe58477f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25541] 10:12:37.484713 <... setgroups resumed> ) = 0
[pid 25537] 10:12:37.484732 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25529] 10:12:37.484830 close(15 <unfinished ...>
[pid 25522] 10:12:37.484859 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.484894 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.484921 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.484937 <... mmap resumed> ) = 0x7fe58477f000
[pid 25541] 10:12:37.484959 getegid( <unfinished ...>
[pid 25537] 10:12:37.484981 read(14,  <unfinished ...>
[pid 25529] 10:12:37.485006 <... close resumed> ) = 0
[pid 25522] 10:12:37.485029 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.485073 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.485094 mmap(0x7fa69174f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25543] 10:12:37.485126 close(6 <unfinished ...>
[pid 25541] 10:12:37.485149 <... getegid resumed> ) = 12
[pid 25537] 10:12:37.485165 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25529] 10:12:37.485194 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25522] 10:12:37.485222 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.485256 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.485282 <... mmap resumed> ) = 0x7fa69174f000
[pid 25543] 10:12:37.485301 <... close resumed> ) = 0
[pid 25541] 10:12:37.485325 geteuid( <unfinished ...>
[pid 25537] 10:12:37.485348 read(14,  <unfinished ...>
[pid 25529] 10:12:37.485377 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.485446 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.485493 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.485514 mmap(0x7fa691752000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.485641 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.485675 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.485698 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25529] 10:12:37.485782 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25522] 10:12:37.485814 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.485852 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0},  <unfinished ...>
[pid 25544] 10:12:37.485879 <... mmap resumed> ) = 0x7fa691752000
[pid 25543] 10:12:37.485900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.485920 geteuid( <unfinished ...>
[pid 25537] 10:12:37.485942 read(14,  <unfinished ...>
[pid 25529] 10:12:37.485967 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25522] 10:12:37.486012 <... mmap resumed> ) = 0x7f2e40b0c000
[pid 25545] 10:12:37.486043 <... rt_sigaction resumed> {0x43f5b0, [], SA_RESTORER|SA_RESTART, 0x7faa40d936a0}, 8) = 0
[pid 25544] 10:12:37.486067 close(6 <unfinished ...>
[pid 25543] 10:12:37.486091 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.486126 <... geteuid resumed> ) = 0
[pid 25537] 10:12:37.486142 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25529] 10:12:37.486179 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.486209 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.486242 execve("/usr/sbin/sendmail", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail"] <unfinished ...>
[pid 25544] 10:12:37.486494 <... close resumed> ) = 0
[pid 25543] 10:12:37.486520 <... open resumed> ) = 6
[pid 25541] 10:12:37.486647 getegid( <unfinished ...>
[pid 25537] 10:12:37.486671 read(14,  <unfinished ...>
[pid 25529] 10:12:37.486695 <... open resumed> ) = 15
[pid 25522] 10:12:37.486711 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.486740 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.486772 read(6,  <unfinished ...>
[pid 25541] 10:12:37.486809 <... getegid resumed> ) = 12
[pid 25537] 10:12:37.486829 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25529] 10:12:37.486912 fstat(15,  <unfinished ...>
[pid 25522] 10:12:37.487016 read(16,  <unfinished ...>
[pid 25545] 10:12:37.487056 <... execve resumed> ) = 0
[pid 25544] 10:12:37.487088 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.487108 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.487133 setgid(12 <unfinished ...>
[pid 25537] 10:12:37.487157 read(14,  <unfinished ...>
[pid 25529] 10:12:37.487181 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.487216 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25545] 10:12:37.487287 brk(0 <unfinished ...>
[pid 25544] 10:12:37.487316 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.487349 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.487372 <... setgid resumed> ) = 0
[pid 25537] 10:12:37.487391 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25529] 10:12:37.487423 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.487451 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25545] 10:12:37.487495 <... brk resumed> ) = 0x212b000
[pid 25544] 10:12:37.487513 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.487617 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25541] 10:12:37.487652 setuid(0 <unfinished ...>
[pid 25537] 10:12:37.487677 read(14,  <unfinished ...>
[pid 25529] 10:12:37.487701 <... mmap resumed> ) = 0x7f21d3367000
[pid 25522] 10:12:37.487718 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4137, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.487781 fcntl(0, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.487809 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.487841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.487868 <... setuid resumed> ) = 0
[pid 25537] 10:12:37.487911 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25529] 10:12:37.487996 read(15,  <unfinished ...>
[pid 25522] 10:12:37.488027 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.488070 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.488087 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.488106 <... mmap resumed> ) = 0x7fe585ecf000
[pid 25541] 10:12:37.488126 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.488156 read(14,  <unfinished ...>
[pid 25529] 10:12:37.488180 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.488208 <... open resumed> ) = 17
[pid 25545] 10:12:37.488238 fcntl(1, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.488262 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.488298 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.488327 <... open resumed> ) = 6
[pid 25537] 10:12:37.488353 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25529] 10:12:37.488436 close(15 <unfinished ...>
[pid 25522] 10:12:37.488466 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25545] 10:12:37.488503 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.488518 <... open resumed> ) = 6
[pid 25543] 10:12:37.488617 <... mmap resumed> ) = 0x7fe584244000
[pid 25541] 10:12:37.488635 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.488659 read(14,  <unfinished ...>
[pid 25529] 10:12:37.488682 <... close resumed> ) = 0
[pid 25522] 10:12:37.488698 <... ioctl resumed> , 0x7ffd5c5b80b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25545] 10:12:37.488728 fcntl(2, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.488759 read(6,  <unfinished ...>
[pid 25543] 10:12:37.488791 mprotect(0x7fe584370000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.488820 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25537] 10:12:37.488857 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25529] 10:12:37.488888 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25522] 10:12:37.488916 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.488950 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.488970 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.488994 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.489010 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.489033 read(14,  <unfinished ...>
[pid 25529] 10:12:37.489056 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.489083 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.489115 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25544] 10:12:37.489144 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.489167 mmap(0x7fe584570000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25541] 10:12:37.489197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25537] 10:12:37.489226 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25529] 10:12:37.489311 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.489344 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.489378 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.489415 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25543] 10:12:37.489450 <... mmap resumed> ) = 0x7fe584570000
[pid 25541] 10:12:37.489471 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.489499 read(14,  <unfinished ...>
[pid 25529] 10:12:37.489603 <... open resumed> ) = 15
[pid 25522] 10:12:37.489627 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4137, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.489668 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.489695 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.489723 mmap(0x7fe584579000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.489751 <... mmap resumed> ) = 0x7fa5f974e000
[pid 25537] 10:12:37.489768 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25529] 10:12:37.489802 fstat(15,  <unfinished ...>
[pid 25522] 10:12:37.489826 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.489860 <... mmap resumed> ) = 0x7f86b72a2000
[pid 25544] 10:12:37.489883 <... mmap resumed> ) = 0x7fa6912be000
[pid 25543] 10:12:37.489901 <... mmap resumed> ) = 0x7fe584579000
[pid 25541] 10:12:37.489922 read(6,  <unfinished ...>
[pid 25537] 10:12:37.489951 read(14,  <unfinished ...>
[pid 25529] 10:12:37.489975 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.490003 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.490038 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25544] 10:12:37.490069 mprotect(0x7fa6912c4000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.490096 close(6 <unfinished ...>
[pid 25541] 10:12:37.490119 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25537] 10:12:37.490239 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25529] 10:12:37.490333 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.490366 read(17,  <unfinished ...>
[pid 25545] 10:12:37.490414 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.490438 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.490456 <... close resumed> ) = 0
[pid 25541] 10:12:37.490477 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25537] 10:12:37.490508 read(14,  <unfinished ...>
[pid 25529] 10:12:37.490613 <... mmap resumed> ) = 0x7f21d3367000
[pid 25522] 10:12:37.490633 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4137
[pid 25545] 10:12:37.491331 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.491374 mmap(0x7fa6914c3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25543] 10:12:37.491411 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.491443 <... socket resumed> ) = 7
[pid 25537] 10:12:37.491459 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25529] 10:12:37.491618 read(15,  <unfinished ...>
[pid 25522] 10:12:37.491655 read(17,  <unfinished ...>
[pid 25545] 10:12:37.491690 <... open resumed> ) = 5
[pid 25544] 10:12:37.491706 <... mmap resumed> ) = 0x7fa6914c3000
[pid 25543] 10:12:37.491728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.491746 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25537] 10:12:37.491788 read(14,  <unfinished ...>
[pid 25529] 10:12:37.491814 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.491841 <... read resumed> "", 8192) = 0
[pid 25545] 10:12:37.491874 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.491899 close(6 <unfinished ...>
[pid 25543] 10:12:37.491922 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.491954 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.491971 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25529] 10:12:37.492078 close(15 <unfinished ...>
[pid 25522] 10:12:37.492109 close(17 <unfinished ...>
[pid 25545] 10:12:37.492143 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.492175 <... close resumed> ) = 0
[pid 25543] 10:12:37.492198 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.492216 close(7 <unfinished ...>
[pid 25537] 10:12:37.492243 read(14,  <unfinished ...>
[pid 25529] 10:12:37.492268 <... close resumed> ) = 0
[pid 25522] 10:12:37.492284 <... close resumed> ) = 0
[pid 25545] 10:12:37.492334 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.492366 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.492396 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.492426 <... close resumed> ) = 0
[pid 25537] 10:12:37.492442 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25529] 10:12:37.492610 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25522] 10:12:37.492648 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.492687 <... mmap resumed> ) = 0x7f86b7298000
[pid 25544] 10:12:37.492709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.492728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.492747 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25537] 10:12:37.492779 read(14,  <unfinished ...>
[pid 25529] 10:12:37.492812 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.492927 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.492998 close(5 <unfinished ...>
[pid 25544] 10:12:37.493026 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.493060 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.493091 <... socket resumed> ) = 7
[pid 25537] 10:12:37.493108 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25529] 10:12:37.493141 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.493170 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.493210 <... close resumed> ) = 0
[pid 25544] 10:12:37.493237 <... open resumed> ) = 6
[pid 25543] 10:12:37.493254 <... open resumed> ) = 6
[pid 25541] 10:12:37.493270 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25537] 10:12:37.493303 read(14,  <unfinished ...>
[pid 25529] 10:12:37.493328 <... open resumed> ) = 15
[pid 25522] 10:12:37.493345 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.493393 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.493426 read(6,  <unfinished ...>
[pid 25543] 10:12:37.493450 read(6,  <unfinished ...>
[pid 25541] 10:12:37.493475 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.493492 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25529] 10:12:37.493656 fstat(15,  <unfinished ...>
[pid 25522] 10:12:37.493688 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.493728 <... open resumed> ) = 5
[pid 25544] 10:12:37.493744 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.493768 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.493803 close(7 <unfinished ...>
[pid 25537] 10:12:37.493832 read(14,  <unfinished ...>
[pid 25529] 10:12:37.493856 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.493889 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.493955 read(5,  <unfinished ...>
[pid 25544] 10:12:37.493985 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.494007 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.494030 <... close resumed> ) = 0
[pid 25537] 10:12:37.494053 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25529] 10:12:37.494138 fstat(15,  <unfinished ...>
[pid 25522] 10:12:37.494165 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.494206 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.494231 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.494261 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.494291 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.494320 read(14,  <unfinished ...>
[pid 25529] 10:12:37.494344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.494380 <... open resumed> ) = 17
[pid 25545] 10:12:37.494412 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.494438 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.494469 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.494504 <... open resumed> ) = 7
[pid 25537] 10:12:37.494629 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25529] 10:12:37.494726 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.494757 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.494794 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.494832 <... mmap resumed> ) = 0x7fa692c13000
[pid 25543] 10:12:37.494853 <... mmap resumed> ) = 0x7fe584040000
[pid 25541] 10:12:37.494870 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.494892 read(14,  <unfinished ...>
[pid 25529] 10:12:37.494916 <... mmap resumed> ) = 0x7f21d3367000
[pid 25522] 10:12:37.494933 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.494971 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.494999 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.495025 mprotect(0x7fe584042000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.495052 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25537] 10:12:37.495080 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25529] 10:12:37.495164 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.495192 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.495229 <... mmap resumed> ) = 0x7f86b6cf0000
[pid 25544] 10:12:37.495246 <... mmap resumed> ) = 0x7fa690f88000
[pid 25543] 10:12:37.495262 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.495278 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.495302 read(14,  <unfinished ...>
[pid 25529] 10:12:37.495326 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.495343 <... mmap resumed> ) = 0x7f2e40b0b000
[pid 25545] 10:12:37.495369 mprotect(0x7f86b6e7a000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.495397 mprotect(0x7fa6910b4000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.495422 mmap(0x7fe584242000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25541] 10:12:37.495452 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25537] 10:12:37.495470 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25529] 10:12:37.495501 read(15,  <unfinished ...>
[pid 25522] 10:12:37.495615 read(17,  <unfinished ...>
[pid 25545] 10:12:37.495661 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.495678 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.495694 <... mmap resumed> ) = 0x7fe584242000
[pid 25541] 10:12:37.495718 read(7,  <unfinished ...>
[pid 25537] 10:12:37.495747 read(14,  <unfinished ...>
[pid 25529] 10:12:37.495771 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25522] 10:12:37.495797 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.495840 mmap(0x7f86b707a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x18a000 <unfinished ...>
[pid 25544] 10:12:37.495872 mmap(0x7fa6912b4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25543] 10:12:37.495910 close(6 <unfinished ...>
[pid 25541] 10:12:37.495933 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25537] 10:12:37.495971 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25529] 10:12:37.496053 read(15,  <unfinished ...>
[pid 25522] 10:12:37.496080 close(17 <unfinished ...>
[pid 25545] 10:12:37.496115 <... mmap resumed> ) = 0x7f86b707a000
[pid 25544] 10:12:37.496136 <... mmap resumed> ) = 0x7fa6912b4000
[pid 25543] 10:12:37.496157 <... close resumed> ) = 0
[pid 25541] 10:12:37.496180 read(7,  <unfinished ...>
[pid 25537] 10:12:37.496204 read(14,  <unfinished ...>
[pid 25529] 10:12:37.496228 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.496313 <... close resumed> ) = 0
[pid 25545] 10:12:37.496348 mmap(0x7f86b707f000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.496387 mmap(0x7fa6912bd000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.496422 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.496460 <... read resumed> "", 4096) = 0
[pid 25537] 10:12:37.496482 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25529] 10:12:37.496602 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.496634 munmap(0x7f2e40b0b000, 4096 <unfinished ...>
[pid 25545] 10:12:37.496674 <... mmap resumed> ) = 0x7f86b707f000
[pid 25544] 10:12:37.496696 <... mmap resumed> ) = 0x7fa6912bd000
[pid 25543] 10:12:37.496719 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.496738 close(7 <unfinished ...>
[pid 25537] 10:12:37.496763 brk(0x1388000 <unfinished ...>
[pid 25529] 10:12:37.496788 <... lseek resumed> ) = 353
[pid 25522] 10:12:37.496809 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.496851 close(5 <unfinished ...>
[pid 25544] 10:12:37.496877 close(6 <unfinished ...>
[pid 25543] 10:12:37.496899 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.496932 <... close resumed> ) = 0
[pid 25537] 10:12:37.496948 <... brk resumed> ) = 0x1388000
[pid 25529] 10:12:37.497010 read(9,  <unfinished ...>
[pid 25522] 10:12:37.497036 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.497080 <... close resumed> ) = 0
[pid 25544] 10:12:37.497110 <... close resumed> ) = 0
[pid 25543] 10:12:37.497134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.497153 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.497181 read(14,  <unfinished ...>
[pid 25529] 10:12:37.497206 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.497245 <... open resumed> ) = 17
[pid 25545] 10:12:37.497279 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.497307 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.497338 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.497367 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.497400 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25529] 10:12:37.497481 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.497510 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.497615 <... mmap resumed> ) = 0x7f86b7297000
[pid 25544] 10:12:37.497639 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.497658 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.497677 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.497708 read(14,  <unfinished ...>
[pid 25529] 10:12:37.497732 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.497749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.497791 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.497820 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.497852 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.497884 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.497901 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25529] 10:12:37.497931 read(9,  <unfinished ...>
[pid 25522] 10:12:37.497955 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.497993 <... mmap resumed> ) = 0x7f86b7296000
[pid 25544] 10:12:37.498012 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.498030 <... open resumed> ) = 6
[pid 25541] 10:12:37.498046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.498077 read(14,  <unfinished ...>
[pid 25529] 10:12:37.498101 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25522] 10:12:37.498155 <... mmap resumed> ) = 0x7f2e40b0b000
[pid 25545] 10:12:37.498187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.498214 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.498245 read(6,  <unfinished ...>
[pid 25541] 10:12:37.498268 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.498285 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25529] 10:12:37.498369 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.498420 read(17,  <unfinished ...>
[pid 25545] 10:12:37.498467 <... mmap resumed> ) = 0x7f86b7295000
[pid 25544] 10:12:37.498489 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.498508 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.498646 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.498684 read(14,  <unfinished ...>
[pid 25529] 10:12:37.498708 <... stat resumed> 0x7f21d1a0b880) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.498740 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.498786 arch_prctl(ARCH_SET_FS, 0x7f86b7296700 <unfinished ...>
[pid 25544] 10:12:37.498811 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.498842 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.498865 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.498882 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25529] 10:12:37.498956 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25522] 10:12:37.498987 close(17 <unfinished ...>
[pid 25545] 10:12:37.499022 <... arch_prctl resumed> ) = 0
[pid 25544] 10:12:37.499112 <... open resumed> ) = 6
[pid 25543] 10:12:37.499132 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.499165 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.499194 read(14,  <unfinished ...>
[pid 25529] 10:12:37.499218 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.499267 <... close resumed> ) = 0
[pid 25545] 10:12:37.499298 mprotect(0x7f86b707a000, 16384, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.499326 read(6,  <unfinished ...>
[pid 25543] 10:12:37.499349 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.499379 <... open resumed> ) = 7
[pid 25537] 10:12:37.499395 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25529] 10:12:37.499431 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.499466 munmap(0x7f2e40b0b000, 4096 <unfinished ...>
[pid 25545] 10:12:37.499506 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.499602 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.499639 <... mmap resumed> ) = 0x7fe583e3d000
[pid 25541] 10:12:37.499658 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.499681 read(14,  <unfinished ...>
[pid 25529] 10:12:37.499705 <... open resumed> ) = 16
[pid 25522] 10:12:37.499728 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.499766 mprotect(0x7f86b72a3000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.499796 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.499819 mprotect(0x7fe583e3f000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.499846 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25537] 10:12:37.499876 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25529] 10:12:37.500024 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.500054 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.500093 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.500109 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.500140 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.500156 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25537] 10:12:37.500184 read(14,  <unfinished ...>
[pid 25529] 10:12:37.500207 <... ioctl resumed> , 0x7ffce2d008c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.500227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.500266 munmap(0x7f86b7298000, 39387 <unfinished ...>
[pid 25544] 10:12:37.500296 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.500329 mmap(0x7fe58403e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25541] 10:12:37.500358 <... mmap resumed> ) = 0x7fa5f972d000
[pid 25537] 10:12:37.500381 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25529] 10:12:37.500418 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.500450 pipe( <unfinished ...>
[pid 25545] 10:12:37.500494 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.500619 <... mmap resumed> ) = 0x7fa690d84000
[pid 25543] 10:12:37.500643 <... mmap resumed> ) = 0x7fe58403e000
[pid 25541] 10:12:37.500669 close(7 <unfinished ...>
[pid 25537] 10:12:37.500694 read(14,  <unfinished ...>
[pid 25529] 10:12:37.500718 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.500735 <... pipe resumed> [17, 18]) = 0
[pid 25545] 10:12:37.500765 getuid( <unfinished ...>
[pid 25544] 10:12:37.500787 mprotect(0x7fa690d86000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.500815 close(6 <unfinished ...>
[pid 25541] 10:12:37.500837 <... close resumed> ) = 0
[pid 25537] 10:12:37.500863 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25529] 10:12:37.500964 fstat(16,  <unfinished ...>
[pid 25522] 10:12:37.500992 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25545] 10:12:37.501032 <... getuid resumed> ) = 503
[pid 25544] 10:12:37.501049 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.501066 <... close resumed> ) = 0
[pid 25541] 10:12:37.501089 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.501123 read(14,  <unfinished ...>
[pid 25529] 10:12:37.501147 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25522] 10:12:37.501177 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25545] 10:12:37.501209 getgid( <unfinished ...>
[pid 25544] 10:12:37.501232 mmap(0x7fa690f86000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25543] 10:12:37.501262 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.501293 <... open resumed> ) = 7
[pid 25537] 10:12:37.501309 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25529] 10:12:37.501398 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.501427 close(15 <unfinished ...>
[pid 25545] 10:12:37.501462 <... getgid resumed> ) = 500
[pid 25544] 10:12:37.501480 <... mmap resumed> ) = 0x7fa690f86000
[pid 25543] 10:12:37.501505 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.501597 read(7,  <unfinished ...>
[pid 25537] 10:12:37.501629 read(14,  <unfinished ...>
[pid 25529] 10:12:37.501653 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.501672 <... close resumed> ) = 0
[pid 25545] 10:12:37.501699 getegid( <unfinished ...>
[pid 25544] 10:12:37.501722 close(6 <unfinished ...>
[pid 25543] 10:12:37.501745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.501777 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.501802 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25529] 10:12:37.501893 fstat(16,  <unfinished ...>
[pid 25522] 10:12:37.501921 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25545] 10:12:37.501961 <... getegid resumed> ) = 499
[pid 25544] 10:12:37.501978 <... close resumed> ) = 0
[pid 25543] 10:12:37.502001 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.502021 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.502044 read(14,  <unfinished ...>
[pid 25529] 10:12:37.502067 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25522] 10:12:37.502119 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.502152 getppid( <unfinished ...>
[pid 25544] 10:12:37.502175 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.502206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.502235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25537] 10:12:37.502268 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25529] 10:12:37.502359 read(16,  <unfinished ...>
[pid 25522] 10:12:37.502395 close(14 <unfinished ...>
[pid 25545] 10:12:37.502440 <... getppid resumed> ) = 25389
[pid 25544] 10:12:37.502460 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.502479 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.502497 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25537] 10:12:37.502612 read(14,  <unfinished ...>
[pid 25529] 10:12:37.502639 <... read resumed> "0", 8192) = 1
[pid 25522] 10:12:37.502660 <... close resumed> ) = 0
[pid 25545] 10:12:37.502688 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25544] 10:12:37.502719 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.502751 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.502782 <... mmap resumed> ) = 0x7fa5f50c8000
[pid 25537] 10:12:37.502799 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25529] 10:12:37.502832 read(16,  <unfinished ...>
[pid 25522] 10:12:37.502856 munmap(0x7f2e40b0e000, 4096 <unfinished ...>
[pid 25545] 10:12:37.502892 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25544] 10:12:37.503009 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.503034 <... open resumed> ) = 6
[pid 25541] 10:12:37.503050 mprotect(0x7fa5f50d4000, 2097152, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.503079 read(14,  <unfinished ...>
[pid 25529] 10:12:37.503103 <... read resumed> "", 8192) = 0
[pid 25522] 10:12:37.503123 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.503153 brk(0 <unfinished ...>
[pid 25544] 10:12:37.503177 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.503207 read(6,  <unfinished ...>
[pid 25541] 10:12:37.503230 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.503246 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25529] 10:12:37.503342 close(16 <unfinished ...>
[pid 25522] 10:12:37.503375 close(9 <unfinished ...>
[pid 25545] 10:12:37.503411 <... brk resumed> ) = 0x212b000
[pid 25544] 10:12:37.503427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.503446 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.503476 mmap(0x7fa5f52d4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25537] 10:12:37.503508 read(14,  <unfinished ...>
[pid 25529] 10:12:37.503610 <... close resumed> ) = 0
[pid 25522] 10:12:37.503690 <... close resumed> ) = 0
[pid 25545] 10:12:37.503725 brk(0x214c000 <unfinished ...>
[pid 25544] 10:12:37.503751 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.503784 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.503807 <... mmap resumed> ) = 0x7fa5f52d4000
[pid 25537] 10:12:37.503833 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25529] 10:12:37.503929 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.503964 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.504005 <... brk resumed> ) = 0x214c000
[pid 25544] 10:12:37.504038 <... open resumed> ) = 6
[pid 25543] 10:12:37.504056 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.504087 close(7 <unfinished ...>
[pid 25537] 10:12:37.504110 read(14,  <unfinished ...>
[pid 25529] 10:12:37.504134 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25522] 10:12:37.504182 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.504214 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.504244 read(6,  <unfinished ...>
[pid 25543] 10:12:37.504268 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.504294 <... close resumed> ) = 0
[pid 25537] 10:12:37.504334 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25529] 10:12:37.504423 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.504452 close(13 <unfinished ...>
[pid 25545] 10:12:37.504491 <... socket resumed> ) = 5
[pid 25544] 10:12:37.504507 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.504610 <... mmap resumed> ) = 0x7fe585ece000
[pid 25541] 10:12:37.504640 mprotect(0x7fa5f52d4000, 4096, PROT_READ <unfinished ...>
[pid 25537] 10:12:37.504674 read(14,  <unfinished ...>
[pid 25529] 10:12:37.504704 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.504758 <... close resumed> ) = 0
[pid 25545] 10:12:37.504790 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.504828 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.504852 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.504881 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.504900 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25529] 10:12:37.504991 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.505020 munmap(0x7f2e40b0f000, 4096 <unfinished ...>
[pid 25545] 10:12:37.505060 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.505078 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.505108 <... mmap resumed> ) = 0x7fe583aa9000
[pid 25541] 10:12:37.505125 munmap(0x7fa5f972d000, 39387 <unfinished ...>
[pid 25537] 10:12:37.505152 read(14,  <unfinished ...>
[pid 25529] 10:12:37.505176 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.505209 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.505238 close(5 <unfinished ...>
[pid 25544] 10:12:37.505266 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.505295 mprotect(0x7fe583c33000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.505323 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.505352 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25529] 10:12:37.505434 close(7 <unfinished ...>
[pid 25522] 10:12:37.505463 close(12 <unfinished ...>
[pid 25545] 10:12:37.505498 <... close resumed> ) = 0
[pid 25544] 10:12:37.505514 <... mmap resumed> ) = 0x7fa690b81000
[pid 25543] 10:12:37.505611 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.505631 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.505673 read(14,  <unfinished ...>
[pid 25529] 10:12:37.505707 <... close resumed> ) = 0
[pid 25522] 10:12:37.505737 <... close resumed> ) = 0
[pid 25545] 10:12:37.505778 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.505827 mprotect(0x7fa690b83000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.505878 mmap(0x7fe583e33000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25541] 10:12:37.505933 <... open resumed> ) = 7
[pid 25537] 10:12:37.505967 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25529] 10:12:37.506105 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25522] 10:12:37.506165 munmap(0x7f2e40b10000, 4096 <unfinished ...>
[pid 25545] 10:12:37.506233 <... socket resumed> ) = 5
[pid 25544] 10:12:37.506261 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.506287 <... mmap resumed> ) = 0x7fe583e33000
[pid 25541] 10:12:37.506321 fcntl(7, F_GETFD <unfinished ...>
[pid 25537] 10:12:37.506359 read(14,  <unfinished ...>
[pid 25529] 10:12:37.506410 <... open resumed> ) = 7
[pid 25522] 10:12:37.506444 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.506493 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.506633 mmap(0x7fa690d82000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25543] 10:12:37.506684 mmap(0x7fe583e38000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.506729 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25537] 10:12:37.506761 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25529] 10:12:37.506811 fcntl(7, F_GETFD <unfinished ...>
[pid 25522] 10:12:37.506856 close(16 <unfinished ...>
[pid 25545] 10:12:37.506918 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.506947 <... mmap resumed> ) = 0x7fa690d82000
[pid 25543] 10:12:37.506986 <... mmap resumed> ) = 0x7fe583e38000
[pid 25541] 10:12:37.507024 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.507066 read(14,  <unfinished ...>
[pid 25529] 10:12:37.507103 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.507132 <... close resumed> ) = 0
[pid 25545] 10:12:37.507177 close(5 <unfinished ...>
[pid 25544] 10:12:37.507229 close(6 <unfinished ...>
[pid 25543] 10:12:37.507267 close(6 <unfinished ...>
[pid 25541] 10:12:37.507312 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25537] 10:12:37.507369 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25529] 10:12:37.507503 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.507610 munmap(0x7f2e40b0c000, 4096 <unfinished ...>
[pid 25545] 10:12:37.507658 <... close resumed> ) = 0
[pid 25544] 10:12:37.507689 <... close resumed> ) = 0
[pid 25543] 10:12:37.507716 <... close resumed> ) = 0
[pid 25541] 10:12:37.507744 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.507774 read(14,  <unfinished ...>
[pid 25529] 10:12:37.507799 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.507816 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.507845 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.507878 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.507910 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.507940 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25537] 10:12:37.507959 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25529] 10:12:37.507991 fstat(7,  <unfinished ...>
[pid 25522] 10:12:37.508015 close(11 <unfinished ...>
[pid 25545] 10:12:37.508050 <... open resumed> ) = 5
[pid 25544] 10:12:37.508074 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.508092 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.508117 read(7,  <unfinished ...>
[pid 25537] 10:12:37.508146 read(14,  <unfinished ...>
[pid 25529] 10:12:37.508170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384355, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.508203 <... close resumed> ) = 0
[pid 25545] 10:12:37.508230 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.508254 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.508287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.508318 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25537] 10:12:37.508359 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25529] 10:12:37.508440 write(7, "2015-12-30 10:12:37 [25529] 1aEJMb-0006df-04 SMTP connection outbound 1451491957 1aEJMb-0006df-04 finestweddingsites.com antiquewedding@gmail.com\n", 146 <unfinished ...>
[pid 25522] 10:12:37.508483 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25545] 10:12:37.508523 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25544] 10:12:37.508556 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.508574 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.508591 close(7 <unfinished ...>
[pid 25537] 10:12:37.508616 read(14,  <unfinished ...>
[pid 25529] 10:12:37.508640 <... write resumed> ) = 146
[pid 25522] 10:12:37.508706 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.508742 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.508771 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.508803 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.508833 <... close resumed> ) = 0
[pid 25537] 10:12:37.508849 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25529] 10:12:37.508934 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25522] 10:12:37.508978 close(10 <unfinished ...>
[pid 25545] 10:12:37.509014 <... mmap resumed> ) = 0x7f86b72a1000
[pid 25544] 10:12:37.509031 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.509051 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.509071 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.509099 read(14,  <unfinished ...>
[pid 25529] 10:12:37.509123 <... open resumed> ) = 16
[pid 25522] 10:12:37.509143 <... close resumed> ) = 0
[pid 25545] 10:12:37.509170 read(5,  <unfinished ...>
[pid 25544] 10:12:37.509197 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.509228 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.509266 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.509324 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25529] 10:12:37.509525 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25522] 10:12:37.509559 munmap(0x7f2e40b12000, 4096 <unfinished ...>
[pid 25545] 10:12:37.509598 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25544] 10:12:37.509637 <... open resumed> ) = 6
[pid 25543] 10:12:37.509654 <... open resumed> ) = 6
[pid 25541] 10:12:37.509670 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25537] 10:12:37.509699 read(14,  <unfinished ...>
[pid 25529] 10:12:37.509723 <... lseek resumed> ) = 17
[pid 25522] 10:12:37.509741 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.509770 read(5,  <unfinished ...>
[pid 25544] 10:12:37.509794 read(6,  <unfinished ...>
[pid 25543] 10:12:37.509817 read(6,  <unfinished ...>
[pid 25541] 10:12:37.509840 <... socket resumed> ) = 7
[pid 25537] 10:12:37.509855 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25529] 10:12:37.509890 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.509917 clone( <unfinished ...>
[pid 25545] 10:12:37.510213 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:37.510235 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.510259 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.510282 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25537] 10:12:37.510316 read(14,  <unfinished ...>
[pid 25529] 10:12:37.510340 <... ioctl resumed> , 0x7ffce2d008c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25545] 10:12:37.510379 close(5 <unfinished ...>
[pid 25544] 10:12:37.510411 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.510434 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.510457 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.510552 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25529] 10:12:37.510646 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.510674 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25547
[pid 25545] 10:12:37.510721 <... close resumed> ) = 0
[pid 25544] 10:12:37.510740 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.510772 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25541] 10:12:37.510802 close(7 <unfinished ...>
[pid 25537] 10:12:37.510830 read(14,  <unfinished ...>
[pid 25529] 10:12:37.510854 <... lseek resumed> ) = 17
[pid 25522] 10:12:37.510872 close(18 <unfinished ...>
[pid 25545] 10:12:37.510906 munmap(0x7f86b72a1000, 4096 <unfinished ...>
[pid 25544] 10:12:37.510934 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.510962 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.510991 <... close resumed> ) = 0
[pid 25537] 10:12:37.511008 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25529] 10:12:37.511058 fstat(16,  <unfinished ...>
[pid 25522] 10:12:37.511084 <... close resumed> ) = 0
[pid 25545] 10:12:37.511111 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.511140 <... mmap resumed> ) = 0x7fa692c12000
[pid 25543] 10:12:37.511161 <... mmap resumed> ) = 0x7fe58383d000
[pid 25541] 10:12:37.511178 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25537] 10:12:37.511206 brk(0x13a9000 <unfinished ...>
[pid 25529] 10:12:37.511230 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=17, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.511259 read(17,  <unfinished ...>
[pid 25545] 10:12:37.511292 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.511321 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.511350 mprotect(0x7fe58389f000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.511386 <... socket resumed> ) = 7
[pid 25537] 10:12:37.511410 <... brk resumed> ) = 0x13a9000
[pid 25529] 10:12:37.511551 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.511594 <... open resumed> ) = 5
[pid 25544] 10:12:37.511611 <... mmap resumed> ) = 0x7fa6907ed000
[pid 25543] 10:12:37.511628 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.511644 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25537] 10:12:37.511677 read(14,  <unfinished ...>
[pid 25529] 10:12:37.511701 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.511740 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.511766 mprotect(0x7fa690977000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.511795 mmap(0x7fe583a9e000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25541] 10:12:37.511825 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.511843 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25529] 10:12:37.511933 write(16, "1", 1 <unfinished ...>
[pid 25545] 10:12:37.511979 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.512012 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.512029 <... mmap resumed> ) = 0x7fe583a9e000
[pid 25541] 10:12:37.512054 close(7 <unfinished ...>
[pid 25537] 10:12:37.512083 read(14,  <unfinished ...>
[pid 25529] 10:12:37.512109 <... write resumed> ) = 1
[pid 25545] 10:12:37.512136 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.512163 mmap(0x7fa690b77000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25543] 10:12:37.512194 close(6 <unfinished ...>
[pid 25541] 10:12:37.512217 <... close resumed> ) = 0
[pid 25537] 10:12:37.512239 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25529] 10:12:37.512333 close(16 <unfinished ...>
[pid 25545] 10:12:37.512378 <... mmap resumed> ) = 0x7f86b7298000
[pid 25544] 10:12:37.512401 <... mmap resumed> ) = 0x7fa690b77000
[pid 25543] 10:12:37.512424 <... close resumed> ) = 0
[pid 25541] 10:12:37.512453 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.512556 read(14,  <unfinished ...>
[pid 25529] 10:12:37.512583 <... close resumed> ) = 0
[pid 25545] 10:12:37.512636 close(5 <unfinished ...>
[pid 25544] 10:12:37.512664 mmap(0x7fa690b7c000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.512695 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.512727 <... open resumed> ) = 7
[pid 25537] 10:12:37.512745 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25529] 10:12:37.512844 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.512888 <... close resumed> ) = 0
[pid 25544] 10:12:37.512917 <... mmap resumed> ) = 0x7fa690b7c000
[pid 25543] 10:12:37.512940 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.512960 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.512983 read(14,  <unfinished ...>
[pid 25529] 10:12:37.513007 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.513041 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.513075 close(6 <unfinished ...>
[pid 25543] 10:12:37.513098 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.513131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25537] 10:12:37.513161 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25529] 10:12:37.513265 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.513306 <... open resumed> ) = 5
[pid 25544] 10:12:37.513329 <... close resumed> ) = 0
[pid 25543] 10:12:37.513355 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.513382 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.513417 read(14,  <unfinished ...>
[pid 25529] 10:12:37.513443 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.513579 read(5,  <unfinished ...>
[pid 25544] 10:12:37.513613 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.513644 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.513675 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25537] 10:12:37.513692 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25529] 10:12:37.513767 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.513811 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.513834 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.513853 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.513871 read(7,  <unfinished ...>
[pid 25537] 10:12:37.513899 read(14,  <unfinished ...>
[pid 25529] 10:12:37.513922 <... open resumed> ) = 16
[pid 25545] 10:12:37.513948 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.513972 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.514004 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.514035 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25537] 10:12:37.514069 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25529] 10:12:37.514160 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.514197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.514234 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.514253 <... open resumed> ) = 6
[pid 25541] 10:12:37.514269 close(7 <unfinished ...>
[pid 25537] 10:12:37.514294 read(14,  <unfinished ...>
[pid 25529] 10:12:37.514318 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25545] 10:12:37.514355 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0 <unfinished ...>
[pid 25544] 10:12:37.514398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.514438 read(6,  <unfinished ...>
[pid 25541] 10:12:37.514462 <... close resumed> ) = 0
[pid 25537] 10:12:37.514556 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25529] 10:12:37.514655 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.514697 <... mmap resumed> ) = 0x7f86b6ae2000
[pid 25544] 10:12:37.514714 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.514733 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.514757 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.514786 read(14,  <unfinished ...>
[pid 25529] 10:12:37.514810 <... mmap resumed> ) = 0x7f21d3366000
[pid 25545] 10:12:37.514836 mprotect(0x7f86b6aee000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.514864 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.514895 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.514918 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.514955 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25529] 10:12:37.515041 read(16,  <unfinished ...>
[pid 25545] 10:12:37.515082 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.515098 <... open resumed> ) = 6
[pid 25543] 10:12:37.515114 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25541] 10:12:37.515145 read(6,  <unfinished ...>
[pid 25537] 10:12:37.515171 read(14,  <unfinished ...>
[pid 25529] 10:12:37.515195 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25545] 10:12:37.515230 mmap(0x7f86b6cee000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xc000 <unfinished ...>
[pid 25544] 10:12:37.515261 read(6,  <unfinished ...>
[pid 25543] 10:12:37.515284 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.515312 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25537] 10:12:37.515373 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25529] 10:12:37.515620 read(16,  <unfinished ...>
[pid 25545] 10:12:37.515663 <... mmap resumed> ) = 0x7f86b6cee000
[pid 25544] 10:12:37.515695 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.515722 <... mmap resumed> ) = 0x7fe58345a000
[pid 25541] 10:12:37.515739 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.515769 read(14,  <unfinished ...>
[pid 25529] 10:12:37.515794 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.515821 close(5 <unfinished ...>
[pid 25544] 10:12:37.515845 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.515869 mprotect(0x7fe583613000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.515896 <... open resumed> ) = 7
[pid 25537] 10:12:37.515914 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25529] 10:12:37.516006 close(16 <unfinished ...>
[pid 25545] 10:12:37.516044 <... close resumed> ) = 0
[pid 25544] 10:12:37.516075 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25543] 10:12:37.516110 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.516127 fstat(7,  <unfinished ...>
[pid 25537] 10:12:37.516150 read(14,  <unfinished ...>
[pid 25529] 10:12:37.516175 <... close resumed> ) = 0
[pid 25545] 10:12:37.516200 mprotect(0x7f86b6cee000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.516227 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.516256 mmap(0x7fe583812000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25541] 10:12:37.516287 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25537] 10:12:37.516316 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25529] 10:12:37.516414 munmap(0x7f21d3366000, 4096 <unfinished ...>
[pid 25545] 10:12:37.516459 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.516555 <... mmap resumed> ) = 0x7fa690581000
[pid 25543] 10:12:37.516579 <... mmap resumed> ) = 0x7fe583812000
[pid 25541] 10:12:37.516600 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.516629 read(14,  <unfinished ...>
[pid 25529] 10:12:37.516653 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.516680 munmap(0x7f86b7298000, 39387 <unfinished ...>
[pid 25544] 10:12:37.516709 mprotect(0x7fa6905e3000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.516737 mmap(0x7fe583839000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.516765 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25537] 10:12:37.516782 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25529] 10:12:37.516902 uname( <unfinished ...>
[pid 25545] 10:12:37.516939 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.516962 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.516980 <... mmap resumed> ) = 0x7fe583839000
[pid 25541] 10:12:37.517006 read(7,  <unfinished ...>
[pid 25537] 10:12:37.517035 read(14,  <unfinished ...>
[pid 25529] 10:12:37.517059 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25545] 10:12:37.517166 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.517204 mmap(0x7fa6907e2000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25543] 10:12:37.517236 close(6 <unfinished ...>
[pid 25541] 10:12:37.517259 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25537] 10:12:37.517282 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25529] 10:12:37.517352 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.517408 <... open resumed> ) = 5
[pid 25544] 10:12:37.517430 <... mmap resumed> ) = 0x7fa6907e2000
[pid 25543] 10:12:37.517457 <... close resumed> ) = 0
[pid 25541] 10:12:37.517554 close(7 <unfinished ...>
[pid 25537] 10:12:37.517586 read(14,  <unfinished ...>
[pid 25529] 10:12:37.517611 <... socket resumed> ) = 16
[pid 25545] 10:12:37.517645 fcntl(5, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.517671 close(6 <unfinished ...>
[pid 25543] 10:12:37.517693 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.517725 <... close resumed> ) = 0
[pid 25537] 10:12:37.517741 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25529] 10:12:37.517819 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25545] 10:12:37.517865 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25544] 10:12:37.517886 <... close resumed> ) = 0
[pid 25543] 10:12:37.517914 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.517934 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.517962 read(14,  <unfinished ...>
[pid 25529] 10:12:37.517986 <... connect resumed> ) = 0
[pid 25545] 10:12:37.518016 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.518040 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.518070 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.518101 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.518126 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.518158 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.518197 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:37.518227 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.518245 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.518266 read(6,  <unfinished ...>
[pid 25537] 10:12:37.518291 close(14 <unfinished ...>
[pid 25529] 10:12:37.518315 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25545] 10:12:37.518345 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.518380 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.518419 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.518449 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25537] 10:12:37.518565 <... close resumed> ) = 0
[pid 25529] 10:12:37.518589 sendto(16, "\25\23\1\0\0\1\0\0\0\0\0\0\5gmail\3com\0\0\17\0\1", 27, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.518656 <... mmap resumed> ) = 0x7f86b72a1000
[pid 25544] 10:12:37.518675 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.518692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.518712 uname( <unfinished ...>
[pid 25537] 10:12:37.518735 munmap(0x7f3c0be4a000, 4096 <unfinished ...>
[pid 25529] 10:12:37.518763 <... sendto resumed> ) = 27
[pid 25545] 10:12:37.518789 read(5,  <unfinished ...>
[pid 25544] 10:12:37.518816 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.518847 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.518879 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25537] 10:12:37.518927 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.519768 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.519817 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:37.519857 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.519879 <... open resumed> ) = 6
[pid 25541] 10:12:37.519896 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25537] 10:12:37.519926 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.519973 close(5 <unfinished ...>
[pid 25544] 10:12:37.519998 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.520028 read(6,  <unfinished ...>
[pid 25541] 10:12:37.520053 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790}, 8) = 0
[pid 25537] 10:12:37.520082 <... open resumed> ) = 14
[pid 25545] 10:12:37.520108 <... close resumed> ) = 0
[pid 25544] 10:12:37.520124 <... open resumed> ) = 6
[pid 25543] 10:12:37.520140 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.520163 clone( <unfinished ...>
[pid 25537] 10:12:37.520399 fstat(14,  <unfinished ...>
[pid 25545] 10:12:37.520444 munmap(0x7f86b72a1000, 4096 <unfinished ...>
[pid 25544] 10:12:37.520536 read(6,  <unfinished ...>
[pid 25543] 10:12:37.520568 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.520594 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.520634 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.520659 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.520685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25541] 10:12:37.520715 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa5f9737a90) = 25548
[pid 25537] 10:12:37.520757 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.520795 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.520824 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.520847 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.520873 wait4(25548,  <unfinished ...>
[pid 25537] 10:12:37.520895 <... mmap resumed> ) = 0x7f3c0be4a000
[pid 25545] 10:12:37.520918 <... socket resumed> ) = 5
[pid 25544] 10:12:37.520934 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25543] 10:12:37.520964 <... mmap resumed> ) = 0x7fe585ecd000
[pid 25537] 10:12:37.520984 read(14,  <unfinished ...>
[pid 25545] 10:12:37.521047 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.521083 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.521112 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.521140 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          239000 kB\nCached:           335316 kB\nBuffers:               0 kB\nActive:           309808 kB\nInactive:         467784 kB\nActive(anon):     172476 kB\nInactive(anon):   277604 kB\nActive(file):     137332 kB\nInac"..., 1024) = 588
[pid 25545] 10:12:37.521178 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.521197 <... mmap resumed> ) = 0x7fa69019e000
[pid 25543] 10:12:37.521213 <... mmap resumed> ) = 0x7fe58322d000
[pid 25537] 10:12:37.521230 close(14 <unfinished ...>
[pid 25545] 10:12:37.521264 close(5 <unfinished ...>
[pid 25544] 10:12:37.521290 mprotect(0x7fa690357000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.521319 mprotect(0x7fe583259000, 2097152, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.521352 <... close resumed> ) = 0
[pid 25545] 10:12:37.521380 <... close resumed> ) = 0
[pid 25544] 10:12:37.521400 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.521420 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.521437 munmap(0x7f3c0be4a000, 4096 <unfinished ...>
[pid 25545] 10:12:37.521554 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.521594 mmap(0x7fa690556000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25543] 10:12:37.521626 mmap(0x7fe583459000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25537] 10:12:37.521654 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.522352 <... socket resumed> ) = 5
[pid 25544] 10:12:37.522382 <... mmap resumed> ) = 0x7fa690556000
[pid 25543] 10:12:37.522412 <... mmap resumed> ) = 0x7fe583459000
[pid 25537] 10:12:37.522434 alarm(300 <unfinished ...>
[pid 25545] 10:12:37.522472 connect(5, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.522591 mmap(0x7fa69057d000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.522623 close(6 <unfinished ...>
[pid 25537] 10:12:37.522647 <... alarm resumed> ) = 0
[pid 25545] 10:12:37.522690 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.522711 <... mmap resumed> ) = 0x7fa69057d000
[pid 25543] 10:12:37.522733 <... close resumed> ) = 0
[pid 25537] 10:12:37.522759 brk(0x13ca000 <unfinished ...>
[pid 25545] 10:12:37.522792 close(5 <unfinished ...>
[pid 25544] 10:12:37.522818 close(6 <unfinished ...>
[pid 25543] 10:12:37.522841 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.522875 <... brk resumed> ) = 0x13ca000
[pid 25545] 10:12:37.522940 <... close resumed> ) = 0
[pid 25544] 10:12:37.522966 <... close resumed> ) = 0
[pid 25543] 10:12:37.522991 <... open resumed> ) = 6
[pid 25537] 10:12:37.523009 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2u;=\307\20\2u\23\305\r\206\353C\313\362\351x\352q\300\222\307\\\355\371\376\33>\366\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25545] 10:12:37.523070 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.523101 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.523130 read(6,  <unfinished ...>
[pid 25537] 10:12:37.523154 <... write resumed> ) = 258
[pid 25545] 10:12:37.523180 <... open resumed> ) = 5
[pid 25544] 10:12:37.523200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.523218 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25537] 10:12:37.523242 read(11,  <unfinished ...>
[pid 25545] 10:12:37.523270 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.523294 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.523325 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.523353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:37.523382 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.523409 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25545] 10:12:37.523445 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.523554 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.523592 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.523629 <... mmap resumed> ) = 0x7f86b72a1000
[pid 25544] 10:12:37.523646 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.523665 <... mmap resumed> ) = 0x7fe583028000
[pid 25545] 10:12:37.523687 read(5,  <unfinished ...>
[pid 25544] 10:12:37.523714 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.523745 mprotect(0x7fe58302d000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.523777 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:37.523812 <... open resumed> ) = 6
[pid 25543] 10:12:37.523830 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.523851 close(5 <unfinished ...>
[pid 25544] 10:12:37.523875 read(6,  <unfinished ...>
[pid 25543] 10:12:37.523898 mmap(0x7fe58322c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25545] 10:12:37.523934 <... close resumed> ) = 0
[pid 25544] 10:12:37.523950 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.523973 <... mmap resumed> ) = 0x7fe58322c000
[pid 25545] 10:12:37.524000 munmap(0x7f86b72a1000, 4096 <unfinished ...>
[pid 25544] 10:12:37.524027 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.524051 close(6 <unfinished ...>
[pid 25545] 10:12:37.524078 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.524100 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25543] 10:12:37.524132 <... close resumed> ) = 0
[pid 25545] 10:12:37.524166 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.524196 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.524223 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.524259 <... open resumed> ) = 5
[pid 25544] 10:12:37.524276 <... mmap resumed> ) = 0x7fa692c11000
[pid 25543] 10:12:37.524295 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.524319 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.524342 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.524377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.524424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:37.524466 <... mmap resumed> ) = 0x7fa68ff71000
[pid 25543] 10:12:37.524568 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.524595 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.524624 mprotect(0x7fa68ff9d000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.524652 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.524690 <... mmap resumed> ) = 0x7f86b72a1000
[pid 25544] 10:12:37.524707 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.524724 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.524749 read(5,  <unfinished ...>
[pid 25544] 10:12:37.524777 mmap(0x7fa69019d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25543] 10:12:37.524806 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.524841 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:37.524874 <... mmap resumed> ) = 0x7fa69019d000
[pid 25543] 10:12:37.524896 <... open resumed> ) = 6
[pid 25545] 10:12:37.524919 close(5 <unfinished ...>
[pid 25544] 10:12:37.524943 close(6 <unfinished ...>
[pid 25543] 10:12:37.524966 read(6,  <unfinished ...>
[pid 25545] 10:12:37.524994 <... close resumed> ) = 0
[pid 25544] 10:12:37.525010 <... close resumed> ) = 0
[pid 25543] 10:12:37.525032 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.525062 munmap(0x7f86b72a1000, 4096 <unfinished ...>
[pid 25544] 10:12:37.525089 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.525120 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.525149 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.525181 <... open resumed> ) = 6
[pid 25543] 10:12:37.525199 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25545] 10:12:37.525236 readlink("/proc/25389/exe",  <unfinished ...>
[pid 25544] 10:12:37.525277 read(6,  <unfinished ...>
[pid 25543] 10:12:37.525301 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.525336 <... readlink resumed> "/opt/php52/bin/php-cgi", 4095) = 22
[pid 25544] 10:12:37.525360 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.525384 <... mmap resumed> ) = 0x7fe582e25000
[pid 25545] 10:12:37.525406 readlink("/opt/php52/bin/php-cgi",  <unfinished ...>
[pid 25544] 10:12:37.525442 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.525466 mprotect(0x7fe582e27000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.525579 <... readlink resumed> 0x7ffce275fbb0, 4095) = -1 EINVAL (Invalid argument)
[pid 25544] 10:12:37.525607 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25543] 10:12:37.525640 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.525663 getcwd( <unfinished ...>
[pid 25544] 10:12:37.525688 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.525716 mmap(0x7fe583026000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25545] 10:12:37.525751 <... getcwd resumed> "/home/finest09/public_html/includes", 4095) = 36
[pid 25544] 10:12:37.525777 <... mmap resumed> ) = 0x7fa68fd6c000
[pid 25543] 10:12:37.525794 <... mmap resumed> ) = 0x7fe583026000
[pid 25545] 10:12:37.525824 stat("/proc/25389/cmdline",  <unfinished ...>
[pid 25544] 10:12:37.525854 mprotect(0x7fa68fd71000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.525881 close(6 <unfinished ...>
[pid 25545] 10:12:37.525909 <... stat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25544] 10:12:37.525940 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.525957 <... close resumed> ) = 0
[pid 25545] 10:12:37.525987 open("/proc/25389/cmdline", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.526017 mmap(0x7fa68ff70000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25543] 10:12:37.526046 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.526081 <... open resumed> ) = 5
[pid 25544] 10:12:37.526099 <... mmap resumed> ) = 0x7fa68ff70000
[pid 25543] 10:12:37.526120 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.526143 fstat(5,  <unfinished ...>
[pid 25544] 10:12:37.526166 close(6 <unfinished ...>
[pid 25543] 10:12:37.526189 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.526225 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=2130165337, st_mode=S_IFREG|0444, st_nlink=1, st_uid=503, st_gid=500, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25544] 10:12:37.526253 <... close resumed> ) = 0
[pid 25543] 10:12:37.526278 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.526302 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.526328 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.526357 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.526406 <... mmap resumed> ) = 0x7f86b72a1000
[pid 25544] 10:12:37.526425 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.526447 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.526548 read(5,  <unfinished ...>
[pid 25544] 10:12:37.526586 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.526619 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.526657 <... read resumed> "/opt/php52/bin/php-cgi\0/home/finest09/public_html/includes/contactmeactionsubmitemail.php\0", 1024) = 90
[pid 25544] 10:12:37.526678 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.526702 <... open resumed> ) = 6
[pid 25545] 10:12:37.526723 read(5,  <unfinished ...>
[pid 25544] 10:12:37.526747 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.526777 read(6,  <unfinished ...>
[pid 25545] 10:12:37.526806 <... read resumed> "", 1024) = 0
[pid 25544] 10:12:37.526829 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.526848 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.526877 setregid(499, 499 <unfinished ...>
[pid 25544] 10:12:37.526901 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.526929 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.526958 <... setregid resumed> ) = 0
[pid 25544] 10:12:37.526977 <... open resumed> ) = 6
[pid 25543] 10:12:37.526994 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25545] 10:12:37.527028 execve("/usr/sbin/exim", ["/usr/sbin/sendmail", "-t", "-i"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25544] 10:12:37.527605 read(6,  <unfinished ...>
[pid 25543] 10:12:37.527635 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.527671 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.527702 <... mmap resumed> ) = 0x7fe585ecc000
[pid 25545] 10:12:37.527729 <... execve resumed> ) = 0
[pid 25544] 10:12:37.527762 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.527788 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.527823 brk(0 <unfinished ...>
[pid 25544] 10:12:37.527847 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25543] 10:12:37.527879 <... mmap resumed> ) = 0x7fe582c02000
[pid 25545] 10:12:37.527901 <... brk resumed> ) = 0x1cd4000
[pid 25544] 10:12:37.527919 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.527948 mprotect(0x7fe582c19000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.527980 fcntl(0, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.528003 <... mmap resumed> ) = 0x7fa68fb69000
[pid 25543] 10:12:37.528019 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.528041 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.528057 mprotect(0x7fa68fb6b000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.528083 mmap(0x7fe582e19000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25545] 10:12:37.528118 fcntl(1, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.528142 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.528158 <... mmap resumed> ) = 0x7fe582e19000
[pid 25545] 10:12:37.528189 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.528207 mmap(0x7fa68fd6a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25543] 10:12:37.528235 close(6 <unfinished ...>
[pid 25545] 10:12:37.528264 fcntl(2, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.528286 <... mmap resumed> ) = 0x7fa68fd6a000
[pid 25543] 10:12:37.528309 <... close resumed> ) = 0
[pid 25545] 10:12:37.528373 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.528401 close(6 <unfinished ...>
[pid 25543] 10:12:37.528432 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.528561 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25544] 10:12:37.528600 <... close resumed> ) = 0
[pid 25543] 10:12:37.528626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.528652 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.528682 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.528713 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.528751 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.528778 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.528796 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.528817 <... mmap resumed> ) = 0x7f6d15b91000
[pid 25544] 10:12:37.528847 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.528881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.528917 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25544] 10:12:37.528945 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.528968 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.528992 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529018 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.529049 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.529087 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.529115 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.529134 <... open resumed> ) = 6
[pid 25545] 10:12:37.529155 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529172 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.529200 read(6,  <unfinished ...>
[pid 25545] 10:12:37.529230 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.529257 <... open resumed> ) = 6
[pid 25543] 10:12:37.529273 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.529301 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529319 read(6,  <unfinished ...>
[pid 25543] 10:12:37.529342 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.529370 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.529398 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.529420 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.529456 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529574 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.529605 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.529640 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25544] 10:12:37.529669 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25543] 10:12:37.529698 <... mmap resumed> ) = 0x7fe5829be000
[pid 25545] 10:12:37.529720 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529738 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.529765 mprotect(0x7fe5829ff000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.529797 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.529826 <... mmap resumed> ) = 0x7fa692c10000
[pid 25543] 10:12:37.529846 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.529873 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.529890 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.529918 mmap(0x7fe582bff000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25545] 10:12:37.529953 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.529980 <... mmap resumed> ) = 0x7fa68f946000
[pid 25543] 10:12:37.529996 <... mmap resumed> ) = 0x7fe582bff000
[pid 25545] 10:12:37.530027 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.530047 mprotect(0x7fa68f95d000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.530074 close(6 <unfinished ...>
[pid 25545] 10:12:37.530103 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.530132 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.530148 <... close resumed> ) = 0
[pid 25545] 10:12:37.530178 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.530196 mmap(0x7fa68fb5d000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25543] 10:12:37.530224 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.530259 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25544] 10:12:37.530286 <... mmap resumed> ) = 0x7fa68fb5d000
[pid 25543] 10:12:37.530309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.530334 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25544] 10:12:37.530363 close(6 <unfinished ...>
[pid 25543] 10:12:37.530395 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.530445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.530558 <... close resumed> ) = 0
[pid 25543] 10:12:37.530600 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.530626 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.530643 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.530673 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.530708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.530737 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.530754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.530778 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.530796 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.530826 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.530863 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.530893 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.530909 <... open resumed> ) = 6
[pid 25545] 10:12:37.530931 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.530947 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.530975 read(6,  <unfinished ...>
[pid 25545] 10:12:37.531004 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25544] 10:12:37.531039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.531058 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.531087 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.531104 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.531134 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.531316 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.531352 <... open resumed> ) = 6
[pid 25543] 10:12:37.531370 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.531407 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.531427 read(6,  <unfinished ...>
[pid 25543] 10:12:37.531451 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.531563 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.531597 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.531621 <... mmap resumed> ) = 0x7fe585ecb000
[pid 25545] 10:12:37.531647 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.531666 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.531690 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.531724 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.531756 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.531786 <... mmap resumed> ) = 0x7fe5826d7000
[pid 25545] 10:12:37.531808 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.531825 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.531853 mprotect(0x7fe5827b2000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.531886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25544] 10:12:37.531915 <... mmap resumed> ) = 0x7fa68f702000
[pid 25543] 10:12:37.531932 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.531953 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.531987 mprotect(0x7fa68f743000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.532015 mmap(0x7fe5829b2000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25545] 10:12:37.532051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.532082 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.532098 <... mmap resumed> ) = 0x7fe5829b2000
[pid 25545] 10:12:37.532128 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.532148 mmap(0x7fa68f943000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25543] 10:12:37.532176 close(6 <unfinished ...>
[pid 25545] 10:12:37.532205 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.532236 <... mmap resumed> ) = 0x7fa68f943000
[pid 25543] 10:12:37.532260 <... close resumed> ) = 0
[pid 25545] 10:12:37.532292 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.532311 close(6 <unfinished ...>
[pid 25543] 10:12:37.532334 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.532380 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.532416 <... close resumed> ) = 0
[pid 25543] 10:12:37.532441 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.532465 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.532590 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.532626 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.532662 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25544] 10:12:37.532689 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.532707 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.532728 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.532745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.532775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.532809 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.532838 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.532854 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.532877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.532895 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.532923 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.532959 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25544] 10:12:37.532986 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.533004 <... open resumed> ) = 6
[pid 25545] 10:12:37.533025 <... stat resumed> 0x7fffd44f7120) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.533042 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.533070 read(6,  <unfinished ...>
[pid 25545] 10:12:37.533099 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.533128 <... open resumed> ) = 6
[pid 25543] 10:12:37.533144 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.533178 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.533195 read(6,  <unfinished ...>
[pid 25543] 10:12:37.533218 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.533246 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25544] 10:12:37.533273 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.533296 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.533331 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.533361 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.533385 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.533421 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.533449 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.533580 <... mmap resumed> ) = 0x7fe5824d3000
[pid 25545] 10:12:37.533610 <... open resumed> ) = 6
[pid 25544] 10:12:37.533626 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.533654 mprotect(0x7fe5824d6000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.533687 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.533710 <... mmap resumed> ) = 0x7fa692c0f000
[pid 25543] 10:12:37.533730 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.533751 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.533780 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.533808 mmap(0x7fe5826d5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25545] 10:12:37.533842 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.533867 <... mmap resumed> ) = 0x7fa68f41b000
[pid 25543] 10:12:37.533883 <... mmap resumed> ) = 0x7fe5826d5000
[pid 25545] 10:12:37.533913 <... mmap resumed> ) = 0x7f6d15b87000
[pid 25544] 10:12:37.533931 mprotect(0x7fa68f4f6000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.533958 close(6 <unfinished ...>
[pid 25545] 10:12:37.533986 close(6 <unfinished ...>
[pid 25544] 10:12:37.534008 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.534024 <... close resumed> ) = 0
[pid 25545] 10:12:37.534052 <... close resumed> ) = 0
[pid 25544] 10:12:37.534084 mmap(0x7fa68f6f6000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25543] 10:12:37.534114 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.534151 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.534182 <... mmap resumed> ) = 0x7fa68f6f6000
[pid 25543] 10:12:37.534206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.534231 <... open resumed> ) = 6
[pid 25544] 10:12:37.534247 close(6 <unfinished ...>
[pid 25543] 10:12:37.534278 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLYProcess 25547 attached
 <unfinished ...>
[pid 25545] 10:12:37.534347 read(6,  <unfinished ...>
[pid 25544] 10:12:37.534374 <... close resumed> ) = 0
[pid 25543] 10:12:37.534399 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.534424 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25545] 10:12:37.534447 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.534472 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.534580 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.534618 <... set_robust_list resumed> ) = 0
[pid 25545] 10:12:37.534632 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.534682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.534700 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.534726 close(17 <unfinished ...>
[pid 25545] 10:12:37.534749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.534780 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.534811 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.534850 <... close resumed> ) = 0
[pid 25545] 10:12:37.534863 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.534955 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.534975 <... open resumed> ) = 6
[pid 25547] 10:12:37.534999 geteuid( <unfinished ...>
[pid 25545] 10:12:37.535021 <... mmap resumed> ) = 0x7f6d15759000
[pid 25544] 10:12:37.535037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.535068 read(6,  <unfinished ...>
[pid 25547] 10:12:37.535098 <... geteuid resumed> ) = 0
[pid 25545] 10:12:37.535112 mprotect(0x7f6d1576f000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.535141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.535159 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25547] 10:12:37.535196 getegid( <unfinished ...>
[pid 25545] 10:12:37.535219 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.535235 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.535264 fstat(6,  <unfinished ...>
[pid 25547] 10:12:37.535294 <... getegid resumed> ) = 12
[pid 25545] 10:12:37.535307 mmap(0x7f6d1596f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25544] 10:12:37.535344 <... open resumed> ) = 6
[pid 25543] 10:12:37.535360 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25547] 10:12:37.535397 setgid(500 <unfinished ...>
[pid 25545] 10:12:37.535422 <... mmap resumed> ) = 0x7f6d1596f000
[pid 25544] 10:12:37.535443 read(6,  <unfinished ...>
[pid 25543] 10:12:37.535469 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25547] 10:12:37.535568 <... setgid resumed> ) = 0
[pid 25545] 10:12:37.535583 mmap(0x7f6d15971000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.535614 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.535638 <... mmap resumed> ) = 0x7fe5822a7000
[pid 25547] 10:12:37.535662 setuid(503 <unfinished ...>
[pid 25545] 10:12:37.535685 <... mmap resumed> ) = 0x7f6d15971000
[pid 25544] 10:12:37.535707 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.535732 mprotect(0x7fe5822d0000, 2097152, PROT_NONE <unfinished ...>
[pid 25547] 10:12:37.535766 <... setuid resumed> ) = 0
[pid 25545] 10:12:37.535779 close(6 <unfinished ...>
[pid 25544] 10:12:37.535841 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.535873 <... mprotect resumed> ) = 0
[pid 25547] 10:12:37.535896 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.535928 <... close resumed> ) = 0
[pid 25544] 10:12:37.535950 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.535981 mmap(0x7fe5824d0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25547] 10:12:37.536018 <... open resumed> ) = 9
[pid 25545] 10:12:37.536031 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.536072 <... mmap resumed> ) = 0x7fa68f217000
[pid 25543] 10:12:37.536089 <... mmap resumed> ) = 0x7fe5824d0000
[pid 25547] 10:12:37.536116 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.536140 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.536157 mprotect(0x7fa68f21a000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.536184 mmap(0x7fe5824d2000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25547] 10:12:37.536218 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.536250 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.536416 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.536435 <... mmap resumed> ) = 0x7fe5824d2000
[pid 25547] 10:12:37.536463 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.536564 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.536584 mmap(0x7fa68f419000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25543] 10:12:37.536615 close(6 <unfinished ...>
[pid 25547] 10:12:37.536644 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.536672 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.536706 <... mmap resumed> ) = 0x7fa68f419000
[pid 25543] 10:12:37.536730 <... close resumed> ) = 0
[pid 25547] 10:12:37.536764 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.536793 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.536813 close(6 <unfinished ...>
[pid 25543] 10:12:37.536837 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.536873 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25545] 10:12:37.536887 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.536920 <... close resumed> ) = 0
[pid 25543] 10:12:37.536943 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.536968 read(9,  <unfinished ...>
[pid 25545] 10:12:37.537004 <... open resumed> ) = 6
[pid 25544] 10:12:37.537022 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.537051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.537088 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25545] 10:12:37.537106 read(6,  <unfinished ...>
[pid 25544] 10:12:37.537132 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.537149 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.537172 read(9,  <unfinished ...>
[pid 25545] 10:12:37.537199 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.537223 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.537253 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.537305 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25545] 10:12:37.537333 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.537380 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.537406 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.537432 close(9 <unfinished ...>
[pid 25545] 10:12:37.537457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.537571 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.537604 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.537643 <... close resumed> ) = 0
[pid 25545] 10:12:37.537656 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.537686 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.537704 <... open resumed> ) = 6
[pid 25547] 10:12:37.537728 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.537759 <... mmap resumed> ) = 0x7f6d15b86000
[pid 25544] 10:12:37.537780 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.537811 read(6,  <unfinished ...>
[pid 25547] 10:12:37.537849 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.537864 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.538298 <... open resumed> ) = 6
[pid 25543] 10:12:37.538319 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
Process 25548 attached
[pid 25547] 10:12:37.538363 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.538402 <... mmap resumed> ) = 0x7f6d15540000
[pid 25544] 10:12:37.538420 read(6,  <unfinished ...>
[pid 25543] 10:12:37.538443 fstat(6,  <unfinished ...>
[pid 25548] 10:12:37.538538 set_robust_list(0x7fa5f9737aa0, 24 <unfinished ...>
[pid 25547] 10:12:37.538567 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.538581 mprotect(0x7f6d15556000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.538612 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.538636 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25548] 10:12:37.538675 <... set_robust_list resumed> ) = 0
[pid 25547] 10:12:37.538689 read(6,  <unfinished ...>
[pid 25545] 10:12:37.538742 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.538759 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.538782 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25548] 10:12:37.538817 geteuid( <unfinished ...>
[pid 25547] 10:12:37.538839 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2364) = 1858
[pid 25545] 10:12:37.538863 mmap(0x7f6d15755000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25544] 10:12:37.539339 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.539372 <... mmap resumed> ) = 0x7fe585eca000
[pid 25548] 10:12:37.539401 <... geteuid resumed> ) = 0
[pid 25547] 10:12:37.539416 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.539447 <... mmap resumed> ) = 0x7f6d15755000
[pid 25544] 10:12:37.539468 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.539569 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25548] 10:12:37.539609 geteuid( <unfinished ...>
[pid 25545] 10:12:37.539639 mmap(0x7f6d15757000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.539669 <... mmap resumed> ) = 0x7fa68efeb000
[pid 25543] 10:12:37.539686 <... mmap resumed> ) = 0x7fe582091000
[pid 25548] 10:12:37.539711 <... geteuid resumed> ) = 0
[pid 25547] 10:12:37.539725 <... write resumed> ) = 4
[pid 25545] 10:12:37.539743 <... mmap resumed> ) = 0x7f6d15757000
[pid 25544] 10:12:37.539767 mprotect(0x7fa68f014000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.539796 mprotect(0x7fe5820a6000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.539823 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25548] 10:12:37.539852 getegid( <unfinished ...>
[pid 25547] 10:12:37.539874 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.539897 close(6 <unfinished ...>
[pid 25544] 10:12:37.539920 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.539935 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.539951 read(17,  <unfinished ...>
[pid 25548] 10:12:37.539982 <... getegid resumed> ) = 12
[pid 25547] 10:12:37.539995 <... write resumed> ) = 4
[pid 25545] 10:12:37.540014 <... close resumed> ) = 0
[pid 25544] 10:12:37.540038 mmap(0x7fa68f214000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25543] 10:12:37.540069 mmap(0x7fe5822a5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25522] 10:12:37.540096 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25548] 10:12:37.540123 setgid(12 <unfinished ...>
[pid 25547] 10:12:37.540146 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.540169 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.540199 <... mmap resumed> ) = 0x7fa68f214000
[pid 25543] 10:12:37.540219 <... mmap resumed> ) = 0x7fe5822a5000
[pid 25522] 10:12:37.540245 read(17,  <unfinished ...>
[pid 25548] 10:12:37.540279 <... setgid resumed> ) = 0
[pid 25547] 10:12:37.540293 <... write resumed> ) = 4
[pid 25545] 10:12:37.540308 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.540328 mmap(0x7fa68f216000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.540356 close(6 <unfinished ...>
[pid 25522] 10:12:37.540378 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25548] 10:12:37.540407 setuid(47 <unfinished ...>
[pid 25547] 10:12:37.540443 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25545] 10:12:37.540471 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.540581 <... mmap resumed> ) = 0x7fa68f216000
[pid 25543] 10:12:37.540604 <... close resumed> ) = 0
[pid 25522] 10:12:37.540642 read(17,  <unfinished ...>
[pid 25548] 10:12:37.540680 <... setuid resumed> ) = 0
[pid 25547] 10:12:37.540694 <... write resumed> ) = 40
[pid 25545] 10:12:37.541523 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.541555 close(6 <unfinished ...>
[pid 25543] 10:12:37.541581 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.541613 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25547] 10:12:37.541640 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.541665 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.541695 <... close resumed> ) = 0
[pid 25543] 10:12:37.541721 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.541743 read(17,  <unfinished ...>
[pid 25547] 10:12:37.541775 <... write resumed> ) = 4
[pid 25545] 10:12:37.541788 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.541812 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.541841 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.541872 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25547] 10:12:37.541898 close(18 <unfinished ...>
[pid 25545] 10:12:37.541922 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.541953 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.541970 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.541987 wait4(-1,  <unfinished ...>
[pid 25547] 10:12:37.542016 <... close resumed> ) = 0
[pid 25545] 10:12:37.542029 <... open resumed> ) = 6
[pid 25544] 10:12:37.542057 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.542089 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25547] 10:12:37.542125 exit_group(0) = ?
[pid 25545] 10:12:37.542139 read(6,  <unfinished ...>
[pid 25544] 10:12:37.542431 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.542450 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25547] 10:12:37.542559 +++ exited with 0 +++
[pid 25545] 10:12:37.542579 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.542604 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.542635 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.542667 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25547
[pid 25545] 10:12:37.542693 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.542716 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.542738 <... open resumed> ) = 6
[pid 25522] 10:12:37.542755 close(17 <unfinished ...>
[pid 25545] 10:12:37.542788 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.542820 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.542850 read(6,  <unfinished ...>
[pid 25522] 10:12:37.543551 <... close resumed> ) = 0
[pid 25545] 10:12:37.543580 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.543617 <... open resumed> ) = 6
[pid 25543] 10:12:37.543634 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.543658 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25545] 10:12:37.543694 <... mmap resumed> ) = 0x7f6d15309000
[pid 25544] 10:12:37.543711 read(6,  <unfinished ...>
[pid 25543] 10:12:37.543738 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.543763 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25545] 10:12:37.543812 mprotect(0x7f6d15310000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.543844 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.543869 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25522] 10:12:37.543902 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.543936 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.543952 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.543975 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.544005 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.544055 mmap(0x7f6d15510000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25544] 10:12:37.544088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25543] 10:12:37.544118 <... mmap resumed> ) = 0x7fe581e86000
[pid 25522] 10:12:37.544135 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.544170 <... mmap resumed> ) = 0x7f6d15510000
[pid 25544] 10:12:37.544191 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.544218 mprotect(0x7fe581e90000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.544245 <... open resumed> ) = 9
[pid 25545] 10:12:37.544268 mmap(0x7f6d15512000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.544297 <... mmap resumed> ) = 0x7fa692c0e000
[pid 25543] 10:12:37.544316 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.544333 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.544362 <... mmap resumed> ) = 0x7f6d15512000
[pid 25544] 10:12:37.544382 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.544412 mmap(0x7fe58208f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25522] 10:12:37.544445 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.544596 close(6 <unfinished ...>
[pid 25544] 10:12:37.544628 <... mmap resumed> ) = 0x7fa68edd5000
[pid 25543] 10:12:37.544646 <... mmap resumed> ) = 0x7fe58208f000
[pid 25522] 10:12:37.544671 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.544703 <... close resumed> ) = 0
[pid 25544] 10:12:37.544724 mprotect(0x7fa68edea000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.544758 close(6 <unfinished ...>
[pid 25522] 10:12:37.544781 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.544817 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.544847 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.544863 <... close resumed> ) = 0
[pid 25522] 10:12:37.544889 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.544923 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.544941 mmap(0x7fa68efe9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25543] 10:12:37.544969 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.544999 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25545] 10:12:37.545022 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.545054 <... mmap resumed> ) = 0x7fa68efe9000
[pid 25543] 10:12:37.545078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.545097 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.545127 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.545144 close(6 <unfinished ...>
[pid 25543] 10:12:37.545167 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.545199 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.545222 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.545251 <... close resumed> ) = 0
[pid 25543] 10:12:37.545284 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.545303 read(9,  <unfinished ...>
[pid 25545] 10:12:37.545336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.545355 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.545384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.545413 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25545] 10:12:37.545467 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.545599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.545618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.545638 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.545671 <... open resumed> ) = 6
[pid 25544] 10:12:37.545688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.545719 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.545756 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.545805 read(6,  <unfinished ...>
[pid 25544] 10:12:37.546012 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.546031 <... open resumed> ) = 6
[pid 25522] 10:12:37.546047 stat("/etc/userdomains",  <unfinished ...>
[pid 25548] 10:12:37.546081 brk(0x1402000 <unfinished ...>
[pid 25545] 10:12:37.546102 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.546125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.546156 read(6,  <unfinished ...>
[pid 25522] 10:12:37.546180 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.546249 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.546278 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.546297 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.546321 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25545] 10:12:37.546361 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.546391 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.546422 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.546445 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.546559 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.546598 <... open resumed> ) = 6
[pid 25543] 10:12:37.546615 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.546650 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25548] 10:12:37.546688 <... brk resumed> ) = 0x1402000
[pid 25545] 10:12:37.546702 <... mmap resumed> ) = 0x7f6d15085000
[pid 25544] 10:12:37.546842 read(6,  <unfinished ...>
[pid 25543] 10:12:37.546875 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.546907 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.546957 mprotect(0x7f6d15108000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.546988 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.547012 <... mmap resumed> ) = 0x7fe581c83000
[pid 25522] 10:12:37.547029 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.547064 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.547081 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.547104 mprotect(0x7fe581c85000, 2093056, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.547130 <... open resumed> ) = 10
[pid 25545] 10:12:37.547153 mmap(0x7f6d15307000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25544] 10:12:37.547463 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25543] 10:12:37.547572 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.547590 fstat(10,  <unfinished ...>
[pid 25548] 10:12:37.547622 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25545] 10:12:37.547646 <... mmap resumed> ) = 0x7f6d15307000
[pid 25544] 10:12:37.547671 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.547704 mmap(0x7fe581e84000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25522] 10:12:37.547733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.547773 close(6 <unfinished ...>
[pid 25544] 10:12:37.547797 <... mmap resumed> ) = 0x7fa68ebca000
[pid 25543] 10:12:37.547814 <... mmap resumed> ) = 0x7fe581e84000
[pid 25522] 10:12:37.547838 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.547870 <... close resumed> ) = 0
[pid 25544] 10:12:37.547892 mprotect(0x7fa68ebd4000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.547921 close(6 <unfinished ...>
[pid 25522] 10:12:37.547944 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.547978 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.548009 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.548024 <... close resumed> ) = 0
[pid 25522] 10:12:37.548047 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.548081 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.548099 mmap(0x7fa68edd3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25543] 10:12:37.548127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.548158 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25545] 10:12:37.548186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.548236 <... mmap resumed> ) = 0x7fa68edd3000
[pid 25543] 10:12:37.548264 <... mmap resumed> ) = 0x7fe585ec9000
[pid 25522] 10:12:37.548297 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.548330 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.548347 close(6 <unfinished ...>
[pid 25543] 10:12:37.548379 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.548411 <... lseek resumed> ) = 0
[pid 25548] 10:12:37.548436 <... open resumed> ) = 7
[pid 25545] 10:12:37.548449 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.548568 <... close resumed> ) = 0
[pid 25543] 10:12:37.548601 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.548626 read(10,  <unfinished ...>
[pid 25548] 10:12:37.548663 fstat(7,  <unfinished ...>
[pid 25545] 10:12:37.548686 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.548704 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.548734 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.548764 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25548] 10:12:37.548797 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25545] 10:12:37.548825 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.548864 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.548881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.548898 read(10,  <unfinished ...>
[pid 25548] 10:12:37.548928 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25545] 10:12:37.548955 <... open resumed> ) = 6
[pid 25544] 10:12:37.548970 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.549001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.549030 <... read resumed> "", 4096) = 0
[pid 25548] 10:12:37.549073 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25545] 10:12:37.549093 read(6,  <unfinished ...>
[pid 25544] 10:12:37.549124 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.549141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.549159 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25548] 10:12:37.549196 read(7,  <unfinished ...>
[pid 25545] 10:12:37.549223 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.549246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.549275 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.549303 <... open resumed> ) = 11
[pid 25548] 10:12:37.549329 <... read resumed> "\273\346\373\3238\\|\227la4\270\343\261\320\345\256\241\36k\6\274d\220\262_\324\337\6\346\n\324\207oTF\36\323\234\210\267\22\213\321\313\274a\305", 48) = 48
[pid 25545] 10:12:37.549353 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.549380 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.549398 <... open resumed> ) = 6
[pid 25522] 10:12:37.549414 fstat(11,  <unfinished ...>
[pid 25548] 10:12:37.549444 close(7 <unfinished ...>
[pid 25545] 10:12:37.549468 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25544] 10:12:37.549581 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.549613 read(6,  <unfinished ...>
[pid 25522] 10:12:37.549637 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25548] 10:12:37.549673 <... close resumed> ) = 0
[pid 25545] 10:12:37.549687 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.549735 <... open resumed> ) = 6
[pid 25543] 10:12:37.549752 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.549775 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25548] 10:12:37.549808 getuid( <unfinished ...>
[pid 25545] 10:12:37.549829 <... mmap resumed> ) = 0x7f6d15b85000
[pid 25544] 10:12:37.549849 read(6,  <unfinished ...>
[pid 25543] 10:12:37.549872 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.549895 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25548] 10:12:37.549918 <... getuid resumed> ) = 47
[pid 25545] 10:12:37.549932 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.550106 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.550131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.550163 read(11,  <unfinished ...>
[pid 25548] 10:12:37.550198 exit_group(0) = ?
[pid 25545] 10:12:37.550212 <... mmap resumed> ) = 0x7f6d14e77000
[pid 25544] 10:12:37.550471 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.550578 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.550610 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25548] 10:12:37.550672 +++ exited with 0 +++
[pid 25545] 10:12:37.550687 mprotect(0x7f6d14e83000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.550715 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25543] 10:12:37.550746 <... mmap resumed> ) = 0x7fe581a64000
[pid 25541] 10:12:37.550763 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25548
[pid 25522] 10:12:37.550784 close(11 <unfinished ...>
[pid 25545] 10:12:37.550816 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.550831 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.550861 mprotect(0x7fe581a81000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.550888 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25522] 10:12:37.550916 <... close resumed> ) = 0
[pid 25545] 10:12:37.550940 mmap(0x7f6d15083000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25544] 10:12:37.550969 <... mmap resumed> ) = 0x7fa68e9c7000
[pid 25543] 10:12:37.551055 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.551073 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, 8) = 0
[pid 25522] 10:12:37.551120 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25545] 10:12:37.551159 <... mmap resumed> ) = 0x7f6d15083000
[pid 25544] 10:12:37.551184 mprotect(0x7fa68e9c9000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.551213 mmap(0x7fe581c80000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25541] 10:12:37.551244 getcwd( <unfinished ...>
[pid 25522] 10:12:37.551269 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.551307 close(6 <unfinished ...>
[pid 25544] 10:12:37.551333 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.551349 <... mmap resumed> ) = 0x7fe581c80000
[pid 25541] 10:12:37.551370 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25522] 10:12:37.551427 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.551465 <... close resumed> ) = 0
[pid 25544] 10:12:37.551541 mmap(0x7fa68ebc8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25543] 10:12:37.551576 mmap(0x7fe581c82000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.551605 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.551634 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.551691 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.551730 <... mmap resumed> ) = 0x7fa68ebc8000
[pid 25543] 10:12:37.551755 <... mmap resumed> ) = 0x7fe581c82000
[pid 25541] 10:12:37.551779 <... open resumed> ) = 7
[pid 25522] 10:12:37.551797 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25545] 10:12:37.551833 <... open resumed> ) = 6
[pid 25544] 10:12:37.551848 close(6 <unfinished ...>
[pid 25543] 10:12:37.551871 close(6 <unfinished ...>
[pid 25541] 10:12:37.551893 fstat(7,  <unfinished ...>
[pid 25522] 10:12:37.551915 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25545] 10:12:37.551961 read(6,  <unfinished ...>
[pid 25544] 10:12:37.551987 <... close resumed> ) = 0
[pid 25543] 10:12:37.552010 <... close resumed> ) = 0
[pid 25541] 10:12:37.552068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.552101 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.552138 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.552161 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.552187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.552212 fstat(7,  <unfinished ...>
[pid 25522] 10:12:37.552234 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.552292 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.552319 <... mmap resumed> ) = 0x7fa692c0d000
[pid 25543] 10:12:37.552351 <... mmap resumed> ) = 0x7fe585ec8000
[pid 25541] 10:12:37.552411 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.552444 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.552578 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25544] 10:12:37.552616 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.552648 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.552675 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.552700 <... open resumed> ) = 11
[pid 25545] 10:12:37.552724 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.552752 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.552769 <... mmap resumed> ) = 0x7fe585ec7000
[pid 25541] 10:12:37.552795 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.552813 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.552844 <... mmap resumed> ) = 0x7f6d14c54000
[pid 25544] 10:12:37.552860 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.552892 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.552917 read(7,  <unfinished ...>
[pid 25522] 10:12:37.552943 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.552982 mprotect(0x7f6d14c75000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.553010 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.553032 <... mmap resumed> ) = 0x7fe585ec5000
[pid 25541] 10:12:37.553054 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25522] 10:12:37.553082 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.553113 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.553129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.553158 arch_prctl(ARCH_SET_FS, 0x7fe585ec57c0 <unfinished ...>
[pid 25541] 10:12:37.553182 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.553204 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.553239 mmap(0x7f6d14e75000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25544] 10:12:37.553268 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.553287 <... arch_prctl resumed> ) = 0
[pid 25541] 10:12:37.553341 <... lseek resumed> ) = 1279
[pid 25522] 10:12:37.553359 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.553392 <... mmap resumed> ) = 0x7f6d14e75000
[pid 25544] 10:12:37.553413 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.553442 mprotect(0x7fe581c80000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.553470 read(7,  <unfinished ...>
[pid 25522] 10:12:37.553597 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25545] 10:12:37.553624 close(6 <unfinished ...>
[pid 25544] 10:12:37.553647 <... open resumed> ) = 6
[pid 25543] 10:12:37.553663 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.553683 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25522] 10:12:37.553717 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.553750 <... close resumed> ) = 0
[pid 25544] 10:12:37.553773 read(6,  <unfinished ...>
[pid 25543] 10:12:37.553797 mprotect(0x7fe581e84000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.553823 close(7 <unfinished ...>
[pid 25522] 10:12:37.553847 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.553871 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.553901 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.553929 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.553962 <... close resumed> ) = 0
[pid 25522] 10:12:37.553979 read(11,  <unfinished ...>
[pid 25545] 10:12:37.554013 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.554031 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.554054 mprotect(0x7fe58208f000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.554080 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25522] 10:12:37.554107 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25545] 10:12:37.554159 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.554195 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25543] 10:12:37.554226 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.554252 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.554284 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.554321 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.554338 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25543] 10:12:37.554369 mprotect(0x7fe5822a5000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.554395 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25522] 10:12:37.554430 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.554474 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.554615 <... mmap resumed> ) = 0x7fa68e7a8000
[pid 25543] 10:12:37.554632 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.554662 <... open resumed> ) = 7
[pid 25522] 10:12:37.554681 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25545] 10:12:37.554718 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.554737 mprotect(0x7fa68e7c5000, 2093056, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.554765 mprotect(0x7fe5824d0000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.554792 fcntl(7, F_GETFD <unfinished ...>
[pid 25522] 10:12:37.554815 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25545] 10:12:37.554864 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.554899 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.554915 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.554942 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.554960 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.554996 <... open resumed> ) = 6
[pid 25544] 10:12:37.555012 mmap(0x7fa68e9c4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25543] 10:12:37.555043 mprotect(0x7fe5826d5000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.555076 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.555101 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.555162 read(6,  <unfinished ...>
[pid 25544] 10:12:37.555189 <... mmap resumed> ) = 0x7fa68e9c4000
[pid 25543] 10:12:37.555211 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.555331 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.555352 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25545] 10:12:37.555389 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.555412 mmap(0x7fa68e9c6000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.555442 mprotect(0x7fe5829b2000, 40960, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.555469 fstat(7,  <unfinished ...>
[pid 25522] 10:12:37.555569 <... stat resumed> 0x7ffd5c5b9b60) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.555609 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.555642 <... mmap resumed> ) = 0x7fa68e9c6000
[pid 25543] 10:12:37.555664 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.555762 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384501, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.555796 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.555831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.555860 close(6 <unfinished ...>
[pid 25543] 10:12:37.555883 mprotect(0x7fe582bff000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.555909 write(7, "2015-12-30 10:12:37 [25541] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMY-0006cE-He\n", 108 <unfinished ...>
[pid 25522] 10:12:37.555939 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.555989 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.556020 <... close resumed> ) = 0
[pid 25543] 10:12:37.556070 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.556101 <... write resumed> ) = 108
[pid 25522] 10:12:37.556122 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.556159 <... mmap resumed> ) = 0x7f6d14a37000
[pid 25544] 10:12:37.556175 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.556202 mprotect(0x7fe582e19000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.556228 chdir("/var/spool/exim" <unfinished ...>
[pid 25522] 10:12:37.556258 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.556330 mprotect(0x7f6d14a4e000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.556363 <... mmap resumed> ) = 0x7fa692c0c000
[pid 25543] 10:12:37.556414 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.556439 <... chdir resumed> ) = 0
[pid 25522] 10:12:37.556458 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.556583 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.556607 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.556642 mprotect(0x7fe583026000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.556674 geteuid( <unfinished ...>
[pid 25522] 10:12:37.556700 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.556754 mmap(0x7f6d14c4e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25544] 10:12:37.556787 <... mmap resumed> ) = 0x7fa692c0b000
[pid 25543] 10:12:37.556813 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.557022 <... geteuid resumed> ) = 0
[pid 25522] 10:12:37.557041 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25545] 10:12:37.557077 <... mmap resumed> ) = 0x7f6d14c4e000
[pid 25544] 10:12:37.557097 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.557124 mprotect(0x7fe583812000, 110592, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.557151 getegid( <unfinished ...>
[pid 25522] 10:12:37.557173 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25545] 10:12:37.557219 mmap(0x7f6d14c50000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.557251 <... mmap resumed> ) = 0x7fa692c09000
[pid 25543] 10:12:37.557272 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.557355 <... getegid resumed> ) = 12
[pid 25522] 10:12:37.557386 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.557425 <... mmap resumed> ) = 0x7f6d14c50000
[pid 25544] 10:12:37.557447 arch_prctl(ARCH_SET_FS, 0x7fa692c097c0 <unfinished ...>
[pid 25543] 10:12:37.557472 mprotect(0x7fe583a9e000, 16384, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.557579 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.557622 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.557687 close(6 <unfinished ...>
[pid 25544] 10:12:37.557715 <... arch_prctl resumed> ) = 0
[pid 25543] 10:12:37.557761 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.557859 <... open resumed> ) = 8
[pid 25522] 10:12:37.557882 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.557913 <... close resumed> ) = 0
[pid 25544] 10:12:37.557936 mprotect(0x7fa68e9c4000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.557964 mprotect(0x7fe583e33000, 16384, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.557989 fstat(8,  <unfinished ...>
[pid 25522] 10:12:37.558012 <... lseek resumed> ) = 2781
[pid 25545] 10:12:37.558054 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.558088 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.558109 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.558129 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.558165 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.558200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.558217 mprotect(0x7fa68ebc8000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.558243 mprotect(0x7fe58403e000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.558269 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.558295 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.558338 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.558373 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.558403 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.558428 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.558446 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25545] 10:12:37.558551 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.558575 mprotect(0x7fa68edd3000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.558609 mprotect(0x7fe584242000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.558642 read(8,  <unfinished ...>
[pid 25522] 10:12:37.558677 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25545] 10:12:37.558732 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.558765 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.558790 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.559462 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.559544 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.559589 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.559617 mprotect(0x7fa68efe9000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.559649 mprotect(0x7fe584f9a000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.559683 close(8 <unfinished ...>
[pid 25537] 10:12:37.559711 <... read resumed> "\26\3\1\0005\2\0", 7) = 7
[pid 25529] 10:12:37.559773 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25522] 10:12:37.559801 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.559869 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.559904 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.559933 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.559972 <... close resumed> ) = 0
[pid 25537] 10:12:37.559990 read(11,  <unfinished ...>
[pid 25529] 10:12:37.560015 recvfrom(16,  <unfinished ...>
[pid 25522] 10:12:37.560040 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25545] 10:12:37.560081 <... open resumed> ) = 6
[pid 25544] 10:12:37.560097 mprotect(0x7fa68f214000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.560123 mprotect(0x7fe5853cf000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.560149 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25537] 10:12:37.560182 <... read resumed> "\0001\3\1V\204\2u!\347\315\315?\267\253\230\2400\377\201?G\215\20\211o+\215\244\300>\337h\325\261\345\0\0009\0\0\t\377\1\0\1\0\0#\0\0", 51) = 51
[pid 25529] 10:12:37.560242 <... recvfrom resumed> "\25\23\201\200\0\1\0\5\0\0\0\0\5gmail\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\rB\0 \0(\4alt4\rgmail-smtp-in\1l\6google\300\22\300\f\0\17\0\1\0\0\rB\0\t\0\36\4alt3\300.\300\f\0\17\0\1\0\0\rB\0\t\0\n\4alt1\300.\300\f\0\17\0\1\0\0\rB\0\4\0\5\300.\300\f\0\17\0\1\0\0\rB\0\t\0\24\4alt2\300.", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 150
[pid 25522] 10:12:37.560286 <... stat resumed> 0x7ffd5c5b9b60) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.560324 read(6,  <unfinished ...>
[pid 25544] 10:12:37.560350 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.560376 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.560398 <... munmap resumed> ) = 0
[pid 25537] 10:12:37.560419 read(11,  <unfinished ...>
[pid 25529] 10:12:37.560443 close(16 <unfinished ...>
[pid 25522] 10:12:37.560557 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.560605 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.560636 mprotect(0x7fa68f419000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.560664 mprotect(0x7fe585653000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.560689 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.560724 <... read resumed> "\26\3\1\22\307", 5) = 5
[pid 25529] 10:12:37.560744 <... close resumed> ) = 0
[pid 25522] 10:12:37.560795 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.560856 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.560883 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.560993 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.561017 <... open resumed> ) = 8
[pid 25537] 10:12:37.561034 read(11,  <unfinished ...>
[pid 25529] 10:12:37.561063 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25522] 10:12:37.561093 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.561132 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.561162 mprotect(0x7fa68f6f6000, 40960, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.561189 mprotect(0x7fe58585c000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.561215 read(8,  <unfinished ...>
[pid 25537] 10:12:37.561240 <... read resumed> "\v\0\22\303\0\22\300\0\5[0\202\5W0\202\4?\240\3\2\1\2\2\t\0\350Dc\277\333iq\3300\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2641\v0\t\6\3U\4\6\23\2US1\0200\16\6\3U\4\10\23\7Arizona1\0230\21\6\3U\4\7\23\nScottsdale1\0320\30\6\3U\4\n\23\21GoDaddy.com, Inc.1-0+\6\3U\4\v\23$http://certs.godaddy.com/repository/1301\6\3U\4\3\23*Go Daddy Secure Certificate Authority - G20\36\27\r150716180238Z\27\r16080"..., 4807) = 4033
[pid 25529] 10:12:37.561263 <... socket resumed> ) = 16
[pid 25522] 10:12:37.561279 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25545] 10:12:37.561352 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.561387 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.561474 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.561591 <... read resumed> "65536\n", 31) = 6
[pid 25537] 10:12:37.561611 read(11,  <unfinished ...>
[pid 25529] 10:12:37.561635 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25522] 10:12:37.561666 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.561706 <... mmap resumed> ) = 0x7f6d15b84000
[pid 25544] 10:12:37.561726 mprotect(0x7fa68f943000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.561754 mprotect(0x7fe585aa1000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.561779 close(8 <unfinished ...>
[pid 25529] 10:12:37.561803 <... connect resumed> ) = 0
[pid 25522] 10:12:37.561819 <... open resumed> ) = 12
[pid 25545] 10:12:37.561845 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.561873 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.561902 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.561928 <... close resumed> ) = 0
[pid 25529] 10:12:37.561951 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25522] 10:12:37.561979 fstat(12,  <unfinished ...>
[pid 25545] 10:12:37.562011 <... mmap resumed> ) = 0x7f6d146c3000
[pid 25544] 10:12:37.562027 mprotect(0x7fa68fb5d000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.562054 mprotect(0x7fe585cbb000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.562079 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.562107 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25522] 10:12:37.562126 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.562167 mprotect(0x7f6d14832000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.562194 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.562213 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.562254 <... open resumed> ) = 8
[pid 25529] 10:12:37.562275 sendto(16, "\335\214\1\0\0\1\0\0\0\0\0\0\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1", 44, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25522] 10:12:37.562330 fstat(12,  <unfinished ...>
[pid 25545] 10:12:37.562366 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.562383 mprotect(0x7fa68fd6a000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.562409 mprotect(0x7fe585ede000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.562436 fstat(8,  <unfinished ...>
[pid 25529] 10:12:37.562458 <... sendto resumed> ) = 44
[pid 25522] 10:12:37.562537 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.562583 mmap(0x7f6d14a31000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25544] 10:12:37.562614 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.562806 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.562826 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.562861 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25522] 10:12:37.562894 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.562929 <... mmap resumed> ) = 0x7f6d14a31000
[pid 25544] 10:12:37.562960 mprotect(0x7fa690556000, 110592, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.562990 munmap(0x7fe585ed3000, 39387 <unfinished ...>
[pid 25541] 10:12:37.563020 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.563045 <... mmap resumed> ) = 0x7f2e40b10000
[pid 25545] 10:12:37.563070 close(6 <unfinished ...>
[pid 25544] 10:12:37.563093 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.563166 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.563186 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.563202 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.563233 <... close resumed> ) = 0
[pid 25544] 10:12:37.563256 mprotect(0x7fa6907e2000, 16384, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.563283 set_tid_address(0x7fe585ec5a90 <unfinished ...>
[pid 25541] 10:12:37.563307 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.563330 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.563353 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.563384 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.563472 <... set_tid_address resumed> ) = 25543
[pid 25541] 10:12:37.563560 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.563583 read(12,  <unfinished ...>
[pid 25545] 10:12:37.563623 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.563642 mprotect(0x7fa690b77000, 16384, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.563668 set_robust_list(0x7fe585ec5aa0, 24 <unfinished ...>
[pid 25541] 10:12:37.563691 read(8,  <unfinished ...>
[pid 25522] 10:12:37.563717 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25545] 10:12:37.563759 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.563797 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.563817 <... set_robust_list resumed> ) = 0
[pid 25541] 10:12:37.563834 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.563865 stat("/jail_owner",  <unfinished ...>
[pid 25545] 10:12:37.563898 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.563915 mprotect(0x7fa690d82000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.563941 futex(0x7ffcdc28900c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25541] 10:12:37.563966 read(8,  <unfinished ...>
[pid 25522] 10:12:37.563988 <... stat resumed> 0x7ffd5c5bb110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.564018 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.564050 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.564074 <... futex resumed> ) = 0
[pid 25541] 10:12:37.564090 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.564110 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25545] 10:12:37.564148 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.564167 mprotect(0x7fa690f86000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.564194 futex(0x7ffcdc28900c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fe585ec57c0 <unfinished ...>
[pid 25541] 10:12:37.564218 close(8 <unfinished ...>
[pid 25522] 10:12:37.564243 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25545] 10:12:37.564293 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.564327 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.564974 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25541] 10:12:37.565008 <... close resumed> ) = 0
[pid 25522] 10:12:37.565026 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25545] 10:12:37.565066 <... open resumed> ) = 6
[pid 25544] 10:12:37.565082 mprotect(0x7fa691cde000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.565108 rt_sigaction(SIGRTMIN, {0x7fe584d88c60, [], SA_RESTORER|SA_SIGINFO, 0x7fe584d92790},  <unfinished ...>
[pid 25541] 10:12:37.565137 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25522] 10:12:37.565165 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.565197 read(6,  <unfinished ...>
[pid 25544] 10:12:37.565222 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.565256 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.565274 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.565293 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25545] 10:12:37.565333 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.565356 mprotect(0x7fa692113000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.565382 rt_sigaction(SIGRT_1, {0x7fe584d88cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fe584d92790},  <unfinished ...>
[pid 25541] 10:12:37.565409 setgroups(1, [12] <unfinished ...>
[pid 25522] 10:12:37.565434 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25545] 10:12:37.565538 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.565568 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.565608 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.565629 <... setgroups resumed> ) = 0
[pid 25522] 10:12:37.565646 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25545] 10:12:37.565685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25544] 10:12:37.565716 mprotect(0x7fa692397000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.565742 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25541] 10:12:37.565768 setgid(12 <unfinished ...>
[pid 25537] 10:12:37.565791 <... read resumed> "n Authority0\202\1 0\r\6\t*\206H\206\367\r\1\1\1\5\0\3\202\1\r\0000\202\1\10\2\202\1\1\0\336\235\327\352W\30I\241[\353\327_H\206\352\276\335\377\344\357g\34\364eh\263Wq\240^w\273\355\233I\351p\200=V\30c\10o\332\362\314\320?\177\2T\"T\20\330\262\201\324\300u=K\177\307w\303>x\253\32\3\265 k/j+\261\305\210~\304\273\36\260\301\330E'o\2527X\367\207&\327\330-\366\251\27\267\37r6N\246\27?e\230\222\333*n]\242\376\210\340\v\336\177\345\215\25\341\353\313:\325\342\22\242\23-\330\216\257_\22=\240\10\5\10\266\\\245e8\4E\231\36\243``t\305A\245rb\33b\305\37o_\32B\276\2Qe\250\256#\30j\374x\3\251M\177\200\303\372\253Z\374\241@\244\312\31\26\376\262\310\357^s\r\356w\275\232"..., 774) = 774
[pid 25522] 10:12:37.566683 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.566743 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.566779 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.566801 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25541] 10:12:37.566828 <... setgid resumed> ) = 0
[pid 25537] 10:12:37.566846 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.566928 stat("/etc/demouids",  <unfinished ...>
[pid 25545] 10:12:37.566966 <... mmap resumed> ) = 0x7f6d14434000
[pid 25544] 10:12:37.566983 mprotect(0x7fa6925a0000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.567010 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25541] 10:12:37.567034 setuid(47 <unfinished ...>
[pid 25537] 10:12:37.567057 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.567106 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.567160 mprotect(0x7f6d144bf000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.567191 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.567222 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25541] 10:12:37.567280 <... setuid resumed> ) = 0
[pid 25537] 10:12:37.567328 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.567357 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.567395 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.567414 mprotect(0x7fa6927e5000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.567441 statfs("/selinux",  <unfinished ...>
[pid 25541] 10:12:37.567534 read(6,  <unfinished ...>
[pid 25537] 10:12:37.567579 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.567616 <... open resumed> ) = 13
[pid 25545] 10:12:37.567653 mmap(0x7f6d146bf000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25544] 10:12:37.567694 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.567724 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350324, f_bavail=6350324, f_files=1000000, f_ffree=691079, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25541] 10:12:37.567794 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25537] 10:12:37.567867 close(7 <unfinished ...>
[pid 25522] 10:12:37.567892 fstat(13,  <unfinished ...>
[pid 25545] 10:12:37.567926 <... mmap resumed> ) = 0x7f6d146bf000
[pid 25544] 10:12:37.567950 mprotect(0x7fa6929ff000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.567978 brk(0 <unfinished ...>
[pid 25541] 10:12:37.568000 read(6,  <unfinished ...>
[pid 25537] 10:12:37.568025 <... close resumed> ) = 0
[pid 25529] 10:12:37.568044 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25522] 10:12:37.568064 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.568107 mmap(0x7f6d146c2000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.568137 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.568183 <... brk resumed> ) = 0x2010000
[pid 25541] 10:12:37.568202 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25537] 10:12:37.568269 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25529] 10:12:37.568309 recvfrom(16,  <unfinished ...>
[pid 25522] 10:12:37.568335 fstat(13,  <unfinished ...>
[pid 25545] 10:12:37.568369 <... mmap resumed> ) = 0x7f6d146c2000
[pid 25544] 10:12:37.568392 mprotect(0x7fa692c22000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.568421 brk(0x2031000 <unfinished ...>
[pid 25541] 10:12:37.568446 read(6,  <unfinished ...>
[pid 25537] 10:12:37.568470 <... open resumed> ) = 7
[pid 25529] 10:12:37.568574 <... recvfrom resumed> "\335\214\201\200\0\1\0\1\0\0\0\0\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0n\0\4\255\302@\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 60
[pid 25522] 10:12:37.568611 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.568663 close(6 <unfinished ...>
[pid 25544] 10:12:37.568696 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.568716 <... brk resumed> ) = 0x2031000
[pid 25541] 10:12:37.568744 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25537] 10:12:37.568804 fcntl(7, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.568829 close(16 <unfinished ...>
[pid 25522] 10:12:37.569019 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.569063 <... close resumed> ) = 0
[pid 25544] 10:12:37.569087 munmap(0x7fa692c17000, 39387 <unfinished ...>
[pid 25543] 10:12:37.569119 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.569158 read(6,  <unfinished ...>
[pid 25537] 10:12:37.569182 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.569199 <... close resumed> ) = 0
[pid 25522] 10:12:37.569238 <... mmap resumed> ) = 0x7f2e40b0f000
[pid 25545] 10:12:37.569268 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.569298 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.569315 <... open resumed> ) = 6
[pid 25541] 10:12:37.569343 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25537] 10:12:37.569405 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.569433 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid 25522] 10:12:37.569461 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.569575 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.569596 set_tid_address(0x7fa692c09a90 <unfinished ...>
[pid 25543] 10:12:37.569625 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.569655 read(6,  <unfinished ...>
[pid 25537] 10:12:37.569687 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.569708 <... socket resumed> ) = 16
[pid 25522] 10:12:37.569728 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.569756 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.569790 <... set_tid_address resumed> ) = 25544
[pid 25543] 10:12:37.569812 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.569844 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25537] 10:12:37.569920 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.569949 ioctl(16, SIOCGIFCONF, { <unfinished ...>
[pid 25522] 10:12:37.569977 read(13,  <unfinished ...>
[pid 25545] 10:12:37.570011 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.570029 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25543] 10:12:37.570052 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.570078 read(6,  <unfinished ...>
[pid 25537] 10:12:37.570102 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384609, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:37.570131 <... ioctl resumed> 160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25522] 10:12:37.570155 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.570191 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.570223 <... set_robust_list resumed> ) = 0
[pid 25543] 10:12:37.570239 <... mmap resumed> ) = 0x7fe585edc000
[pid 25541] 10:12:37.570256 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25537] 10:12:37.570354 write(7, "2015-12-30 10:12:37 [25537] 1aEJMa-0006dB-67 [108.168.168.75] SSL verify error: certificate name mismatch: \"/OU=Domain Control Validated/CN=mail.coursetrends.com\"\n", 163 <unfinished ...>
[pid 25529] 10:12:37.570392 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25522] 10:12:37.570418 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25545] 10:12:37.570457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.570555 futex(0x7ffc5384fa5c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25543] 10:12:37.570586 read(6,  <unfinished ...>
[pid 25541] 10:12:37.570695 read(6,  <unfinished ...>
[pid 25537] 10:12:37.570727 <... write resumed> ) = 163
[pid 25529] 10:12:37.570771 <... ioctl resumed> , {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25522] 10:12:37.570799 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25545] 10:12:37.570879 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.570916 <... futex resumed> ) = 0
[pid 25543] 10:12:37.570933 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25541] 10:12:37.570962 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25537] 10:12:37.571022 read(11,  <unfinished ...>
[pid 25529] 10:12:37.571051 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25522] 10:12:37.571076 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.571113 <... open resumed> ) = 6
[pid 25544] 10:12:37.571129 futex(0x7ffc5384fa5c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fa692c097c0 <unfinished ...>
[pid 25543] 10:12:37.571154 read(6,  <unfinished ...>
[pid 25541] 10:12:37.571177 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25537] 10:12:37.571205 <... read resumed> "\26\3\1\2\r", 5) = 5
[pid 25529] 10:12:37.571224 <... ioctl resumed> , {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.571247 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.571294 read(6,  <unfinished ...>
[pid 25544] 10:12:37.571319 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25543] 10:12:37.571342 <... read resumed> "", 1024) = 0
[pid 25541] 10:12:37.571366 <... open resumed> ) = 8
[pid 25537] 10:12:37.571385 read(11,  <unfinished ...>
[pid 25529] 10:12:37.571408 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25522] 10:12:37.571432 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.571466 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.571571 rt_sigaction(SIGRTMIN, {0x7fa691accc60, [], SA_RESTORER|SA_SIGINFO, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.571612 close(6 <unfinished ...>
[pid 25541] 10:12:37.571647 fstat(8,  <unfinished ...>
[pid 25537] 10:12:37.571678 <... read resumed> "\f\0\2\t\0\200\331~\23\2702\277\364.C7\300L\263\231\374\f\1\304\17\21\315\343z\336\352\244\24\16u\346\267\36\372z{=f\306\246\33xK\2155\343\231\251\235d\277\212l\261\5\323\363_-\nW9IFm\217\261\207G\327\202\264\32a=I\316\3207K\222H`\366nW\227-\23ay\361\242f\204\273\350u\256\207\272\261\313\3436l\212\3#\236\216\24M\225\217\225\21S}\241\311\345\336\245\376\3565|\353\0\1\2\0\200zl\315\267\324\4\354\230[V\256\250\303\215*\347\336\310\314\241\275C\v\244\367 \257\260\253\342/\261\335U\370\35\272\333\306\7[\313)}\203\313\214\20\261u1l,\330\212\17\227!\6\3250\221\326\374uR\3129\330:\2738\331\2555\370K\267*M\200SX\304D\353\342\226\"\357\236\220W\364\213\350\37n\315a\315i\226\350`\242;\343\247\375CW\r\3252\7?"..., 525) = 525
[pid 25529] 10:12:37.571813 <... ioctl resumed> , {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.571841 <... lseek resumed> ) = 353
[pid 25545] 10:12:37.571889 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.571916 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.571933 <... close resumed> ) = 0
[pid 25541] 10:12:37.571949 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25537] 10:12:37.571978 read(11,  <unfinished ...>
[pid 25529] 10:12:37.572003 ioctl(16, SIOCGIFFLAGS <unfinished ...>
[pid 25522] 10:12:37.572027 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.572066 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25544] 10:12:37.572102 rt_sigaction(SIGRT_1, {0x7fa691acccf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.572130 munmap(0x7fe585edc000, 4096 <unfinished ...>
[pid 25541] 10:12:37.572158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25537] 10:12:37.572185 <... read resumed> "\26\3\1\0\4", 5) = 5
[pid 25529] 10:12:37.572204 <... ioctl resumed> , {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25522] 10:12:37.572226 <... open resumed> ) = 14
[pid 25545] 10:12:37.572256 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.572287 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.572304 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.572372 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25537] 10:12:37.572393 read(11,  <unfinished ...>
[pid 25529] 10:12:37.572419 close(16 <unfinished ...>
[pid 25522] 10:12:37.572449 fstat(14,  <unfinished ...>
[pid 25545] 10:12:37.572566 <... mmap resumed> ) = 0x7f6d1422e000
[pid 25544] 10:12:37.572586 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25543] 10:12:37.572625 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25541] 10:12:37.572667 read(8,  <unfinished ...>
[pid 25537] 10:12:37.572702 <... read resumed> "\16\0\0\0", 4) = 4
[pid 25529] 10:12:37.574456 <... close resumed> ) = 0
[pid 25522] 10:12:37.574491 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.574536 mprotect(0x7f6d14234000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.574566 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25543] 10:12:37.574591 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.574698 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25537] 10:12:37.574733 write(11, "\26\3\1\0\206\20\0\0\202\0\200\322gIRq\270\212:(\206[\345\1777\214=gK\r~\4^$9\305!\246\314J\\\373\270\21\225\335\254\365\205N\305F\360\351_ \220\6\263e]\3152\206\357\231\32E\257\334\265\316\234\372]l\177n\353X\36\226\26\242`\273\272\240l\17|K\35\213xw\357ec]3\267\2165|i\364\271\34\177&@a/fa\257\263Ym1\277\205\4\20a\320\314V\376^\\\354\231\3\264\211\356\222\24\3\1\0\1\1\26\3\1\0000)\234\f u\327\30q1\32\241\20\261\313\233E7:C\t\362\374\316\\-c\323\346]\234wT5sf\362\366\3562\252\266\327\277\373m)$\20", 198 <unfinished ...>
[pid 25529] 10:12:37.574787 open("/proc/net/if_inet6", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.574839 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.574878 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.574895 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25543] 10:12:37.574918 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe584d92790},  <unfinished ...>
[pid 25541] 10:12:37.574945 close(8 <unfinished ...>
[pid 25537] 10:12:37.574969 <... write resumed> ) = 198
[pid 25529] 10:12:37.574987 <... open resumed> ) = 16
[pid 25522] 10:12:37.575008 <... mmap resumed> ) = 0x7f2e40b0e000
[pid 25545] 10:12:37.575036 mmap(0x7f6d14433000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25544] 10:12:37.575066 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25543] 10:12:37.575121 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.575158 <... close resumed> ) = 0
[pid 25537] 10:12:37.575176 read(11,  <unfinished ...>
[pid 25529] 10:12:37.575199 fstat(16,  <unfinished ...>
[pid 25522] 10:12:37.575222 read(14,  <unfinished ...>
[pid 25545] 10:12:37.575257 <... mmap resumed> ) = 0x7f6d14433000
[pid 25544] 10:12:37.575278 statfs("/selinux",  <unfinished ...>
[pid 25543] 10:12:37.575311 fstat(2,  <unfinished ...>
[pid 25541] 10:12:37.575334 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25529] 10:12:37.575362 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.575391 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.575426 close(6 <unfinished ...>
[pid 25544] 10:12:37.575449 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350324, f_bavail=6350324, f_files=1000000, f_ffree=691079, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25543] 10:12:37.575600 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25541] 10:12:37.575687 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.575776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.575807 close(14 <unfinished ...>
[pid 25545] 10:12:37.575842 <... close resumed> ) = 0
[pid 25544] 10:12:37.575865 brk(0 <unfinished ...>
[pid 25543] 10:12:37.575889 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fe584d92790},  <unfinished ...>
[pid 25541] 10:12:37.575916 read(6,  <unfinished ...>
[pid 25529] 10:12:37.575940 <... mmap resumed> ) = 0x7f21d3366000
[pid 25522] 10:12:37.575957 <... close resumed> ) = 0
[pid 25545] 10:12:37.575981 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.576012 <... brk resumed> ) = 0x1f05000
[pid 25543] 10:12:37.576028 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.576048 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25529] 10:12:37.576126 read(16,  <unfinished ...>
[pid 25522] 10:12:37.576172 munmap(0x7f2e40b0e000, 4096 <unfinished ...>
[pid 25545] 10:12:37.576210 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.576228 brk(0x1f26000 <unfinished ...>
[pid 25543] 10:12:37.576253 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25541] 10:12:37.576280 read(6,  <unfinished ...>
[pid 25529] 10:12:37.576304 <... read resumed> "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25522] 10:12:37.576326 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.576365 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.576403 <... brk resumed> ) = 0x1f26000
[pid 25543] 10:12:37.576430 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25541] 10:12:37.576452 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25529] 10:12:37.576644 read(16,  <unfinished ...>
[pid 25522] 10:12:37.576692 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.576731 <... open resumed> ) = 6
[pid 25544] 10:12:37.576748 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.576781 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25541] 10:12:37.576808 read(6,  <unfinished ...>
[pid 25529] 10:12:37.576832 <... read resumed> "", 1024) = 0
[pid 25522] 10:12:37.576858 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.576894 read(6,  <unfinished ...>
[pid 25544] 10:12:37.576919 <... open resumed> ) = 6
[pid 25543] 10:12:37.576947 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25541] 10:12:37.576968 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25529] 10:12:37.577076 read(16,  <unfinished ...>
[pid 25522] 10:12:37.577106 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.577142 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.577165 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.577188 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe584d92790},  <unfinished ...>
[pid 25541] 10:12:37.577214 read(6,  <unfinished ...>
[pid 25529] 10:12:37.577238 <... read resumed> "", 1024) = 0
[pid 25522] 10:12:37.577256 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.577313 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.577339 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.577369 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.577396 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25529] 10:12:37.577578 close(16 <unfinished ...>
[pid 25522] 10:12:37.577626 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.577681 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.577717 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.577744 umask(0 <unfinished ...>
[pid 25541] 10:12:37.577767 read(6,  <unfinished ...>
[pid 25529] 10:12:37.577792 <... close resumed> ) = 0
[pid 25522] 10:12:37.577808 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.577862 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.577892 <... mmap resumed> ) = 0x7fa692c20000
[pid 25543] 10:12:37.577910 <... umask resumed> ) = 0
[pid 25541] 10:12:37.577970 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25529] 10:12:37.578011 munmap(0x7f21d3366000, 4096 <unfinished ...>
[pid 25522] 10:12:37.578043 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.578079 <... mmap resumed> ) = 0x7f6d15b83000
[pid 25544] 10:12:37.578099 read(6,  <unfinished ...>
[pid 25543] 10:12:37.578173 geteuid( <unfinished ...>
[pid 25541] 10:12:37.578196 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.578225 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.578277 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.578338 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.578372 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25543] 10:12:37.578401 <... geteuid resumed> ) = 0
[pid 25541] 10:12:37.578421 <... open resumed> ) = 8
[pid 25529] 10:12:37.578439 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25522] 10:12:37.578468 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.578512 <... mmap resumed> ) = 0x7f6d13ef8000
[pid 25544] 10:12:37.578530 read(6,  <unfinished ...>
[pid 25543] 10:12:37.578553 getuid( <unfinished ...>
[pid 25541] 10:12:37.578575 fstat(8,  <unfinished ...>
[pid 25529] 10:12:37.578604 <... socket resumed> ) = 16
[pid 25522] 10:12:37.578626 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.578687 mprotect(0x7f6d14024000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.578719 <... read resumed> "", 1024) = 0
[pid 25543] 10:12:37.578743 <... getuid resumed> ) = 47
[pid 25541] 10:12:37.578762 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.578792 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25522] 10:12:37.578823 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.578858 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.578873 close(6 <unfinished ...>
[pid 25543] 10:12:37.578899 getgid( <unfinished ...>
[pid 25541] 10:12:37.578921 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.578947 <... connect resumed> ) = 0
[pid 25522] 10:12:37.578964 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.579031 mmap(0x7f6d14224000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25544] 10:12:37.579114 <... close resumed> ) = 0
[pid 25543] 10:12:37.579141 <... getgid resumed> ) = 12
[pid 25541] 10:12:37.579184 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25529] 10:12:37.579203 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25522] 10:12:37.579230 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.579266 <... mmap resumed> ) = 0x7f6d14224000
[pid 25544] 10:12:37.579286 munmap(0x7fa692c20000, 4096 <unfinished ...>
[pid 25543] 10:12:37.579314 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25541] 10:12:37.579337 read(8,  <unfinished ...>
[pid 25529] 10:12:37.579363 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25522] 10:12:37.579382 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.579442 mmap(0x7f6d1422d000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.579600 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.579686 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25541] 10:12:37.579712 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.579743 sendto(16, "}7\1\0\0\1\0\0\0\0\0\0\4alt1\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1", 49, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25522] 10:12:37.579799 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25545] 10:12:37.579838 <... mmap resumed> ) = 0x7f6d1422d000
[pid 25544] 10:12:37.579860 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25543] 10:12:37.579894 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25541] 10:12:37.579916 close(8 <unfinished ...>
[pid 25529] 10:12:37.579940 <... sendto resumed> ) = 49
[pid 25522] 10:12:37.579956 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.579989 close(6 <unfinished ...>
[pid 25544] 10:12:37.580012 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.580093 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25541] 10:12:37.580118 <... close resumed> ) = 0
[pid 25529] 10:12:37.580134 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25522] 10:12:37.580161 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.580198 <... close resumed> ) = 0
[pid 25544] 10:12:37.580220 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.580248 getgroups(65536,  <unfinished ...>
[pid 25541] 10:12:37.580271 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25522] 10:12:37.580298 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.580345 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.580379 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.580404 <... getgroups resumed> [12]) = 1
[pid 25541] 10:12:37.580430 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.580459 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.580572 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.580597 fstat(2,  <unfinished ...>
[pid 25543] 10:12:37.580626 setgroups(0, [] <unfinished ...>
[pid 25541] 10:12:37.580659 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.580696 <... open resumed> ) = 14
[pid 25545] 10:12:37.580727 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.580761 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25543] 10:12:37.580823 <... setgroups resumed> ) = 0
[pid 25541] 10:12:37.580845 <... open resumed> ) = 8
[pid 25522] 10:12:37.580862 fstat(14,  <unfinished ...>
[pid 25545] 10:12:37.580893 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.580910 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.580938 getegid( <unfinished ...>
[pid 25541] 10:12:37.580960 fstat(8,  <unfinished ...>
[pid 25522] 10:12:37.580982 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.581021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.581051 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.581072 <... getegid resumed> ) = 12
[pid 25541] 10:12:37.581089 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.581116 fstat(14,  <unfinished ...>
[pid 25545] 10:12:37.581146 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.581165 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.581192 geteuid( <unfinished ...>
[pid 25541] 10:12:37.581214 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.581240 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.581274 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.581307 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25543] 10:12:37.581326 <... geteuid resumed> ) = 0
[pid 25541] 10:12:37.581348 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.581365 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.581398 <... open resumed> ) = 6
[pid 25544] 10:12:37.581414 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.581440 geteuid( <unfinished ...>
[pid 25541] 10:12:37.581462 read(8,  <unfinished ...>
[pid 25522] 10:12:37.581493 <... mmap resumed> ) = 0x7f2e40b0e000
[pid 25545] 10:12:37.581518 read(6,  <unfinished ...>
[pid 25544] 10:12:37.581543 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25543] 10:12:37.581561 <... geteuid resumed> ) = 0
[pid 25541] 10:12:37.581578 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.581614 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.581651 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.581689 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.581719 getegid( <unfinished ...>
[pid 25541] 10:12:37.581741 close(8 <unfinished ...>
[pid 25522] 10:12:37.581765 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.581790 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.581813 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.581838 <... getegid resumed> ) = 12
[pid 25541] 10:12:37.581859 <... close resumed> ) = 0
[pid 25522] 10:12:37.581875 read(14,  <unfinished ...>
[pid 25545] 10:12:37.581906 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.581935 umask(0 <unfinished ...>
[pid 25543] 10:12:37.581958 setgid(12 <unfinished ...>
[pid 25541] 10:12:37.581981 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25522] 10:12:37.582008 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.582046 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.582079 <... umask resumed> ) = 0
[pid 25543] 10:12:37.582128 <... setgid resumed> ) = 0
[pid 25541] 10:12:37.582146 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.582181 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.582206 <... mmap resumed> ) = 0x7f6d13cf4000
[pid 25544] 10:12:37.582215 geteuid( <unfinished ...>
[pid 25543] 10:12:37.582223 setuid(0 <unfinished ...>
[pid 25541] 10:12:37.582233 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.582245 <... open resumed> ) = 15
[pid 25545] 10:12:37.582261 mprotect(0x7f6d13cf6000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.582275 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.582285 <... setuid resumed> ) = 0
[pid 25541] 10:12:37.582321 <... open resumed> ) = 8
[pid 25522] 10:12:37.582331 fstat(15,  <unfinished ...>
[pid 25545] 10:12:37.582348 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.582356 getuid( <unfinished ...>
[pid 25543] 10:12:37.582364 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.582379 fstat(8,  <unfinished ...>
[pid 25522] 10:12:37.582387 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.582414 mmap(0x7f6d13ef6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25544] 10:12:37.582429 <... getuid resumed> ) = 47
[pid 25543] 10:12:37.582439 <... open resumed> ) = 6
[pid 25541] 10:12:37.582464 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.582672 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.582709 <... mmap resumed> ) = 0x7f6d13ef6000
[pid 25544] 10:12:37.582740 getgid( <unfinished ...>
[pid 25543] 10:12:37.582770 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.582801 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.582833 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25545] 10:12:37.582857 close(6 <unfinished ...>
[pid 25544] 10:12:37.582880 <... getgid resumed> ) = 12
[pid 25543] 10:12:37.582917 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25541] 10:12:37.582959 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.582977 read(15,  <unfinished ...>
[pid 25545] 10:12:37.583012 <... close resumed> ) = 0
[pid 25544] 10:12:37.583034 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25543] 10:12:37.583058 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.583081 read(8,  <unfinished ...>
[pid 25522] 10:12:37.583106 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.583140 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.583171 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25543] 10:12:37.583189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25541] 10:12:37.583217 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.583244 close(15 <unfinished ...>
[pid 25545] 10:12:37.583276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.583294 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25543] 10:12:37.583316 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.583344 close(8 <unfinished ...>
[pid 25522] 10:12:37.583367 <... close resumed> ) = 0
[pid 25545] 10:12:37.583390 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.583421 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25543] 10:12:37.583441 <... mmap resumed> ) = 0x7fe585edc000
[pid 25541] 10:12:37.583458 <... close resumed> ) = 0
[pid 25522] 10:12:37.583473 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25545] 10:12:37.583590 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.583617 getgroups(65536,  <unfinished ...>
[pid 25543] 10:12:37.583643 read(6,  <unfinished ...>
[pid 25541] 10:12:37.583678 munmap(0x7fa5f974d000, 4096 <unfinished ...>
[pid 25522] 10:12:37.583707 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.583745 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.583780 <... getgroups resumed> [12]) = 1
[pid 25543] 10:12:37.583803 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25541] 10:12:37.583921 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.584017 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.584056 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.584075 setgroups(0, [] <unfinished ...>
[pid 25543] 10:12:37.584099 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25541] 10:12:37.584129 read(6,  <unfinished ...>
[pid 25522] 10:12:37.584154 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.584216 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.584252 <... setgroups resumed> ) = 0
[pid 25543] 10:12:37.584271 <... socket resumed> ) = 7
[pid 25541] 10:12:37.584287 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25522] 10:12:37.584400 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25545] 10:12:37.584438 <... open resumed> ) = 6
[pid 25544] 10:12:37.584454 getegid( <unfinished ...>
[pid 25543] 10:12:37.584480 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25541] 10:12:37.584520 read(6,  <unfinished ...>
[pid 25522] 10:12:37.584545 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.584577 read(6,  <unfinished ...>
[pid 25544] 10:12:37.584602 <... getegid resumed> ) = 12
[pid 25543] 10:12:37.584626 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.584649 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25522] 10:12:37.584744 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.584785 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.584810 geteuid( <unfinished ...>
[pid 25543] 10:12:37.584833 close(7 <unfinished ...>
[pid 25541] 10:12:37.584862 read(6,  <unfinished ...>
[pid 25522] 10:12:37.584886 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.584931 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.584957 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.584980 <... close resumed> ) = 0
[pid 25541] 10:12:37.584998 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.585017 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25545] 10:12:37.585053 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.585083 geteuid( <unfinished ...>
[pid 25543] 10:12:37.585105 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25541] 10:12:37.585131 read(6,  <unfinished ...>
[pid 25522] 10:12:37.585154 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25545] 10:12:37.585202 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.585234 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.585250 <... socket resumed> ) = 7
[pid 25541] 10:12:37.585272 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.585293 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.585327 <... mmap resumed> ) = 0x7f6d13af1000
[pid 25544] 10:12:37.585344 getegid( <unfinished ...>
[pid 25543] 10:12:37.585366 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25541] 10:12:37.585397 close(6 <unfinished ...>
[pid 25522] 10:12:37.585424 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.585454 mprotect(0x7f6d13af3000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.585612 <... getegid resumed> ) = 12
[pid 25543] 10:12:37.585641 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.585668 <... close resumed> ) = 0
[pid 25522] 10:12:37.585688 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.585724 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.585739 setgid(12 <unfinished ...>
[pid 25543] 10:12:37.585763 close(7 <unfinished ...>
[pid 25541] 10:12:37.585788 munmap(0x7fa5f974e000, 4096 <unfinished ...>
[pid 25522] 10:12:37.585816 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.585869 mmap(0x7f6d13cf2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25544] 10:12:37.585901 <... setgid resumed> ) = 0
[pid 25543] 10:12:37.585920 <... close resumed> ) = 0
[pid 25541] 10:12:37.585944 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.585966 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25545] 10:12:37.586001 <... mmap resumed> ) = 0x7f6d13cf2000
[pid 25544] 10:12:37.586025 setuid(0 <unfinished ...>
[pid 25543] 10:12:37.586050 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.586080 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.586107 <... stat resumed> 0x7ffd5c5bdf00) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.586201 close(6 <unfinished ...>
[pid 25544] 10:12:37.586231 <... setuid resumed> ) = 0
[pid 25543] 10:12:37.586274 <... open resumed> ) = 7
[pid 25541] 10:12:37.586297 <... open resumed> ) = 6
[pid 25522] 10:12:37.586314 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.586349 <... close resumed> ) = 0
[pid 25544] 10:12:37.586371 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.586402 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.586425 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.586447 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.586497 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.586533 <... open resumed> ) = 6
[pid 25543] 10:12:37.586566 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25541] 10:12:37.586603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.586638 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.586684 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.586702 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.586727 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.586760 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.586784 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.586886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.586926 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.586959 <... mmap resumed> ) = 0x7fe585edb000
[pid 25541] 10:12:37.586977 <... mmap resumed> ) = 0x7fa5f974e000
[pid 25522] 10:12:37.586993 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.587024 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.587041 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.587064 read(7,  <unfinished ...>
[pid 25541] 10:12:37.587091 read(6,  <unfinished ...>
[pid 25522] 10:12:37.587116 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.587140 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.587171 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.587198 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25541] 10:12:37.587234 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.587260 read(14,  <unfinished ...>
[pid 25545] 10:12:37.587291 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.587310 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.587336 read(7,  <unfinished ...>
[pid 25541] 10:12:37.587358 close(6 <unfinished ...>
[pid 25522] 10:12:37.587382 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.587426 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.587463 <... mmap resumed> ) = 0x7fa692c20000
[pid 25543] 10:12:37.587585 <... read resumed> "", 4096) = 0
[pid 25541] 10:12:37.587617 <... close resumed> ) = 0
[pid 25522] 10:12:37.587637 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.587680 <... open resumed> ) = 6
[pid 25544] 10:12:37.587700 read(6,  <unfinished ...>
[pid 25543] 10:12:37.587728 close(7 <unfinished ...>
[pid 25541] 10:12:37.587752 munmap(0x7fa5f974e000, 4096 <unfinished ...>
[pid 25522] 10:12:37.587779 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.587828 read(6,  <unfinished ...>
[pid 25544] 10:12:37.587853 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25543] 10:12:37.587973 <... close resumed> ) = 0
[pid 25541] 10:12:37.587996 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.588023 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.588065 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.588088 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25543] 10:12:37.588116 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.588144 fstat(1,  <unfinished ...>
[pid 25522] 10:12:37.588167 <... open resumed> ) = 15
[pid 25545] 10:12:37.588191 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.588214 <... socket resumed> ) = 7
[pid 25543] 10:12:37.588230 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.588261 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25522] 10:12:37.588305 fstat(15,  <unfinished ...>
[pid 25545] 10:12:37.588339 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.588368 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25543] 10:12:37.588400 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.588430 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa5f8604790},  <unfinished ...>
[pid 25522] 10:12:37.588458 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.588586 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.588617 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.588635 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.588652 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.588682 fstat(15,  <unfinished ...>
[pid 25545] 10:12:37.588715 <... mmap resumed> ) = 0x7f6d15b82000
[pid 25544] 10:12:37.588735 close(7 <unfinished ...>
[pid 25543] 10:12:37.588761 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.588796 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25522] 10:12:37.588823 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.588859 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.588887 <... close resumed> ) = 0
[pid 25543] 10:12:37.588904 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.588920 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25522] 10:12:37.588939 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.588979 <... mmap resumed> ) = 0x7f6d1375d000
[pid 25544] 10:12:37.588996 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25543] 10:12:37.589022 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.589052 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25522] 10:12:37.589078 <... mmap resumed> ) = 0x7f2e40b0d000
[pid 25545] 10:12:37.589102 mprotect(0x7f6d138e7000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.589130 <... socket resumed> ) = 7
[pid 25543] 10:12:37.589146 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.589163 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25522] 10:12:37.589185 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.589216 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.589232 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25543] 10:12:37.589263 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.589292 fstat(0,  <unfinished ...>
[pid 25522] 10:12:37.589315 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.589339 mmap(0x7f6d13ae7000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25544] 10:12:37.589370 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.589388 <... open resumed> ) = 7
[pid 25541] 10:12:37.589405 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130169392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.589433 read(15,  <unfinished ...>
[pid 25545] 10:12:37.589464 <... mmap resumed> ) = 0x7f6d13ae7000
[pid 25544] 10:12:37.589575 close(7 <unfinished ...>
[pid 25543] 10:12:37.589607 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.589631 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.589657 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.589690 mmap(0x7f6d13aec000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.589720 <... close resumed> ) = 0
[pid 25543] 10:12:37.589743 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25541] 10:12:37.589774 <... mmap resumed> ) = 0x7fa5f974e000
[pid 25522] 10:12:37.589791 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.589825 <... mmap resumed> ) = 0x7f6d13aec000
[pid 25544] 10:12:37.589846 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.589876 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25541] 10:12:37.589903 read(0,  <unfinished ...>
[pid 25522] 10:12:37.589929 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25545] 10:12:37.589982 close(6 <unfinished ...>
[pid 25544] 10:12:37.590007 <... open resumed> ) = 7
[pid 25543] 10:12:37.590026 <... mmap resumed> ) = 0x7fe585ebb000
[pid 25541] 10:12:37.590043 <... read resumed> "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3519
[pid 25522] 10:12:37.590108 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.590150 <... close resumed> ) = 0
[pid 25544] 10:12:37.590179 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.590204 close(7 <unfinished ...>
[pid 25541] 10:12:37.590227 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.590252 <... open resumed> ) = 16
[pid 25545] 10:12:37.590277 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.590307 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25543] 10:12:37.590335 <... close resumed> ) = 0
[pid 25541] 10:12:37.590362 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.590407 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.590440 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.590460 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.590566 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.590601 open("/var/spool/exim/input/b/1aEJMb-0006dx-Iz-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25522] 10:12:37.590676 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.590715 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.590748 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.590765 <... open resumed> ) = 7
[pid 25541] 10:12:37.590781 <... open resumed> ) = 6
[pid 25522] 10:12:37.590801 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.590836 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.590853 read(7,  <unfinished ...>
[pid 25543] 10:12:37.590880 read(7,  <unfinished ...>
[pid 25541] 10:12:37.590903 fchown(6, 47, 12 <unfinished ...>
[pid 25522] 10:12:37.590931 <... mmap resumed> ) = 0x7f2e40b0c000
[pid 25545] 10:12:37.590955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.590985 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25543] 10:12:37.591021 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.591046 <... fchown resumed> ) = 0
[pid 25522] 10:12:37.591064 read(16,  <unfinished ...>
[pid 25545] 10:12:37.591099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.591118 read(7,  <unfinished ...>
[pid 25543] 10:12:37.591141 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.591163 fchmod(6, 0640 <unfinished ...>
[pid 25522] 10:12:37.591189 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.591228 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.591262 <... read resumed> "", 4096) = 0
[pid 25543] 10:12:37.591279 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25541] 10:12:37.591324 <... fchmod resumed> ) = 0
[pid 25522] 10:12:37.591347 close(16 <unfinished ...>
[pid 25545] 10:12:37.591380 <... open resumed> ) = 6
[pid 25544] 10:12:37.591397 close(7 <unfinished ...>
[pid 25543] 10:12:37.591421 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25541] 10:12:37.591454 fcntl(6, F_GETFL <unfinished ...>
[pid 25522] 10:12:37.591555 <... close resumed> ) = 0
[pid 25545] 10:12:37.591585 read(6,  <unfinished ...>
[pid 25544] 10:12:37.591610 <... close resumed> ) = 0
[pid 25543] 10:12:37.591627 <... mmap resumed> ) = 0x7fe581856000
[pid 25541] 10:12:37.591644 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25522] 10:12:37.591662 munmap(0x7f2e40b0c000, 4096 <unfinished ...>
[pid 25545] 10:12:37.591698 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.591722 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.591747 mprotect(0x7fe581862000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.591775 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.591797 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.591837 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.591863 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.591892 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.591911 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.591940 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.591976 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25544] 10:12:37.592006 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.592034 mmap(0x7fe581a62000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25541] 10:12:37.592064 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.592089 <... open resumed> ) = 16
[pid 25545] 10:12:37.592113 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.592141 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.592158 <... mmap resumed> ) = 0x7fe581a62000
[pid 25541] 10:12:37.592183 <... mmap resumed> ) = 0x7fa5f974d000
[pid 25522] 10:12:37.592202 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.592233 <... mmap resumed> ) = 0x7f6d134f1000
[pid 25544] 10:12:37.592248 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.592286 close(7 <unfinished ...>
[pid 25541] 10:12:37.592309 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.592334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25545] 10:12:37.592373 mprotect(0x7f6d13553000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.592401 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.592418 <... close resumed> ) = 0
[pid 25541] 10:12:37.592457 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.592556 fstat(16,  <unfinished ...>
[pid 25545] 10:12:37.592595 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.592611 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.592651 mprotect(0x7fe581a62000, 4096, PROT_READ <unfinished ...>
[pid 25541] 10:12:37.592682 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25522] 10:12:37.592714 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25545] 10:12:37.592751 mmap(0x7f6d13752000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25544] 10:12:37.592780 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.592798 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.592817 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.592915 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.592951 <... mmap resumed> ) = 0x7f6d13752000
[pid 25544] 10:12:37.592976 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.593007 munmap(0x7fe585ebb000, 39387 <unfinished ...>
[pid 25541] 10:12:37.593035 read(0,  <unfinished ...>
[pid 25522] 10:12:37.593058 <... mmap resumed> ) = 0x7f2e40b0c000
[pid 25545] 10:12:37.593082 close(6 <unfinished ...>
[pid 25544] 10:12:37.593105 <... open resumed> ) = 7
[pid 25543] 10:12:37.593120 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.593145 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.593163 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.593195 <... close resumed> ) = 0
[pid 25544] 10:12:37.593220 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.593245 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.593273 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25522] 10:12:37.593300 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.593324 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.593353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25543] 10:12:37.593382 <... open resumed> ) = 7
[pid 25541] 10:12:37.593403 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25522] 10:12:37.593421 read(16,  <unfinished ...>
[pid 25545] 10:12:37.593455 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.593473 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25543] 10:12:37.593506 fcntl(7, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.593529 write(6, "1aEJMb-0006dx-Iz-D\n--1451491957-eximdsn-2019261844\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3164 <unfinished ...>
[pid 25522] 10:12:37.593566 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25545] 10:12:37.593621 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.593664 <... mmap resumed> ) = 0x7fa692bff000
[pid 25543] 10:12:37.593685 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25541] 10:12:37.593707 <... write resumed> ) = 3164
[pid 25522] 10:12:37.593727 read(16,  <unfinished ...>
[pid 25545] 10:12:37.593758 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.593775 close(7 <unfinished ...>
[pid 25543] 10:12:37.593798 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.593820 fsync(6 <unfinished ...>
[pid 25522] 10:12:37.593891 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.593938 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.594057 <... close resumed> ) = 0
[pid 25543] 10:12:37.594083 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.594112 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.594147 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.594165 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.594196 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.594223 <... open resumed> ) = 17
[pid 25545] 10:12:37.594246 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.594279 <... open resumed> ) = 7
[pid 25543] 10:12:37.594296 <... mmap resumed> ) = 0x7fe585edb000
[pid 25522] 10:12:37.594313 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.594343 <... open resumed> ) = 6
[pid 25544] 10:12:37.594359 read(7,  <unfinished ...>
[pid 25543] 10:12:37.594382 read(7,  <unfinished ...>
[pid 25541] 10:12:37.594408 <... fsync resumed> ) = 0
[pid 25522] 10:12:37.594442 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.594607 read(6,  <unfinished ...>
[pid 25544] 10:12:37.594645 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25543] 10:12:37.594671 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25541] 10:12:37.594710 stat("/etc/localtime",  <unfinished ...>
[pid 25522] 10:12:37.594738 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.594773 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.594806 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.594831 close(7 <unfinished ...>
[pid 25541] 10:12:37.594856 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:37.594926 <... mmap resumed> ) = 0x7f2e40b0b000
[pid 25545] 10:12:37.594955 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.594979 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25543] 10:12:37.595011 <... close resumed> ) = 0
[pid 25541] 10:12:37.595029 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.595052 read(17,  <unfinished ...>
[pid 25545] 10:12:37.595086 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25544] 10:12:37.595116 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25543] 10:12:37.595150 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.595178 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3164, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25522] 10:12:37.595295 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.595341 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.595374 <... mmap resumed> ) = 0x7fa68e59a000
[pid 25543] 10:12:37.595391 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.595427 brk(0x1402000 <unfinished ...>
[pid 25522] 10:12:37.595467 close(17 <unfinished ...>
[pid 25545] 10:12:37.595612 <... mmap resumed> ) = 0x7f6d1310e000
[pid 25544] 10:12:37.595631 mprotect(0x7fa68e5a6000, 2097152, PROT_NONE <unfinished ...>
[pid 25543] 10:12:37.595660 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25541] 10:12:37.595688 <... brk resumed> ) = 0x1402000
[pid 25522] 10:12:37.595734 <... close resumed> ) = 0
[pid 25545] 10:12:37.595761 mprotect(0x7f6d132c7000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.595789 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.595805 <... socket resumed> ) = 7
[pid 25541] 10:12:37.595821 getuid( <unfinished ...>
[pid 25522] 10:12:37.595843 munmap(0x7f2e40b0b000, 4096 <unfinished ...>
[pid 25545] 10:12:37.595878 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.595894 mmap(0x7fa68e7a6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25543] 10:12:37.595923 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25541] 10:12:37.595958 <... getuid resumed> ) = 47
[pid 25522] 10:12:37.595977 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.596013 mmap(0x7f6d134c6000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25544] 10:12:37.596046 <... mmap resumed> ) = 0x7fa68e7a6000
[pid 25543] 10:12:37.596071 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.596096 geteuid( <unfinished ...>
[pid 25522] 10:12:37.596119 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.596157 <... mmap resumed> ) = 0x7f6d134c6000
[pid 25544] 10:12:37.596179 close(7 <unfinished ...>
[pid 25543] 10:12:37.596202 close(7 <unfinished ...>
[pid 25541] 10:12:37.596228 <... geteuid resumed> ) = 47
[pid 25522] 10:12:37.596247 <... open resumed> ) = 17
[pid 25545] 10:12:37.596272 mmap(0x7f6d134ed000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.596302 <... close resumed> ) = 0
[pid 25543] 10:12:37.596338 <... close resumed> ) = 0
[pid 25541] 10:12:37.596357 getgid( <unfinished ...>
[pid 25522] 10:12:37.596379 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.596410 <... mmap resumed> ) = 0x7f6d134ed000
[pid 25544] 10:12:37.596431 mprotect(0x7fa68e7a6000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.596460 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25541] 10:12:37.596491 <... getgid resumed> ) = 12
[pid 25522] 10:12:37.596512 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25545] 10:12:37.596575 close(6 <unfinished ...>
[pid 25544] 10:12:37.596604 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.596624 <... socket resumed> ) = 7
[pid 25541] 10:12:37.596647 getegid( <unfinished ...>
[pid 25522] 10:12:37.596670 fstat(17,  <unfinished ...>
[pid 25545] 10:12:37.596700 <... close resumed> ) = 0
[pid 25544] 10:12:37.596725 munmap(0x7fa692bff000, 39387 <unfinished ...>
[pid 25543] 10:12:37.596754 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25541] 10:12:37.596787 <... getegid resumed> ) = 12
[pid 25522] 10:12:37.596871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25545] 10:12:37.596913 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.596944 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.596968 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.596987 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.597019 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.597054 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.597071 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.597098 close(7 <unfinished ...>
[pid 25541] 10:12:37.597124 <... open resumed> ) = 8
[pid 25522] 10:12:37.597142 <... mmap resumed> ) = 0x7f2e40b0b000
[pid 25545] 10:12:37.597166 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.597198 <... open resumed> ) = 7
[pid 25543] 10:12:37.597219 <... close resumed> ) = 0
[pid 25541] 10:12:37.597241 read(8,  <unfinished ...>
[pid 25522] 10:12:37.597268 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.597299 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.597316 fcntl(7, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.597339 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.597366 <... read resumed> "=\331\255\320", 4) = 4
[pid 25522] 10:12:37.597386 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.597411 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.597441 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25543] 10:12:37.597462 <... open resumed> ) = 7
[pid 25541] 10:12:37.597596 close(8 <unfinished ...>
[pid 25522] 10:12:37.597633 read(17,  <unfinished ...>
[pid 25545] 10:12:37.597664 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.597684 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.597707 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.597730 <... close resumed> ) = 0
[pid 25522] 10:12:37.597841 <... read resumed> "", 4096) = 0
[pid 25545] 10:12:37.597886 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.597923 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25543] 10:12:37.597953 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25541] 10:12:37.597981 readlink("/proc/self/exe",  <unfinished ...>
[pid 25522] 10:12:37.598028 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.598062 <... open resumed> ) = 6
[pid 25544] 10:12:37.598078 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.598105 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.598130 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25522] 10:12:37.598196 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.598250 read(6,  <unfinished ...>
[pid 25544] 10:12:37.598277 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.598295 <... mmap resumed> ) = 0x7fe585edb000
[pid 25541] 10:12:37.598312 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.598338 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.598372 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.598396 read(7,  <unfinished ...>
[pid 25543] 10:12:37.598423 read(7,  <unfinished ...>
[pid 25541] 10:12:37.598448 <... ioctl resumed> , 0x7ffea6d0f8e0) = -1 EINVAL (Invalid argument)
[pid 25522] 10:12:37.598470 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.598599 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.598625 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25543] 10:12:37.598663 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25541] 10:12:37.598698 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.598728 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.598762 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25544] 10:12:37.598792 close(7 <unfinished ...>
[pid 25543] 10:12:37.598816 close(7 <unfinished ...>
[pid 25541] 10:12:37.598840 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25522] 10:12:37.598861 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.598908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.598938 <... close resumed> ) = 0
[pid 25543] 10:12:37.598955 <... close resumed> ) = 0
[pid 25541] 10:12:37.598970 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.598994 stat("/etc/userdomains",  <unfinished ...>
[pid 25545] 10:12:37.599027 <... mmap resumed> ) = 0x7f6d15b81000
[pid 25544] 10:12:37.599047 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.599076 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.599101 <... ioctl resumed> , 0x7ffea6d0f8e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.599119 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.599167 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.599198 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.599234 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.599271 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.599296 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.599329 <... mmap resumed> ) = 0x7f6d12ee1000
[pid 25544] 10:12:37.599345 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25543] 10:12:37.599372 read(6,  <unfinished ...>
[pid 25541] 10:12:37.599397 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.599415 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.599478 mprotect(0x7f6d12f0d000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.599513 <... socket resumed> ) = 7
[pid 25543] 10:12:37.599529 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25541] 10:12:37.599586 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.599614 write(8, "2015-12-30 10:12:37 routing failed for finest09@fin.finestweddingsites.com <redmountainranch@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 178 <unfinished ...>
[pid 25545] 10:12:37.599654 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.599670 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25543] 10:12:37.599703 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.599732 <... ioctl resumed> , 0x7ffea6d0f8f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.599750 <... write resumed> ) = 178
[pid 25545] 10:12:37.599777 mmap(0x7f6d1310d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25544] 10:12:37.599815 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.599832 <... open resumed> ) = 7
[pid 25541] 10:12:37.599849 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.599872 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.599904 <... mmap resumed> ) = 0x7f6d1310d000
[pid 25544] 10:12:37.599925 close(7 <unfinished ...>
[pid 25543] 10:12:37.599952 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.599975 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.599995 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.600043 close(6 <unfinished ...>
[pid 25544] 10:12:37.600069 <... close resumed> ) = 0
[pid 25543] 10:12:37.600085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25541] 10:12:37.600109 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.600127 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.600145 <... close resumed> ) = 0
[pid 25544] 10:12:37.600160 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25543] 10:12:37.600173 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.600185 <... open resumed> ) = 8
[pid 25522] 10:12:37.600195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.600224 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.600243 <... socket resumed> ) = 7
[pid 25543] 10:12:37.600251 <... mmap resumed> ) = 0x7fe585edb000
[pid 25541] 10:12:37.600260 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.600270 close(7 <unfinished ...>
[pid 25545] 10:12:37.600287 <... open resumed> ) = 6
[pid 25544] 10:12:37.600295 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25543] 10:12:37.600312 read(7,  <unfinished ...>
[pid 25541] 10:12:37.600325 <... ioctl resumed> , 0x7ffea6d0f9c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.600335 <... close resumed> ) = 0
[pid 25545] 10:12:37.600353 read(6,  <unfinished ...>
[pid 25544] 10:12:37.600363 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.600372 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25541] 10:12:37.600385 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.600394 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25545] 10:12:37.600420 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.600433 close(7 <unfinished ...>
[pid 25543] 10:12:37.600444 close(7 <unfinished ...>
[pid 25541] 10:12:37.600454 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.600465 <... open resumed> ) = 7
[pid 25545] 10:12:37.600711 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.600743 <... close resumed> ) = 0
[pid 25543] 10:12:37.600765 <... close resumed> ) = 0
[pid 25541] 10:12:37.600782 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.600806 fcntl(7, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.600836 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25544] 10:12:37.600867 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.600895 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.600923 <... fcntl resumed> ) = 0
[pid 25522] 10:12:37.600942 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.600967 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.600997 <... open resumed> ) = 7
[pid 25543] 10:12:37.601014 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.601038 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25522] 10:12:37.601062 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.601094 <... mmap resumed> ) = 0x7f6d12cdc000
[pid 25544] 10:12:37.601164 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.601189 read(6,  <unfinished ...>
[pid 25541] 10:12:37.601214 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa5f8604790}, 8) = 0
[pid 25522] 10:12:37.601239 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.601264 mprotect(0x7f6d12ce1000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.601291 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25543] 10:12:37.601320 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25541] 10:12:37.601360 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25522] 10:12:37.601388 fstat(7,  <unfinished ...>
[pid 25545] 10:12:37.601419 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.601435 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.601461 uname( <unfinished ...>
[pid 25541] 10:12:37.601489 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fa5f8604790}, 8) = 0
[pid 25522] 10:12:37.601760 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384772, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.601808 mmap(0x7f6d12ee0000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25544] 10:12:37.601840 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.601858 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25541] 10:12:37.601910 read(8,  <unfinished ...>
[pid 25522] 10:12:37.601937 write(7, "2015-12-30 10:12:37 [25522] 1aEJMa-0006dL-LG ** finest09@fin.finestweddingsites.com <redmountainranch@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 187 <unfinished ...>
[pid 25545] 10:12:37.601976 <... mmap resumed> ) = 0x7f6d12ee0000
[pid 25544] 10:12:37.601997 read(7,  <unfinished ...>
[pid 25543] 10:12:37.602024 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25541] 10:12:37.602057 <... read resumed> "", 8192) = 0
[pid 25522] 10:12:37.602080 <... write resumed> ) = 187
[pid 25545] 10:12:37.602107 close(6 <unfinished ...>
[pid 25544] 10:12:37.602131 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25543] 10:12:37.602163 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fe584d92790}, 8) = 0
[pid 25541] 10:12:37.602192 close(8 <unfinished ...>
[pid 25522] 10:12:37.602217 close(16 <unfinished ...>
[pid 25545] 10:12:37.602249 <... close resumed> ) = 0
[pid 25544] 10:12:37.602274 close(7 <unfinished ...>
[pid 25543] 10:12:37.602299 clone( <unfinished ...>
[pid 25541] 10:12:37.602639 <... close resumed> ) = 0
[pid 25522] 10:12:37.602854 <... close resumed> ) = 0
[pid 25545] 10:12:37.602889 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.602923 <... close resumed> ) = 0
[pid 25541] 10:12:37.602941 brk(0x1423000 <unfinished ...>
[pid 25522] 10:12:37.602965 munmap(0x7f2e40b0c000, 4096 <unfinished ...>
[pid 25545] 10:12:37.603002 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.603020 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.603046 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe585ec5a90) = 25549
[pid 25541] 10:12:37.603088 <... brk resumed> ) = 0x1423000
[pid 25522] 10:12:37.603212 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.603246 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.603283 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.603319 wait4(25549,  <unfinished ...>
[pid 25541] 10:12:37.603346 stat("/etc/exim.pl",  <unfinished ...>
[pid 25522] 10:12:37.603387 close(17 <unfinished ...>
[pid 25545] 10:12:37.603427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.603450 read(6,  <unfinished ...>
[pid 25541] 10:12:37.603529 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.603570 <... close resumed> ) = 0
[pid 25545] 10:12:37.603595 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.603626 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25541] 10:12:37.603682 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.603715 munmap(0x7f2e40b0b000, 4096 <unfinished ...>
[pid 25545] 10:12:37.603749 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.603770 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.603798 <... open resumed> ) = 8
[pid 25522] 10:12:37.603816 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.603842 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.603872 <... open resumed> ) = 7
[pid 25541] 10:12:37.603889 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.603913 close(13 <unfinished ...>
[pid 25545] 10:12:37.603944 <... open resumed> ) = 6
[pid 25544] 10:12:37.603959 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.603982 <... ioctl resumed> , 0x7ffea6d0f7f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.604007 <... close resumed> ) = 0
[pid 25545] 10:12:37.604030 read(6,  <unfinished ...>
[pid 25544] 10:12:37.604054 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25541] 10:12:37.604083 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.604106 munmap(0x7f2e40b0f000, 4096 <unfinished ...>
[pid 25545] 10:12:37.604139 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.604163 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.604189 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.604231 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.604260 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.604284 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25541] 10:12:37.604301 read(8,  <unfinished ...>
[pid 25522] 10:12:37.604326 close(14 <unfinished ...>
[pid 25545] 10:12:37.604357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25544] 10:12:37.604388 read(7,  <unfinished ...>
[pid 25541] 10:12:37.604415 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25522] 10:12:37.605375 <... close resumed> ) = 0
[pid 25545] 10:12:37.605420 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.605466 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25541] 10:12:37.605609 brk(0x1444000 <unfinished ...>
[pid 25522] 10:12:37.605638 munmap(0x7f2e40b0e000, 4096 <unfinished ...>
[pid 25545] 10:12:37.605671 <... mmap resumed> ) = 0x7f6d12ad9000
[pid 25544] 10:12:37.605689 close(7 <unfinished ...>
[pid 25541] 10:12:37.605714 <... brk resumed> ) = 0x1444000
[pid 25522] 10:12:37.605927 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.605963 mprotect(0x7f6d12adb000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.605994 <... close resumed> ) = 0
[pid 25541] 10:12:37.606011 read(8,  <unfinished ...>
[pid 25522] 10:12:37.606037 close(9 <unfinished ...>
[pid 25545] 10:12:37.606067 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.606083 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25541] 10:12:37.606111 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25522] 10:12:37.606979 <... close resumed> ) = 0
[pid 25545] 10:12:37.607020 mmap(0x7f6d12cda000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25544] 10:12:37.607056 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.607089 brk(0x1465000 <unfinished ...>
[pid 25522] 10:12:37.607116 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.607152 <... mmap resumed> ) = 0x7f6d12cda000
[pid 25544] 10:12:37.607177 read(6,  <unfinished ...>
[pid 25541] 10:12:37.607204 <... brk resumed> ) = 0x1465000
[pid 25522] 10:12:37.607625 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.607665 close(6 <unfinished ...>
[pid 25544] 10:12:37.607692 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25541] 10:12:37.607735 read(8,  <unfinished ...>
[pid 25522] 10:12:37.607764 close(12 <unfinished ...>
[pid 25545] 10:12:37.607798 <... close resumed> ) = 0
[pid 25544] 10:12:37.607833 uname( <unfinished ...>
[pid 25541] 10:12:37.607860 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25522] 10:12:37.608875 <... close resumed> ) = 0
[pid 25545] 10:12:37.608927 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.608979 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25541] 10:12:37.609054 brk(0x1486000 <unfinished ...>
[pid 25522] 10:12:37.609104 munmap(0x7f2e40b10000, 4096 <unfinished ...>
[pid 25545] 10:12:37.609166 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.609195 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25541] 10:12:37.609238 <... brk resumed> ) = 0x1486000
[pid 25522] 10:12:37.609259 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.609725 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.609789 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fa691ad6790}, 8) = 0
[pid 25541] 10:12:37.609830 read(8,  <unfinished ...>
[pid 25522] 10:12:37.609868 close(15 <unfinished ...>
[pid 25545] 10:12:37.609914 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.609939 clone( <unfinished ...>
[pid 25541] 10:12:37.610244 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25522] 10:12:37.610272 <... close resumed> ) = 0
[pid 25545] 10:12:37.610305 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.610352 munmap(0x7f2e40b0d000, 4096 <unfinished ...>
[pid 25545] 10:12:37.610396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.610424 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25550
[pid 25522] 10:12:37.610542 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.610584 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.610634 wait4(25550,  <unfinished ...>
[pid 25522] 10:12:37.610668 close(11 <unfinished ...>
[pid 25545] 10:12:37.610709 <... open resumed> ) = 6
[pid 25522] 10:12:37.610735 <... close resumed> ) = 0
[pid 25545] 10:12:37.610772 read(6,  <unfinished ...>
[pid 25522] 10:12:37.610811 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25545] 10:12:37.610857 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25522] 10:12:37.610897 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.610925 fstat(6,  <unfinished ...>
[pid 25522] 10:12:37.610962 close(10 <unfinished ...>
[pid 25545] 10:12:37.611008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25522] 10:12:37.611057 <... close resumed> ) = 0
[pid 25545] 10:12:37.611088 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.611130 munmap(0x7f2e40b12000, 4096 <unfinished ...>
[pid 25545] 10:12:37.611174 <... mmap resumed> ) = 0x7f6d15b80000
[pid 25522] 10:12:37.611203 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.611247 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25522] 10:12:37.611293 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25545] 10:12:37.611397 <... mmap resumed> ) = 0x7f6d128b6000
[pid 25522] 10:12:37.611424 <... open resumed> ) = 9
[pid 25545] 10:12:37.611454 mprotect(0x7f6d128cd000, 2097152, PROT_NONE <unfinished ...>
[pid 25522] 10:12:37.611586 fcntl(9, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.611633 <... mprotect resumed> ) = 0
[pid 25522] 10:12:37.611657 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.611688 mmap(0x7f6d12acd000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25522] 10:12:37.611733 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.611775 <... mmap resumed> ) = 0x7f6d12acd000
[pid 25522] 10:12:37.611811 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.611843 close(6 <unfinished ...>
[pid 25522] 10:12:37.611877 fchown(9, 47, 12 <unfinished ...>
[pid 25545] 10:12:37.611929 <... close resumed> ) = 0
[pid 25522] 10:12:37.611985 <... fchown resumed> ) = 0
[pid 25545] 10:12:37.612017 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.612067 fchmod(9, 0640 <unfinished ...>
[pid 25545] 10:12:37.612112 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.612139 <... fchmod resumed> ) = 0
[pid 25545] 10:12:37.612199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.612252 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25545] 10:12:37.612307 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.612333 <... open resumed> ) = 10
[pid 25545] 10:12:37.612364 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.612430 alarm(60 <unfinished ...>
[pid 25545] 10:12:37.612965 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.613011 <... read resumed> "\26\3\1\0\252", 5) = 5
[pid 25522] 10:12:37.613048 <... alarm resumed> ) = 0
[pid 25545] 10:12:37.613085 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.613136 read(8,  <unfinished ...>
[pid 25537] 10:12:37.613167 read(11,  <unfinished ...>
[pid 25522] 10:12:37.613204 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25545] 10:12:37.613252 <... open resumed> ) = 6
[pid 25537] 10:12:37.613276 <... read resumed> "\4\0\0\246\0\0\0\0\0\240\347)\272\6\261\237(\234~\204\24\301\243\266\30\234$1 2\240\353[u\"Rz\206\252XNu\272\10y\3170,\362Hu\3525\201:\")\371\37\24\35N\216\272c\320Vo\224\311\362\16\23\2425\20\362\215\370\v/\300\310\245\337\34\276\177\242\17\33\20\254z\207\321]\4\257'\241\177\327\272{O\316\3I5e\371}\27<\177.s8\341\262W\200>\2719*}y\221\351d]\34\265\362*\237\4\277QJ\255\4\2725\273\333\303N\213\6\221}\262Q\307\"8\10\276\245\20\307\237\277\364\34c\352", 170) = 170
[pid 25522] 10:12:37.613350 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.613386 read(6,  <unfinished ...>
[pid 25537] 10:12:37.613421 read(11,  <unfinished ...>
[pid 25522] 10:12:37.613471 alarm(0 <unfinished ...>
[pid 25545] 10:12:37.613591 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.613626 <... read resumed> "", 8192) = 0
[pid 25537] 10:12:37.613646 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25522] 10:12:37.613670 <... alarm resumed> ) = 60
[pid 25545] 10:12:37.613734 fstat(6,  <unfinished ...>
[pid 25537] 10:12:37.613771 read(11,  <unfinished ...>
[pid 25522] 10:12:37.613803 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25545] 10:12:37.613849 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25537] 10:12:37.613893 <... read resumed> "\1", 1) = 1
[pid 25522] 10:12:37.613975 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25545] 10:12:37.614037 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25537] 10:12:37.614088 read(11,  <unfinished ...>
[pid 25522] 10:12:37.614124 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.614177 <... mmap resumed> ) = 0x7f6d12672000
[pid 25537] 10:12:37.614201 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25522] 10:12:37.614228 <... open resumed> ) = 11
[pid 25545] 10:12:37.614260 mprotect(0x7f6d126b3000, 2097152, PROT_NONE <unfinished ...>
[pid 25537] 10:12:37.614301 read(11,  <unfinished ...>
[pid 25522] 10:12:37.614340 fcntl(11, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.614388 <... mprotect resumed> ) = 0
[pid 25537] 10:12:37.614414 <... read resumed> "\304\325\361\215~z\362:\2104\5\v@{\365\247}q\265\0\350\352\24\377\353mvo\212\343\250\354\366j\f\205\v\r&\32\272\266\244\325\255E\300J", 48) = 48
[pid 25522] 10:12:37.614598 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.614631 mmap(0x7f6d128b3000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25537] 10:12:37.614664 alarm(0 <unfinished ...>
[pid 25522] 10:12:37.614688 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.614717 <... mmap resumed> ) = 0x7f6d128b3000
[pid 25537] 10:12:37.614746 <... alarm resumed> ) = 300
[pid 25522] 10:12:37.614794 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.614820 close(6 <unfinished ...>
[pid 25537] 10:12:37.614845 write(11, "\27\3\1\0 \313\300\234\4\3678\326\243\214wo\235\30\321Y1,'\344M\31|\313\232\263L\4\10\373\204ho\27\3\1\0@\207jan*\367\327O\313\205A\242\21\377\7\1G\343\337\323H\365\263\260\255F\237\3119\343\330\276\275j*\r\306\207\300\3745\351T\211^\373@\204+3}\256 \\\247.\254\1\26\317\314\241\336\r", 106 <unfinished ...>
[pid 25522] 10:12:37.614895 read(11,  <unfinished ...>
[pid 25545] 10:12:37.614927 <... close resumed> ) = 0
[pid 25537] 10:12:37.614959 <... write resumed> ) = 106
[pid 25522] 10:12:37.614982 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25545] 10:12:37.615015 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25537] 10:12:37.615049 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25522] 10:12:37.615079 close(11 <unfinished ...>
[pid 25545] 10:12:37.615113 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.615133 <... close resumed> ) = 0
[pid 25545] 10:12:37.615161 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.615197 close(8 <unfinished ...>
[pid 25522] 10:12:37.615223 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.615254 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.615271 <... close resumed> ) = 0
[pid 25522] 10:12:37.615309 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.615337 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.615369 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25522] 10:12:37.615397 stat("/var/tmp",  <unfinished ...>
[pid 25545] 10:12:37.615432 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.615450 <... stat resumed> 0x7fa5f7deb880) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.615471 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25545] 10:12:37.615688 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.615728 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25522] 10:12:37.615758 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.615792 <... open resumed> ) = 6
[pid 25541] 10:12:37.615808 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.615840 <... open resumed> ) = 11
[pid 25545] 10:12:37.615862 read(6,  <unfinished ...>
[pid 25541] 10:12:37.615886 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25522] 10:12:37.615911 fcntl(11, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.615940 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.615963 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25522] 10:12:37.615993 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.616020 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.616044 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.616072 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.616107 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25541] 10:12:37.616144 <... open resumed> ) = 8
[pid 25522] 10:12:37.616164 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.616187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.616215 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.616240 fstat(11,  <unfinished ...>
[pid 25545] 10:12:37.616267 <... mmap resumed> ) = 0x7f6d15b7f000
[pid 25541] 10:12:37.616288 <... ioctl resumed> , 0x7ffea6d0f7f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.616307 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25545] 10:12:37.616358 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.616394 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.616417 pread(11,  <unfinished ...>
[pid 25545] 10:12:37.616447 <... mmap resumed> ) = 0x7f6d1238b000
[pid 25541] 10:12:37.616463 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.616578 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25545] 10:12:37.616632 mprotect(0x7f6d12466000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.616664 read(8,  <unfinished ...>
[pid 25522] 10:12:37.616690 pread(11,  <unfinished ...>
[pid 25545] 10:12:37.616720 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.616740 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25522] 10:12:37.617173 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25545] 10:12:37.617224 mmap(0x7f6d12666000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25541] 10:12:37.617261 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.617285 close(11 <unfinished ...>
[pid 25545] 10:12:37.617314 <... mmap resumed> ) = 0x7f6d12666000
[pid 25522] 10:12:37.617340 <... close resumed> ) = 0
[pid 25545] 10:12:37.617388 close(6 <unfinished ...>
[pid 25522] 10:12:37.617422 close(10 <unfinished ...>
[pid 25545] 10:12:37.617470 <... close resumed> ) = 0
[pid 25541] 10:12:37.617566 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.617595 <... close resumed> ) = 0
[pid 25545] 10:12:37.617634 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.617669 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.617695 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.617731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.617750 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.617771 <... open resumed> ) = 10
[pid 25545] 10:12:37.617794 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.617827 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.617855 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.617894 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.617912 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.617930 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.617969 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.618000 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.618027 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.618055 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.618073 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.618095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25545] 10:12:37.618129 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.618161 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.618195 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.618227 <... open resumed> ) = 6
[pid 25541] 10:12:37.618243 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.618261 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25545] 10:12:37.618282 read(6,  <unfinished ...>
[pid 25541] 10:12:37.618306 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.618338 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.618373 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.618401 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.618423 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.618454 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.618560 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.618596 read(10,  <unfinished ...>
[pid 25545] 10:12:37.618629 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25541] 10:12:37.618668 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.618687 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25545] 10:12:37.618740 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.618778 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.618809 pipe( <unfinished ...>
[pid 25545] 10:12:37.618842 <... mmap resumed> ) = 0x7f6d12187000
[pid 25541] 10:12:37.618860 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.618881 <... pipe resumed> [11, 12]) = 0
[pid 25545] 10:12:37.618906 mprotect(0x7f6d1218a000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.618935 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.618966 close(10 <unfinished ...>
[pid 25545] 10:12:37.618995 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.619011 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.619028 <... close resumed> ) = 0
[pid 25545] 10:12:37.619049 mmap(0x7f6d12389000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25541] 10:12:37.619080 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.619110 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.619143 <... mmap resumed> ) = 0x7f6d12389000
[pid 25541] 10:12:37.619168 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.619191 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.619215 close(6 <unfinished ...>
[pid 25541] 10:12:37.619238 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25522] 10:12:37.619268 clone( <unfinished ...>
[pid 25545] 10:12:37.619683 <... close resumed> ) = 0
[pid 25541] 10:12:37.619711 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.619740 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.619773 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25522] 10:12:37.619804 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25551
[pid 25545] 10:12:37.619847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.619867 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:37.619898 close(12 <unfinished ...>
[pid 25545] 10:12:37.619927 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.619959 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.619990 <... close resumed> ) = 0
[pid 25545] 10:12:37.620012 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.620029 <... open resumed> ) = 9
[pid 25522] 10:12:37.620047 read(11,  <unfinished ...>
[pid 25545] 10:12:37.620074 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.620103 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25545] 10:12:37.620138 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.620158 <... ioctl resumed> , 0x7ffea6d0f200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25545] 10:12:37.620180 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.620212 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.620239 <... open resumed> ) = 6
[pid 25541] 10:12:37.620255 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.620295 read(6,  <unfinished ...>
[pid 25541] 10:12:37.620323 brk(0x14a7000 <unfinished ...>
[pid 25529] 10:12:37.620351 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25545] 10:12:37.620384 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25541] 10:12:37.620415 <... brk resumed> ) = 0x14a7000
[pid 25529] 10:12:37.620451 recvfrom(16,  <unfinished ...>
[pid 25545] 10:12:37.620580 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.620607 read(9,  <unfinished ...>
[pid 25529] 10:12:37.620632 <... recvfrom resumed> "}7\201\200\0\1\0\1\0\0\0\0\4alt1\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\356\0\4\255\302\333\33", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 65
[pid 25545] 10:12:37.620670 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25541] 10:12:37.620702 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25529] 10:12:37.621010 close(16 <unfinished ...>
[pid 25545] 10:12:37.621057 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.621089 read(9,  <unfinished ...>
[pid 25529] 10:12:37.621115 <... close resumed> ) = 0
[pid 25545] 10:12:37.621180 <... mmap resumed> ) = 0x7f6d11f5b000
[pid 25541] 10:12:37.621201 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25529] 10:12:37.621975 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.622030 mprotect(0x7f6d11f84000, 2097152, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.622061 read(9,  <unfinished ...>
[pid 25529] 10:12:37.622083 <... socket resumed> ) = 16
[pid 25545] 10:12:37.622105 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.622123 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25545] 10:12:37.622160 mmap(0x7f6d12184000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25529] 10:12:37.622193 <... connect resumed> ) = 0
[pid 25545] 10:12:37.622215 <... mmap resumed> ) = 0x7f6d12184000
[pid 25529] 10:12:37.622237 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.622270 mmap(0x7f6d12186000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.622306 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25545] 10:12:37.622330 <... mmap resumed> ) = 0x7f6d12186000
[pid 25529] 10:12:37.622352 sendto(16, "\235\326\1\0\0\1\0\0\0\0\0\0\4alt2\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1", 49, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.622438 close(6 <unfinished ...>
[pid 25529] 10:12:37.622469 <... sendto resumed> ) = 49
[pid 25545] 10:12:37.622547 <... close resumed> ) = 0
[pid 25529] 10:12:37.622577 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.622609 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.622653 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.622696 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.622742 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25545] 10:12:37.622785 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.622827 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25545] 10:12:37.622877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b7e000
[pid 25545] 10:12:37.622920 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f6d11d45000
[pid 25545] 10:12:37.622961 mprotect(0x7f6d11d5a000, 2093056, PROT_NONE) = 0
[pid 25545] 10:12:37.622999 mmap(0x7f6d11f59000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f6d11f59000
[pid 25545] 10:12:37.623048 close(6)    = 0
[pid 25545] 10:12:37.623100 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.623145 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.623188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.623232 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25545] 10:12:37.623341 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.623382 brk(0x14c8000 <unfinished ...>
[pid 25545] 10:12:37.623405 <... open resumed> ) = 6
[pid 25545] 10:12:37.623424 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.623465 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.623530 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f6d11b3a000
[pid 25541] 10:12:37.623575 <... brk resumed> ) = 0x14c8000
[pid 25545] 10:12:37.623907 mprotect(0x7f6d11b44000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.623948 read(9,  <unfinished ...>
[pid 25545] 10:12:37.624088 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.624112 mmap(0x7f6d11d43000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f6d11d43000
[pid 25545] 10:12:37.624165 close(6)    = 0
[pid 25545] 10:12:37.624214 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624306 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624355 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25545] 10:12:37.624413 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.624460 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25545] 10:12:37.624587 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f6d11937000
[pid 25545] 10:12:37.624632 mprotect(0x7f6d11939000, 2093056, PROT_NONE) = 0
[pid 25545] 10:12:37.624670 mmap(0x7f6d11b38000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f6d11b38000
[pid 25545] 10:12:37.624717 close(6)    = 0
[pid 25545] 10:12:37.624763 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b7d000
[pid 25545] 10:12:37.624817 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624862 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624906 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.624948 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25545] 10:12:37.624988 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.625029 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25545] 10:12:37.625089 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25541] 10:12:37.625121 <... read resumed> "", 8192) = 0
[pid 25545] 10:12:37.625144 <... mmap resumed> ) = 0x7f6d11718000
[pid 25541] 10:12:37.625162 close(9 <unfinished ...>
[pid 25545] 10:12:37.625190 mprotect(0x7f6d11735000, 2093056, PROT_NONE <unfinished ...>
[pid 25541] 10:12:37.625218 <... close resumed> ) = 0
[pid 25545] 10:12:37.625925 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.625959 read(8,  <unfinished ...>
[pid 25545] 10:12:37.625985 mmap(0x7f6d11934000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f6d11934000
[pid 25545] 10:12:37.626036 mmap(0x7f6d11936000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f6d11936000
[pid 25545] 10:12:37.626083 close(6)    = 0
[pid 25545] 10:12:37.626157 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b7c000
[pid 25545] 10:12:37.626235 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b7b000
[pid 25545] 10:12:37.626282 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b79000
[pid 25545] 10:12:37.626323 arch_prctl(ARCH_SET_FS, 0x7f6d15b797c0) = 0
[pid 25545] 10:12:37.626406 mprotect(0x7f6d11934000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.626460 mprotect(0x7f6d11b38000, 4096, PROT_READ) = 0
[pid 25541] 10:12:37.626622 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25545] 10:12:37.626648 mprotect(0x7f6d11d43000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.626697 mprotect(0x7f6d11f59000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.626750 mprotect(0x7f6d12184000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.626797 mprotect(0x7f6d12389000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.626939 mprotect(0x7f6d12666000, 40960, PROT_READ) = 0
[pid 25545] 10:12:37.627058 mprotect(0x7f6d128b3000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.627110 mprotect(0x7f6d12acd000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.627151 mprotect(0x7f6d12cda000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.627376 mprotect(0x7f6d134c6000, 110592, PROT_READ) = 0
[pid 25545] 10:12:37.627489 mprotect(0x7f6d13752000, 16384, PROT_READ) = 0
[pid 25545] 10:12:37.627623 mprotect(0x7f6d13ae7000, 16384, PROT_READ) = 0
[pid 25545] 10:12:37.627668 mprotect(0x7f6d13cf2000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.627713 mprotect(0x7f6d13ef6000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.628379 mprotect(0x7f6d14c4e000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.628457 mprotect(0x7f6d15083000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.628569 mprotect(0x7f6d15307000, 4096, PROT_READ) = 0
[pid 25545] 10:12:37.628613 mprotect(0x7f6d15510000, 4096, PROT_READ) = 0
[pid 25529] 10:12:37.628672 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25545] 10:12:37.628698 mprotect(0x7f6d15755000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.628726 recvfrom(16,  <unfinished ...>
[pid 25545] 10:12:37.628759 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.628784 <... recvfrom resumed> "\235\326\201\200\0\1\0\1\0\0\0\0\4alt2\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\36\0\4\255\302\314\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 65
[pid 25545] 10:12:37.628820 mprotect(0x7f6d1596f000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.628848 close(16 <unfinished ...>
[pid 25545] 10:12:37.628882 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.628924 <... close resumed> ) = 0
[pid 25545] 10:12:37.628989 mprotect(0x7f6d15b92000, 4096, PROT_READ <unfinished ...>
[pid 25529] 10:12:37.629022 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.629055 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.629079 <... socket resumed> ) = 16
[pid 25545] 10:12:37.629100 munmap(0x7f6d15b87000, 39387 <unfinished ...>
[pid 25529] 10:12:37.629132 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25545] 10:12:37.629169 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.629186 <... connect resumed> ) = 0
[pid 25545] 10:12:37.629207 set_tid_address(0x7f6d15b79a90 <unfinished ...>
[pid 25529] 10:12:37.629232 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.629262 <... set_tid_address resumed> ) = 25545
[pid 25529] 10:12:37.629279 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25545] 10:12:37.629303 set_robust_list(0x7f6d15b79aa0, 24 <unfinished ...>
[pid 25529] 10:12:37.629327 sendto(16, "\271}\1\0\0\1\0\0\0\0\0\0\4alt3\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1", 49, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.629392 <... set_robust_list resumed> ) = 0
[pid 25529] 10:12:37.629411 <... sendto resumed> ) = 49
[pid 25545] 10:12:37.629433 futex(0x7fffd44f7a1c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25529] 10:12:37.629460 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.629555 <... futex resumed> ) = 0
[pid 25545] 10:12:37.629577 futex(0x7fffd44f7a1c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f6d15b797c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25545] 10:12:37.629620 rt_sigaction(SIGRTMIN, {0x7f6d14a3cc60, [], SA_RESTORER|SA_SIGINFO, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.629662 rt_sigaction(SIGRT_1, {0x7f6d14a3ccf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.630388 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25545] 10:12:37.630454 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25541] 10:12:37.630642 read(8,  <unfinished ...>
[pid 25545] 10:12:37.630672 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350323, f_bavail=6350323, f_files=1000000, f_ffree=691077, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25545] 10:12:37.630778 brk(0)      = 0x1cd4000
[pid 25545] 10:12:37.630818 brk(0x1cf5000) = 0x1cf5000
[pid 25545] 10:12:37.630864 open("/proc/filesystems", O_RDONLY) = 6
[pid 25545] 10:12:37.630928 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.630979 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b90000
[pid 25545] 10:12:37.631018 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25545] 10:12:37.631133 read(6, "", 1024) = 0
[pid 25545] 10:12:37.631174 close(6)    = 0
[pid 25545] 10:12:37.631213 munmap(0x7f6d15b90000, 4096) = 0
[pid 25545] 10:12:37.631300 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.631419 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.631470 fstat(2, {st_dev=makedev(0, 8), st_ino=2130165220, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25545] 10:12:37.631557 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.631601 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25545] 10:12:37.631642 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25545] 10:12:37.631680 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.631734 umask(0)    = 022
[pid 25545] 10:12:37.631807 geteuid()   = 0
[pid 25545] 10:12:37.631845 getuid()    = 503
[pid 25545] 10:12:37.631879 getgid()    = 499
[pid 25545] 10:12:37.631926 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25545] 10:12:37.631965 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25545] 10:12:37.632002 getgroups(65536, [500]) = 1
[pid 25545] 10:12:37.632042 setgroups(0, []) = 0
[pid 25545] 10:12:37.632079 getegid()   = 499
[pid 25545] 10:12:37.632112 geteuid()   = 0
[pid 25545] 10:12:37.632148 geteuid()   = 0
[pid 25545] 10:12:37.632182 getegid()   = 499
[pid 25545] 10:12:37.632220 setgid(499) = 0
[pid 25545] 10:12:37.632256 setuid(0)   = 0
[pid 25545] 10:12:37.632317 open("/etc/exim.conf", O_RDONLYProcess 25550 attached
) = 6
[pid 25541] 10:12:37.632426 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25545] 10:12:37.632456 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25550] 10:12:37.633312 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25545] 10:12:37.633339 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.633366 read(8,  <unfinished ...>
[pid 25545] 10:12:37.633390 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25545] 10:12:37.633422 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b90000
[pid 25545] 10:12:37.633462 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25545] 10:12:37.633662 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25545] 10:12:37.633710 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.633761 close(7)    = 0
[pid 25545] 10:12:37.633798 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25545] 10:12:37.633834 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.633875 close(7)    = 0
[pid 25545] 10:12:37.633917 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25545] 10:12:37.633961 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25545] 10:12:37.634009 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.634046 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25545] 10:12:37.634103 read(7, "", 4096) = 0
[pid 25545] 10:12:37.634138 close(7)    = 0
[pid 25545] 10:12:37.634173 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.634222 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.634268 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.634319 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.634360 open("/etc/ld.so.cache", O_RDONLYProcess 25549 attached
 <unfinished ...>
[pid 25550] 10:12:37.634441 <... set_robust_list resumed> ) = 0
[pid 25545] 10:12:37.634463 <... open resumed> ) = 7
[pid 25541] 10:12:37.634553 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25545] 10:12:37.634582 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.634606 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25545] 10:12:37.634629 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25529] 10:12:37.634659 recvfrom(16,  <unfinished ...>
[pid 25545] 10:12:37.634688 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25529] 10:12:37.634715 <... recvfrom resumed> "\271}\201\200\0\1\0\1\0\0\0\0\4alt3\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\0\263\0\4J}\215\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 65
[pid 25545] 10:12:37.634747 <... mmap resumed> ) = 0x7f6d15b6f000
[pid 25529] 10:12:37.634764 close(16 <unfinished ...>
[pid 25545] 10:12:37.634795 close(7 <unfinished ...>
[pid 25529] 10:12:37.634818 <... close resumed> ) = 0
[pid 25545] 10:12:37.634872 <... close resumed> ) = 0
[pid 25529] 10:12:37.634903 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.634936 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.634969 <... socket resumed> ) = 16
[pid 25545] 10:12:37.634989 <... open resumed> ) = 7
[pid 25529] 10:12:37.635005 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25545] 10:12:37.635039 read(7,  <unfinished ...>
[pid 25529] 10:12:37.635062 <... connect resumed> ) = 0
[pid 25545] 10:12:37.635082 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.635106 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.635136 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.635158 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25545] 10:12:37.635180 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.635213 sendto(16, "M\232\1\0\0\1\0\0\0\0\0\0\4alt4\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1", 49, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.635275 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25529] 10:12:37.635308 <... sendto resumed> ) = 49
[pid 25545] 10:12:37.635329 <... mmap resumed> ) = 0x7f6d1150a000
[pid 25529] 10:12:37.635346 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.635377 mprotect(0x7f6d11516000, 2097152, PROT_NONE) = 0
[pid 25545] 10:12:37.635422 mmap(0x7f6d11716000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f6d11716000
[pid 25545] 10:12:37.635471 close(7 <unfinished ...>
[pid 25550] 10:12:37.636198 geteuid( <unfinished ...>
[pid 25549] 10:12:37.636225 set_robust_list(0x7fe585ec5aa0, 24 <unfinished ...>
[pid 25545] 10:12:37.636248 <... close resumed> ) = 0
[pid 25541] 10:12:37.636283 read(8,  <unfinished ...>
[pid 25550] 10:12:37.636355 <... geteuid resumed> ) = 0
[pid 25549] 10:12:37.636388 <... set_robust_list resumed> ) = 0
[pid 25545] 10:12:37.636418 mprotect(0x7f6d11716000, 4096, PROT_READ <unfinished ...>
[pid 25550] 10:12:37.636542 geteuid( <unfinished ...>
[pid 25549] 10:12:37.636568 geteuid( <unfinished ...>
[pid 25545] 10:12:37.636590 <... mprotect resumed> ) = 0
[pid 25541] 10:12:37.636610 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25550] 10:12:37.636635 <... geteuid resumed> ) = 0
[pid 25549] 10:12:37.636818 <... geteuid resumed> ) = 0
[pid 25545] 10:12:37.636842 munmap(0x7f6d15b6f000, 39387 <unfinished ...>
[pid 25550] 10:12:37.636889 getegid( <unfinished ...>
[pid 25549] 10:12:37.636912 geteuid( <unfinished ...>
[pid 25545] 10:12:37.636934 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.636958 brk(0x14e9000 <unfinished ...>
[pid 25550] 10:12:37.636989 <... getegid resumed> ) = 12
[pid 25549] 10:12:37.637004 <... geteuid resumed> ) = 0
[pid 25545] 10:12:37.637022 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25550] 10:12:37.637062 setgid(12 <unfinished ...>
[pid 25549] 10:12:37.637085 getegid( <unfinished ...>
[pid 25545] 10:12:37.637107 <... open resumed> ) = 7
[pid 25541] 10:12:37.637127 <... brk resumed> ) = 0x14e9000
[pid 25550] 10:12:37.637147 <... setgid resumed> ) = 0
[pid 25549] 10:12:37.637666 <... getegid resumed> ) = 12
[pid 25545] 10:12:37.637697 fcntl(7, F_GETFD <unfinished ...>
[pid 25550] 10:12:37.637738 setuid(47 <unfinished ...>
[pid 25549] 10:12:37.637762 setgid(12 <unfinished ...>
[pid 25545] 10:12:37.637785 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25541] 10:12:37.637806 read(8,  <unfinished ...>
[pid 25550] 10:12:37.637837 <... setuid resumed> ) = 0
[pid 25549] 10:12:37.637851 <... setgid resumed> ) = 0
[pid 25545] 10:12:37.639481 fstat(7,  <unfinished ...>
[pid 25550] 10:12:37.639529 brk(0x1f47000 <unfinished ...>
[pid 25549] 10:12:37.639551 setuid(47 <unfinished ...>
[pid 25545] 10:12:37.639571 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25541] 10:12:37.639603 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25545] 10:12:37.639624 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.639664 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.639725 close(7)    = 0
[pid 25545] 10:12:37.639762 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.639821 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25545] 10:12:37.639863 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.639909 close(7)    = 0
[pid 25545] 10:12:37.639952 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25545] 10:12:37.639988 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.640029 close(7)    = 0
[pid 25545] 10:12:37.640069 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25545] 10:12:37.640112 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.640158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.640195 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.640248 close(7)    = 0
[pid 25545] 10:12:37.640284 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.640338 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25549] 10:12:37.641435 <... setuid resumed> ) = 0
[pid 25545] 10:12:37.641464 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.641512 brk(0x150a000 <unfinished ...>
[pid 25545] 10:12:37.641538 <... open resumed> ) = 7
[pid 25529] 10:12:37.641556 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25545] 10:12:37.641581 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.641605 recvfrom(16,  <unfinished ...>
[pid 25545] 10:12:37.641635 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.641666 <... recvfrom resumed> "M\232\201\200\0\1\0\1\0\0\0\0\4alt4\rgmail-smtp-in\1l\6google\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1 \0\4@\351\272\32", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 65
[pid 25545] 10:12:37.641698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.641727 close(16 <unfinished ...>
[pid 25545] 10:12:37.641759 <... mmap resumed> ) = 0x7f6d15b8f000
[pid 25529] 10:12:37.641776 <... close resumed> ) = 0
[pid 25545] 10:12:37.641889 read(7,  <unfinished ...>
[pid 25529] 10:12:37.641926 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25545] 10:12:37.641959 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.641983 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25545] 10:12:37.642035 close(7 <unfinished ...>
[pid 25529] 10:12:37.642064 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.642097 <... close resumed> ) = 0
[pid 25529] 10:12:37.642113 <... open resumed> ) = 16
[pid 25545] 10:12:37.642136 munmap(0x7f6d15b8f000, 4096 <unfinished ...>
[pid 25529] 10:12:37.642165 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25545] 10:12:37.642194 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.642218 <... ioctl resumed> , 0x7ffce2d023e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25545] 10:12:37.642249 read(6,  <unfinished ...>
[pid 25529] 10:12:37.642275 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.642302 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25529] 10:12:37.642342 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.643998 uname( <unfinished ...>
[pid 25529] 10:12:37.644036 fstat(16, Process 25551 attached
 <unfinished ...>
[pid 25549] 10:12:37.644095 brk(0x2052000 <unfinished ...>
[pid 25545] 10:12:37.644119 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25541] 10:12:37.644169 <... brk resumed> ) = 0x150a000
[pid 25529] 10:12:37.644186 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25551] 10:12:37.644223 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25545] 10:12:37.644244 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25529] 10:12:37.644273 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.644301 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790}, 8) = 0
[pid 25529] 10:12:37.644328 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.644362 clone( <unfinished ...>
[pid 25529] 10:12:37.644845 read(16,  <unfinished ...>
[pid 25551] 10:12:37.644881 <... set_robust_list resumed> ) = 0
[pid 25541] 10:12:37.644897 read(8,  <unfinished ...>
[pid 25529] 10:12:37.644917 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25545] 10:12:37.645136 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f6d15b79a90) = 25552
[pid 25529] 10:12:37.645187 close(16 <unfinished ...>
[pid 25545] 10:12:37.645219 wait4(25552,  <unfinished ...>
[pid 25529] 10:12:37.645242 <... close resumed> ) = 0
[pid 25529] 10:12:37.645284 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 16
[pid 25529] 10:12:37.645341 alarm(60)   = 0
[pid 25529] 10:12:37.645376 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25529] 10:12:37.645416 alarm(0)    = 60
[pid 25529] 10:12:37.645473 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.645540 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25529] 10:12:37.645582 fcntl(17, F_GETFD) = 0
[pid 25529] 10:12:37.645615 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.645649 read(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25529] 10:12:37.645694 close(17)   = 0
[pid 25529] 10:12:37.645734 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.645782 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25529] 10:12:37.645856 brk(0x2428000) = 0x2428000
[pid 25529] 10:12:37.646002 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25529] 10:12:37.646048 fcntl(17, F_GETFD) = 0
[pid 25529] 10:12:37.646081 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25529] 10:12:37.646115 fstat(17, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.646177 pread(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25529] 10:12:37.646244 pread(17, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25529] 10:12:37.646309 pread(17, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25529] 10:12:37.646386 close(17)   = 0
[pid 25529] 10:12:37.646459 close(16 <unfinished ...>
[pid 25551] 10:12:37.646702 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25550] 10:12:37.646733 <... brk resumed> ) = 0x1f47000
[pid 25549] 10:12:37.646747 <... brk resumed> ) = 0x2052000
[pid 25541] 10:12:37.647138 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25529] 10:12:37.647530 <... close resumed> ) = 0
[pid 25551] 10:12:37.647576 <... setrlimit resumed> ) = 0
[pid 25550] 10:12:37.647594 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25529] 10:12:37.647620 lseek(13, 0, SEEK_SET) = 0
[pid 25529] 10:12:37.647656 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25529] 10:12:37.647710 stat("/jail_owner", 0x7ffce2d00dc0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.647758 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.647833 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.647883 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.647939 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck", 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.647984 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.648052 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:37.648178 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.648253 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:37.648316 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25551] 10:12:37.649189 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25550] 10:12:37.649224 <... open resumed> ) = 7
[pid 25549] 10:12:37.649239 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25541] 10:12:37.649277 read(8,  <unfinished ...>
[pid 25529] 10:12:37.649304 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25551] 10:12:37.649343 <... open resumed> ) = 10
[pid 25550] 10:12:37.649356 fstat(7,  <unfinished ...>
[pid 25549] 10:12:37.649389 <... open resumed> ) = 7
[pid 25541] 10:12:37.649402 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25529] 10:12:37.649431 <... open resumed> ) = 16
[pid 25551] 10:12:37.649979 fstat(10,  <unfinished ...>
[pid 25550] 10:12:37.650014 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25549] 10:12:37.650046 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.650078 brk(0x152b000 <unfinished ...>
[pid 25529] 10:12:37.650103 fstat(16,  <unfinished ...>
[pid 25551] 10:12:37.650136 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25550] 10:12:37.650169 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25549] 10:12:37.650213 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25541] 10:12:37.650242 <... brk resumed> ) = 0x152b000
[pid 25529] 10:12:37.650262 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25551] 10:12:37.650465 fstat(10,  <unfinished ...>
[pid 25550] 10:12:37.650564 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25549] 10:12:37.650585 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25541] 10:12:37.650619 read(8,  <unfinished ...>
[pid 25537] 10:12:37.650644 <... select resumed> ) = 1 (in [11], left {299, 964619})
[pid 25529] 10:12:37.650677 fstat(16,  <unfinished ...>
[pid 25551] 10:12:37.650711 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25550] 10:12:37.650738 read(7,  <unfinished ...>
[pid 25549] 10:12:37.650772 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25541] 10:12:37.650788 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25537] 10:12:37.650813 read(11,  <unfinished ...>
[pid 25529] 10:12:37.651441 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25551] 10:12:37.651495 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25550] 10:12:37.651528 <... read resumed> "\241&\336\333h\6h\0273\352\2457[\321\351\26'\303\7\0\264#\330[\214\30\357N\240\352\323\247\237\205\243\336\304\v\33.\323m\0\244'\212\306\245", 48) = 48
[pid 25549] 10:12:37.651546 read(7,  <unfinished ...>
[pid 25541] 10:12:37.651578 read(8,  <unfinished ...>
[pid 25537] 10:12:37.651603 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25529] 10:12:37.651623 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25551] 10:12:37.651659 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25550] 10:12:37.651673 close(7 <unfinished ...>
[pid 25549] 10:12:37.651701 <... read resumed> "\334\226\344\16\17c\245\365t\222\n\t\2540\\\340)G)\1\322sY\t\233\21\300}\222\5\211\36d3\315X\211w\30\25\306\347\367Xv\t\230\25", 48) = 48
[pid 25541] 10:12:37.651719 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25537] 10:12:37.651740 read(11,  <unfinished ...>
[pid 25529] 10:12:37.652194 <... mmap resumed> ) = 0x7f21d3366000
[pid 25551] 10:12:37.652227 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25550] 10:12:37.652253 <... close resumed> ) = 0
[pid 25549] 10:12:37.652267 close(7 <unfinished ...>
[pid 25541] 10:12:37.652312 brk(0x154c000 <unfinished ...>
[pid 25537] 10:12:37.652338 <... read resumed> "uD;\375\1\263\330\347I|ZLH\216\16\265\303\206\261\225b\226\300G\224)B\340\316\240\217\204", 32) = 32
[pid 25529] 10:12:37.652372 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25551] 10:12:37.652414 <... lseek resumed> ) = 0
[pid 25550] 10:12:37.652440 getuid( <unfinished ...>
[pid 25549] 10:12:37.652473 <... close resumed> ) = 0
[pid 25541] 10:12:37.652574 <... brk resumed> ) = 0x154c000
[pid 25537] 10:12:37.652607 read(11,  <unfinished ...>
[pid 25529] 10:12:37.652948 <... lseek resumed> ) = 0
[pid 25551] 10:12:37.652980 read(10,  <unfinished ...>
[pid 25550] 10:12:37.653071 <... getuid resumed> ) = 47
[pid 25549] 10:12:37.653096 getuid( <unfinished ...>
[pid 25541] 10:12:37.653276 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25537] 10:12:37.653308 <... read resumed> "\27\3\1\0\200", 5) = 5
[pid 25529] 10:12:37.653328 read(16,  <unfinished ...>
[pid 25551] 10:12:37.653368 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25550] 10:12:37.653387 exit_group(0) = ?
[pid 25549] 10:12:37.653442 <... getuid resumed> ) = 47
[pid 25541] 10:12:37.653734 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.653893 read(11,  <unfinished ...>
[pid 25529] 10:12:37.653927 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25551] 10:12:37.654013 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25550] 10:12:37.654047 +++ exited with 0 +++
[pid 25549] 10:12:37.654060 exit_group(0) = ?
[pid 25544] 10:12:37.654073 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25550
[pid 25541] 10:12:37.654301 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25537] 10:12:37.654334 <... read resumed> "\352\37\317\235\24\270\216\310\246cU\f\235N\353N\220*\177\260\251\35\302\6\203`\217\200\271\300\346vo1\267\302A\26?pr\327\367b\4p&\237\202\267D\216\376m\335e\2560\353N>so13\353\221Ah_\21\254\370\200<\205\307<D\371\4$\254\310%\237\316\360}1\247\2\311\312\0<?\2257a\313\323\36.x\267\307\300\347\270\\e5\31\312\7\206\326B\5\233\255\34\35\251s\224L", 128) = 128
[pid 25529] 10:12:37.654406 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25551] 10:12:37.654541 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25549] 10:12:37.654575 +++ exited with 0 +++
[pid 25544] 10:12:37.654616 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.654651 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25549
[pid 25541] 10:12:37.654672 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.654687 write(11, "\27\3\1\0 9\331\t>\200=<\376\255\214+U\207\n\224.\200\\N2c}\306p\3157\243s-\303!8\27\3\1\0\200\242\346\253c\177\24\345\217\360CC\367\277r\3m\275O1\370\32\30l\325\244\252\344\241lml(\300ES\352\355G\331H\3753k\23.\306\177\336\335\326\27\327\311\343\260\0367N\2F\223\232\t\375\357\4R%\34\233\"\25\227\374\220~\315\0040\33C5\214 z\361\302\206\313?s\r$m\265\355\215Az\243$R\2\f\4\332f\207y\302\366H#\7\306\235\211\362G \366)\251\371\2702\337\366", 170 <unfinished ...>
[pid 25529] 10:12:37.654745 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4137, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25551] 10:12:37.654805 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.654840 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25543] 10:12:37.654894 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25541] 10:12:37.654925 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25537] 10:12:37.654951 <... write resumed> ) = 170
[pid 25529] 10:12:37.654972 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25551] 10:12:37.655013 <... open resumed> ) = 13
[pid 25544] 10:12:37.655027 getcwd( <unfinished ...>
[pid 25543] 10:12:37.655055 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0}, 8) = 0
[pid 25541] 10:12:37.655096 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:37.655114 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25529] 10:12:37.655146 <... open resumed> ) = 17
[pid 25551] 10:12:37.655172 fstat(13,  <unfinished ...>
[pid 25544] 10:12:37.655196 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25543] 10:12:37.655247 getcwd( <unfinished ...>
[pid 25541] 10:12:37.655275 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.655300 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25551] 10:12:37.655334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:37.655360 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.655393 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25541] 10:12:37.655442 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.655461 <... ioctl resumed> , 0x7ffce2cfdd60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25551] 10:12:37.655498 fstat(13,  <unfinished ...>
[pid 25544] 10:12:37.655524 <... open resumed> ) = 7
[pid 25543] 10:12:37.655541 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.655569 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.655595 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25551] 10:12:37.655626 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:37.655651 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.655675 <... open resumed> ) = 7
[pid 25541] 10:12:37.655692 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.655706 <... lseek resumed> ) = 0
[pid 25551] 10:12:37.655732 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.655759 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25543] 10:12:37.655789 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.655812 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.655837 fstat(17,  <unfinished ...>
[pid 25551] 10:12:37.655868 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25544] 10:12:37.655882 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.655906 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.655934 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.655949 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4137, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25551] 10:12:37.655995 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.656020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25543] 10:12:37.656047 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.656070 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.656104 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25551] 10:12:37.656133 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.656138 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.656153 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.656170 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.656176 <... fcntl resumed> ) = 0
[pid 25551] 10:12:37.656202 read(13,  <unfinished ...>
[pid 25544] 10:12:37.656208 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.656222 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.656233 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.656240 read(17,  <unfinished ...>
[pid 25551] 10:12:37.656266 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25544] 10:12:37.656274 read(7,  <unfinished ...>
[pid 25543] 10:12:37.656294 <... mmap resumed> ) = 0x7fe585edb000
[pid 25541] 10:12:37.656303 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.656308 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4137
[pid 25551] 10:12:37.657240 read(13,  <unfinished ...>
[pid 25544] 10:12:37.657274 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25543] 10:12:37.657304 read(7,  <unfinished ...>
[pid 25541] 10:12:37.657332 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.657362 read(17,  <unfinished ...>
[pid 25551] 10:12:37.657394 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:37.657407 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.657468 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25541] 10:12:37.657554 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.657573 <... read resumed> "", 8192) = 0
[pid 25551] 10:12:37.657606 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25544] 10:12:37.657637 <... lseek resumed> ) = 1279
[pid 25543] 10:12:37.657655 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.657679 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.657708 close(17 <unfinished ...>
[pid 25551] 10:12:37.657741 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:37.657758 read(7,  <unfinished ...>
[pid 25543] 10:12:37.657783 <... lseek resumed> ) = 1279
[pid 25541] 10:12:37.657800 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.657814 <... close resumed> ) = 0
[pid 25551] 10:12:37.657865 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25544] 10:12:37.657896 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25543] 10:12:37.657929 read(7,  <unfinished ...>
[pid 25541] 10:12:37.657955 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.657986 stat("/etc/userdomains",  <unfinished ...>
[pid 25551] 10:12:37.658020 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:37.658036 close(7 <unfinished ...>
[pid 25543] 10:12:37.658062 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25541] 10:12:37.658092 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.658111 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25551] 10:12:37.658186 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25544] 10:12:37.658217 <... close resumed> ) = 0
[pid 25543] 10:12:37.658234 close(7 <unfinished ...>
[pid 25541] 10:12:37.658258 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.658288 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25551] 10:12:37.658326 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f2e3f9ca790}, 8) = 0
[pid 25544] 10:12:37.658343 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.658383 <... close resumed> ) = 0
[pid 25541] 10:12:37.658405 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.658423 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25551] 10:12:37.658599 close(11 <unfinished ...>
[pid 25544] 10:12:37.658630 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.658660 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.658690 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.658720 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25551] 10:12:37.658755 <... close resumed> ) = 0
[pid 25544] 10:12:37.658769 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25543] 10:12:37.658807 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.658835 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.658852 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25551] 10:12:37.658916 fcntl(12, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.658943 <... open resumed> ) = 7
[pid 25543] 10:12:37.658962 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25541] 10:12:37.658993 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.659022 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25551] 10:12:37.659059 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.659072 fcntl(7, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.659097 <... open resumed> ) = 7
[pid 25541] 10:12:37.659114 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.659141 <... open resumed> ) = 17
[pid 25551] 10:12:37.659170 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.659193 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.659209 fcntl(7, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.659232 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.659262 fstat(17,  <unfinished ...>
[pid 25551] 10:12:37.659294 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.659307 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.659350 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.659367 <... open resumed> ) = 9
[pid 25529] 10:12:37.659386 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25551] 10:12:37.659446 geteuid( <unfinished ...>
[pid 25544] 10:12:37.659545 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.659570 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.659594 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.659618 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25551] 10:12:37.659654 <... geteuid resumed> ) = 0
[pid 25544] 10:12:37.659667 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.659692 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.659709 <... ioctl resumed> , 0x7ffea6d0f200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.659724 <... mmap resumed> ) = 0x7f21d3365000
[pid 25551] 10:12:37.659750 getegid( <unfinished ...>
[pid 25544] 10:12:37.659772 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384959, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.659805 fstat(7,  <unfinished ...>
[pid 25541] 10:12:37.659828 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.659850 read(17,  <unfinished ...>
[pid 25551] 10:12:37.659886 <... getegid resumed> ) = 12
[pid 25544] 10:12:37.659899 write(7, "2015-12-30 10:12:37 [25544] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMb-0006dm-9U\n", 92 <unfinished ...>
[pid 25543] 10:12:37.659935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5384959, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.659965 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.659978 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25551] 10:12:37.660044 setgid(500 <unfinished ...>
[pid 25544] 10:12:37.660071 <... write resumed> ) = 92
[pid 25543] 10:12:37.660090 write(7, "2015-12-30 10:12:37 [25543] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMb-0006dp-8u\n", 92 <unfinished ...>
[pid 25541] 10:12:37.660120 read(9,  <unfinished ...>
[pid 25529] 10:12:37.660143 close(17 <unfinished ...>
[pid 25551] 10:12:37.660175 <... setgid resumed> ) = 0
[pid 25544] 10:12:37.660189 chdir("/var/spool/exim" <unfinished ...>
[pid 25543] 10:12:37.660221 <... write resumed> ) = 92
[pid 25541] 10:12:37.660239 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25529] 10:12:37.660258 <... close resumed> ) = 0
[pid 25551] 10:12:37.660480 setuid(503 <unfinished ...>
[pid 25544] 10:12:37.660515 <... chdir resumed> ) = 0
[pid 25543] 10:12:37.660536 chdir("/var/spool/exim" <unfinished ...>
[pid 25541] 10:12:37.660567 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.660589 munmap(0x7f21d3365000, 4096 <unfinished ...>
[pid 25551] 10:12:37.660626 <... setuid resumed> ) = 0
[pid 25544] 10:12:37.660640 setgid(12 <unfinished ...>
[pid 25543] 10:12:37.660665 <... chdir resumed> ) = 0
[pid 25541] 10:12:37.660684 <... lseek resumed> ) = 878
[pid 25529] 10:12:37.660698 <... munmap resumed> ) = 0
[pid 25551] 10:12:37.660738 chdir("/" <unfinished ...>
[pid 25544] 10:12:37.660765 <... setgid resumed> ) = 0
[pid 25543] 10:12:37.660810 setgid(12 <unfinished ...>
[pid 25541] 10:12:37.660837 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.660860 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25551] 10:12:37.660903 <... chdir resumed> ) = 0
[pid 25544] 10:12:37.660918 read(6,  <unfinished ...>
[pid 25543] 10:12:37.660961 <... setgid resumed> ) = 0
[pid 25541] 10:12:37.661003 <... lseek resumed> ) = 878
[pid 25529] 10:12:37.661019 <... open resumed> ) = 17
[pid 25551] 10:12:37.661046 geteuid( <unfinished ...>
[pid 25544] 10:12:37.661069 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25543] 10:12:37.661131 read(6,  <unfinished ...>
[pid 25541] 10:12:37.661160 close(9 <unfinished ...>
[pid 25529] 10:12:37.661183 fstat(17,  <unfinished ...>
[pid 25551] 10:12:37.661215 <... geteuid resumed> ) = 503
[pid 25544] 10:12:37.661228 read(6,  <unfinished ...>
[pid 25543] 10:12:37.661254 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25541] 10:12:37.661314 <... close resumed> ) = 0
[pid 25529] 10:12:37.661331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25551] 10:12:37.661741 getegid( <unfinished ...>
[pid 25544] 10:12:37.661775 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25543] 10:12:37.661849 read(6,  <unfinished ...>
[pid 25541] 10:12:37.661877 read(8,  <unfinished ...>
[pid 25529] 10:12:37.661902 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25551] 10:12:37.661938 <... getegid resumed> ) = 500
[pid 25544] 10:12:37.661952 read(6,  <unfinished ...>
[pid 25543] 10:12:37.662001 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25541] 10:12:37.662073 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25529] 10:12:37.662093 <... mmap resumed> ) = 0x7f21d3365000
[pid 25551] 10:12:37.662732 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25544] 10:12:37.662777 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25543] 10:12:37.662842 read(6,  <unfinished ...>
[pid 25541] 10:12:37.662870 read(8,  <unfinished ...>
[pid 25529] 10:12:37.662895 read(17,  <unfinished ...>
[pid 25551] 10:12:37.662930 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25544] 10:12:37.662960 read(6,  <unfinished ...>
[pid 25543] 10:12:37.662987 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25541] 10:12:37.663053 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25529] 10:12:37.663073 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25551] 10:12:37.663230 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25544] 10:12:37.663267 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25543] 10:12:37.663330 read(6,  <unfinished ...>
[pid 25541] 10:12:37.663364 brk(0x156d000 <unfinished ...>
[pid 25529] 10:12:37.663394 close(17 <unfinished ...>
[pid 25551] 10:12:37.663432 <... chdir resumed> ) = 0
[pid 25544] 10:12:37.663446 read(6,  <unfinished ...>
[pid 25543] 10:12:37.663474 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25541] 10:12:37.663617 <... brk resumed> ) = 0x156d000
[pid 25529] 10:12:37.663639 <... close resumed> ) = 0
[pid 25551] 10:12:37.664714 stat("tmp",  <unfinished ...>
[pid 25544] 10:12:37.664757 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25543] 10:12:37.664841 read(6,  <unfinished ...>
[pid 25541] 10:12:37.664872 read(8,  <unfinished ...>
[pid 25529] 10:12:37.664897 munmap(0x7f21d3365000, 4096 <unfinished ...>
[pid 25551] 10:12:37.664935 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.664965 read(6,  <unfinished ...>
[pid 25543] 10:12:37.664992 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25541] 10:12:37.665068 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25529] 10:12:37.665090 <... munmap resumed> ) = 0
[pid 25551] 10:12:37.665318 stat("new",  <unfinished ...>
[pid 25544] 10:12:37.665354 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25543] 10:12:37.665471 read(6,  <unfinished ...>
[pid 25541] 10:12:37.665572 brk(0x158e000 <unfinished ...>
[pid 25529] 10:12:37.665599 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25551] 10:12:37.665636 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.665665 read(6,  <unfinished ...>
[pid 25543] 10:12:37.665692 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25541] 10:12:37.665785 <... brk resumed> ) = 0x158e000
[pid 25529] 10:12:37.665804 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25551] 10:12:37.666995 stat("cur",  <unfinished ...>
[pid 25544] 10:12:37.667037 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25543] 10:12:37.667099 read(6,  <unfinished ...>
[pid 25541] 10:12:37.667131 read(8,  <unfinished ...>
[pid 25529] 10:12:37.667152 pipe( <unfinished ...>
[pid 25551] 10:12:37.667187 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25544] 10:12:37.667216 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.667247 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25529] 10:12:37.667303 <... pipe resumed> [17, 18]) = 0
[pid 25544] 10:12:37.667332 <... open resumed> ) = 8
[pid 25543] 10:12:37.667350 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.667380 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25544] 10:12:37.667415 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.667439 <... open resumed> ) = 8
[pid 25529] 10:12:37.667456 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25544] 10:12:37.667548 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25543] 10:12:37.667585 fstat(8,  <unfinished ...>
[pid 25529] 10:12:37.667610 close(15 <unfinished ...>
[pid 25544] 10:12:37.667733 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.667764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.667794 <... close resumed> ) = 0
Process 25552 attached
[pid 25551] 10:12:37.667829 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25544] 10:12:37.667889 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.667908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.667939 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25552] 10:12:37.667978 set_robust_list(0x7f6d15b79aa0, 24 <unfinished ...>
[pid 25551] 10:12:37.668001 <... open resumed> ) = 11
[pid 25544] 10:12:37.668014 read(8,  <unfinished ...>
[pid 25543] 10:12:37.668045 <... mmap resumed> ) = 0x7fe585edb000
[pid 25541] 10:12:37.668061 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25529] 10:12:37.668080 <... munmap resumed> ) = 0
[pid 25552] 10:12:37.668207 <... set_robust_list resumed> ) = 0
[pid 25551] 10:12:37.668229 read(11,  <unfinished ...>
[pid 25544] 10:12:37.668280 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25543] 10:12:37.668310 read(8,  <unfinished ...>
[pid 25541] 10:12:37.668337 brk(0x15af000 <unfinished ...>
[pid 25529] 10:12:37.668363 close(14 <unfinished ...>
[pid 25552] 10:12:37.668398 geteuid( <unfinished ...>
[pid 25551] 10:12:37.668419 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2964
[pid 25544] 10:12:37.668438 close(8 <unfinished ...>
[pid 25543] 10:12:37.668610 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25541] 10:12:37.668641 <... brk resumed> ) = 0x15af000
[pid 25529] 10:12:37.668656 <... close resumed> ) = 0
[pid 25552] 10:12:37.669399 <... geteuid resumed> ) = 0
[pid 25551] 10:12:37.669428 stat("tmp/1451491957.H668581P25551.fin.finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:37.669546 <... close resumed> ) = 0
[pid 25543] 10:12:37.669571 close(8 <unfinished ...>
[pid 25529] 10:12:37.669597 munmap(0x7f21d3368000, 4096 <unfinished ...>
[pid 25552] 10:12:37.669633 geteuid( <unfinished ...>
[pid 25551] 10:12:37.669656 <... stat resumed> 0x7ffd5c5be100) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.669671 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.669702 <... close resumed> ) = 0
[pid 25529] 10:12:37.669719 <... munmap resumed> ) = 0
[pid 25552] 10:12:37.669745 <... geteuid resumed> ) = 0
[pid 25551] 10:12:37.669759 open("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25544] 10:12:37.669821 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.669907 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25529] 10:12:37.669938 close(9 <unfinished ...>
[pid 25552] 10:12:37.669972 getegid( <unfinished ...>
[pid 25551] 10:12:37.669994 <... open resumed> ) = 14
[pid 25544] 10:12:37.670007 read(6,  <unfinished ...>
[pid 25543] 10:12:37.670040 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.670120 <... close resumed> ) = 0
[pid 25552] 10:12:37.670147 <... getegid resumed> ) = 499
[pid 25551] 10:12:37.670162 chown("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25544] 10:12:37.670199 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25543] 10:12:37.670287 read(6,  <unfinished ...>
[pid 25529] 10:12:37.670316 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25552] 10:12:37.670354 setgid(12 <unfinished ...>
[pid 25551] 10:12:37.670379 <... chown resumed> ) = 0
[pid 25544] 10:12:37.670392 read(6,  <unfinished ...>
[pid 25543] 10:12:37.670424 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25529] 10:12:37.670509 <... munmap resumed> ) = 0
[pid 25552] 10:12:37.670542 <... setgid resumed> ) = 0
[pid 25551] 10:12:37.670556 chmod("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25544] 10:12:37.670588 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25543] 10:12:37.670693 read(6,  <unfinished ...>
[pid 25529] 10:12:37.670721 close(13 <unfinished ...>
[pid 25552] 10:12:37.670753 setuid(47 <unfinished ...>
[pid 25551] 10:12:37.670777 <... chmod resumed> ) = 0
[pid 25544] 10:12:37.670790 read(6,  <unfinished ...>
[pid 25543] 10:12:37.670816 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25529] 10:12:37.670918 <... close resumed> ) = 0
[pid 25552] 10:12:37.670945 <... setuid resumed> ) = 0
[pid 25551] 10:12:37.670959 chown("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25544] 10:12:37.672644 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25543] 10:12:37.672763 read(6,  <unfinished ...>
[pid 25529] 10:12:37.672793 munmap(0x7f21d3369000, 4096 <unfinished ...>
[pid 25552] 10:12:37.672831 brk(0x1d16000 <unfinished ...>
[pid 25551] 10:12:37.672852 <... chown resumed> ) = 0
[pid 25544] 10:12:37.672865 read(6,  <unfinished ...>
[pid 25543] 10:12:37.672889 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25529] 10:12:37.673005 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.673032 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25543] 10:12:37.673133 read(6,  <unfinished ...>
[pid 25529] 10:12:37.673162 close(12 <unfinished ...>
[pid 25544] 10:12:37.673195 read(6,  <unfinished ...>
[pid 25543] 10:12:37.673220 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25529] 10:12:37.673320 <... close resumed> ) = 0
[pid 25544] 10:12:37.673348 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25543] 10:12:37.673399 read(6,  <unfinished ...>
[pid 25529] 10:12:37.673434 munmap(0x7f21d336a000, 4096 <unfinished ...>
[pid 25544] 10:12:37.673471 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.673576 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25529] 10:12:37.673613 <... munmap resumed> ) = 0
[pid 25551] 10:12:37.673642 chmod("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25544] 10:12:37.673665 <... open resumed> ) = 8
[pid 25543] 10:12:37.673682 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.673710 close(16 <unfinished ...>
[pid 25544] 10:12:37.673740 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.673763 <... open resumed> ) = 8
[pid 25529] 10:12:37.673780 <... close resumed> ) = 0
[pid 25544] 10:12:37.673801 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25543] 10:12:37.673831 fstat(8,  <unfinished ...>
[pid 25529] 10:12:37.673854 munmap(0x7f21d3366000, 4096 <unfinished ...>
[pid 25544] 10:12:37.673885 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.673911 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.673940 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.673962 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.673979 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.674004 close(11 <unfinished ...>
[pid 25544] 10:12:37.674032 read(8,  <unfinished ...>
[pid 25543] 10:12:37.674059 <... mmap resumed> ) = 0x7fe585edb000
[pid 25529] 10:12:37.674076 <... close resumed> ) = 0
[pid 25544] 10:12:37.674097 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25543] 10:12:37.674127 read(8,  <unfinished ...>
[pid 25529] 10:12:37.674154 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25544] 10:12:37.674186 close(8 <unfinished ...>
[pid 25543] 10:12:37.674210 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.674239 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.674262 <... close resumed> ) = 0
[pid 25543] 10:12:37.674279 close(8 <unfinished ...>
[pid 25529] 10:12:37.674302 close(10 <unfinished ...>
[pid 25544] 10:12:37.674331 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.674432 <... close resumed> ) = 0
[pid 25529] 10:12:37.674452 <... close resumed> ) = 0
[pid 25551] 10:12:37.674481 <... chmod resumed> ) = 0
[pid 25544] 10:12:37.674530 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.674562 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25541] 10:12:37.674593 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25529] 10:12:37.674630 munmap(0x7f21d336c000, 4096 <unfinished ...>
[pid 25551] 10:12:37.674665 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:37.674691 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.674720 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.674747 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.674765 <... munmap resumed> ) = 0
[pid 25551] 10:12:37.674793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.674856 <... open resumed> ) = 8
[pid 25543] 10:12:37.674876 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.674905 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25529] 10:12:37.674931 clone( <unfinished ...>
[pid 25551] 10:12:37.675227 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.675252 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.675276 <... open resumed> ) = 8
[pid 25541] 10:12:37.675293 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25551] 10:12:37.675317 <... lseek resumed> ) = 19
[pid 25544] 10:12:37.675335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25543] 10:12:37.675370 fstat(8,  <unfinished ...>
[pid 25529] 10:12:37.675400 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25553
[pid 25551] 10:12:37.675454 read(6,  <unfinished ...>
[pid 25544] 10:12:37.675610 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.675640 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.675671 close(18 <unfinished ...>
[pid 25551] 10:12:37.675702 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25544] 10:12:37.675779 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.675799 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.675826 <... close resumed> ) = 0
[pid 25551] 10:12:37.675849 read(6,  <unfinished ...>
[pid 25544] 10:12:37.675873 read(8,  <unfinished ...>
[pid 25543] 10:12:37.675899 <... mmap resumed> ) = 0x7fe585edb000
[pid 25529] 10:12:37.675916 read(17,  <unfinished ...>
[pid 25551] 10:12:37.675943 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:37.675960 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25543] 10:12:37.675990 read(8,  <unfinished ...>
[pid 25551] 10:12:37.676023 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2509 <unfinished ...>
[pid 25544] 10:12:37.676060 close(8 <unfinished ...>
[pid 25543] 10:12:37.676085 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25551] 10:12:37.676124 <... write resumed> ) = 2509
[pid 25544] 10:12:37.676147 <... close resumed> ) = 0
[pid 25543] 10:12:37.676165 close(8 <unfinished ...>
[pid 25551] 10:12:37.676195 fsync(14 <unfinished ...>
[pid 25544] 10:12:37.676273 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.676303 <... close resumed> ) = 0
[pid 25544] 10:12:37.676325 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.676377 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25544] 10:12:37.676543 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.676579 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.676626 <... open resumed> ) = 8
[pid 25543] 10:12:37.676647 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.676680 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.676708 <... open resumed> ) = 8
[pid 25551] 10:12:37.676730 <... fsync resumed> ) = 0
[pid 25544] 10:12:37.676749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25543] 10:12:37.676779 fstat(8,  <unfinished ...>
[pid 25551] 10:12:37.676808 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25544] 10:12:37.676830 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.676857 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25551] 10:12:37.676890 <... lseek resumed> ) = 2964
[pid 25544] 10:12:37.676906 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.676923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25551] 10:12:37.676953 write(11, "2509 1\n", 7 <unfinished ...>
[pid 25544] 10:12:37.676984 read(8,  <unfinished ...>
[pid 25543] 10:12:37.677010 <... mmap resumed> ) = 0x7fe585edb000
[pid 25551] 10:12:37.677032 <... write resumed> ) = 7
[pid 25544] 10:12:37.677048 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25543] 10:12:37.677077 read(8,  <unfinished ...>
[pid 25551] 10:12:37.677109 close(11 <unfinished ...>
[pid 25544] 10:12:37.677134 close(8 <unfinished ...>
[pid 25543] 10:12:37.677157 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25551] 10:12:37.677190 <... close resumed> ) = 0
[pid 25544] 10:12:37.677209 <... close resumed> ) = 0
[pid 25543] 10:12:37.677226 close(8 <unfinished ...>
[pid 25551] 10:12:37.677255 fstat(14,  <unfinished ...>
[pid 25544] 10:12:37.677278 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.677304 <... close resumed> ) = 0
[pid 25551] 10:12:37.677328 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016478, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2509, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.677356 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.677462 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25551] 10:12:37.677588 close(14 <unfinished ...>
[pid 25544] 10:12:37.677621 read(6,  <unfinished ...>
[pid 25543] 10:12:37.677647 <... munmap resumed> ) = 0
[pid 25551] 10:12:37.677741 <... close resumed> ) = 0
[pid 25544] 10:12:37.677775 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25543] 10:12:37.677894 read(6,  <unfinished ...>
[pid 25551] 10:12:37.677928 rename("tmp/1451491957.H668581P25551.fin.finestweddingsites.com", "new/1451491957.H668581P25551.fin.finestweddingsites.com,S=2509" <unfinished ...>
[pid 25544] 10:12:37.677983 read(6,  <unfinished ...>
[pid 25543] 10:12:37.678009 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25551] 10:12:37.678127 <... rename resumed> ) = 0
[pid 25544] 10:12:37.678150 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25543] 10:12:37.678237 read(6,  <unfinished ...>
[pid 25551] 10:12:37.678280 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.678313 read(6,  <unfinished ...>
[pid 25543] 10:12:37.678337 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25551] 10:12:37.678428 <... write resumed> ) = 4
[pid 25544] 10:12:37.678450 <... read resumed> "", 4096) = 0
[pid 25543] 10:12:37.678469 read(6,  <unfinished ...>
[pid 25522] 10:12:37.678560 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25551] 10:12:37.678592 write(12, "\315\t\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.678619 read(6,  <unfinished ...>
[pid 25543] 10:12:37.678643 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.678661 read(11,  <unfinished ...>
[pid 25551] 10:12:37.678693 <... write resumed> ) = 4
[pid 25544] 10:12:37.678710 <... read resumed> "", 4096) = 0
[pid 25543] 10:12:37.678730 read(6,  <unfinished ...>
[pid 25522] 10:12:37.678754 <... read resumed> "\315\t\0\0", 4) = 4
[pid 25551] 10:12:37.678778 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25544] 10:12:37.678802 close(6 <unfinished ...>
[pid 25543] 10:12:37.678826 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.678846 read(11,  <unfinished ...>
[pid 25551] 10:12:37.678876 <... write resumed> ) = 4
[pid 25544] 10:12:37.678892 <... close resumed> ) = 0
[pid 25543] 10:12:37.678908 close(6 <unfinished ...>
[pid 25522] 10:12:37.678931 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25551] 10:12:37.678955 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.678979 munmap(0x7fa692c20000, 4096 <unfinished ...>
[pid 25543] 10:12:37.679008 <... close resumed> ) = 0
[pid 25522] 10:12:37.679025 read(11,  <unfinished ...>
[pid 25551] 10:12:37.679054 <... write resumed> ) = 4
[pid 25544] 10:12:37.679070 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.679105 munmap(0x7fe585edc000, 4096 <unfinished ...>
[pid 25522] 10:12:37.679135 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25551] 10:12:37.679160 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.679184 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fa691ad6790},  <unfinished ...>
[pid 25543] 10:12:37.679212 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.679243 read(11,  <unfinished ...>
[pid 25551] 10:12:37.679276 <... write resumed> ) = 4
[pid 25544] 10:12:37.679292 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.679325 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe584d92790},  <unfinished ...>
[pid 25522] 10:12:37.679377 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25552] 10:12:37.679413 <... brk resumed> ) = 0x1d16000
[pid 25551] 10:12:37.679432 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.679922 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25543] 10:12:37.679968 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25541] 10:12:37.679995 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25522] 10:12:37.680024 read(11,  <unfinished ...>
[pid 25552] 10:12:37.680058 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25551] 10:12:37.680092 <... write resumed> ) = 4
[pid 25544] 10:12:37.680109 <... open resumed> ) = 6
[pid 25543] 10:12:37.680125 open("/var/spool/exim/input/b/1aEJMb-0006dp-8u-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25541] 10:12:37.680156 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.680172 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25552] 10:12:37.680201 <... open resumed> ) = 7
[pid 25551] 10:12:37.680215 write(12, "\2603p\1\0\0\0\0", 8 <unfinished ...>
[pid 25544] 10:12:37.680248 fcntl(6, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.680272 <... open resumed> ) = 6
[pid 25541] 10:12:37.680288 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25522] 10:12:37.680312 read(11,  <unfinished ...>
[pid 25552] 10:12:37.680347 fstat(7,  <unfinished ...>
[pid 25551] 10:12:37.680376 <... write resumed> ) = 8
[pid 25544] 10:12:37.680396 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.680416 fcntl(6, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.680445 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.680465 <... read resumed> "\2603p\1\0\0\0\0", 8) = 8
[pid 25552] 10:12:37.680574 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25551] 10:12:37.680607 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.680641 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.680665 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.680681 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25522] 10:12:37.680708 read(11,  <unfinished ...>
[pid 25552] 10:12:37.680741 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25551] 10:12:37.680767 <... write resumed> ) = 4
[pid 25544] 10:12:37.680783 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.680799 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.680822 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.680837 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25552] 10:12:37.680865 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25551] 10:12:37.680881 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:37.680912 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25543] 10:12:37.680941 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.680957 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25522] 10:12:37.680983 read(11,  <unfinished ...>
[pid 25552] 10:12:37.681015 read(7,  <unfinished ...>
[pid 25551] 10:12:37.681043 <... write resumed> ) = 4
[pid 25544] 10:12:37.681059 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.681076 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25541] 10:12:37.681101 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.681116 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25552] 10:12:37.681147 <... read resumed> "\4L\320\371\216%\357\336\0\336zV{\227\36S\"\303M\200M\235\fxV1\230X~q\1*w\253\2312\201\30'f\304(\322\247\351\2:\277", 48) = 48
[pid 25551] 10:12:37.681165 close(12 <unfinished ...>
[pid 25544] 10:12:37.681198 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.681223 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.681239 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25522] 10:12:37.681275 close(11 <unfinished ...>
[pid 25552] 10:12:37.681311 close(7 <unfinished ...>
[pid 25551] 10:12:37.681334 <... close resumed> ) = 0
[pid 25544] 10:12:37.681352 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.681388 fstat(6,  <unfinished ...>
[pid 25541] 10:12:37.681414 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.681428 <... close resumed> ) = 0
[pid 25552] 10:12:37.681465 <... close resumed> ) = 0
[pid 25551] 10:12:37.681485 close(10 <unfinished ...>
[pid 25544] 10:12:37.681531 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-H", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.681564 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080174, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=5192, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.681600 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25522] 10:12:37.681632 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25552] 10:12:37.681678 getuid( <unfinished ...>
[pid 25551] 10:12:37.681700 <... close resumed> ) = 0
[pid 25544] 10:12:37.681717 <... open resumed> ) = 8
[pid 25543] 10:12:37.681734 open("/var/spool/exim/input/b/1aEJMb-0006dp-8u-H", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.681766 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.681781 <... write resumed> ) = 55
[pid 25552] 10:12:37.681817 <... getuid resumed> ) = 47
[pid 25551] 10:12:37.681834 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25544] 10:12:37.682004 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.682029 <... open resumed> ) = 8
[pid 25541] 10:12:37.682047 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25522] 10:12:37.682079 fsync(9 <unfinished ...>
[pid 25552] 10:12:37.682147 exit_group(0) = ?
[pid 25551] 10:12:37.682162 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.682603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=975, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.682645 fstat(8,  <unfinished ...>
[pid 25541] 10:12:37.682670 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25552] 10:12:37.682714 +++ exited with 0 +++
[pid 25551] 10:12:37.682727 close(13 <unfinished ...>
[pid 25545] 10:12:37.682752 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25552
[pid 25544] 10:12:37.682773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.682800 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080178, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1047, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.682829 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25522] 10:12:37.682859 <... fsync resumed> ) = 0
[pid 25551] 10:12:37.682885 <... close resumed> ) = 0
[pid 25545] 10:12:37.682901 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25544] 10:12:37.682929 <... mmap resumed> ) = 0x7fa692c20000
[pid 25543] 10:12:37.682952 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.682978 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.682993 wait4(-1,  <unfinished ...>
[pid 25551] 10:12:37.683029 munmap(0x7f2e40b12000, 4096 <unfinished ...>
[pid 25545] 10:12:37.683057 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, 8) = 0
[pid 25544] 10:12:37.683103 read(8,  <unfinished ...>
[pid 25543] 10:12:37.683134 <... mmap resumed> ) = 0x7fe585edc000
[pid 25541] 10:12:37.683151 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25551] 10:12:37.683190 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.683562 getcwd( <unfinished ...>
[pid 25544] 10:12:37.683595 <... read resumed> "1aEJMb-0006dm-9U-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 975
[pid 25543] 10:12:37.683651 read(8,  <unfinished ...>
[pid 25551] 10:12:37.683689 exit_group(0) = ?
[pid 25545] 10:12:37.683959 <... getcwd resumed> "/home/finest09/public_html/includes", 16380) = 36
[pid 25544] 10:12:37.684016 read(8,  <unfinished ...>
[pid 25543] 10:12:37.684044 <... read resumed> "1aEJMb-0006dp-8u-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 75\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 1047
[pid 25541] 10:12:37.684095 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25551] 10:12:37.684133 +++ exited with 0 +++
[pid 25545] 10:12:37.684147 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.684175 <... read resumed> "", 4096) = 0
[pid 25543] 10:12:37.684192 read(8,  <unfinished ...>
[pid 25541] 10:12:37.684215 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25522] 10:12:37.684245 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25551
[pid 25545] 10:12:37.684304 <... open resumed> ) = 7
[pid 25544] 10:12:37.684340 close(8 <unfinished ...>
[pid 25543] 10:12:37.684380 <... read resumed> "", 4096) = 0
[pid 25541] 10:12:37.684405 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25522] 10:12:37.684434 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.684585 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.684617 <... close resumed> ) = 0
[pid 25543] 10:12:37.684634 close(8 <unfinished ...>
[pid 25541] 10:12:37.684659 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.684691 <... open resumed> ) = 10
[pid 25545] 10:12:37.684717 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.684747 munmap(0x7fa692c20000, 4096 <unfinished ...>
[pid 25543] 10:12:37.684775 <... close resumed> ) = 0
[pid 25541] 10:12:37.684798 <... open resumed> ) = 9
[pid 25522] 10:12:37.684811 fstat(10,  <unfinished ...>
[pid 25545] 10:12:37.684849 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.684872 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.684892 munmap(0x7fe585edc000, 4096 <unfinished ...>
[pid 25541] 10:12:37.684918 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25522] 10:12:37.684944 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.684983 <... poll resumed> ) = 0 (Timeout)
[pid 25545] 10:12:37.685014 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.685042 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-J", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.685080 <... munmap resumed> ) = 0
[pid 25541] 10:12:37.685101 <... ioctl resumed> , 0x7ffea6d0f200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25522] 10:12:37.685117 fstat(10,  <unfinished ...>
[pid 25491] 10:12:37.685143 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.685183 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.685210 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.685233 open("/var/spool/exim/input/b/1aEJMb-0006dp-8u-J", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.685267 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.685290 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.685318 <... socket resumed> ) = 17
[pid 25545] 10:12:37.685344 <... mmap resumed> ) = 0x7f6d15b8f000
[pid 25544] 10:12:37.685361 open("/var/spool/exim/msglog/b/1aEJMb-0006dm-9U", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25543] 10:12:37.685396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25541] 10:12:37.685418 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.685432 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.685575 connect(17, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25545] 10:12:37.685624 read(7,  <unfinished ...>
[pid 25544] 10:12:37.685652 <... open resumed> ) = 8
[pid 25543] 10:12:37.685668 open("/var/spool/exim/msglog/b/1aEJMb-0006dp-8u", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25541] 10:12:37.685703 read(9,  <unfinished ...>
[pid 25522] 10:12:37.685728 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25491] 10:12:37.685745 <... connect resumed> ) = 0
[pid 25545] 10:12:37.685772 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25544] 10:12:37.685799 fcntl(8, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.685823 <... open resumed> ) = 8
[pid 25541] 10:12:37.685839 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25522] 10:12:37.685857 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.686075 poll([{fd=17, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.686120 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.686145 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.686161 fcntl(8, F_GETFD <unfinished ...>
[pid 25541] 10:12:37.686184 brk(0x15d0000 <unfinished ...>
[pid 25522] 10:12:37.686208 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.686225 <... poll resumed> ) = 1 ([{fd=17, revents=POLLOUT}])
[pid 25545] 10:12:37.686254 <... lseek resumed> ) = 1279
[pid 25544] 10:12:37.686271 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.686294 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.686315 <... brk resumed> ) = 0x15d0000
[pid 25522] 10:12:37.686341 read(10,  <unfinished ...>
[pid 25491] 10:12:37.686908 sendto(17, "kJ\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\0\0\17\0\1", 31, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.686985 read(7,  <unfinished ...>
[pid 25544] 10:12:37.687011 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.687034 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.687059 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.687082 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:37.687130 <... sendto resumed> ) = 31
[pid 25545] 10:12:37.687160 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25544] 10:12:37.687194 fchown(8, 47, 12 <unfinished ...>
[pid 25543] 10:12:37.687227 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.687248 <... lseek resumed> ) = 4868
[pid 25522] 10:12:37.687262 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.687296 poll([{fd=17, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.687331 close(7 <unfinished ...>
[pid 25544] 10:12:37.687359 <... fchown resumed> ) = 0
[pid 25543] 10:12:37.687384 fchown(8, 47, 12 <unfinished ...>
[pid 25541] 10:12:37.687419 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.687443 <... stat resumed> 0x7ffd5c5bce50) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.687544 <... close resumed> ) = 0
[pid 25544] 10:12:37.687570 fchmod(8, 0640 <unfinished ...>
[pid 25543] 10:12:37.687601 <... fchown resumed> ) = 0
[pid 25541] 10:12:37.687620 <... lseek resumed> ) = 4868
[pid 25522] 10:12:37.687638 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.687684 munmap(0x7f6d15b8f000, 4096 <unfinished ...>
[pid 25544] 10:12:37.687712 <... fchmod resumed> ) = 0
[pid 25543] 10:12:37.687733 fchmod(8, 0640 <unfinished ...>
[pid 25541] 10:12:37.687760 close(9 <unfinished ...>
[pid 25522] 10:12:37.687783 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.687838 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.687870 fcntl(8, F_GETFL <unfinished ...>
[pid 25543] 10:12:37.687895 <... fchmod resumed> ) = 0
[pid 25541] 10:12:37.687921 <... close resumed> ) = 0
[pid 25522] 10:12:37.687937 write(8, "2015-12-30 10:12:37 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25545] 10:12:37.687994 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25544] 10:12:37.688030 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25543] 10:12:37.688050 fcntl(8, F_GETFL <unfinished ...>
[pid 25541] 10:12:37.688073 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25522] 10:12:37.688100 <... write resumed> ) = 132
[pid 25545] 10:12:37.688135 <... open resumed> ) = 7
[pid 25544] 10:12:37.688156 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.688180 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25541] 10:12:37.688198 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.688213 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.688249 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.688272 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.688305 fstat(8,  <unfinished ...>
[pid 25541] 10:12:37.688339 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25522] 10:12:37.688372 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.688423 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.688447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.688559 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080180, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.688593 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.688609 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.688648 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.688672 <... mmap resumed> ) = 0x7fa692c20000
[pid 25543] 10:12:37.688689 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.688715 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25522] 10:12:37.688740 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.688779 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.688797 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.688820 <... mmap resumed> ) = 0x7fe585edc000
[pid 25541] 10:12:37.688837 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.688852 close(7 <unfinished ...>
[pid 25545] 10:12:37.688886 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.688909 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.688932 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.688956 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25522] 10:12:37.688982 <... close resumed> ) = 0
[pid 25545] 10:12:37.689008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5385143, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.689040 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25543] 10:12:37.689073 <... lseek resumed> ) = 0
[pid 25541] 10:12:37.689096 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.689112 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25545] 10:12:37.689156 write(7, "2015-12-30 10:12:37 [25545] cwd=/home/finest09/public_html/includes 3 args: /usr/sbin/sendmail -t -i\n", 101 <unfinished ...>
[pid 25544] 10:12:37.689188 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.689221 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25541] 10:12:37.689248 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25522] 10:12:37.689273 <... open resumed> ) = 7
[pid 25545] 10:12:37.689297 <... write resumed> ) = 101
[pid 25544] 10:12:37.689317 pipe( <unfinished ...>
[pid 25543] 10:12:37.689347 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25541] 10:12:37.689386 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.689407 fcntl(7, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.689446 chdir("/var/spool/exim" <unfinished ...>
[pid 25544] 10:12:37.689561 <... pipe resumed> [9, 10]) = 0
[pid 25543] 10:12:37.689585 pipe( <unfinished ...>
[pid 25541] 10:12:37.689612 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25522] 10:12:37.689638 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.689663 <... chdir resumed> ) = 0
[pid 25544] 10:12:37.689682 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.689712 <... pipe resumed> [9, 10]) = 0
[pid 25541] 10:12:37.689730 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.689744 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.689782 geteuid( <unfinished ...>
[pid 25544] 10:12:37.689805 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fa691ad6790}, 8) = 0
[pid 25543] 10:12:37.689828 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25541] 10:12:37.689855 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25522] 10:12:37.689887 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.689912 <... geteuid resumed> ) = 0
[pid 25544] 10:12:37.689928 clone( <unfinished ...>
[pid 25543] 10:12:37.690146 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fe584d92790}, 8) = 0
[pid 25541] 10:12:37.690170 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.690186 fstat(7,  <unfinished ...>
[pid 25545] 10:12:37.690218 getegid( <unfinished ...>
[pid 25543] 10:12:37.690241 clone( <unfinished ...>
[pid 25522] 10:12:37.690449 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5385244, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.690550 <... getegid resumed> ) = 499
[pid 25544] 10:12:37.690586 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25554
[pid 25541] 10:12:37.690633 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25522] 10:12:37.690659 write(7, "2015-12-30 10:12:37 [25522] 1aEJMa-0006dL-LG => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2509 QT=1s DT=0s\n", 232 <unfinished ...>
[pid 25545] 10:12:37.690704 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.690734 close(10 <unfinished ...>
[pid 25543] 10:12:37.690758 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe585ec5a90) = 25555
[pid 25522] 10:12:37.690802 <... write resumed> ) = 232
[pid 25545] 10:12:37.690834 <... open resumed> ) = 8
[pid 25544] 10:12:37.690855 <... close resumed> ) = 0
[pid 25543] 10:12:37.690874 close(10 <unfinished ...>
[pid 25522] 10:12:37.690898 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25545] 10:12:37.690939 fstat(8,  <unfinished ...>
[pid 25544] 10:12:37.690963 read(9,  <unfinished ...>
[pid 25543] 10:12:37.690985 <... close resumed> ) = 0
[pid 25522] 10:12:37.691002 <... open resumed> ) = 11
[pid 25545] 10:12:37.691024 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25543] 10:12:37.691053 read(9,  <unfinished ...>
[pid 25522] 10:12:37.691076 alarm(60 <unfinished ...>
[pid 25545] 10:12:37.691104 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.691131 <... alarm resumed> ) = 0
[pid 25545] 10:12:37.691151 <... mmap resumed> ) = 0x7f6d15b8f000
[pid 25522] 10:12:37.691167 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25545] 10:12:37.691199 read(8,  <unfinished ...>
[pid 25522] 10:12:37.691227 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.691247 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.691275 alarm(0 <unfinished ...>
[pid 25545] 10:12:37.691302 close(8 <unfinished ...>
[pid 25522] 10:12:37.691329 <... alarm resumed> ) = 60
[pid 25545] 10:12:37.691415 <... close resumed> ) = 0
[pid 25522] 10:12:37.691445 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25545] 10:12:37.691574 munmap(0x7f6d15b8f000, 4096 <unfinished ...>
[pid 25522] 10:12:37.691604 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25541] 10:12:37.691639 <... stat resumed> 0x7ffea6d0f410) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.691659 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.691680 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.691716 open("/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.691751 <... open resumed> ) = 12
[pid 25545] 10:12:37.691771 <... open resumed> ) = 8
[pid 25522] 10:12:37.691787 fcntl(12, F_GETFD <unfinished ...>
[pid 25545] 10:12:37.691813 read(8,  <unfinished ...>
[pid 25522] 10:12:37.691838 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.691858 <... read resumed> "65536\n", 31) = 6
[pid 25522] 10:12:37.691875 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.691902 close(8 <unfinished ...>
[pid 25522] 10:12:37.691925 <... fcntl resumed> ) = 0
[pid 25545] 10:12:37.691946 <... close resumed> ) = 0
[pid 25522] 10:12:37.691968 read(12,  <unfinished ...>
[pid 25545] 10:12:37.691997 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.692026 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25545] 10:12:37.692062 <... open resumed> ) = 8
[pid 25522] 10:12:37.692083 close(12 <unfinished ...>
[pid 25545] 10:12:37.692113 fstat(8,  <unfinished ...>
[pid 25522] 10:12:37.692136 <... close resumed> ) = 0
[pid 25545] 10:12:37.692163 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25522] 10:12:37.692195 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.692228 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.692261 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.692285 <... mmap resumed> ) = 0x7f6d15b8f000
[pid 25522] 10:12:37.692303 stat("/var/tmp",  <unfinished ...>
[pid 25491] 10:12:37.692333 <... poll resumed> ) = 1 ([{fd=17, revents=POLLIN}])
[pid 25545] 10:12:37.692357 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25522] 10:12:37.692381 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25491] 10:12:37.692578 recvfrom(17,  <unfinished ...>
[pid 25545] 10:12:37.692620 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.692641 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.692675 <... recvfrom resumed> "kJ\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\n\33\0)\0\n\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\300\f\0\17\0\1\0\0\n\33\0$\0\n\tncghotels\3com\tinbound10\7mxlogic\300O", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 132
[pid 25545] 10:12:37.692713 read(8,  <unfinished ...>
[pid 25522] 10:12:37.692742 <... open resumed> ) = 12
[pid 25491] 10:12:37.692759 close(16 <unfinished ...>
[pid 25545] 10:12:37.692794 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25522] 10:12:37.692826 fcntl(12, F_GETFD <unfinished ...>
[pid 25491] 10:12:37.692850 <... close resumed> ) = 0
[pid 25545] 10:12:37.692872 read(8,  <unfinished ...>
[pid 25522] 10:12:37.692895 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.692912 close(17 <unfinished ...>
[pid 25545] 10:12:37.692943 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.692965 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.692989 <... close resumed> ) = 0
[pid 25545] 10:12:37.693040 close(8 <unfinished ...>
[pid 25522] 10:12:37.693068 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.693085 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25545] 10:12:37.693120 <... close resumed> ) = 0
[pid 25522] 10:12:37.693137 fstat(12,  <unfinished ...>
[pid 25491] 10:12:37.693161 <... socket resumed> ) = 16
[pid 25545] 10:12:37.693183 munmap(0x7f6d15b8f000, 4096 <unfinished ...>
[pid 25522] 10:12:37.693212 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:37.693259 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25545] 10:12:37.693300 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.693322 pread(12,  <unfinished ...>
[pid 25491] 10:12:37.693357 <... connect resumed> ) = 0
[pid 25545] 10:12:37.693386 setgroups(1, [12] <unfinished ...>
[pid 25522] 10:12:37.693421 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25491] 10:12:37.693562 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25545] 10:12:37.693608 <... setgroups resumed> ) = 0
[pid 25541] 10:12:37.693627 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25522] 10:12:37.693650 pread(12,  <unfinished ...>
[pid 25491] 10:12:37.693676 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25545] 10:12:37.693700 setgid(12 <unfinished ...>
[pid 25522] 10:12:37.693724 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25491] 10:12:37.693755 sendto(16, ";t\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1", 53, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25545] 10:12:37.693818 <... setgid resumed> ) = 0
[pid 25522] 10:12:37.693836 close(12 <unfinished ...>
[pid 25491] 10:12:37.693862 <... sendto resumed> ) = 53
[pid 25545] 10:12:37.693883 setuid(47 <unfinished ...>
[pid 25522] 10:12:37.693908 <... close resumed> ) = 0
[pid 25491] 10:12:37.693940 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25545] 10:12:37.693974 <... setuid resumed> ) = 0
[pid 25522] 10:12:37.694022 close(11 <unfinished ...>
[pid 25545] 10:12:37.694056 read(6,  <unfinished ...>
[pid 25522] 10:12:37.694084 <... close resumed> ) = 0
[pid 25545] 10:12:37.694129 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25522] 10:12:37.694194 pipe( <unfinished ...>
[pid 25545] 10:12:37.694227 read(6,  <unfinished ...>
[pid 25522] 10:12:37.694251 <... pipe resumed> [11, 12]) = 0
[pid 25545] 10:12:37.694273 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25522] 10:12:37.694340 close(10 <unfinished ...>
[pid 25545] 10:12:37.694374 read(6,  <unfinished ...>
[pid 25522] 10:12:37.694399 <... close resumed> ) = 0
[pid 25545] 10:12:37.694419 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25522] 10:12:37.694559 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.694602 read(6,  <unfinished ...>
[pid 25541] 10:12:37.694627 <... stat resumed> 0x7ffea6d0f4b0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.694643 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.694672 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25522] 10:12:37.694736 clone( <unfinished ...>
[pid 25545] 10:12:37.695018 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25522] 10:12:37.695113 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25556
[pid 25545] 10:12:37.695157 read(6,  <unfinished ...>
[pid 25522] 10:12:37.695185 close(12 <unfinished ...>
[pid 25545] 10:12:37.695211 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25522] 10:12:37.695308 <... close resumed> ) = 0
[pid 25545] 10:12:37.695335 read(6,  <unfinished ...>
[pid 25522] 10:12:37.695361 read(11,  <unfinished ...>
[pid 25545] 10:12:37.695393 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25545] 10:12:37.695453 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25545] 10:12:37.695569 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.695636 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0Process 25553 attached
) = 0x7f6d15b8f000
[pid 25541] 10:12:37.695697 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25545] 10:12:37.695724 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.695773 close(8)    = 0
[pid 25545] 10:12:37.695809 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.695909 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25545] 10:12:37.696007 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25545] 10:12:37.696130 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25545] 10:12:37.696253 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25545] 10:12:37.696375 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25545] 10:12:37.696435 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25553] 10:12:37.696577 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25545] 10:12:37.696607 fstat(8,  <unfinished ...>
[pid 25541] 10:12:37.696631 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25545] 10:12:37.696664 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.696694 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.696732 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.696783 close(8)    = 0
[pid 25545] 10:12:37.696818 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.696919 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25545] 10:12:37.696969 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25545] 10:12:37.697016 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.697053 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25545] 10:12:37.697103 close(8)    = 0
[pid 25545] 10:12:37.697138 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.697198 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25541] 10:12:37.697247 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.697285 fstat(8,  <unfinished ...>
[pid 25541] 10:12:37.697309 <... open resumed> ) = 9
[pid 25545] 10:12:37.697332 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25541] 10:12:37.697373 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25553] 10:12:37.697414 <... set_robust_list resumed> ) = 0
[pid 25545] 10:12:37.697429 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25541] 10:12:37.697460 <... ioctl resumed> , 0x7ffea6d0f200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25553] 10:12:37.697571 close(17 <unfinished ...>
[pid 25545] 10:12:37.697599 <... mmap resumed> ) = 0x7f6d15b8f000
[pid 25541] 10:12:37.697617 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.697645 read(8,  <unfinished ...>
[pid 25541] 10:12:37.697672 <... lseek resumed> ) = 0
[pid 25545] 10:12:37.697721 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25541] 10:12:37.697761 read(9,  <unfinished ...>
[pid 25545] 10:12:37.697793 close(8 <unfinished ...>
[pid 25541] 10:12:37.697818 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25545] 10:12:37.698275 <... close resumed> ) = 0
[pid 25541] 10:12:37.698306 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.698334 munmap(0x7f6d15b8f000, 4096) = 0
[pid 25545] 10:12:37.698463 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25545] 10:12:37.698662 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25545] 10:12:37.698770 read(6, "", 4096) = 0
[pid 25545] 10:12:37.698812 read(6, "", 4096) = 0
[pid 25545] 10:12:37.698850 close(6)    = 0
[pid 25545] 10:12:37.698887 munmap(0x7f6d15b90000, 4096) = 0
[pid 25545] 10:12:37.698931 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25545] 10:12:37.698974 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.699023 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b90000
[pid 25545] 10:12:37.699061 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.699113 close(6)    = 0
[pid 25545] 10:12:37.699150 munmap(0x7f6d15b90000, 4096) = 0
[pid 25545] 10:12:37.699203 fstat(1, {st_dev=makedev(0, 8), st_ino=2130165219, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=99, st_gid=99, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25545] 10:12:37.699266 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.699322 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25545] 10:12:37.699372 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25545] 10:12:37.699424 fstat(0, {st_dev=makedev(0, 8), st_ino=2130169415, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.699473 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25553] 10:12:37.699585 <... close resumed> ) = 0
[pid 25545] 10:12:37.699600 <... mmap resumed> ) = 0x7f6d15b90000
[pid 25541] 10:12:37.699619 <... lseek resumed> ) = 2366
[pid 25545] 10:12:37.699641 read(0,  <unfinished ...>
[pid 25541] 10:12:37.699668 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25545] 10:12:37.699696 <... read resumed> "To:  kgallagher@mcdowellmountaingc.com, mcdowell-mountain@finestweddingsites.com\nSubject: FinestWeddingSites.com - Interested Bride\nContent-type: text/html; charset=iso-8859-1\r\nCc: BridesFrom@finestweddingsites.com\r\nFrom: Tylerrutt9@yahoo.com\n\n<html><head>"..., 4096) = 2102
[pid 25541] 10:12:37.699789 <... lseek resumed> ) = 2366
[pid 25545] 10:12:37.699817 stat("/etc/localtime",  <unfinished ...>
[pid 25541] 10:12:37.699845 close(9 <unfinished ...>
[pid 25545] 10:12:37.699875 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.699921 <... close resumed> ) = 0
[pid 25545] 10:12:37.700258 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25541] 10:12:37.700344 read(8,  <unfinished ...>
[pid 25545] 10:12:37.700370 <... open resumed> ) = 6
[pid 25545] 10:12:37.700394 fchown(6, 47, 12) = 0
[pid 25545] 10:12:37.700437 fchmod(6, 0640) = 0
[pid 25545] 10:12:37.700554 fcntl(6, F_GETFL <unfinished ...>
[pid 25553] 10:12:37.700592 geteuid( <unfinished ...>
[pid 25545] 10:12:37.700613 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25541] 10:12:37.700632 <... read resumed> "", 8192) = 0
[pid 25545] 10:12:37.700650 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080158, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.700698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d15b8f000
[pid 25545] 10:12:37.700742 lseek(6, 0, SEEK_CUR) = 0
[pid 25545] 10:12:37.700784 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25545] 10:12:37.700879 read(0, "", 4096) = 0
[pid 25545] 10:12:37.700916 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f6d14a46790}, NULL, 8) = 0
[pid 25545] 10:12:37.700954 write(6, "1aEJMb-0006e1-MY-D\n<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" bo"..., 1877) = 1877
[pid 25545] 10:12:37.701004 fsync(6 <unfinished ...>
[pid 25553] 10:12:37.701074 <... geteuid resumed> ) = 0
[pid 25541] 10:12:37.701090 close(8 <unfinished ...>
[pid 25553] 10:12:37.701234 getegid( <unfinished ...>
[pid 25541] 10:12:37.701256 <... close resumed> ) = 0
[pid 25553] 10:12:37.701487 <... getegid resumed> ) = 12
[pid 25545] 10:12:37.701511 <... fsync resumed> ) = 0
[pid 25541] 10:12:37.701547 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25545] 10:12:37.701576 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.701668 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080158, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.701805 brk(0x1d16000) = 0x1d16000
[pid 25545] 10:12:37.701871 getuid()    = 47
[pid 25545] 10:12:37.701908 geteuid()   = 47
[pid 25545] 10:12:37.701943 getgid()    = 12
[pid 25545] 10:12:37.701977 getegid()   = 12
[pid 25545] 10:12:37.702075 open("/dev/urandom", O_RDONLY) = 8
[pid 25545] 10:12:37.702126 read(8, "\350\351r\4", 4) = 4
[pid 25545] 10:12:37.702165 close(8)    = 0
[pid 25545] 10:12:37.702280 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25545] 10:12:37.702392 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffd44b2cb0) = -1 EINVAL (Invalid argument)
[pid 25545] 10:12:37.702437 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25545] 10:12:37.702572 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25553] 10:12:37.702611 setgid(500 <unfinished ...>
[pid 25545] 10:12:37.702639 <... ioctl resumed> , 0x7fffd44b2cb0) = -1 EINVAL (Invalid argument)
[pid 25541] 10:12:37.702658 <... open resumed> ) = 8
[pid 25545] 10:12:37.702680 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.702704 fstat(8,  <unfinished ...>
[pid 25545] 10:12:37.702731 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25541] 10:12:37.702751 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25545] 10:12:37.702786 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25541] 10:12:37.702811 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.702842 <... ioctl resumed> , 0x7fffd44b2cc0) = -1 EINVAL (Invalid argument)
[pid 25541] 10:12:37.702860 <... mmap resumed> ) = 0x7fa5f974c000
[pid 25545] 10:12:37.702880 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.702904 read(8,  <unfinished ...>
[pid 25545] 10:12:37.702935 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25541] 10:12:37.702956 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25545] 10:12:37.702989 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.703022 close(8 <unfinished ...>
[pid 25545] 10:12:37.703052 <... open resumed> ) = 8
[pid 25541] 10:12:37.703069 <... close resumed> ) = 0
[pid 25545] 10:12:37.703089 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25541] 10:12:37.703114 munmap(0x7fa5f974c000, 4096 <unfinished ...>
[pid 25545] 10:12:37.703147 <... ioctl resumed> , 0x7fffd44b2d90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25541] 10:12:37.703165 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.703230 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.703259 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.703287 <... lseek resumed> ) = 0
[pid 25541] 10:12:37.703306 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.703328 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25541] 10:12:37.703352 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.703398 <... fcntl resumed> ) = 0
[pid 25541] 10:12:37.703425 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25553] 10:12:37.703450 <... setgid resumed> ) = 0
[pid 25545] 10:12:37.703464 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25541] 10:12:37.703568 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25553] 10:12:37.703604 setuid(503 <unfinished ...>
[pid 25545] 10:12:37.703624 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f6d14a46790}, 8) = 0
[pid 25541] 10:12:37.703649 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.703670 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25541] 10:12:37.703697 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.703728 <... rt_sigaction resumed> {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f6d14a46790}, 8) = 0
[pid 25541] 10:12:37.703989 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.704018 read(8,  <unfinished ...>
[pid 25541] 10:12:37.704043 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.704075 <... read resumed> "", 8192) = 0
[pid 25541] 10:12:37.704099 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.704121 close(8 <unfinished ...>
[pid 25541] 10:12:37.704146 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.704176 <... close resumed> ) = 0
[pid 25541] 10:12:37.704384 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.704433 brk(0x1d37000 <unfinished ...>
[pid 25541] 10:12:37.704462 alarm(300 <unfinished ...>
[pid 25553] 10:12:37.704564 <... setuid resumed> ) = 0
[pid 25545] 10:12:37.704580 <... brk resumed> ) = 0x1d37000
[pid 25541] 10:12:37.704699 <... alarm resumed> ) = 0
[pid 25545] 10:12:37.704728 stat("/etc/exim.pl",  <unfinished ...>
[pid 25541] 10:12:37.704759 alarm(0 <unfinished ...>
[pid 25545] 10:12:37.704786 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25541] 10:12:37.704819 <... alarm resumed> ) = 300
[pid 25545] 10:12:37.704840 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25541] 10:12:37.704869 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.704901 <... open resumed> ) = 8
[pid 25541] 10:12:37.704920 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.704941 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25541] 10:12:37.704966 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.704996 <... ioctl resumed> , 0x7fffd44b2bc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25541] 10:12:37.705014 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.705035 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25541] 10:12:37.705059 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.705088 <... lseek resumed> ) = 0
[pid 25541] 10:12:37.705124 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.705149 read(8,  <unfinished ...>
[pid 25541] 10:12:37.705176 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.705205 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25541] 10:12:37.706242 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.706282 brk(0x1d58000 <unfinished ...>
[pid 25541] 10:12:37.706312 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fa5f8604790},  <unfinished ...>
[pid 25545] 10:12:37.706345 <... brk resumed> ) = 0x1d58000
[pid 25541] 10:12:37.706620 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25545] 10:12:37.706657 read(8,  <unfinished ...>
[pid 25541] 10:12:37.706686 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0},  <unfinished ...>
[pid 25545] 10:12:37.706719 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25541] 10:12:37.707708 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, 8) = 0
[pid 25545] 10:12:37.707753 brk(0x1d79000 <unfinished ...>
[pid 25541] 10:12:37.707777 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, 8) = 0
[pid 25541] 10:12:37.707827 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.707893 open("/var/spool/exim/input/b/hdr.25541", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25545] 10:12:37.707985 <... brk resumed> ) = 0x1d79000
[pid 25541] 10:12:37.708296 fchown(8, 47, 12 <unfinished ...>
[pid 25545] 10:12:37.708348 read(8,  <unfinished ...>
[pid 25541] 10:12:37.708425 <... fchown resumed> ) = 0
[pid 25553] 10:12:37.708463 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.708546 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25541] 10:12:37.708568 fchmod(8, 0640) = 0
[pid 25541] 10:12:37.708608 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25541] 10:12:37.708653 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.708701 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f974c000
[pid 25541] 10:12:37.708740 lseek(8, 0, SEEK_CUR) = 0
[pid 25541] 10:12:37.708789 write(8, "1aEJMb-0006dx-Iz-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25541] 10:12:37.708839 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.708892 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMb-0006dx-Iz\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:37 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25541] 10:12:37.708934 fsync(8 <unfinished ...>
[pid 25553] 10:12:37.709946 <... open resumed> ) = 9
[pid 25545] 10:12:37.709966 brk(0x1d9a000 <unfinished ...>
[pid 25541] 10:12:37.709989 <... fsync resumed> ) = 0
[pid 25541] 10:12:37.710009 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.710059 close(8)    = 0
[pid 25541] 10:12:37.710095 munmap(0x7fa5f974c000, 4096) = 0
[pid 25541] 10:12:37.710141 rename("/var/spool/exim/input/b/hdr.25541", "/var/spool/exim/input/b/1aEJMb-0006dx-Iz-H") = 0
[pid 25541] 10:12:37.710206 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25541] 10:12:37.710249 fsync(8)    = 0
[pid 25541] 10:12:37.710285 close(8)    = 0
[pid 25541] 10:12:37.710320 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3164, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.710387 open("/var/spool/exim/msglog/b/1aEJMb-0006dx-Iz", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25541] 10:12:37.710464 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25541] 10:12:37.710562 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080186, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.710612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5f974c000
[pid 25541] 10:12:37.710649 lseek(8, 0, SEEK_CUR) = 0
[pid 25541] 10:12:37.710685 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.710749 write(8, "2015-12-30 10:12:37 Received from <> R=1aEJMY-0006cE-He U=mailnull P=local S=3788 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25541] 10:12:37.710796 close(8)    = 0
[pid 25541] 10:12:37.710831 munmap(0x7fa5f974c000, 4096) = 0
[pid 25541] 10:12:37.710872 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.710929 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25541] 10:12:37.710981 close(7)    = 0
[pid 25541] 10:12:37.711019 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25541] 10:12:37.711063 fcntl(7, F_GETFD) = 0
[pid 25541] 10:12:37.711096 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25541] 10:12:37.711128 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5385476, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25541] 10:12:37.711175 write(7, "2015-12-30 10:12:37 [25541] 1aEJMb-0006dx-Iz <= <> R=1aEJMY-0006cE-He U=mailnull P=local S=3788 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25541] 10:12:37.711218 close(6)    = 0
[pid 25541] 10:12:37.711256 munmap(0x7fa5f974d000, 4096) = 0
[pid 25541] 10:12:37.711294 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, 8) = 0
[pid 25541] 10:12:37.711336 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa5f734d6a0}, 8) = 0
[pid 25541] 10:12:37.711382 open("/proc/loadavg", O_RDONLY) = 6
[pid 25541] 10:12:37.711441 read(6, "0.18 0.08 0.01 7/258 25556\n", 40) = 27
[pid 25541] 10:12:37.711560 close(6)    = 0
[pid 25541] 10:12:37.711616 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa5f9737a90) = 25557
[pid 25541] 10:12:37.712120 exit_group(0) = ?
[pid 25541] 10:12:37.712415 +++ exited with 0 +++
[pid 25443] 10:12:37.712436 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25541
[pid 25443] 10:12:37.712462 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fdec36b86a0}, 8) = 0
[pid 25443] 10:12:37.712573 write(8, "2015-12-30 10:12:37 radissonphx-north@finestweddingsites.com: children all complete\n", 84) = 84
[pid 25443] 10:12:37.712625 open("/var/spool/exim/input/Y/hdr.25443", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25443] 10:12:37.712698 fchown(10, 47, 12) = 0
[pid 25443] 10:12:37.712738 fchmod(10, 0640) = 0
[pid 25443] 10:12:37.712775 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25443] 10:12:37.712815 fstat(10, {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25443] 10:12:37.712866 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdec5ab8000
[pid 25443] 10:12:37.712905 lseek(10, 0, SEEK_CUR) = 0
[pid 25443] 10:12:37.712954 write(10, "1aEJMY-0006cE-He-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491954 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 730) = 730
[pid 25443] 10:12:37.713006 fstat(10, {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=730, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25443] 10:12:37.713058 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMY-0006cE-He; Wed, 30 Dec 2015 10:12:34 -0600\n075T To:  rochelle.samms@radisson.com, radissonphx-north@finestwe"..., 558) = 558
[pid 25443] 10:12:37.713105 fsync(10Process 25555 attached
 <unfinished ...>
[pid 25553] 10:12:37.713203 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.713258 <... brk resumed> ) = 0x1d9a000
[pid 25555] 10:12:37.713663 set_robust_list(0x7fe585ec5aa0, 24 <unfinished ...>
[pid 25553] 10:12:37.713698 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.713728 read(8,  <unfinished ...>
[pid 25443] 10:12:37.713749 <... fsync resumed> ) = 0
[pid 25443] 10:12:37.713768 fstat(10, {st_dev=makedev(144, 4215), st_ino=124794952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1288, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25443] 10:12:37.713816 close(10)   = 0
[pid 25443] 10:12:37.713853 munmap(0x7fdec5ab8000, 4096) = 0
[pid 25443] 10:12:37.713898 rename("/var/spool/exim/input/Y/hdr.25443", "/var/spool/exim/input/Y/1aEJMY-0006cE-He-H") = 0
[pid 25443] 10:12:37.713991 open("/var/spool/exim/input/Y/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25443] 10:12:37.714036 fsync(10)   = 0
[pid 25443] 10:12:37.714071 close(10)   = 0
[pid 25443] 10:12:37.714110 unlink("/var/spool/exim/msglog/Y/1aEJMY-0006cE-He") = 0
[pid 25443] 10:12:37.714164 unlink("/var/spool/exim/input/Y/1aEJMY-0006cE-He-D") = 0
[pid 25443] 10:12:37.714213 unlink("/var/spool/exim/input/Y/1aEJMY-0006cE-He-H") = 0
[pid 25443] 10:12:37.714282 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.714345 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25443] 10:12:37.714399 close(7)    = 0
[pid 25443] 10:12:37.714439 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25443] 10:12:37.714550 fcntl(7, F_GETFD) = 0
[pid 25443] 10:12:37.714590 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25443] 10:12:37.714637 fstat(7, Process 25554 attached
{st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5385680, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25555] 10:12:37.714829 <... set_robust_list resumed> ) = 0
[pid 25553] 10:12:37.714845 fstat(9,  <unfinished ...>
[pid 25545] 10:12:37.714865 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25443] 10:12:37.714886 write(7, "2015-12-30 10:12:37 [25443] 1aEJMY-0006cE-He Completed QT=3s\n", 61) = 61
[pid 25443] 10:12:37.714930 close(8)    = 0
[pid 25443] 10:12:37.714980 munmap(0x7fdec5ab9000, 4096) = 0
[pid 25443] 10:12:37.715021 close(9)    = 0
[pid 25443] 10:12:37.715060 unlink("/var/spool/exim/input/Y/1aEJMY-0006cE-He-J") = 0
[pid 25443] 10:12:37.715135 close(6)    = 0
[pid 25443] 10:12:37.715348 exit_group(0) = ?
[pid 25491] 10:12:37.716002 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25443] 10:12:37.716034 +++ exited with 0 +++
[pid 25491] 10:12:37.716051 recvfrom(16, ";t\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1\300\f\0\1\0\1\0\0\250\300\0\4\320A\221\3\300\f\0\1\0\1\0\0\250\300\0\4\320A\220\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 85
[pid 25491] 10:12:37.716104 close(16)   = 0
[pid 25491] 10:12:37.716198 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25491] 10:12:37.716708 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16Process 25556 attached
 <unfinished ...>
[pid 25555] 10:12:37.716795 close(9 <unfinished ...>
[pid 25554] 10:12:37.716828 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25553] 10:12:37.716853 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25545] 10:12:37.716882 read(8,  <unfinished ...>
[pid 25491] 10:12:37.716908 <... connect resumed> ) = 0
[pid 25556] 10:12:37.716935 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25555] 10:12:37.716959 <... close resumed> ) = 0
[pid 25554] 10:12:37.716973 <... set_robust_list resumed> ) = 0
[pid 25553] 10:12:37.716995 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.717080 <... read resumed> "", 8192) = 0
[pid 25491] 10:12:37.717095 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25556] 10:12:37.717137 <... set_robust_list resumed> ) = 0
[pid 25555] 10:12:37.717151 geteuid( <unfinished ...>
[pid 25554] 10:12:37.717244 close(9 <unfinished ...>
[pid 25553] 10:12:37.717267 <... mmap resumed> ) = 0x7f21d336d000
[pid 25545] 10:12:37.717281 close(8 <unfinished ...>
[pid 25491] 10:12:37.717307 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25556] 10:12:37.717335 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25555] 10:12:37.717362 <... geteuid resumed> ) = 0
[pid 25554] 10:12:37.717375 <... close resumed> ) = 0
[pid 25553] 10:12:37.717390 read(9,  <unfinished ...>
[pid 25545] 10:12:37.717435 <... close resumed> ) = 0
[pid 25491] 10:12:37.717450 sendto(16, "o\303\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1", 55, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25556] 10:12:37.717547 <... setrlimit resumed> ) = 0
[pid 25555] 10:12:37.717563 getegid( <unfinished ...>
[pid 25554] 10:12:37.717727 geteuid( <unfinished ...>
[pid 25553] 10:12:37.717752 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25545] 10:12:37.717771 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25491] 10:12:37.717802 <... sendto resumed> ) = 55
[pid 25556] 10:12:37.717829 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25555] 10:12:37.717858 <... getegid resumed> ) = 12
[pid 25554] 10:12:37.717872 <... geteuid resumed> ) = 0
[pid 25553] 10:12:37.717894 read(9,  <unfinished ...>
[pid 25545] 10:12:37.717923 <... stat resumed> 0x7f6d1422d880) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.717940 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25556] 10:12:37.717981 <... open resumed> ) = 10
[pid 25555] 10:12:37.717995 setgid(494 <unfinished ...>
[pid 25554] 10:12:37.718027 getegid( <unfinished ...>
[pid 25553] 10:12:37.718050 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25545] 10:12:37.718074 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25556] 10:12:37.718112 fstat(10,  <unfinished ...>
[pid 25555] 10:12:37.718134 <... setgid resumed> ) = 0
[pid 25554] 10:12:37.718147 <... getegid resumed> ) = 12
[pid 25553] 10:12:37.718163 close(9 <unfinished ...>
[pid 25556] 10:12:37.718199 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25555] 10:12:37.718227 setuid(495 <unfinished ...>
[pid 25554] 10:12:37.718266 setgid(494 <unfinished ...>
[pid 25545] 10:12:37.718290 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25556] 10:12:37.718328 fstat(10,  <unfinished ...>
[pid 25555] 10:12:37.718354 <... setuid resumed> ) = 0
[pid 25554] 10:12:37.718368 <... setgid resumed> ) = 0
[pid 25553] 10:12:37.718403 <... close resumed> ) = 0
[pid 25545] 10:12:37.718420 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25556] 10:12:37.718457 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25555] 10:12:37.718612 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25554] 10:12:37.718658 setuid(495 <unfinished ...>
[pid 25553] 10:12:37.718682 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25545] 10:12:37.718709 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25556] 10:12:37.718748 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25555] 10:12:37.718783 <... open resumed> ) = 9
[pid 25554] 10:12:37.718801 <... setuid resumed> ) = 0
[pid 25553] 10:12:37.718824 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.718860 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.719294 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25555] 10:12:37.719310 fstat(9,  <unfinished ...>
[pid 25554] 10:12:37.719337 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25553] 10:12:37.719365 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.719388 <... open resumed> ) = 8
[pid 25556] 10:12:37.719415 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25555] 10:12:37.719438 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25554] 10:12:37.719467 <... open resumed> ) = 9
[pid 25553] 10:12:37.719586 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.719620 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25556] 10:12:37.719664 <... lseek resumed> ) = 0
[pid 25555] 10:12:37.719683 fstat(9,  <unfinished ...>
[pid 25554] 10:12:37.719716 fstat(9,  <unfinished ...>
[pid 25553] 10:12:37.719740 read(6,  <unfinished ...>
[pid 25545] 10:12:37.719763 <... ioctl resumed> , 0x7fffd44b2bc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25556] 10:12:37.719790 read(10,  <unfinished ...>
[pid 25555] 10:12:37.719817 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25554] 10:12:37.719851 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25553] 10:12:37.719880 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2376) = 1858
[pid 25545] 10:12:37.719939 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25556] 10:12:37.720428 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25555] 10:12:37.720449 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25554] 10:12:37.720587 fstat(9,  <unfinished ...>
[pid 25553] 10:12:37.720621 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.720662 <... lseek resumed> ) = 0
[pid 25556] 10:12:37.720719 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25555] 10:12:37.720756 <... mmap resumed> ) = 0x7fe585edb000
[pid 25554] 10:12:37.720770 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25553] 10:12:37.720799 <... write resumed> ) = 4
[pid 25545] 10:12:37.720817 read(8,  <unfinished ...>
[pid 25529] 10:12:37.720845 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25556] 10:12:37.720873 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25555] 10:12:37.720899 read(9,  <unfinished ...>
[pid 25554] 10:12:37.720957 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25553] 10:12:37.720985 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.721010 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25529] 10:12:37.721441 read(17,  <unfinished ...>
[pid 25556] 10:12:37.721567 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25555] 10:12:37.721607 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25554] 10:12:37.721635 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25553] 10:12:37.721653 <... write resumed> ) = 4
[pid 25545] 10:12:37.721675 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.721710 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25556] 10:12:37.721738 <... open resumed> ) = 13
[pid 25555] 10:12:37.721752 read(9,  <unfinished ...>
[pid 25554] 10:12:37.721782 read(9,  <unfinished ...>
[pid 25553] 10:12:37.721811 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.721836 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.721855 read(17,  <unfinished ...>
[pid 25556] 10:12:37.721887 fstat(13,  <unfinished ...>
[pid 25555] 10:12:37.721915 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25554] 10:12:37.721933 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25553] 10:12:37.721955 <... write resumed> ) = 4
[pid 25545] 10:12:37.721972 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.722000 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25556] 10:12:37.722028 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25555] 10:12:37.722058 close(9 <unfinished ...>
[pid 25554] 10:12:37.722088 read(9,  <unfinished ...>
[pid 25553] 10:12:37.722115 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25545] 10:12:37.722140 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.722162 read(17,  <unfinished ...>
[pid 25556] 10:12:37.722197 fstat(13,  <unfinished ...>
[pid 25555] 10:12:37.722219 <... close resumed> ) = 0
[pid 25554] 10:12:37.722232 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25553] 10:12:37.722252 <... write resumed> ) = 40
[pid 25545] 10:12:37.722270 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.722303 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25556] 10:12:37.722330 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25555] 10:12:37.722356 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25554] 10:12:37.722385 close(9 <unfinished ...>
[pid 25553] 10:12:37.722409 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.722433 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.722451 read(17,  <unfinished ...>
[pid 25556] 10:12:37.722488 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25555] 10:12:37.722515 <... munmap resumed> ) = 0
[pid 25554] 10:12:37.722529 <... close resumed> ) = 0
[pid 25553] 10:12:37.722587 <... write resumed> ) = 4
[pid 25545] 10:12:37.722606 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.722650 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25556] 10:12:37.722682 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25555] 10:12:37.722701 brk(0x2053000 <unfinished ...>
[pid 25554] 10:12:37.722729 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25553] 10:12:37.722754 close(18 <unfinished ...>
[pid 25545] 10:12:37.722778 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.722799 wait4(-1,  <unfinished ...>
[pid 25556] 10:12:37.722831 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25555] 10:12:37.722853 <... brk resumed> ) = 0x2053000
[pid 25554] 10:12:37.722867 <... munmap resumed> ) = 0
[pid 25553] 10:12:37.723084 <... close resumed> ) = 0
[pid 25545] 10:12:37.723149 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25556] 10:12:37.723218 <... lseek resumed> ) = 0
[pid 25555] 10:12:37.723232 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25554] 10:12:37.723266 brk(0x1f48000 <unfinished ...>
[pid 25553] 10:12:37.723290 exit_group(0) = ?
[pid 25545] 10:12:37.723304 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.723664 read(13,  <unfinished ...>
[pid 25555] 10:12:37.723704 <... write resumed> ) = 4
[pid 25554] 10:12:37.723719 <... brk resumed> ) = 0x1f48000
[pid 25553] 10:12:37.723734 +++ exited with 0 +++
[pid 25545] 10:12:37.723899 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.723939 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25529] 10:12:37.723960 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25553
[pid 25556] 10:12:37.723988 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25555] 10:12:37.724007 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25554] 10:12:37.724066 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25545] 10:12:37.724091 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.724113 read(9,  <unfinished ...>
[pid 25529] 10:12:37.724138 close(17 <unfinished ...>
[pid 25556] 10:12:37.724174 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25555] 10:12:37.724202 <... write resumed> ) = 4
[pid 25554] 10:12:37.724216 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.724231 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.724270 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25529] 10:12:37.724288 <... close resumed> ) = 0
[pid 25556] 10:12:37.724314 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25555] 10:12:37.724330 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25554] 10:12:37.724355 read(6,  <unfinished ...>
[pid 25545] 10:12:37.724378 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.724396 read(9,  <unfinished ...>
[pid 25529] 10:12:37.724419 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25556] 10:12:37.724454 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25555] 10:12:37.724483 <... write resumed> ) = 4
[pid 25554] 10:12:37.724499 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2369) = 1858
[pid 25545] 10:12:37.724520 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.724798 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.724820 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25556] 10:12:37.724870 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25555] 10:12:37.724889 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25554] 10:12:37.724916 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.724948 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.724969 read(9,  <unfinished ...>
[pid 25529] 10:12:37.724994 stat("/etc/userdomains",  <unfinished ...>
[pid 25556] 10:12:37.725031 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0},  <unfinished ...>
[pid 25555] 10:12:37.725057 <... write resumed> ) = 4
[pid 25554] 10:12:37.725070 <... write resumed> ) = 4
[pid 25545] 10:12:37.725091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25544] 10:12:37.725127 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25543] 10:12:37.725146 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25529] 10:12:37.725164 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25556] 10:12:37.725218 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f2e3f9ca790}, 8) = 0
[pid 25555] 10:12:37.725239 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25554] 10:12:37.725267 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.725291 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.725309 read(9,  <unfinished ...>
[pid 25543] 10:12:37.725332 read(9,  <unfinished ...>
[pid 25529] 10:12:37.725355 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.725395 close(11 <unfinished ...>
[pid 25555] 10:12:37.725419 <... write resumed> ) = 4
[pid 25554] 10:12:37.725433 <... write resumed> ) = 4
[pid 25545] 10:12:37.725449 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25544] 10:12:37.725609 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25543] 10:12:37.725641 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.725666 <... open resumed> ) = 9
[pid 25556] 10:12:37.725698 <... close resumed> ) = 0
[pid 25555] 10:12:37.725713 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25554] 10:12:37.725741 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.725765 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.725786 read(9,  <unfinished ...>
[pid 25543] 10:12:37.725810 read(9,  <unfinished ...>
[pid 25529] 10:12:37.725836 fstat(9,  <unfinished ...>
[pid 25556] 10:12:37.725870 fcntl(12, F_GETFD <unfinished ...>
[pid 25555] 10:12:37.725892 <... write resumed> ) = 40
[pid 25554] 10:12:37.725905 <... write resumed> ) = 4
[pid 25545] 10:12:37.725921 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25544] 10:12:37.725953 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25543] 10:12:37.725971 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25529] 10:12:37.725989 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25556] 10:12:37.726033 <... fcntl resumed> ) = 0
[pid 25555] 10:12:37.726048 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25554] 10:12:37.726074 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25545] 10:12:37.726097 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.726115 read(9,  <unfinished ...>
[pid 25543] 10:12:37.726137 read(9,  <unfinished ...>
[pid 25529] 10:12:37.726160 fstat(9,  <unfinished ...>
[pid 25556] 10:12:37.726193 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25555] 10:12:37.726216 <... write resumed> ) = 4
[pid 25554] 10:12:37.726229 <... write resumed> ) = 4
[pid 25545] 10:12:37.726244 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25544] 10:12:37.726277 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25543] 10:12:37.726294 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.726313 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25556] 10:12:37.726358 <... fcntl resumed> ) = 0
[pid 25555] 10:12:37.726373 close(10 <unfinished ...>
[pid 25554] 10:12:37.726414 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.726440 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.726469 read(9,  <unfinished ...>
[pid 25543] 10:12:37.726499 wait4(-1,  <unfinished ...>
[pid 25529] 10:12:37.726522 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25556] 10:12:37.726558 geteuid( <unfinished ...>
[pid 25555] 10:12:37.726580 <... close resumed> ) = 0
[pid 25554] 10:12:37.726593 <... write resumed> ) = 4
[pid 25545] 10:12:37.726622 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.726666 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25529] 10:12:37.726691 <... mmap resumed> ) = 0x7f21d336d000
[pid 25556] 10:12:37.726722 <... geteuid resumed> ) = 0
[pid 25555] 10:12:37.726738 exit_group(0) = ?
[pid 25554] 10:12:37.726754 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25545] 10:12:37.726982 <... open resumed> ) = 9
[pid 25544] 10:12:37.727002 read(9,  <unfinished ...>
[pid 25529] 10:12:37.727029 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25556] 10:12:37.727073 getegid( <unfinished ...>
[pid 25555] 10:12:37.727094 +++ exited with 0 +++
[pid 25554] 10:12:37.727106 <... write resumed> ) = 40
[pid 25545] 10:12:37.727120 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:37.727146 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25543] 10:12:37.727165 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25555
[pid 25529] 10:12:37.727183 <... lseek resumed> ) = 0
[pid 25556] 10:12:37.727209 <... getegid resumed> ) = 12
[pid 25554] 10:12:37.727223 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.727252 <... ioctl resumed> , 0x7fffd44b25d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:37.727271 read(9,  <unfinished ...>
[pid 25543] 10:12:37.727294 close(9 <unfinished ...>
[pid 25529] 10:12:37.727322 read(9,  <unfinished ...>
[pid 25556] 10:12:37.727359 setgid(500 <unfinished ...>
[pid 25554] 10:12:37.727381 <... write resumed> ) = 4
[pid 25545] 10:12:37.727395 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.727423 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25543] 10:12:37.727445 <... close resumed> ) = 0
[pid 25529] 10:12:37.727462 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25556] 10:12:37.727636 <... setgid resumed> ) = 0
[pid 25554] 10:12:37.727667 close(10 <unfinished ...>
[pid 25545] 10:12:37.727697 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.727726 wait4(-1,  <unfinished ...>
[pid 25543] 10:12:37.727752 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25529] 10:12:37.727781 stat("/etc/userdomains",  <unfinished ...>
[pid 25556] 10:12:37.727816 setuid(503 <unfinished ...>
[pid 25554] 10:12:37.727838 <... close resumed> ) = 0
[pid 25545] 10:12:37.727852 brk(0x1dbb000 <unfinished ...>
[pid 25543] 10:12:37.727887 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0}, 8) = 0
[pid 25529] 10:12:37.727923 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25556] 10:12:37.727980 <... setuid resumed> ) = 0
[pid 25554] 10:12:37.727997 exit_group(0) = ?
[pid 25545] 10:12:37.728012 <... brk resumed> ) = 0x1dbb000
[pid 25543] 10:12:37.728242 brk(0x2052000 <unfinished ...>
[pid 25529] 10:12:37.728271 stat("/etc/userdomains",  <unfinished ...>
[pid 25556] 10:12:37.728316 chdir("/" <unfinished ...>
[pid 25554] 10:12:37.728340 +++ exited with 0 +++
[pid 25545] 10:12:37.728352 read(9,  <unfinished ...>
[pid 25544] 10:12:37.728377 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25554
[pid 25543] 10:12:37.728396 <... brk resumed> ) = 0x2052000
[pid 25529] 10:12:37.728421 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25556] 10:12:37.728494 <... chdir resumed> ) = 0
[pid 25545] 10:12:37.728514 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25544] 10:12:37.728868 close(9 <unfinished ...>
[pid 25543] 10:12:37.728905 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25529] 10:12:37.728945 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25556] 10:12:37.728984 geteuid( <unfinished ...>
[pid 25545] 10:12:37.729006 read(9,  <unfinished ...>
[pid 25544] 10:12:37.729031 <... close resumed> ) = 0
[pid 25543] 10:12:37.729048 <... open resumed> ) = 9
[pid 25529] 10:12:37.729068 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.729101 <... geteuid resumed> ) = 503
[pid 25545] 10:12:37.729124 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25544] 10:12:37.729946 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.729994 alarm(60 <unfinished ...>
[pid 25529] 10:12:37.730020 stat("/etc/valiases/finestweddingsites.com", Process 25557 attached
 <unfinished ...>
[pid 25556] 10:12:37.730083 getegid( <unfinished ...>
[pid 25545] 10:12:37.730107 read(9,  <unfinished ...>
[pid 25544] 10:12:37.730131 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25543] 10:12:37.730170 <... alarm resumed> ) = 0
[pid 25529] 10:12:37.730189 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.730242 set_robust_list(0x7fa5f9737aa0, 24 <unfinished ...>
[pid 25556] 10:12:37.730268 <... getegid resumed> ) = 500
[pid 25545] 10:12:37.730282 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25544] 10:12:37.730401 brk(0x1f47000 <unfinished ...>
[pid 25543] 10:12:37.730436 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25529] 10:12:37.730468 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.730578 <... set_robust_list resumed> ) = 0
[pid 25556] 10:12:37.730593 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25545] 10:12:37.730674 brk(0x1ddc000 <unfinished ...>
[pid 25544] 10:12:37.730706 <... brk resumed> ) = 0x1f47000
[pid 25543] 10:12:37.730731 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.730749 <... open resumed> ) = 10
[pid 25557] 10:12:37.730775 close(0 <unfinished ...>
[pid 25556] 10:12:37.730801 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25545] 10:12:37.730830 <... brk resumed> ) = 0x1ddc000
[pid 25544] 10:12:37.731157 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25543] 10:12:37.731203 alarm(0 <unfinished ...>
[pid 25529] 10:12:37.731228 fstat(10,  <unfinished ...>
[pid 25557] 10:12:37.731262 <... close resumed> ) = 0
[pid 25556] 10:12:37.731275 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25545] 10:12:37.731304 read(9,  <unfinished ...>
[pid 25544] 10:12:37.731327 <... open resumed> ) = 9
[pid 25543] 10:12:37.731347 <... alarm resumed> ) = 60
[pid 25529] 10:12:37.731413 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.731460 close(1 <unfinished ...>
[pid 25556] 10:12:37.731488 <... chdir resumed> ) = 0
[pid 25545] 10:12:37.731504 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:37.731525 alarm(60 <unfinished ...>
[pid 25543] 10:12:37.731550 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.731585 fstat(10,  <unfinished ...>
[pid 25557] 10:12:37.731625 <... close resumed> ) = 0
[pid 25556] 10:12:37.731644 stat("tmp",  <unfinished ...>
[pid 25545] 10:12:37.731680 close(9 <unfinished ...>
[pid 25544] 10:12:37.731710 <... alarm resumed> ) = 0
[pid 25543] 10:12:37.731726 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.731744 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.731782 close(2 <unfinished ...>
[pid 25556] 10:12:37.731805 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.731830 <... close resumed> ) = 0
[pid 25544] 10:12:37.732649 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25543] 10:12:37.732704 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.732745 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.732784 <... close resumed> ) = 0
[pid 25556] 10:12:37.732798 stat("new",  <unfinished ...>
[pid 25545] 10:12:37.732879 read(8,  <unfinished ...>
[pid 25544] 10:12:37.732905 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.732922 <... open resumed> ) = 10
[pid 25529] 10:12:37.732939 <... mmap resumed> ) = 0x7f21d336c000
[pid 25557] 10:12:37.732965 setsid( <unfinished ...>
[pid 25556] 10:12:37.732988 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25545] 10:12:37.733016 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25544] 10:12:37.733043 alarm(0 <unfinished ...>
[pid 25543] 10:12:37.733795 read(10,  <unfinished ...>
[pid 25529] 10:12:37.733848 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.733882 <... setsid resumed> ) = 25557
[pid 25556] 10:12:37.733897 stat("cur",  <unfinished ...>
[pid 25545] 10:12:37.733930 read(8,  <unfinished ...>
[pid 25544] 10:12:37.733955 <... alarm resumed> ) = 60
[pid 25543] 10:12:37.734009 <... read resumed> "cpu  123092 1342469 395269 67343100 2509 0 0 0\ncpu0 123092 1342469 395269 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58581005\nbtime 1450798266\nprocesses 893035\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25529] 10:12:37.734035 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.734062 fstat(0,  <unfinished ...>
[pid 25556] 10:12:37.734084 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25545] 10:12:37.734112 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25544] 10:12:37.734192 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.735024 close(10 <unfinished ...>
[pid 25529] 10:12:37.735058 read(10,  <unfinished ...>
[pid 25557] 10:12:37.735097 <... fstat resumed> 0x7ffea6d13d30) = -1 EBADF (Bad file descriptor)
[pid 25556] 10:12:37.735114 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25545] 10:12:37.735154 read(8,  <unfinished ...>
[pid 25544] 10:12:37.735180 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.735198 <... close resumed> ) = 0
[pid 25529] 10:12:37.735269 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25557] 10:12:37.735308 open("/dev/null", O_RDWR <unfinished ...>
[pid 25556] 10:12:37.735342 <... open resumed> ) = 11
[pid 25545] 10:12:37.735356 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25544] 10:12:37.735378 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.735993 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25529] 10:12:37.736028 read(10,  <unfinished ...>
[pid 25557] 10:12:37.736063 <... open resumed> ) = 0
[pid 25556] 10:12:37.736077 read(11,  <unfinished ...>
[pid 25545] 10:12:37.736105 read(8,  <unfinished ...>
[pid 25544] 10:12:37.736129 <... open resumed> ) = 10
[pid 25543] 10:12:37.736146 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.736185 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.736234 fstat(1,  <unfinished ...>
[pid 25556] 10:12:37.736260 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4137
[pid 25545] 10:12:37.736279 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25544] 10:12:37.736430 read(10,  <unfinished ...>
[pid 25543] 10:12:37.736754 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.736789 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.736828 <... fstat resumed> 0x7ffea6d13d30) = -1 EBADF (Bad file descriptor)
[pid 25556] 10:12:37.736845 stat("tmp/1451491957.H736417P25556.fin.finestweddingsites.com",  <unfinished ...>
[pid 25545] 10:12:37.736887 brk(0x1dfd000 <unfinished ...>
[pid 25544] 10:12:37.736911 <... read resumed> "cpu  123092 1342469 395269 67343100 2509 0 0 0\ncpu0 123092 1342469 395269 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58581166\nbtime 1450798266\nprocesses 893035\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25543] 10:12:37.736934 <... open resumed> ) = 10
[pid 25529] 10:12:37.736952 <... open resumed> ) = 11
[pid 25557] 10:12:37.736981 dup2(0, 1 <unfinished ...>
[pid 25556] 10:12:37.737005 <... stat resumed> 0x7ffd5c5be100) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.737020 <... brk resumed> ) = 0x1dfd000
[pid 25544] 10:12:37.737037 close(10 <unfinished ...>
[pid 25543] 10:12:37.737539 fcntl(10, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.737571 fstat(11,  <unfinished ...>
[pid 25557] 10:12:37.737604 <... dup2 resumed> ) = 1
[pid 25556] 10:12:37.737618 open("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25545] 10:12:37.737680 read(8,  <unfinished ...>
[pid 25544] 10:12:37.737708 <... close resumed> ) = 0
[pid 25543] 10:12:37.737764 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.737783 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25557] 10:12:37.737824 fstat(2,  <unfinished ...>
[pid 25556] 10:12:37.737846 <... open resumed> ) = 14
[pid 25545] 10:12:37.737859 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25544] 10:12:37.737885 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25543] 10:12:37.738761 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.738791 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.738830 <... fstat resumed> 0x7ffea6d13d30) = -1 EBADF (Bad file descriptor)
[pid 25556] 10:12:37.738847 chown("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25545] 10:12:37.738882 brk(0x1e1e000 <unfinished ...>
[pid 25544] 10:12:37.738906 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25543] 10:12:37.738945 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.738969 <... mmap resumed> ) = 0x7f21d336b000
[pid 25557] 10:12:37.738996 dup2(0, 2 <unfinished ...>
[pid 25556] 10:12:37.739019 <... chown resumed> ) = 0
[pid 25545] 10:12:37.739032 <... brk resumed> ) = 0x1e1e000
[pid 25544] 10:12:37.739052 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.739228 read(10,  <unfinished ...>
[pid 25529] 10:12:37.739255 read(11,  <unfinished ...>
[pid 25557] 10:12:37.739292 <... dup2 resumed> ) = 2
[pid 25556] 10:12:37.739306 chmod("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25545] 10:12:37.739343 read(8,  <unfinished ...>
[pid 25544] 10:12:37.739368 <... open resumed> ) = 10
[pid 25543] 10:12:37.739387 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25529] 10:12:37.739425 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25557] 10:12:37.739470 geteuid( <unfinished ...>
[pid 25556] 10:12:37.739568 <... chmod resumed> ) = 0
[pid 25545] 10:12:37.739584 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25544] 10:12:37.739605 fcntl(10, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.740124 close(10 <unfinished ...>
[pid 25529] 10:12:37.740153 close(11 <unfinished ...>
[pid 25557] 10:12:37.740188 <... geteuid resumed> ) = 47
[pid 25556] 10:12:37.740202 chown("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25545] 10:12:37.740244 read(8,  <unfinished ...>
[pid 25544] 10:12:37.740270 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.740286 <... close resumed> ) = 0
[pid 25529] 10:12:37.740318 <... close resumed> ) = 0
[pid 25557] 10:12:37.740345 fstat(0,  <unfinished ...>
[pid 25556] 10:12:37.740377 <... chown resumed> ) = 0
[pid 25545] 10:12:37.740397 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25544] 10:12:37.740959 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.740997 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.741028 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25557] 10:12:37.741069 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25556] 10:12:37.741098 chmod("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25545] 10:12:37.741129 brk(0x1e3f000 <unfinished ...>
[pid 25544] 10:12:37.741153 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.741175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.741197 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.741241 fstat(1,  <unfinished ...>
[pid 25556] 10:12:37.741269 <... chmod resumed> ) = 0
[pid 25545] 10:12:37.741282 <... brk resumed> ) = 0x1e3f000
[pid 25544] 10:12:37.741328 read(10,  <unfinished ...>
[pid 25543] 10:12:37.741544 stat("/var/tmp",  <unfinished ...>
[pid 25529] 10:12:37.741585 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.741622 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25556] 10:12:37.741650 stat("/etc/localtime",  <unfinished ...>
[pid 25545] 10:12:37.741684 read(8,  <unfinished ...>
[pid 25544] 10:12:37.741708 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25543] 10:12:37.741742 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25529] 10:12:37.741821 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.741881 fstat(2,  <unfinished ...>
[pid 25556] 10:12:37.741906 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25545] 10:12:37.741933 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25544] 10:12:37.741984 close(10 <unfinished ...>
[pid 25543] 10:12:37.742465 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.742571 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25557] 10:12:37.742814 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25556] 10:12:37.742853 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.742888 <... close resumed> ) = 0
[pid 25543] 10:12:37.742920 <... mmap resumed> ) = 0x7fe585e94000
[pid 25529] 10:12:37.743062 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25557] 10:12:37.743120 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMb-0006dx-Iz"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25556] 10:12:37.743855 <... lseek resumed> ) = 19
[pid 25545] 10:12:37.743881 read(8,  <unfinished ...>
[pid 25544] 10:12:37.743906 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.743935 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.743965 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25556] 10:12:37.744004 read(6,  <unfinished ...>
[pid 25544] 10:12:37.744032 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.744055 <... open resumed> ) = 10
[pid 25529] 10:12:37.744072 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.744139 <... execve resumed> ) = 0
[pid 25556] 10:12:37.744162 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25544] 10:12:37.744201 stat("/var/tmp",  <unfinished ...>
[pid 25543] 10:12:37.744242 fcntl(10, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.744265 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.744304 brk(0 <unfinished ...>
[pid 25556] 10:12:37.744328 read(6,  <unfinished ...>
[pid 25545] 10:12:37.744350 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25544] 10:12:37.744374 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25543] 10:12:37.744975 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.745006 <... open resumed> ) = 11
[pid 25557] 10:12:37.745035 <... brk resumed> ) = 0x2541000
[pid 25556] 10:12:37.745050 <... read resumed> "", 8192) = 0
[pid 25545] 10:12:37.745069 brk(0x1e60000 <unfinished ...>
[pid 25544] 10:12:37.745092 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.745121 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.745145 fstat(11,  <unfinished ...>
[pid 25557] 10:12:37.745176 fcntl(0, F_GETFD <unfinished ...>
[pid 25556] 10:12:37.745199 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2509 <unfinished ...>
[pid 25544] 10:12:37.745240 <... mmap resumed> ) = 0x7fa692bd8000
[pid 25543] 10:12:37.745366 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.745391 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.745434 <... fcntl resumed> ) = 0
[pid 25556] 10:12:37.745448 <... write resumed> ) = 2509
[pid 25544] 10:12:37.745463 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.745504 fstat(10,  <unfinished ...>
[pid 25529] 10:12:37.745528 fstat(11,  <unfinished ...>
[pid 25557] 10:12:37.745558 fcntl(1, F_GETFD <unfinished ...>
[pid 25556] 10:12:37.745580 fsync(14 <unfinished ...>
[pid 25544] 10:12:37.745649 <... open resumed> ) = 10
[pid 25543] 10:12:37.745671 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25529] 10:12:37.745743 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.745861 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.745875 fcntl(10, F_GETFD <unfinished ...>
[pid 25543] 10:12:37.745900 pread(10,  <unfinished ...>
[pid 25529] 10:12:37.745925 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.745958 fcntl(2, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.745980 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.745996 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25529] 10:12:37.746068 <... mmap resumed> ) = 0x7f21d336b000
[pid 25557] 10:12:37.746099 <... fcntl resumed> ) = 0
[pid 25556] 10:12:37.746113 <... fsync resumed> ) = 0
[pid 25544] 10:12:37.746133 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.746162 pread(10,  <unfinished ...>
[pid 25529] 10:12:37.746186 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.746217 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25556] 10:12:37.746245 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25544] 10:12:37.746267 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.746287 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25529] 10:12:37.746334 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.746369 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.746391 <... lseek resumed> ) = 4137
[pid 25544] 10:12:37.746427 fstat(10,  <unfinished ...>
[pid 25543] 10:12:37.746460 close(10 <unfinished ...>
[pid 25529] 10:12:37.746599 read(11,  <unfinished ...>
[pid 25557] 10:12:37.746645 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25556] 10:12:37.746676 write(11, "2509 1\n", 7 <unfinished ...>
[pid 25544] 10:12:37.746707 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25543] 10:12:37.746765 <... close resumed> ) = 0
[pid 25529] 10:12:37.746808 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25557] 10:12:37.746867 <... mmap resumed> ) = 0x7fc7a8f42000
[pid 25556] 10:12:37.746885 <... write resumed> ) = 7
[pid 25545] 10:12:37.746914 <... brk resumed> ) = 0x1e60000
[pid 25544] 10:12:37.746932 pread(10,  <unfinished ...>
[pid 25543] 10:12:37.747282 munmap(0x7fe585e94000, 200704 <unfinished ...>
[pid 25529] 10:12:37.747330 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.747369 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25556] 10:12:37.747398 close(11 <unfinished ...>
[pid 25545] 10:12:37.747423 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.747447 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25543] 10:12:37.747576 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.747617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.747668 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.747685 <... close resumed> ) = 0
[pid 25544] 10:12:37.747711 pread(10,  <unfinished ...>
[pid 25543] 10:12:37.747746 close(9 <unfinished ...>
[pid 25529] 10:12:37.747774 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25557] 10:12:37.747813 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.747843 fstat(14,  <unfinished ...>
[pid 25544] 10:12:37.747865 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25543] 10:12:37.747905 <... close resumed> ) = 0
[pid 25529] 10:12:37.747944 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25557] 10:12:37.747998 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.748016 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179984, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2509, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.748053 pread(10,  <unfinished ...>
[pid 25543] 10:12:37.748079 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.748109 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25557] 10:12:37.748145 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25556] 10:12:37.748171 close(14 <unfinished ...>
[pid 25544] 10:12:37.748197 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25543] 10:12:37.748244 <... open resumed> ) = 9
[pid 25529] 10:12:37.748266 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.748336 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.748354 <... close resumed> ) = 0
[pid 25545] 10:12:37.748395 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.748417 close(10 <unfinished ...>
[pid 25543] 10:12:37.748454 fstat(9,  <unfinished ...>
[pid 25529] 10:12:37.748573 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25557] 10:12:37.748618 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.748646 rename("tmp/1451491957.H736417P25556.fin.finestweddingsites.com", "new/1451491957.H736417P25556.fin.finestweddingsites.com,S=2509" <unfinished ...>
[pid 25545] 10:12:37.748710 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.748738 <... close resumed> ) = 0
[pid 25543] 10:12:37.748774 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.748813 <... stat resumed> 0x7ffce2cff810) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.748900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.748922 <... rename resumed> ) = 0
[pid 25545] 10:12:37.748943 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.748958 munmap(0x7fa692bd8000, 200704 <unfinished ...>
[pid 25543] 10:12:37.749004 fstat(9,  <unfinished ...>
[pid 25529] 10:12:37.749028 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.749063 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25556] 10:12:37.749088 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.749120 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.749145 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.749172 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.749203 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.749263 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.749281 <... write resumed> ) = 4
[pid 25545] 10:12:37.749299 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.749314 close(9 <unfinished ...>
[pid 25543] 10:12:37.749344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.749378 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.749414 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.749447 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.749551 write(12, "\315\t\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.749581 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.749606 <... close resumed> ) = 0
[pid 25543] 10:12:37.749639 <... mmap resumed> ) = 0x7fe585edb000
[pid 25529] 10:12:37.749660 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.749719 read(11,  <unfinished ...>
[pid 25557] 10:12:37.749762 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.749777 <... write resumed> ) = 4
[pid 25545] 10:12:37.749795 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.749809 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.749843 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.749867 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.749893 <... read resumed> "\315\t\0\0", 4) = 4
[pid 25557] 10:12:37.749920 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25556] 10:12:37.749947 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.749971 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.749996 <... open resumed> ) = 9
[pid 25543] 10:12:37.750015 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.750033 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.750074 read(11,  <unfinished ...>
[pid 25557] 10:12:37.750110 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.750125 <... write resumed> ) = 4
[pid 25545] 10:12:37.750143 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.750157 fstat(9,  <unfinished ...>
[pid 25543] 10:12:37.750182 read(9,  <unfinished ...>
[pid 25529] 10:12:37.750208 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25522] 10:12:37.750235 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25557] 10:12:37.750263 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.750291 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.750316 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.750341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.750375 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25529] 10:12:37.750421 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25522] 10:12:37.750468 read(11,  <unfinished ...>
[pid 25557] 10:12:37.750512 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.750527 <... write resumed> ) = 4
[pid 25545] 10:12:37.750545 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.750559 fstat(9,  <unfinished ...>
[pid 25543] 10:12:37.750588 stat("/jail_owner",  <unfinished ...>
[pid 25529] 10:12:37.750615 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.750644 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.750672 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25556] 10:12:37.750698 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.750723 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.750757 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.750786 <... stat resumed> 0x7ffcdc244e30) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.750810 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.750854 read(11,  <unfinished ...>
[pid 25557] 10:12:37.750891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25556] 10:12:37.750916 <... write resumed> ) = 4
[pid 25545] 10:12:37.750934 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.750949 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.750978 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25529] 10:12:37.751009 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.751032 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.751060 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.751095 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.751119 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.751146 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.751156 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.751184 <... lseek resumed> ) = 2781
[pid 25522] 10:12:37.751211 read(11,  <unfinished ...>
[pid 25557] 10:12:37.751233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.751239 <... write resumed> ) = 4
[pid 25545] 10:12:37.751249 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.751255 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.751268 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25529] 10:12:37.751284 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.751296 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.751315 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25556] 10:12:37.751323 write(12, "\2603p\1\0\0\0\0", 8 <unfinished ...>
[pid 25545] 10:12:37.751338 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.751345 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.751366 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.751385 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.751413 read(11,  <unfinished ...>
[pid 25557] 10:12:37.751440 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.751446 <... write resumed> ) = 8
[pid 25545] 10:12:37.751457 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.751466 read(9,  <unfinished ...>
[pid 25543] 10:12:37.751690 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25529] 10:12:37.751724 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25522] 10:12:37.751751 <... read resumed> "\2603p\1\0\0\0\0", 8) = 8
[pid 25557] 10:12:37.751779 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.751810 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.751836 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.751863 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25543] 10:12:37.751908 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25529] 10:12:37.751946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.751986 read(11,  <unfinished ...>
[pid 25557] 10:12:37.752022 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.752037 <... write resumed> ) = 4
[pid 25545] 10:12:37.752054 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.752069 stat("/jail_owner",  <unfinished ...>
[pid 25543] 10:12:37.752099 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25529] 10:12:37.752128 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.752155 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.752183 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25556] 10:12:37.752212 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25545] 10:12:37.752236 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.752264 <... stat resumed> 0x7ffc5380b880) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.752288 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.752310 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.752370 read(11,  <unfinished ...>
[pid 25557] 10:12:37.752409 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.752424 <... write resumed> ) = 4
[pid 25545] 10:12:37.752441 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.752456 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25543] 10:12:37.752491 stat("/etc/demouids",  <unfinished ...>
[pid 25529] 10:12:37.752519 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25522] 10:12:37.752548 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25557] 10:12:37.752575 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.752607 close(12 <unfinished ...>
[pid 25545] 10:12:37.752631 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.752660 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25543] 10:12:37.752698 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.752745 <... stat resumed> 0x7ffce2cff810) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.752772 close(11 <unfinished ...>
[pid 25557] 10:12:37.752811 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.752825 <... close resumed> ) = 0
[pid 25545] 10:12:37.752845 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.752860 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25543] 10:12:37.752894 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.752922 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.752947 <... close resumed> ) = 0
[pid 25557] 10:12:37.752983 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25556] 10:12:37.753015 close(10 <unfinished ...>
[pid 25545] 10:12:37.753040 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25544] 10:12:37.753068 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.753092 <... open resumed> ) = 10
[pid 25529] 10:12:37.753110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.753149 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25557] 10:12:37.753180 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.753187 <... close resumed> ) = 0
[pid 25545] 10:12:37.753197 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.753203 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25543] 10:12:37.753218 fstat(10,  <unfinished ...>
[pid 25529] 10:12:37.753228 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25522] 10:12:37.753240 <... write resumed> ) = 28
[pid 25557] 10:12:37.753258 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.753266 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25545] 10:12:37.753288 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25544] 10:12:37.753296 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25543] 10:12:37.753326 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.753347 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25522] 10:12:37.753394 fsync(9 <unfinished ...>
[pid 25557] 10:12:37.753439 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.753448 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.753464 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.753680 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck",  <unfinished ...>
[pid 25543] 10:12:37.753718 fstat(10,  <unfinished ...>
[pid 25529] 10:12:37.753742 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.753782 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25556] 10:12:37.753810 close(13 <unfinished ...>
[pid 25545] 10:12:37.753836 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.753865 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.753888 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.753918 <... open resumed> ) = 12
[pid 25522] 10:12:37.753935 <... fsync resumed> ) = 0
[pid 25557] 10:12:37.753961 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25556] 10:12:37.753986 <... close resumed> ) = 0
[pid 25545] 10:12:37.754004 <... open resumed> ) = 9
[pid 25544] 10:12:37.754018 stat("/etc/demouids",  <unfinished ...>
[pid 25543] 10:12:37.754048 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.754075 fstat(12,  <unfinished ...>
[pid 25522] 10:12:37.754098 wait4(-1,  <unfinished ...>
[pid 25557] 10:12:37.754129 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25556] 10:12:37.754158 munmap(0x7f2e40b12000, 4096 <unfinished ...>
[pid 25545] 10:12:37.754185 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:37.754210 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.754256 <... mmap resumed> ) = 0x7fe585eda000
[pid 25529] 10:12:37.754277 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.754322 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.754338 <... munmap resumed> ) = 0
[pid 25545] 10:12:37.754716 <... ioctl resumed> , 0x7fffd44b25d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:37.754739 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.754770 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.754794 fstat(12,  <unfinished ...>
[pid 25557] 10:12:37.754826 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25556] 10:12:37.754854 exit_group(0) = ?
[pid 25545] 10:12:37.755169 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.755196 <... open resumed> ) = 10
[pid 25543] 10:12:37.755214 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.755231 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.755278 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25556] 10:12:37.755285 +++ exited with 0 +++
[pid 25545] 10:12:37.755289 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.755294 fstat(10,  <unfinished ...>
[pid 25543] 10:12:37.755334 read(10,  <unfinished ...>
[pid 25529] 10:12:37.755345 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.755358 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25556
[pid 25491] 10:12:37.755405 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25557] 10:12:37.755438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.755447 read(9,  <unfinished ...>
[pid 25544] 10:12:37.755456 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.755667 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.755699 <... mmap resumed> ) = 0x7f21d336a000
[pid 25522] 10:12:37.755718 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.755748 recvfrom(16,  <unfinished ...>
[pid 25557] 10:12:37.755787 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.755802 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25544] 10:12:37.755822 fstat(10,  <unfinished ...>
[pid 25543] 10:12:37.756053 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25529] 10:12:37.756086 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.756110 <... open resumed> ) = 10
[pid 25491] 10:12:37.756128 <... recvfrom resumed> "o\303\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1\300\f\0\1\0\1\0\0T_\0\4\320A\221\3\300\f\0\1\0\1\0\0T_\0\4\320A\220\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 87
[pid 25557] 10:12:37.756172 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25545] 10:12:37.756201 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.756223 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.756253 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:37.756331 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.756365 fstat(10,  <unfinished ...>
[pid 25491] 10:12:37.756428 close(16 <unfinished ...>
[pid 25557] 10:12:37.756554 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.756573 <... lseek resumed> ) = 878
[pid 25544] 10:12:37.756590 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.756620 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.756648 read(12,  <unfinished ...>
[pid 25522] 10:12:37.756675 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.756709 <... close resumed> ) = 0
[pid 25557] 10:12:37.756820 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.756858 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.756881 <... mmap resumed> ) = 0x7fa692c1e000
[pid 25543] 10:12:37.756899 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.756935 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25522] 10:12:37.756970 fstat(10,  <unfinished ...>
[pid 25491] 10:12:37.756996 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25557] 10:12:37.757035 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.757050 <... lseek resumed> ) = 878
[pid 25544] 10:12:37.757065 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.757091 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.757119 stat("/jail_owner",  <unfinished ...>
[pid 25522] 10:12:37.757144 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.757171 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25557] 10:12:37.757224 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25545] 10:12:37.757254 close(9 <unfinished ...>
[pid 25544] 10:12:37.757278 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.757295 <... open resumed> ) = 11
[pid 25529] 10:12:37.757312 <... stat resumed> 0x7ffce2d00dc0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.757336 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.757365 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.757405 <... stat resumed> 0x7ffc5dbb00a0) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.757419 <... close resumed> ) = 0
[pid 25544] 10:12:37.757435 read(10,  <unfinished ...>
[pid 25543] 10:12:37.757801 fstat(11,  <unfinished ...>
[pid 25529] 10:12:37.757830 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25522] 10:12:37.757860 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25491] 10:12:37.757877 <... open resumed> ) = 16
[pid 25557] 10:12:37.757908 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.757940 read(8,  <unfinished ...>
[pid 25544] 10:12:37.757972 <... read resumed> "", 4096) = 0
[pid 25543] 10:12:37.757998 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.758033 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.758069 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.758093 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:37.758128 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.758146 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25544] 10:12:37.758164 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25543] 10:12:37.758882 fstat(11,  <unfinished ...>
[pid 25529] 10:12:37.758910 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25522] 10:12:37.758942 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.758959 <... ioctl resumed> , 0x7ffc86159f70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:37.758991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25545] 10:12:37.759020 read(8,  <unfinished ...>
[pid 25544] 10:12:37.759044 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25543] 10:12:37.759185 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.759222 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.759248 read(10,  <unfinished ...>
[pid 25491] 10:12:37.759277 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:37.759312 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25545] 10:12:37.759343 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25544] 10:12:37.759361 getuid( <unfinished ...>
[pid 25543] 10:12:37.759508 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.759538 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25522] 10:12:37.759568 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:37.759618 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.759657 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.759700 brk(0x1e81000 <unfinished ...>
[pid 25544] 10:12:37.759732 <... getuid resumed> ) = 0
[pid 25543] 10:12:37.759752 <... mmap resumed> ) = 0x7fe585ed9000
[pid 25529] 10:12:37.759769 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25522] 10:12:37.759805 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.759835 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.759869 <... open resumed> ) = 6
[pid 25545] 10:12:37.759885 <... brk resumed> ) = 0x1e81000
[pid 25544] 10:12:37.759899 geteuid( <unfinished ...>
[pid 25543] 10:12:37.761011 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.761042 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25522] 10:12:37.761073 <... stat resumed> 0x7ffd5c5bce50) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.761101 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25557] 10:12:37.761148 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.761172 read(8,  <unfinished ...>
[pid 25544] 10:12:37.761198 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.761218 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.761236 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.761260 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:37.761287 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.761322 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25545] 10:12:37.761351 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25544] 10:12:37.761369 getgid( <unfinished ...>
[pid 25543] 10:12:37.761685 read(11,  <unfinished ...>
[pid 25529] 10:12:37.761717 stat("/etc/demouids",  <unfinished ...>
[pid 25522] 10:12:37.761745 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:37.761788 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.761829 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.761860 brk(0x1ea2000 <unfinished ...>
[pid 25544] 10:12:37.761884 <... getgid resumed> ) = 12
[pid 25543] 10:12:37.761903 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25529] 10:12:37.761952 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.762000 write(8, "2015-12-30 10:12:37 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25491] 10:12:37.762035 read(16,  <unfinished ...>
[pid 25557] 10:12:37.762071 <... mmap resumed> ) = 0x7fc7a8f38000
[pid 25545] 10:12:37.762088 <... brk resumed> ) = 0x1ea2000
[pid 25544] 10:12:37.762107 getegid( <unfinished ...>
[pid 25543] 10:12:37.762566 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.763317 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25522] 10:12:37.763376 <... write resumed> ) = 126
[pid 25491] 10:12:37.763412 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25557] 10:12:37.763717 close(6 <unfinished ...>
[pid 25545] 10:12:37.763755 read(8,  <unfinished ...>
[pid 25544] 10:12:37.763779 <... getegid resumed> ) = 12
[pid 25543] 10:12:37.763872 <... open resumed> ) = 12
[pid 25529] 10:12:37.763896 <... open resumed> ) = 13
[pid 25522] 10:12:37.763914 write(8, "2015-12-30 10:12:37 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25491] 10:12:37.763946 close(16 <unfinished ...>
[pid 25557] 10:12:37.763981 <... close resumed> ) = 0
[pid 25544] 10:12:37.764007 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.764042 fstat(12,  <unfinished ...>
[pid 25529] 10:12:37.764066 fstat(13,  <unfinished ...>
[pid 25522] 10:12:37.764089 <... write resumed> ) = 77
[pid 25491] 10:12:37.764118 <... close resumed> ) = 0
[pid 25557] 10:12:37.764177 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.764217 <... open resumed> ) = 11
[pid 25543] 10:12:37.764235 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.764266 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.764298 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:37.764324 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25557] 10:12:37.764363 <... open resumed> ) = 6
[pid 25544] 10:12:37.764379 read(11,  <unfinished ...>
[pid 25543] 10:12:37.764406 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.764434 fstat(13,  <unfinished ...>
[pid 25522] 10:12:37.764456 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:37.764502 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25557] 10:12:37.764552 read(6,  <unfinished ...>
[pid 25544] 10:12:37.764578 <... read resumed> "\246\202\275i", 4) = 4
[pid 25543] 10:12:37.764598 <... mmap resumed> ) = 0x7fe585ed8000
[pid 25529] 10:12:37.764616 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.764657 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:37.764685 stat("/usr/local/cpanel/3rdparty/mailman/lists/vhuerta_ncghotels.com/config.pck",  <unfinished ...>
[pid 25557] 10:12:37.764741 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.764774 close(11 <unfinished ...>
[pid 25543] 10:12:37.764801 read(12,  <unfinished ...>
[pid 25529] 10:12:37.764828 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.764854 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:37.764888 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.764926 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.764952 <... close resumed> ) = 0
[pid 25543] 10:12:37.765052 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.765085 <... mmap resumed> ) = 0x7f21d3369000
[pid 25522] 10:12:37.765103 close(7 <unfinished ...>
[pid 25491] 10:12:37.765129 stat("/etc/demouids",  <unfinished ...>
[pid 25557] 10:12:37.765164 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.765195 readlink("/proc/self/exe",  <unfinished ...>
[pid 25543] 10:12:37.765244 close(12 <unfinished ...>
[pid 25529] 10:12:37.765269 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.765293 <... close resumed> ) = 0
[pid 25491] 10:12:37.765312 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.765368 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.765402 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25543] 10:12:37.765469 <... close resumed> ) = 0
[pid 25529] 10:12:37.765615 <... lseek resumed> ) = 0
[pid 25522] 10:12:37.765646 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25491] 10:12:37.765687 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25557] 10:12:37.765726 <... mmap resumed> ) = 0x7fc7a8b0a000
[pid 25544] 10:12:37.765743 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.765768 munmap(0x7fe585ed8000, 4096 <unfinished ...>
[pid 25529] 10:12:37.765796 read(13,  <unfinished ...>
[pid 25522] 10:12:37.765825 <... open resumed> ) = 7
[pid 25491] 10:12:37.765846 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25557] 10:12:37.765957 mprotect(0x7fc7a8b20000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.765994 <... ioctl resumed> , 0x7ffc53805e10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.766016 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.766059 <... read resumed> "", 4096) = 0
[pid 25522] 10:12:37.766087 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:37.766112 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25557] 10:12:37.766149 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.766165 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.766195 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:37.766223 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25522] 10:12:37.766250 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.766266 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25557] 10:12:37.766409 mmap(0x7fc7a8d20000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25544] 10:12:37.766455 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.766482 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.766510 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25522] 10:12:37.766579 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.766613 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.766664 <... mmap resumed> ) = 0x7fc7a8d20000
[pid 25545] 10:12:37.766687 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25544] 10:12:37.766706 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.766833 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.766863 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.766889 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.766994 <... stat resumed> 0x7f3314b98880) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.767035 mmap(0x7fc7a8d22000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.767068 brk(0x1ec3000 <unfinished ...>
[pid 25544] 10:12:37.767091 <... ioctl resumed> , 0x7ffc53805e10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.767110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.767158 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.767196 fstat(7,  <unfinished ...>
[pid 25491] 10:12:37.767221 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25557] 10:12:37.767258 <... mmap resumed> ) = 0x7fc7a8d22000
[pid 25545] 10:12:37.767281 <... brk resumed> ) = 0x1ec3000
[pid 25544] 10:12:37.767297 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.768093 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:37.768130 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25522] 10:12:37.768155 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5385741, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25491] 10:12:37.768187 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.768249 close(6 <unfinished ...>
[pid 25545] 10:12:37.768276 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.768300 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.768322 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.768364 <... lseek resumed> ) = 353
[pid 25522] 10:12:37.768403 write(7, "2015-12-30 10:12:37 [25522] 1aEJMa-0006dL-LG => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2509 QT=1s "..., 262 <unfinished ...>
[pid 25491] 10:12:37.768440 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.768569 <... close resumed> ) = 0
[pid 25544] 10:12:37.768598 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.768625 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:37.768653 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25522] 10:12:37.768681 <... write resumed> ) = 262
[pid 25491] 10:12:37.768732 <... open resumed> ) = 16
[pid 25557] 10:12:37.768764 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.768797 <... ioctl resumed> , 0x7ffc53805e20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.768825 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.768879 <... open resumed> ) = 14
[pid 25522] 10:12:37.768902 pipe( <unfinished ...>
[pid 25491] 10:12:37.768931 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:37.768966 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.768983 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.769007 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.769032 fstat(14,  <unfinished ...>
[pid 25522] 10:12:37.769055 <... pipe resumed> [11, 12]) = 0
[pid 25491] 10:12:37.769073 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:37.769100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.769138 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.769159 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.769200 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25522] 10:12:37.769230 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25491] 10:12:37.769254 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:37.769286 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.769303 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.769336 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.769362 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25522] 10:12:37.769389 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.769407 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.769434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.769472 <... open resumed> ) = 11
[pid 25543] 10:12:37.769579 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.769622 <... mmap resumed> ) = 0x7f21d3368000
[pid 25522] 10:12:37.769641 close(10 <unfinished ...>
[pid 25491] 10:12:37.769666 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.769699 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.769721 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.769746 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.769773 read(14,  <unfinished ...>
[pid 25522] 10:12:37.769800 <... close resumed> ) = 0
[pid 25491] 10:12:37.769816 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25557] 10:12:37.769855 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.769888 <... ioctl resumed> , 0x7ffc53805ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.769906 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.769955 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25522] 10:12:37.769985 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25491] 10:12:37.770016 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.770050 <... open resumed> ) = 6
[pid 25544] 10:12:37.770066 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.770089 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25529] 10:12:37.770116 close(14 <unfinished ...>
[pid 25522] 10:12:37.770140 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.770158 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.770186 read(6,  <unfinished ...>
[pid 25544] 10:12:37.770210 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.770229 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.770251 <... close resumed> ) = 0
[pid 25522] 10:12:37.770269 clone( <unfinished ...>
[pid 25491] 10:12:37.770560 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.770596 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.770620 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.770651 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:37.770688 munmap(0x7f21d3368000, 4096 <unfinished ...>
[pid 25491] 10:12:37.770717 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25557] 10:12:37.770774 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.770806 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.770821 <... fcntl resumed> ) = 0
[pid 25543] 10:12:37.770843 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.770881 <... munmap resumed> ) = 0
[pid 25522] 10:12:37.770912 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25558
[pid 25491] 10:12:37.770950 read(16,  <unfinished ...>
[pid 25557] 10:12:37.770987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25545] 10:12:37.771017 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.771045 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25543] 10:12:37.771069 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.771098 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.771124 close(12 <unfinished ...>
[pid 25491] 10:12:37.771146 <... read resumed> "0", 8192) = 1
[pid 25557] 10:12:37.771176 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.771205 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.771220 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25543] 10:12:37.771612 <... open resumed> ) = 12
[pid 25529] 10:12:37.771641 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25522] 10:12:37.771667 <... close resumed> ) = 0
[pid 25491] 10:12:37.771706 read(16,  <unfinished ...>
[pid 25557] 10:12:37.771746 <... mmap resumed> ) = 0x7fc7a8f37000
[pid 25545] 10:12:37.771768 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.771797 brk(0x1f68000 <unfinished ...>
[pid 25543] 10:12:37.771821 fstat(12,  <unfinished ...>
[pid 25529] 10:12:37.771844 stat("/etc/userdomains",  <unfinished ...>
[pid 25522] 10:12:37.771870 wait4(-1,  <unfinished ...>
[pid 25491] 10:12:37.771893 <... read resumed> "", 8192) = 0
[pid 25557] 10:12:37.771925 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.771955 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.771970 <... brk resumed> ) = 0x1f68000
[pid 25543] 10:12:37.772000 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.772035 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25522] 10:12:37.772082 <... wait4 resumed> 0x7ffd5c5be400, WNOHANG, NULL) = 0
[pid 25491] 10:12:37.772114 close(16 <unfinished ...>
[pid 25557] 10:12:37.772154 <... mmap resumed> ) = 0x7fc7a88f1000
[pid 25545] 10:12:37.772171 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.772198 read(11,  <unfinished ...>
[pid 25543] 10:12:37.772220 fstat(12,  <unfinished ...>
[pid 25529] 10:12:37.772243 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25522] 10:12:37.772270 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25491] 10:12:37.772299 <... close resumed> ) = 0
[pid 25557] 10:12:37.772373 mprotect(0x7fc7a8907000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.772407 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.772429 <... read resumed> "", 8192) = 0
[pid 25543] 10:12:37.772458 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.772494 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:37.772533 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.772575 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.772591 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.772618 close(11 <unfinished ...>
[pid 25543] 10:12:37.772642 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.772669 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.772696 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25557] 10:12:37.772747 mmap(0x7fc7a8b06000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25545] 10:12:37.772782 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.772797 <... close resumed> ) = 0
[pid 25543] 10:12:37.773077 <... mmap resumed> ) = 0x7fe585ed8000
[pid 25529] 10:12:37.773105 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:37.773154 stat("/etc/localtime",  <unfinished ...>
[pid 25557] 10:12:37.773197 <... mmap resumed> ) = 0x7fc7a8b06000
[pid 25545] 10:12:37.773219 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.773247 stat("/etc/exim.pl",  <unfinished ...>
[pid 25543] 10:12:37.773274 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.773297 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.773323 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:37.773370 mmap(0x7fc7a8b08000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.773404 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.773420 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.773455 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.773474 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.773648 stat("/etc/localtime",  <unfinished ...>
[pid 25557] 10:12:37.773687 <... mmap resumed> ) = 0x7fc7a8b08000
[pid 25545] 10:12:37.773709 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.773746 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.773782 read(12,  <unfinished ...>
[pid 25529] 10:12:37.773806 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.773834 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:37.773876 close(6 <unfinished ...>
[pid 25545] 10:12:37.773900 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.773915 <... open resumed> ) = 11
[pid 25543] 10:12:37.773935 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.773972 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.774013 close(7 <unfinished ...>
[pid 25557] 10:12:37.774050 <... close resumed> ) = 0
[pid 25545] 10:12:37.774074 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.774106 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.774130 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.774159 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.774185 <... close resumed> ) = 0
[pid 25557] 10:12:37.774213 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.774245 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.774259 <... ioctl resumed> , 0x7ffc53805d20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.774282 <... open resumed> ) = 13
[pid 25529] 10:12:37.774302 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.774355 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25557] 10:12:37.774402 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.774420 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.774449 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.774473 fstat(13,  <unfinished ...>
[pid 25529] 10:12:37.774579 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25491] 10:12:37.774606 <... open resumed> ) = 7
[pid 25557] 10:12:37.774632 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.774666 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.774681 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.774724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:37.774763 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.774793 fcntl(7, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.774828 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.774845 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.774874 read(11,  <unfinished ...>
[pid 25543] 10:12:37.774900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.774927 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.774953 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.774978 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.775015 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.775030 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25543] 10:12:37.775847 <... mmap resumed> ) = 0x7fe585ed7000
[pid 25529] 10:12:37.775881 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:37.775927 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.775965 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.775990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:37.776023 brk(0x1f89000 <unfinished ...>
[pid 25543] 10:12:37.776048 read(13,  <unfinished ...>
[pid 25529] 10:12:37.776075 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.776105 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.776131 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.776164 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.776179 <... brk resumed> ) = 0x1f89000
[pid 25543] 10:12:37.776643 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:37.776697 <... open resumed> ) = 14
[pid 25491] 10:12:37.776718 fstat(7,  <unfinished ...>
[pid 25557] 10:12:37.776754 <... open resumed> ) = 6
[pid 25545] 10:12:37.776770 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25544] 10:12:37.776801 read(11,  <unfinished ...>
[pid 25543] 10:12:37.776827 close(13 <unfinished ...>
[pid 25529] 10:12:37.776851 fstat(14,  <unfinished ...>
[pid 25491] 10:12:37.776874 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5386003, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:37.776914 read(6,  <unfinished ...>
[pid 25545] 10:12:37.776939 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:37.776965 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25543] 10:12:37.777744 <... close resumed> ) = 0
[pid 25529] 10:12:37.777776 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:37.777814 write(7, "2015-12-30 10:12:37 [25491] 1aEJMZ-0006cs-RM SMTP connection outbound 1451491957 1aEJMZ-0006cs-RM finestweddingsites.com vhuerta@ncghotels.com\n", 143 <unfinished ...>
[pid 25557] 10:12:37.777859 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.777890 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.777926 brk(0x1faa000 <unfinished ...>
[pid 25543] 10:12:37.777952 munmap(0x7fe585ed7000, 4096 <unfinished ...>
[pid 25529] 10:12:37.777981 fstat(14,  <unfinished ...>
[pid 25491] 10:12:37.778004 <... write resumed> ) = 143
[pid 25557] 10:12:37.778057 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.778085 <... open resumed> ) = 9
[pid 25544] 10:12:37.778099 <... brk resumed> ) = 0x1faa000
[pid 25543] 10:12:37.778634 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.778693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25491] 10:12:37.778736 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25557] 10:12:37.778787 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25545] 10:12:37.778819 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:37.778844 read(11,  <unfinished ...>
[pid 25543] 10:12:37.778873 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.778909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.778936 <... open resumed> ) = 16
[pid 25557] 10:12:37.778964 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.778993 <... ioctl resumed> , 0x7fffd44b25d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:37.779009 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25543] 10:12:37.779645 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.779711 <... mmap resumed> ) = 0x7f21d3368000
[pid 25491] 10:12:37.779734 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25557] 10:12:37.779770 <... mmap resumed> ) = 0x7fc7a86ba000
[pid 25545] 10:12:37.779787 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.779810 brk(0x1fcb000 <unfinished ...>
[pid 25543] 10:12:37.779834 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25529] 10:12:37.779862 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.779885 <... lseek resumed> ) = 18
[pid 25557] 10:12:37.779912 mprotect(0x7fc7a86c1000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.779941 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.779954 <... brk resumed> ) = 0x1fcb000
[pid 25543] 10:12:37.780429 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.780465 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.780570 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:37.780618 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.780635 read(9,  <unfinished ...>
[pid 25544] 10:12:37.780661 read(11,  <unfinished ...>
[pid 25543] 10:12:37.780685 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.780712 read(14,  <unfinished ...>
[pid 25491] 10:12:37.780734 <... ioctl resumed> , 0x7ffc86158450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:37.780763 mmap(0x7fc7a88c1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25545] 10:12:37.780796 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25544] 10:12:37.780815 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25543] 10:12:37.781010 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.781328 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:37.781372 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:37.781411 <... mmap resumed> ) = 0x7fc7a88c1000
[pid 25545] 10:12:37.781433 brk(0x1ee4000 <unfinished ...>
[pid 25544] 10:12:37.781459 read(11,  <unfinished ...>
[pid 25543] 10:12:37.781486 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25529] 10:12:37.781519 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.781549 <... lseek resumed> ) = 18
[pid 25557] 10:12:37.781576 mmap(0x7fc7a88c3000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.781607 <... brk resumed> ) = 0x1ee4000
[pid 25544] 10:12:37.781621 <... read resumed> "", 8192) = 0
[pid 25543] 10:12:37.782047 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:37.782108 <... open resumed> ) = 15
[pid 25491] 10:12:37.782130 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.782166 <... mmap resumed> ) = 0x7fc7a88c3000
[pid 25545] 10:12:37.782191 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.782217 close(11 <unfinished ...>
[pid 25543] 10:12:37.782242 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25529] 10:12:37.782270 fstat(15,  <unfinished ...>
[pid 25491] 10:12:37.782293 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=18, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:37.782334 close(6 <unfinished ...>
[pid 25545] 10:12:37.782358 <... lseek resumed> ) = 4868
[pid 25544] 10:12:37.782371 <... close resumed> ) = 0
[pid 25543] 10:12:37.782386 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.782431 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:37.782463 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.782585 <... close resumed> ) = 0
[pid 25545] 10:12:37.782611 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.782642 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25543] 10:12:37.782670 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.782696 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.782723 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.782757 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.782792 <... lseek resumed> ) = 4868
[pid 25544] 10:12:37.782805 <... stat resumed> 0x7fa6912bd880) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.782823 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.782873 <... mmap resumed> ) = 0x7f21d3367000
[pid 25491] 10:12:37.782893 write(16, "1", 1 <unfinished ...>
[pid 25557] 10:12:37.782934 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.782952 close(9 <unfinished ...>
[pid 25544] 10:12:37.782975 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25543] 10:12:37.783001 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25529] 10:12:37.783026 read(15,  <unfinished ...>
[pid 25491] 10:12:37.783054 <... write resumed> ) = 1
[pid 25557] 10:12:37.783080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.783115 <... close resumed> ) = 0
[pid 25544] 10:12:37.783128 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.783171 <... stat resumed> 0x7ffcdc247c20) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.783201 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:37.783229 close(16 <unfinished ...>
[pid 25557] 10:12:37.783265 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.783282 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:37.783308 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25543] 10:12:37.783333 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.783360 close(15 <unfinished ...>
[pid 25491] 10:12:37.783393 <... close resumed> ) = 0
[pid 25557] 10:12:37.783445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.783566 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.783584 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25543] 10:12:37.783614 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.783654 <... close resumed> ) = 0
[pid 25491] 10:12:37.783673 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.783713 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.783733 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:37.783760 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.783787 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:37.783821 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25491] 10:12:37.783851 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.783888 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.783925 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.783940 <... open resumed> ) = 11
[pid 25543] 10:12:37.783959 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25529] 10:12:37.784079 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.784117 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.784159 <... open resumed> ) = 6
[pid 25545] 10:12:37.784175 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:37.784200 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.784224 getuid( <unfinished ...>
[pid 25529] 10:12:37.784247 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.784272 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.784330 read(6,  <unfinished ...>
[pid 25545] 10:12:37.784359 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.784374 <... ioctl resumed> , 0x7ffc53805d20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.784394 <... getuid resumed> ) = 0
[pid 25529] 10:12:37.784413 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.784460 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25557] 10:12:37.784510 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.784535 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:37.784561 lseek(11, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.784584 geteuid( <unfinished ...>
[pid 25529] 10:12:37.784613 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25491] 10:12:37.784646 <... socket resumed> ) = 16
[pid 25557] 10:12:37.784672 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.784697 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.784711 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.784753 <... geteuid resumed> ) = 0
[pid 25529] 10:12:37.784776 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.784800 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25557] 10:12:37.784843 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25545] 10:12:37.784873 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:37.784906 read(11,  <unfinished ...>
[pid 25543] 10:12:37.784938 getgid( <unfinished ...>
[pid 25529] 10:12:37.784961 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.784992 <... connect resumed> ) = 0
[pid 25557] 10:12:37.785019 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.785048 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.785063 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25543] 10:12:37.785349 <... getgid resumed> ) = 12
[pid 25529] 10:12:37.785379 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.785417 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25557] 10:12:37.785444 <... mmap resumed> ) = 0x7fc7a8436000
[pid 25545] 10:12:37.785454 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:37.785461 brk(0x1fec000 <unfinished ...>
[pid 25543] 10:12:37.785640 getegid( <unfinished ...>
[pid 25529] 10:12:37.785669 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25491] 10:12:37.785707 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25557] 10:12:37.785741 mprotect(0x7fc7a84b9000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.785772 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.785787 <... brk resumed> ) = 0x1fec000
[pid 25543] 10:12:37.785987 <... getegid resumed> ) = 12
[pid 25529] 10:12:37.786083 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25491] 10:12:37.786135 sendto(16, "\273\336\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\0\0\17\0\1", 31, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25557] 10:12:37.786209 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.786227 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:37.786261 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.786286 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.786320 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25491] 10:12:37.786346 <... sendto resumed> ) = 31
[pid 25557] 10:12:37.786372 mmap(0x7fc7a86b8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25545] 10:12:37.786404 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.786420 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.786439 <... open resumed> ) = 13
[pid 25529] 10:12:37.786458 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.786485 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25557] 10:12:37.786525 <... mmap resumed> ) = 0x7fc7a86b8000
[pid 25545] 10:12:37.786552 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:37.786585 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.786617 read(13,  <unfinished ...>
[pid 25529] 10:12:37.786650 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.786691 close(6 <unfinished ...>
[pid 25545] 10:12:37.786718 <... stat resumed> 0x7fffd44b27e0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.786735 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.786760 <... read resumed> "L\203\32\225", 4) = 4
[pid 25529] 10:12:37.786782 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.786842 <... close resumed> ) = 0
[pid 25545] 10:12:37.786869 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:37.786901 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.786929 close(13 <unfinished ...>
[pid 25529] 10:12:37.786953 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25557] 10:12:37.786986 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.787016 <... stat resumed> 0x7fffd44b2880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.787030 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.787050 <... close resumed> ) = 0
[pid 25529] 10:12:37.787150 <... stat resumed> 0x7ffce2d03bb0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.787185 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.787205 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:37.787235 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.787262 readlink("/proc/self/exe",  <unfinished ...>
[pid 25529] 10:12:37.787308 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.787343 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.787379 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25544] 10:12:37.787406 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.787431 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25529] 10:12:37.787620 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.787679 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.787700 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.787733 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.787764 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.787790 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.787825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.787854 <... open resumed> ) = 9
[pid 25544] 10:12:37.787868 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.787889 <... ioctl resumed> , 0x7ffcdc244a80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.787911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25557] 10:12:37.788008 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.788035 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:37.788059 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.788096 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.788121 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.788152 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.788185 <... ioctl resumed> , 0x7fffd44b25d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:37.788200 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.788222 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.788245 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.788272 <... open resumed> ) = 6
[pid 25545] 10:12:37.788289 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.788311 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.788344 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.788368 read(14,  <unfinished ...>
[pid 25557] 10:12:37.788399 read(6,  <unfinished ...>
[pid 25545] 10:12:37.788422 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.788435 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.788473 <... ioctl resumed> , 0x7ffcdc244a80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.788577 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.788625 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.788656 read(9,  <unfinished ...>
[pid 25544] 10:12:37.788682 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.788712 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.788735 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.788771 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.788795 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25544] 10:12:37.788812 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.789270 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.789302 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25557] 10:12:37.789357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25545] 10:12:37.789392 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.789416 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.789448 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.789472 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.789518 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.789546 <... lseek resumed> ) = 2366
[pid 25544] 10:12:37.789560 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.789586 <... ioctl resumed> , 0x7ffcdc244a90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.789606 <... open resumed> ) = 15
[pid 25557] 10:12:37.789631 <... mmap resumed> ) = 0x7fc7a8f36000
[pid 25545] 10:12:37.789652 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.789675 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.789706 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.789729 fstat(15,  <unfinished ...>
[pid 25557] 10:12:37.789759 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.789787 <... lseek resumed> ) = 2366
[pid 25544] 10:12:37.789895 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.789926 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.789949 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25557] 10:12:37.789992 <... mmap resumed> ) = 0x7fc7a8228000
[pid 25545] 10:12:37.790010 close(9 <unfinished ...>
[pid 25544] 10:12:37.790034 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25543] 10:12:37.790064 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.790096 fstat(15,  <unfinished ...>
[pid 25557] 10:12:37.790127 mprotect(0x7fc7a8234000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.790155 <... close resumed> ) = 0
[pid 25544] 10:12:37.790168 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.790548 <... open resumed> ) = 13
[pid 25529] 10:12:37.790578 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25557] 10:12:37.790620 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.790637 read(8,  <unfinished ...>
[pid 25544] 10:12:37.790661 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25543] 10:12:37.790692 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.790717 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.790752 mmap(0x7fc7a8434000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25545] 10:12:37.790783 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:37.790798 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.790833 <... ioctl resumed> , 0x7ffcdc244b60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.790853 <... mmap resumed> ) = 0x7f21d3367000
[pid 25557] 10:12:37.790878 <... mmap resumed> ) = 0x7fc7a8434000
[pid 25545] 10:12:37.790905 close(8 <unfinished ...>
[pid 25544] 10:12:37.790931 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.790964 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.790988 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.791019 close(6 <unfinished ...>
[pid 25545] 10:12:37.791041 <... close resumed> ) = 0
[pid 25544] 10:12:37.791054 <... open resumed> ) = 12
[pid 25543] 10:12:37.791279 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.791307 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.791334 <... close resumed> ) = 0
[pid 25545] 10:12:37.791359 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.791391 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.791423 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.791450 read(15,  <unfinished ...>
[pid 25557] 10:12:37.791554 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.791593 <... open resumed> ) = 8
[pid 25544] 10:12:37.791607 <... ioctl resumed> , 0x7ffc53805730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.791629 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.791649 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.791683 <... open resumed> ) = 6
[pid 25545] 10:12:37.791701 fstat(8,  <unfinished ...>
[pid 25544] 10:12:37.791723 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.791746 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25529] 10:12:37.791771 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.791806 read(6,  <unfinished ...>
[pid 25545] 10:12:37.791829 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:37.791858 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.791899 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0}, 8) = 0
[pid 25529] 10:12:37.792158 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25557] 10:12:37.792223 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.792251 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.792279 read(12,  <unfinished ...>
[pid 25543] 10:12:37.792305 brk(0x2074000 <unfinished ...>
[pid 25529] 10:12:37.792330 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.792368 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.792391 <... mmap resumed> ) = 0x7f6d15b8e000
[pid 25544] 10:12:37.792405 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25543] 10:12:37.792721 <... brk resumed> ) = 0x2074000
[pid 25529] 10:12:37.792761 <... open resumed> ) = 16
[pid 25557] 10:12:37.792790 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25545] 10:12:37.792824 read(8,  <unfinished ...>
[pid 25544] 10:12:37.792852 read(12,  <unfinished ...>
[pid 25543] 10:12:37.792878 read(13,  <unfinished ...>
[pid 25529] 10:12:37.792900 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.792932 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.792960 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:37.792984 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25543] 10:12:37.793679 <... read resumed> "", 8192) = 0
[pid 25529] 10:12:37.793720 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25557] 10:12:37.793767 <... mmap resumed> ) = 0x7fc7a8005000
[pid 25545] 10:12:37.793786 close(8 <unfinished ...>
[pid 25544] 10:12:37.793812 brk(0x200d000 <unfinished ...>
[pid 25543] 10:12:37.793837 close(13 <unfinished ...>
[pid 25529] 10:12:37.793861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.793896 mprotect(0x7fc7a8026000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.793923 <... close resumed> ) = 0
[pid 25544] 10:12:37.793937 <... brk resumed> ) = 0x200d000
[pid 25543] 10:12:37.794119 <... close resumed> ) = 0
[pid 25529] 10:12:37.794403 <... mmap resumed> ) = 0x7f21d3366000
[pid 25557] 10:12:37.794440 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.794458 munmap(0x7f6d15b8e000, 4096 <unfinished ...>
[pid 25544] 10:12:37.794492 read(12,  <unfinished ...>
[pid 25543] 10:12:37.794521 stat("/etc/exim.pl",  <unfinished ...>
[pid 25529] 10:12:37.794560 read(16, Process 25558 attached
 <unfinished ...>
[pid 25557] 10:12:37.794621 mmap(0x7fc7a8226000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25545] 10:12:37.794654 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.794668 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25543] 10:12:37.795099 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.795144 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25558] 10:12:37.795183 set_robust_list(0x7f2e40afdaa0, 24 <unfinished ...>
[pid 25557] 10:12:37.795209 <... mmap resumed> ) = 0x7fc7a8226000
[pid 25545] 10:12:37.795231 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25544] 10:12:37.795256 read(12,  <unfinished ...>
[pid 25543] 10:12:37.795279 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.795309 close(16 <unfinished ...>
[pid 25558] 10:12:37.795343 <... set_robust_list resumed> ) = 0
[pid 25557] 10:12:37.795357 close(6 <unfinished ...>
[pid 25545] 10:12:37.795409 <... lseek resumed> ) = 19
[pid 25544] 10:12:37.795423 <... read resumed> "", 8192) = 0
[pid 25543] 10:12:37.795444 <... open resumed> ) = 13
[pid 25529] 10:12:37.795463 <... close resumed> ) = 0
[pid 25558] 10:12:37.795585 fcntl(12, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.795617 <... close resumed> ) = 0
[pid 25545] 10:12:37.795642 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.795672 close(12 <unfinished ...>
[pid 25543] 10:12:37.795696 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.795727 munmap(0x7f21d3366000, 4096 <unfinished ...>
[pid 25558] 10:12:37.795765 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.795778 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.795811 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.795825 <... close resumed> ) = 0
[pid 25543] 10:12:37.796507 <... ioctl resumed> , 0x7ffcdc244990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.796542 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.796589 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.796618 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.796636 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.796664 read(11,  <unfinished ...>
[pid 25543] 10:12:37.796689 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.796713 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.796751 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.796764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.796804 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.796818 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25543] 10:12:37.796838 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.797679 <... open resumed> ) = 16
[pid 25558] 10:12:37.797721 close(6 <unfinished ...>
[pid 25557] 10:12:37.797749 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.797768 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.797796 read(11,  <unfinished ...>
[pid 25543] 10:12:37.797821 read(13,  <unfinished ...>
[pid 25529] 10:12:37.797847 fstat(16,  <unfinished ...>
[pid 25558] 10:12:37.797879 <... close resumed> ) = 0
[pid 25557] 10:12:37.797893 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.797954 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.797969 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25543] 10:12:37.797990 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25529] 10:12:37.799554 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25558] 10:12:37.799619 open("/var/spool/exim/input/a/1aEJMa-0006dL-LG-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25557] 10:12:37.799666 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.799689 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.799716 read(11,  <unfinished ...>
[pid 25543] 10:12:37.799742 brk(0x2095000 <unfinished ...>
[pid 25529] 10:12:37.799767 fstat(16,  <unfinished ...>
[pid 25558] 10:12:37.799800 <... open resumed> ) = 6
[pid 25557] 10:12:37.799813 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.799856 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.799871 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25543] 10:12:37.799897 <... brk resumed> ) = 0x2095000
[pid 25529] 10:12:37.800843 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25558] 10:12:37.800903 fcntl(6, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.800929 <... open resumed> ) = 6
[pid 25545] 10:12:37.800946 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.800973 brk(0x202e000 <unfinished ...>
[pid 25543] 10:12:37.800997 read(13,  <unfinished ...>
[pid 25529] 10:12:37.801023 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.801050 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25558] 10:12:37.801082 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.801095 read(6,  <unfinished ...>
[pid 25545] 10:12:37.801121 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.801134 <... brk resumed> ) = 0x202e000
[pid 25543] 10:12:37.801154 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25529] 10:12:37.802062 <... mmap resumed> ) = 0x7f21d3366000
[pid 25491] 10:12:37.802096 recvfrom(16,  <unfinished ...>
[pid 25558] 10:12:37.802138 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.802163 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.802189 alarm(300 <unfinished ...>
[pid 25544] 10:12:37.802214 read(11,  <unfinished ...>
[pid 25543] 10:12:37.802238 brk(0x20b6000 <unfinished ...>
[pid 25529] 10:12:37.802263 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.802287 <... recvfrom resumed> "\273\336\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\0\0\17\0\1\300\f\0\17\0\1\0\0\0+\0)\0\n\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\300\f\0\17\0\1\0\0\0+\0$\0\n\tncghotels\3com\tinbound10\7mxlogic\300O", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 132
[pid 25558] 10:12:37.802331 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.802348 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.802415 <... alarm resumed> ) = 0
[pid 25544] 10:12:37.802430 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25543] 10:12:37.802450 <... brk resumed> ) = 0x20b6000
[pid 25529] 10:12:37.803530 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.803564 close(16 <unfinished ...>
[pid 25558] 10:12:37.803611 geteuid( <unfinished ...>
[pid 25557] 10:12:37.803643 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25545] 10:12:37.803698 alarm(0 <unfinished ...>
[pid 25544] 10:12:37.803728 read(11,  <unfinished ...>
[pid 25543] 10:12:37.803755 read(13,  <unfinished ...>
[pid 25529] 10:12:37.803781 read(16,  <unfinished ...>
[pid 25491] 10:12:37.803808 <... close resumed> ) = 0
[pid 25558] 10:12:37.803865 <... geteuid resumed> ) = 0
[pid 25557] 10:12:37.803883 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.803915 <... alarm resumed> ) = 300
[pid 25544] 10:12:37.803929 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25543] 10:12:37.803950 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25529] 10:12:37.805168 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25491] 10:12:37.805221 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25558] 10:12:37.805267 getegid( <unfinished ...>
[pid 25557] 10:12:37.805291 <... mmap resumed> ) = 0x7fc7a7de8000
[pid 25545] 10:12:37.805308 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.805336 brk(0x204f000 <unfinished ...>
[pid 25543] 10:12:37.805359 brk(0x20d7000 <unfinished ...>
[pid 25529] 10:12:37.805382 read(16,  <unfinished ...>
[pid 25491] 10:12:37.805405 <... socket resumed> ) = 16
[pid 25558] 10:12:37.805433 <... getegid resumed> ) = 12
[pid 25557] 10:12:37.805447 mprotect(0x7fc7a7dff000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.805485 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.805502 <... brk resumed> ) = 0x204f000
[pid 25543] 10:12:37.805519 <... brk resumed> ) = 0x20d7000
[pid 25529] 10:12:37.805990 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:37.806467 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25558] 10:12:37.806585 setgid(12 <unfinished ...>
[pid 25557] 10:12:37.806620 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.806650 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.806693 read(11,  <unfinished ...>
[pid 25543] 10:12:37.806720 read(13,  <unfinished ...>
[pid 25529] 10:12:37.806744 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.806775 <... connect resumed> ) = 0
[pid 25558] 10:12:37.806803 <... setgid resumed> ) = 0
[pid 25557] 10:12:37.806817 mmap(0x7fc7a7fff000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25545] 10:12:37.806852 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.806866 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25543] 10:12:37.806886 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25529] 10:12:37.807404 <... open resumed> ) = 17
[pid 25491] 10:12:37.807736 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25558] 10:12:37.807798 setuid(47 <unfinished ...>
[pid 25557] 10:12:37.807824 <... mmap resumed> ) = 0x7fc7a7fff000
[pid 25545] 10:12:37.807847 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.807875 read(11,  <unfinished ...>
[pid 25543] 10:12:37.807900 read(13,  <unfinished ...>
[pid 25529] 10:12:37.807923 fstat(17,  <unfinished ...>
[pid 25491] 10:12:37.807946 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25558] 10:12:37.807976 <... setuid resumed> ) = 0
[pid 25557] 10:12:37.807990 mmap(0x7fc7a8001000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.808024 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.808038 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25543] 10:12:37.808058 <... read resumed> "", 8192) = 0
[pid 25529] 10:12:37.808408 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25491] 10:12:37.808455 sendto(16, "\333U\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1", 55, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25558] 10:12:37.808608 close(11 <unfinished ...>
[pid 25557] 10:12:37.808640 <... mmap resumed> ) = 0x7fc7a8001000
[pid 25545] 10:12:37.808671 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.808709 brk(0x2070000 <unfinished ...>
[pid 25543] 10:12:37.808738 close(13 <unfinished ...>
[pid 25529] 10:12:37.808763 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.808790 <... sendto resumed> ) = 55
[pid 25558] 10:12:37.808818 <... close resumed> ) = 0
[pid 25557] 10:12:37.808831 close(6 <unfinished ...>
[pid 25545] 10:12:37.809034 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.809050 <... brk resumed> ) = 0x2070000
[pid 25543] 10:12:37.809073 <... close resumed> ) = 0
[pid 25529] 10:12:37.809359 <... mmap resumed> ) = 0x7f21d3365000
[pid 25491] 10:12:37.809407 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25558] 10:12:37.809451 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25557] 10:12:37.809533 <... close resumed> ) = 0
[pid 25545] 10:12:37.809567 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f6d14a46790},  <unfinished ...>
[pid 25544] 10:12:37.809596 read(11,  <unfinished ...>
[pid 25543] 10:12:37.809633 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25529] 10:12:37.809664 read(17,  <unfinished ...>
[pid 25558] 10:12:37.809702 <... socket resumed> ) = 10
[pid 25557] 10:12:37.809716 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.809752 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:37.809765 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25543] 10:12:37.809789 <... stat resumed> 0x7fe584579880) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.810394 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25558] 10:12:37.810456 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25557] 10:12:37.810514 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.810535 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25544] 10:12:37.810563 read(11,  <unfinished ...>
[pid 25543] 10:12:37.810583 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25529] 10:12:37.810610 close(17 <unfinished ...>
[pid 25558] 10:12:37.810643 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.810657 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.810698 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, 8) = 0
[pid 25543] 10:12:37.810716 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.810746 <... close resumed> ) = 0
[pid 25558] 10:12:37.810775 close(10 <unfinished ...>
[pid 25557] 10:12:37.810801 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.810819 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25543] 10:12:37.810845 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25529] 10:12:37.810870 munmap(0x7f21d3365000, 4096 <unfinished ...>
[pid 25558] 10:12:37.810907 <... close resumed> ) = 0
[pid 25557] 10:12:37.810921 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.810959 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, 8) = 0
[pid 25543] 10:12:37.810976 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25529] 10:12:37.811014 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.811062 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25557] 10:12:37.811091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.811113 stat("/etc/localtime",  <unfinished ...>
[pid 25543] 10:12:37.811140 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.811167 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.811204 <... socket resumed> ) = 10
[pid 25557] 10:12:37.811218 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.811249 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25543] 10:12:37.811292 <... open resumed> ) = 13
[pid 25529] 10:12:37.811307 <... open resumed> ) = 17
[pid 25558] 10:12:37.811337 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25557] 10:12:37.811370 <... open resumed> ) = 6
[pid 25545] 10:12:37.811387 open("/var/spool/exim/input/b/hdr.25545", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25543] 10:12:37.811463 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25529] 10:12:37.811611 fstat(17,  <unfinished ...>
[pid 25558] 10:12:37.811645 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.811663 read(6,  <unfinished ...>
[pid 25545] 10:12:37.811690 <... open resumed> ) = 8
[pid 25543] 10:12:37.811711 <... ioctl resumed> , 0x7ffcdc244990) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25529] 10:12:37.811731 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25558] 10:12:37.811780 close(10 <unfinished ...>
[pid 25557] 10:12:37.811807 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.811831 fchown(8, 47, 12 <unfinished ...>
[pid 25544] 10:12:37.811860 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25543] 10:12:37.811877 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25529] 10:12:37.812126 fstat(17,  <unfinished ...>
[pid 25558] 10:12:37.812163 <... close resumed> ) = 0
[pid 25557] 10:12:37.812177 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.812244 <... fchown resumed> ) = 0
[pid 25544] 10:12:37.812262 brk(0x2091000 <unfinished ...>
[pid 25543] 10:12:37.812283 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.812320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25558] 10:12:37.812363 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.812393 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25545] 10:12:37.812424 fchmod(8, 0640 <unfinished ...>
[pid 25543] 10:12:37.812451 read(13,  <unfinished ...>
[pid 25529] 10:12:37.812481 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.812519 <... open resumed> ) = 10
[pid 25557] 10:12:37.812533 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.812570 <... fchmod resumed> ) = 0
[pid 25543] 10:12:37.812588 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25529] 10:12:37.812890 <... mmap resumed> ) = 0x7f21d3365000
[pid 25558] 10:12:37.812926 fstat(10,  <unfinished ...>
[pid 25557] 10:12:37.812955 <... mmap resumed> ) = 0x7fc7a8f35000
[pid 25545] 10:12:37.812975 fcntl(8, F_GETFL <unfinished ...>
[pid 25543] 10:12:37.812999 brk(0x20f8000 <unfinished ...>
[pid 25529] 10:12:37.813022 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25558] 10:12:37.813055 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:37.813084 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.813117 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25544] 10:12:37.813145 <... brk resumed> ) = 0x2091000
[pid 25543] 10:12:37.813159 <... brk resumed> ) = 0x20f8000
[pid 25529] 10:12:37.813772 <... lseek resumed> ) = 0
[pid 25558] 10:12:37.813819 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.813853 <... mmap resumed> ) = 0x7fc7a7a74000
[pid 25545] 10:12:37.813871 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.813894 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.813922 read(17,  <unfinished ...>
[pid 25558] 10:12:37.813962 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25557] 10:12:37.813976 mprotect(0x7fc7a7be3000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.814007 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080188, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.814038 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.814054 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:37.814093 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25558] 10:12:37.814127 read(10,  <unfinished ...>
[pid 25557] 10:12:37.814156 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.814172 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.814199 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.814224 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.814251 recvfrom(16,  <unfinished ...>
[pid 25558] 10:12:37.814286 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25557] 10:12:37.814304 mmap(0x7fc7a7de2000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25545] 10:12:37.814369 <... mmap resumed> ) = 0x7f6d15b8e000
[pid 25543] 10:12:37.814387 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.814408 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.814451 <... recvfrom resumed> "\333U\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\tmxlogicmx\3net\0\0\1\0\1\300\f\0\1\0\1\0\0\244\313\0\4\320A\221\3\300\f\0\1\0\1\0\0\244\313\0\4\320A\220\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 87
[pid 25558] 10:12:37.814500 close(10 <unfinished ...>
[pid 25557] 10:12:37.814528 <... mmap resumed> ) = 0x7fc7a7de2000
[pid 25545] 10:12:37.814554 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.814581 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.814894 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.814924 close(16 <unfinished ...>
[pid 25558] 10:12:37.814965 <... close resumed> ) = 0
[pid 25557] 10:12:37.814979 close(6 <unfinished ...>
[pid 25545] 10:12:37.815004 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.815039 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.815064 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.815083 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.815126 <... close resumed> ) = 0
[pid 25558] 10:12:37.815206 munmap(0x7f2e40b13000, 4096 <unfinished ...>
[pid 25557] 10:12:37.815239 <... close resumed> ) = 0
[pid 25545] 10:12:37.815266 write(8, "1aEJMb-0006e1-MY-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 439 <unfinished ...>
[pid 25543] 10:12:37.815309 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.815337 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.815363 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25558] 10:12:37.815401 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.815414 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.815613 <... write resumed> ) = 439
[pid 25543] 10:12:37.815634 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.815657 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.815699 <... socket resumed> ) = 16
[pid 25558] 10:12:37.815728 stat("/etc/mailips",  <unfinished ...>
[pid 25557] 10:12:37.815755 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.815773 fstat(8,  <unfinished ...>
[pid 25543] 10:12:37.815797 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.815830 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.815855 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25558] 10:12:37.815897 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.815923 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.815986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080188, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=439, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.816026 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.816045 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.816085 <... connect resumed> ) = 0
[pid 25558] 10:12:37.816116 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.816144 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.816162 write(8, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006e1-MY; Wed, 30 Dec 2015 10:12:37 -0600\n081T To:  kgallagher@mcdowellmountaingc.com, mcdowell-mountain@fi"..., 564 <unfinished ...>
[pid 25544] 10:12:37.816192 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.816206 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.816239 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:37.816264 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25558] 10:12:37.816301 <... open resumed> ) = 10
[pid 25557] 10:12:37.816315 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.816351 <... write resumed> ) = 564
[pid 25544] 10:12:37.816367 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.816394 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.816425 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:37.816557 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25558] 10:12:37.816596 fstat(10,  <unfinished ...>
[pid 25557] 10:12:37.816620 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.816640 fsync(8 <unfinished ...>
[pid 25544] 10:12:37.816703 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.816720 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.816855 write(8, "2015-12-30 10:12:37 routing failed for finest09@fin.finestweddingsites.com <antiqueweddinghouse@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 181 <unfinished ...>
[pid 25491] 10:12:37.816884 sendto(16, "\333(\1\0\0\1\0\0\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1", 53, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25558] 10:12:37.816947 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.816982 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.817035 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.817062 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.817080 <... sendto resumed> ) = 53
[pid 25558] 10:12:37.817107 fstat(10,  <unfinished ...>
[pid 25557] 10:12:37.817129 <... open resumed> ) = 6
[pid 25545] 10:12:37.817145 <... fsync resumed> ) = 0
[pid 25544] 10:12:37.817161 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.817175 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.817207 <... write resumed> ) = 181
[pid 25491] 10:12:37.817226 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25558] 10:12:37.817263 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.817289 read(6,  <unfinished ...>
[pid 25545] 10:12:37.817315 fstat(8,  <unfinished ...>
[pid 25544] 10:12:37.817338 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.817362 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.817382 stat("/etc/localtime",  <unfinished ...>
[pid 25558] 10:12:37.817418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.817444 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.817469 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080188, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1003, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.817580 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.817602 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.817641 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25558] 10:12:37.817690 <... mmap resumed> ) = 0x7f2e40b13000
[pid 25557] 10:12:37.817707 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.817734 close(8 <unfinished ...>
[pid 25544] 10:12:37.817760 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.817786 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.817803 stat("/etc/localtime",  <unfinished ...>
[pid 25558] 10:12:37.817837 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.817860 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25545] 10:12:37.817889 <... close resumed> ) = 0
[pid 25544] 10:12:37.817906 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.817920 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.818025 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25558] 10:12:37.818070 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.818085 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.818117 munmap(0x7f6d15b8e000, 4096 <unfinished ...>
[pid 25544] 10:12:37.818146 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.818173 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.818194 close(7 <unfinished ...>
[pid 25558] 10:12:37.818229 read(10,  <unfinished ...>
[pid 25557] 10:12:37.818251 <... mmap resumed> ) = 0x7fc7a77e5000
[pid 25545] 10:12:37.818268 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.818292 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.818307 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25529] 10:12:37.818348 <... close resumed> ) = 0
[pid 25558] 10:12:37.818377 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.818393 mprotect(0x7fc7a7870000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.818443 rename("/var/spool/exim/input/b/hdr.25545", "/var/spool/exim/input/b/1aEJMb-0006e1-MY-H" <unfinished ...>
[pid 25544] 10:12:37.818563 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.818596 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.818615 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25558] 10:12:37.818659 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.818682 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.818698 <... rename resumed> ) = 0
[pid 25544] 10:12:37.818716 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.818731 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25529] 10:12:37.818763 <... open resumed> ) = 7
[pid 25558] 10:12:37.818788 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.818802 mmap(0x7fc7a7a70000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25545] 10:12:37.818836 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25544] 10:12:37.818873 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.818902 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25529] 10:12:37.818934 fcntl(7, F_GETFD <unfinished ...>
[pid 25558] 10:12:37.818967 read(10,  <unfinished ...>
[pid 25557] 10:12:37.818989 <... mmap resumed> ) = 0x7fc7a7a70000
[pid 25545] 10:12:37.819011 <... open resumed> ) = 8
[pid 25544] 10:12:37.819028 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.819042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.819079 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.819104 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.819118 mmap(0x7fc7a7a73000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.819344 fsync(8 <unfinished ...>
[pid 25544] 10:12:37.819372 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.819402 <... open resumed> ) = 14
[pid 25529] 10:12:37.819422 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.819464 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.819570 <... mmap resumed> ) = 0x7fc7a7a73000
[pid 25545] 10:12:37.819598 <... fsync resumed> ) = 0
[pid 25544] 10:12:37.819619 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.819635 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25537] 10:12:37.819663 <... select resumed> ) = 1 (in [11], left {299, 835817})
[pid 25529] 10:12:37.819691 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.819718 <... open resumed> ) = 11
[pid 25557] 10:12:37.819732 close(6 <unfinished ...>
[pid 25545] 10:12:37.819759 close(8 <unfinished ...>
[pid 25544] 10:12:37.819783 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.819812 <... ioctl resumed> , 0x7ffcdc2443a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25537] 10:12:37.819831 read(11,  <unfinished ...>
[pid 25529] 10:12:37.819856 fstat(7,  <unfinished ...>
[pid 25558] 10:12:37.819889 fstat(11,  <unfinished ...>
[pid 25557] 10:12:37.819911 <... close resumed> ) = 0
[pid 25545] 10:12:37.819936 <... close resumed> ) = 0
[pid 25544] 10:12:37.819955 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.819970 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25537] 10:12:37.819998 <... read resumed> "\27\3\1\0 ", 5) = 5
[pid 25529] 10:12:37.820018 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10528, st_size=5386146, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25558] 10:12:37.820058 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25557] 10:12:37.820083 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.820115 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.820138 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.820166 <... lseek resumed> ) = 0
[pid 25537] 10:12:37.820208 read(11,  <unfinished ...>
[pid 25529] 10:12:37.820238 write(7, "2015-12-30 10:12:37 [25529] 1aEJMb-0006df-04 ** finest09@fin.finestweddingsites.com <antiqueweddinghouse@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 190 <unfinished ...>
[pid 25558] 10:12:37.820291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.820317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.820335 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080158, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.820378 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.820396 read(14,  <unfinished ...>
[pid 25537] 10:12:37.820425 <... read resumed> "o\261\317\325\270H\251d\266}2\326\242\22\242\314#\325\334.\237\305\212\247~\0\360\36\350y\210\371", 32) = 32
[pid 25529] 10:12:37.820453 <... write resumed> ) = 190
[pid 25558] 10:12:37.820558 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25557] 10:12:37.820579 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.820615 open("/var/spool/exim/msglog/b/1aEJMb-0006e1-MY", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25544] 10:12:37.820675 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.820705 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25537] 10:12:37.821019 read(11,  <unfinished ...>
[pid 25529] 10:12:37.821052 close(16 <unfinished ...>
[pid 25558] 10:12:37.821089 read(11,  <unfinished ...>
[pid 25557] 10:12:37.821117 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.821135 <... open resumed> ) = 8
[pid 25544] 10:12:37.821152 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.821167 read(14,  <unfinished ...>
[pid 25537] 10:12:37.821198 <... read resumed> "\27\3\1\0@", 5) = 5
[pid 25529] 10:12:37.821217 <... close resumed> ) = 0
[pid 25558] 10:12:37.821244 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25557] 10:12:37.821262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.821305 fcntl(8, F_GETFL <unfinished ...>
[pid 25544] 10:12:37.821331 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25543] 10:12:37.821360 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25537] 10:12:37.821998 read(11,  <unfinished ...>
[pid 25529] 10:12:37.822040 munmap(0x7f21d3366000, 4096 <unfinished ...>
[pid 25558] 10:12:37.822083 close(11 <unfinished ...>
[pid 25557] 10:12:37.822109 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.822132 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25544] 10:12:37.822152 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.822167 brk(0x2119000 <unfinished ...>
[pid 25537] 10:12:37.822194 <... read resumed> "\233\373$\\;\177'\366\10\326\247\231\236\375\216\257\313\25\251_`c\303\256\33\203\213Z\323+\352\317\356\247\5\204y\270+\252\262\236ma>03\253%\324#\270>\335\17\253\353RS\372\n<\25I", 64) = 64
[pid 25529] 10:12:37.822252 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.822285 <... close resumed> ) = 0
[pid 25557] 10:12:37.822300 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.822338 fstat(8,  <unfinished ...>
[pid 25544] 10:12:37.822362 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25543] 10:12:37.822391 <... brk resumed> ) = 0x2119000
[pid 25537] 10:12:37.822649 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.822685 close(17 <unfinished ...>
[pid 25558] 10:12:37.822723 munmap(0x7f2e40b12000, 4096 <unfinished ...>
[pid 25557] 10:12:37.822750 <... open resumed> ) = 6
[pid 25545] 10:12:37.822767 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080190, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:37.822799 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.822824 read(14,  <unfinished ...>
[pid 25537] 10:12:37.822853 <... lseek resumed> ) = 19
[pid 25529] 10:12:37.822870 <... close resumed> ) = 0
[pid 25558] 10:12:37.822896 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.822910 read(6,  <unfinished ...>
[pid 25545] 10:12:37.822967 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.822996 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.823029 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25537] 10:12:37.823405 read(6,  <unfinished ...>
[pid 25529] 10:12:37.823446 munmap(0x7f21d3365000, 4096 <unfinished ...>
[pid 25558] 10:12:37.823494 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.823525 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.823551 <... mmap resumed> ) = 0x7f6d15b8e000
[pid 25544] 10:12:37.823568 <... open resumed> ) = 12
[pid 25543] 10:12:37.823582 read(14,  <unfinished ...>
[pid 25537] 10:12:37.823611 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25529] 10:12:37.823641 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.823670 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25557] 10:12:37.823686 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.823825 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:37.823851 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.823876 <... read resumed> "", 8192) = 0
[pid 25537] 10:12:37.823895 read(6,  <unfinished ...>
[pid 25529] 10:12:37.823919 close(13 <unfinished ...>
[pid 25558] 10:12:37.823956 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.823987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25545] 10:12:37.824021 <... lseek resumed> ) = 0
[pid 25544] 10:12:37.824042 <... ioctl resumed> , 0x7ffc53805730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.824058 close(14 <unfinished ...>
[pid 25537] 10:12:37.824085 <... read resumed> "", 8192) = 0
[pid 25529] 10:12:37.824102 <... close resumed> ) = 0
[pid 25558] 10:12:37.824129 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.824143 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.824175 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:37.824206 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.824229 <... close resumed> ) = 0
[pid 25537] 10:12:37.825046 alarm(300 <unfinished ...>
[pid 25529] 10:12:37.825089 munmap(0x7f21d3369000, 4096 <unfinished ...>
[pid 25558] 10:12:37.825131 read(10,  <unfinished ...>
[pid 25557] 10:12:37.825155 <... mmap resumed> ) = 0x7fc7a75df000
[pid 25545] 10:12:37.825172 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.825214 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.825230 read(13,  <unfinished ...>
[pid 25537] 10:12:37.825287 <... alarm resumed> ) = 0
[pid 25529] 10:12:37.825331 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.825361 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.825377 mprotect(0x7fc7a75e5000, 2093056, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.825412 write(8, "2015-12-30 10:12:37 Received from finest09@fin.finestweddingsites.com U=finest09 P=local S=2383 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\"\n", 148 <unfinished ...>
[pid 25544] 10:12:37.825449 read(12,  <unfinished ...>
[pid 25543] 10:12:37.825473 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25537] 10:12:37.825497 write(11, "\27\3\1\0 \376\2*\315\343\"\331\255]\253\262\215\3478\232\261\206\276s\266\2336\"\374\r\365\264sUID\367\27\3\1\f@\205\213^\375\217+\230a\3517\247\25o\32)~7\207\0059QP\276\0i\357\320\376\rb\373,\267\277X\26\17\233(\227s\7\370\356\240I\302\356\37\255\30/\346\231\255]D\261\300\220\310m\316O\332li\311\34\220]@:E}\254\0372\361\375Y4x\355..\250\234v\1\257\303\212A\240\35\263\205E\353\362\364\f\204\311\323\374\31\260j\261#\6\352\0f\307j\313\211\36\352(\34\323\263\231\3\202\245\210\353\366\30\276A,p\322\227\272\251\252p1\353\375D0\336n\230\230K\325\237\33\325\247\266\25\264#\305\262D\350e\245\212\373q\270E\222\325D\331\253\34\341\313p\344\252\254b\344me \271IS_\22P&\343\322 \353uGL\354w\365\211\236\r;\321\364"..., 3178 <unfinished ...>
[pid 25529] 10:12:37.826258 close(14 <unfinished ...>
[pid 25558] 10:12:37.826302 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.826328 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.826346 <... write resumed> ) = 148
[pid 25544] 10:12:37.826363 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25543] 10:12:37.826382 read(13,  <unfinished ...>
[pid 25537] 10:12:37.826719 <... write resumed> ) = 3178
[pid 25529] 10:12:37.826742 <... close resumed> ) = 0
[pid 25558] 10:12:37.826770 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.826790 mmap(0x7fc7a77e4000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25545] 10:12:37.826826 close(8 <unfinished ...>
[pid 25544] 10:12:37.826851 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.826874 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25537] 10:12:37.826894 alarm(0 <unfinished ...>
[pid 25529] 10:12:37.827661 munmap(0x7f21d3368000, 4096 <unfinished ...>
[pid 25558] 10:12:37.827707 read(10,  <unfinished ...>
[pid 25557] 10:12:37.827732 <... mmap resumed> ) = 0x7fc7a77e4000
[pid 25545] 10:12:37.827755 <... close resumed> ) = 0
[pid 25544] 10:12:37.827774 <... lseek resumed> ) = 878
[pid 25543] 10:12:37.827787 read(13,  <unfinished ...>
[pid 25537] 10:12:37.827815 <... alarm resumed> ) = 300
[pid 25529] 10:12:37.827834 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.827863 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.827878 close(6 <unfinished ...>
[pid 25545] 10:12:37.827936 munmap(0x7f6d15b8e000, 4096 <unfinished ...>
[pid 25544] 10:12:37.827964 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.827987 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25537] 10:12:37.828006 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25529] 10:12:37.828658 close(9 <unfinished ...>
[pid 25558] 10:12:37.828701 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25557] 10:12:37.828742 <... close resumed> ) = 0
[pid 25545] 10:12:37.828770 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.828793 <... lseek resumed> ) = 878
[pid 25543] 10:12:37.828808 brk(0x213a000 <unfinished ...>
[pid 25529] 10:12:37.828836 <... close resumed> ) = 0
[pid 25558] 10:12:37.828862 <... open resumed> ) = 11
[pid 25557] 10:12:37.828876 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.828910 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:37.828937 close(12 <unfinished ...>
[pid 25543] 10:12:37.828960 <... brk resumed> ) = 0x213a000
[pid 25529] 10:12:37.828974 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25558] 10:12:37.829057 alarm(60 <unfinished ...>
[pid 25557] 10:12:37.829083 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.829102 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.829145 <... close resumed> ) = 0
[pid 25543] 10:12:37.829161 read(13,  <unfinished ...>
[pid 25529] 10:12:37.829426 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.829458 <... alarm resumed> ) = 0
[pid 25557] 10:12:37.829473 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.829520 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:37.829547 read(11,  <unfinished ...>
[pid 25543] 10:12:37.829572 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25529] 10:12:37.829591 close(12 <unfinished ...>
[pid 25558] 10:12:37.830186 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25557] 10:12:37.830222 <... open resumed> ) = 6
[pid 25545] 10:12:37.830247 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:37.830283 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25543] 10:12:37.830303 read(13,  <unfinished ...>
[pid 25529] 10:12:37.830894 <... close resumed> ) = 0
[pid 25558] 10:12:37.830927 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.830942 read(6,  <unfinished ...>
[pid 25545] 10:12:37.830975 close(7 <unfinished ...>
[pid 25544] 10:12:37.831007 brk(0x20b2000 <unfinished ...>
[pid 25543] 10:12:37.831032 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25529] 10:12:37.831053 munmap(0x7f21d336a000, 4096 <unfinished ...>
[pid 25558] 10:12:37.831657 alarm(0 <unfinished ...>
[pid 25557] 10:12:37.831687 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.831714 <... close resumed> ) = 0
[pid 25544] 10:12:37.831735 <... brk resumed> ) = 0x20b2000
[pid 25543] 10:12:37.831750 brk(0x215b000 <unfinished ...>
[pid 25529] 10:12:37.831885 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.831915 <... alarm resumed> ) = 60
[pid 25557] 10:12:37.832011 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.832040 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25544] 10:12:37.832075 read(11,  <unfinished ...>
[pid 25543] 10:12:37.832100 <... brk resumed> ) = 0x215b000
[pid 25529] 10:12:37.832115 close(15 <unfinished ...>
[pid 25558] 10:12:37.832591 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25557] 10:12:37.832628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25545] 10:12:37.832661 <... open resumed> ) = 7
[pid 25544] 10:12:37.832678 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25543] 10:12:37.832696 read(13,  <unfinished ...>
[pid 25529] 10:12:37.833819 <... close resumed> ) = 0
[pid 25558] 10:12:37.833853 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:37.833900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.833932 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.833972 brk(0x20d3000 <unfinished ...>
[pid 25543] 10:12:37.834026 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25529] 10:12:37.834077 munmap(0x7f21d3367000, 4096 <unfinished ...>
[pid 25558] 10:12:37.834647 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.834685 <... mmap resumed> ) = 0x7fc7a8f34000
[pid 25545] 10:12:37.834707 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.834724 <... brk resumed> ) = 0x20d3000
[pid 25543] 10:12:37.834738 read(13,  <unfinished ...>
[pid 25529] 10:12:37.834889 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.834920 <... open resumed> ) = 13
[pid 25557] 10:12:37.834938 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.834968 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.834992 read(11,  <unfinished ...>
[pid 25543] 10:12:37.835016 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25529] 10:12:37.835035 close(11 <unfinished ...>
[pid 25558] 10:12:37.835447 fcntl(13, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.835541 <... mmap resumed> ) = 0x7fc7a72a9000
[pid 25545] 10:12:37.835567 <... fcntl resumed> ) = 0
[pid 25544] 10:12:37.835584 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25543] 10:12:37.835604 brk(0x217c000 <unfinished ...>
[pid 25529] 10:12:37.836562 <... close resumed> ) = 0
[pid 25558] 10:12:37.836595 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.836614 mprotect(0x7fc7a73d5000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.836645 fstat(7,  <unfinished ...>
[pid 25543] 10:12:37.836669 <... brk resumed> ) = 0x217c000
[pid 25529] 10:12:37.836683 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25558] 10:12:37.836995 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.837023 <... mprotect resumed> ) = 0
[pid 25545] 10:12:37.837040 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5386336, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.837072 read(13,  <unfinished ...>
[pid 25529] 10:12:37.837098 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.837124 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.837145 mmap(0x7fc7a75d5000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25545] 10:12:37.837177 write(7, "2015-12-30 10:12:37 [25545] 1aEJMb-0006e1-MY <= finest09@fin.finestweddingsites.com U=finest09 P=local S=2383 M8S=0 T=\"FinestWeddingSites.com - Interested Bride\" from <finest09@fin.finestweddingsites.com> for kgallagher@mcdowellmountaingc.com mcdowell-moun"..., 318 <unfinished ...>
[pid 25543] 10:12:37.837211 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25529] 10:12:37.837228 close(10 <unfinished ...>
[pid 25558] 10:12:37.837856 read(13,  <unfinished ...>
[pid 25557] 10:12:37.837886 <... mmap resumed> ) = 0x7fc7a75d5000
[pid 25545] 10:12:37.837909 <... write resumed> ) = 318
[pid 25543] 10:12:37.837929 read(13,  <unfinished ...>
[pid 25529] 10:12:37.837950 <... close resumed> ) = 0
[pid 25558] 10:12:37.837973 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25557] 10:12:37.838010 mmap(0x7fc7a75de000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25545] 10:12:37.838044 close(6 <unfinished ...>
[pid 25529] 10:12:37.838073 munmap(0x7f21d336c000, 4096 <unfinished ...>
[pid 25558] 10:12:37.838107 close(13 <unfinished ...>
[pid 25557] 10:12:37.838131 <... mmap resumed> ) = 0x7fc7a75de000
[pid 25545] 10:12:37.838154 <... close resumed> ) = 0
[pid 25529] 10:12:37.838173 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.838208 <... close resumed> ) = 0
[pid 25557] 10:12:37.838241 close(6 <unfinished ...>
[pid 25545] 10:12:37.838267 munmap(0x7f6d15b8f000, 4096 <unfinished ...>
[pid 25529] 10:12:37.838300 open("/var/spool/exim/input/b/1aEJMb-0006df-04-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25558] 10:12:37.838377 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.838418 <... close resumed> ) = 0
[pid 25545] 10:12:37.838449 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.838472 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25529] 10:12:37.838590 <... open resumed> ) = 9
[pid 25558] 10:12:37.838870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.838899 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.838938 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25543] 10:12:37.838969 brk(0x219d000 <unfinished ...>
[pid 25529] 10:12:37.838990 fcntl(9, F_GETFD <unfinished ...>
[pid 25558] 10:12:37.839020 stat("/var/tmp",  <unfinished ...>
[pid 25557] 10:12:37.839052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.839070 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, 8) = 0
[pid 25529] 10:12:37.839091 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.839117 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25557] 10:12:37.839340 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.839458 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0},  <unfinished ...>
[pid 25529] 10:12:37.839558 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.839592 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.839855 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.839884 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f6d1378f6a0}, 8) = 0
[pid 25529] 10:12:37.839908 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.839934 <... open resumed> ) = 13
[pid 25557] 10:12:37.839951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.839986 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.840024 brk(0x20f4000 <unfinished ...>
[pid 25529] 10:12:37.840045 fchown(9, 47, 12 <unfinished ...>
[pid 25558] 10:12:37.840088 fcntl(13, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.840122 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25545] 10:12:37.840143 <... open resumed> ) = 6
[pid 25543] 10:12:37.840164 <... brk resumed> ) = 0x219d000
[pid 25529] 10:12:37.840179 <... fchown resumed> ) = 0
[pid 25558] 10:12:37.840546 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.840575 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25545] 10:12:37.840613 read(6,  <unfinished ...>
[pid 25529] 10:12:37.840643 fchmod(9, 0640 <unfinished ...>
[pid 25558] 10:12:37.840677 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.840701 <... open resumed> ) = 6
[pid 25545] 10:12:37.840717 <... read resumed> "0.18 0.08 0.01 4/254 25558\n", 40) = 27
[pid 25529] 10:12:37.840736 <... fchmod resumed> ) = 0
[pid 25558] 10:12:37.840789 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.840811 read(6,  <unfinished ...>
[pid 25545] 10:12:37.840835 close(6 <unfinished ...>
[pid 25529] 10:12:37.840864 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25558] 10:12:37.840907 fstat(13,  <unfinished ...>
[pid 25557] 10:12:37.840931 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25545] 10:12:37.840955 <... close resumed> ) = 0
[pid 25529] 10:12:37.840983 <... open resumed> ) = 10
[pid 25558] 10:12:37.841013 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:37.841076 fstat(6,  <unfinished ...>
[pid 25545] 10:12:37.841103 clone( <unfinished ...>
[pid 25544] 10:12:37.841400 <... brk resumed> ) = 0x20f4000
[pid 25529] 10:12:37.841421 alarm(60 <unfinished ...>
[pid 25558] 10:12:37.841459 pread(13,  <unfinished ...>
[pid 25557] 10:12:37.841554 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.841591 <... alarm resumed> ) = 0
[pid 25558] 10:12:37.841614 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25557] 10:12:37.841667 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25545] 10:12:37.841703 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f6d15b79a90) = 25559
[pid 25529] 10:12:37.841958 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25558] 10:12:37.841999 pread(13,  <unfinished ...>
[pid 25557] 10:12:37.842024 <... mmap resumed> ) = 0x7fc7a70a5000
[pid 25545] 10:12:37.842041 exit_group(0) = ?
[pid 25529] 10:12:37.842309 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.842364 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25557] 10:12:37.842413 mprotect(0x7fc7a70a7000, 2097152, PROT_NONE <unfinished ...>
[pid 25545] 10:12:37.842445 +++ exited with 0 +++
[pid 25529] 10:12:37.842458 alarm(0 <unfinished ...>
[pid 25389] 10:12:37.843069 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25545
[pid 25558] 10:12:37.843118 close(13 <unfinished ...>
[pid 25557] 10:12:37.843147 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.843164 read(11,  <unfinished ...>
[pid 25543] 10:12:37.843190 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.843213 <... alarm resumed> ) = 60
[pid 25389] 10:12:37.843260 munmap(0x7ff3d4f3d000, 4096 <unfinished ...>
[pid 25558] 10:12:37.843306 <... close resumed> ) = 0
[pid 25557] 10:12:37.843352 mmap(0x7fc7a72a7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25544] 10:12:37.843401 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25529] 10:12:37.843422 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25389] 10:12:37.843452 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.843808 close(11 <unfinished ...>
[pid 25557] 10:12:37.843845 <... mmap resumed> ) = 0x7fc7a72a7000
[pid 25529] 10:12:37.843871 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25389] 10:12:37.843910 read(3,  <unfinished ...>
[pid 25558] 10:12:37.843948 <... close resumed> ) = 0
[pid 25557] 10:12:37.843991 close(6 <unfinished ...>
[pid 25529] 10:12:37.844018 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25389] 10:12:37.844049 <... read resumed> "ngsites.com, style_grand-ballroom_teri@finestweddingsites.com\nstyle_grand-ballroom.php = tracy.thompson@hilton.com, hiltongardeninn@finestweddingsites.com\nstyle_grand-ballroom.php = awhitsett@wigwamarizona.com, wigwamarizona@finestweddingsites.com \nstyle_g"..., 8192) = 2335
[pid 25558] 10:12:37.844183 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25557] 10:12:37.844219 <... close resumed> ) = 0
[pid 25529] 10:12:37.844244 <... open resumed> ) = 11
[pid 25389] 10:12:37.844262 read(3,  <unfinished ...>
[pid 25558] 10:12:37.844293 <... socket resumed> ) = 11
[pid 25557] 10:12:37.844318 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.844358 fcntl(11, F_GETFD <unfinished ...>
[pid 25389] 10:12:37.844382 <... read resumed> "", 8192) = 0
[pid 25558] 10:12:37.844437 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25557] 10:12:37.844468 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.844553 <... fcntl resumed> ) = 0
[pid 25389] 10:12:37.844576 close(3 <unfinished ...>
[pid 25558] 10:12:37.844606 <... setsockopt resumed> ) = 0
[pid 25557] 10:12:37.844636 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.844687 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25389] 10:12:37.844712 <... close resumed> ) = 0
[pid 25558] 10:12:37.844763 alarm(300 <unfinished ...>
[pid 25557] 10:12:37.844791 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.844815 <... fcntl resumed> ) = 0
[pid 25389] 10:12:37.844833 write(1, "X-Powered-By: PHP/5.2.17", 24 <unfinished ...>
[pid 25558] 10:12:37.844906 <... alarm resumed> ) = 0
[pid 25557] 10:12:37.844930 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.845016 read(11,  <unfinished ...>
[pid 25389] 10:12:37.845047 <... write resumed> ) = 24
[pid 25558] 10:12:37.845072 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("98.129.185.131")}, 16 <unfinished ...>
[pid 25557] 10:12:37.845136 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.845158 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25389] 10:12:37.845186 write(1, "\r\n", 2 <unfinished ...>
[pid 25557] 10:12:37.845233 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.845267 close(11 <unfinished ...>
[pid 25389] 10:12:37.845291 <... write resumed> ) = 2
[pid 25557] 10:12:37.845315 <... open resumed> ) = 6
[pid 25529] 10:12:37.845331 <... close resumed> ) = 0
[pid 25389] 10:12:37.845354 write(1, "Content-type: text/html", 23 <unfinished ...>
[pid 25557] 10:12:37.845394 read(6,  <unfinished ...>
[pid 25529] 10:12:37.845418 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25389] 10:12:37.845446 <... write resumed> ) = 23
[pid 25557] 10:12:37.845471 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.846381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25389] 10:12:37.846413 write(1, "\r\n", 2 <unfinished ...>
[pid 25557] 10:12:37.846483 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.846510 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.846533 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.846549 stat("/var/tmp",  <unfinished ...>
[pid 25389] 10:12:37.846579 <... write resumed> ) = 2
[pid 25557] 10:12:37.846603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25529] 10:12:37.846636 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25389] 10:12:37.846760 write(1, "\r\n", 2 <unfinished ...>
[pid 25557] 10:12:37.846867 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25529] 10:12:37.846902 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25389] 10:12:37.846935 <... write resumed> ) = 2
[pid 25557] 10:12:37.846959 <... mmap resumed> ) = 0x7fc7a6ea2000
[pid 25529] 10:12:37.846977 <... open resumed> ) = 11
[pid 25389] 10:12:37.846994 write(1, "Mail Sent", 9 <unfinished ...>
[pid 25557] 10:12:37.847096 mprotect(0x7fc7a6ea4000, 2093056, PROT_NONE <unfinished ...>
[pid 25529] 10:12:37.847136 fcntl(11, F_GETFD <unfinished ...>
[pid 25389] 10:12:37.847160 <... write resumed> ) = 9
[pid 25557] 10:12:37.847353 <... mprotect resumed> ) = 0
[pid 25529] 10:12:37.847376 <... fcntl resumed> ) = 0
[pid 25389] 10:12:37.847392 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff3cff416a0},  <unfinished ...>
[pid 25557] 10:12:37.847429 mmap(0x7fc7a70a3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25529] 10:12:37.847460 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25389] 10:12:37.847565 <... rt_sigaction resumed> {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff3cff416a0}, 8) = 0
[pid 25557] 10:12:37.847607 <... mmap resumed> ) = 0x7fc7a70a3000
[pid 25529] 10:12:37.847636 <... fcntl resumed> ) = 0
[pid 25389] 10:12:37.847655 sendto(4, "\1\0\0\0\1", 5, 0, NULL, 0 <unfinished ...>
[pid 25557] 10:12:37.847776 close(6 <unfinished ...>
[pid 25529] 10:12:37.847802 fstat(11,  <unfinished ...>
[pid 25389] 10:12:37.847825 <... sendto resumed> ) = 5
[pid 25557] 10:12:37.847856 <... close resumed> ) = 0
[pid 25529] 10:12:37.847883 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25389] 10:12:37.847931 shutdown(4, SHUT_RDWR <unfinished ...>
[pid 25557] 10:12:37.847963 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.847995 pread(11,  <unfinished ...>
[pid 25389] 10:12:37.848020 <... shutdown resumed> ) = 0
[pid 25557] 10:12:37.848042 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.848060 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25389] 10:12:37.848098 close(4 <unfinished ...>
[pid 25557] 10:12:37.848131 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.848165 pread(11,  <unfinished ...>
[pid 25389] 10:12:37.848190 <... close resumed> ) = 0
[pid 25557] 10:12:37.848249 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.848269 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25389] 10:12:37.848301 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff3cff416a0},  <unfinished ...>
[pid 25557] 10:12:37.848336 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.848376 close(11 <unfinished ...>
[pid 25389] 10:12:37.848409 <... rt_sigaction resumed> {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff3cff416a0}, 8) = 0
[pid 25557] 10:12:37.848466 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.848573 <... close resumed> ) = 0
[pid 25389] 10:12:37.848613 setitimer(ITIMER_PROF, {it_interval={0, 0}, it_value={0, 0}},  <unfinished ...>
[pid 25557] 10:12:37.848657 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.848691 close(10 <unfinished ...>
[pid 25389] 10:12:37.848719 <... setitimer resumed> NULL) = 0
[pid 25557] 10:12:37.848891 <... open resumed> ) = 6
[pid 25529] 10:12:37.848912 <... close resumed> ) = 0
[pid 25491] 10:12:37.848946 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25389] 10:12:37.848970 munmap(0x7ff3cdbb4000, 2124576 <unfinished ...>
[pid 25557] 10:12:37.849016 read(6,  <unfinished ...>
[pid 25529] 10:12:37.849040 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.849070 recvfrom(16,  <unfinished ...>
[pid 25389] 10:12:37.849097 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.849141 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25529] 10:12:37.849169 <... open resumed> ) = 10
[pid 25491] 10:12:37.849187 <... recvfrom resumed> "\333(\201\200\0\1\0\2\0\0\0\0\tncghotels\3com\tinbound10\7mxlogic\3net\0\0\1\0\1\300\f\0\1\0\1\0\0T_\0\4\320A\221\3\300\f\0\1\0\1\0\0T_\0\4\320A\220\3", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 85
[pid 25389] 10:12:37.849217 munmap(0x7ff3cddbb000, 2538648 <unfinished ...>
[pid 25557] 10:12:37.849265 fstat(6,  <unfinished ...>
[pid 25529] 10:12:37.849289 fstat(10,  <unfinished ...>
[pid 25491] 10:12:37.849312 close(16 <unfinished ...>
[pid 25389] 10:12:37.849344 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.849462 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.849577 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.849597 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.849628 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.849662 <... close resumed> ) = 0
[pid 25389] 10:12:37.849763 munmap(0x7ff3ce027000, 2477728 <unfinished ...>
[pid 25557] 10:12:37.849823 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.849852 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.849880 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.849895 fstat(10,  <unfinished ...>
[pid 25491] 10:12:37.849927 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25389] 10:12:37.849955 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.850009 <... mmap resumed> ) = 0x7fc7a8f33000
[pid 25544] 10:12:37.850034 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.850049 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.850083 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.850112 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25389] 10:12:37.850163 munmap(0x7ff3ce284000, 2198648 <unfinished ...>
[pid 25557] 10:12:37.850214 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.850245 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.850270 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.850285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.850314 open("/etc/passwd", O_RDONLY <unfinished ...>
[pid 25389] 10:12:37.850343 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.852698 <... mmap resumed> ) = 0x7fc7a6b0e000
[pid 25544] 10:12:37.852730 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.852748 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.852778 <... mmap resumed> ) = 0x7f21d336d000
[pid 25491] 10:12:37.852796 <... open resumed> ) = 16
[pid 25389] 10:12:37.852816 munmap(0x7ff3ce74b000, 2189792 <unfinished ...>
[pid 25557] 10:12:37.852890 mprotect(0x7fc7a6c98000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.852919 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.852945 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.852960 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.852991 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25389] 10:12:37.853017 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.853054 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.853073 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.853088 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.853121 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.853140 <... ioctl resumed> , 0x7ffc86159f70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25389] 10:12:37.853159 munmap(0x7ff3ce49d000, 2808944 <unfinished ...>
[pid 25557] 10:12:37.853256 mmap(0x7fc7a6e98000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25544] 10:12:37.853288 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.853316 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.853332 read(10,  <unfinished ...>
[pid 25491] 10:12:37.853364 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25389] 10:12:37.853389 <... munmap resumed> ) = 0
[pid 25558] 10:12:37.854281 <... connect resumed> ) = 0
[pid 25557] 10:12:37.854311 <... mmap resumed> ) = 0x7fc7a6e98000
[pid 25544] 10:12:37.854337 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.854354 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.854386 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:37.854440 <... lseek resumed> ) = 0
[pid 25389] 10:12:37.854463 exit_group(0) = ?
[pid 25558] 10:12:37.854536 alarm(0 <unfinished ...>
[pid 25557] 10:12:37.855675 mmap(0x7fc7a6e9d000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.855718 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.855751 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.855772 pipe( <unfinished ...>
[pid 25491] 10:12:37.855812 fstat(16,  <unfinished ...>
[pid 25558] 10:12:37.855849 <... alarm resumed> ) = 300
[pid 25557] 10:12:37.855875 <... mmap resumed> ) = 0x7fc7a6e9d000
[pid 25544] 10:12:37.855900 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.855918 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.855967 <... pipe resumed> [11, 12]) = 0
[pid 25491] 10:12:37.855988 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25389] 10:12:37.856019 +++ exited with 0 +++
[pid 25558] 10:12:37.856040 getsockname(11,  <unfinished ...>
[pid 25557] 10:12:37.856064 close(6 <unfinished ...>
[pid 25544] 10:12:37.856087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.856116 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.856131 close(10 <unfinished ...>
[pid 25491] 10:12:37.856158 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.856191 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(52863), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25557] 10:12:37.856223 <... close resumed> ) = 0
[pid 25544] 10:12:37.856252 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.856268 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25529] 10:12:37.856300 <... close resumed> ) = 0
[pid 25491] 10:12:37.856317 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.856355 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25557] 10:12:37.856386 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.856418 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.856446 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.856461 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25491] 10:12:37.856568 read(16,  <unfinished ...>
[pid 25558] 10:12:37.856606 <... setsockopt resumed> ) = 0
[pid 25557] 10:12:37.856629 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.856647 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.856662 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25529] 10:12:37.856697 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.856723 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25558] 10:12:37.856935 stat("/etc/mailhelo",  <unfinished ...>
[pid 25557] 10:12:37.856970 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.857005 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.857034 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.857050 clone( <unfinished ...>
[pid 25491] 10:12:37.857348 close(16 <unfinished ...>
[pid 25558] 10:12:37.857385 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.857427 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.857447 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.857462 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25491] 10:12:37.857491 <... close resumed> ) = 0
[pid 25558] 10:12:37.857540 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.857580 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.857611 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25560
[pid 25491] 10:12:37.857650 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25558] 10:12:37.857698 <... open resumed> ) = 13
[pid 25557] 10:12:37.857717 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:37.857738 close(12 <unfinished ...>
[pid 25491] 10:12:37.857762 <... open resumed> ) = 16
[pid 25558] 10:12:37.857785 fstat(13,  <unfinished ...>
[pid 25557] 10:12:37.857809 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.857842 <... close resumed> ) = 0
[pid 25491] 10:12:37.857858 alarm(60 <unfinished ...>
[pid 25558] 10:12:37.857890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.857923 <... open resumed> ) = 6
[pid 25529] 10:12:37.857941 read(11,  <unfinished ...>
[pid 25491] 10:12:37.857963 <... alarm resumed> ) = 0
[pid 25558] 10:12:37.857985 fstat(13,  <unfinished ...>
[pid 25557] 10:12:37.858009 read(6,  <unfinished ...>
[pid 25491] 10:12:37.858033 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25558] 10:12:37.858067 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.858094 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.858119 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.858141 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.858169 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.858193 alarm(0 <unfinished ...>
[pid 25558] 10:12:37.858222 <... mmap resumed> ) = 0x7f2e40b12000
[pid 25557] 10:12:37.858239 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25491] 10:12:37.858269 <... alarm resumed> ) = 60
[pid 25558] 10:12:37.858304 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.858331 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:37.858362 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.858405 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.858423 <... mmap resumed> ) = 0x7fc7a68a2000
[pid 25491] 10:12:37.858440 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.858463 read(13,  <unfinished ...>
[pid 25557] 10:12:37.858635 mprotect(0x7fc7a6904000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.858666 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.858714 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.858753 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.858774 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.858803 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.858818 <... open resumed> ) = 17
[pid 25558] 10:12:37.858841 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.858866 mmap(0x7fc7a6b03000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25491] 10:12:37.858898 read(17,  <unfinished ...>
[pid 25558] 10:12:37.858952 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.858969 <... mmap resumed> ) = 0x7fc7a6b03000
[pid 25491] 10:12:37.858996 <... read resumed> "cpu  123093 1342474 395275 67343100 2509 0 0 0\ncpu0 123093 1342474 395275 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58591797\nbtime 1450798266\nprocesses 893038\nprocs_running 6\nprocs_blocked 0\n", 8192) = 191
[pid 25558] 10:12:37.859026 read(13,  <unfinished ...>
[pid 25557] 10:12:37.859050 close(6 <unfinished ...>
[pid 25491] 10:12:37.859074 close(17 <unfinished ...>
[pid 25558] 10:12:37.859107 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.859172 <... close resumed> ) = 0
[pid 25491] 10:12:37.859206 <... close resumed> ) = 0
[pid 25558] 10:12:37.859247 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.859275 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.859307 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25558] 10:12:37.859342 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.859360 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.859379 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25558] 10:12:37.859417 read(13,  <unfinished ...>
[pid 25557] 10:12:37.859441 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.859568 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.859611 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.859631 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.859649 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.859665 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25491] 10:12:37.859687 <... open resumed> ) = 17
[pid 25558] 10:12:37.859709 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.859733 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.859763 fcntl(17, F_GETFD <unfinished ...>
[pid 25558] 10:12:37.859792 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.859809 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.859829 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.859851 read(13,  <unfinished ...>
[pid 25557] 10:12:37.859875 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.859906 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25558] 10:12:37.859936 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.859969 <... open resumed> ) = 6
[pid 25491] 10:12:37.859988 <... fcntl resumed> ) = 0
[pid 25558] 10:12:37.860011 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:37.860042 read(6,  <unfinished ...>
[pid 25491] 10:12:37.860066 read(17,  <unfinished ...>
[pid 25557] 10:12:37.860095 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.860125 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25557] 10:12:37.860157 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.860182 close(17 <unfinished ...>
[pid 25557] 10:12:37.860211 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25491] 10:12:37.860242 <... close resumed> ) = 0
[pid 25557] 10:12:37.860268 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:37.860301 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.860337 <... mmap resumed> ) = 0x7fc7a64bf000
[pid 25491] 10:12:37.860354 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.860378 mprotect(0x7fc7a6678000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.860406 stat("/var/tmp",  <unfinished ...>
[pid 25557] 10:12:37.860441 <... mprotect resumed> ) = 0
[pid 25491] 10:12:37.860457 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25557] 10:12:37.860596 mmap(0x7fc7a6877000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25491] 10:12:37.860634 brk(0x181d000 <unfinished ...>
[pid 25557] 10:12:37.860663 <... mmap resumed> ) = 0x7fc7a6877000
[pid 25491] 10:12:37.860685 <... brk resumed> ) = 0x181d000
[pid 25557] 10:12:37.860815 mmap(0x7fc7a689e000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.860849 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.860886 <... mmap resumed> ) = 0x7fc7a689e000
[pid 25491] 10:12:37.860909 <... open resumed> ) = 17
[pid 25557] 10:12:37.860931 close(6 <unfinished ...>
[pid 25491] 10:12:37.860955 fcntl(17, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.860982 <... close resumed> ) = 0
[pid 25491] 10:12:37.861006 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.861028 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.861060 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.861087 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.861105 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.861126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.861159 fstat(17,  <unfinished ...>
[pid 25557] 10:12:37.861187 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.861204 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:37.861251 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.861285 pread(17,  <unfinished ...>
[pid 25557] 10:12:37.861314 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.861339 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25557] 10:12:37.861391 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.861432 pread(17,  <unfinished ...>
[pid 25557] 10:12:37.861462 <... open resumed> ) = 6
[pid 25491] 10:12:37.861551 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25557] 10:12:37.861602 read(6,  <unfinished ...>
[pid 25491] 10:12:37.861631 pread(17,  <unfinished ...>
[pid 25557] 10:12:37.861660 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.861683 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25557] 10:12:37.861733 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.861762 close(17 <unfinished ...>
[pid 25557] 10:12:37.861790 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25491] 10:12:37.861821 <... close resumed> ) = 0
[pid 25557] 10:12:37.861861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.861893 close(16 <unfinished ...>
[pid 25557] 10:12:37.861924 <... mmap resumed> ) = 0x7fc7a8f32000
[pid 25491] 10:12:37.861945 <... close resumed> ) = 0
[pid 25557] 10:12:37.861976 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:37.862008 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.862037 <... mmap resumed> ) = 0x7fc7a6292000
[pid 25491] 10:12:37.862054 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.862075 mprotect(0x7fc7a62be000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.862103 read(13,  <unfinished ...>
[pid 25557] 10:12:37.862133 <... mprotect resumed> ) = 0
[pid 25491] 10:12:37.862149 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25557] 10:12:37.862194 mmap(0x7fc7a64be000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25491] 10:12:37.862228 stat("/jail_owner",  <unfinished ...>
[pid 25557] 10:12:37.862260 <... mmap resumed> ) = 0x7fc7a64be000
[pid 25491] 10:12:37.862283 <... stat resumed> 0x7ffc86158950) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.862318 close(6 <unfinished ...>
[pid 25491] 10:12:37.862365 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25557] 10:12:37.862417 <... close resumed> ) = 0
[pid 25491] 10:12:37.862446 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25557] 10:12:37.862592 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.862636 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25557] 10:12:37.862671 <... open resumed> ) = 6
[pid 25491] 10:12:37.862687 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.862716 read(6,  <unfinished ...>
[pid 25491] 10:12:37.862742 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25557] 10:12:37.862775 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.862799 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25557] 10:12:37.862837 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.862863 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck",  <unfinished ...>
[pid 25557] 10:12:37.862896 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25491] 10:12:37.862926 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.862953 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:37.862985 stat("/etc/demouids",  <unfinished ...>
[pid 25557] 10:12:37.863017 <... mmap resumed> ) = 0x7fc7a608d000
[pid 25491] 10:12:37.863033 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.863081 mprotect(0x7fc7a6092000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.863111 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25557] 10:12:37.863146 <... mprotect resumed> ) = 0
[pid 25491] 10:12:37.863162 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25557] 10:12:37.863269 mmap(0x7fc7a6291000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25491] 10:12:37.863307 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.863340 <... mmap resumed> ) = 0x7fc7a6291000
[pid 25491] 10:12:37.863363 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25558] 10:12:37.863424 <... select resumed> ) = 1 (in [11], left {299, 996649})
[pid 25557] 10:12:37.863453 close(6 <unfinished ...>
[pid 25491] 10:12:37.863563 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25558] 10:12:37.863607 recvfrom(11,  <unfinished ...>
[pid 25557] 10:12:37.863633 <... close resumed> ) = 0
[pid 25491] 10:12:37.863660 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25558] 10:12:37.863705 <... recvfrom resumed> "220 mx1.emailsrvr.com ESMTP - VA Code Section 18.2-152.3:1 forbids sending spam through this system\r\n", 4096, 0, NULL, NULL) = 101
[pid 25557] 10:12:37.863742 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.863778 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25558] 10:12:37.863813 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25557] 10:12:37.863862 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.863882 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25558] 10:12:37.863926 <... sendto resumed> ) = 33
[pid 25557] 10:12:37.863946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.863980 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.864022 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:37.864050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.864068 <... open resumed> ) = 16
[pid 25557] 10:12:37.864090 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.864121 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.864148 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.864168 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.864204 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.864235 fstat(16,  <unfinished ...>
[pid 25557] 10:12:37.864263 <... open resumed> ) = 6
[pid 25491] 10:12:37.864279 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.864310 read(6,  <unfinished ...>
[pid 25491] 10:12:37.864338 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.864369 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.864399 <... mmap resumed> ) = 0x7f33164f3000
[pid 25557] 10:12:37.864421 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.864445 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.864566 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25491] 10:12:37.864610 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.864635 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.864667 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25543] 10:12:37.864690 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.864706 read(16,  <unfinished ...>
[pid 25557] 10:12:37.864738 <... mmap resumed> ) = 0x7fc7a5e8a000
[pid 25491] 10:12:37.864756 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25557] 10:12:37.864819 mprotect(0x7fc7a5e8c000, 2093056, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.864854 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize",  <unfinished ...>
[pid 25557] 10:12:37.864891 <... mprotect resumed> ) = 0
[pid 25491] 10:12:37.864908 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4144, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:37.864958 mmap(0x7fc7a608b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25491] 10:12:37.864993 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.865030 <... mmap resumed> ) = 0x7fc7a608b000
[pid 25491] 10:12:37.865056 <... open resumed> ) = 17
[pid 25557] 10:12:37.865081 close(6 <unfinished ...>
[pid 25491] 10:12:37.865106 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:37.865136 <... close resumed> ) = 0
[pid 25491] 10:12:37.865162 <... ioctl resumed> , 0x7ffc861558f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:37.865186 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.865218 lseek(17, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:37.865246 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.865264 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.865286 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.865321 fstat(17,  <unfinished ...>
[pid 25557] 10:12:37.865349 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.865366 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4144, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:37.865399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.865429 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.865463 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.865561 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.865595 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.865632 read(17,  <unfinished ...>
[pid 25557] 10:12:37.865662 <... open resumed> ) = 6
[pid 25491] 10:12:37.865679 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4144
[pid 25557] 10:12:37.866403 read(6,  <unfinished ...>
[pid 25491] 10:12:37.866435 read(17,  <unfinished ...>
[pid 25557] 10:12:37.866462 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25491] 10:12:37.866607 <... read resumed> "", 8192) = 0
[pid 25557] 10:12:37.866637 fstat(6,  <unfinished ...>
[pid 25491] 10:12:37.866664 close(17 <unfinished ...>
[pid 25557] 10:12:37.866693 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25491] 10:12:37.866731 <... close resumed> ) = 0
[pid 25557] 10:12:37.866778 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.866812 stat("/etc/userdomains",  <unfinished ...>
[pid 25557] 10:12:37.866844 <... mmap resumed> ) = 0x7fc7a8f31000
[pid 25491] 10:12:37.866865 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:37.866916 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25491] 10:12:37.866949 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.866983 <... mmap resumed> ) = 0x7fc7a5c67000
[pid 25491] 10:12:37.866999 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25557] 10:12:37.867039 mprotect(0x7fc7a5c7e000, 2097152, PROT_NONE <unfinished ...>
[pid 25491] 10:12:37.867068 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.867098 <... mprotect resumed> ) = 0
[pid 25491] 10:12:37.867115 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25557] 10:12:37.867170 mmap(0x7fc7a5e7e000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25491] 10:12:37.867206 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:37.867241 <... mmap resumed> ) = 0x7fc7a5e7e000
[pid 25491] 10:12:37.867269 <... open resumed> ) = 17
[pid 25557] 10:12:37.867298 close(6 <unfinished ...>
[pid 25543] 10:12:37.867323 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25491] 10:12:37.867356 fstat(17, Process 25559 attached
 <unfinished ...>
[pid 25557] 10:12:37.867458 <... close resumed> ) = 0
[pid 25544] 10:12:37.867574 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.867596 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.867620 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:37.867659 set_robust_list(0x7f6d15b79aa0, 24 <unfinished ...>
[pid 25557] 10:12:37.867683 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.867714 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25543] 10:12:37.867743 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25491] 10:12:37.867773 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.867808 <... set_robust_list resumed> ) = 0
[pid 25557] 10:12:37.867822 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.867862 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25543] 10:12:37.867891 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.867913 <... mmap resumed> ) = 0x7f33164f2000
[pid 25559] 10:12:37.867938 close(0 <unfinished ...>
[pid 25557] 10:12:37.867965 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.867998 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.868029 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25491] 10:12:37.868059 read(17,  <unfinished ...>
[pid 25559] 10:12:37.868094 <... close resumed> ) = 0
[pid 25557] 10:12:37.868108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.868127 <... open resumed> ) = 12
[pid 25543] 10:12:37.868141 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:37.868176 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:37.868217 close(1 <unfinished ...>
[pid 25557] 10:12:37.868462 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.868577 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.868603 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.868635 close(17 <unfinished ...>
[pid 25559] 10:12:37.868668 <... close resumed> ) = 0
[pid 25557] 10:12:37.868682 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.868704 <... ioctl resumed> , 0x7ffc53805730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.868719 <... open resumed> ) = 14
[pid 25491] 10:12:37.868741 <... close resumed> ) = 0
[pid 25559] 10:12:37.868766 close(2 <unfinished ...>
[pid 25557] 10:12:37.868792 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.868831 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.868854 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:37.868878 munmap(0x7f33164f2000, 4096 <unfinished ...>
[pid 25559] 10:12:37.868915 <... close resumed> ) = 0
[pid 25557] 10:12:37.868929 <... open resumed> ) = 6
[pid 25544] 10:12:37.869005 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.869020 <... ioctl resumed> , 0x7ffcdc2443a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25491] 10:12:37.869075 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.869116 setsid( <unfinished ...>
[pid 25557] 10:12:37.869142 read(6,  <unfinished ...>
[pid 25544] 10:12:37.869166 read(12,  <unfinished ...>
[pid 25543] 10:12:37.869191 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:37.869214 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.869252 <... setsid resumed> ) = 25559
[pid 25557] 10:12:37.869265 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.869295 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25543] 10:12:37.869314 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.869567 <... open resumed> ) = 17
[pid 25559] 10:12:37.869605 fstat(0,  <unfinished ...>
[pid 25557] 10:12:37.869629 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.869653 brk(0x2115000 <unfinished ...>
[pid 25543] 10:12:37.869677 read(14,  <unfinished ...>
[pid 25491] 10:12:37.869702 fstat(17,  <unfinished ...>
[pid 25559] 10:12:37.869732 <... fstat resumed> 0x7fffd44b7100) = -1 EBADF (Bad file descriptor)
[pid 25557] 10:12:37.869747 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.869786 <... brk resumed> ) = 0x2115000
[pid 25543] 10:12:37.869801 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25491] 10:12:37.870618 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:37.870676 open("/dev/null", O_RDWR <unfinished ...>
[pid 25557] 10:12:37.870717 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.870750 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.870774 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.870797 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.870831 <... open resumed> ) = 0
[pid 25557] 10:12:37.870845 <... mmap resumed> ) = 0x7fc7a5a23000
[pid 25544] 10:12:37.870866 <... lseek resumed> ) = 4868
[pid 25543] 10:12:37.870880 <... lseek resumed> ) = 878
[pid 25491] 10:12:37.870899 <... mmap resumed> ) = 0x7f33164f2000
[pid 25559] 10:12:37.870930 fstat(1,  <unfinished ...>
[pid 25557] 10:12:37.870953 mprotect(0x7fc7a5a64000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.870982 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.871004 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:37.871027 read(17,  <unfinished ...>
[pid 25559] 10:12:37.871062 <... fstat resumed> 0x7fffd44b7100) = -1 EBADF (Bad file descriptor)
[pid 25557] 10:12:37.871077 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.871104 <... lseek resumed> ) = 4868
[pid 25543] 10:12:37.871118 <... lseek resumed> ) = 878
[pid 25491] 10:12:37.871137 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:37.871177 dup2(0, 1 <unfinished ...>
[pid 25557] 10:12:37.871201 mmap(0x7fc7a5c64000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25544] 10:12:37.871232 close(12 <unfinished ...>
[pid 25543] 10:12:37.871256 close(14 <unfinished ...>
[pid 25491] 10:12:37.871280 close(17 <unfinished ...>
[pid 25559] 10:12:37.871311 <... dup2 resumed> ) = 1
[pid 25557] 10:12:37.871325 <... mmap resumed> ) = 0x7fc7a5c64000
[pid 25544] 10:12:37.871352 <... close resumed> ) = 0
[pid 25543] 10:12:37.871369 <... close resumed> ) = 0
[pid 25491] 10:12:37.871641 <... close resumed> ) = 0
[pid 25559] 10:12:37.871684 fstat(2,  <unfinished ...>
[pid 25557] 10:12:37.871710 close(6 <unfinished ...>
[pid 25544] 10:12:37.871736 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25543] 10:12:37.871764 read(13,  <unfinished ...>
[pid 25491] 10:12:37.871792 munmap(0x7f33164f2000, 4096 <unfinished ...>
[pid 25559] 10:12:37.871828 <... fstat resumed> 0x7fffd44b7100) = -1 EBADF (Bad file descriptor)
[pid 25557] 10:12:37.871844 <... close resumed> ) = 0
[pid 25544] 10:12:37.871872 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.871889 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25491] 10:12:37.872372 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.872420 dup2(0, 2 <unfinished ...>
[pid 25557] 10:12:37.872448 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.872569 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25543] 10:12:37.872602 brk(0x21be000 <unfinished ...>
[pid 25491] 10:12:37.872627 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:37.872664 <... dup2 resumed> ) = 2
[pid 25557] 10:12:37.872677 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.872697 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.872713 <... brk resumed> ) = 0x21be000
[pid 25491] 10:12:37.872735 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:37.872881 geteuid( <unfinished ...>
[pid 25557] 10:12:37.872909 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.872944 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25543] 10:12:37.872970 read(13,  <unfinished ...>
[pid 25491] 10:12:37.872996 pipe( <unfinished ...>
[pid 25559] 10:12:37.873040 <... geteuid resumed> ) = 47
[pid 25557] 10:12:37.873054 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.873089 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.873106 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25558] 10:12:37.873127 <... select resumed> ) = 1 (in [11], left {299, 991013})
[pid 25491] 10:12:37.874146 <... pipe resumed> [17, 18]) = 0
[pid 25559] 10:12:37.874190 fstat(0,  <unfinished ...>
[pid 25558] 10:12:37.874217 recvfrom(11,  <unfinished ...>
[pid 25557] 10:12:37.874244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.874276 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25543] 10:12:37.874301 brk(0x21df000 <unfinished ...>
[pid 25491] 10:12:37.874325 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25559] 10:12:37.874365 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25558] 10:12:37.874394 <... recvfrom resumed> "250-smtp48.gate.dfw1a.rsapps.net says EHLO to 50.116.78.207:52863\r\n250-SIZE 75000000\r\n250-STARTTLS\r\n250-ENHANCEDSTATUSCODES\r\n250-8BITMIME\r\n250 PIPELINING\r\n", 4096, 0, NULL, NULL) = 155
[pid 25557] 10:12:37.874442 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.874464 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.874566 <... brk resumed> ) = 0x21df000
[pid 25491] 10:12:37.874593 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25559] 10:12:37.874717 fstat(1,  <unfinished ...>
[pid 25558] 10:12:37.874748 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0 <unfinished ...>
[pid 25557] 10:12:37.874796 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.874831 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25543] 10:12:37.874857 read(13,  <unfinished ...>
[pid 25491] 10:12:37.874882 close(15 <unfinished ...>
[pid 25559] 10:12:37.874917 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25558] 10:12:37.874945 <... sendto resumed> ) = 10
[pid 25557] 10:12:37.874965 <... open resumed> ) = 6
[pid 25544] 10:12:37.874981 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.874996 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25491] 10:12:37.875016 <... close resumed> ) = 0
[pid 25559] 10:12:37.876204 fstat(2,  <unfinished ...>
[pid 25558] 10:12:37.876244 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:37.876275 read(6,  <unfinished ...>
[pid 25544] 10:12:37.876300 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25543] 10:12:37.876327 brk(0x2200000 <unfinished ...>
[pid 25491] 10:12:37.876352 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25559] 10:12:37.876390 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25557] 10:12:37.876419 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.876458 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.876480 <... brk resumed> ) = 0x2200000
[pid 25491] 10:12:37.876501 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.876742 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMb-0006e1-MY"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25557] 10:12:37.877379 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.877411 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25543] 10:12:37.877446 read(13,  <unfinished ...>
[pid 25491] 10:12:37.877471 close(14 <unfinished ...>
[pid 25557] 10:12:37.877605 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.877645 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.877672 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25491] 10:12:37.877696 <... close resumed> ) = 0
[pid 25559] 10:12:37.878601 <... execve resumed> ) = 0
[pid 25557] 10:12:37.878663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.878702 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25543] 10:12:37.878736 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.878764 munmap(0x7f33164f5000, 4096 <unfinished ...>
[pid 25559] 10:12:37.878799 brk(0 <unfinished ...>
[pid 25557] 10:12:37.878822 <... mmap resumed> ) = 0x7fc7a8f30000
[pid 25544] 10:12:37.878842 <... stat resumed> 0x7ffc53805940) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.878865 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.878881 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.878909 <... brk resumed> ) = 0x9b8000
[pid 25557] 10:12:37.878924 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.878960 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25543] 10:12:37.878990 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.879017 close(9 <unfinished ...>
[pid 25559] 10:12:37.879050 fcntl(0, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.879073 <... mmap resumed> ) = 0x7fc7a573c000
[pid 25544] 10:12:37.879090 <... stat resumed> 0x7ffc538059e0) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.879107 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.879121 <... close resumed> ) = 0
[pid 25559] 10:12:37.879151 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.879165 mprotect(0x7fc7a5817000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.879194 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25543] 10:12:37.879225 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.879250 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25559] 10:12:37.879285 fcntl(1, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.879308 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.879324 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25543] 10:12:37.879357 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.879372 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.879399 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.879414 mmap(0x7fc7a5a17000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25544] 10:12:37.879445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.879482 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.879511 close(13 <unfinished ...>
[pid 25559] 10:12:37.879544 fcntl(2, F_GETFD <unfinished ...>
[pid 25557] 10:12:37.879566 <... mmap resumed> ) = 0x7fc7a5a17000
[pid 25544] 10:12:37.879597 <... open resumed> ) = 12
[pid 25543] 10:12:37.879623 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.879639 <... close resumed> ) = 0
[pid 25559] 10:12:37.879668 <... fcntl resumed> ) = 0
[pid 25557] 10:12:37.879683 close(6 <unfinished ...>
[pid 25544] 10:12:37.879713 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.879738 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.879765 munmap(0x7f33164f6000, 4096 <unfinished ...>
[pid 25559] 10:12:37.879800 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25557] 10:12:37.879827 <... close resumed> ) = 0
[pid 25544] 10:12:37.879853 <... ioctl resumed> , 0x7ffc53805730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25543] 10:12:37.879873 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.879893 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.879921 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.879936 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.879986 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.880010 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.880036 close(12 <unfinished ...>
[pid 25559] 10:12:37.880069 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.880094 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.880112 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.880147 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.880165 <... close resumed> ) = 0
[pid 25559] 10:12:37.880195 <... mmap resumed> ) = 0x7ff9b2d43000
[pid 25557] 10:12:37.880210 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.880261 read(12,  <unfinished ...>
[pid 25543] 10:12:37.880288 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.880327 munmap(0x7f33164f7000, 4096Process 25560 attached
 <unfinished ...>
[pid 25559] 10:12:37.880391 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25557] 10:12:37.880423 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.880447 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25543] 10:12:37.880998 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.881028 <... munmap resumed> ) = 0
[pid 25560] 10:12:37.881062 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25559] 10:12:37.881088 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.881103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.881146 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.881170 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.881199 close(16 <unfinished ...>
[pid 25560] 10:12:37.881234 <... set_robust_list resumed> ) = 0
[pid 25559] 10:12:37.881248 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.881356 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.881379 <... lseek resumed> ) = 2366
[pid 25543] 10:12:37.881396 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.881411 <... close resumed> ) = 0
[pid 25560] 10:12:37.881442 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25559] 10:12:37.881469 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.881543 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.881588 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.881612 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.881641 munmap(0x7f33164f3000, 4096 <unfinished ...>
[pid 25560] 10:12:37.881679 <... setrlimit resumed> ) = 0
[pid 25559] 10:12:37.881693 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64",  <unfinished ...>
[pid 25557] 10:12:37.881841 <... open resumed> ) = 6
[pid 25544] 10:12:37.881857 <... lseek resumed> ) = 2366
[pid 25543] 10:12:37.881874 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.881890 <... munmap resumed> ) = 0
[pid 25560] 10:12:37.881925 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.881954 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.881969 read(6,  <unfinished ...>
[pid 25544] 10:12:37.881995 close(12 <unfinished ...>
[pid 25543] 10:12:37.882019 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.882048 close(11 <unfinished ...>
[pid 25560] 10:12:37.882081 <... open resumed> ) = 10
[pid 25559] 10:12:37.882095 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.882131 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.882155 <... close resumed> ) = 0
[pid 25543] 10:12:37.882469 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.882564 <... close resumed> ) = 0
[pid 25560] 10:12:37.882600 fstat(10,  <unfinished ...>
[pid 25559] 10:12:37.882625 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.882640 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.882665 read(11,  <unfinished ...>
[pid 25543] 10:12:37.882688 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25491] 10:12:37.882718 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25560] 10:12:37.882756 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.882785 stat("/usr/local/cpanel/3rdparty/lib64/tls",  <unfinished ...>
[pid 25557] 10:12:37.882831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.882861 <... read resumed> "", 8192) = 0
[pid 25543] 10:12:37.882881 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.882897 <... munmap resumed> ) = 0
[pid 25560] 10:12:37.882926 fstat(10,  <unfinished ...>
[pid 25559] 10:12:37.882949 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.882963 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.882998 close(11 <unfinished ...>
[pid 25543] 10:12:37.883023 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25491] 10:12:37.883052 close(10 <unfinished ...>
[pid 25560] 10:12:37.883086 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.883111 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.883143 <... mmap resumed> ) = 0x7fc7a5538000
[pid 25544] 10:12:37.883160 <... close resumed> ) = 0
[pid 25543] 10:12:37.883362 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25491] 10:12:37.883405 <... close resumed> ) = 0
[pid 25560] 10:12:37.883436 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.883465 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.883561 mprotect(0x7fc7a553b000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.883597 stat("/etc/userdomains",  <unfinished ...>
[pid 25543] 10:12:37.883625 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.883656 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25560] 10:12:37.883704 <... mmap resumed> ) = 0x7f21d336d000
[pid 25559] 10:12:37.883718 stat("/usr/local/cpanel/3rdparty/lib64/x86_64",  <unfinished ...>
[pid 25557] 10:12:37.883749 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.883766 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.883803 <... open resumed> ) = 14
[pid 25558] 10:12:37.883819 <... select resumed> ) = 1 (in [11], left {299, 992574})
[pid 25491] 10:12:37.883844 <... munmap resumed> ) = 0
[pid 25560] 10:12:37.883874 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.883897 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.883913 recvfrom(11,  <unfinished ...>
[pid 25557] 10:12:37.883940 mmap(0x7fc7a573a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25544] 10:12:37.883970 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.883998 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25491] 10:12:37.884023 clone( <unfinished ...>
[pid 25560] 10:12:37.884317 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.884333 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.884368 <... recvfrom resumed> "220 continue\r\n", 4096, 0, NULL, NULL) = 14
[pid 25557] 10:12:37.886411 <... mmap resumed> ) = 0x7fc7a573a000
[pid 25544] 10:12:37.886453 <... open resumed> ) = 11
[pid 25543] 10:12:37.886478 <... ioctl resumed> , 0x7ffcdc2443a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25560] 10:12:37.886508 read(10,  <unfinished ...>
[pid 25559] 10:12:37.886540 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.886556 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25557] 10:12:37.886596 close(6 <unfinished ...>
[pid 25544] 10:12:37.886620 fstat(11,  <unfinished ...>
[pid 25491] 10:12:37.886642 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25561
[pid 25560] 10:12:37.886690 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:37.886712 stat("/usr/local/cpanel/3rdparty/lib64",  <unfinished ...>
[pid 25558] 10:12:37.886866 <... open resumed> ) = 14
[pid 25557] 10:12:37.886888 <... close resumed> ) = 0
[pid 25544] 10:12:37.886915 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.886950 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:37.886974 close(18 <unfinished ...>
[pid 25560] 10:12:37.887008 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25559] 10:12:37.887038 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25558] 10:12:37.887070 fstat(14,  <unfinished ...>
[pid 25557] 10:12:37.887096 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.887126 fstat(11,  <unfinished ...>
[pid 25543] 10:12:37.887149 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.887162 <... close resumed> ) = 0
[pid 25560] 10:12:37.887219 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.887249 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.887311 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25557] 10:12:37.887356 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.887382 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.887413 read(14,  <unfinished ...>
[pid 25491] 10:12:37.887445 read(17,  <unfinished ...>
[pid 25560] 10:12:37.887564 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.887602 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.887618 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25557] 10:12:37.887648 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.887680 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.887707 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25560] 10:12:37.887734 <... open resumed> ) = 13
[pid 25559] 10:12:37.887847 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64",  <unfinished ...>
[pid 25558] 10:12:37.887887 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25557] 10:12:37.887912 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.887931 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25560] 10:12:37.887959 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.887982 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.887997 read(14,  <unfinished ...>
[pid 25557] 10:12:37.888028 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.888059 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.888082 brk(0x2221000 <unfinished ...>
[pid 25560] 10:12:37.888115 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.888142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.888177 <... read resumed> "\341Vv\372'=\256Ry\237\367f\323\307n\230&\350\353C\254P\7\360\2456|\224\235\234\305\342\241u\302\20\v\36\225\274l\221\20\233\321\200L ", 48) = 48
[pid 25557] 10:12:37.888206 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.888227 <... lseek resumed> ) = 0
[pid 25560] 10:12:37.888253 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.888276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.888290 close(14 <unfinished ...>
[pid 25557] 10:12:37.888316 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.888348 read(11,  <unfinished ...>
[pid 25543] 10:12:37.888375 <... brk resumed> ) = 0x2221000
[pid 25560] 10:12:37.888396 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.888909 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls",  <unfinished ...>
[pid 25558] 10:12:37.888956 <... close resumed> ) = 0
[pid 25557] 10:12:37.888993 <... open resumed> ) = 6
[pid 25544] 10:12:37.889012 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25560] 10:12:37.889070 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.889103 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.889119 getuid( <unfinished ...>
[pid 25557] 10:12:37.889144 read(6,  <unfinished ...>
[pid 25544] 10:12:37.889168 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.889198 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25560] 10:12:37.889230 <... mmap resumed> ) = 0x7f21d336c000
[pid 25559] 10:12:37.889244 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.889278 <... getuid resumed> ) = 47
[pid 25557] 10:12:37.895057 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.895099 <... open resumed> ) = 12
[pid 25560] 10:12:37.895131 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.895158 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.895173 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.895199 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.895223 fstat(12,  <unfinished ...>
[pid 25543] 10:12:37.895246 <... lseek resumed> ) = 4868
[pid 25560] 10:12:37.895266 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.895280 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25557] 10:12:37.895302 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.895334 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25557] 10:12:37.895375 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.895408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.895438 <... mmap resumed> ) = 0x7fc7a530c000
[pid 25544] 10:12:37.895455 <... mmap resumed> ) = 0x7fa692c1c000
[pid 25557] 10:12:37.895479 mprotect(0x7fc7a5335000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.895511 read(12,  <unfinished ...>
[pid 25557] 10:12:37.895542 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.895559 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25557] 10:12:37.895596 mmap(0x7fc7a5535000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25544] 10:12:37.895629 close(12 <unfinished ...>
[pid 25557] 10:12:37.895658 <... mmap resumed> ) = 0x7fc7a5535000
[pid 25544] 10:12:37.895684 <... close resumed> ) = 0
[pid 25560] 10:12:37.895734 read(13,  <unfinished ...>
[pid 25559] 10:12:37.895757 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.895772 mmap(0x7fc7a5537000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.895806 munmap(0x7fa692c1c000, 4096 <unfinished ...>
[pid 25543] 10:12:37.895840 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:37.895866 <... mmap resumed> ) = 0x7fc7a5537000
[pid 25544] 10:12:37.895888 <... munmap resumed> ) = 0
[pid 25557] 10:12:37.895948 close(6 <unfinished ...>
[pid 25544] 10:12:37.895989 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:37.896040 <... close resumed> ) = 0
[pid 25544] 10:12:37.896082 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.896136 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.896170 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25557] 10:12:37.896203 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.896220 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.896262 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.896297 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.896330 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.896347 <... open resumed> ) = 12
[pid 25557] 10:12:37.896368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.896397 fstat(12,  <unfinished ...>
[pid 25557] 10:12:37.896425 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.896444 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25560] 10:12:37.896628 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25559] 10:12:37.896660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.896684 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.896717 fstat(12,  <unfinished ...>
[pid 25543] 10:12:37.896741 <... lseek resumed> ) = 4868
[pid 25557] 10:12:37.896759 <... open resumed> ) = 6
[pid 25544] 10:12:37.896775 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:37.896807 read(6,  <unfinished ...>
[pid 25544] 10:12:37.896831 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.896862 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.896885 <... mmap resumed> ) = 0x7fa692c1c000
[pid 25557] 10:12:37.896906 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.896930 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:37.896956 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25544] 10:12:37.896986 <... lseek resumed> ) = 0
[pid 25557] 10:12:37.897006 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.897033 read(12,  <unfinished ...>
[pid 25557] 10:12:37.897064 <... mmap resumed> ) = 0x7fc7a8f2f000
[pid 25544] 10:12:37.897084 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25557] 10:12:37.897115 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.897146 read(12,  <unfinished ...>
[pid 25557] 10:12:37.897173 <... mmap resumed> ) = 0x7fc7a50f6000
[pid 25544] 10:12:37.897189 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:37.897250 mprotect(0x7fc7a510b000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.897284 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25557] 10:12:37.897322 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.897339 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2971, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25560] 10:12:37.897454 read(13,  <unfinished ...>
[pid 25559] 10:12:37.897564 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.897586 <... open resumed> ) = 14
[pid 25557] 10:12:37.897602 mmap(0x7fc7a530a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25544] 10:12:37.897647 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.897680 close(14 <unfinished ...>
[pid 25560] 10:12:37.897712 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:37.897727 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE",  <unfinished ...>
[pid 25558] 10:12:37.897799 fstat(14,  <unfinished ...>
[pid 25557] 10:12:37.897823 <... mmap resumed> ) = 0x7fc7a530a000
[pid 25544] 10:12:37.897850 <... open resumed> ) = 13
[pid 25560] 10:12:37.897881 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.897911 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25558] 10:12:37.897938 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:37.897966 close(6 <unfinished ...>
[pid 25544] 10:12:37.897991 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25543] 10:12:37.898017 <... close resumed> ) = 0
[pid 25560] 10:12:37.898038 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:37.898079 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.898115 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.898142 <... close resumed> ) = 0
[pid 25544] 10:12:37.898176 <... ioctl resumed> , 0x7ffc53808820) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25560] 10:12:37.898207 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.898235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.898249 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25557] 10:12:37.898264 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.898297 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25543] 10:12:37.898320 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25560] 10:12:37.898355 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:37.898371 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25558] 10:12:37.898399 read(14,  <unfinished ...>
[pid 25557] 10:12:37.898426 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.898444 <... lseek resumed> ) = 0
[pid 25560] 10:12:37.898474 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.898508 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.898522 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25557] 10:12:37.898542 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.898590 fstat(13,  <unfinished ...>
[pid 25543] 10:12:37.898613 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.898636 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f21d2224790}, 8) = 0
[pid 25559] 10:12:37.898655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.898688 read(14,  <unfinished ...>
[pid 25557] 10:12:37.898712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.898729 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2971, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25560] 10:12:37.898773 close(11 <unfinished ...>
[pid 25559] 10:12:37.898796 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.898810 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25557] 10:12:37.898830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.898963 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.898989 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25560] 10:12:37.899025 <... close resumed> ) = 0
[pid 25559] 10:12:37.899039 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25558] 10:12:37.899068 read(14,  <unfinished ...>
[pid 25557] 10:12:37.899091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.899111 <... fcntl resumed> ) = 0
[pid 25560] 10:12:37.899193 fcntl(12, F_GETFD <unfinished ...>
[pid 25559] 10:12:37.899219 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.899234 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25557] 10:12:37.899252 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.899282 read(13,  <unfinished ...>
[pid 25543] 10:12:37.899293 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.899307 <... fcntl resumed> ) = 0
[pid 25559] 10:12:37.899312 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.899319 read(14,  <unfinished ...>
[pid 25557] 10:12:37.899326 <... open resumed> ) = 6
[pid 25544] 10:12:37.899335 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2971
[pid 25560] 10:12:37.900079 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.900116 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.900132 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25557] 10:12:37.900153 read(6,  <unfinished ...>
[pid 25544] 10:12:37.900249 read(13,  <unfinished ...>
[pid 25543] 10:12:37.900274 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25560] 10:12:37.900309 <... fcntl resumed> ) = 0
[pid 25559] 10:12:37.900322 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64",  <unfinished ...>
[pid 25558] 10:12:37.900371 read(14,  <unfinished ...>
[pid 25557] 10:12:37.900396 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.900420 <... read resumed> "", 8192) = 0
[pid 25560] 10:12:37.900461 geteuid( <unfinished ...>
[pid 25559] 10:12:37.900551 <... stat resumed> 0x7fffca4f7930) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.900569 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25557] 10:12:37.900590 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.900634 close(13 <unfinished ...>
[pid 25543] 10:12:37.900664 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.900689 <... geteuid resumed> ) = 0
[pid 25559] 10:12:37.900706 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.900749 read(14,  <unfinished ...>
[pid 25557] 10:12:37.900775 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25544] 10:12:37.900827 <... close resumed> ) = 0
[pid 25560] 10:12:37.900894 getegid( <unfinished ...>
[pid 25559] 10:12:37.900922 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.900937 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25557] 10:12:37.900958 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.901054 stat("/etc/userdomains",  <unfinished ...>
[pid 25543] 10:12:37.901084 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25560] 10:12:37.901120 <... getegid resumed> ) = 12
[pid 25559] 10:12:37.901134 stat("/usr/local/cpanel/3rdparty/perl/514/lib64",  <unfinished ...>
[pid 25558] 10:12:37.901166 read(14,  <unfinished ...>
[pid 25557] 10:12:37.901189 <... mmap resumed> ) = 0x7fc7a4eeb000
[pid 25544] 10:12:37.901206 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25560] 10:12:37.901264 setgid(500 <unfinished ...>
[pid 25559] 10:12:37.901290 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25558] 10:12:37.901316 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25557] 10:12:37.901339 mprotect(0x7fc7a4ef5000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.901434 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25543] 10:12:37.901465 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.901568 <... setgid resumed> ) = 0
[pid 25559] 10:12:37.901592 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.901625 read(14,  <unfinished ...>
[pid 25557] 10:12:37.901649 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.901666 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25560] 10:12:37.901715 setuid(503 <unfinished ...>
[pid 25559] 10:12:37.901748 <... open resumed> ) = 6
[pid 25558] 10:12:37.901761 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25557] 10:12:37.901781 mmap(0x7fc7a50f4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25544] 10:12:37.901877 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25543] 10:12:37.901906 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25560] 10:12:37.901940 <... setuid resumed> ) = 0
[pid 25559] 10:12:37.901954 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.901980 read(14,  <unfinished ...>
[pid 25557] 10:12:37.902003 <... mmap resumed> ) = 0x7fc7a50f4000
[pid 25544] 10:12:37.902035 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25560] 10:12:37.902121 chdir("/" <unfinished ...>
[pid 25559] 10:12:37.902156 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25558] 10:12:37.902186 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25557] 10:12:37.902204 close(6 <unfinished ...>
[pid 25544] 10:12:37.902241 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.902271 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.902294 <... chdir resumed> ) = 0
[pid 25559] 10:12:37.902310 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.902353 read(14,  <unfinished ...>
[pid 25557] 10:12:37.902377 <... close resumed> ) = 0
[pid 25544] 10:12:37.902403 <... open resumed> ) = 13
[pid 25560] 10:12:37.902433 geteuid( <unfinished ...>
[pid 25559] 10:12:37.902456 <... mmap resumed> ) = 0x7ff9b2d39000
[pid 25558] 10:12:37.902473 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25557] 10:12:37.902496 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.902592 fstat(13,  <unfinished ...>
[pid 25543] 10:12:37.902617 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25560] 10:12:37.902654 <... geteuid resumed> ) = 503
[pid 25559] 10:12:37.902668 close(6 <unfinished ...>
[pid 25558] 10:12:37.902692 read(14,  <unfinished ...>
[pid 25557] 10:12:37.902716 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.902733 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25543] 10:12:37.902762 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.902793 getegid( <unfinished ...>
[pid 25559] 10:12:37.902816 <... close resumed> ) = 0
[pid 25558] 10:12:37.902841 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25557] 10:12:37.902865 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.902959 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.902987 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25560] 10:12:37.903030 <... getegid resumed> ) = 500
[pid 25559] 10:12:37.903043 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.903101 read(14,  <unfinished ...>
[pid 25557] 10:12:37.903127 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.903145 <... mmap resumed> ) = 0x7fa692c1b000
[pid 25543] 10:12:37.903163 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.903190 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25559] 10:12:37.903218 <... open resumed> ) = 6
[pid 25558] 10:12:37.903234 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25557] 10:12:37.903249 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.903321 read(13,  <unfinished ...>
[pid 25543] 10:12:37.903337 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25560] 10:12:37.903372 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25559] 10:12:37.903392 read(6,  <unfinished ...>
[pid 25558] 10:12:37.903404 read(14,  <unfinished ...>
[pid 25557] 10:12:37.903410 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.903429 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25543] 10:12:37.903455 <... stat resumed> 0x7ffcdc2445b0) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.903639 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25559] 10:12:37.903674 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.903701 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25557] 10:12:37.903719 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.903808 close(13 <unfinished ...>
[pid 25543] 10:12:37.903835 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25560] 10:12:37.903875 <... chdir resumed> ) = 0
[pid 25559] 10:12:37.903894 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.903921 read(14,  <unfinished ...>
[pid 25557] 10:12:37.903944 <... open resumed> ) = 6
[pid 25544] 10:12:37.903961 <... close resumed> ) = 0
[pid 25543] 10:12:37.903977 <... stat resumed> 0x7ffcdc244650) = -1 ENOENT (No such file or directory)
[pid 25560] 10:12:37.904005 stat("tmp",  <unfinished ...>
[pid 25559] 10:12:37.904032 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.904064 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25557] 10:12:37.904081 read(6,  <unfinished ...>
[pid 25544] 10:12:37.904156 munmap(0x7fa692c1b000, 4096 <unfinished ...>
[pid 25543] 10:12:37.904186 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25560] 10:12:37.904227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.904253 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.904284 read(14,  <unfinished ...>
[pid 25557] 10:12:37.904307 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.904331 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.904357 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25560] 10:12:37.904398 stat("new",  <unfinished ...>
[pid 25559] 10:12:37.904428 <... mmap resumed> ) = 0x7ff9b290b000
[pid 25558] 10:12:37.904445 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25557] 10:12:37.904463 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.904609 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25543] 10:12:37.904638 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25560] 10:12:37.904680 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.904706 mprotect(0x7ff9b2921000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.904740 read(14,  <unfinished ...>
[pid 25557] 10:12:37.904764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25544] 10:12:37.904800 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25543] 10:12:37.904829 <... open resumed> ) = 14
[pid 25560] 10:12:37.904857 stat("cur",  <unfinished ...>
[pid 25559] 10:12:37.904883 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.904899 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25557] 10:12:37.904917 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.905038 pipe( <unfinished ...>
[pid 25543] 10:12:37.905068 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25560] 10:12:37.905103 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25559] 10:12:37.905130 mmap(0x7ff9b2b21000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000 <unfinished ...>
[pid 25558] 10:12:37.905236 read(14,  <unfinished ...>
[pid 25557] 10:12:37.905262 <... mmap resumed> ) = 0x7fc7a4ce8000
[pid 25544] 10:12:37.905279 <... pipe resumed> [13, 14]) = 0
[pid 25543] 10:12:37.905297 <... ioctl resumed> , 0x7ffcdc2443a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25560] 10:12:37.905327 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25559] 10:12:37.905367 <... mmap resumed> ) = 0x7ff9b2b21000
[pid 25558] 10:12:37.905397 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25557] 10:12:37.905416 mprotect(0x7fc7a4cea000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.905596 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.905628 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25560] 10:12:37.905662 <... open resumed> ) = 11
[pid 25559] 10:12:37.905675 mmap(0x7ff9b2b23000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.905709 read(14,  <unfinished ...>
[pid 25557] 10:12:37.905733 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.905749 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25543] 10:12:37.905771 <... lseek resumed> ) = 0
[pid 25560] 10:12:37.905819 read(11,  <unfinished ...>
[pid 25559] 10:12:37.905846 <... mmap resumed> ) = 0x7ff9b2b23000
[pid 25558] 10:12:37.905869 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25557] 10:12:37.905889 mmap(0x7fc7a4ee9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25544] 10:12:37.905933 close(10 <unfinished ...>
[pid 25543] 10:12:37.905959 read(14,  <unfinished ...>
[pid 25560] 10:12:37.905995 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2971
[pid 25559] 10:12:37.906019 close(6 <unfinished ...>
[pid 25558] 10:12:37.906107 read(14,  <unfinished ...>
[pid 25557] 10:12:37.906131 <... mmap resumed> ) = 0x7fc7a4ee9000
[pid 25544] 10:12:37.906157 <... close resumed> ) = 0
[pid 25543] 10:12:37.906176 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25560] 10:12:37.906719 stat("tmp/1451491957.H906085P25560.fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:37.906770 <... close resumed> ) = 0
[pid 25558] 10:12:37.906797 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25557] 10:12:37.906818 close(6 <unfinished ...>
[pid 25544] 10:12:37.906901 munmap(0x7fa692c1e000, 4096 <unfinished ...>
[pid 25543] 10:12:37.906933 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25560] 10:12:37.906967 <... stat resumed> 0x7ffce2d03db0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.906983 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.907020 read(14,  <unfinished ...>
[pid 25557] 10:12:37.907044 <... close resumed> ) = 0
[pid 25544] 10:12:37.907069 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.907089 <... lseek resumed> ) = 2366
[pid 25560] 10:12:37.907115 open("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25559] 10:12:37.907175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.907196 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25557] 10:12:37.907215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.907304 close(11 <unfinished ...>
[pid 25543] 10:12:37.907333 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25560] 10:12:37.907376 <... open resumed> ) = 14
[pid 25559] 10:12:37.907393 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.907437 read(14,  <unfinished ...>
[pid 25557] 10:12:37.907461 <... mmap resumed> ) = 0x7fc7a8f2e000
[pid 25544] 10:12:37.907561 <... close resumed> ) = 0
[pid 25543] 10:12:37.907585 <... lseek resumed> ) = 2366
[pid 25560] 10:12:37.907613 chown("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25559] 10:12:37.907644 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.907663 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25557] 10:12:37.907681 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.907773 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25543] 10:12:37.907802 close(14 <unfinished ...>
[pid 25560] 10:12:37.907836 <... chown resumed> ) = 0
[pid 25559] 10:12:37.907850 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.907887 read(14,  <unfinished ...>
[pid 25557] 10:12:37.907910 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.907928 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.907952 <... close resumed> ) = 0
[pid 25560] 10:12:37.908293 chmod("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25559] 10:12:37.908336 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.908361 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25557] 10:12:37.908380 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.908474 close(12 <unfinished ...>
[pid 25543] 10:12:37.908507 read(13,  <unfinished ...>
[pid 25560] 10:12:37.908542 <... chmod resumed> ) = 0
[pid 25559] 10:12:37.908556 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.908592 read(14,  <unfinished ...>
[pid 25557] 10:12:37.908616 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.908634 <... close resumed> ) = 0
[pid 25543] 10:12:37.908651 <... read resumed> "", 8192) = 0
[pid 25560] 10:12:37.908679 chown("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25559] 10:12:37.908709 <... open resumed> ) = 6
[pid 25558] 10:12:37.908725 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25557] 10:12:37.908743 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.908783 munmap(0x7fa692c1c000, 4096 <unfinished ...>
[pid 25543] 10:12:37.908810 close(13 <unfinished ...>
[pid 25560] 10:12:37.908845 <... chown resumed> ) = 0
[pid 25559] 10:12:37.908858 read(6,  <unfinished ...>
[pid 25558] 10:12:37.908884 read(14,  <unfinished ...>
[pid 25557] 10:12:37.908906 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.908926 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.908944 <... close resumed> ) = 0
[pid 25560] 10:12:37.909139 chmod("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25559] 10:12:37.909177 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.909202 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25557] 10:12:37.909220 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.909312 close(9 <unfinished ...>
[pid 25543] 10:12:37.909338 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25560] 10:12:37.909372 <... chmod resumed> ) = 0
[pid 25559] 10:12:37.909388 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.909448 read(14,  <unfinished ...>
[pid 25557] 10:12:37.909473 <... open resumed> ) = 6
[pid 25544] 10:12:37.909612 <... close resumed> ) = 0
[pid 25543] 10:12:37.909630 <... lseek resumed> ) = 0
[pid 25560] 10:12:37.909657 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:37.909683 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.909722 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25557] 10:12:37.909741 read(6,  <unfinished ...>
[pid 25544] 10:12:37.909833 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25543] 10:12:37.909864 read(12,  <unfinished ...>
[pid 25560] 10:12:37.909898 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:37.909926 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.909992 read(14,  <unfinished ...>
[pid 25557] 10:12:37.910016 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.910041 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.910060 <... read resumed> "", 4096) = 0
[pid 25560] 10:12:37.910112 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.910139 <... mmap resumed> ) = 0x7ff9b2d38000
[pid 25558] 10:12:37.910161 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25557] 10:12:37.910180 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.910216 clone( <unfinished ...>
[pid 25543] 10:12:37.910578 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25560] 10:12:37.910622 <... lseek resumed> ) = 19
[pid 25559] 10:12:37.910635 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.910666 read(14,  <unfinished ...>
[pid 25557] 10:12:37.910686 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25543] 10:12:37.910722 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.910773 <... mmap resumed> ) = 0x7ff9b26f2000
[pid 25557] 10:12:37.910793 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25544] 10:12:37.910833 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25562
[pid 25543] 10:12:37.910875 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.910916 mprotect(0x7ff9b2708000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:37.910945 <... mmap resumed> ) = 0x7fc7a4ac9000
[pid 25544] 10:12:37.910961 close(14 <unfinished ...>
[pid 25543] 10:12:37.910985 <... open resumed> ) = 13
[pid 25559] 10:12:37.911009 <... mprotect resumed> ) = 0
[pid 25557] 10:12:37.911031 mprotect(0x7fc7a4ae6000, 2093056, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.911059 <... close resumed> ) = 0
[pid 25543] 10:12:37.911075 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.911106 mmap(0x7ff9b2907000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000 <unfinished ...>
[pid 25557] 10:12:37.911137 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.911153 read(13,  <unfinished ...>
[pid 25543] 10:12:37.911175 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.911212 <... mmap resumed> ) = 0x7ff9b2907000
[pid 25557] 10:12:37.911234 mmap(0x7fc7a4ce5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25543] 10:12:37.911265 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.911294 mmap(0x7ff9b2909000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.911321 <... mmap resumed> ) = 0x7fc7a4ce5000
[pid 25543] 10:12:37.911341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.911375 <... mmap resumed> ) = 0x7ff9b2909000
[pid 25557] 10:12:37.911396 mmap(0x7fc7a4ce7000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.911428 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25560] 10:12:37.911461 read(6,  <unfinished ...>
[pid 25559] 10:12:37.911495 close(6 <unfinished ...>
[pid 25557] 10:12:37.911520 <... mmap resumed> ) = 0x7fc7a4ce7000
[pid 25543] 10:12:37.911542 <... mmap resumed> ) = 0x7fe585ed7000
[pid 25560] 10:12:37.911568 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25559] 10:12:37.911598 <... close resumed> ) = 0
[pid 25557] 10:12:37.911621 close(6 <unfinished ...>
[pid 25543] 10:12:37.911645 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25560] 10:12:37.911675 read(6,  <unfinished ...>
[pid 25559] 10:12:37.911698 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.911728 <... close resumed> ) = 0
[pid 25543] 10:12:37.911783 <... lseek resumed> ) = 0
[pid 25560] 10:12:37.911809 <... read resumed> "", 8192) = 0
[pid 25559] 10:12:37.911827 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.911845 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.911872 read(13,  <unfinished ...>
[pid 25560] 10:12:37.911902 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2521 <unfinished ...>
[pid 25559] 10:12:37.911939 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.911972 <... mmap resumed> ) = 0x7fc7a8f2d000
[pid 25543] 10:12:37.912030 <... read resumed> "", 4096) = 0
[pid 25560] 10:12:37.912063 <... write resumed> ) = 2521
[pid 25559] 10:12:37.912085 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.912104 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.912130 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25560] 10:12:37.912172 fsync(14 <unfinished ...>
[pid 25559] 10:12:37.912233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.912264 <... mmap resumed> ) = 0x7fc7a8f2c000
[pid 25543] 10:12:37.912291 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.912335 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.912352 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.912364 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.912384 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.912400 <... mmap resumed> ) = 0x7fc7a8f2a000
[pid 25543] 10:12:37.912412 <... open resumed> ) = 14
[pid 25559] 10:12:37.912426 <... open resumed> ) = 6
[pid 25557] 10:12:37.912435 arch_prctl(ARCH_SET_FS, 0x7fc7a8f2a7c0 <unfinished ...>
[pid 25543] 10:12:37.912444 fstat(14,  <unfinished ...>
[pid 25559] 10:12:37.912458 read(6,  <unfinished ...>
[pid 25557] 10:12:37.912468 <... arch_prctl resumed> ) = 0
[pid 25543] 10:12:37.912666 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25560] 10:12:37.912708 <... fsync resumed> ) = 0
[pid 25559] 10:12:37.912728 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25557] 10:12:37.912753 mprotect(0x7fc7a4ce5000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.912781 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25560] 10:12:37.912815 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25559] 10:12:37.912839 fstat(6,  <unfinished ...>
[pid 25557] 10:12:37.912862 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.912883 <... mmap resumed> ) = 0x7fe585ed6000
[pid 25560] 10:12:37.912907 <... lseek resumed> ) = 2971
[pid 25559] 10:12:37.912924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25557] 10:12:37.912954 mprotect(0x7fc7a4ee9000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.912980 read(14,  <unfinished ...>
[pid 25560] 10:12:37.913014 write(11, "2521 1\n", 7 <unfinished ...>
[pid 25559] 10:12:37.913045 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25557] 10:12:37.913073 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.913105 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25560] 10:12:37.913140 <... write resumed> ) = 7
[pid 25559] 10:12:37.913158 <... mmap resumed> ) = 0x7ff9b24bb000
[pid 25557] 10:12:37.913174 mprotect(0x7fc7a50f4000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.913200 close(14 <unfinished ...>
[pid 25560] 10:12:37.913232 close(11 <unfinished ...>
[pid 25559] 10:12:37.913263 mprotect(0x7ff9b24c2000, 2097152, PROT_NONE <unfinished ...>
[pid 25557] 10:12:37.913290 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.913316 <... close resumed> ) = 0
[pid 25560] 10:12:37.913340 <... close resumed> ) = 0
[pid 25559] 10:12:37.913358 <... mprotect resumed> ) = 0
[pid 25557] 10:12:37.913377 mprotect(0x7fc7a530a000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.913404 munmap(0x7fe585ed6000, 4096 <unfinished ...>
[pid 25560] 10:12:37.913438 fstat(14,  <unfinished ...>
[pid 25559] 10:12:37.913462 mmap(0x7ff9b26c2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25557] 10:12:37.913606 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.913639 <... munmap resumed> ) = 0
[pid 25560] 10:12:37.913683 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016480, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2521, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.913717 <... mmap resumed> ) = 0x7ff9b26c2000
[pid 25558] 10:12:37.913738 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25557] 10:12:37.913757 mprotect(0x7fc7a5535000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.913784 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25560] 10:12:37.913820 close(14 <unfinished ...>
[pid 25559] 10:12:37.913845 mmap(0x7ff9b26c4000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:37.913874 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.913900 <... open resumed> ) = 14
[pid 25560] 10:12:37.913925 <... close resumed> ) = 0
[pid 25559] 10:12:37.913959 <... mmap resumed> ) = 0x7ff9b26c4000
[pid 25557] 10:12:37.913983 mprotect(0x7fc7a573a000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.914011 fstat(14,  <unfinished ...>
[pid 25560] 10:12:37.914041 rename("tmp/1451491957.H906085P25560.fin.finestweddingsites.com", "new/1451491957.H906085P25560.fin.finestweddingsites.com,S=2521" <unfinished ...>
[pid 25559] 10:12:37.914098 close(6 <unfinished ...>
[pid 25557] 10:12:37.914122 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.914243 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25560] 10:12:37.914286 <... rename resumed> ) = 0
[pid 25559] 10:12:37.914307 <... close resumed> ) = 0
[pid 25557] 10:12:37.914330 mprotect(0x7fc7a5a17000, 40960, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.914358 fstat(14,  <unfinished ...>
[pid 25560] 10:12:37.914388 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.914419 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.914450 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.914612 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25560] 10:12:37.914658 <... write resumed> ) = 4
[pid 25559] 10:12:37.914675 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.914693 mprotect(0x7fc7a5c64000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.914720 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.914746 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.914776 write(12, "\331\t\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.914806 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.914845 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.914875 <... mmap resumed> ) = 0x7fe585ed6000
[pid 25529] 10:12:37.914894 read(11,  <unfinished ...>
[pid 25560] 10:12:37.914929 <... write resumed> ) = 4
[pid 25559] 10:12:37.914945 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.914962 mprotect(0x7fc7a5e7e000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.914988 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.915012 <... read resumed> "\331\t\0\0", 4) = 4
[pid 25560] 10:12:37.915037 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25559] 10:12:37.915061 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.915091 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.915111 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.915129 read(11,  <unfinished ...>
[pid 25560] 10:12:37.915160 <... write resumed> ) = 4
[pid 25559] 10:12:37.915175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.915194 mprotect(0x7fc7a608b000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.915221 read(14,  <unfinished ...>
[pid 25529] 10:12:37.915248 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25560] 10:12:37.915274 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.915298 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.915332 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.915613 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25529] 10:12:37.915657 read(11,  <unfinished ...>
[pid 25560] 10:12:37.915691 <... write resumed> ) = 4
[pid 25559] 10:12:37.915707 <... open resumed> ) = 6
[pid 25557] 10:12:37.915723 mprotect(0x7fc7a6877000, 110592, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.915751 read(14,  <unfinished ...>
[pid 25529] 10:12:37.915774 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.915799 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.915824 read(6,  <unfinished ...>
[pid 25557] 10:12:37.915847 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.915927 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.916005 read(11,  <unfinished ...>
[pid 25560] 10:12:37.916045 <... write resumed> ) = 4
[pid 25559] 10:12:37.916062 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25557] 10:12:37.916087 mprotect(0x7fc7a6b03000, 16384, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.916114 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.916144 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.916169 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.916194 fstat(6,  <unfinished ...>
[pid 25557] 10:12:37.916216 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.916315 <... open resumed> ) = 15
[pid 25529] 10:12:37.916336 read(11,  <unfinished ...>
[pid 25560] 10:12:37.916370 <... write resumed> ) = 4
[pid 25559] 10:12:37.916386 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25557] 10:12:37.916418 mprotect(0x7fc7a6e98000, 16384, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.916451 fstat(15,  <unfinished ...>
[pid 25529] 10:12:37.916596 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.916635 write(12, "\2603\36\2\0\0\0\0", 8 <unfinished ...>
[pid 25559] 10:12:37.916663 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.916692 read(14,  <unfinished ...>
[pid 25557] 10:12:37.916713 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.916734 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25529] 10:12:37.916766 read(11,  <unfinished ...>
[pid 25560] 10:12:37.916797 <... write resumed> ) = 8
[pid 25559] 10:12:37.916813 <... mmap resumed> ) = 0x7ff9b2237000
[pid 25557] 10:12:37.916830 mprotect(0x7fc7a70a3000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.916857 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:37.916883 <... read resumed> "\2603\36\2\0\0\0\0", 8) = 8
[pid 25560] 10:12:37.916909 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.916933 mprotect(0x7ff9b22ba000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:37.916960 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.916985 <... mmap resumed> ) = 0x7fe585ed5000
[pid 25529] 10:12:37.917003 read(11,  <unfinished ...>
[pid 25560] 10:12:37.917034 <... write resumed> ) = 4
[pid 25559] 10:12:37.917050 <... mprotect resumed> ) = 0
[pid 25557] 10:12:37.917066 mprotect(0x7fc7a72a7000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.917093 read(15,  <unfinished ...>
[pid 25529] 10:12:37.917122 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.917148 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.917172 mmap(0x7ff9b24b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25557] 10:12:37.917201 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.917903 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25529] 10:12:37.917947 read(11,  <unfinished ...>
[pid 25560] 10:12:37.917983 <... write resumed> ) = 4
[pid 25559] 10:12:37.917999 <... mmap resumed> ) = 0x7ff9b24b9000
[pid 25557] 10:12:37.918026 mprotect(0x7fc7a7fff000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.918055 close(15 <unfinished ...>
[pid 25529] 10:12:37.918080 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25560] 10:12:37.918107 close(12 <unfinished ...>
[pid 25559] 10:12:37.918131 close(6 <unfinished ...>
[pid 25557] 10:12:37.918153 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.918190 <... close resumed> ) = 0
[pid 25529] 10:12:37.918208 close(11 <unfinished ...>
[pid 25560] 10:12:37.918243 <... close resumed> ) = 0
[pid 25559] 10:12:37.918261 <... close resumed> ) = 0
[pid 25557] 10:12:37.918284 mprotect(0x7fc7a8434000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.918312 munmap(0x7fe585ed5000, 4096 <unfinished ...>
[pid 25529] 10:12:37.918342 <... close resumed> ) = 0
[pid 25560] 10:12:37.918375 close(10 <unfinished ...>
[pid 25559] 10:12:37.918401 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.918433 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.918454 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.918544 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25560] 10:12:37.918598 <... close resumed> ) = 0
[pid 25559] 10:12:37.918615 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.918633 mprotect(0x7fc7a86b8000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.918664 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25529] 10:12:37.918695 <... write resumed> ) = 55
[pid 25560] 10:12:37.918726 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25559] 10:12:37.918757 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.918790 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.918811 <... open resumed> ) = 15
[pid 25529] 10:12:37.918829 fsync(9 <unfinished ...>
[pid 25560] 10:12:37.918890 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.918910 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.918928 mprotect(0x7fc7a88c1000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.919044 fstat(15,  <unfinished ...>
[pid 25560] 10:12:37.919074 close(13 <unfinished ...>
[pid 25559] 10:12:37.919099 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.919129 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.919161 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25560] 10:12:37.919210 <... close resumed> ) = 0
[pid 25559] 10:12:37.919227 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:37.919247 mprotect(0x7fc7a8b06000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.919274 fstat(15,  <unfinished ...>
[pid 25529] 10:12:37.919296 <... fsync resumed> ) = 0
[pid 25560] 10:12:37.919320 munmap(0x7f21d336c000, 4096 <unfinished ...>
[pid 25559] 10:12:37.919347 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:37.919380 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.919404 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25529] 10:12:37.919434 wait4(-1,  <unfinished ...>
[pid 25560] 10:12:37.919463 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.919913 <... open resumed> ) = 6
[pid 25557] 10:12:37.919939 mprotect(0x7fc7a8d20000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.919968 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0Process 25561 attached
 <unfinished ...>
[pid 25560] 10:12:37.920032 exit_group(0) = ?
[pid 25559] 10:12:37.920342 read(6,  <unfinished ...>
[pid 25558] 10:12:37.920372 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25557] 10:12:37.920391 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.920553 <... mmap resumed> ) = 0x7fe585ed5000
[pid 25561] 10:12:37.920603 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25560] 10:12:37.920628 +++ exited with 0 +++
[pid 25559] 10:12:37.920640 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.920665 read(14,  <unfinished ...>
[pid 25557] 10:12:37.920689 mprotect(0x7fc7a8f43000, 4096, PROT_READ <unfinished ...>
[pid 25543] 10:12:37.920716 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:37.920740 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25560
[pid 25561] 10:12:37.920804 <... set_robust_list resumed> ) = 0
[pid 25559] 10:12:37.920823 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.920872 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25557] 10:12:37.920892 <... mprotect resumed> ) = 0
[pid 25543] 10:12:37.920920 <... lseek resumed> ) = 0
[pid 25529] 10:12:37.920938 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25561] 10:12:37.920977 close(17 <unfinished ...>
[pid 25559] 10:12:37.920999 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25558] 10:12:37.921030 read(14,  <unfinished ...>
[pid 25557] 10:12:37.921053 munmap(0x7fc7a8f38000, 39387 <unfinished ...>
[pid 25543] 10:12:37.921084 read(15,  <unfinished ...>
[pid 25529] 10:12:37.921107 <... open resumed> ) = 10
[pid 25561] 10:12:37.921133 <... close resumed> ) = 0
[pid 25559] 10:12:37.921147 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.921185 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25557] 10:12:37.921204 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.921283 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:37.921320 fstat(10,  <unfinished ...>
[pid 25561] 10:12:37.921357 geteuid( <unfinished ...>
[pid 25559] 10:12:37.921380 <... mmap resumed> ) = 0x7ff9b2d37000
[pid 25558] 10:12:37.921401 read(14,  <unfinished ...>
[pid 25557] 10:12:37.921425 set_tid_address(0x7fc7a8f2aa90 <unfinished ...>
[pid 25543] 10:12:37.921449 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.921479 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25561] 10:12:37.921582 <... geteuid resumed> ) = 0
[pid 25559] 10:12:37.921598 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.921629 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25557] 10:12:37.921647 <... set_tid_address resumed> ) = 25557
[pid 25543] 10:12:37.921721 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.921767 fstat(10,  <unfinished ...>
[pid 25561] 10:12:37.921804 getegid( <unfinished ...>
[pid 25559] 10:12:37.921825 <... mmap resumed> ) = 0x7ff9b2029000
[pid 25558] 10:12:37.921842 read(14,  <unfinished ...>
[pid 25557] 10:12:37.921865 set_robust_list(0x7fc7a8f2aaa0, 24 <unfinished ...>
[pid 25543] 10:12:37.921888 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.921914 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25561] 10:12:37.921950 <... getegid resumed> ) = 12
[pid 25559] 10:12:37.921971 mprotect(0x7ff9b2035000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.922005 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25557] 10:12:37.922024 <... set_robust_list resumed> ) = 0
[pid 25543] 10:12:37.922050 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.922087 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25561] 10:12:37.922126 setgid(500 <unfinished ...>
[pid 25559] 10:12:37.922149 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.922163 read(14,  <unfinished ...>
[pid 25557] 10:12:37.922169 futex(0x7ffc5dbb099c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25543] 10:12:37.922183 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.922195 <... mmap resumed> ) = 0x7f21d336d000
[pid 25561] 10:12:37.922212 <... setgid resumed> ) = 0
[pid 25559] 10:12:37.922217 mmap(0x7ff9b2235000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000 <unfinished ...>
[pid 25558] 10:12:37.922234 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25557] 10:12:37.922242 <... futex resumed> ) = 0
[pid 25543] 10:12:37.922305 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.922336 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25561] 10:12:37.922357 setuid(503 <unfinished ...>
[pid 25559] 10:12:37.922363 <... mmap resumed> ) = 0x7ff9b2235000
[pid 25558] 10:12:37.922388 read(14,  <unfinished ...>
[pid 25557] 10:12:37.922395 futex(0x7ffc5dbb099c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fc7a8f2a7c0 <unfinished ...>
[pid 25543] 10:12:37.922412 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:37.922427 <... lseek resumed> ) = 0
[pid 25561] 10:12:37.922446 <... setuid resumed> ) = 0
[pid 25559] 10:12:37.922451 close(6 <unfinished ...>
[pid 25558] 10:12:37.922675 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25557] 10:12:37.922697 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25543] 10:12:37.922774 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:37.922822 read(10,  <unfinished ...>
[pid 25561] 10:12:37.922862 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.922894 <... close resumed> ) = 0
[pid 25558] 10:12:37.922917 read(14,  <unfinished ...>
[pid 25557] 10:12:37.922942 rt_sigaction(SIGRTMIN, {0x7fc7a7dedc60, [], SA_RESTORER|SA_SIGINFO, 0x7fc7a7df7790},  <unfinished ...>
[pid 25543] 10:12:37.922972 stat("/etc/localtime",  <unfinished ...>
[pid 25529] 10:12:37.922998 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25561] 10:12:37.923055 <... open resumed> ) = 9
[pid 25559] 10:12:37.923073 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.923119 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25557] 10:12:37.923137 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.923223 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25529] 10:12:37.923278 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25561] 10:12:37.923322 fstat(9,  <unfinished ...>
[pid 25559] 10:12:37.923345 <... open resumed> ) = 6
[pid 25558] 10:12:37.923360 read(14,  <unfinished ...>
[pid 25557] 10:12:37.923383 rt_sigaction(SIGRT_1, {0x7fc7a7dedcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fc7a7df7790},  <unfinished ...>
[pid 25543] 10:12:37.923411 write(8, "2015-12-30 10:12:37 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25529] 10:12:37.923442 <... stat resumed> 0x7ffce2d02b00) = -1 ENOENT (No such file or directory)
[pid 25561] 10:12:37.923484 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:37.923516 read(6,  <unfinished ...>
[pid 25558] 10:12:37.923652 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25557] 10:12:37.923748 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.923771 <... write resumed> ) = 101
[pid 25529] 10:12:37.923791 stat("/etc/localtime",  <unfinished ...>
[pid 25561] 10:12:37.923828 fstat(9,  <unfinished ...>
[pid 25559] 10:12:37.923851 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.923874 read(14,  <unfinished ...>
[pid 25557] 10:12:37.923898 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25543] 10:12:37.923924 stat("/etc/localtime",  <unfinished ...>
[pid 25529] 10:12:37.923950 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25561] 10:12:37.924002 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:37.924030 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.924057 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25557] 10:12:37.924080 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25543] 10:12:37.924118 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25529] 10:12:37.924154 write(8, "2015-12-30 10:12:37 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25561] 10:12:37.924181 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.924189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25558] 10:12:37.924214 read(14,  <unfinished ...>
[pid 25557] 10:12:37.924220 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25543] 10:12:37.924232 stat("/etc/localtime",  <unfinished ...>
[pid 25529] 10:12:37.924243 <... write resumed> ) = 132
[pid 25561] 10:12:37.924269 <... mmap resumed> ) = 0x7f33164fa000
[pid 25559] 10:12:37.924276 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.924291 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25557] 10:12:37.924299 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25543] 10:12:37.924414 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25529] 10:12:37.924442 stat("/etc/localtime",  <unfinished ...>
[pid 25561] 10:12:37.924464 read(9,  <unfinished ...>
[pid 25559] 10:12:37.924470 <... mmap resumed> ) = 0x7ff9b1e06000
[pid 25558] 10:12:37.924680 read(14,  <unfinished ...>
[pid 25557] 10:12:37.924739 statfs("/selinux",  <unfinished ...>
[pid 25543] 10:12:37.924775 close(7 <unfinished ...>
[pid 25529] 10:12:37.924802 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25561] 10:12:37.924854 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25559] 10:12:37.924876 mprotect(0x7ff9b1e27000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.924907 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25557] 10:12:37.924996 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350318, f_bavail=6350318, f_files=1000000, f_ffree=691072, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25543] 10:12:37.925067 <... close resumed> ) = 0
[pid 25529] 10:12:37.925097 stat("/etc/localtime",  <unfinished ...>
[pid 25561] 10:12:37.925134 read(9,  <unfinished ...>
[pid 25559] 10:12:37.925160 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.925178 read(14,  <unfinished ...>
[pid 25557] 10:12:37.925202 brk(0 <unfinished ...>
[pid 25543] 10:12:37.925225 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25529] 10:12:37.925260 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25561] 10:12:37.925302 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25559] 10:12:37.925321 mmap(0x7ff9b2027000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000 <unfinished ...>
[pid 25558] 10:12:37.925359 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25557] 10:12:37.925446 <... brk resumed> ) = 0x2541000
[pid 25543] 10:12:37.925467 <... open resumed> ) = 7
[pid 25529] 10:12:37.925565 close(7 <unfinished ...>
[pid 25561] 10:12:37.925610 close(9 <unfinished ...>
[pid 25559] 10:12:37.925640 <... mmap resumed> ) = 0x7ff9b2027000
[pid 25558] 10:12:37.925662 read(14,  <unfinished ...>
[pid 25557] 10:12:37.925694 brk(0x2562000 <unfinished ...>
[pid 25543] 10:12:37.925724 fcntl(7, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.925748 <... close resumed> ) = 0
[pid 25561] 10:12:37.925777 <... close resumed> ) = 0
[pid 25559] 10:12:37.925791 close(6 <unfinished ...>
[pid 25558] 10:12:37.925817 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25557] 10:12:37.925849 <... brk resumed> ) = 0x2562000
[pid 25543] 10:12:37.925876 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.925893 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25561] 10:12:37.925933 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25559] 10:12:37.925960 <... close resumed> ) = 0
[pid 25558] 10:12:37.925984 read(14,  <unfinished ...>
[pid 25557] 10:12:37.926010 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.926047 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25529] 10:12:37.926072 <... open resumed> ) = 7
[pid 25561] 10:12:37.926098 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.926113 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.926684 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25557] 10:12:37.926773 <... open resumed> ) = 6
[pid 25543] 10:12:37.926809 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.926828 fcntl(7, F_GETFD <unfinished ...>
[pid 25561] 10:12:37.926863 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.926886 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.926905 read(14,  <unfinished ...>
[pid 25557] 10:12:37.926929 fstat(6,  <unfinished ...>
[pid 25543] 10:12:37.926952 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.926975 <... fcntl resumed> ) = 0
[pid 25561] 10:12:37.926999 <... lseek resumed> ) = 19
[pid 25559] 10:12:37.927019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.927057 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25557] 10:12:37.927139 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25543] 10:12:37.927176 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5386654, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:37.927206 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25561] 10:12:37.927240 read(6,  <unfinished ...>
[pid 25559] 10:12:37.927263 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.927281 read(14,  <unfinished ...>
[pid 25557] 10:12:37.927305 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.927332 write(7, "2015-12-30 10:12:37 [25543] 1aEJMb-0006dp-8u ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25529] 10:12:37.927364 <... fcntl resumed> ) = 0
[pid 25561] 10:12:37.927391 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2420) = 1858
[pid 25559] 10:12:37.927410 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.928001 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25557] 10:12:37.928086 <... mmap resumed> ) = 0x7fc7a8f41000
[pid 25543] 10:12:37.928108 <... write resumed> ) = 110
[pid 25529] 10:12:37.928128 fstat(7,  <unfinished ...>
[pid 25561] 10:12:37.928162 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.928194 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.928215 read(14,  <unfinished ...>
[pid 25557] 10:12:37.928240 read(6,  <unfinished ...>
[pid 25543] 10:12:37.928330 close(14 <unfinished ...>
[pid 25529] 10:12:37.928356 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5386764, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25561] 10:12:37.928397 <... write resumed> ) = 4
[pid 25559] 10:12:37.928411 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.928446 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25557] 10:12:37.928519 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25543] 10:12:37.928556 <... close resumed> ) = 0
[pid 25529] 10:12:37.928574 write(7, "2015-12-30 10:12:37 [25529] 1aEJMb-0006df-04 => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2521 QT=0s DT=0s\n", 232 <unfinished ...>
[pid 25491] 10:12:37.928622 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25561] 10:12:37.928655 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.928680 <... open resumed> ) = 6
[pid 25558] 10:12:37.928696 read(14,  <unfinished ...>
[pid 25557] 10:12:37.928720 read(6,  <unfinished ...>
[pid 25543] 10:12:37.928746 munmap(0x7fe585ed6000, 4096 <unfinished ...>
[pid 25529] 10:12:37.928775 <... write resumed> ) = 232
[pid 25491] 10:12:37.928800 read(17,  <unfinished ...>
[pid 25561] 10:12:37.928838 <... write resumed> ) = 4
[pid 25559] 10:12:37.928851 read(6,  <unfinished ...>
[pid 25558] 10:12:37.928876 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25557] 10:12:37.928956 <... read resumed> "", 1024) = 0
[pid 25543] 10:12:37.928985 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.929005 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25491] 10:12:37.929044 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25561] 10:12:37.929073 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.929097 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.929120 read(14,  <unfinished ...>
[pid 25557] 10:12:37.929144 close(6 <unfinished ...>
[pid 25543] 10:12:37.929171 close(15 <unfinished ...>
[pid 25529] 10:12:37.929195 <... open resumed> ) = 11
[pid 25491] 10:12:37.929211 read(17,  <unfinished ...>
[pid 25561] 10:12:37.929245 <... write resumed> ) = 4
[pid 25559] 10:12:37.929258 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.929283 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25557] 10:12:37.929312 <... close resumed> ) = 0
[pid 25543] 10:12:37.929328 <... close resumed> ) = 0
[pid 25529] 10:12:37.929344 alarm(60 <unfinished ...>
[pid 25491] 10:12:37.929369 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25561] 10:12:37.929399 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25559] 10:12:37.929425 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.929456 read(14,  <unfinished ...>
[pid 25557] 10:12:37.929603 munmap(0x7fc7a8f41000, 4096 <unfinished ...>
[pid 25543] 10:12:37.929640 munmap(0x7fe585ed5000, 4096 <unfinished ...>
[pid 25529] 10:12:37.929666 <... alarm resumed> ) = 0
[pid 25491] 10:12:37.929682 read(17,  <unfinished ...>
[pid 25561] 10:12:37.929720 <... write resumed> ) = 40
[pid 25559] 10:12:37.929741 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.929781 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25557] 10:12:37.929823 <... munmap resumed> ) = 0
[pid 25543] 10:12:37.929897 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.929927 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25491] 10:12:37.929958 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25561] 10:12:37.929988 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.930013 <... mmap resumed> ) = 0x7ff9b1be9000
[pid 25558] 10:12:37.930029 read(14,  <unfinished ...>
[pid 25557] 10:12:37.930054 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25543] 10:12:37.930087 close(10 <unfinished ...>
[pid 25529] 10:12:37.930112 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.930128 read(17,  <unfinished ...>
[pid 25561] 10:12:37.930162 <... write resumed> ) = 4
[pid 25559] 10:12:37.930175 mprotect(0x7ff9b1c00000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.930203 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25557] 10:12:37.930303 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.930395 <... close resumed> ) = 0
[pid 25529] 10:12:37.930417 alarm(0 <unfinished ...>
[pid 25491] 10:12:37.930442 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25561] 10:12:37.930471 close(18 <unfinished ...>
[pid 25559] 10:12:37.930579 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.930598 read(14,  <unfinished ...>
[pid 25557] 10:12:37.930623 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fc7a7df7790},  <unfinished ...>
[pid 25543] 10:12:37.930651 munmap(0x7fe585eda000, 4096 <unfinished ...>
[pid 25529] 10:12:37.930679 <... alarm resumed> ) = 60
[pid 25491] 10:12:37.930750 wait4(-1,  <unfinished ...>
[pid 25561] 10:12:37.930786 <... close resumed> ) = 0
[pid 25559] 10:12:37.930799 mmap(0x7ff9b1e00000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25558] 10:12:37.930850 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25557] 10:12:37.930939 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.930970 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.930991 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25561] 10:12:37.931032 exit_group(0) = ?
[pid 25559] 10:12:37.931046 <... mmap resumed> ) = 0x7ff9b1e00000
[pid 25558] 10:12:37.931327 read(14,  <unfinished ...>
[pid 25557] 10:12:37.931357 fstat(2,  <unfinished ...>
[pid 25543] 10:12:37.931381 close(11 <unfinished ...>
[pid 25529] 10:12:37.931417 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
Process 25562 attached
[pid 25561] 10:12:37.931552 +++ exited with 0 +++
[pid 25559] 10:12:37.931589 mmap(0x7ff9b1e02000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.931623 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25557] 10:12:37.931701 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25543] 10:12:37.931773 <... close resumed> ) = 0
[pid 25529] 10:12:37.931794 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.931825 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25561
[pid 25562] 10:12:37.931856 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25559] 10:12:37.931879 <... mmap resumed> ) = 0x7ff9b1e02000
[pid 25558] 10:12:37.931900 read(14,  <unfinished ...>
[pid 25557] 10:12:37.931926 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fc7a7df7790},  <unfinished ...>
[pid 25543] 10:12:37.931953 munmap(0x7fe585ed9000, 4096 <unfinished ...>
[pid 25529] 10:12:37.931981 <... open resumed> ) = 12
[pid 25491] 10:12:37.931998 close(17 <unfinished ...>
[pid 25562] 10:12:37.932035 <... set_robust_list resumed> ) = 0
[pid 25559] 10:12:37.932049 close(6 <unfinished ...>
[pid 25558] 10:12:37.932096 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25557] 10:12:37.932183 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.932208 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.932227 fcntl(12, F_GETFD <unfinished ...>
[pid 25491] 10:12:37.932251 <... close resumed> ) = 0
[pid 25562] 10:12:37.932278 close(13 <unfinished ...>
[pid 25559] 10:12:37.932300 <... close resumed> ) = 0
[pid 25558] 10:12:37.932322 read(14,  <unfinished ...>
[pid 25557] 10:12:37.932348 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25543] 10:12:37.932384 close(9 <unfinished ...>
[pid 25529] 10:12:37.932414 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.932430 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25562] 10:12:37.932546 <... close resumed> ) = 0
[pid 25559] 10:12:37.932566 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.932610 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25557] 10:12:37.932694 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25543] 10:12:37.932719 <... close resumed> ) = 0
[pid 25529] 10:12:37.932735 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.932759 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25562] 10:12:37.932811 geteuid( <unfinished ...>
[pid 25559] 10:12:37.932836 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.932854 read(14,  <unfinished ...>
[pid 25557] 10:12:37.932878 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25543] 10:12:37.932904 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25529] 10:12:37.932931 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.932948 stat("/etc/userdomains",  <unfinished ...>
[pid 25562] 10:12:37.932985 <... geteuid resumed> ) = 0
[pid 25559] 10:12:37.932999 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.933033 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25557] 10:12:37.933118 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25543] 10:12:37.933147 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.933166 read(12,  <unfinished ...>
[pid 25491] 10:12:37.933190 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25562] 10:12:37.933244 getegid( <unfinished ...>
[pid 25559] 10:12:37.933269 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.933287 read(14,  <unfinished ...>
[pid 25557] 10:12:37.933311 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fc7a7df7790},  <unfinished ...>
[pid 25543] 10:12:37.933337 close(13 <unfinished ...>
[pid 25529] 10:12:37.933361 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25491] 10:12:37.933388 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25562] 10:12:37.933428 <... getegid resumed> ) = 12
[pid 25559] 10:12:37.933441 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.933481 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25557] 10:12:37.933552 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25543] 10:12:37.933586 <... close resumed> ) = 0
[pid 25529] 10:12:37.933604 close(12 <unfinished ...>
[pid 25491] 10:12:37.933628 <... open resumed> ) = 9
[pid 25562] 10:12:37.933656 setgid(500 <unfinished ...>
[pid 25559] 10:12:37.933679 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.933700 read(14,  <unfinished ...>
[pid 25557] 10:12:37.933724 umask(0 <unfinished ...>
[pid 25543] 10:12:37.933747 munmap(0x7fe585ed7000, 4096 <unfinished ...>
[pid 25529] 10:12:37.933773 <... close resumed> ) = 0
[pid 25491] 10:12:37.933797 fstat(9,  <unfinished ...>
[pid 25562] 10:12:37.933834 <... setgid resumed> ) = 0
[pid 25559] 10:12:37.933847 open("/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.933880 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25557] 10:12:37.934016 <... umask resumed> ) = 0
[pid 25543] 10:12:37.934081 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.934102 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.934131 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25562] 10:12:37.934176 setuid(503 <unfinished ...>
[pid 25559] 10:12:37.934202 <... open resumed> ) = 6
[pid 25558] 10:12:37.934218 read(14,  <unfinished ...>
[pid 25557] 10:12:37.934242 geteuid( <unfinished ...>
[pid 25543] 10:12:37.934264 close(12 <unfinished ...>
[pid 25529] 10:12:37.934288 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.934307 fstat(9,  <unfinished ...>
[pid 25562] 10:12:37.934343 <... setuid resumed> ) = 0
[pid 25559] 10:12:37.934361 read(6,  <unfinished ...>
[pid 25558] 10:12:37.934425 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25557] 10:12:37.934591 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.934620 <... close resumed> ) = 0
[pid 25529] 10:12:37.934638 stat("/var/tmp",  <unfinished ...>
[pid 25491] 10:12:37.934669 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25562] 10:12:37.934710 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.934741 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.934768 read(14,  <unfinished ...>
[pid 25557] 10:12:37.934793 getuid( <unfinished ...>
[pid 25543] 10:12:37.934815 munmap(0x7fe585ed8000, 4096 <unfinished ...>
[pid 25529] 10:12:37.934841 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25491] 10:12:37.934961 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25562] 10:12:37.935006 <... open resumed> ) = 9
[pid 25559] 10:12:37.935020 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.935051 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25557] 10:12:37.935127 <... getuid resumed> ) = 47
[pid 25543] 10:12:37.935152 <... munmap resumed> ) = 0
[pid 25529] 10:12:37.935185 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.935219 <... mmap resumed> ) = 0x7f33164fa000
[pid 25562] 10:12:37.935247 fstat(9,  <unfinished ...>
[pid 25559] 10:12:37.935269 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25558] 10:12:37.935299 read(14,  <unfinished ...>
[pid 25557] 10:12:37.935323 getgid( <unfinished ...>
[pid 25543] 10:12:37.935345 geteuid( <unfinished ...>
[pid 25529] 10:12:37.935367 <... open resumed> ) = 12
[pid 25491] 10:12:37.935383 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25562] 10:12:37.935419 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:37.935444 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.935589 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25557] 10:12:37.935681 <... getgid resumed> ) = 12
[pid 25543] 10:12:37.935730 <... geteuid resumed> ) = 0
[pid 25529] 10:12:37.935749 fcntl(12, F_GETFD <unfinished ...>
[pid 25491] 10:12:37.935772 <... lseek resumed> ) = 0
[pid 25562] 10:12:37.935800 brk(0x2136000 <unfinished ...>
[pid 25559] 10:12:37.935825 <... mmap resumed> ) = 0x7ff9b2d36000
[pid 25558] 10:12:37.935845 read(14,  <unfinished ...>
[pid 25557] 10:12:37.935871 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25543] 10:12:37.935894 getegid( <unfinished ...>
[pid 25529] 10:12:37.935915 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.935931 read(9,  <unfinished ...>
[pid 25562] 10:12:37.935968 <... brk resumed> ) = 0x2136000
[pid 25559] 10:12:37.935981 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.936074 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25557] 10:12:37.936137 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25543] 10:12:37.936161 <... getegid resumed> ) = 12
[pid 25529] 10:12:37.936179 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.936205 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25562] 10:12:37.936253 fstat(9,  <unfinished ...>
[pid 25559] 10:12:37.936279 <... mmap resumed> ) = 0x7ff9b1875000
[pid 25558] 10:12:37.936296 brk(0x1969000 <unfinished ...>
[pid 25557] 10:12:37.936349 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25543] 10:12:37.936395 setgid(12 <unfinished ...>
[pid 25529] 10:12:37.936426 <... fcntl resumed> ) = 0
[pid 25491] 10:12:37.936449 stat("/etc/userdomains",  <unfinished ...>
[pid 25562] 10:12:37.936562 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:37.936593 mprotect(0x7ff9b19e4000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.936627 <... brk resumed> ) = 0x1969000
[pid 25557] 10:12:37.936660 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25543] 10:12:37.936684 <... setgid resumed> ) = 0
[pid 25529] 10:12:37.936701 fstat(12,  <unfinished ...>
[pid 25491] 10:12:37.936725 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25562] 10:12:37.936776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.936805 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.936822 read(14,  <unfinished ...>
[pid 25557] 10:12:37.936846 getgroups(65536,  <unfinished ...>
[pid 25543] 10:12:37.936868 setuid(47 <unfinished ...>
[pid 25529] 10:12:37.936892 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:37.936937 stat("/etc/userdomains",  <unfinished ...>
[pid 25562] 10:12:37.936979 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25559] 10:12:37.936993 mmap(0x7ff9b1be3000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25558] 10:12:37.937025 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25557] 10:12:37.937111 <... getgroups resumed> [12]) = 1
[pid 25543] 10:12:37.937140 <... setuid resumed> ) = 0
[pid 25529] 10:12:37.937162 pread(12,  <unfinished ...>
[pid 25491] 10:12:37.937188 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25562] 10:12:37.937283 read(9,  <unfinished ...>
[pid 25559] 10:12:37.937323 <... mmap resumed> ) = 0x7ff9b1be3000
[pid 25558] 10:12:37.937350 read(14,  <unfinished ...>
[pid 25557] 10:12:37.937378 setgroups(0, [] <unfinished ...>
[pid 25543] 10:12:37.937402 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fe583adb6a0},  <unfinished ...>
[pid 25529] 10:12:37.937430 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25491] 10:12:37.937469 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25562] 10:12:37.937599 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25559] 10:12:37.937619 close(6 <unfinished ...>
[pid 25558] 10:12:37.937645 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25557] 10:12:37.937728 <... setgroups resumed> ) = 0
[pid 25543] 10:12:37.937752 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25529] 10:12:37.937784 pread(12,  <unfinished ...>
[pid 25491] 10:12:37.937810 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25562] 10:12:37.937845 read(9,  <unfinished ...>
[pid 25559] 10:12:37.937873 <... close resumed> ) = 0
[pid 25558] 10:12:37.937897 read(14,  <unfinished ...>
[pid 25557] 10:12:37.937923 getegid( <unfinished ...>
[pid 25543] 10:12:37.937945 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25529] 10:12:37.937974 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25491] 10:12:37.938159 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25562] 10:12:37.938205 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25559] 10:12:37.938230 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.938266 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25557] 10:12:37.938346 <... getegid resumed> ) = 12
[pid 25543] 10:12:37.938376 <... write resumed> ) = 36
[pid 25529] 10:12:37.938401 close(12 <unfinished ...>
[pid 25491] 10:12:37.938427 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25562] 10:12:37.938565 close(9 <unfinished ...>
[pid 25559] 10:12:37.938597 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.938616 read(14,  <unfinished ...>
[pid 25557] 10:12:37.938640 geteuid( <unfinished ...>
[pid 25543] 10:12:37.938662 stat("/etc/localtime",  <unfinished ...>
[pid 25529] 10:12:37.938689 <... close resumed> ) = 0
[pid 25491] 10:12:37.938721 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25562] 10:12:37.938763 <... close resumed> ) = 0
[pid 25559] 10:12:37.938777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.938812 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25557] 10:12:37.938889 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.938916 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25529] 10:12:37.938956 close(11 <unfinished ...>
[pid 25491] 10:12:37.938985 <... open resumed> ) = 10
[pid 25562] 10:12:37.939012 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25559] 10:12:37.939039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.939057 read(14,  <unfinished ...>
[pid 25557] 10:12:37.939081 geteuid( <unfinished ...>
[pid 25543] 10:12:37.939103 stat("/etc/localtime",  <unfinished ...>
[pid 25529] 10:12:37.939129 <... close resumed> ) = 0
[pid 25491] 10:12:37.939166 fstat(10,  <unfinished ...>
[pid 25562] 10:12:37.939203 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.939216 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.939727 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25557] 10:12:37.939816 <... geteuid resumed> ) = 0
[pid 25543] 10:12:37.939838 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25529] 10:12:37.939874 pipe( <unfinished ...>
[pid 25491] 10:12:37.939902 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25562] 10:12:37.939946 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.939987 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.940010 read(14,  <unfinished ...>
[pid 25557] 10:12:37.940035 getegid( <unfinished ...>
[pid 25543] 10:12:37.940058 close(7 <unfinished ...>
[pid 25529] 10:12:37.940084 <... pipe resumed> [11, 12]) = 0
[pid 25491] 10:12:37.940104 fstat(10,  <unfinished ...>
[pid 25562] 10:12:37.940138 <... lseek resumed> ) = 19
[pid 25559] 10:12:37.940152 open("/usr/lib64/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.940188 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25557] 10:12:37.940268 <... getegid resumed> ) = 12
[pid 25543] 10:12:37.940296 <... close resumed> ) = 0
[pid 25529] 10:12:37.940318 close(10 <unfinished ...>
[pid 25491] 10:12:37.940343 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25562] 10:12:37.940384 read(6,  <unfinished ...>
[pid 25559] 10:12:37.940408 <... open resumed> ) = 6
[pid 25558] 10:12:37.940425 read(14,  <unfinished ...>
[pid 25557] 10:12:37.940448 setgid(12 <unfinished ...>
[pid 25543] 10:12:37.940471 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25529] 10:12:37.940576 <... close resumed> ) = 0
[pid 25491] 10:12:37.940594 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25562] 10:12:37.940633 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2369) = 1858
[pid 25559] 10:12:37.940652 read(6,  <unfinished ...>
[pid 25558] 10:12:37.941148 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25557] 10:12:37.941231 <... setgid resumed> ) = 0
[pid 25543] 10:12:37.941255 <... open resumed> ) = 7
[pid 25529] 10:12:37.941273 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25491] 10:12:37.941302 <... mmap resumed> ) = 0x7f33164f9000
[pid 25562] 10:12:37.941330 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.941363 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.941388 read(14,  <unfinished ...>
[pid 25557] 10:12:37.941413 setuid(0 <unfinished ...>
[pid 25543] 10:12:37.941437 fcntl(7, F_GETFD <unfinished ...>
[pid 25529] 10:12:37.941466 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.941592 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25562] 10:12:37.941635 <... write resumed> ) = 4
[pid 25559] 10:12:37.941649 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.941675 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25557] 10:12:37.941763 <... setuid resumed> ) = 0
[pid 25544] 10:12:37.941815 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25543] 10:12:37.941839 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.941856 clone( <unfinished ...>
[pid 25491] 10:12:37.942130 <... lseek resumed> ) = 0
[pid 25562] 10:12:37.942161 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.942187 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25558] 10:12:37.942219 read(14,  <unfinished ...>
[pid 25557] 10:12:37.942244 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.942273 read(13,  <unfinished ...>
[pid 25543] 10:12:37.942297 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.942322 read(10,  <unfinished ...>
[pid 25562] 10:12:37.942361 <... write resumed> ) = 4
[pid 25559] 10:12:37.942375 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.942406 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25557] 10:12:37.942438 <... open resumed> ) = 6
[pid 25544] 10:12:37.942473 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25543] 10:12:37.942500 <... fcntl resumed> ) = 0
[pid 25529] 10:12:37.942518 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25563
[pid 25491] 10:12:37.942559 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25562] 10:12:37.942599 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.942625 <... mmap resumed> ) = 0x7ff9b15e6000
[pid 25558] 10:12:37.942641 read(14,  <unfinished ...>
[pid 25557] 10:12:37.942665 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.942696 read(13,  <unfinished ...>
[pid 25543] 10:12:37.942726 fstat(7,  <unfinished ...>
[pid 25529] 10:12:37.942756 close(12 <unfinished ...>
[pid 25491] 10:12:37.942783 read(10,  <unfinished ...>
[pid 25562] 10:12:37.942820 <... write resumed> ) = 4
[pid 25559] 10:12:37.942834 mprotect(0x7ff9b1671000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.942864 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25557] 10:12:37.942947 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:37.942987 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25543] 10:12:37.943009 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5386996, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:37.943039 <... close resumed> ) = 0
[pid 25491] 10:12:37.943056 <... read resumed> "", 4096) = 0
[pid 25562] 10:12:37.943104 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25559] 10:12:37.943133 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.943150 read(14,  <unfinished ...>
[pid 25557] 10:12:37.943180 fstat(6,  <unfinished ...>
[pid 25544] 10:12:37.943203 read(13,  <unfinished ...>
[pid 25543] 10:12:37.943228 write(7, "2015-12-30 10:12:37 [25543] 1aEJMb-0006dp-8u Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25529] 10:12:37.943258 read(11,  <unfinished ...>
[pid 25491] 10:12:37.943280 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25562] 10:12:37.943321 <... write resumed> ) = 40
[pid 25559] 10:12:37.943334 mmap(0x7ff9b1871000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25558] 10:12:37.943370 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25557] 10:12:37.943603 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:37.943645 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25543] 10:12:37.943665 <... write resumed> ) = 77
[pid 25491] 10:12:37.943684 <... open resumed> ) = 11
[pid 25562] 10:12:37.943716 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:37.943743 <... mmap resumed> ) = 0x7ff9b1871000
[pid 25558] 10:12:37.943766 read(14,  <unfinished ...>
[pid 25557] 10:12:37.943791 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.943818 read(13,  <unfinished ...>
[pid 25543] 10:12:37.943840 open("/var/spool/exim/input/b/hdr.25543", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25491] 10:12:37.943912 fstat(11,  <unfinished ...>
[pid 25562] 10:12:37.943949 <... write resumed> ) = 4
[pid 25559] 10:12:37.943963 mmap(0x7ff9b1874000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.943995 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25557] 10:12:37.944025 <... mmap resumed> ) = 0x7fc7a8f41000
[pid 25544] 10:12:37.944043 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25543] 10:12:37.944060 <... open resumed> ) = 9
[pid 25491] 10:12:37.944077 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25562] 10:12:37.944116 close(14 <unfinished ...>
[pid 25559] 10:12:37.944140 <... mmap resumed> ) = 0x7ff9b1874000
[pid 25558] 10:12:37.944162 read(14,  <unfinished ...>
[pid 25557] 10:12:37.944188 read(6,  <unfinished ...>
[pid 25544] 10:12:37.944216 wait4(-1,  <unfinished ...>
[pid 25543] 10:12:37.944238 fchown(9, 47, 12 <unfinished ...>
[pid 25491] 10:12:37.944267 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25562] 10:12:37.944302 <... close resumed> ) = 0
[pid 25559] 10:12:37.944316 close(6 <unfinished ...>
[pid 25558] 10:12:37.944353 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25557] 10:12:37.944436 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25543] 10:12:37.944651 <... fchown resumed> ) = 0
[pid 25491] 10:12:37.944678 <... mmap resumed> ) = 0x7f33164f8000
[pid 25562] 10:12:37.944706 exit_group(0) = ?
[pid 25559] 10:12:37.944721 <... close resumed> ) = 0
[pid 25558] 10:12:37.944985 read(14,  <unfinished ...>
[pid 25557] 10:12:37.945016 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25543] 10:12:37.945048 fchmod(9, 0640 <unfinished ...>
[pid 25491] 10:12:37.945076 read(11,  <unfinished ...>
[pid 25562] 10:12:37.945125 +++ exited with 0 +++
[pid 25559] 10:12:37.945138 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.945170 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25557] 10:12:37.945203 <... socket resumed> ) = 7
[pid 25544] 10:12:37.945221 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25562
[pid 25543] 10:12:37.945240 <... fchmod resumed> ) = 0
[pid 25491] 10:12:37.945257 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:37.945297 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.945316 read(14,  <unfinished ...>
[pid 25557] 10:12:37.945340 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.945378 close(13 <unfinished ...>
[pid 25543] 10:12:37.945404 fcntl(9, F_GETFL <unfinished ...>
[pid 25491] 10:12:37.945427 close(11 <unfinished ...>
[pid 25559] 10:12:37.945461 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.945501 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25557] 10:12:37.945603 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.945626 <... close resumed> ) = 0
[pid 25543] 10:12:37.945642 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25491] 10:12:37.945662 <... close resumed> ) = 0
[pid 25559] 10:12:37.945687 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.945705 read(14,  <unfinished ...>
[pid 25557] 10:12:37.945729 close(7 <unfinished ...>
[pid 25544] 10:12:37.945756 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25543] 10:12:37.945784 fstat(9,  <unfinished ...>
[pid 25491] 10:12:37.945808 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25559] 10:12:37.945845 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.945876 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25557] 10:12:37.945959 <... close resumed> ) = 0
[pid 25544] 10:12:37.945979 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25543] 10:12:37.946019 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080194, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25491] 10:12:37.946058 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.946099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.946123 read(14,  <unfinished ...>
[pid 25557] 10:12:37.946148 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.946176 stat("/etc/userdomains",  <unfinished ...>
[pid 25543] 10:12:37.946202 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.946229 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.946264 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.946296 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25557] 10:12:37.946381 <... socket resumed> ) = 7
[pid 25544] 10:12:37.946403 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.946447 <... mmap resumed> ) = 0x7fe585edb000
[pid 25491] 10:12:37.946468 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.946654 <... open resumed> ) = 6
[pid 25558] 10:12:37.946674 read(14,  <unfinished ...>
[pid 25557] 10:12:37.946699 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.946733 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.946762 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25491] 10:12:37.946785 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25559] 10:12:37.946831 read(6,  <unfinished ...>
[pid 25558] 10:12:37.946862 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25557] 10:12:37.946957 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.946980 <... open resumed> ) = 9
[pid 25543] 10:12:37.946997 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.947034 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25559] 10:12:37.947089 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.947115 read(14,  <unfinished ...>
[pid 25557] 10:12:37.947140 close(7 <unfinished ...>
[pid 25544] 10:12:37.947167 fstat(9,  <unfinished ...>
[pid 25543] 10:12:37.947189 write(9, "1aEJMb-0006dp-8u-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 75\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491957\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25491] 10:12:37.947229 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.947268 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.947292 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25557] 10:12:37.947379 <... close resumed> ) = 0
[pid 25544] 10:12:37.947406 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.947441 <... write resumed> ) = 268
[pid 25491] 10:12:37.947460 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.947527 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25558] 10:12:37.947563 read(14,  <unfinished ...>
[pid 25557] 10:12:37.947589 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.947618 fstat(9,  <unfinished ...>
[pid 25543] 10:12:37.947641 fstat(9,  <unfinished ...>
[pid 25491] 10:12:37.947664 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.947711 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.947748 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25557] 10:12:37.947847 <... open resumed> ) = 7
[pid 25544] 10:12:37.947872 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.947904 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080194, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25491] 10:12:37.947935 <... open resumed> ) = 11
[pid 25559] 10:12:37.947955 <... mmap resumed> ) = 0x7ff9b13e0000
[pid 25558] 10:12:37.947964 read(14,  <unfinished ...>
[pid 25557] 10:12:37.947975 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.947984 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.947996 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMb-0006dp-8u\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:37 -0600\n144  X-Failed-Recipients: Jennifer.Gonzales@onehospitalitygroup.com,\n  gretchen"..., 779 <unfinished ...>
[pid 25491] 10:12:37.948013 fstat(11,  <unfinished ...>
[pid 25559] 10:12:37.948031 mprotect(0x7ff9b13e6000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.948045 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25557] 10:12:37.948111 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25544] 10:12:37.948133 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25543] 10:12:37.948142 <... write resumed> ) = 779
[pid 25491] 10:12:37.948154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.948185 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.948193 read(14,  <unfinished ...>
[pid 25557] 10:12:37.948204 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.948215 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.948224 fsync(9 <unfinished ...>
[pid 25491] 10:12:37.948265 fstat(11,  <unfinished ...>
[pid 25559] 10:12:37.948285 mmap(0x7ff9b15e5000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25558] 10:12:37.948300 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25557] 10:12:37.948369 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:37.948380 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.948389 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.948417 <... mmap resumed> ) = 0x7ff9b15e5000
[pid 25558] 10:12:37.948430 read(14,  <unfinished ...>
[pid 25557] 10:12:37.948448 read(7,  <unfinished ...>
[pid 25544] 10:12:37.948460 read(9,  <unfinished ...>
[pid 25491] 10:12:37.948474 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.948774 close(6 <unfinished ...>
[pid 25558] 10:12:37.948798 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25557] 10:12:37.948874 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25544] 10:12:37.948917 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25543] 10:12:37.948954 <... fsync resumed> ) = 0
[pid 25491] 10:12:37.948975 <... mmap resumed> ) = 0x7f33164f8000
[pid 25559] 10:12:37.949002 <... close resumed> ) = 0
[pid 25558] 10:12:37.949025 read(14,  <unfinished ...>
[pid 25557] 10:12:37.949051 read(7,  <unfinished ...>
[pid 25544] 10:12:37.949074 stat("/etc/userdomains",  <unfinished ...>
[pid 25543] 10:12:37.949100 fstat(9,  <unfinished ...>
[pid 25491] 10:12:37.949123 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.949155 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.949186 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25557] 10:12:37.949268 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:37.949291 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.949333 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080194, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1047, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25491] 10:12:37.949364 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.949393 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.949413 read(14,  <unfinished ...>
[pid 25557] 10:12:37.949438 close(7 <unfinished ...>
[pid 25544] 10:12:37.949462 stat("/etc/userdomains",  <unfinished ...>
[pid 25543] 10:12:37.949568 close(9 <unfinished ...>
[pid 25491] 10:12:37.949595 read(11,  <unfinished ...>
[pid 25559] 10:12:37.949632 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.949667 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25557] 10:12:37.949725 <... close resumed> ) = 0
[pid 25544] 10:12:37.949745 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25543] 10:12:37.949806 <... close resumed> ) = 0
[pid 25491] 10:12:37.949828 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25559] 10:12:37.949880 <... open resumed> ) = 6
[pid 25558] 10:12:37.949900 brk(0x198a000 <unfinished ...>
[pid 25557] 10:12:37.949925 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:37.949953 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter",  <unfinished ...>
[pid 25543] 10:12:37.949983 munmap(0x7fe585edb000, 4096 <unfinished ...>
[pid 25491] 10:12:37.950009 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.950055 read(6,  <unfinished ...>
[pid 25558] 10:12:37.950080 <... brk resumed> ) = 0x198a000
[pid 25557] 10:12:37.950128 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.950163 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25543] 10:12:37.950188 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.950211 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.950258 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.950290 read(14,  <unfinished ...>
[pid 25557] 10:12:37.950315 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.950348 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25543] 10:12:37.950381 rename("/var/spool/exim/input/b/hdr.25543", "/var/spool/exim/input/b/1aEJMb-0006dp-8u-H" <unfinished ...>
[pid 25491] 10:12:37.950563 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:37.950611 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.950635 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25557] 10:12:37.950723 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.950746 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25543] 10:12:37.950788 <... rename resumed> ) = 0
[pid 25491] 10:12:37.950809 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:37.950860 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25558] 10:12:37.950892 read(14,  <unfinished ...>
[pid 25557] 10:12:37.950917 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.950950 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25543] 10:12:37.950978 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25491] 10:12:37.951008 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.951045 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.951073 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25557] 10:12:37.951104 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.951122 <... open resumed> ) = 10
[pid 25543] 10:12:37.951139 <... open resumed> ) = 9
[pid 25491] 10:12:37.951155 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.951216 <... mmap resumed> ) = 0x7ff9b2d35000
[pid 25558] 10:12:37.951239 read(14,  <unfinished ...>
[pid 25557] 10:12:37.951265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.951296 fstat(10,  <unfinished ...>
[pid 25543] 10:12:37.951318 fsync(9 <unfinished ...>
[pid 25491] 10:12:37.951342 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25559] 10:12:37.951380 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.951409 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25557] 10:12:37.951497 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.951522 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25543] 10:12:37.951555 <... fsync resumed> ) = 0
[pid 25491] 10:12:37.951572 <... stat resumed> 0x7ffc861573a0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.951606 <... mmap resumed> ) = 0x7ff9b10aa000
[pid 25558] 10:12:37.951625 read(14,  <unfinished ...>
[pid 25557] 10:12:37.951650 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.951679 fstat(10,  <unfinished ...>
[pid 25543] 10:12:37.951703 close(9 <unfinished ...>
[pid 25491] 10:12:37.951727 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.951762 mprotect(0x7ff9b11d6000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.951790 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25557] 10:12:37.951865 <... open resumed> ) = 7
[pid 25544] 10:12:37.951885 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25543] 10:12:37.951914 <... close resumed> ) = 0
[pid 25491] 10:12:37.951931 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.951982 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.952001 read(14,  <unfinished ...>
[pid 25557] 10:12:37.952026 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.952049 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25543] 10:12:37.952072 close(8 <unfinished ...>
[pid 25491] 10:12:37.952084 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.952107 mmap(0x7ff9b13d6000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000 <unfinished ...>
[pid 25558] 10:12:37.952124 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25557] 10:12:37.952185 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:37.952207 <... mmap resumed> ) = 0x7fa692c1e000
[pid 25543] 10:12:37.952216 <... close resumed> ) = 0
[pid 25491] 10:12:37.952224 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.952283 <... mmap resumed> ) = 0x7ff9b13d6000
[pid 25558] 10:12:37.952298 read(14,  <unfinished ...>
[pid 25557] 10:12:37.952310 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25544] 10:12:37.952322 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25543] 10:12:37.952331 munmap(0x7fe585edc000, 4096 <unfinished ...>
[pid 25491] 10:12:37.952345 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.952372 mmap(0x7ff9b13df000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.952386 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25557] 10:12:37.952456 <... mmap resumed> ) = 0x7fc7a8f20000
[pid 25544] 10:12:37.952467 <... lseek resumed> ) = 0
[pid 25543] 10:12:37.952682 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.952715 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.952773 <... mmap resumed> ) = 0x7ff9b13df000
[pid 25558] 10:12:37.952799 read(14,  <unfinished ...>
[pid 25557] 10:12:37.952826 close(7 <unfinished ...>
[pid 25544] 10:12:37.952849 read(10,  <unfinished ...>
[pid 25543] 10:12:37.952875 unlink("/var/spool/exim/input/b/1aEJMb-0006dp-8u-J" <unfinished ...>
[pid 25491] 10:12:37.952907 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25559] 10:12:37.952943 close(6 <unfinished ...>
[pid 25558] 10:12:37.952966 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25557] 10:12:37.953093 <... close resumed> ) = 0
[pid 25544] 10:12:37.953129 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25543] 10:12:37.953177 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.953200 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25559] 10:12:37.953252 <... close resumed> ) = 0
[pid 25558] 10:12:37.953278 read(14,  <unfinished ...>
[pid 25557] 10:12:37.953306 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:37.953340 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25543] 10:12:37.953368 close(6 <unfinished ...>
[pid 25491] 10:12:37.953396 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.953434 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.953465 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25557] 10:12:37.953548 <... open resumed> ) = 7
[pid 25544] 10:12:37.953571 <... open resumed> ) = 11
[pid 25543] 10:12:37.953590 <... close resumed> ) = 0
[pid 25491] 10:12:37.953735 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.953798 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.953819 read(14,  <unfinished ...>
[pid 25557] 10:12:37.953851 read(7,  <unfinished ...>
[pid 25544] 10:12:37.953874 fstat(11,  <unfinished ...>
[pid 25543] 10:12:37.953897 exit_group(0) = ?
[pid 25491] 10:12:37.954550 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.954653 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.954690 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25557] 10:12:37.954767 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25544] 10:12:37.954797 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25543] 10:12:37.954826 +++ exited with 0 +++
[pid 25491] 10:12:37.954839 <... lseek resumed> ) = 2781
[pid 25559] 10:12:37.954883 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.954905 read(14,  <unfinished ...>
[pid 25557] 10:12:37.954931 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.954954 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.954981 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.955015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.955047 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25557] 10:12:37.955078 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25544] 10:12:37.955113 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25491] 10:12:37.955131 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.955175 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.955197 read(14,  <unfinished ...>
[pid 25557] 10:12:37.955222 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25544] 10:12:37.955255 read(11,  <unfinished ...>
[pid 25491] 10:12:37.955282 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:37.955332 open("/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.955393 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25557] 10:12:37.955748 <... mmap resumed> ) = 0x7fc7a48bb000
[pid 25544] 10:12:37.955776 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:37.955817 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:37.955871 <... open resumed> ) = 6
[pid 25558] 10:12:37.955890 read(14,  <unfinished ...>
[pid 25557] 10:12:37.955915 mprotect(0x7fc7a48c7000, 2097152, PROT_NONE <unfinished ...>
[pid 25544] 10:12:37.955943 close(11 <unfinished ...>
[pid 25491] 10:12:37.955968 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.956007 read(6,  <unfinished ...>
[pid 25558] 10:12:37.956030 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25557] 10:12:37.956108 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.956129 <... close resumed> ) = 0
[pid 25491] 10:12:37.956146 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.956208 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.956235 read(14,  <unfinished ...>
[pid 25557] 10:12:37.956260 mmap(0x7fc7a4ac7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25544] 10:12:37.956291 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25491] 10:12:37.956319 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25559] 10:12:37.956356 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.956379 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25557] 10:12:37.956463 <... mmap resumed> ) = 0x7fc7a4ac7000
[pid 25544] 10:12:37.956499 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.956552 <... stat resumed> 0x7ffc861573a0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.956591 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.956625 read(14,  <unfinished ...>
[pid 25557] 10:12:37.956650 close(7 <unfinished ...>
[pid 25544] 10:12:37.956673 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.956703 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.956736 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.956766 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25557] 10:12:37.956854 <... close resumed> ) = 0
[pid 25544] 10:12:37.956898 <... open resumed> ) = 11
[pid 25491] 10:12:37.956918 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.956972 <... mmap resumed> ) = 0x7ff9b0ea6000
[pid 25558] 10:12:37.956991 read(14,  <unfinished ...>
[pid 25557] 10:12:37.957016 mprotect(0x7fc7a4ac7000, 4096, PROT_READ <unfinished ...>
[pid 25544] 10:12:37.957043 fstat(11,  <unfinished ...>
[pid 25491] 10:12:37.957066 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.957102 mprotect(0x7ff9b0ea8000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.957129 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25557] 10:12:37.957202 <... mprotect resumed> ) = 0
[pid 25544] 10:12:37.957226 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.957259 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.957315 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.957326 read(14,  <unfinished ...>
[pid 25557] 10:12:37.957337 munmap(0x7fc7a8f20000, 39387 <unfinished ...>
[pid 25544] 10:12:37.957359 fstat(11,  <unfinished ...>
[pid 25491] 10:12:37.957368 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.957395 mmap(0x7ff9b10a8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25558] 10:12:37.957412 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25557] 10:12:37.957667 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.957701 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.957734 <... open resumed> ) = 12
[pid 25559] 10:12:37.957760 <... mmap resumed> ) = 0x7ff9b10a8000
[pid 25558] 10:12:37.957786 read(14,  <unfinished ...>
[pid 25557] 10:12:37.957813 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.957843 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.957869 fstat(12,  <unfinished ...>
[pid 25559] 10:12:37.957900 close(6 <unfinished ...>
[pid 25558] 10:12:37.957923 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25557] 10:12:37.957952 <... open resumed> ) = 7
[pid 25544] 10:12:37.957974 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25491] 10:12:37.957991 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.958037 <... close resumed> ) = 0
[pid 25558] 10:12:37.958061 read(14,  <unfinished ...>
[pid 25557] 10:12:37.958087 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:37.958110 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.958133 fstat(12,  <unfinished ...>
[pid 25559] 10:12:37.958163 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.958193 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25557] 10:12:37.958272 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25544] 10:12:37.958298 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.958316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.958352 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.958371 read(14,  <unfinished ...>
[pid 25557] 10:12:37.958397 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.958420 read(11,  <unfinished ...>
[pid 25491] 10:12:37.958447 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.958486 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.958522 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25557] 10:12:37.958552 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:37.958582 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25491] 10:12:37.958615 <... mmap resumed> ) = 0x7f33164f7000
[pid 25559] 10:12:37.958643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.958661 read(14,  <unfinished ...>
[pid 25557] 10:12:37.958685 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.958711 stat("/jail_owner",  <unfinished ...>
[pid 25491] 10:12:37.958738 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.958769 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.958799 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25557] 10:12:37.958873 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:37.958894 <... stat resumed> 0x7ffc5380b880) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.958918 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.958945 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.958969 read(14,  <unfinished ...>
[pid 25557] 10:12:37.958995 read(7,  <unfinished ...>
[pid 25544] 10:12:37.959021 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:37.959053 read(12,  <unfinished ...>
[pid 25559] 10:12:37.959086 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.959118 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25557] 10:12:37.959149 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:37.959185 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:37.959213 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:37.959244 <... open resumed> ) = 6
[pid 25558] 10:12:37.959253 read(14,  <unfinished ...>
[pid 25557] 10:12:37.959264 close(7 <unfinished ...>
[pid 25544] 10:12:37.959274 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassy-airport_finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25491] 10:12:37.959292 stat("/jail_owner",  <unfinished ...>
[pid 25559] 10:12:37.959312 read(6,  <unfinished ...>
[pid 25558] 10:12:37.959321 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25557] 10:12:37.959400 <... close resumed> ) = 0
[pid 25544] 10:12:37.959411 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.959429 <... stat resumed> 0x7ffc86158950) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.959457 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.959683 read(14,  <unfinished ...>
[pid 25557] 10:12:37.959716 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:37.959745 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:37.959774 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25559] 10:12:37.959810 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.959833 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25557] 10:12:37.959919 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.959963 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:37.960009 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:37.960054 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.960088 read(14,  <unfinished ...>
[pid 25557] 10:12:37.960121 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.960150 stat("/usr/local/cpanel/3rdparty/mailman/lists/embassy-airport/config.pck",  <unfinished ...>
[pid 25491] 10:12:37.960181 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25559] 10:12:37.960219 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.960249 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25557] 10:12:37.960282 <... socket resumed> ) = 7
[pid 25544] 10:12:37.960300 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:37.960323 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.960357 <... mmap resumed> ) = 0x7ff9b0ca3000
[pid 25558] 10:12:37.960378 read(14,  <unfinished ...>
[pid 25557] 10:12:37.960404 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.960438 stat("/etc/demouids",  <unfinished ...>
[pid 25491] 10:12:37.960465 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25559] 10:12:37.960583 mprotect(0x7ff9b0ca5000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.960612 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25557] 10:12:37.960724 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.960749 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.960806 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:37.960853 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.960871 read(14,  <unfinished ...>
[pid 25557] 10:12:37.960896 close(7 <unfinished ...>
[pid 25544] 10:12:37.960922 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.960951 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25559] 10:12:37.960988 mmap(0x7ff9b0ea4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25558] 10:12:37.961018 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25557] 10:12:37.961109 <... close resumed> ) = 0
[pid 25544] 10:12:37.961131 <... open resumed> ) = 12
[pid 25491] 10:12:37.961148 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.961179 <... mmap resumed> ) = 0x7ff9b0ea4000
[pid 25558] 10:12:37.961204 read(14,  <unfinished ...>
[pid 25557] 10:12:37.961231 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:37.961258 fstat(12,  <unfinished ...>
[pid 25491] 10:12:37.961282 stat("/etc/demouids",  <unfinished ...>
[pid 25559] 10:12:37.961316 close(6 <unfinished ...>
[pid 25558] 10:12:37.961338 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25557] 10:12:37.961424 <... socket resumed> ) = 7
[pid 25544] 10:12:37.961444 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.961482 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.961533 <... close resumed> ) = 0
[pid 25558] 10:12:37.961558 read(14,  <unfinished ...>
[pid 25557] 10:12:37.961585 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:37.961618 fstat(12,  <unfinished ...>
[pid 25491] 10:12:37.961641 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.961677 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.961707 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25557] 10:12:37.961737 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:37.961756 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.961784 <... open resumed> ) = 13
[pid 25559] 10:12:37.961809 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.961826 brk(0x19ab000 <unfinished ...>
[pid 25557] 10:12:37.961851 close(7 <unfinished ...>
[pid 25544] 10:12:37.961876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.961902 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.961933 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.961965 <... brk resumed> ) = 0x19ab000
[pid 25557] 10:12:37.962053 <... close resumed> ) = 0
[pid 25544] 10:12:37.962079 <... mmap resumed> ) = 0x7fa692c1c000
[pid 25491] 10:12:37.962098 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.962139 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.962157 read(14,  <unfinished ...>
[pid 25557] 10:12:37.962182 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.962216 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.962241 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.962272 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.962301 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25557] 10:12:37.962324 <... open resumed> ) = 7
[pid 25544] 10:12:37.962334 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.962344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.962377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.962393 read(14,  <unfinished ...>
[pid 25557] 10:12:37.962404 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.962413 read(12,  <unfinished ...>
[pid 25491] 10:12:37.962422 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.962447 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.962466 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25557] 10:12:37.962713 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:37.962752 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:37.962778 <... mmap resumed> ) = 0x7f33164f6000
[pid 25559] 10:12:37.962805 <... open resumed> ) = 6
[pid 25558] 10:12:37.962821 read(14,  <unfinished ...>
[pid 25557] 10:12:37.962846 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.962872 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25491] 10:12:37.962900 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.962931 read(6,  <unfinished ...>
[pid 25558] 10:12:37.962954 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25557] 10:12:37.963039 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:37.963061 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25491] 10:12:37.963187 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.963220 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.963246 read(14,  <unfinished ...>
[pid 25557] 10:12:37.963271 read(7,  <unfinished ...>
[pid 25544] 10:12:37.963298 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.963330 read(13,  <unfinished ...>
[pid 25559] 10:12:37.963386 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.963426 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25557] 10:12:37.963464 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:37.963617 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.963693 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:37.963744 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25558] 10:12:37.963793 read(14,  <unfinished ...>
[pid 25557] 10:12:37.963828 close(7 <unfinished ...>
[pid 25544] 10:12:37.963863 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.963903 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:37.963954 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.963993 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25557] 10:12:37.964190 <... close resumed> ) = 0
[pid 25544] 10:12:37.964220 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:37.964276 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:37.964392 <... mmap resumed> ) = 0x7ff9b2d34000
[pid 25558] 10:12:37.964429 read(14,  <unfinished ...>
[pid 25557] 10:12:37.964466 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:37.964598 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25491] 10:12:37.964643 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.964693 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.964736 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25557] 10:12:37.964788 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.964838 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:37.964901 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.964976 <... mmap resumed> ) = 0x7ff9b090f000
[pid 25558] 10:12:37.965002 read(14,  <unfinished ...>
[pid 25557] 10:12:37.965037 read(6,  <unfinished ...>
[pid 25544] 10:12:37.965072 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25491] 10:12:37.965115 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.965162 mprotect(0x7ff9b0a99000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.965201 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25557] 10:12:37.965347 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25544] 10:12:37.965438 <... open resumed> ) = 13
[pid 25491] 10:12:37.965551 <... lseek resumed> ) = 353
[pid 25559] 10:12:37.965608 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.965630 read(14,  <unfinished ...>
[pid 25557] 10:12:37.965656 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:37.965686 fstat(13,  <unfinished ...>
[pid 25491] 10:12:37.965710 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.965745 mmap(0x7ff9b0c99000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25558] 10:12:37.965777 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25557] 10:12:37.965858 <... open resumed> ) = 7
[pid 25544] 10:12:37.965880 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:37.965915 <... open resumed> ) = 14
[pid 25559] 10:12:37.965943 <... mmap resumed> ) = 0x7ff9b0c99000
[pid 25558] 10:12:37.965967 read(14,  <unfinished ...>
[pid 25557] 10:12:37.965991 fstat(7,  <unfinished ...>
[pid 25544] 10:12:37.966014 fstat(13,  <unfinished ...>
[pid 25491] 10:12:37.966037 fstat(14,  <unfinished ...>
[pid 25559] 10:12:37.966067 mmap(0x7ff9b0c9e000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.966096 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25557] 10:12:37.966125 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:37.966154 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:37.966181 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:37.966221 <... mmap resumed> ) = 0x7ff9b0c9e000
[pid 25558] 10:12:37.966244 read(14,  <unfinished ...>
[pid 25557] 10:12:37.966270 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:37.966296 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.966320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.966352 close(6 <unfinished ...>
[pid 25558] 10:12:37.966375 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25557] 10:12:37.966455 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:37.966557 <... mmap resumed> ) = 0x7fa692c1b000
[pid 25491] 10:12:37.966581 <... mmap resumed> ) = 0x7f33164f5000
[pid 25559] 10:12:37.966606 <... close resumed> ) = 0
[pid 25558] 10:12:37.966638 read(14,  <unfinished ...>
[pid 25557] 10:12:37.966666 read(7,  <unfinished ...>
[pid 25544] 10:12:37.966692 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:37.966715 read(14, Process 25563 attached
 <unfinished ...>
[pid 25559] 10:12:37.966776 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.966810 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25557] 10:12:37.966840 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:37.966864 <... lseek resumed> ) = 0
[pid 25491] 10:12:37.966936 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25563] 10:12:37.966978 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25559] 10:12:37.967002 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.967021 read(14,  <unfinished ...>
[pid 25557] 10:12:37.967044 close(7 <unfinished ...>
[pid 25544] 10:12:37.967069 read(13,  <unfinished ...>
[pid 25491] 10:12:37.967095 close(14 <unfinished ...>
[pid 25563] 10:12:37.967128 <... set_robust_list resumed> ) = 0
[pid 25559] 10:12:37.967142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.967253 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25557] 10:12:37.967331 <... close resumed> ) = 0
[pid 25544] 10:12:37.967354 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25491] 10:12:37.967393 <... close resumed> ) = 0
[pid 25563] 10:12:37.967422 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25559] 10:12:37.967469 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.967590 read(14,  <unfinished ...>
[pid 25557] 10:12:37.967629 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:37.967669 read(13,  <unfinished ...>
[pid 25491] 10:12:37.967704 munmap(0x7f33164f5000, 4096 <unfinished ...>
[pid 25563] 10:12:37.967761 <... setrlimit resumed> ) = 0
[pid 25559] 10:12:37.967783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.968076 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25557] 10:12:37.968128 <... munmap resumed> ) = 0
[pid 25544] 10:12:37.968173 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:37.968230 <... munmap resumed> ) = 0
[pid 25563] 10:12:37.968297 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.968349 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.968382 read(14,  <unfinished ...>
[pid 25557] 10:12:37.968426 read(6,  <unfinished ...>
[pid 25544] 10:12:37.968471 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.968598 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25563] 10:12:37.968668 <... open resumed> ) = 10
[pid 25559] 10:12:37.968695 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.968768 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25557] 10:12:37.968908 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25544] 10:12:37.968976 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:37.969052 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25563] 10:12:37.969108 fstat(10,  <unfinished ...>
[pid 25559] 10:12:37.969148 <... open resumed> ) = 6
[pid 25558] 10:12:37.969173 read(14,  <unfinished ...>
[pid 25557] 10:12:37.969211 uname( <unfinished ...>
[pid 25544] 10:12:37.969247 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.969293 stat("/etc/userdomains",  <unfinished ...>
[pid 25563] 10:12:37.969351 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.969396 read(6,  <unfinished ...>
[pid 25558] 10:12:37.969453 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25557] 10:12:37.969671 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25544] 10:12:37.969753 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25491] 10:12:37.969826 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25563] 10:12:37.969914 fstat(10,  <unfinished ...>
[pid 25559] 10:12:37.969956 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.969996 read(14,  <unfinished ...>
[pid 25557] 10:12:37.970034 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25544] 10:12:37.970085 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.970128 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25563] 10:12:37.970189 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.970241 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.970285 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25557] 10:12:37.970398 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fc7a7df7790}, 8) = 0
[pid 25544] 10:12:37.970450 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25491] 10:12:37.970662 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25563] 10:12:37.970743 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.970792 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25558] 10:12:37.970843 read(14,  <unfinished ...>
[pid 25557] 10:12:37.970884 clone( <unfinished ...>
[pid 25544] 10:12:37.971167 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:37.971216 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25563] 10:12:37.971278 <... mmap resumed> ) = 0x7f21d336d000
[pid 25559] 10:12:37.971304 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.971370 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25544] 10:12:37.971430 <... open resumed> ) = 14
[pid 25491] 10:12:37.971469 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25563] 10:12:37.971659 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.971707 <... mmap resumed> ) = 0x7ff9b06a3000
[pid 25558] 10:12:37.971736 read(14,  <unfinished ...>
[pid 25557] 10:12:37.971775 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fc7a8f2aa90) = 25564
[pid 25544] 10:12:37.971831 fstat(14,  <unfinished ...>
[pid 25491] 10:12:37.971872 stat("/etc/userdomains",  <unfinished ...>
[pid 25563] 10:12:37.971928 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.971949 mprotect(0x7ff9b0705000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.971997 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25557] 10:12:37.972152 wait4(25564,  <unfinished ...>
[pid 25544] 10:12:37.972198 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25491] 10:12:37.972250 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25563] 10:12:37.972329 read(10,  <unfinished ...>
[pid 25559] 10:12:37.972376 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.972403 read(14,  <unfinished ...>
[pid 25544] 10:12:37.972449 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:37.972588 stat("/etc/userdomains",  <unfinished ...>
[pid 25563] 10:12:37.972652 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:37.972684 mmap(0x7ff9b0904000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25558] 10:12:37.972805 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25544] 10:12:37.972932 <... mmap resumed> ) = 0x7fa692c1a000
[pid 25491] 10:12:37.972966 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25563] 10:12:37.973043 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25559] 10:12:37.973089 <... mmap resumed> ) = 0x7ff9b0904000
[pid 25558] 10:12:37.973129 read(14,  <unfinished ...>
[pid 25544] 10:12:37.973173 read(14,  <unfinished ...>
[pid 25491] 10:12:37.973217 stat("/etc/userdomains",  <unfinished ...>
[pid 25563] 10:12:37.973277 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.973324 close(6 <unfinished ...>
[pid 25558] 10:12:37.973413 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25544] 10:12:37.973654 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25491] 10:12:37.973719 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25563] 10:12:37.973822 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.973880 <... close resumed> ) = 0
[pid 25558] 10:12:37.973924 read(14,  <unfinished ...>
[pid 25544] 10:12:37.973966 close(14 <unfinished ...>
[pid 25491] 10:12:37.974007 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25563] 10:12:37.974064 <... open resumed> ) = 13
[pid 25559] 10:12:37.974087 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.974140 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25544] 10:12:37.974270 <... close resumed> ) = 0
[pid 25491] 10:12:37.974308 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25563] 10:12:37.974373 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.974420 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.974463 read(14,  <unfinished ...>
[pid 25544] 10:12:37.974604 munmap(0x7fa692c1a000, 4096 <unfinished ...>
[pid 25491] 10:12:37.974657 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25563] 10:12:37.974716 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.974764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.974827 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25544] 10:12:37.974955 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.975003 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25563] 10:12:37.975082 fstat(13,  <unfinished ...>
[pid 25559] 10:12:37.975125 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.975154 read(14,  <unfinished ...>
[pid 25544] 10:12:37.975192 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:37.975235 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25563] 10:12:37.975292 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:37.975337 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.975400 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25544] 10:12:37.975623 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25491] 10:12:37.975679 <... open resumed> ) = 14
[pid 25563] 10:12:37.975711 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.975742 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.975765 read(14,  <unfinished ...>
[pid 25544] 10:12:37.975790 pipe( <unfinished ...>
[pid 25491] 10:12:37.975818 fstat(14,  <unfinished ...>
[pid 25563] 10:12:37.975849 <... mmap resumed> ) = 0x7f21d336c000
[pid 25559] 10:12:37.975863 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.975900 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25544] 10:12:37.975978 <... pipe resumed> [14, 15]) = 0
[pid 25491] 10:12:37.976002 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25563] 10:12:37.976044 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.976069 <... open resumed> ) = 6
[pid 25558] 10:12:37.976085 read(14,  <unfinished ...>
[pid 25544] 10:12:37.976109 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25491] 10:12:37.976137 fstat(14,  <unfinished ...>
[pid 25563] 10:12:37.976168 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.976181 read(6,  <unfinished ...>
[pid 25558] 10:12:37.976208 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25544] 10:12:37.976277 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25491] 10:12:37.976304 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25563] 10:12:37.976343 read(13,  <unfinished ...>
[pid 25559] 10:12:37.976380 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.976413 read(14,  <unfinished ...>
[pid 25544] 10:12:37.976438 close(12 <unfinished ...>
[pid 25491] 10:12:37.976464 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25563] 10:12:37.976499 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25559] 10:12:37.976524 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.976596 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25544] 10:12:37.976627 <... close resumed> ) = 0
[pid 25491] 10:12:37.976644 <... mmap resumed> ) = 0x7f33164f5000
[pid 25563] 10:12:37.976669 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.976697 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25558] 10:12:37.976727 read(14,  <unfinished ...>
[pid 25544] 10:12:37.976752 munmap(0x7fa692c1c000, 4096 <unfinished ...>
[pid 25491] 10:12:37.976780 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25563] 10:12:37.976812 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:37.976828 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.976860 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25544] 10:12:37.976941 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.976964 <... lseek resumed> ) = 0
[pid 25563] 10:12:37.976990 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.977017 <... mmap resumed> ) = 0x7ff9b02c0000
[pid 25558] 10:12:37.977034 read(14,  <unfinished ...>
[pid 25544] 10:12:37.977058 close(9 <unfinished ...>
[pid 25491] 10:12:37.977079 read(14,  <unfinished ...>
[pid 25563] 10:12:37.977096 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:37.977104 mprotect(0x7ff9b0479000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.977119 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25544] 10:12:37.977182 <... close resumed> ) = 0
[pid 25491] 10:12:37.977193 <... read resumed> "", 4096) = 0
[pid 25563] 10:12:37.977226 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:37.977236 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.977247 read(14,  <unfinished ...>
[pid 25544] 10:12:37.977257 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25491] 10:12:37.977271 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25563] 10:12:37.977294 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f21d2224790}, 8) = 0
[pid 25559] 10:12:37.977302 mmap(0x7ff9b0678000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25558] 10:12:37.977322 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25544] 10:12:37.977342 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.977352 <... open resumed> ) = 15
[pid 25563] 10:12:37.977369 close(11 <unfinished ...>
[pid 25559] 10:12:37.977375 <... mmap resumed> ) = 0x7ff9b0678000
[pid 25558] 10:12:37.977390 read(14,  <unfinished ...>
[pid 25544] 10:12:37.977400 close(11 <unfinished ...>
[pid 25491] 10:12:37.977410 fstat(15,  <unfinished ...>
[pid 25563] 10:12:37.977426 <... close resumed> ) = 0
[pid 25559] 10:12:37.977431 mmap(0x7ff9b069f000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.977447 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25544] 10:12:37.977507 <... close resumed> ) = 0
[pid 25491] 10:12:37.977517 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25563] 10:12:37.977549 fcntl(12, F_GETFD <unfinished ...>
[pid 25559] 10:12:37.977556 <... mmap resumed> ) = 0x7ff9b069f000
[pid 25558] 10:12:37.977572 brk(0x19cc000 <unfinished ...>
[pid 25544] 10:12:37.977583 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25491] 10:12:37.977595 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25563] 10:12:37.977614 <... fcntl resumed> ) = 0
[pid 25559] 10:12:37.977619 close(6 <unfinished ...>
[pid 25558] 10:12:37.977629 <... brk resumed> ) = 0x19cc000
[pid 25544] 10:12:37.977652 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.977662 <... mmap resumed> ) = 0x7f33164f4000
[pid 25563] 10:12:37.977678 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.977685 <... close resumed> ) = 0
[pid 25558] 10:12:37.977704 read(14,  <unfinished ...>
[pid 25544] 10:12:37.977714 close(13 <unfinished ...>
[pid 25491] 10:12:37.977725 read(15,  <unfinished ...>
[pid 25563] 10:12:37.977744 <... fcntl resumed> ) = 0
[pid 25559] 10:12:37.977750 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.977783 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25544] 10:12:37.977806 <... close resumed> ) = 0
[pid 25491] 10:12:37.977815 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25563] 10:12:37.977838 geteuid( <unfinished ...>
[pid 25559] 10:12:37.977845 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.977856 read(14,  <unfinished ...>
[pid 25544] 10:12:37.977865 munmap(0x7fa692c1b000, 4096 <unfinished ...>
[pid 25491] 10:12:37.977877 close(15 <unfinished ...>
[pid 25563] 10:12:37.977895 <... geteuid resumed> ) = 0
[pid 25559] 10:12:37.977900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.977919 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25544] 10:12:37.977983 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.977995 <... close resumed> ) = 0
[pid 25563] 10:12:37.978011 getegid( <unfinished ...>
[pid 25559] 10:12:37.978017 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.978027 read(14,  <unfinished ...>
[pid 25544] 10:12:37.978037 close(10 <unfinished ...>
[pid 25491] 10:12:37.978047 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25563] 10:12:37.978067 <... getegid resumed> ) = 12
[pid 25559] 10:12:37.978072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.978091 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25544] 10:12:37.978155 <... close resumed> ) = 0
[pid 25491] 10:12:37.978165 <... munmap resumed> ) = 0
[pid 25563] 10:12:37.978196 setgid(500 <unfinished ...>
[pid 25559] 10:12:37.978204 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.978218 read(14,  <unfinished ...>
[pid 25544] 10:12:37.978228 munmap(0x7fa692c1e000, 4096 <unfinished ...>
[pid 25491] 10:12:37.978240 stat("/etc/userdomains",  <unfinished ...>
[pid 25563] 10:12:37.978260 <... setgid resumed> ) = 0
[pid 25559] 10:12:37.978265 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.978285 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25544] 10:12:37.978358 <... munmap resumed> ) = 0
[pid 25491] 10:12:37.978371 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25563] 10:12:37.978416 setuid(503 <unfinished ...>
[pid 25559] 10:12:37.978423 <... open resumed> ) = 6
[pid 25558] 10:12:37.978434 read(14,  <unfinished ...>
[pid 25544] 10:12:37.978446 clone( <unfinished ...>
[pid 25491] 10:12:37.978740 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25563] 10:12:37.978765 <... setuid resumed> ) = 0
[pid 25559] 10:12:37.978772 read(6,  <unfinished ...>
[pid 25558] 10:12:37.978783 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25491] 10:12:37.978863 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.978889 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.978904 read(14,  <unfinished ...>
[pid 25544] 10:12:37.978914 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25565
[pid 25491] 10:12:37.978941 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.978960 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.978970 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25544] 10:12:37.978991 close(15 <unfinished ...>
[pid 25491] 10:12:37.979000 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.979033 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25558] 10:12:37.979053 read(14,  <unfinished ...>
[pid 25544] 10:12:37.979063 <... close resumed> ) = 0
[pid 25491] 10:12:37.979071 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:37.979091 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.979104 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25544] 10:12:37.979184 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:37.979231 <... mmap resumed> ) = 0x7ff9b2d33000
[pid 25558] 10:12:37.979243 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979253 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.979270 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.979285 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25491] 10:12:37.979304 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.979324 <... mmap resumed> ) = 0x7ff9b0093000
[pid 25558] 10:12:37.979333 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979343 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.979358 mprotect(0x7ff9b00bf000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.979372 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25491] 10:12:37.979451 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.979491 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.979500 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979510 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25559] 10:12:37.979527 mmap(0x7ff9b02bf000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25558] 10:12:37.979546 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25491] 10:12:37.979566 <... stat resumed> 0x7ffc8615b740) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.979586 <... mmap resumed> ) = 0x7ff9b02bf000
[pid 25558] 10:12:37.979599 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979609 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:37.979625 close(6 <unfinished ...>
[pid 25558] 10:12:37.979634 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25491] 10:12:37.979699 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:37.979732 <... close resumed> ) = 0
[pid 25558] 10:12:37.979748 read(14,  <unfinished ...>
[pid 25491] 10:12:37.979775 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:37.980298 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.980339 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25491] 10:12:37.980373 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.980475 <... open resumed> ) = 6
[pid 25558] 10:12:37.980498 read(14,  <unfinished ...>
[pid 25491] 10:12:37.980524 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.980605 read(6,  <unfinished ...>
[pid 25558] 10:12:37.980633 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25491] 10:12:37.980716 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.980744 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.980769 read(14,  <unfinished ...>
[pid 25491] 10:12:37.980793 read(14,  <unfinished ...>
[pid 25559] 10:12:37.980822 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.980845 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25491] 10:12:37.980875 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:37.980920 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25558] 10:12:37.980956 read(14,  <unfinished ...>
[pid 25491] 10:12:37.980981 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:37.981014 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.981045 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25491] 10:12:37.981130 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.981180 <... mmap resumed> ) = 0x7ff9afe8e000
[pid 25558] 10:12:37.981199 read(14,  <unfinished ...>
[pid 25491] 10:12:37.981223 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.981259 mprotect(0x7ff9afe93000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.981286 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25491] 10:12:37.981373 <... open resumed> ) = 15
[pid 25559] 10:12:37.981406 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.981425 read(14,  <unfinished ...>
[pid 25491] 10:12:37.981454 fstat(15,  <unfinished ...>
[pid 25559] 10:12:37.981488 mmap(0x7ff9b0092000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25558] 10:12:37.981517 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25491] 10:12:37.981650 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.981695 <... mmap resumed> ) = 0x7ff9b0092000
[pid 25558] 10:12:37.981718 read(14,  <unfinished ...>
[pid 25491] 10:12:37.981744 fstat(15,  <unfinished ...>
[pid 25559] 10:12:37.981772 close(6 <unfinished ...>
[pid 25558] 10:12:37.981795 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25491] 10:12:37.981879 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.981918 <... close resumed> ) = 0
[pid 25558] 10:12:37.981945 read(14,  <unfinished ...>
[pid 25491] 10:12:37.981971 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.982003 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.982033 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25491] 10:12:37.982063 <... mmap resumed> ) = 0x7f33164f4000
[pid 25559] 10:12:37.982085 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.982103 read(14,  <unfinished ...>
[pid 25491] 10:12:37.982127 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.982156 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.982188 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25491] 10:12:37.982275 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.982302 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.982320 read(14,  <unfinished ...>
[pid 25491] 10:12:37.982344 read(15,  <unfinished ...>
[pid 25559] 10:12:37.982372 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.982403 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25491] 10:12:37.982479 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:37.982514 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.982536 read(14,  <unfinished ...>
[pid 25491] 10:12:37.982645 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25563] 10:12:37.982680 chdir("/" <unfinished ...>
[pid 25559] 10:12:37.982702 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.982733 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25491] 10:12:37.982815 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:37.982871 <... open resumed> ) = 6
[pid 25558] 10:12:37.982890 read(14,  <unfinished ...>
[pid 25491] 10:12:37.982914 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.982948 read(6,  <unfinished ...>
[pid 25558] 10:12:37.982972 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25491] 10:12:37.983052 <... open resumed> ) = 16
[pid 25559] 10:12:37.983078 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.983103 read(14,  <unfinished ...>
[pid 25491] 10:12:37.983127 fstat(16,  <unfinished ...>
[pid 25559] 10:12:37.983155 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.983178 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25491] 10:12:37.983209 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:37.983243 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25558] 10:12:37.983278 read(14,  <unfinished ...>
[pid 25491] 10:12:37.983303 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.983337 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.983376 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25491] 10:12:37.983466 <... mmap resumed> ) = 0x7f33164f3000
[pid 25559] 10:12:37.983497 <... mmap resumed> ) = 0x7ff9afc8b000
[pid 25558] 10:12:37.983515 read(14,  <unfinished ...>
[pid 25491] 10:12:37.983620 read(16,  <unfinished ...>
[pid 25559] 10:12:37.983661 mprotect(0x7ff9afc8d000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.983690 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25491] 10:12:37.983774 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:37.983810 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.983828 read(14,  <unfinished ...>
[pid 25491] 10:12:37.983852 close(16 <unfinished ...>
[pid 25559] 10:12:37.983881 mmap(0x7ff9afe8c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25558] 10:12:37.983911 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25491] 10:12:37.983996 <... close resumed> ) = 0
[pid 25559] 10:12:37.984021 <... mmap resumed> ) = 0x7ff9afe8c000
[pid 25558] 10:12:37.984047 read(14,  <unfinished ...>
[pid 25491] 10:12:37.984073 munmap(0x7f33164f3000, 4096 <unfinished ...>
[pid 25559] 10:12:37.984107 close(6 <unfinished ...>
[pid 25558] 10:12:37.984130 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25491] 10:12:37.984211 <... munmap resumed> ) = 0
[pid 25559] 10:12:37.984252 <... close resumed> ) = 0
[pid 25558] 10:12:37.984283 read(14,  <unfinished ...>
[pid 25491] 10:12:37.984309 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25559] 10:12:37.984345 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.984375 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25491] 10:12:37.984405 <... open resumed> ) = 16
[pid 25559] 10:12:37.984428 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.984446 read(14,  <unfinished ...>
[pid 25491] 10:12:37.984471 fstat(16,  <unfinished ...>
[pid 25559] 10:12:37.984500 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.984615 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25491] 10:12:37.984703 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25559] 10:12:37.984748 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.984767 read(14,  <unfinished ...>
[pid 25491] 10:12:37.984792 fstat(16,  <unfinished ...>
[pid 25559] 10:12:37.984819 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.984850 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25491] 10:12:37.984890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25559] 10:12:37.984927 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.984946 brk(0x19ed000 <unfinished ...>
[pid 25491] 10:12:37.984971 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.985003 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.985035 <... brk resumed> ) = 0x19ed000
[pid 25491] 10:12:37.985093 <... mmap resumed> ) = 0x7f33164f3000
[pid 25559] 10:12:37.985118 <... open resumed> ) = 6
[pid 25558] 10:12:37.985135 read(14,  <unfinished ...>
[pid 25491] 10:12:37.985158 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.985187 read(6,  <unfinished ...>
[pid 25558] 10:12:37.985210 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25491] 10:12:37.985278 <... lseek resumed> ) = 0
[pid 25559] 10:12:37.985305 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.985330 read(14,  <unfinished ...>
[pid 25491] 10:12:37.985355 read(16,  <unfinished ...>
[pid 25559] 10:12:37.985394 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.985423 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25491] 10:12:37.985458 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25559] 10:12:37.985507 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25558] 10:12:37.985640 read(14,  <unfinished ...>
[pid 25491] 10:12:37.985670 read(16,  <unfinished ...>
[pid 25559] 10:12:37.985699 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.985726 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25491] 10:12:37.985799 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:37.985839 <... mmap resumed> ) = 0x7ff9b2d32000
[pid 25558] 10:12:37.985862 read(14,  <unfinished ...>
[pid 25491] 10:12:37.985887 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:37.985922 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.985952 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25491] 10:12:37.986023 <... open resumed> ) = 17
[pid 25559] 10:12:37.986050 <... mmap resumed> ) = 0x7ff9afa68000
[pid 25558] 10:12:37.986068 read(14,  <unfinished ...>
[pid 25491] 10:12:37.986092 fstat(17,  <unfinished ...>
[pid 25559] 10:12:37.986120 mprotect(0x7ff9afa7f000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.986147 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25491] 10:12:37.986181 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:37.986217 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.986234 read(14,  <unfinished ...>
[pid 25491] 10:12:37.986257 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:37.986288 mmap(0x7ff9afc7f000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25558] 10:12:37.986317 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25491] 10:12:37.986458 <... mmap resumed> ) = 0x7f33164f2000
[pid 25559] 10:12:37.986487 <... mmap resumed> ) = 0x7ff9afc7f000
[pid 25558] 10:12:37.986514 read(14,  <unfinished ...>
[pid 25491] 10:12:37.986615 read(17,  <unfinished ...>
[pid 25559] 10:12:37.986654 close(6 <unfinished ...>
[pid 25558] 10:12:37.986678 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25491] 10:12:37.986709 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:37.986752 <... close resumed> ) = 0
[pid 25558] 10:12:37.986791 read(14,  <unfinished ...>
[pid 25491] 10:12:37.986817 close(17 <unfinished ...>
[pid 25559] 10:12:37.986847 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.986878 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25491] 10:12:37.986967 <... close resumed> ) = 0
[pid 25559] 10:12:37.986993 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.987012 read(14,  <unfinished ...>
[pid 25491] 10:12:37.987035 munmap(0x7f33164f2000, 4096 <unfinished ...>
[pid 25559] 10:12:37.987070 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.987106 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25491] 10:12:37.987273 <... munmap resumed> ) = 0
Process 25565 attached
[pid 25563] 10:12:37.987328 <... chdir resumed> ) = 0
[pid 25559] 10:12:37.987385 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.987413 read(14,  <unfinished ...>
[pid 25491] 10:12:37.987444 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25565] 10:12:37.987489 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25563] 10:12:37.987513 geteuid( <unfinished ...>
[pid 25559] 10:12:37.987535 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.987627 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25491] 10:12:37.987721 <... open resumed> ) = 17
[pid 25565] 10:12:37.987751 <... set_robust_list resumed> ) = 0
[pid 25563] 10:12:37.987765 <... geteuid resumed> ) = 503
[pid 25559] 10:12:37.987807 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.987828 read(14,  <unfinished ...>
[pid 25491] 10:12:37.987853 fstat(17,  <unfinished ...>
[pid 25565] 10:12:37.987884 close(14 <unfinished ...>
[pid 25563] 10:12:37.987906 getegid( <unfinished ...>
[pid 25559] 10:12:37.987928 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.987961 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25491] 10:12:37.988050 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25565] 10:12:37.988096 <... close resumed> ) = 0
[pid 25563] 10:12:37.988110 <... getegid resumed> ) = 500
[pid 25559] 10:12:37.988158 <... open resumed> ) = 6
[pid 25558] 10:12:37.988179 read(14,  <unfinished ...>
[pid 25491] 10:12:37.988203 fstat(17,  <unfinished ...>
[pid 25565] 10:12:37.988234 geteuid( <unfinished ...>
[pid 25563] 10:12:37.988255 stat("/home/finest09/mail/finestweddingsites.com/lisa",  <unfinished ...>
[pid 25559] 10:12:37.988285 read(6,  <unfinished ...>
[pid 25558] 10:12:37.988309 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25491] 10:12:37.988347 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25565] 10:12:37.988385 <... geteuid resumed> ) = 0
[pid 25563] 10:12:37.988399 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25559] 10:12:37.988429 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.988453 read(14,  <unfinished ...>
[pid 25491] 10:12:37.988478 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25565] 10:12:37.988513 getegid( <unfinished ...>
[pid 25563] 10:12:37.988534 chdir("/home/finest09/mail/finestweddingsites.com/lisa" <unfinished ...>
[pid 25559] 10:12:37.988648 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.988673 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25491] 10:12:37.988767 <... mmap resumed> ) = 0x7f33164f2000
[pid 25565] 10:12:37.988798 <... getegid resumed> ) = 12
[pid 25563] 10:12:37.988812 <... chdir resumed> ) = 0
[pid 25559] 10:12:37.988834 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25558] 10:12:37.988866 read(14,  <unfinished ...>
[pid 25491] 10:12:37.988890 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25565] 10:12:37.988922 setgid(500 <unfinished ...>
[pid 25563] 10:12:37.988945 stat("tmp",  <unfinished ...>
[pid 25559] 10:12:37.988972 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.989002 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25491] 10:12:37.989091 <... lseek resumed> ) = 0
[pid 25565] 10:12:37.989121 <... setgid resumed> ) = 0
[pid 25563] 10:12:37.989135 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.989166 <... mmap resumed> ) = 0x7ff9af824000
[pid 25558] 10:12:37.989183 read(14,  <unfinished ...>
[pid 25491] 10:12:37.989207 read(17,  <unfinished ...>
[pid 25565] 10:12:37.989238 setuid(503 <unfinished ...>
[pid 25563] 10:12:37.989261 stat("new",  <unfinished ...>
[pid 25559] 10:12:37.989287 mprotect(0x7ff9af865000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.989320 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25491] 10:12:37.989417 <... read resumed> "", 4096) = 0
[pid 25565] 10:12:37.989468 <... setuid resumed> ) = 0
[pid 25563] 10:12:37.989488 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.989625 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.989648 read(14,  <unfinished ...>
[pid 25491] 10:12:37.989673 stat("/etc/userdomains",  <unfinished ...>
[pid 25565] 10:12:37.989708 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25563] 10:12:37.989739 stat("cur",  <unfinished ...>
[pid 25559] 10:12:37.989766 mmap(0x7ff9afa65000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25558] 10:12:37.989797 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25491] 10:12:37.989887 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25565] 10:12:37.989942 <... open resumed> ) = 9
[pid 25563] 10:12:37.989958 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25559] 10:12:37.990061 <... mmap resumed> ) = 0x7ff9afa65000
[pid 25558] 10:12:37.990094 read(14,  <unfinished ...>
[pid 25491] 10:12:37.990120 stat("/etc/userdomains",  <unfinished ...>
[pid 25565] 10:12:37.990155 fstat(9,  <unfinished ...>
[pid 25563] 10:12:37.990178 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25559] 10:12:37.990211 close(6 <unfinished ...>
[pid 25558] 10:12:37.990234 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25491] 10:12:37.990314 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25565] 10:12:37.990367 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25563] 10:12:37.990397 <... open resumed> ) = 11
[pid 25559] 10:12:37.990434 <... close resumed> ) = 0
[pid 25558] 10:12:37.990460 read(14,  <unfinished ...>
[pid 25491] 10:12:37.990486 stat("/etc/userdomains",  <unfinished ...>
[pid 25565] 10:12:37.990520 brk(0x2136000 <unfinished ...>
[pid 25563] 10:12:37.990636 read(11,  <unfinished ...>
[pid 25559] 10:12:37.990667 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.990699 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25491] 10:12:37.990793 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25565] 10:12:37.990847 <... brk resumed> ) = 0x2136000
[pid 25563] 10:12:37.990863 <... read resumed> "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4144
[pid 25559] 10:12:37.991029 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.991052 read(14,  <unfinished ...>
[pid 25491] 10:12:37.991076 stat("/etc/userdomains",  <unfinished ...>
[pid 25565] 10:12:37.991111 fstat(9,  <unfinished ...>
[pid 25563] 10:12:37.991133 stat("tmp/1451491957.H991020P25563.fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:37.991166 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.991199 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25491] 10:12:37.991227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25565] 10:12:37.991277 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25563] 10:12:37.991305 <... stat resumed> 0x7ffce2d03db0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:37.991328 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.991346 read(14,  <unfinished ...>
[pid 25491] 10:12:37.991377 stat("/etc/localtime",  <unfinished ...>
[pid 25565] 10:12:37.991418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25563] 10:12:37.991451 open("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25559] 10:12:37.991516 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.991628 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25491] 10:12:37.991712 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25565] 10:12:37.991782 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25563] 10:12:37.991800 <... open resumed> ) = 14
[pid 25559] 10:12:37.991824 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.991844 read(14,  <unfinished ...>
[pid 25491] 10:12:37.991868 write(8, "2015-12-30 10:12:37 routing failed for finest09@fin.finestweddingsites.com <courtyardavondale@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 179 <unfinished ...>
[pid 25565] 10:12:37.991916 read(9,  <unfinished ...>
[pid 25563] 10:12:37.991949 chown("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25559] 10:12:37.991983 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.992014 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25491] 10:12:37.992045 <... write resumed> ) = 179
[pid 25565] 10:12:37.992072 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25563] 10:12:37.992091 <... chown resumed> ) = 0
[pid 25559] 10:12:37.992113 <... open resumed> ) = 6
[pid 25558] 10:12:37.992129 read(14,  <unfinished ...>
[pid 25491] 10:12:37.992153 stat("/etc/localtime",  <unfinished ...>
[pid 25565] 10:12:37.992186 read(9,  <unfinished ...>
[pid 25563] 10:12:37.992212 chmod("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25559] 10:12:37.992242 read(6,  <unfinished ...>
[pid 25558] 10:12:37.992266 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25491] 10:12:37.992343 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25565] 10:12:37.992395 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25563] 10:12:37.992416 <... chmod resumed> ) = 0
[pid 25559] 10:12:37.992436 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.992461 read(14,  <unfinished ...>
[pid 25491] 10:12:37.992485 stat("/etc/localtime",  <unfinished ...>
[pid 25565] 10:12:37.992519 close(9 <unfinished ...>
[pid 25563] 10:12:37.992659 chown("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25559] 10:12:37.992701 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.992731 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25491] 10:12:37.992822 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25565] 10:12:37.992869 <... close resumed> ) = 0
[pid 25563] 10:12:37.992890 <... chown resumed> ) = 0
[pid 25559] 10:12:37.992908 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25558] 10:12:37.992938 read(14,  <unfinished ...>
[pid 25491] 10:12:37.992963 close(7 <unfinished ...>
[pid 25565] 10:12:37.992996 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25563] 10:12:37.993023 chmod("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25559] 10:12:37.993053 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:37.993080 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25491] 10:12:37.993150 <... close resumed> ) = 0
[pid 25565] 10:12:37.993183 <... munmap resumed> ) = 0
[pid 25563] 10:12:37.993197 <... chmod resumed> ) = 0
[pid 25559] 10:12:37.993725 <... mmap resumed> ) = 0x7ff9b2d31000
[pid 25558] 10:12:37.993757 read(14,  <unfinished ...>
[pid 25491] 10:12:37.993784 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25565] 10:12:37.993830 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25563] 10:12:37.993854 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:37.993880 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.993910 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25491] 10:12:37.993946 <... open resumed> ) = 7
[pid 25565] 10:12:37.993973 <... lseek resumed> ) = 19
[pid 25563] 10:12:37.993986 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:37.994051 <... mmap resumed> ) = 0x7ff9af53d000
[pid 25558] 10:12:37.994071 read(14,  <unfinished ...>
[pid 25491] 10:12:37.994096 fcntl(7, F_GETFD <unfinished ...>
[pid 25565] 10:12:37.994127 read(6,  <unfinished ...>
[pid 25563] 10:12:37.994150 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25559] 10:12:37.994173 mprotect(0x7ff9af618000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.994200 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25491] 10:12:37.994281 <... fcntl resumed> ) = 0
[pid 25565] 10:12:37.994310 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2369) = 1858
[pid 25563] 10:12:37.994329 <... lseek resumed> ) = 19
[pid 25559] 10:12:37.994872 <... mprotect resumed> ) = 0
[pid 25558] 10:12:37.994898 read(14,  <unfinished ...>
[pid 25491] 10:12:37.994924 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25565] 10:12:37.994956 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25563] 10:12:37.994988 read(6,  <unfinished ...>
[pid 25559] 10:12:37.995017 mmap(0x7ff9af818000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25558] 10:12:37.995049 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25491] 10:12:37.995108 <... fcntl resumed> ) = 0
[pid 25565] 10:12:37.995138 <... write resumed> ) = 4
[pid 25563] 10:12:37.995152 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25559] 10:12:37.995183 <... mmap resumed> ) = 0x7ff9af818000
[pid 25558] 10:12:37.995209 brk(0x1a0e000 <unfinished ...>
[pid 25544] 10:12:37.995236 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25491] 10:12:37.995255 fstat(7,  <unfinished ...>
[pid 25565] 10:12:37.995288 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25563] 10:12:37.995314 read(6,  <unfinished ...>
[pid 25559] 10:12:37.995336 close(6 <unfinished ...>
[pid 25558] 10:12:37.995359 <... brk resumed> ) = 0x1a0e000
[pid 25544] 10:12:37.995422 read(14,  <unfinished ...>
[pid 25491] 10:12:37.995450 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387073, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25565] 10:12:37.995491 <... write resumed> ) = 4
[pid 25563] 10:12:37.995505 <... read resumed> "", 8192) = 0
[pid 25559] 10:12:37.995524 <... close resumed> ) = 0
[pid 25558] 10:12:37.995619 read(14,  <unfinished ...>
[pid 25544] 10:12:37.995652 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25491] 10:12:37.995670 write(7, "2015-12-30 10:12:37 [25491] 1aEJMZ-0006cs-RM ** finest09@fin.finestweddingsites.com <courtyardavondale@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 188 <unfinished ...>
[pid 25565] 10:12:37.995713 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25563] 10:12:37.995737 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:37 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2521 <unfinished ...>
[pid 25559] 10:12:37.995773 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.995804 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25544] 10:12:37.995887 read(14,  <unfinished ...>
[pid 25491] 10:12:37.995914 <... write resumed> ) = 188
[pid 25565] 10:12:37.995942 <... write resumed> ) = 4
[pid 25563] 10:12:37.995956 <... write resumed> ) = 2521
[pid 25559] 10:12:37.995975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.995994 read(14,  <unfinished ...>
[pid 25544] 10:12:37.996017 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:37.996038 close(16 <unfinished ...>
[pid 25565] 10:12:37.996074 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25563] 10:12:37.996098 fsync(14 <unfinished ...>
[pid 25559] 10:12:37.996168 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.996215 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25544] 10:12:37.996415 read(14,  <unfinished ...>
[pid 25491] 10:12:37.996450 <... close resumed> ) = 0
Process 25564 attached
[pid 25565] 10:12:37.996494 <... write resumed> ) = 40
[pid 25559] 10:12:37.996510 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.996615 read(14,  <unfinished ...>
[pid 25544] 10:12:37.996646 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25491] 10:12:37.996665 munmap(0x7f33164f3000, 4096 <unfinished ...>
[pid 25565] 10:12:37.996706 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25564] 10:12:37.996731 set_robust_list(0x7fc7a8f2aaa0, 24 <unfinished ...>
[pid 25563] 10:12:37.996753 <... fsync resumed> ) = 0
[pid 25559] 10:12:37.996771 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.996803 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25544] 10:12:37.996901 read(14,  <unfinished ...>
[pid 25491] 10:12:37.996929 <... munmap resumed> ) = 0
[pid 25565] 10:12:37.996958 <... write resumed> ) = 4
[pid 25564] 10:12:37.996972 <... set_robust_list resumed> ) = 0
[pid 25563] 10:12:37.996987 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25559] 10:12:37.997036 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:37.997056 read(14,  <unfinished ...>
[pid 25544] 10:12:37.997080 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:37.997098 close(17 <unfinished ...>
[pid 25565] 10:12:37.997133 close(15 <unfinished ...>
[pid 25564] 10:12:37.997156 geteuid( <unfinished ...>
[pid 25563] 10:12:37.997178 <... lseek resumed> ) = 4144
[pid 25559] 10:12:37.997194 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25558] 10:12:37.997226 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25544] 10:12:37.997331 wait4(-1,  <unfinished ...>
[pid 25491] 10:12:37.997358 <... close resumed> ) = 0
[pid 25565] 10:12:37.997383 <... close resumed> ) = 0
[pid 25564] 10:12:37.997399 <... geteuid resumed> ) = 0
[pid 25563] 10:12:37.997425 write(11, "2521 1\n", 7 <unfinished ...>
[pid 25559] 10:12:37.997465 <... open resumed> ) = 6
[pid 25558] 10:12:37.997481 read(14,  <unfinished ...>
[pid 25491] 10:12:37.997504 munmap(0x7f33164f2000, 4096 <unfinished ...>
[pid 25565] 10:12:37.997606 exit_group(0) = ?
[pid 25564] 10:12:37.997625 geteuid( <unfinished ...>
[pid 25563] 10:12:37.997917 <... write resumed> ) = 7
[pid 25559] 10:12:37.997935 read(6,  <unfinished ...>
[pid 25558] 10:12:37.997959 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25491] 10:12:37.998035 <... munmap resumed> ) = 0
[pid 25565] 10:12:37.998081 +++ exited with 0 +++
[pid 25564] 10:12:37.998095 <... geteuid resumed> ) = 0
[pid 25563] 10:12:37.998109 close(11 <unfinished ...>
[pid 25559] 10:12:37.998135 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:37.998164 read(14,  <unfinished ...>
[pid 25544] 10:12:37.998189 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25565
[pid 25491] 10:12:37.998208 close(13 <unfinished ...>
[pid 25564] 10:12:37.998241 getegid( <unfinished ...>
[pid 25563] 10:12:37.998264 <... close resumed> ) = 0
[pid 25559] 10:12:37.998286 fstat(6,  <unfinished ...>
[pid 25558] 10:12:37.998311 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25544] 10:12:37.998402 close(14 <unfinished ...>
[pid 25491] 10:12:37.998434 <... close resumed> ) = 0
[pid 25564] 10:12:37.998463 <... getegid resumed> ) = 12
[pid 25563] 10:12:37.998478 fstat(14,  <unfinished ...>
[pid 25559] 10:12:37.998507 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25558] 10:12:37.998607 read(14,  <unfinished ...>
[pid 25544] 10:12:37.998639 <... close resumed> ) = 0
[pid 25491] 10:12:37.998656 munmap(0x7f33164f6000, 4096 <unfinished ...>
[pid 25564] 10:12:37.998694 setgid(12 <unfinished ...>
[pid 25563] 10:12:37.998718 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122179986, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2521, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:37.998749 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:37.998783 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25544] 10:12:37.998874 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25491] 10:12:37.998909 <... munmap resumed> ) = 0
[pid 25564] 10:12:37.998937 <... setgid resumed> ) = 0
[pid 25563] 10:12:37.998951 close(14 <unfinished ...>
[pid 25559] 10:12:37.998979 <... mmap resumed> ) = 0x7ff9af339000
[pid 25558] 10:12:37.998995 read(14,  <unfinished ...>
[pid 25544] 10:12:37.999019 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25491] 10:12:37.999060 close(14 <unfinished ...>
[pid 25564] 10:12:37.999098 setuid(47 <unfinished ...>
[pid 25563] 10:12:37.999122 <... close resumed> ) = 0
[pid 25559] 10:12:37.999151 mprotect(0x7ff9af33c000, 2093056, PROT_NONE <unfinished ...>
[pid 25558] 10:12:37.999181 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25544] 10:12:37.999267 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:37.999367 <... close resumed> ) = 0
[pid 25564] 10:12:37.999394 <... setuid resumed> ) = 0
[pid 25563] 10:12:37.999408 rename("tmp/1451491957.H991020P25563.fin.finestweddingsites.com", "new/1451491957.H991020P25563.fin.finestweddingsites.com,S=2521" <unfinished ...>
[pid 25559] 10:12:38.001057 <... mprotect resumed> ) = 0
[pid 25558] 10:12:38.001078 read(14,  <unfinished ...>
[pid 25544] 10:12:38.001104 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.001155 munmap(0x7f33164f5000, 4096 <unfinished ...>
[pid 25564] 10:12:38.001204 brk(0x2583000 <unfinished ...>
[pid 25563] 10:12:38.001231 <... rename resumed> ) = 0
[pid 25559] 10:12:38.001252 mmap(0x7ff9af53b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25558] 10:12:38.001284 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25544] 10:12:38.001437 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.001474 <... munmap resumed> ) = 0
[pid 25563] 10:12:38.001501 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.001535 <... mmap resumed> ) = 0x7ff9af53b000
[pid 25558] 10:12:38.001619 read(14,  <unfinished ...>
[pid 25544] 10:12:38.001647 <... open resumed> ) = 9
[pid 25491] 10:12:38.001664 close(9 <unfinished ...>
[pid 25563] 10:12:38.001700 <... write resumed> ) = 4
[pid 25559] 10:12:38.001717 close(6 <unfinished ...>
[pid 25558] 10:12:38.001740 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25544] 10:12:38.001834 fstat(9,  <unfinished ...>
[pid 25529] 10:12:38.001862 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.001884 <... close resumed> ) = 0
[pid 25563] 10:12:38.001911 write(12, "\331\t\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.001936 <... close resumed> ) = 0
[pid 25558] 10:12:38.001961 read(14,  <unfinished ...>
[pid 25544] 10:12:38.001987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.002021 read(11,  <unfinished ...>
[pid 25491] 10:12:38.002048 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25563] 10:12:38.002086 <... write resumed> ) = 4
[pid 25559] 10:12:38.002103 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.002134 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25544] 10:12:38.002219 fstat(9,  <unfinished ...>
[pid 25529] 10:12:38.002247 <... read resumed> "\331\t\0\0", 4) = 4
[pid 25491] 10:12:38.002266 <... munmap resumed> ) = 0
[pid 25563] 10:12:38.002293 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.002318 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.002337 read(14,  <unfinished ...>
[pid 25544] 10:12:38.002368 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.002405 read(11,  <unfinished ...>
[pid 25491] 10:12:38.002430 close(12 <unfinished ...>
[pid 25563] 10:12:38.002468 <... write resumed> ) = 4
[pid 25559] 10:12:38.002484 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.002525 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25544] 10:12:38.002722 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:38.002758 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25491] 10:12:38.002778 <... close resumed> ) = 0
[pid 25563] 10:12:38.002804 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.002829 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.002847 read(14,  <unfinished ...>
[pid 25544] 10:12:38.002871 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25529] 10:12:38.002888 read(11,  <unfinished ...>
[pid 25491] 10:12:38.002910 munmap(0x7f33164f7000, 4096 <unfinished ...>
[pid 25563] 10:12:38.002947 <... write resumed> ) = 4
[pid 25559] 10:12:38.002964 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.002994 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25544] 10:12:38.003061 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:38.003089 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.003107 <... munmap resumed> ) = 0
[pid 25563] 10:12:38.003135 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.003160 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.003180 read(14,  <unfinished ...>
[pid 25544] 10:12:38.003203 <... lseek resumed> ) = 0
[pid 25529] 10:12:38.003220 read(11,  <unfinished ...>
[pid 25491] 10:12:38.003243 close(15 <unfinished ...>
[pid 25563] 10:12:38.003277 <... write resumed> ) = 4
[pid 25559] 10:12:38.003293 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.003326 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25544] 10:12:38.003400 read(9,  <unfinished ...>
[pid 25529] 10:12:38.003431 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.003450 <... close resumed> ) = 0
[pid 25563] 10:12:38.003478 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.003503 <... open resumed> ) = 6
[pid 25558] 10:12:38.003519 read(14,  <unfinished ...>
[pid 25544] 10:12:38.003605 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25529] 10:12:38.003648 read(11,  <unfinished ...>
[pid 25491] 10:12:38.003676 munmap(0x7f33164f4000, 4096 <unfinished ...>
[pid 25563] 10:12:38.003712 <... write resumed> ) = 4
[pid 25559] 10:12:38.003728 read(6,  <unfinished ...>
[pid 25558] 10:12:38.003752 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.003782 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:38.003811 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.003829 <... munmap resumed> ) = 0
[pid 25563] 10:12:38.003856 write(12, "\2603\36\2\0\0\0\0", 8 <unfinished ...>
[pid 25559] 10:12:38.003881 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:38.003904 close(14 <unfinished ...>
[pid 25544] 10:12:38.003935 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.003978 read(11,  <unfinished ...>
[pid 25491] 10:12:38.004004 close(11 <unfinished ...>
[pid 25563] 10:12:38.004038 <... write resumed> ) = 8
[pid 25559] 10:12:38.004055 fstat(6,  <unfinished ...>
[pid 25558] 10:12:38.004079 <... close resumed> ) = 0
[pid 25544] 10:12:38.004095 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:38.004122 <... read resumed> "\2603\36\2\0\0\0\0", 8) = 8
[pid 25491] 10:12:38.004140 <... close resumed> ) = 0
[pid 25563] 10:12:38.004165 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.004191 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25558] 10:12:38.004220 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25544] 10:12:38.004248 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.004308 read(11,  <unfinished ...>
[pid 25491] 10:12:38.004337 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25563] 10:12:38.004380 <... write resumed> ) = 4
[pid 25559] 10:12:38.004400 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25558] 10:12:38.004435 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.005288 stat("/home/finest09/etc/finestweddingsites.com/embassy-airport/filter",  <unfinished ...>
[pid 25529] 10:12:38.005337 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.005357 <... munmap resumed> ) = 0
[pid 25563] 10:12:38.005393 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.005424 <... mmap resumed> ) = 0x7ff9af10d000
[pid 25558] 10:12:38.005441 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.005483 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25529] 10:12:38.005512 read(11,  <unfinished ...>
[pid 25491] 10:12:38.005585 close(10 <unfinished ...>
[pid 25563] 10:12:38.005627 <... write resumed> ) = 4
[pid 25559] 10:12:38.005645 mprotect(0x7ff9af136000, 2097152, PROT_NONE <unfinished ...>
[pid 25558] 10:12:38.005675 <... open resumed> ) = 14
[pid 25544] 10:12:38.005692 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:38.005721 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.005739 <... close resumed> ) = 0
[pid 25563] 10:12:38.005764 close(12 <unfinished ...>
[pid 25559] 10:12:38.005788 <... mprotect resumed> ) = 0
[pid 25558] 10:12:38.005804 fstat(14,  <unfinished ...>
[pid 25544] 10:12:38.005826 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.005868 close(11 <unfinished ...>
[pid 25491] 10:12:38.005898 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25564] 10:12:38.005940 <... brk resumed> ) = 0x2583000
[pid 25563] 10:12:38.005954 <... close resumed> ) = 0
[pid 25559] 10:12:38.006350 mmap(0x7ff9af336000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25558] 10:12:38.006390 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.006422 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25529] 10:12:38.006460 <... close resumed> ) = 0
[pid 25491] 10:12:38.006485 <... munmap resumed> ) = 0
[pid 25564] 10:12:38.006526 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25563] 10:12:38.006618 close(10 <unfinished ...>
[pid 25559] 10:12:38.006646 <... mmap resumed> ) = 0x7ff9af336000
[pid 25558] 10:12:38.006668 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.006697 <... open resumed> ) = 10
[pid 25529] 10:12:38.006714 write(9, "lisa@finestweddingsites.com\n", 28 <unfinished ...>
[pid 25491] 10:12:38.006747 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25563] 10:12:38.006827 <... close resumed> ) = 0
[pid 25559] 10:12:38.006845 mmap(0x7ff9af338000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:38.006875 <... mmap resumed> ) = 0x7f2e40b11000
[pid 25544] 10:12:38.006892 fstat(10,  <unfinished ...>
[pid 25529] 10:12:38.006916 <... write resumed> ) = 28
[pid 25491] 10:12:38.006931 <... open resumed> ) = 9
[pid 25563] 10:12:38.006957 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25559] 10:12:38.006984 <... mmap resumed> ) = 0x7ff9af338000
[pid 25558] 10:12:38.007006 read(14,  <unfinished ...>
[pid 25544] 10:12:38.007063 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.007096 fsync(9 <unfinished ...>
[pid 25491] 10:12:38.007147 fcntl(9, F_GETFD <unfinished ...>
[pid 25563] 10:12:38.007187 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.007206 close(6 <unfinished ...>
[pid 25558] 10:12:38.007309 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          241292 kB\nCached:           336508 kB\nBuffers:               0 kB\nActive:           307740 kB\nInactive:         467904 kB\nActive(anon):     169336 kB\nInactive(anon):   277604 kB\nActive(file):     138404 kB\nInac"..., 1024) = 588
[pid 25544] 10:12:38.007342 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.007372 <... fcntl resumed> ) = 0
[pid 25563] 10:12:38.007398 close(13 <unfinished ...>
[pid 25559] 10:12:38.007429 <... close resumed> ) = 0
[pid 25558] 10:12:38.007459 close(14 <unfinished ...>
[pid 25544] 10:12:38.007488 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:38.007516 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25563] 10:12:38.007621 <... close resumed> ) = 0
[pid 25559] 10:12:38.007640 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.007683 <... close resumed> ) = 0
[pid 25544] 10:12:38.007700 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:38.007727 <... fsync resumed> ) = 0
[pid 25491] 10:12:38.007744 <... fcntl resumed> ) = 0
[pid 25563] 10:12:38.007769 munmap(0x7f21d336c000, 4096 <unfinished ...>
[pid 25559] 10:12:38.007797 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.007815 munmap(0x7f2e40b11000, 4096 <unfinished ...>
[pid 25544] 10:12:38.007854 <... mmap resumed> ) = 0x7fa692c1e000
[pid 25529] 10:12:38.007870 wait4(-1,  <unfinished ...>
[pid 25491] 10:12:38.007893 fchown(9, 47, 12 <unfinished ...>
[pid 25564] 10:12:38.007935 <... open resumed> ) = 7
[pid 25563] 10:12:38.007948 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.008343 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.008382 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.009134 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.009177 <... fchown resumed> ) = 0
[pid 25564] 10:12:38.009205 fstat(7,  <unfinished ...>
[pid 25563] 10:12:38.009229 exit_group(0) = ?
[pid 25559] 10:12:38.009594 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.009623 alarm(300 <unfinished ...>
[pid 25544] 10:12:38.009650 <... lseek resumed> ) = 0
[pid 25491] 10:12:38.009667 fchmod(9, 0640 <unfinished ...>
[pid 25564] 10:12:38.009716 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25563] 10:12:38.009746 +++ exited with 0 +++
[pid 25559] 10:12:38.009766 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.009798 <... alarm resumed> ) = 0
[pid 25544] 10:12:38.009834 read(10,  <unfinished ...>
[pid 25529] 10:12:38.009866 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25563
[pid 25491] 10:12:38.009915 <... fchmod resumed> ) = 0
[pid 25564] 10:12:38.009969 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25559] 10:12:38.009999 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.010020 brk(0x1a2f000 <unfinished ...>
[pid 25544] 10:12:38.010044 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25529] 10:12:38.010070 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.010100 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25564] 10:12:38.010145 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25559] 10:12:38.010162 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.010203 <... brk resumed> ) = 0x1a2f000
[pid 25544] 10:12:38.010262 read(10,  <unfinished ...>
[pid 25529] 10:12:38.010291 <... open resumed> ) = 10
[pid 25491] 10:12:38.010308 <... open resumed> ) = 10
[pid 25564] 10:12:38.010335 read(7,  <unfinished ...>
[pid 25559] 10:12:38.010364 <... open resumed> ) = 6
[pid 25558] 10:12:38.010380 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2v\261\330\21\216\240h?\215\23\274l\312kmYg\244\203\276\315\320\320\203\306\220\10h\355\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25544] 10:12:38.010437 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:38.010475 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.010502 alarm(60 <unfinished ...>
[pid 25564] 10:12:38.010536 <... read resumed> "h\234\20\20*j\336\212\351\34d]U\2\342\271\247e\203\360b@u\326\r\267 F\237/\253S\203\210\306\250%\202\216\236Z\222\24$1\23\17\21", 48) = 48
[pid 25559] 10:12:38.010632 read(6,  <unfinished ...>
[pid 25558] 10:12:38.010661 <... write resumed> ) = 258
[pid 25544] 10:12:38.010681 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:38.010712 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.010746 <... alarm resumed> ) = 0
[pid 25564] 10:12:38.010774 close(7 <unfinished ...>
[pid 25559] 10:12:38.010797 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25558] 10:12:38.010826 read(11,  <unfinished ...>
[pid 25544] 10:12:38.010850 <... open resumed> ) = 11
[pid 25529] 10:12:38.010868 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.010892 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25564] 10:12:38.010930 <... close resumed> ) = 0
[pid 25559] 10:12:38.010943 fstat(6,  <unfinished ...>
[pid 25544] 10:12:38.010987 fstat(11,  <unfinished ...>
[pid 25529] 10:12:38.011011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.011039 <... fcntl resumed> ) = 0
[pid 25564] 10:12:38.011063 getuid( <unfinished ...>
[pid 25559] 10:12:38.011085 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25544] 10:12:38.011113 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25529] 10:12:38.011140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.011166 alarm(0 <unfinished ...>
[pid 25564] 10:12:38.011197 <... getuid resumed> ) = 47
[pid 25559] 10:12:38.011211 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.011389 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:38.011423 <... mmap resumed> ) = 0x7f21d336d000
[pid 25491] 10:12:38.011441 <... alarm resumed> ) = 60
[pid 25564] 10:12:38.011491 exit_group(0) = ?
[pid 25559] 10:12:38.011509 <... mmap resumed> ) = 0x7ff9b2d30000
[pid 25544] 10:12:38.011862 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25529] 10:12:38.011886 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.011910 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25564] 10:12:38.011970 +++ exited with 0 +++
[pid 25559] 10:12:38.011983 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25557] 10:12:38.012014 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25564
[pid 25544] 10:12:38.012035 read(11,  <unfinished ...>
[pid 25529] 10:12:38.012062 <... lseek resumed> ) = 0
[pid 25491] 10:12:38.012078 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.012104 <... mmap resumed> ) = 0x7ff9aeef7000
[pid 25557] 10:12:38.012120 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25544] 10:12:38.012149 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25529] 10:12:38.012180 read(10,  <unfinished ...>
[pid 25491] 10:12:38.012207 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.012248 mprotect(0x7ff9aef0c000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:38.012277 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0}, 8) = 0
[pid 25544] 10:12:38.012328 close(11 <unfinished ...>
[pid 25529] 10:12:38.012357 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:38.012400 <... open resumed> ) = 11
[pid 25559] 10:12:38.012429 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.012446 getcwd( <unfinished ...>
[pid 25544] 10:12:38.012472 <... close resumed> ) = 0
[pid 25529] 10:12:38.012488 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:38.012518 read(11,  <unfinished ...>
[pid 25559] 10:12:38.012644 mmap(0x7ff9af10b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25557] 10:12:38.012679 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25544] 10:12:38.012733 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25529] 10:12:38.012764 <... stat resumed> 0x7ffce2d02b00) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.012791 <... read resumed> "cpu  123095 1342478 395283 67343100 2509 0 0 0\ncpu0 123095 1342478 395283 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58608300\nbtime 1450798266\nprocesses 893043\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25559] 10:12:38.012824 <... mmap resumed> ) = 0x7ff9af10b000
[pid 25557] 10:12:38.012850 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.012881 <... munmap resumed> ) = 0
[pid 25529] 10:12:38.012913 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:38.012943 close(11 <unfinished ...>
[pid 25559] 10:12:38.012977 close(6 <unfinished ...>
[pid 25557] 10:12:38.013000 <... open resumed> ) = 7
[pid 25544] 10:12:38.013016 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:38.013041 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:38.013081 <... close resumed> ) = 0
[pid 25559] 10:12:38.013127 <... close resumed> ) = 0
[pid 25557] 10:12:38.013167 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.013192 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.013237 write(8, "2015-12-30 10:12:38 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25491] 10:12:38.013269 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25559] 10:12:38.013308 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.013339 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.013375 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25529] 10:12:38.013409 <... write resumed> ) = 126
[pid 25491] 10:12:38.013434 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.013485 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.013509 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.013532 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25529] 10:12:38.013660 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25491] 10:12:38.013692 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.013732 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.013764 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.013792 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25529] 10:12:38.013821 <... write resumed> ) = 77
[pid 25491] 10:12:38.013848 <... open resumed> ) = 11
[pid 25559] 10:12:38.013874 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.013892 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.013919 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.013968 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:38.013998 fcntl(11, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.014029 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.014059 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.014076 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25529] 10:12:38.014105 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:38.014144 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.014171 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.014191 read(7,  <unfinished ...>
[pid 25544] 10:12:38.014219 <... open resumed> ) = 11
[pid 25529] 10:12:38.014236 stat("/etc/localtime",  <unfinished ...>
[pid 25491] 10:12:38.014261 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.014292 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.014323 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25544] 10:12:38.014351 fstat(11,  <unfinished ...>
[pid 25529] 10:12:38.014375 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:38.014408 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.014433 <... open resumed> ) = 6
[pid 25557] 10:12:38.014450 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.014478 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.014510 close(7 <unfinished ...>
[pid 25491] 10:12:38.014536 read(11,  <unfinished ...>
[pid 25559] 10:12:38.014675 read(6,  <unfinished ...>
[pid 25557] 10:12:38.014699 <... lseek resumed> ) = 1279
[pid 25544] 10:12:38.014716 fstat(11,  <unfinished ...>
[pid 25529] 10:12:38.014739 <... close resumed> ) = 0
[pid 25491] 10:12:38.014758 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25559] 10:12:38.014794 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25557] 10:12:38.014818 read(7,  <unfinished ...>
[pid 25544] 10:12:38.014842 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.014869 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25491] 10:12:38.014903 close(11 <unfinished ...>
[pid 25559] 10:12:38.014934 fstat(6,  <unfinished ...>
[pid 25557] 10:12:38.014957 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25544] 10:12:38.014989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25529] 10:12:38.015017 <... open resumed> ) = 7
[pid 25491] 10:12:38.015033 <... close resumed> ) = 0
[pid 25559] 10:12:38.015061 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25557] 10:12:38.015092 close(7 <unfinished ...>
[pid 25544] 10:12:38.015116 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25529] 10:12:38.015132 fcntl(7, F_GETFD <unfinished ...>
[pid 25491] 10:12:38.015155 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.015190 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25557] 10:12:38.015226 <... close resumed> ) = 0
[pid 25544] 10:12:38.015243 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:38.015266 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.015282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.015309 <... mmap resumed> ) = 0x7ff9aecec000
[pid 25557] 10:12:38.015326 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.015355 <... lseek resumed> ) = 0
[pid 25529] 10:12:38.015379 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.015410 stat("/var/tmp",  <unfinished ...>
[pid 25559] 10:12:38.015456 mprotect(0x7ff9aecf6000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:38.015488 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.015518 read(11,  <unfinished ...>
[pid 25529] 10:12:38.015648 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.015668 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25559] 10:12:38.015801 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.015822 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25544] 10:12:38.015854 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25529] 10:12:38.015882 fstat(7,  <unfinished ...>
[pid 25491] 10:12:38.015906 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.015943 mmap(0x7ff9aeef5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25557] 10:12:38.015973 <... open resumed> ) = 7
[pid 25544] 10:12:38.015992 read(11,  <unfinished ...>
[pid 25529] 10:12:38.016015 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387261, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25491] 10:12:38.016044 <... open resumed> ) = 11
[pid 25559] 10:12:38.016068 <... mmap resumed> ) = 0x7ff9aeef5000
[pid 25557] 10:12:38.016093 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.016119 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:38.016148 write(7, "2015-12-30 10:12:38 [25529] 1aEJMb-0006df-04 => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2521 QT=1s "..., 262 <unfinished ...>
[pid 25491] 10:12:38.016184 fcntl(11, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.016216 close(6 <unfinished ...>
[pid 25557] 10:12:38.016238 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.016254 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:38.016280 <... write resumed> ) = 262
[pid 25491] 10:12:38.016333 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.016362 <... close resumed> ) = 0
[pid 25557] 10:12:38.016388 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.016413 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.016449 pipe( <unfinished ...>
[pid 25491] 10:12:38.016479 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.016510 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.016630 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.016652 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25529] 10:12:38.016682 <... pipe resumed> [11, 12]) = 0
[pid 25491] 10:12:38.016705 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.016731 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.016749 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.016772 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25529] 10:12:38.016814 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid 25491] 10:12:38.016840 fstat(11,  <unfinished ...>
[pid 25559] 10:12:38.016871 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.016904 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387523, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.016934 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25529] 10:12:38.016962 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.016979 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.017033 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.017054 write(7, "2015-12-30 10:12:38 [25557] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMb-0006dx-Iz\n", 92 <unfinished ...>
[pid 25544] 10:12:38.017083 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.017137 close(10 <unfinished ...>
[pid 25491] 10:12:38.017165 pread(11,  <unfinished ...>
[pid 25559] 10:12:38.017197 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.017228 <... write resumed> ) = 92
[pid 25544] 10:12:38.017247 stat("/etc/userdomains",  <unfinished ...>
[pid 25529] 10:12:38.017273 <... close resumed> ) = 0
[pid 25491] 10:12:38.017289 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25559] 10:12:38.017334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.017359 chdir("/var/spool/exim" <unfinished ...>
[pid 25544] 10:12:38.017395 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.017444 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25491] 10:12:38.017479 pread(11,  <unfinished ...>
[pid 25559] 10:12:38.017519 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.017635 <... chdir resumed> ) = 0
[pid 25544] 10:12:38.017657 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25529] 10:12:38.017688 <... munmap resumed> ) = 0
[pid 25491] 10:12:38.017707 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25559] 10:12:38.017753 <... open resumed> ) = 6
[pid 25557] 10:12:38.017772 setgid(12 <unfinished ...>
[pid 25544] 10:12:38.017795 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.017843 clone( <unfinished ...>
[pid 25491] 10:12:38.018076 close(11 <unfinished ...>
[pid 25559] 10:12:38.018111 read(6,  <unfinished ...>
[pid 25557] 10:12:38.018135 <... setgid resumed> ) = 0
[pid 25544] 10:12:38.018180 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:38.018212 <... close resumed> ) = 0
[pid 25559] 10:12:38.018256 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25557] 10:12:38.018284 read(6,  <unfinished ...>
[pid 25544] 10:12:38.018312 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.018351 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25566
[pid 25491] 10:12:38.018394 close(10 <unfinished ...>
[pid 25559] 10:12:38.018440 fstat(6,  <unfinished ...>
[pid 25557] 10:12:38.018465 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25544] 10:12:38.018532 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25529] 10:12:38.018647 close(12 <unfinished ...>
[pid 25491] 10:12:38.018671 <... close resumed> ) = 0
[pid 25559] 10:12:38.018709 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25557] 10:12:38.018743 read(6,  <unfinished ...>
[pid 25544] 10:12:38.018768 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25529] 10:12:38.018859 <... close resumed> ) = 0
[pid 25491] 10:12:38.018905 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.018946 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25557] 10:12:38.018979 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25544] 10:12:38.019054 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25529] 10:12:38.019081 wait4(-1,  <unfinished ...>
[pid 25491] 10:12:38.019104 <... open resumed> ) = 10
[pid 25559] 10:12:38.019129 <... mmap resumed> ) = 0x7ff9aeae9000
[pid 25557] 10:12:38.019146 read(6,  <unfinished ...>
[pid 25544] 10:12:38.019170 <... lseek resumed> ) = 0
[pid 25529] 10:12:38.019186 <... wait4 resumed> 0x7ffce2d040b0, WNOHANG, NULL) = 0
[pid 25491] 10:12:38.019214 fstat(10,  <unfinished ...>
[pid 25559] 10:12:38.019248 mprotect(0x7ff9aeaeb000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:38.019276 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25544] 10:12:38.019332 read(10,  <unfinished ...>
[pid 25529] 10:12:38.019358 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25491] 10:12:38.019386 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.019425 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.019442 read(6,  <unfinished ...>
[pid 25544] 10:12:38.019467 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25491] 10:12:38.019493 fstat(10,  <unfinished ...>
[pid 25559] 10:12:38.019523 mmap(0x7ff9aecea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25557] 10:12:38.019635 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25544] 10:12:38.019698 read(10,  <unfinished ...>
[pid 25491] 10:12:38.019724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.019760 <... mmap resumed> ) = 0x7ff9aecea000
[pid 25557] 10:12:38.019828 read(6,  <unfinished ...>
[pid 25544] 10:12:38.019856 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:38.019902 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.019943 close(6 <unfinished ...>
[pid 25558] 10:12:38.019967 <... read resumed> "\26\3\1\0Q\2\0", 7) = 7
[pid 25557] 10:12:38.020020 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25544] 10:12:38.020102 stat("/etc/vdomainaliases/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:38.020136 <... mmap resumed> ) = 0x7f33164fa000
[pid 25559] 10:12:38.020162 <... close resumed> ) = 0
[pid 25558] 10:12:38.020187 read(11,  <unfinished ...>
[pid 25557] 10:12:38.020213 read(6,  <unfinished ...>
[pid 25544] 10:12:38.020237 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25491] 10:12:38.020277 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.020318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25558] 10:12:38.020345 <... read resumed> "\0M\3\1V\204\2v+\35~N\223\205u\237\356\\\35\0079E\366!W\374\337\315\3257\\\240\260\234\333\367 C\257Y\313fO\fS\34EH\224\20H\322\370\210\32N\2_\332\326\240\251+p\7Nx\360\235\0005\0\0\5\377\1\0\1\0", 79) = 79
[pid 25557] 10:12:38.020413 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25544] 10:12:38.020526 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.020634 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.020661 <... mmap resumed> ) = 0x7ff9b2d2f000
[pid 25558] 10:12:38.020695 read(11,  <unfinished ...>
[pid 25557] 10:12:38.020722 read(6,  <unfinished ...>
[pid 25544] 10:12:38.020746 <... open resumed> ) = 12
[pid 25491] 10:12:38.020763 read(10,  <unfinished ...>
[pid 25559] 10:12:38.020797 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.020828 <... read resumed> "\26\3\1\f\226", 5) = 5
[pid 25557] 10:12:38.020847 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25544] 10:12:38.020902 fstat(12,  <unfinished ...>
[pid 25491] 10:12:38.020931 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.020981 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.021003 read(11,  <unfinished ...>
[pid 25557] 10:12:38.021029 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.021059 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25491] 10:12:38.021091 pipe( <unfinished ...>
[pid 25559] 10:12:38.021127 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.021159 <... read resumed> "\v\0\f\222\0\f\217\0\5,0\202\5(0\202\4\20\240\3\2\1\2\2\3\22~90\r\6\t*\206H\206\367\r\1\1\5\5\0000<1\v0\t\6\3U\4\6\23\2US1\0270\25\6\3U\4\n\23\16GeoTrust, Inc.1\0240\22\6\3U\4\3\23\vRapidSSL CA0\36\27\r140428174333Z\27\r180430071225Z0\201\3001)0'\6\3U\4\5\23 6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp1\0230\21\6\3U\4\v\23\nGT21850092110/\6\3U\4\v\23(See www.rapidssl.com/resources/cps (c)141"..., 3222) = 3222
[pid 25557] 10:12:38.021961 <... open resumed> ) = 8
[pid 25544] 10:12:38.021995 fstat(12,  <unfinished ...>
[pid 25491] 10:12:38.022022 <... pipe resumed> [11, 12]) = 0
[pid 25559] 10:12:38.022051 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.022070 read(11,  <unfinished ...>
[pid 25557] 10:12:38.022095 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.022118 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25491] 10:12:38.022148 close(10 <unfinished ...>
[pid 25559] 10:12:38.022181 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.022211 <... read resumed> "\26\3\1;\304", 5) = 5
[pid 25557] 10:12:38.022237 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.022266 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.022293 <... close resumed> ) = 0
[pid 25559] 10:12:38.022317 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.022337 read(11,  <unfinished ...>
[pid 25557] 10:12:38.022363 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.022388 <... mmap resumed> ) = 0x7fa692c1c000
[pid 25491] 10:12:38.022413 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25559] 10:12:38.022457 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.022495 <... read resumed> "\r\0;\274\2\1\2;\267\0a0_1\v0\t\6\3U\4\6\23\2US1 0\36\6\3U\4\n\23\27RSA Data Security, Inc.1.0,\6\3U\4\v\23%Secure Server Certification Authority\0G0E1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1\0340\32\6\3U\4\3\23\23GTE CyberTrust Root\0w0u1\v0\t\6\3U\4\6\23\2US1\0300\26\6\3U\4\n\23\17GTE Corporation1'0%\6\3U\4\v\23\36GTE CyberTrust Soluti"..., 15300) = 778
[pid 25557] 10:12:38.022519 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.022606 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.022638 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.022665 <... open resumed> ) = 6
[pid 25558] 10:12:38.022681 read(11,  <unfinished ...>
[pid 25557] 10:12:38.022704 read(8,  <unfinished ...>
[pid 25544] 10:12:38.022731 <... lseek resumed> ) = 0
[pid 25491] 10:12:38.022747 clone( <unfinished ...>
[pid 25559] 10:12:38.023033 read(6,  <unfinished ...>
[pid 25557] 10:12:38.023058 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:38.023087 read(12,  <unfinished ...>
[pid 25559] 10:12:38.023117 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25557] 10:12:38.023140 close(8 <unfinished ...>
[pid 25544] 10:12:38.023165 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:38.023189 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25567
[pid 25559] 10:12:38.023232 fstat(6,  <unfinished ...>
[pid 25557] 10:12:38.023258 <... close resumed> ) = 0
[pid 25544] 10:12:38.023274 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25491] 10:12:38.023301 close(12 <unfinished ...>
[pid 25559] 10:12:38.023329 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25557] 10:12:38.023360 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.023388 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25491] 10:12:38.023439 <... close resumed> ) = 0
[pid 25559] 10:12:38.023467 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25557] 10:12:38.023499 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.023662 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.023702 read(11,  <unfinished ...>
[pid 25559] 10:12:38.023730 <... mmap resumed> ) = 0x7ff9ae8ca000
[pid 25557] 10:12:38.023747 read(6,  <unfinished ...>
[pid 25544] 10:12:38.023771 <... open resumed> ) = 13
[pid 25559] 10:12:38.023793 mprotect(0x7ff9ae8e7000, 2093056, PROT_NONE <unfinished ...>
[pid 25557] 10:12:38.023822 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25544] 10:12:38.023901 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.023934 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.023950 read(6,  <unfinished ...>
[pid 25544] 10:12:38.023974 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.024008 mmap(0x7ff9aeae6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25557] 10:12:38.024040 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25544] 10:12:38.024141 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.024176 <... mmap resumed> ) = 0x7ff9aeae6000
[pid 25557] 10:12:38.024198 read(6,  <unfinished ...>
[pid 25544] 10:12:38.024225 <... mmap resumed> ) = 0x7fa692c1b000
[pid 25559] 10:12:38.024247 mmap(0x7ff9aeae8000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.024275 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25544] 10:12:38.024378 read(13,  <unfinished ...>
[pid 25559] 10:12:38.024424 <... mmap resumed> ) = 0x7ff9aeae8000
[pid 25557] 10:12:38.024456 read(6,  <unfinished ...>
[pid 25544] 10:12:38.024484 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.024528 close(6 <unfinished ...>
[pid 25557] 10:12:38.024648 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25544] 10:12:38.024753 close(13 <unfinished ...>
[pid 25559] 10:12:38.024788 <... close resumed> ) = 0
[pid 25557] 10:12:38.024842 read(6,  <unfinished ...>
[pid 25544] 10:12:38.024869 <... close resumed> ) = 0
[pid 25559] 10:12:38.024891 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.024918 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25544] 10:12:38.024960 munmap(0x7fa692c1b000, 4096 <unfinished ...>
[pid 25559] 10:12:38.024997 <... mmap resumed> ) = 0x7ff9b2d2e000
[pid 25557] 10:12:38.025053 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.025084 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.025129 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.025159 <... open resumed> ) = 8
[pid 25544] 10:12:38.025176 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.025211 <... mmap resumed> ) = 0x7ff9b2d2d000
[pid 25557] 10:12:38.025237 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.025261 <... open resumed> ) = 13
[pid 25559] 10:12:38.025283 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.025308 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.025338 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.025366 <... mmap resumed> ) = 0x7ff9b2d2b000
[pid 25557] 10:12:38.025386 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.025412 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.025450 arch_prctl(ARCH_SET_FS, 0x7ff9b2d2b7c0 <unfinished ...>
[pid 25557] 10:12:38.025476 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.025492 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.025520 <... arch_prctl resumed> ) = 0
[pid 25557] 10:12:38.025649 read(8,  <unfinished ...>
[pid 25544] 10:12:38.025684 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.025720 mprotect(0x7ff9aeae6000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.025747 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:38.025778 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.025809 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.025830 close(8 <unfinished ...>
[pid 25544] 10:12:38.025855 <... mmap resumed> ) = 0x7fa692c1b000
[pid 25559] 10:12:38.025876 mprotect(0x7ff9aecea000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.025903 <... close resumed> ) = 0
[pid 25544] 10:12:38.025919 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.025947 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.025980 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.026008 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.026030 mprotect(0x7ff9aeef5000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.026056 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.026082 read(13,  <unfinished ...>
[pid 25559] 10:12:38.026116 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.026141 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.026171 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.026207 mprotect(0x7ff9af10b000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.026235 <... open resumed> ) = 8
[pid 25544] 10:12:38.026252 read(13,  <unfinished ...>
[pid 25559] 10:12:38.026279 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.026309 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.026336 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.026368 mprotect(0x7ff9af336000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.026399 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:38.026435 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25559] 10:12:38.026479 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.026511 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.026621 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.026672 mprotect(0x7ff9af53b000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.026701 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.026718 stat("/usr/local/cpanel/3rdparty/mailman/lists/wendy.laws_hilton.com/config.pck",  <unfinished ...>
[pid 25559] 10:12:38.026756 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.026880 read(8,  <unfinished ...>
[pid 25544] 10:12:38.026911 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.026945 mprotect(0x7ff9af818000, 40960, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.026975 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:38.027006 stat("/etc/demouids",  <unfinished ...>
[pid 25559] 10:12:38.027039 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.027138 close(8 <unfinished ...>
[pid 25544] 10:12:38.027165 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.027213 mprotect(0x7ff9afa65000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.027243 <... close resumed> ) = 0
[pid 25544] 10:12:38.027259 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.027293 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.027323 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.027353 <... open resumed> ) = 14
[pid 25559] 10:12:38.027376 mprotect(0x7ff9afc7f000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.027404 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.027446 fstat(14,  <unfinished ...>
[pid 25559] 10:12:38.027479 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.027500 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.027530 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.027643 mprotect(0x7ff9afe8c000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.027672 <... open resumed> ) = 8
[pid 25544] 10:12:38.027690 fstat(14,  <unfinished ...>
[pid 25559] 10:12:38.027718 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.027927 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.027954 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.027994 mprotect(0x7ff9b0678000, 110592, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.028022 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:38.028050 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.028082 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.028166 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.028194 <... mmap resumed> ) = 0x7fa692c1a000
[pid 25559] 10:12:38.028217 mprotect(0x7ff9b0904000, 16384, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.028242 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.028259 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.028288 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.028385 read(8,  <unfinished ...>
[pid 25544] 10:12:38.028425 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.028453 mprotect(0x7ff9b0c99000, 16384, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.028483 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:38.028519 read(14,  <unfinished ...>
[pid 25559] 10:12:38.028619 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.028643 close(8 <unfinished ...>
[pid 25544] 10:12:38.028669 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.028700 mprotect(0x7ff9b0ea4000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.028729 <... close resumed> ) = 0
[pid 25544] 10:12:38.028746 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:38.028781 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.028805 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.028834 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.029022 mprotect(0x7ff9b10a8000, 4096, PROT_READ <unfinished ...>
[pid 25558] 10:12:38.029060 <... read resumed> " Town1\0320\30\6\3U\4\n\23\21Thawte Consulting1(0&\6\3U\4\v\23\37Certification Services Division1$0\"\6\3U\4\3\23\33Thawte Personal Freemail CA1+0)\6\t*\206H\206\367\r\1\t\1\26\34personal-freemail@thawte.com\0\3070\201\3041\v0\t\6\3U\4\6\23\2ZA1\0250\23\6\3U\4\10\23\fWestern Cape1\0220\20\6\3U\4\7\23\tCape Town1\0350\33\6\3U\4\n\23\24Thawte Consulting cc1(0&\6\3"..., 14522) = 4344
[pid 25557] 10:12:38.029086 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.029180 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.029221 <... mprotect resumed> ) = 0
[pid 25558] 10:12:38.029951 read(11,  <unfinished ...>
[pid 25557] 10:12:38.029993 read(6,  <unfinished ...>
[pid 25544] 10:12:38.030018 <... open resumed> ) = 15
[pid 25559] 10:12:38.030045 mprotect(0x7ff9b1e00000, 4096, PROT_READ <unfinished ...>
[pid 25558] 10:12:38.030074 <... read resumed> "ncorp. by ref. (limits liab.)1%0#\6\3U\4\v\23\34(c) 1999 Entrust.net Limited1301\6\3U\4\3\23*Entrust.net Certification Authority (2048)\0\\0Z1\v0\t\6\3U\4\6\23\2IE1\0220\20\6\3U\4\n\23\tBaltimore1\0230\21\6\3U\4\v\23\nCyberTrust1\"0 \6\3U\4\3\23\31Baltimore CyberTrust Root\0\\0Z1\v0\t\6\3U\4\6\23\2US1\0340\32\6\3U\4\n\23\23Equifax Secur"..., 10178) = 2896
[pid 25557] 10:12:38.030098 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25544] 10:12:38.030221 fstat(15,  <unfinished ...>
[pid 25559] 10:12:38.030255 <... mprotect resumed> ) = 0
[pid 25558] 10:12:38.030296 read(11,  <unfinished ...>
[pid 25557] 10:12:38.030322 read(6,  <unfinished ...>
[pid 25544] 10:12:38.030346 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.030382 mprotect(0x7ff9b2235000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.030410 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25544] 10:12:38.030494 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.030533 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.030622 read(6,  <unfinished ...>
[pid 25544] 10:12:38.030649 <... mmap resumed> ) = 0x7fa692c19000
[pid 25559] 10:12:38.030671 mprotect(0x7ff9b24b9000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.030699 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.030717 read(15,  <unfinished ...>
[pid 25559] 10:12:38.030749 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.030770 read(6,  <unfinished ...>
[pid 25544] 10:12:38.030793 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.030825 mprotect(0x7ff9b26c2000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.030853 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.030873 close(15 <unfinished ...>
[pid 25559] 10:12:38.030903 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.030935 close(6 <unfinished ...>
[pid 25544] 10:12:38.030960 <... close resumed> ) = 0
[pid 25559] 10:12:38.030981 mprotect(0x7ff9b2907000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.031008 <... close resumed> ) = 0
[pid 25544] 10:12:38.031023 munmap(0x7fa692c19000, 4096 <unfinished ...>
[pid 25559] 10:12:38.031057 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.031082 munmap(0x7fc7a8f41000, 4096 <unfinished ...>
[pid 25544] 10:12:38.031108 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.031178 mprotect(0x7ff9b2b21000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.031211 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.031245 stat("/etc/eximmailtrap",  <unfinished ...>
[pid 25559] 10:12:38.031281 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.031324 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fc7a7df7790},  <unfinished ...>
[pid 25544] 10:12:38.031358 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25559] 10:12:38.031410 mprotect(0x7ff9b2d44000, 4096, PROT_READ <unfinished ...>
[pid 25557] 10:12:38.031446 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25544] 10:12:38.031482 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.031525 <... mprotect resumed> ) = 0
[pid 25557] 10:12:38.031613 open("/var/spool/exim/input/b/1aEJMb-0006dx-Iz-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25544] 10:12:38.031658 <... open resumed> ) = 15
[pid 25559] 10:12:38.031681 munmap(0x7ff9b2d39000, 39387 <unfinished ...>
[pid 25557] 10:12:38.031717 <... open resumed> ) = 6
[pid 25544] 10:12:38.031734 fstat(15,  <unfinished ...>
[pid 25559] 10:12:38.031763 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.031780 fcntl(6, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.031803 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.031836 set_tid_address(0x7ff9b2d2ba90 <unfinished ...>
[pid 25557] 10:12:38.031860 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.031876 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.031907 <... set_tid_address resumed> ) = 25559
[pid 25557] 10:12:38.031923 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.031946 <... mmap resumed> ) = 0x7fa692c19000
[pid 25559] 10:12:38.031967 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25557] 10:12:38.031990 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.032005 read(15,  <unfinished ...>
[pid 25559] 10:12:38.032037 <... set_robust_list resumed> ) = 0
[pid 25557] 10:12:38.032052 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25544] 10:12:38.032080 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.032113 futex(0x7fffca4f822c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25557] 10:12:38.032139 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.032155 close(15 <unfinished ...>
[pid 25559] 10:12:38.032184 <... futex resumed> ) = 0
[pid 25557] 10:12:38.032200 fstat(6,  <unfinished ...>
[pid 25544] 10:12:38.032222 <... close resumed> ) = 0
[pid 25559] 10:12:38.032242 futex(0x7fffca4f822c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7ff9b2d2b7c0 <unfinished ...>
[pid 25557] 10:12:38.032267 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125064872, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3164, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:38.032302 munmap(0x7fa692c19000, 4096 <unfinished ...>
[pid 25559] 10:12:38.032336 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25557] 10:12:38.032359 open("/var/spool/exim/input/b/1aEJMb-0006dx-Iz-H", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.032392 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.032424 rt_sigaction(SIGRTMIN, {0x7ff9b1beec60, [], SA_RESTORER|SA_SIGINFO, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25557] 10:12:38.032457 <... open resumed> ) = 8
[pid 25544] 10:12:38.032474 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.032508 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25557] 10:12:38.032524 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.032627 <... open resumed> ) = 15
[pid 25559] 10:12:38.032652 rt_sigaction(SIGRT_1, {0x7ff9b1beecf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25557] 10:12:38.032681 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080184, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:38.032709 fstat(15,  <unfinished ...>
[pid 25559] 10:12:38.032737 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25557] 10:12:38.032753 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.032779 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.032818 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25557] 10:12:38.032844 <... mmap resumed> ) = 0x7fc7a8f41000
[pid 25544] 10:12:38.032860 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.032890 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25557] 10:12:38.032916 read(8,  <unfinished ...>
[pid 25544] 10:12:38.032945 <... mmap resumed> ) = 0x7fa692c19000
[pid 25559] 10:12:38.032966 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25557] 10:12:38.032989 <... read resumed> "1aEJMb-0006dx-Iz-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25544] 10:12:38.033042 read(15,  <unfinished ...>
[pid 25559] 10:12:38.033077 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25557] 10:12:38.033134 read(8,  <unfinished ...>
[pid 25544] 10:12:38.033160 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.033191 statfs("/selinux",  <unfinished ...>
[pid 25557] 10:12:38.033225 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.033243 close(15 <unfinished ...>
[pid 25559] 10:12:38.033273 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350317, f_bavail=6350317, f_files=1000000, f_ffree=691070, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25557] 10:12:38.033340 close(8 <unfinished ...>
[pid 25544] 10:12:38.033369 <... close resumed> ) = 0
[pid 25559] 10:12:38.033391 brk(0 <unfinished ...>
[pid 25557] 10:12:38.033424 <... close resumed> ) = 0
[pid 25544] 10:12:38.033441 munmap(0x7fa692c19000, 4096 <unfinished ...>
[pid 25559] 10:12:38.033480 <... brk resumed> ) = 0x9b8000
[pid 25557] 10:12:38.033503 munmap(0x7fc7a8f41000, 4096 <unfinished ...>
[pid 25544] 10:12:38.033533 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.033728 brk(0x9d9000 <unfinished ...>
[pid 25557] 10:12:38.033762 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.033783 open("/etc/domainusers", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.033820 <... brk resumed> ) = 0x9d9000
[pid 25557] 10:12:38.033848 open("/var/spool/exim/input/b/1aEJMb-0006dx-Iz-J", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.033887 <... open resumed> ) = 15
[pid 25559] 10:12:38.033910 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.033948 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.033971 fstat(15,  <unfinished ...>
[pid 25559] 10:12:38.034001 <... open resumed> ) = 6
[pid 25557] 10:12:38.034029 open("/var/spool/exim/msglog/b/1aEJMb-0006dx-Iz", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25544] 10:12:38.034066 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.034105 fstat(6,  <unfinished ...>
[pid 25557] 10:12:38.034129 <... open resumed> ) = 8
[pid 25544] 10:12:38.034145 fstat(15,  <unfinished ...>
[pid 25559] 10:12:38.034173 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25557] 10:12:38.034202 fcntl(8, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.034226 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.034264 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.034292 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.034308 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.034338 <... mmap resumed> ) = 0x7ff9b2d42000
[pid 25557] 10:12:38.034355 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.034379 <... mmap resumed> ) = 0x7fa692c19000
[pid 25559] 10:12:38.034400 read(6,  <unfinished ...>
[pid 25557] 10:12:38.034491 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.034512 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.034609 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25557] 10:12:38.034645 fchown(8, 47, 12 <unfinished ...>
[pid 25544] 10:12:38.034676 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.034705 read(6,  <unfinished ...>
[pid 25557] 10:12:38.034733 <... fchown resumed> ) = 0
[pid 25544] 10:12:38.034755 read(15,  <unfinished ...>
[pid 25559] 10:12:38.034794 <... read resumed> "", 1024) = 0
[pid 25557] 10:12:38.034823 fchmod(8, 0640 <unfinished ...>
[pid 25544] 10:12:38.034852 <... read resumed> "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25559] 10:12:38.034878 close(6 <unfinished ...>
[pid 25557] 10:12:38.034906 <... fchmod resumed> ) = 0
[pid 25544] 10:12:38.034926 read(15,  <unfinished ...>
[pid 25559] 10:12:38.034955 <... close resumed> ) = 0
[pid 25557] 10:12:38.034971 fcntl(8, F_GETFL <unfinished ...>
[pid 25544] 10:12:38.034994 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.035079 munmap(0x7ff9b2d42000, 4096 <unfinished ...>
[pid 25557] 10:12:38.035113 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25544] 10:12:38.035133 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.035162 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.035230 fstat(8,  <unfinished ...>
[pid 25544] 10:12:38.035258 <... lseek resumed> ) = 353
[pid 25559] 10:12:38.035284 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25557] 10:12:38.035319 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080186, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.035349 read(9,  <unfinished ...>
[pid 25559] 10:12:38.035377 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.035459 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.035491 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.035534 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25557] 10:12:38.035638 <... mmap resumed> ) = 0x7fc7a8f41000
[pid 25544] 10:12:38.035657 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.035686 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25557] 10:12:38.035713 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.035738 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.035761 fstat(2,  <unfinished ...>
[pid 25557] 10:12:38.035785 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.035808 read(9,  <unfinished ...>
[pid 25559] 10:12:38.035838 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25557] 10:12:38.035900 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25544] 10:12:38.035931 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.035994 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25557] 10:12:38.036027 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:38.036061 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.036100 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25557] 10:12:38.036120 pipe( <unfinished ...>
[pid 25544] 10:12:38.036149 <... stat resumed> 0x7fa6912bd880) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.036184 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25557] 10:12:38.036215 <... pipe resumed> [9, 10]) = 0
[pid 25544] 10:12:38.036233 stat("/etc/email_send_limits",  <unfinished ...>
[pid 25559] 10:12:38.036265 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25557] 10:12:38.036284 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25544] 10:12:38.036336 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.036404 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25557] 10:12:38.036440 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7fc7a7df7790}, 8) = 0
[pid 25544] 10:12:38.036466 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.036506 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25557] 10:12:38.036526 clone( <unfinished ...>
[pid 25544] 10:12:38.036844 <... open resumed> ) = 16
[pid 25559] 10:12:38.036876 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25544] 10:12:38.036909 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.036941 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25557] 10:12:38.036968 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fc7a8f2aa90) = 25568
[pid 25544] 10:12:38.037012 <... ioctl resumed> , 0x7ffc5380b380) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.037039 umask(0 <unfinished ...>
[pid 25557] 10:12:38.037062 close(10 <unfinished ...>
[pid 25544] 10:12:38.037084 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.037112 <... umask resumed> ) = 0
[pid 25557] 10:12:38.037165 <... close resumed> ) = 0
[pid 25544] 10:12:38.037186 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.037209 geteuid( <unfinished ...>
[pid 25557] 10:12:38.037232 read(9,  <unfinished ...>
[pid 25544] 10:12:38.037253 fstat(16,  <unfinished ...>
[pid 25559] 10:12:38.037279 <... geteuid resumed> ) = 0
[pid 25544] 10:12:38.037297 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25559] 10:12:38.037331 getuid( <unfinished ...>
[pid 25544] 10:12:38.037354 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.037381 <... getuid resumed> ) = 47
[pid 25544] 10:12:38.037399 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.037421 getgid( <unfinished ...>
[pid 25544] 10:12:38.037444 fstat(16,  <unfinished ...>
[pid 25559] 10:12:38.037472 <... getgid resumed> ) = 12
[pid 25544] 10:12:38.037520 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25559] 10:12:38.037636 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25544] 10:12:38.037665 read(16,  <unfinished ...>
[pid 25559] 10:12:38.037693 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25544] 10:12:38.037713 <... read resumed> "0", 8192) = 1
[pid 25559] 10:12:38.037735 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25544] 10:12:38.037758 read(16,  <unfinished ...>
[pid 25559] 10:12:38.037784 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25544] 10:12:38.037804 <... read resumed> "", 8192) = 0
[pid 25559] 10:12:38.037829 getgroups(65536,  <unfinished ...>
[pid 25544] 10:12:38.037853 close(16 <unfinished ...>
[pid 25559] 10:12:38.037881 <... getgroups resumed> [12]) = 1
[pid 25544] 10:12:38.037903 <... close resumed> ) = 0
[pid 25559] 10:12:38.037979 setgroups(0, [] <unfinished ...>
[pid 25544] 10:12:38.038011 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.038046 <... setgroups resumed> ) = 0
[pid 25544] 10:12:38.038065 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25559] 10:12:38.038139 getegid( <unfinished ...>
[pid 25558] 10:12:38.038168 <... read resumed> "Root CAs1301\6\3U\4\3\23*beTRUSTed Root CA - Entrust Implementation\0d0b1\0220\20\6\3U\4\n\23\tbeTRUSTed1\0330\31\6\3U\4\v\23\22beTRUSTed Root CAs1/0-\6\3U\4\3\23&beTRUSTed Root CA - RSA Implementation\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc1\0350\33\6\3U\4\v\23\24RSA Security 2048 V3\0<0:1\0310\27\6\3U\4\n\23\20RSA Security Inc"..., 7282) = 1448
[pid 25544] 10:12:38.038192 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:38.038224 <... getegid resumed> ) = 12
[pid 25558] 10:12:38.038240 read(11,  <unfinished ...>
[pid 25544] 10:12:38.038264 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.038308 geteuid( <unfinished ...>
[pid 25558] 10:12:38.038334 <... read resumed> "\22Greater Manchester1\0200\16\6\3U\4\7\f\7Salford1\0320\30\6\3U\4\n\f\21Comodo CA Limited1$0\"\6\3U\4\3\f\33Secure Certificate Services\0\2010\1771\v0\t\6\3U\4\6\23\2GB1\0330\31\6\3U\4\10\f\22Greater Manchester1\0200\16\6\3U\4\7\f\7Salford1\0320\30\6\3U\4\n\f\21Comodo CA Limited1%0#\6\3U\4\3\f\34Trusted Certificate Services\1 0\202\1\0341\v0\t\6\3U\4\6\23\2ES1\0220"..., 5834) = 1448
[pid 25544] 10:12:38.038356 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:38.038389 <... geteuid resumed> ) = 0
[pid 25558] 10:12:38.038422 read(11,  <unfinished ...>
[pid 25544] 10:12:38.038474 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.038527 geteuid( <unfinished ...>
[pid 25558] 10:12:38.038631 <... read resumed> " publishing Services s.l.1+0)\6\3U\4\n\24\"ips@mail.ips.es C.I.F.  B-609294521/0-\6\3U\4\v\23&IPS CA CLASEA3 Certification Authority1/0-\6\3U\4\3\23&IPS CA CLASEA3 Certification Authority1\0360\34\6\t*\206H\206\367\r\1\t\1\26\17ips@mail.ips.es\0\2460\201\2431\v0\t\6\3U\4\6\23\2ES1\0220\20\6\3U\4\10\23\tBARCELONA1\0220\20\6\3U\4\7\23\tBARCELO"..., 4386) = 1448
[pid 25544] 10:12:38.038656 close(7 <unfinished ...>
[pid 25559] 10:12:38.038687 <... geteuid resumed> ) = 0
[pid 25558] 10:12:38.038703 read(11,  <unfinished ...>
[pid 25544] 10:12:38.038735 <... close resumed> ) = 0
[pid 25559] 10:12:38.038760 getegid( <unfinished ...>
[pid 25558] 10:12:38.038784 <... read resumed> "rk1!0\37\6\3U\4\v\23\30http://www.usertrust.com1604\6\3U\4\3\23-UTN-USERFirst-Client Authentication and Email\0\2320\201\2271\v0\t\6\3U\4\6\23\2US1\v0\t\6\3U\4\10\23\2UT1\0270\25\6\3U\4\7\23\16Salt Lake City1\0360\34\6\3U\4\n\23\25The USERTRUST Network1!0\37\6\3U\4\v\23\30http://www.usertrust.com1\0370\35\6\3U\4\3\23\26UTN-USERFirst-Hardware\0\2300\201\2251\v"..., 2938) = 2938
[pid 25544] 10:12:38.039509 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25559] 10:12:38.039617 <... getegid resumed> ) = 12
[pid 25558] 10:12:38.039640 brk(0x1a50000 <unfinished ...>
[pid 25544] 10:12:38.039666 <... open resumed> ) = 7
[pid 25559] 10:12:38.039688 setgid(12 <unfinished ...>
[pid 25558] 10:12:38.039711 <... brk resumed> ) = 0x1a50000
[pid 25544] 10:12:38.040692 fcntl(7, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.040738 <... setgid resumed> ) = 0
[pid 25558] 10:12:38.040759 write(11, "\26\3\1\0\7\v\0\0\3\0\0\0\26\3\1\1\6\20\0\1\2\1\0o3`W<M\6\272\1\306\10\337\334pfT\7\23F}\216Ks0\254\37\6\250\242\316\257\33\\\34\223\363&\2\206\347\206\273\24\22\223\33\4\347\221V\24\270\257\26-L\337\262\376\344i9\376\222\334\363`%h\270\340<\340\f]\33X\276Hl\316\355\220q\352\317\322;\277\345\240\365\330\363\0\332\252\10c\317\17\311\340\226\300g\235\333\201\376\321\274\262H6\246\212a\226\341\216\316\212\334|*s\1\314\225q\262\263\230\233\n\306\210\245\1T.\237\n\351,\31\tt/&X\223`\271\353\250,\220\233\374\355\324\265\204(\267B\243\1\vxZ \21\3627\333\7a\274\240\313\21EE\23_\35\n8L\276\244\301b\345\2208\330=N~I\240\224\21\331~\260s%\24\255\332\344\2469\332\226\316\7\315\260\307m\252\36j\177\4\270\200"..., 338 <unfinished ...>
[pid 25544] 10:12:38.040814 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.040838 setuid(0 <unfinished ...>
[pid 25558] 10:12:38.040863 <... write resumed> ) = 338
[pid 25544] 10:12:38.040880 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.040909 <... setuid resumed> ) = 0
[pid 25558] 10:12:38.040955 read(11,  <unfinished ...>
[pid 25544] 10:12:38.040983 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.041003 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.041034 fstat(7,  <unfinished ...>
[pid 25559] 10:12:38.041061 <... open resumed> ) = 6
[pid 25544] 10:12:38.041095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387615, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.041132 fstat(6,  <unfinished ...>
[pid 25544] 10:12:38.041156 write(7, "2015-12-30 10:12:38 [25544] 1aEJMb-0006dm-9U SMTP connection outbound 1451491958 1aEJMb-0006dm-9U finestweddingsites.com wendy.laws@hilton.com\n", 143 <unfinished ...>
[pid 25559] 10:12:38.041190 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:38.041222 <... write resumed> ) = 143
[pid 25559] 10:12:38.041283 fstat(6,  <unfinished ...>
[pid 25544] 10:12:38.041312 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666 <unfinished ...>
[pid 25559] 10:12:38.041353 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:38.041382 <... open resumed> ) = 16
[pid 25559] 10:12:38.041405 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.041434 lseek(16, 0, SEEK_END <unfinished ...>
[pid 25559] 10:12:38.041462 <... mmap resumed> ) = 0x7ff9b2d42000
[pid 25544] 10:12:38.041485 <... lseek resumed> ) = 19
[pid 25559] 10:12:38.041507 read(6,  <unfinished ...>
[pid 25544] 10:12:38.041536 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.041647 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25544] 10:12:38.041772 <... ioctl resumed> , 0x7ffc5380b380) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.041801 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:38.041835 lseek(16, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.041862 <... socket resumed> ) = 7
[pid 25544] 10:12:38.041878 <... lseek resumed> ) = 19
[pid 25559] 10:12:38.041899 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:38.041937 fstat(16,  <unfinished ...>
[pid 25559] 10:12:38.041964 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.041982 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=19, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:38.042016 close(7 <unfinished ...>
[pid 25544] 10:12:38.042044 fcntl(16, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.042072 <... close resumed> ) = 0
[pid 25544] 10:12:38.042088 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.042119 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25544] 10:12:38.042147 write(16, "1", 1 <unfinished ...>
[pid 25559] 10:12:38.042182 <... socket resumed> ) = 7
[pid 25544] 10:12:38.042199 <... write resumed> ) = 1
[pid 25559] 10:12:38.042219 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25544] 10:12:38.042250 close(16 <unfinished ...>
[pid 25559] 10:12:38.042278 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.042294 <... close resumed> ) = 0
[pid 25559] 10:12:38.042333 close(7 <unfinished ...>
[pid 25544] 10:12:38.042364 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.042399 <... close resumed> ) = 0
[pid 25544] 10:12:38.042431 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.042467 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.042506 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.042611 <... open resumed> ) = 7
[pid 25544] 10:12:38.042635 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.042687 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.042716 open("/etc/resolv.conf", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.042749 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25544] 10:12:38.042779 <... open resumed> ) = 16
[pid 25559] 10:12:38.042800 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.042827 fstat(16,  <unfinished ...>
[pid 25559] 10:12:38.042854 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25544] 10:12:38.042871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25559] 10:12:38.042902 read(7,  <unfinished ...>
[pid 25544] 10:12:38.042930 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.042964 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25544] 10:12:38.043001 <... mmap resumed> ) = 0x7fa692c18000
[pid 25559] 10:12:38.043023 read(7,  <unfinished ...>
[pid 25544] 10:12:38.043046 read(16,  <unfinished ...>
[pid 25559] 10:12:38.043075 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.043093 <... read resumed> "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25559] 10:12:38.043121 close(7 <unfinished ...>
[pid 25544] 10:12:38.043148 read(16,  <unfinished ...>
[pid 25559] 10:12:38.043174 <... close resumed> ) = 0
[pid 25544] 10:12:38.043190 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.043211 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25544] 10:12:38.043239 close(16 <unfinished ...>
[pid 25559] 10:12:38.043267 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.043296 <... close resumed> ) = 0
[pid 25559] 10:12:38.043318 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.043351 munmap(0x7fa692c18000, 4096 <unfinished ...>
[pid 25559] 10:12:38.043381 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.043399 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.043419 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.043456 uname( <unfinished ...>
[pid 25559] 10:12:38.043483 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.043500 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25559] 10:12:38.043662 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.043703 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25559] 10:12:38.043736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.043755 <... socket resumed> ) = 16
[pid 25559] 10:12:38.043782 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.043813 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25559] 10:12:38.043850 <... open resumed> ) = 7
[pid 25544] 10:12:38.043867 <... connect resumed> ) = 0
[pid 25559] 10:12:38.043890 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.043914 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25559] 10:12:38.043944 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25544] 10:12:38.043973 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25559] 10:12:38.043996 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25544] 10:12:38.044024 sendto(16, "\274/\1\0\0\1\0\0\0\0\0\0\6hilton\3com\0\0\17\0\1", 28, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25559] 10:12:38.044088 <... mmap resumed> ) = 0x7ff9b2d21000
[pid 25544] 10:12:38.044107 <... sendto resumed> ) = 28
[pid 25559] 10:12:38.044127 close(7 <unfinished ...>
[pid 25544] 10:12:38.044150 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25559] 10:12:38.044180 <... close resumed> ) = 0
[pid 25559] 10:12:38.044209 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25559] 10:12:38.044253 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25559] 10:12:38.044299 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25559] 10:12:38.044350 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7ff9ae6bc000
[pid 25559] 10:12:38.044393 mprotect(0x7ff9ae6c8000, 2097152, PROT_NONE) = 0
[pid 25559] 10:12:38.044441 mmap(0x7ff9ae8c8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7ff9ae8c8000
[pid 25559] 10:12:38.044499 close(7)    = 0
[pid 25559] 10:12:38.044639 mprotect(0x7ff9ae8c8000, 4096, PROT_READ) = 0
[pid 25559] 10:12:38.044687 munmap(0x7ff9b2d21000, 39387) = 0
[pid 25559] 10:12:38.044734 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25559] 10:12:38.044781 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25559] 10:12:38.044819 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.044865 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.044902 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.044961 close(7)    = 0
[pid 25559] 10:12:38.044997 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.045052 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25559] 10:12:38.045093 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.045139 close(7)    = 0
[pid 25559] 10:12:38.045175 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25559] 10:12:38.045210 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.045252 close(7)    = 0
[pid 25559] 10:12:38.045292 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25559] 10:12:38.045334 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.045381 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.045417 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.045472 close(7)    = 0
[pid 25559] 10:12:38.045509 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.045629 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25559] 10:12:38.045710 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25559] 10:12:38.045761 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.045809 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.045846 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.045890 close(7)    = 0
[pid 25559] 10:12:38.045926 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.045970 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25559] 10:12:38.046027 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25559] 10:12:38.046091 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [], SA_RESTORER, 0x7ff9b1bf8790}, 8) = 0
[pid 25559] 10:12:38.046143 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25569
[pid 25559] 10:12:38.046419 wait4(25569, Process 25567 attached
Process 25566 attached
 <unfinished ...>
[pid 25567] 10:12:38.046535 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25566] 10:12:38.046632 set_robust_list(0x7f21d3357aa0, 24 <unfinished ...>
[pid 25567] 10:12:38.046665 <... set_robust_list resumed> ) = 0
[pid 25566] 10:12:38.046679 <... set_robust_list resumed> ) = 0
[pid 25567] 10:12:38.046796 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25566] 10:12:38.046824 fcntl(12, F_GETFD <unfinished ...>
[pid 25567] 10:12:38.046854 <... setrlimit resumed> ) = 0
[pid 25566] 10:12:38.046867 <... fcntl resumed> ) = 0
[pid 25567] 10:12:38.047001 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.047028 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25567] 10:12:38.047063 <... open resumed> ) = 10
[pid 25566] 10:12:38.047076 <... fcntl resumed> ) = 0
[pid 25567] 10:12:38.047108 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.047128 close(6 <unfinished ...>
[pid 25567] 10:12:38.047158 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.047185 <... close resumed> ) = 0
[pid 25567] 10:12:38.047242 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.047265 open("/var/spool/exim/input/b/1aEJMb-0006df-04-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25567] 10:12:38.047309 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.047336 <... open resumed> ) = 6
[pid 25567] 10:12:38.047364 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.047388 fcntl(6, F_GETFD <unfinished ...>
[pid 25567] 10:12:38.047422 <... mmap resumed> ) = 0x7f33164fa000
[pid 25566] 10:12:38.047437 <... fcntl resumed> ) = 0
[pid 25567] 10:12:38.047460 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.047484 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25567] 10:12:38.047513 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.047526 <... fcntl resumed> ) = 0
[pid 25567] 10:12:38.047662 read(10,  <unfinished ...>
[pid 25566] 10:12:38.047689 geteuid( <unfinished ...>
[pid 25567] 10:12:38.047723 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25566] 10:12:38.047742 <... geteuid resumed> ) = 0
[pid 25567] 10:12:38.047807 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25566] 10:12:38.047833 getegid( <unfinished ...>
[pid 25567] 10:12:38.047870 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.047897 <... getegid resumed> ) = 12
[pid 25567] 10:12:38.047943 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.047969 setgid(12 <unfinished ...>
[pid 25567] 10:12:38.048005 <... open resumed> ) = 13
[pid 25566] 10:12:38.048018 <... setgid resumed> ) = 0
[pid 25567] 10:12:38.048041 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.048062 setuid(47 <unfinished ...>
[pid 25567] 10:12:38.048092 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.048117 <... setuid resumed> ) = 0
[pid 25567] 10:12:38.048142 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.048163 close(11 <unfinished ...>
[pid 25567] 10:12:38.048192 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.048216 <... close resumed> ) = 0
[pid 25567] 10:12:38.048404 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.048445 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25567] 10:12:38.048476 <... mmap resumed> ) = 0x7f33164f9000
[pid 25567] 10:12:38.048503 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.048525 <... socket resumed> ) = 10
[pid 25567] 10:12:38.048614 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.048635 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25567] 10:12:38.048678 read(13,  <unfinished ...>
[pid 25566] 10:12:38.048698 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25567] 10:12:38.048726 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25566] 10:12:38.048745 close(10 <unfinished ...>
[pid 25567] 10:12:38.048784 read(13,  <unfinished ...>
[pid 25566] 10:12:38.048804 <... close resumed> ) = 0
[pid 25567] 10:12:38.048829 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.048844 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25567] 10:12:38.048906 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25566] 10:12:38.048932 <... socket resumed> ) = 10
[pid 25567] 10:12:38.048955 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25566] 10:12:38.048971 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25567] 10:12:38.049009 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25566] 10:12:38.049033 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25567] 10:12:38.049062 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25566] 10:12:38.049079 close(10 <unfinished ...>
[pid 25567] 10:12:38.049111 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25566] 10:12:38.049135 <... close resumed> ) = 0
[pid 25567] 10:12:38.049195 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f33153b1790}, 8) = 0
[pid 25566] 10:12:38.049216 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25567] 10:12:38.049255 close(11 <unfinished ...>
[pid 25566] 10:12:38.049275 <... open resumed> ) = 10
[pid 25567] 10:12:38.049304 <... close resumed> ) = 0
[pid 25566] 10:12:38.049318 fstat(10,  <unfinished ...>
[pid 25567] 10:12:38.049348 fcntl(12, F_GETFD <unfinished ...>
[pid 25566] 10:12:38.049368 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25567] 10:12:38.049405 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.049419 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25567] 10:12:38.049456 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.049477 <... mmap resumed> ) = 0x7f21d336d000
[pid 25567] 10:12:38.049500 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.049513 read(10,  <unfinished ...>
[pid 25567] 10:12:38.049638 geteuid( <unfinished ...>
[pid 25566] 10:12:38.049662 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25567] 10:12:38.049716 <... geteuid resumed> ) = 0
[pid 25566] 10:12:38.049732 close(10 <unfinished ...>
[pid 25567] 10:12:38.049763 getegid( <unfinished ...>
[pid 25566] 10:12:38.049783 <... close resumed> ) = 0
[pid 25567] 10:12:38.049805 <... getegid resumed> ) = 12
[pid 25566] 10:12:38.049819 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25567] 10:12:38.049855 setgid(500 <unfinished ...>
[pid 25566] 10:12:38.049875 <... munmap resumed> ) = 0
[pid 25567] 10:12:38.049935 <... setgid resumed> ) = 0
[pid 25566] 10:12:38.049953 stat("/etc/mailips",  <unfinished ...>
[pid 25567] 10:12:38.049987 setuid(503 <unfinished ...>
[pid 25566] 10:12:38.050007 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25567] 10:12:38.050069 <... setuid resumed> ) = 0
[pid 25566] 10:12:38.050087 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25567] 10:12:38.050130 chdir("/" <unfinished ...>
[pid 25566] 10:12:38.050157 <... open resumed> ) = 10
[pid 25567] 10:12:38.050185 <... chdir resumed> ) = 0
[pid 25566] 10:12:38.050199 fstat(10,  <unfinished ...>
[pid 25567] 10:12:38.050240 geteuid( <unfinished ...>
[pid 25566] 10:12:38.050260 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25567] 10:12:38.050305 <... geteuid resumed> ) = 503
[pid 25566] 10:12:38.050389 fstat(10,  <unfinished ...>
[pid 25567] 10:12:38.050420 getegid( <unfinished ...>
[pid 25566] 10:12:38.050440 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25567] 10:12:38.050474 <... getegid resumed> ) = 500
[pid 25566] 10:12:38.050488 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25567] 10:12:38.050621 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25566] 10:12:38.050648 <... mmap resumed> ) = 0x7f21d336d000
[pid 25567] 10:12:38.050679 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25566] 10:12:38.050708 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25567] 10:12:38.050739 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25566] 10:12:38.050760 <... lseek resumed> ) = 0
[pid 25567] 10:12:38.050786 <... chdir resumed> ) = 0
[pid 25566] 10:12:38.050800 read(10,  <unfinished ...>
[pid 25567] 10:12:38.050830 stat("tmp",  <unfinished ...>
[pid 25566] 10:12:38.050852 <... read resumed> "", 4096) = 0
[pid 25567] 10:12:38.050891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25566] 10:12:38.050921 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25567] 10:12:38.050951 stat("new",  <unfinished ...>
[pid 25566] 10:12:38.050972 <... lseek resumed> ) = 0
[pid 25567] 10:12:38.050996 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25566] 10:12:38.051021 read(10,  <unfinished ...>
[pid 25567] 10:12:38.051051 stat("cur",  <unfinished ...>
[pid 25566] 10:12:38.051072 <... read resumed> "", 4096) = 0
[pid 25567] 10:12:38.051257 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25566] 10:12:38.051289 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25567] 10:12:38.051402 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25566] 10:12:38.051445 <... open resumed> ) = 11
[pid 25567] 10:12:38.051466 <... open resumed> ) = 11
[pid 25567] 10:12:38.051493 read(11,  <unfinished ...>
[pid 25566] 10:12:38.051514 fstat(11,  <unfinished ...>
[pid 25567] 10:12:38.051613 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2978
[pid 25566] 10:12:38.051635 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25567] 10:12:38.051728 stat("tmp/1451491958.H51714P25567.fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.051753 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25567] 10:12:38.051796 <... stat resumed> 0x7ffc8615b940) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.051812 <... mmap resumed> ) = 0x7f21d336c000
[pid 25567] 10:12:38.051837 open("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25566] 10:12:38.051860 read(11,  <unfinished ...>
[pid 25567] 10:12:38.051931 <... open resumed> ) = 14
[pid 25566] 10:12:38.051946 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25567] 10:12:38.051994 chown("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25566] 10:12:38.052018 close(11 <unfinished ...>
[pid 25567] 10:12:38.052055 <... chown resumed> ) = 0
[pid 25566] 10:12:38.052069 <... close resumed> ) = 0
[pid 25567] 10:12:38.052095 chmod("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25566] 10:12:38.052133 munmap(0x7f21d336c000, 4096Process 25568 attached
 <unfinished ...>
[pid 25567] 10:12:38.052191 <... chmod resumed> ) = 0
[pid 25566] 10:12:38.052225 <... munmap resumed> ) = 0
[pid 25568] 10:12:38.052245 set_robust_list(0x7fc7a8f2aaa0, 24 <unfinished ...>
[pid 25567] 10:12:38.052290 chown("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25568] 10:12:38.052323 <... set_robust_list resumed> ) = 0
[pid 25566] 10:12:38.052338 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25568] 10:12:38.052431 close(9 <unfinished ...>
[pid 25567] 10:12:38.052452 <... chown resumed> ) = 0
[pid 25566] 10:12:38.052468 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25568] 10:12:38.052670 <... close resumed> ) = 0
[pid 25567] 10:12:38.052693 chmod("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25566] 10:12:38.052734 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25568] 10:12:38.052762 geteuid( <unfinished ...>
[pid 25567] 10:12:38.052784 <... chmod resumed> ) = 0
[pid 25568] 10:12:38.052801 <... geteuid resumed> ) = 0
[pid 25566] 10:12:38.052845 <... lseek resumed> ) = 0
[pid 25568] 10:12:38.052867 getegid( <unfinished ...>
[pid 25567] 10:12:38.052892 stat("/etc/localtime",  <unfinished ...>
[pid 25568] 10:12:38.052920 <... getegid resumed> ) = 12
[pid 25566] 10:12:38.052933 read(10,  <unfinished ...>
[pid 25568] 10:12:38.052964 setgid(494 <unfinished ...>
[pid 25567] 10:12:38.052987 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25568] 10:12:38.053018 <... setgid resumed> ) = 0
[pid 25566] 10:12:38.053063 <... read resumed> "", 4096) = 0
[pid 25568] 10:12:38.053086 setuid(495 <unfinished ...>
[pid 25567] 10:12:38.053115 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25568] 10:12:38.053142 <... setuid resumed> ) = 0
[pid 25566] 10:12:38.053155 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25568] 10:12:38.053204 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25567] 10:12:38.053234 <... lseek resumed> ) = 19
[pid 25568] 10:12:38.053252 <... open resumed> ) = 9
[pid 25566] 10:12:38.053267 <... lseek resumed> ) = 0
[pid 25568] 10:12:38.053293 fstat(9,  <unfinished ...>
[pid 25567] 10:12:38.053319 read(6,  <unfinished ...>
[pid 25568] 10:12:38.053357 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25566] 10:12:38.053391 read(10,  <unfinished ...>
[pid 25568] 10:12:38.053472 fstat(9,  <unfinished ...>
[pid 25567] 10:12:38.053496 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25568] 10:12:38.053518 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25566] 10:12:38.053632 <... read resumed> "", 4096) = 0
[pid 25568] 10:12:38.053658 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25567] 10:12:38.053715 read(6,  <unfinished ...>
[pid 25568] 10:12:38.053744 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25566] 10:12:38.053758 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25568] 10:12:38.053798 read(9,  <unfinished ...>
[pid 25567] 10:12:38.053828 <... read resumed> "", 8192) = 0
[pid 25568] 10:12:38.053847 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25566] 10:12:38.053867 <... open resumed> ) = 11
[pid 25568] 10:12:38.053886 read(9,  <unfinished ...>
[pid 25567] 10:12:38.053915 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2565 <unfinished ...>
[pid 25568] 10:12:38.053954 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25566] 10:12:38.053972 alarm(60 <unfinished ...>
[pid 25568] 10:12:38.054005 close(9 <unfinished ...>
[pid 25567] 10:12:38.054029 <... write resumed> ) = 2565
[pid 25568] 10:12:38.054046 <... close resumed> ) = 0
[pid 25566] 10:12:38.054065 <... alarm resumed> ) = 0
[pid 25568] 10:12:38.054085 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25567] 10:12:38.054114 fsync(14 <unfinished ...>
[pid 25568] 10:12:38.054167 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.054185 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25568] 10:12:38.054292 brk(0x2584000 <unfinished ...>
[pid 25566] 10:12:38.054321 <... fcntl resumed> ) = 0
[pid 25568] 10:12:38.054337 <... brk resumed> ) = 0x2584000
[pid 25566] 10:12:38.054356 alarm(0 <unfinished ...>
[pid 25568] 10:12:38.054486 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25567] 10:12:38.054518 <... fsync resumed> ) = 0
[pid 25568] 10:12:38.054607 <... write resumed> ) = 4
[pid 25566] 10:12:38.054628 <... alarm resumed> ) = 60
[pid 25557] 10:12:38.054644 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25568] 10:12:38.054704 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25567] 10:12:38.054731 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25566] 10:12:38.054753 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.054789 read(9,  <unfinished ...>
[pid 25568] 10:12:38.054819 <... write resumed> ) = 4
[pid 25567] 10:12:38.054832 <... lseek resumed> ) = 2978
[pid 25566] 10:12:38.054847 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.054864 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25568] 10:12:38.054889 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25567] 10:12:38.054912 write(11, "2565 1\n", 7 <unfinished ...>
[pid 25566] 10:12:38.054940 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.054975 read(9,  <unfinished ...>
[pid 25568] 10:12:38.055005 <... write resumed> ) = 4
[pid 25567] 10:12:38.055018 <... write resumed> ) = 7
[pid 25566] 10:12:38.055033 <... open resumed> ) = 13
[pid 25557] 10:12:38.055049 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25568] 10:12:38.055075 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25567] 10:12:38.055099 close(11 <unfinished ...>
[pid 25566] 10:12:38.055122 read(13,  <unfinished ...>
[pid 25557] 10:12:38.055167 read(9,  <unfinished ...>
[pid 25568] 10:12:38.055197 <... write resumed> ) = 4
[pid 25567] 10:12:38.055210 <... close resumed> ) = 0
[pid 25566] 10:12:38.055231 <... read resumed> "cpu  123096 1342479 395286 67343100 2509 0 0 0\ncpu0 123096 1342479 395286 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58613774\nbtime 1450798266\nprocesses 893047\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25557] 10:12:38.055257 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25568] 10:12:38.055285 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25567] 10:12:38.055309 fstat(14,  <unfinished ...>
[pid 25566] 10:12:38.055332 close(13 <unfinished ...>
[pid 25557] 10:12:38.055364 read(9,  <unfinished ...>
[pid 25568] 10:12:38.055402 <... write resumed> ) = 4
[pid 25567] 10:12:38.055424 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016482, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2565, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25566] 10:12:38.055456 <... close resumed> ) = 0
[pid 25557] 10:12:38.055472 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25568] 10:12:38.055608 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25567] 10:12:38.055643 close(14 <unfinished ...>
[pid 25566] 10:12:38.055667 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25557] 10:12:38.055696 read(9,  <unfinished ...>
[pid 25568] 10:12:38.055729 <... write resumed> ) = 40
[pid 25567] 10:12:38.055743 <... close resumed> ) = 0
[pid 25566] 10:12:38.055758 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:38.055798 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25568] 10:12:38.055838 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25567] 10:12:38.055865 rename("tmp/1451491958.H51714P25567.fin.finestweddingsites.com", "new/1451491958.H51714P25567.fin.finestweddingsites.com,S=2565" <unfinished ...>
[pid 25566] 10:12:38.055925 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.055959 read(9,  <unfinished ...>
[pid 25568] 10:12:38.055991 <... write resumed> ) = 4
[pid 25567] 10:12:38.056005 <... rename resumed> ) = 0
[pid 25566] 10:12:38.056020 <... open resumed> ) = 13
[pid 25558] 10:12:38.056038 <... read resumed> "\24\3\1\0\1", 5) = 5
[pid 25557] 10:12:38.056061 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25568] 10:12:38.056089 close(10 <unfinished ...>
[pid 25567] 10:12:38.056112 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.056142 fcntl(13, F_GETFD <unfinished ...>
[pid 25558] 10:12:38.056164 read(11,  <unfinished ...>
[pid 25557] 10:12:38.056188 wait4(-1,  <unfinished ...>
[pid 25568] 10:12:38.056219 <... close resumed> ) = 0
[pid 25567] 10:12:38.056232 <... write resumed> ) = 4
[pid 25566] 10:12:38.056257 <... fcntl resumed> ) = 0
[pid 25558] 10:12:38.056273 <... read resumed> "\1", 1) = 1
[pid 25491] 10:12:38.056341 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25568] 10:12:38.056377 exit_group(0) = ?
[pid 25567] 10:12:38.056393 write(12, "\5\n\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.056698 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25558] 10:12:38.056724 read(11,  <unfinished ...>
[pid 25491] 10:12:38.056748 read(11,  <unfinished ...>
[pid 25568] 10:12:38.056795 +++ exited with 0 +++
[pid 25567] 10:12:38.056808 <... write resumed> ) = 4
[pid 25566] 10:12:38.056821 <... fcntl resumed> ) = 0
[pid 25558] 10:12:38.056836 <... read resumed> "\26\3\1\0000", 5) = 5
[pid 25557] 10:12:38.056860 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25568
[pid 25491] 10:12:38.056879 <... read resumed> "\5\n\0\0", 4) = 4
[pid 25567] 10:12:38.056905 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25566] 10:12:38.056928 read(13,  <unfinished ...>
[pid 25558] 10:12:38.056951 read(11,  <unfinished ...>
[pid 25557] 10:12:38.056974 close(9 <unfinished ...>
[pid 25491] 10:12:38.057007 read(11,  <unfinished ...>
[pid 25567] 10:12:38.057038 <... write resumed> ) = 4
[pid 25566] 10:12:38.057051 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25558] 10:12:38.057073 <... read resumed> "\7\351\307r\3112.\336\324\253x\"x2X\311\253x@\0079\253\16\202\207\367`\334I\1~f\256}\32e`\v,\377\367\2762\222\277\260\316\301", 48) = 48
[pid 25557] 10:12:38.057147 <... close resumed> ) = 0
[pid 25491] 10:12:38.057170 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25567] 10:12:38.057197 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.057221 close(13 <unfinished ...>
[pid 25558] 10:12:38.057245 alarm(0 <unfinished ...>
[pid 25557] 10:12:38.057268 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25491] 10:12:38.057297 read(11,  <unfinished ...>
[pid 25567] 10:12:38.057327 <... write resumed> ) = 4
[pid 25566] 10:12:38.057342 <... close resumed> ) = 0
[pid 25558] 10:12:38.057363 <... alarm resumed> ) = 300
[pid 25557] 10:12:38.057436 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0}, 8) = 0
[pid 25491] 10:12:38.057483 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25567] 10:12:38.057513 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.057602 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.057637 write(11, "\27\3\1\0 qZ\314\375\33\350\321n\225\222)\5\265u2\377U\26\376hG!\262;\244\252\332\215J\276op\27\3\1\0@)oY=\256\337~rSM\22$UI\3174\25\205\306\264\332'\307\246\351\16\245C\0\361\271zs\343\305\265:\304\2169g\216;\367\33_\367\232\344e\311\221\310[\212Z%Ej\234j\350\234\232", 106 <unfinished ...>
[pid 25557] 10:12:38.057683 brk(0x2583000 <unfinished ...>
[pid 25491] 10:12:38.057710 read(11,  <unfinished ...>
[pid 25567] 10:12:38.057741 <... write resumed> ) = 4
[pid 25566] 10:12:38.057754 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.057771 <... write resumed> ) = 106
[pid 25557] 10:12:38.057795 <... brk resumed> ) = 0x2583000
[pid 25491] 10:12:38.057822 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25567] 10:12:38.057849 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.057873 stat("/var/tmp",  <unfinished ...>
[pid 25558] 10:12:38.057903 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:38.057932 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25491] 10:12:38.057966 read(11,  <unfinished ...>
[pid 25567] 10:12:38.057995 <... write resumed> ) = 4
[pid 25566] 10:12:38.058009 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25557] 10:12:38.058038 <... open resumed> ) = 9
[pid 25491] 10:12:38.058234 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25567] 10:12:38.058264 write(12, "\260\203]\1\0\0\0\0", 8 <unfinished ...>
[pid 25566] 10:12:38.058289 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.058319 alarm(60 <unfinished ...>
[pid 25491] 10:12:38.058343 read(11,  <unfinished ...>
[pid 25567] 10:12:38.058377 <... write resumed> ) = 8
[pid 25566] 10:12:38.058391 <... open resumed> ) = 13
[pid 25557] 10:12:38.058407 <... alarm resumed> ) = 0
[pid 25491] 10:12:38.058426 <... read resumed> "\260\203]\1\0\0\0\0", 8) = 8
[pid 25567] 10:12:38.058450 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.058474 fcntl(13, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.058502 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25491] 10:12:38.058529 read(11,  <unfinished ...>
[pid 25567] 10:12:38.058627 <... write resumed> ) = 4
[pid 25566] 10:12:38.058642 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.058658 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.058676 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25567] 10:12:38.058700 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25566] 10:12:38.058724 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.058746 alarm(0 <unfinished ...>
[pid 25491] 10:12:38.058768 read(11,  <unfinished ...>
[pid 25567] 10:12:38.058797 <... write resumed> ) = 4
[pid 25566] 10:12:38.058810 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.058824 <... alarm resumed> ) = 60
[pid 25491] 10:12:38.058882 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25567] 10:12:38.058910 close(12 <unfinished ...>
[pid 25566] 10:12:38.058933 fstat(13,  <unfinished ...>
[pid 25557] 10:12:38.058955 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.058987 close(11 <unfinished ...>
[pid 25567] 10:12:38.059019 <... close resumed> ) = 0
[pid 25566] 10:12:38.059032 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:38.059062 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.059111 <... close resumed> ) = 0
[pid 25567] 10:12:38.059145 close(10 <unfinished ...>
[pid 25566] 10:12:38.059171 pread(13,  <unfinished ...>
[pid 25557] 10:12:38.059201 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.059234 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55Process 25569 attached
 <unfinished ...>
[pid 25567] 10:12:38.059302 <... close resumed> ) = 0
[pid 25566] 10:12:38.059329 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25557] 10:12:38.059374 <... open resumed> ) = 10
[pid 25491] 10:12:38.059438 <... write resumed> ) = 55
[pid 25569] 10:12:38.059474 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25567] 10:12:38.059498 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25566] 10:12:38.059525 pread(13,  <unfinished ...>
[pid 25557] 10:12:38.059617 read(10,  <unfinished ...>
[pid 25491] 10:12:38.059656 fsync(9 <unfinished ...>
[pid 25569] 10:12:38.059715 <... set_robust_list resumed> ) = 0
[pid 25567] 10:12:38.059730 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.059814 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25557] 10:12:38.059845 <... read resumed> "cpu  123096 1342479 395286 67343100 2509 0 0 0\ncpu0 123096 1342479 395286 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58614388\nbtime 1450798266\nprocesses 893047\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25569] 10:12:38.059895 geteuid( <unfinished ...>
[pid 25567] 10:12:38.059983 close(13 <unfinished ...>
[pid 25566] 10:12:38.060008 close(13 <unfinished ...>
[pid 25557] 10:12:38.060031 close(10 <unfinished ...>
[pid 25569] 10:12:38.060065 <... geteuid resumed> ) = 0
[pid 25567] 10:12:38.060079 <... close resumed> ) = 0
[pid 25566] 10:12:38.060100 <... close resumed> ) = 0
[pid 25557] 10:12:38.060116 <... close resumed> ) = 0
[pid 25491] 10:12:38.060208 <... fsync resumed> ) = 0
[pid 25569] 10:12:38.060237 geteuid( <unfinished ...>
[pid 25567] 10:12:38.060258 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25566] 10:12:38.060285 close(11 <unfinished ...>
[pid 25557] 10:12:38.060310 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25491] 10:12:38.060339 wait4(-1,  <unfinished ...>
[pid 25569] 10:12:38.060367 <... geteuid resumed> ) = 0
[pid 25567] 10:12:38.060380 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.060395 <... close resumed> ) = 0
[pid 25557] 10:12:38.060821 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25569] 10:12:38.060901 getegid( <unfinished ...>
[pid 25567] 10:12:38.060927 exit_group(0) = ?
[pid 25566] 10:12:38.060941 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25557] 10:12:38.061237 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25569] 10:12:38.061288 <... getegid resumed> ) = 12
[pid 25567] 10:12:38.061302 +++ exited with 0 +++
[pid 25566] 10:12:38.061319 <... socket resumed> ) = 11
[pid 25557] 10:12:38.061336 <... open resumed> ) = 10
[pid 25491] 10:12:38.061369 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25567
[pid 25569] 10:12:38.061430 setgid(12 <unfinished ...>
[pid 25566] 10:12:38.061457 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25557] 10:12:38.061484 fcntl(10, F_GETFD <unfinished ...>
[pid 25491] 10:12:38.061507 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25569] 10:12:38.061625 <... setgid resumed> ) = 0
[pid 25566] 10:12:38.061653 <... setsockopt resumed> ) = 0
[pid 25557] 10:12:38.061671 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.061701 <... open resumed> ) = 10
[pid 25569] 10:12:38.061726 setuid(47 <unfinished ...>
[pid 25566] 10:12:38.061749 alarm(300 <unfinished ...>
[pid 25557] 10:12:38.061772 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.061798 fstat(10,  <unfinished ...>
[pid 25569] 10:12:38.061828 <... setuid resumed> ) = 0
[pid 25566] 10:12:38.061841 <... alarm resumed> ) = 0
[pid 25557] 10:12:38.062344 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.062385 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.062430 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("173.194.64.27")}, 16 <unfinished ...>
[pid 25557] 10:12:38.062513 read(10,  <unfinished ...>
[pid 25491] 10:12:38.062597 fstat(10,  <unfinished ...>
[pid 25557] 10:12:38.062636 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25491] 10:12:38.062673 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25557] 10:12:38.062714 close(10 <unfinished ...>
[pid 25491] 10:12:38.062738 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.063590 <... close resumed> ) = 0
[pid 25491] 10:12:38.063636 <... mmap resumed> ) = 0x7f33164fa000
[pid 25557] 10:12:38.063662 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.063692 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25557] 10:12:38.063720 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.063740 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.063761 stat("/var/tmp",  <unfinished ...>
[pid 25491] 10:12:38.063795 read(10,  <unfinished ...>
[pid 25557] 10:12:38.063826 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25491] 10:12:38.063901 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25557] 10:12:38.063951 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.063983 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25557] 10:12:38.064017 <... mmap resumed> ) = 0x7fc7a8ef9000
[pid 25491] 10:12:38.064134 <... stat resumed> 0x7ffc8615a690) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.064168 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.064202 stat("/etc/localtime",  <unfinished ...>
[pid 25557] 10:12:38.064232 <... open resumed> ) = 10
[pid 25491] 10:12:38.064247 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.064293 fcntl(10, F_GETFD <unfinished ...>
[pid 25491] 10:12:38.064318 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25557] 10:12:38.064365 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.064387 <... write resumed> ) = 132
[pid 25557] 10:12:38.064417 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.064442 stat("/etc/localtime",  <unfinished ...>
[pid 25557] 10:12:38.064471 <... fcntl resumed> ) = 0
[pid 25491] 10:12:38.064491 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.064533 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.064656 stat("/etc/localtime",  <unfinished ...>
[pid 25557] 10:12:38.064689 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:38.064749 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.064787 pread(10,  <unfinished ...>
[pid 25491] 10:12:38.064816 close(7 <unfinished ...>
[pid 25557] 10:12:38.064844 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25491] 10:12:38.064914 <... close resumed> ) = 0
[pid 25557] 10:12:38.064943 pread(10,  <unfinished ...>
[pid 25491] 10:12:38.064968 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25557] 10:12:38.065005 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25491] 10:12:38.065050 <... open resumed> ) = 7
[pid 25557] 10:12:38.065072 close(10 <unfinished ...>
[pid 25491] 10:12:38.065097 fcntl(7, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.065123 <... close resumed> ) = 0
[pid 25491] 10:12:38.065161 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.065183 munmap(0x7fc7a8ef9000, 200704 <unfinished ...>
[pid 25491] 10:12:38.065224 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.065252 <... munmap resumed> ) = 0
[pid 25491] 10:12:38.065281 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.065303 close(9 <unfinished ...>
[pid 25491] 10:12:38.065329 fstat(7,  <unfinished ...>
[pid 25557] 10:12:38.065355 <... close resumed> ) = 0
[pid 25491] 10:12:38.065388 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387758, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25557] 10:12:38.065425 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.065457 write(7, "2015-12-30 10:12:38 [25491] 1aEJMZ-0006cs-RM => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2565 QT=3s DT=0s\n", 232 <unfinished ...>
[pid 25557] 10:12:38.065494 <... open resumed> ) = 9
[pid 25491] 10:12:38.065512 <... write resumed> ) = 232
[pid 25557] 10:12:38.065628 fstat(9,  <unfinished ...>
[pid 25491] 10:12:38.065661 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25557] 10:12:38.065698 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.065736 <... open resumed> ) = 11
[pid 25557] 10:12:38.065758 fstat(9,  <unfinished ...>
[pid 25491] 10:12:38.065782 alarm(60 <unfinished ...>
[pid 25557] 10:12:38.065813 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.065841 <... alarm resumed> ) = 0
[pid 25557] 10:12:38.065861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.065889 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25557] 10:12:38.065920 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25491] 10:12:38.065937 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.065956 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.065980 alarm(0 <unfinished ...>
[pid 25557] 10:12:38.066012 <... lseek resumed> ) = 0
[pid 25491] 10:12:38.066029 <... alarm resumed> ) = 60
[pid 25557] 10:12:38.066095 read(9,  <unfinished ...>
[pid 25491] 10:12:38.066126 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25557] 10:12:38.066158 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25491] 10:12:38.066203 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:38.066243 stat("/jail_owner",  <unfinished ...>
[pid 25491] 10:12:38.066271 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.066305 <... stat resumed> 0x7ffc5db6c7c0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.066330 <... open resumed> ) = 12
[pid 25557] 10:12:38.066362 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:38.066400 fcntl(12, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.066428 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:38.066467 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.066488 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25491] 10:12:38.066519 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.066652 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.066681 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.066703 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25491] 10:12:38.066820 read(12,  <unfinished ...>
[pid 25558] 10:12:38.066850 <... select resumed> ) = 1 (in [11], left {299, 991114})
[pid 25557] 10:12:38.066879 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25491] 10:12:38.066914 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25558] 10:12:38.066946 read(11,  <unfinished ...>
[pid 25557] 10:12:38.066971 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25491] 10:12:38.066999 close(12 <unfinished ...>
[pid 25558] 10:12:38.067029 <... read resumed> "\27\3\1\0\260", 5) = 5
[pid 25557] 10:12:38.067047 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.067292 <... close resumed> ) = 0
[pid 25569] 10:12:38.067324 brk(0x9fa000 <unfinished ...>
[pid 25558] 10:12:38.067347 read(11,  <unfinished ...>
[pid 25557] 10:12:38.067373 stat("/etc/demouids",  <unfinished ...>
[pid 25491] 10:12:38.067401 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25558] 10:12:38.067434 <... read resumed> "\313\202H\223\274\1\321\3L\270\315\336y\265G\342\234\237\323$\266\223 \36e=\360T\264\271.\213\204\204\203w\372\245\252}\351\370\252#\312f\373\341\1\20DQ\364\f\371\335\3K\305CU\342\200/\224n|~\16\16\307\310\260\351c\273\242\334z\v\256+\240\277\301\216L\35\211y\371\3150\25\200\351\220\350~\254\255\350\243\373\335\25\211\203\266\365~S\r\347\237\343\177\t'\3d\204/\22\365\210\346+\347\363D\2\302\272{\360\366\245\323X\375\376w\223U\320\325\221L\274\266s\22qbq\250\210E\211\\\37\177\331\221\26O\202I\325\233\4I\23\252\310", 176) = 176
[pid 25557] 10:12:38.067500 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.067641 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.067675 write(11, "\27\3\1\0 \2725^\10\242\214k\344W\324\371\354\263\375G\366\207bg/\227\363\221\347\205\337\247\205\257\316\253\375\27\3\1\0\200\235\260m1\267H_Aq\253p\334\0\32\343\2138F\t\316\241\5C \306\370p!\344\362\2\245\375\306\2472\245\210\322\213mp\327\320Hn,\304\262\37\f\n\354!\247\313\325f\204\337P\351\267\323\4\321B\261l\2569\1\312\226\333\261T\345kg\2176B\325O\n\264Vo\246H?R\250i\206+\354\234\2673\240\233e\372\310\236\27\17\371\345\234\264\27\237\235\25\225\372\273\271\327\313\203z\340\366\377", 170 <unfinished ...>
[pid 25557] 10:12:38.067725 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.067755 stat("/var/tmp",  <unfinished ...>
[pid 25558] 10:12:38.067790 <... write resumed> ) = 170
[pid 25557] 10:12:38.067812 <... open resumed> ) = 10
[pid 25491] 10:12:38.067830 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25558] 10:12:38.067946 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:38.067979 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.068003 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.068037 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.068068 <... open resumed> ) = 12
[pid 25557] 10:12:38.068088 fstat(10,  <unfinished ...>
[pid 25491] 10:12:38.068111 fcntl(12, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.068137 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.068163 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.068183 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.068213 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25569] 10:12:38.068241 <... brk resumed> ) = 0x9fa000
[pid 25557] 10:12:38.068254 <... mmap resumed> ) = 0x7fc7a8f3f000
[pid 25491] 10:12:38.068357 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.068386 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.068411 fstat(12,  <unfinished ...>
[pid 25557] 10:12:38.068437 <... lseek resumed> ) = 0
[pid 25491] 10:12:38.068454 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25557] 10:12:38.068497 read(10,  <unfinished ...>
[pid 25491] 10:12:38.068620 pread(12,  <unfinished ...>
[pid 25557] 10:12:38.068657 <... read resumed> "", 4096) = 0
[pid 25491] 10:12:38.068968 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25569] 10:12:38.069023 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25557] 10:12:38.069052 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25491] 10:12:38.069081 pread(12,  <unfinished ...>
[pid 25557] 10:12:38.069110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25491] 10:12:38.069182 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25557] 10:12:38.069220 stat("/etc/userdomains",  <unfinished ...>
[pid 25491] 10:12:38.069249 close(12 <unfinished ...>
[pid 25557] 10:12:38.069277 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.069312 <... close resumed> ) = 0
[pid 25557] 10:12:38.069347 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25491] 10:12:38.069379 close(11 <unfinished ...>
[pid 25557] 10:12:38.069411 <... open resumed> ) = 11
[pid 25491] 10:12:38.069428 <... close resumed> ) = 0
[pid 25557] 10:12:38.069468 fstat(11,  <unfinished ...>
[pid 25491] 10:12:38.069494 pipe( <unfinished ...>
[pid 25557] 10:12:38.069524 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.069649 <... pipe resumed> [11, 12]) = 0
[pid 25557] 10:12:38.069675 fstat(11,  <unfinished ...>
[pid 25491] 10:12:38.069699 close(10 <unfinished ...>
[pid 25557] 10:12:38.069726 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.069754 <... close resumed> ) = 0
[pid 25557] 10:12:38.069774 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25491] 10:12:38.069804 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25557] 10:12:38.069836 <... mmap resumed> ) = 0x7fc7a8f3e000
[pid 25491] 10:12:38.069853 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.069875 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25491] 10:12:38.069898 clone( <unfinished ...>
[pid 25557] 10:12:38.070162 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.070185 read(11,  <unfinished ...>
[pid 25491] 10:12:38.070212 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25570
[pid 25569] 10:12:38.070262 <... open resumed> ) = 7
[pid 25557] 10:12:38.070279 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:38.070339 close(12 <unfinished ...>
[pid 25569] 10:12:38.070386 fstat(7,  <unfinished ...>
[pid 25557] 10:12:38.070410 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25491] 10:12:38.070439 <... close resumed> ) = 0
[pid 25569] 10:12:38.070461 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25557] 10:12:38.070488 <... open resumed> ) = 12
[pid 25491] 10:12:38.070514 read(11,  <unfinished ...>
[pid 25569] 10:12:38.070645 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25557] 10:12:38.070680 fstat(12,  <unfinished ...>
[pid 25569] 10:12:38.070708 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25557] 10:12:38.070724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25569] 10:12:38.070764 read(7,  <unfinished ...>
[pid 25557] 10:12:38.070795 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25569] 10:12:38.070827 <... read resumed> "+\36\327\370z\325\310h\220\201\222\205\4$\357\250\375|\335\252\216\262\371\25\\\224V\353|\6\344Y\345\4D)\313g\222\252\10\34\224\f_\216g\367", 48) = 48
[pid 25557] 10:12:38.070844 <... mmap resumed> ) = 0x7fc7a8f3d000
[pid 25569] 10:12:38.070868 close(7 <unfinished ...>
[pid 25557] 10:12:38.070891 read(12,  <unfinished ...>
[pid 25569] 10:12:38.070922 <... close resumed> ) = 0
[pid 25557] 10:12:38.070936 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25569] 10:12:38.070984 getuid( <unfinished ...>
[pid 25557] 10:12:38.071008 close(12 <unfinished ...>
[pid 25569] 10:12:38.071036 <... getuid resumed> ) = 47
[pid 25557] 10:12:38.071049 <... close resumed> ) = 0
[pid 25569] 10:12:38.071206 exit_group(0) = ?
[pid 25557] 10:12:38.071225 munmap(0x7fc7a8f3d000, 4096 <unfinished ...>
[pid 25569] 10:12:38.071492 +++ exited with 0 +++
[pid 25559] 10:12:38.071506 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25569
[pid 25557] 10:12:38.071528 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.071636 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25557] 10:12:38.071673 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.071705 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25557] 10:12:38.071749 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.071780 getcwd( <unfinished ...>
[pid 25557] 10:12:38.071809 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.071840 <... getcwd resumed> "/var/spool/exim", 16380) = 16
[pid 25557] 10:12:38.071891 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.071945 open("/etc/localtime", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.071977 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.072009 <... open resumed> ) = 7
[pid 25557] 10:12:38.072025 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.072072 fstat(7,  <unfinished ...>
[pid 25557] 10:12:38.072097 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.072127 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.072156 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.072205 fstat(7,  <unfinished ...>
[pid 25557] 10:12:38.072231 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.072259 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.072286 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.072325 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.072356 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.072397 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25557] 10:12:38.072416 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.072456 read(7,  <unfinished ...>
[pid 25557] 10:12:38.072485 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.072514 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25557] 10:12:38.072656 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.072717 lseek(7, -2264, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:38.072744 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25559] 10:12:38.072774 <... lseek resumed> ) = 1279
[pid 25557] 10:12:38.072793 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.072821 read(7,  <unfinished ...>
[pid 25557] 10:12:38.072846 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25559] 10:12:38.072878 <... read resumed> "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25557] 10:12:38.072917 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.072957 close(7 <unfinished ...>
[pid 25557] 10:12:38.072984 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.073016 <... close resumed> ) = 0
[pid 25557] 10:12:38.073032 <... open resumed> ) = 12
[pid 25559] 10:12:38.073053 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25557] 10:12:38.073081 fstat(12,  <unfinished ...>
[pid 25559] 10:12:38.073107 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.073135 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.073172 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25557] 10:12:38.073205 fstat(12,  <unfinished ...>
[pid 25559] 10:12:38.073231 <... open resumed> ) = 7
[pid 25557] 10:12:38.073249 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.073280 fcntl(7, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.073303 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.073333 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.073348 <... mmap resumed> ) = 0x7fc7a8f3d000
[pid 25559] 10:12:38.073368 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.073391 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.073417 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.073433 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.073454 fstat(7,  <unfinished ...>
[pid 25557] 10:12:38.073478 read(12,  <unfinished ...>
[pid 25559] 10:12:38.073504 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5387990, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25557] 10:12:38.073533 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.073683 write(7, "2015-12-30 10:12:38 [25559] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMb-0006e1-MY\n", 92 <unfinished ...>
[pid 25557] 10:12:38.073718 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.073752 <... write resumed> ) = 92
[pid 25557] 10:12:38.073770 <... open resumed> ) = 13
[pid 25559] 10:12:38.073794 chdir("/var/spool/exim" <unfinished ...>
[pid 25557] 10:12:38.073822 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.073848 <... chdir resumed> ) = 0
[pid 25557] 10:12:38.073867 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.073899 setgid(12 <unfinished ...>
[pid 25557] 10:12:38.073923 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.073952 <... setgid resumed> ) = 0
[pid 25557] 10:12:38.074001 <... mmap resumed> ) = 0x7fc7a8f3c000
[pid 25559] 10:12:38.074026 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074053 read(13,  <unfinished ...>
[pid 25559] 10:12:38.074083 <... read resumed> "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25557] 10:12:38.074144 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.074175 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074200 close(13 <unfinished ...>
[pid 25559] 10:12:38.074227 <... read resumed> "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25557] 10:12:38.074292 <... close resumed> ) = 0
[pid 25559] 10:12:38.074314 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074340 munmap(0x7fc7a8f3c000, 4096 <unfinished ...>
[pid 25559] 10:12:38.074385 <... read resumed> "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25557] 10:12:38.074442 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.074480 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074508 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.074622 <... read resumed> "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25557] 10:12:38.074690 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.074743 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074771 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25559] 10:12:38.074802 <... read resumed> "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25557] 10:12:38.074878 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.074910 read(6,  <unfinished ...>
[pid 25557] 10:12:38.074936 stat("/etc/userdomains",  <unfinished ...>
[pid 25559] 10:12:38.074966 <... read resumed> "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25557] 10:12:38.075058 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.075103 read(6,  <unfinished ...>
[pid 25557] 10:12:38.075130 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25559] 10:12:38.075162 <... read resumed> "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25557] 10:12:38.075227 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25566] 10:12:38.075280 <... connect resumed> ) = 0
[pid 25559] 10:12:38.075300 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.075330 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.075361 alarm(0 <unfinished ...>
[pid 25559] 10:12:38.075385 <... open resumed> ) = 8
[pid 25557] 10:12:38.075402 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.075430 <... alarm resumed> ) = 300
[pid 25559] 10:12:38.075456 fstat(8,  <unfinished ...>
[pid 25557] 10:12:38.075482 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.075512 getsockname(11,  <unfinished ...>
[pid 25559] 10:12:38.075535 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25557] 10:12:38.075665 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.075713 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(49100), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25559] 10:12:38.075747 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.075776 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.075807 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25559] 10:12:38.075834 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25557] 10:12:38.075851 <... stat resumed> 0x7ffc5db6f5b0) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.075878 <... setsockopt resumed> ) = 0
[pid 25559] 10:12:38.075906 read(8,  <unfinished ...>
[pid 25557] 10:12:38.075935 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.075966 stat("/etc/mailhelo",  <unfinished ...>
[pid 25559] 10:12:38.075992 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25557] 10:12:38.076019 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.076059 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.076097 close(8 <unfinished ...>
[pid 25557] 10:12:38.076123 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.076154 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.076182 <... close resumed> ) = 0
[pid 25557] 10:12:38.076199 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.076325 <... open resumed> ) = 13
[pid 25559] 10:12:38.076357 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25557] 10:12:38.076391 getuid( <unfinished ...>
[pid 25566] 10:12:38.076420 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.076443 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.076522 <... getuid resumed> ) = 0
[pid 25566] 10:12:38.076639 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.076680 read(6,  <unfinished ...>
[pid 25557] 10:12:38.076707 geteuid( <unfinished ...>
[pid 25566] 10:12:38.076734 fstat(13,  <unfinished ...>
[pid 25559] 10:12:38.076757 <... read resumed> "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25557] 10:12:38.076836 <... geteuid resumed> ) = 0
[pid 25566] 10:12:38.076864 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.076894 read(6,  <unfinished ...>
[pid 25557] 10:12:38.076918 getgid( <unfinished ...>
[pid 25566] 10:12:38.076945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.076972 <... read resumed> "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25557] 10:12:38.077073 <... getgid resumed> ) = 12
[pid 25566] 10:12:38.077100 <... mmap resumed> ) = 0x7f21d336c000
[pid 25559] 10:12:38.077118 read(6,  <unfinished ...>
[pid 25557] 10:12:38.077143 getegid( <unfinished ...>
[pid 25566] 10:12:38.077169 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.077193 <... read resumed> " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25557] 10:12:38.077296 <... getegid resumed> ) = 12
[pid 25566] 10:12:38.077396 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.077419 read(6,  <unfinished ...>
[pid 25558] 10:12:38.077443 <... select resumed> ) = 1 (in [11], left {299, 990582})
[pid 25557] 10:12:38.077471 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.077510 read(13,  <unfinished ...>
[pid 25559] 10:12:38.077533 <... read resumed> "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25558] 10:12:38.077717 read(11,  <unfinished ...>
[pid 25557] 10:12:38.077749 <... open resumed> ) = 13
[pid 25566] 10:12:38.077775 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.077807 read(6,  <unfinished ...>
[pid 25558] 10:12:38.077835 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25557] 10:12:38.077854 read(13,  <unfinished ...>
[pid 25566] 10:12:38.077885 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.077908 <... read resumed> "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25558] 10:12:38.077949 read(11,  <unfinished ...>
[pid 25557] 10:12:38.077977 <... read resumed> "\233\366=o", 4) = 4
[pid 25566] 10:12:38.078004 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.078021 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25558] 10:12:38.078050 <... read resumed> "\337\321+\255D\2051\205t\302\250\302\234\311~d\216t\216\372\331V\353+Mw\31s\255\325W\340\305u\211\225\0eR7\321\264\304OZ\r[\f", 48) = 48
[pid 25557] 10:12:38.078080 close(13 <unfinished ...>
[pid 25566] 10:12:38.078113 read(13,  <unfinished ...>
[pid 25559] 10:12:38.078136 <... open resumed> ) = 8
[pid 25558] 10:12:38.078153 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25557] 10:12:38.078182 <... close resumed> ) = 0
[pid 25566] 10:12:38.078291 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.078378 fstat(8,  <unfinished ...>
[pid 25557] 10:12:38.078412 readlink("/proc/self/exe",  <unfinished ...>
[pid 25566] 10:12:38.078470 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.078495 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25557] 10:12:38.078525 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25566] 10:12:38.078673 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.078698 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.078727 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25566] 10:12:38.078758 read(13,  <unfinished ...>
[pid 25559] 10:12:38.078780 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25557] 10:12:38.078797 <... ioctl resumed> , 0x7ffc5db6c410) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25566] 10:12:38.078823 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.078844 read(8,  <unfinished ...>
[pid 25557] 10:12:38.078870 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25566] 10:12:38.078898 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.078921 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25557] 10:12:38.078951 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.078977 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.078995 close(8 <unfinished ...>
[pid 25557] 10:12:38.079020 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25566] 10:12:38.079048 read(13,  <unfinished ...>
[pid 25559] 10:12:38.079071 <... close resumed> ) = 0
[pid 25557] 10:12:38.079087 <... ioctl resumed> , 0x7ffc5db6c410) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25566] 10:12:38.079111 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.079144 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25557] 10:12:38.079174 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25566] 10:12:38.079202 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25559] 10:12:38.079230 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.079258 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.079283 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.079313 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.079341 <... open resumed> ) = 8
[pid 25557] 10:12:38.079357 <... ioctl resumed> , 0x7ffc5db6c420) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.079380 fstat(8,  <unfinished ...>
[pid 25557] 10:12:38.079403 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.079430 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25557] 10:12:38.079464 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.079489 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.079516 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.079640 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25557] 10:12:38.079661 <... open resumed> ) = 13
[pid 25559] 10:12:38.079683 read(8,  <unfinished ...>
[pid 25557] 10:12:38.079711 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.079738 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25557] 10:12:38.079769 <... ioctl resumed> , 0x7ffc5db6c4f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.079791 close(8 <unfinished ...>
[pid 25557] 10:12:38.079816 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.079842 <... close resumed> ) = 0
[pid 25557] 10:12:38.079857 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.079879 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25557] 10:12:38.079906 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.079934 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.079975 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.080001 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.080088 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25559] 10:12:38.080118 <... open resumed> ) = 8
[pid 25557] 10:12:38.080135 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0}, 8) = 0
[pid 25559] 10:12:38.080408 fstat(8,  <unfinished ...>
[pid 25557] 10:12:38.080442 brk(0x25a5000 <unfinished ...>
[pid 25559] 10:12:38.080471 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25557] 10:12:38.080502 <... brk resumed> ) = 0x25a5000
[pid 25559] 10:12:38.080534 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.080638 read(13,  <unfinished ...>
[pid 25559] 10:12:38.080667 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25557] 10:12:38.080684 <... read resumed> "", 8192) = 0
[pid 25559] 10:12:38.080711 read(8,  <unfinished ...>
[pid 25557] 10:12:38.080739 close(13 <unfinished ...>
[pid 25559] 10:12:38.080767 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25557] 10:12:38.080797 <... close resumed> ) = 0
[pid 25559] 10:12:38.081093 close(8 <unfinished ...>
[pid 25557] 10:12:38.081128 stat("/etc/exim.pl",  <unfinished ...>
[pid 25559] 10:12:38.081160 <... close resumed> ) = 0
[pid 25557] 10:12:38.081177 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25559] 10:12:38.081212 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25557] 10:12:38.081241 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.081274 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.081373 <... open resumed> ) = 13
[pid 25559] 10:12:38.081407 read(6,  <unfinished ...>
[pid 25557] 10:12:38.081434 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.081462 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25557] 10:12:38.081661 <... ioctl resumed> , 0x7ffc5db6c320) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.081695 read(6,  <unfinished ...>
[pid 25557] 10:12:38.081721 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.081748 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25557] 10:12:38.081832 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.081881 read(6,  <unfinished ...>
[pid 25557] 10:12:38.081909 read(13,  <unfinished ...>
[pid 25559] 10:12:38.081937 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:38.081956 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25559] 10:12:38.082851 read(6,  <unfinished ...>
[pid 25557] 10:12:38.082892 brk(0x25c6000 <unfinished ...>
[pid 25559] 10:12:38.082923 <... read resumed> "", 4096) = 0
[pid 25557] 10:12:38.082945 <... brk resumed> ) = 0x25c6000
[pid 25559] 10:12:38.083279 close(6 <unfinished ...>
[pid 25557] 10:12:38.083315 read(13,  <unfinished ...>
[pid 25559] 10:12:38.083352 <... close resumed> ) = 0
[pid 25557] 10:12:38.083373 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25559] 10:12:38.084210 munmap(0x7ff9b2d42000, 4096 <unfinished ...>
[pid 25557] 10:12:38.084256 brk(0x25e7000 <unfinished ...>
[pid 25559] 10:12:38.084286 <... munmap resumed> ) = 0
[pid 25557] 10:12:38.084323 <... brk resumed> ) = 0x25e7000
[pid 25559] 10:12:38.084829 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7ff9b1bf8790},  <unfinished ...>
[pid 25557] 10:12:38.084874 read(13,  <unfinished ...>
[pid 25559] 10:12:38.084905 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25559] 10:12:38.084939 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25557] 10:12:38.084989 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25559] 10:12:38.085013 <... open resumed> ) = 6
[pid 25544] 10:12:38.085744 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25559] 10:12:38.085790 fcntl(6, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.085817 brk(0x2608000 <unfinished ...>
[pid 25544] 10:12:38.085842 recvfrom(16,  <unfinished ...>
[pid 25559] 10:12:38.085874 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.085891 <... brk resumed> ) = 0x2608000
[pid 25544] 10:12:38.085904 <... recvfrom resumed> "\274/\201\200\0\1\0\2\0\0\0\0\6hilton\3com\0\0\17\0\1\300\f\0\17\0\1\0\0.o\0\25\0\n\3mx2\6hilton\5iphmx\300\23\300\f\0\17\0\1\0\0.o\0\10\0\n\3mx1\300.", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 81
[pid 25559] 10:12:38.086353 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.086389 read(13,  <unfinished ...>
[pid 25544] 10:12:38.086415 close(16 <unfinished ...>
[pid 25559] 10:12:38.086451 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.086468 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25544] 10:12:38.086495 <... close resumed> ) = 0
[pid 25559] 10:12:38.086875 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25557] 10:12:38.086917 read(13,  <unfinished ...>
[pid 25544] 10:12:38.086941 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25559] 10:12:38.086977 <... fcntl resumed> ) = 0
[pid 25557] 10:12:38.086995 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:38.087009 <... socket resumed> ) = 16
[pid 25559] 10:12:38.087035 fstat(6,  <unfinished ...>
[pid 25557] 10:12:38.087059 close(13 <unfinished ...>
[pid 25544] 10:12:38.087083 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16 <unfinished ...>
[pid 25559] 10:12:38.087121 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080158, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:38.087161 <... close resumed> ) = 0
[pid 25544] 10:12:38.087177 <... connect resumed> ) = 0
[pid 25559] 10:12:38.087219 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-H", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.087256 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25544] 10:12:38.087284 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25559] 10:12:38.087319 <... open resumed> ) = 8
[pid 25557] 10:12:38.087337 <... stat resumed> 0x7fc7a75de880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.087359 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25559] 10:12:38.087396 fstat(8,  <unfinished ...>
[pid 25557] 10:12:38.087421 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25544] 10:12:38.087455 sendto(16, "\370\326\1\0\0\1\0\0\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25559] 10:12:38.087527 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080188, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1003, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25557] 10:12:38.087630 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25544] 10:12:38.087658 <... sendto resumed> ) = 38
[pid 25559] 10:12:38.087684 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25557] 10:12:38.087711 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25544] 10:12:38.087736 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25559] 10:12:38.087767 <... mmap resumed> ) = 0x7ff9b2d42000
[pid 25557] 10:12:38.087784 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25559] 10:12:38.087811 read(8, "1aEJMb-0006e1-MY-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 4096) = 1003
[pid 25557] 10:12:38.087894 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.087928 read(8, "", 4096) = 0
[pid 25557] 10:12:38.087962 <... open resumed> ) = 13
[pid 25559] 10:12:38.087978 close(8)    = 0
[pid 25557] 10:12:38.088015 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.088049 munmap(0x7ff9b2d42000, 4096) = 0
[pid 25557] 10:12:38.088090 <... ioctl resumed> , 0x7ffc5db6c320) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.088110 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.088165 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.088192 open("/var/spool/exim/msglog/b/1aEJMb-0006e1-MY", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25557] 10:12:38.088237 <... lseek resumed> ) = 0
[pid 25559] 10:12:38.088253 fcntl(8, F_GETFD) = 0
[pid 25557] 10:12:38.088311 read(13,  <unfinished ...>
[pid 25559] 10:12:38.088339 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25557] 10:12:38.088376 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25559] 10:12:38.088398 fchown(8, 47, 12) = 0
[pid 25557] 10:12:38.088823 brk(0x2629000 <unfinished ...>
[pid 25559] 10:12:38.088855 fchmod(8, 0640) = 0
[pid 25557] 10:12:38.088897 <... brk resumed> ) = 0x2629000
[pid 25559] 10:12:38.088914 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25557] 10:12:38.089108 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25559] 10:12:38.089143 fstat(8,  <unfinished ...>
[pid 25566] 10:12:38.089181 <... select resumed> ) = 1 (in [11], left {299, 990068})
[pid 25559] 10:12:38.089211 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080190, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=148, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25557] 10:12:38.089242 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.089262 recvfrom(11,  <unfinished ...>
[pid 25559] 10:12:38.089291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.089326 <... recvfrom resumed> "220 mx.google.com ESMTP v5si31377544oeq.19 - gsmtp\r\n", 4096, 0, NULL, NULL) = 52
[pid 25559] 10:12:38.089373 <... mmap resumed> ) = 0x7ff9b2d42000
[pid 25557] 10:12:38.089396 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25566] 10:12:38.089426 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25559] 10:12:38.089477 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25566] 10:12:38.089507 <... sendto resumed> ) = 33
[pid 25559] 10:12:38.089525 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.089609 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.089635 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25559] 10:12:38.089683 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25557] 10:12:38.089740 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25559] 10:12:38.089773 pipe([9, 10]) = 0
[pid 25557] 10:12:38.089811 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.089828 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [], SA_RESTORER, 0x7ff9b1bf8790}, 8) = 0
[pid 25557] 10:12:38.089873 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25559] 10:12:38.089903 clone( <unfinished ...>
[pid 25557] 10:12:38.090146 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.090165 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25571
[pid 25559] 10:12:38.090213 close(10)   = 0
[pid 25559] 10:12:38.090257 read(9,  <unfinished ...>
[pid 25557] 10:12:38.090291 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090341 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090385 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090429 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090472 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090517 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090630 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.090676 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25557] 10:12:38.090731 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25557] 10:12:38.090777 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc5db6bd30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:38.090816 lseek(14, 0, SEEK_CUR) = 0
[pid 25557] 10:12:38.090871 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25557] 10:12:38.091193 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25557] 10:12:38.091859 brk(0x264a000) = 0x264a000
[pid 25557] 10:12:38.092065 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25557] 10:12:38.092457 read(14, "", 8192) = 0
[pid 25557] 10:12:38.092509 close(14)   = 0
[pid 25557] 10:12:38.093258 read(13,  <unfinished ...>
[pid 25544] 10:12:38.093294 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25544] 10:12:38.093320 recvfrom(16, "\370\326\201\200\0\1\0\10\0\0\0\0\3mx1\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\ny\0\4D\350\207\324\300\f\0\1\0\1\0\0\ny\0\4D\350\217\276\300\f\0\1\0\1\0\0\ny\0\4D\350\211\265\300\f\0\1\0\1\0\0\ny\0\4D\350\216\t\300\f\0\1\0\1\0\0\ny\0\4D\350\217\220\300\f\0\1\0\1\0\0\ny\0\4D\350\214S\300\f\0\1\0\1\0\0\ny\0\4D\350\214v\300\f\0\1\0\1\0\0\ny\0\4D\350\2159", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 166
[pid 25544] 10:12:38.093386 close(16 <unfinished ...>
[pid 25557] 10:12:38.093425 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25544] 10:12:38.093464 <... close resumed> ) = 0
[pid 25544] 10:12:38.093510 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25557] 10:12:38.094296 read(13,  <unfinished ...>
[pid 25544] 10:12:38.094324 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25544] 10:12:38.094375 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25544] 10:12:38.094420 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25544] 10:12:38.094463 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25544] 10:12:38.094503 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25544] 10:12:38.094592 close(16)   = 0
[pid 25544] 10:12:38.094641 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25544] 10:12:38.094715 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.094765 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c18000
[pid 25544] 10:12:38.094804 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25544] 10:12:38.094866 read(16, "", 1024) = 0
[pid 25544] 10:12:38.094913 read(16, "", 1024) = 0
[pid 25544] 10:12:38.094953 close(16)   = 0
[pid 25544] 10:12:38.094990 munmap(0x7fa692c18000, 4096) = 0
[pid 25544] 10:12:38.095105 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25544] 10:12:38.095149 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
[pid 25544] 10:12:38.095192 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25544] 10:12:38.095232 sendto(16, "h\16\1\0\0\1\0\0\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1", 38, MSG_NOSIGNAL, NULL, 0) = 38
[pid 25544] 10:12:38.095302 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25557] 10:12:38.095343 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25557] 10:12:38.096133 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
Process 25570 attached
[pid 25570] 10:12:38.096648 set_robust_list(0x7f33164e4aa0, 24) = 0
[pid 25570] 10:12:38.096769 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0}) = 0
[pid 25570] 10:12:38.096933 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.097151 brk(0x266b000 <unfinished ...>
[pid 25570] 10:12:38.097189 <... open resumed> ) = 10
[pid 25570] 10:12:38.097218 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25570] 10:12:38.097284 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25570] 10:12:38.097368 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25570] 10:12:38.097424 lseek(10, 0, SEEK_SET) = 0
[pid 25570] 10:12:38.097476 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25570] 10:12:38.097635 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25570] 10:12:38.097725 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25570] 10:12:38.097773 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25557] 10:12:38.097823 <... brk resumed> ) = 0x266b000
[pid 25570] 10:12:38.097847 fstat(13,  <unfinished ...>
[pid 25557] 10:12:38.097922 read(13,  <unfinished ...>
[pid 25570] 10:12:38.097951 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25570] 10:12:38.097984 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164f9000
[pid 25570] 10:12:38.098024 lseek(13, 0, SEEK_SET) = 0
[pid 25570] 10:12:38.098060 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25570] 10:12:38.098134 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0},  <unfinished ...>
[pid 25557] 10:12:38.098173 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25570] 10:12:38.098615 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25570] 10:12:38.098653 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25570] 10:12:38.098697 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f33153b1790}, 8) = 0
[pid 25570] 10:12:38.098740 close(11)   = 0
[pid 25570] 10:12:38.098777 fcntl(12, F_GETFD) = 0
[pid 25570] 10:12:38.098812 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25570] 10:12:38.098859 geteuid()   = 0
[pid 25570] 10:12:38.098895 getegid()   = 12
[pid 25570] 10:12:38.098931 setgid(500) = 0
[pid 25570] 10:12:38.098966 setuid(503) = 0
[pid 25570] 10:12:38.099001 chdir("/")  = 0
[pid 25570] 10:12:38.099049 geteuid()   = 503
[pid 25570] 10:12:38.099084 getegid()   = 500
[pid 25570] 10:12:38.099140 stat("/home/finest09/mail/finestweddingsites.com/lisa", {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25570] 10:12:38.099200 chdir("/home/finest09/mail/finestweddingsites.com/lisa") = 0
[pid 25570] 10:12:38.099239 stat("tmp", {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25570] 10:12:38.099289 stat("new", {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25570] 10:12:38.099344 stat("cur", {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25570] 10:12:38.099478 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25570] 10:12:38.099532 read(11, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4151
[pid 25570] 10:12:38.099714 stat("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", 0x7ffc8615b940) = -1 ENOENT (No such file or directory)
[pid 25570] 10:12:38.099768 open("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25557] 10:12:38.100089 read(13,  <unfinished ...>
[pid 25570] 10:12:38.100132 chown("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", 503, 500) = 0
[pid 25570] 10:12:38.100181 chmod("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", 0660) = 0
[pid 25570] 10:12:38.100223 chown("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", 503, 500) = 0
[pid 25570] 10:12:38.100263 chmod("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", 0660) = 0
[pid 25570] 10:12:38.100333 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25570] 10:12:38.100419 lseek(6, 19, SEEK_SET) = 19
[pid 25570] 10:12:38.100458 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25570] 10:12:38.100513 read(6, "", 8192) = 0
[pid 25570] 10:12:38.100620 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2565) = 2565
[pid 25570] 10:12:38.100674 fsync(14 <unfinished ...>
[pid 25557] 10:12:38.100754 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25557] 10:12:38.101237 brk(0x268c000) = 0x268c000
[pid 25570] 10:12:38.101599 <... fsync resumed> ) = 0
[pid 25570] 10:12:38.101637 lseek(11, 0, SEEK_END) = 4151
[pid 25570] 10:12:38.101675 write(11, "2565 1\n", 7) = 7
[pid 25570] 10:12:38.101718 close(11)   = 0
[pid 25570] 10:12:38.101757 fstat(14, {st_dev=makedev(144, 4215), st_ino=122179988, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2565, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25570] 10:12:38.101807 close(14)   = 0
[pid 25570] 10:12:38.101855 rename("tmp/1451491958.H99703P25570.fin.finestweddingsites.com", "new/1451491958.H99703P25570.fin.finestweddingsites.com,S=2565") = 0
[pid 25570] 10:12:38.101924 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25491] 10:12:38.101961 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.101986 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102016 <... write resumed> ) = 4
[pid 25570] 10:12:38.102042 write(12, "\5\n\0\0", 4 <unfinished ...>
[pid 25491] 10:12:38.102075 <... read resumed> "\5\n\0\0", 4) = 4
[pid 25491] 10:12:38.102096 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102123 <... write resumed> ) = 4
[pid 25570] 10:12:38.102142 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25491] 10:12:38.102172 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25491] 10:12:38.102191 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102219 <... write resumed> ) = 4
[pid 25570] 10:12:38.102237 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25491] 10:12:38.102266 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102286 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102313 <... write resumed> ) = 4
[pid 25570] 10:12:38.102332 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25491] 10:12:38.102362 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102381 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102415 <... write resumed> ) = 4
[pid 25570] 10:12:38.102442 write(12, "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102487 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102509 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102600 write(12, "\260\203]\1\0\0\0\0", 8) = 8
[pid 25491] 10:12:38.102644 <... read resumed> "\260\203]\1\0\0\0\0", 8) = 8
[pid 25491] 10:12:38.102665 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102693 write(12, "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102727 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102747 read(11,  <unfinished ...>
[pid 25570] 10:12:38.102775 write(12, "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102808 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25491] 10:12:38.102828 close(11)   = 0
[pid 25491] 10:12:38.102870 write(9, "lisa@finestweddingsites.com\n", 28) = 28
[pid 25491] 10:12:38.102916 fsync(9 <unfinished ...>
[pid 25570] 10:12:38.102962 close(12)   = 0
[pid 25570] 10:12:38.103042 close(10)   = 0
[pid 25570] 10:12:38.103079 munmap(0x7f33164fa000, 4096) = 0
[pid 25570] 10:12:38.103121 close(13)   = 0
[pid 25570] 10:12:38.103158 munmap(0x7f33164f9000, 4096) = 0
[pid 25491] 10:12:38.103197 <... fsync resumed> ) = 0
[pid 25491] 10:12:38.103218 wait4(-1,  <unfinished ...>
[pid 25570] 10:12:38.103691 exit_group(0) = ?
[pid 25570] 10:12:38.104009 +++ exited with 0 +++
[pid 25491] 10:12:38.104027 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25570
[pid 25491] 10:12:38.104078 open("/etc/userdomains", O_RDONLY) = 10
[pid 25491] 10:12:38.104123 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.104176 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25491] 10:12:38.104223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:38.104262 lseek(10, 0, SEEK_SET) = 0
[pid 25491] 10:12:38.104297 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25491] 10:12:38.104361 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com", 0x7ffc8615a690) = -1 ENOENT (No such file or directory)
[pid 25491] 10:12:38.104416 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:38.104479 write(8, "2015-12-30 10:12:38 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126) = 126
[pid 25491] 10:12:38.104535 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com: children all complete\n", 77) = 77
[pid 25566] 10:12:38.104685 <... select resumed> ) = 1 (in [11], left {299, 984999})
[pid 25491] 10:12:38.104717 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.104749 recvfrom(11,  <unfinished ...>
[pid 25491] 10:12:38.104776 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.104820 <... recvfrom resumed> "250-mx.google.com at your service, [50.116.78.207]\r\n250-SIZE 35882577\r\n250-8BITMIME\r\n250-STARTTLS\r\n250-ENHANCEDSTATUSCODES\r\n250-PIPELINING\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n", 4096, 0, NULL, NULL) = 168
[pid 25491] 10:12:38.104868 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.104899 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0 <unfinished ...>
[pid 25491] 10:12:38.104946 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.104984 <... sendto resumed> ) = 10
[pid 25491] 10:12:38.105002 close(7 <unfinished ...>
[pid 25566] 10:12:38.105031 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25491] 10:12:38.105060 <... close resumed> ) = 0
[pid 25491] 10:12:38.105082 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:38.105128 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:38.105161 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:38.105194 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388082, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25491] 10:12:38.105239 write(7, "2015-12-30 10:12:38 [25491] 1aEJMZ-0006cs-RM => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2565 QT=3s "..., 262) = 262
[pid 25491] 10:12:38.105319 pipe([11, 12]) = 0
[pid 25491] 10:12:38.105361 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25491] 10:12:38.105653 close(10)   = 0
[pid 25491] 10:12:38.105701 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:38.105744 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25572
[pid 25491] 10:12:38.105975 close(12)   = 0
[pid 25491] 10:12:38.106029 pipe([10, 12]) = 0
[pid 25491] 10:12:38.106070 fcntl(10, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25491] 10:12:38.106112 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25573
[pid 25491] 10:12:38.106352 close(12)   = 0
[pid 25491] 10:12:38.106407 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:38.106454 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25557] 10:12:38.106645 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25557] 10:12:38.107185 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25557] 10:12:38.107618 brk(0x26ad000) = 0x26ad000
[pid 25557] 10:12:38.107980 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
Process 25571 attached
[pid 25571] 10:12:38.108712 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25557] 10:12:38.108787 read(13,  <unfinished ...>
[pid 25571] 10:12:38.108817 <... set_robust_list resumed> ) = 0
[pid 25571] 10:12:38.108893 close(9 <unfinished ...>
[pid 25557] 10:12:38.108926 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25557] 10:12:38.109181 brk(0x26ce000 <unfinished ...>
[pid 25571] 10:12:38.109218 <... close resumed> ) = 0
[pid 25571] 10:12:38.109247 geteuid()   = 0
[pid 25571] 10:12:38.109284 getegid()   = 12
[pid 25571] 10:12:38.109321 setgid(494) = 0
[pid 25571] 10:12:38.109357 setuid(495) = 0
[pid 25571] 10:12:38.109415 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25571] 10:12:38.109472 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25571] 10:12:38.109625 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25571] 10:12:38.109697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25571] 10:12:38.109743 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25571] 10:12:38.109795 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25571] 10:12:38.109845 close(9)    = 0
[pid 25571] 10:12:38.109883 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25571] 10:12:38.109968 brk(0x9fb000 <unfinished ...>
[pid 25557] 10:12:38.110000 <... brk resumed> ) = 0x26ce000
[pid 25557] 10:12:38.110514 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25571] 10:12:38.110636 <... brk resumed> ) = 0x9fb000
[pid 25571] 10:12:38.110826 lseek(6, 19, SEEK_SET) = 19
[pid 25571] 10:12:38.110877 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2383) = 1858
[pid 25571] 10:12:38.111140 write(10, "\2\0\0\0", 4) = 4
[pid 25559] 10:12:38.111185 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25559] 10:12:38.111208 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111237 write(10, "\1\0\0\0", 4) = 4
[pid 25559] 10:12:38.111271 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25559] 10:12:38.111291 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111318 write(10, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111352 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111372 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111400 write(10, "\377\377\377\377", 4) = 4
[pid 25559] 10:12:38.111434 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25559] 10:12:38.111454 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111483 write(10, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111517 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111596 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111644 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25559] 10:12:38.111692 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25559] 10:12:38.111718 read(9,  <unfinished ...>
[pid 25571] 10:12:38.111746 write(10, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111781 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.111804 wait4(-1,  <unfinished ...>
[pid 25571] 10:12:38.111834 close(10)   = 0
[pid 25571] 10:12:38.111879 exit_group(0) = ?
[pid 25571] 10:12:38.112131 +++ exited with 0 +++
[pid 25559] 10:12:38.112148 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25571
[pid 25559] 10:12:38.112170 close(9)    = 0
[pid 25559] 10:12:38.112208 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.112270 brk(0x9fa000) = 0x9fa000
[pid 25559] 10:12:38.112316 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25559] 10:12:38.112373 alarm(60)   = 0
[pid 25559] 10:12:38.112409 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25559] 10:12:38.112448 alarm(0)    = 60
[pid 25559] 10:12:38.112531 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.112654 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25559] 10:12:38.112713 read(10, "cpu  123097 1342481 395289 67343100 2509 0 0 0\ncpu0 123097 1342481 395289 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58619405\nbtime 1450798266\nprocesses 893051\nprocs_running 5\nprocs_blocked 0\n", 8192) = 191
[pid 25559] 10:12:38.112775 close(10)   = 0
[pid 25559] 10:12:38.112869 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.112934 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25559] 10:12:38.112978 fcntl(10, F_GETFD) = 0
[pid 25559] 10:12:38.113012 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.113050 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25559] 10:12:38.113105 close(10)   = 0
[pid 25559] 10:12:38.113156 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.113201 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25559] 10:12:38.113304 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2cfa000
[pid 25559] 10:12:38.113458 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25559] 10:12:38.113505 fcntl(10, F_GETFD) = 0
[pid 25559] 10:12:38.113600 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.113657 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.113751 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25559] 10:12:38.113847 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25559] 10:12:38.113911 pread(10, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25559] 10:12:38.113980 close(10)   = 0
[pid 25559] 10:12:38.114043 munmap(0x7ff9b2cfa000, 200704) = 0
[pid 25559] 10:12:38.114113 close(9)    = 0
[pid 25559] 10:12:38.114171 open("/etc/localdomains", O_RDONLY) = 9
[pid 25559] 10:12:38.114218 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.114274 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.114322 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.114360 lseek(9, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.114395 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.114465 stat("/jail_owner", 0x7fffca4b4050) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.114515 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.114689 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom_finestweddingsites.com/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.114744 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.114800 stat("/usr/local/cpanel/3rdparty/mailman/lists/bridesfrom/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.114845 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.114916 open("/etc/demouids", O_RDONLY) = 10
[pid 25559] 10:12:38.114960 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.115009 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.115054 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25559] 10:12:38.115092 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.115125 read(10, "", 4096) = 0
[pid 25559] 10:12:38.115167 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.115321 getuid()    = 0
[pid 25559] 10:12:38.115365 geteuid()   = 0
[pid 25559] 10:12:38.115401 getgid()    = 12
[pid 25559] 10:12:38.115436 getegid()   = 12
[pid 25559] 10:12:38.115535 open("/dev/urandom", O_RDONLY) = 11
[pid 25559] 10:12:38.115692 read(11, "\356\375I\334", 4) = 4
[pid 25559] 10:12:38.115735 close(11)   = 0
[pid 25559] 10:12:38.115850 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25559] 10:12:38.115960 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae5e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.116008 lseek(0, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.116047 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae5e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.116085 lseek(1, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.116120 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae5f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.116156 lseek(2, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.116193 open("/dev/null", O_RDONLY) = 11
[pid 25559] 10:12:38.116238 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae6c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.116274 lseek(11, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.116310 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.116347 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.116702 brk(0xa1b000) = 0xa1b000
[pid 25559] 10:12:38.116763 read(11, "", 8192) = 0
[pid 25559] 10:12:38.116807 close(11)   = 0
[pid 25559] 10:12:38.117103 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25559] 10:12:38.117172 open("/etc/exim.pl", O_RDONLY) = 11
[pid 25559] 10:12:38.117216 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae4f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.117257 lseek(11, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.117312 read(11, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25566] 10:12:38.118246 <... select resumed> ) = 1 (in [11], left {299, 986813})
[pid 25559] 10:12:38.118284 brk(0xa3c000 <unfinished ...>
[pid 25566] 10:12:38.118311 recvfrom(11, "220 2.0.0 Ready to start TLS\r\n", 4096, 0, NULL, NULL) = 30
[pid 25566] 10:12:38.120299 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25559] 10:12:38.120361 <... brk resumed> ) = 0xa3c000
[pid 25566] 10:12:38.120836 fstat(14,  <unfinished ...>
[pid 25559] 10:12:38.120873 read(11,  <unfinished ...>
[pid 25566] 10:12:38.120910 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25559] 10:12:38.120941 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25566] 10:12:38.121785 poll([{fd=14, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25559] 10:12:38.121829 brk(0xa5d000 <unfinished ...>
[pid 25566] 10:12:38.121865 <... poll resumed> ) = 1 ([{fd=14, revents=POLLIN}])
[pid 25559] 10:12:38.121883 <... brk resumed> ) = 0xa5d000
[pid 25566] 10:12:38.122307 read(14,  <unfinished ...>
[pid 25559] 10:12:38.122341 read(11,  <unfinished ...>
[pid 25566] 10:12:38.122383 <... read resumed> "\333$#C\201\326\4(\1_\22Wk\252\374\271%\220I\301\276\276Z\226a\234[\243\t\220\211\351\245\203\355\264F\257Z\225\355S\201o\332\343\30w", 48) = 48
[pid 25559] 10:12:38.122402 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25566] 10:12:38.123089 close(14 <unfinished ...>
[pid 25559] 10:12:38.123124 brk(0xa7e000 <unfinished ...>
[pid 25566] 10:12:38.123160 <... close resumed> ) = 0
[pid 25559] 10:12:38.123175 <... brk resumed> ) = 0xa7e000
[pid 25566] 10:12:38.123211 getuid()    = 47
[pid 25559] 10:12:38.124587 read(11,  <unfinished ...>
[pid 25566] 10:12:38.129451 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.129482 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25558] 10:12:38.129502 <... select resumed> ) = 1 (in [11], left {299, 952619})
[pid 25558] 10:12:38.129534 read(11,  <unfinished ...>
[pid 25559] 10:12:38.129894 read(11,  <unfinished ...>
[pid 25558] 10:12:38.129918 <... read resumed> "\27\3\1\0000", 5) = 5
[pid 25558] 10:12:38.129943 read(11, "\233/\216w\25\277\250\232u\213T\232b\26A,\33\203\306\210|:I\223\374Ag\376N.\3617:\310W\225\326\253\37\261\275n\362\306wV>R", 48) = 48
[pid 25558] 10:12:38.129993 select(12, [11], NULL, NULL, {300, 0}) = 1 (in [11], left {299, 999998})
[pid 25558] 10:12:38.130040 read(11, "\27\3\1\0@", 5) = 5
[pid 25558] 10:12:38.130076 read(11, "d\f\3740m\331^\31~\230-\216\25`\22\365\207C\326\357\224\234\341g\365\361\16\2445\27\7\266\313\372\214\1\371\0\210ck\337\276\316cP\377\v\251\210\203\276\203\"\2*\254\312\364\207]y\3340", 64) = 64
[pid 25558] 10:12:38.130140 lseek(6, 19, SEEK_SET) = 19
[pid 25558] 10:12:38.130179 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25558] 10:12:38.130231 read(6, "", 8192) = 0
[pid 25558] 10:12:38.130266 alarm(300)  = 0
[pid 25558] 10:12:38.130325 write(11, "\27\3\1\0 O}\277\241\352\371Q\1c\347\347\254\5B\22\261\20342\261.\30\272\201nq\272d\26\2525}\27\3\1\f0\"\33\212a\303\17\340k\17\272\304|E\326\22p\337\323\35W\233v) \254b\344g\32!0\274\232\255`\262\243^\333\v\267\207\333\323\217\20\316K\225\321D\267*\273B\376D\220Mh{!\302\313\3523\2\327\274\277K\1\5\252\327\242\341\325(\223\17J\234<\334/t'R\31\372\242P\244\347\366D<\354\377<.\311\271\6\tb\275,\332Y\210\252\325#\340.1\270\"\240H\370\320\31n8\211\344\24\354h\31\n\321\2370\350\220\252\234l\372\312\216\177\267\251\322\251\264\0\227\346z\240\27X\270\322\340Q6\317t\22\337\"\233\243?cG$\316\206h)\357N>\312\230{\302\204\212\223\374\25\345r\236\331\374C\354o\355\6\2124\270\24]C\330\345\230\17\314\212\320\271"..., 3162) = 3162
[pid 25558] 10:12:38.130418 alarm(0)    = 300
[pid 25558] 10:12:38.130455 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25559] 10:12:38.130492 <... read resumed> "", 8192) = 0
[pid 25559] 10:12:38.130515 close(11)   = 0
[pid 25559] 10:12:38.130654 stat("/usr/share/amavis/amavis-filter", 0x7ff9b13df880) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.130710 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25559] 10:12:38.130768 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25559] 10:12:38.130820 open("/etc/exim.pl.local", O_RDONLY) = 11
[pid 25559] 10:12:38.130864 ioctl(11, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4ae4f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.130904 lseek(11, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.130958 read(11, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25559] 10:12:38.131261 brk(0xa9f000) = 0xa9f000
[pid 25559] 10:12:38.131475 stat("/etc/exim/perl/warnings.pmc", 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.131614 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.131646 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.131676 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.131692 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.131730 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25557] 10:12:38.131752 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.131784 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.131800 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.131833 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.131853 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.131880 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.131894 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.131929 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25557] 10:12:38.131951 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.131987 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132002 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.132035 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.132057 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132098 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132117 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.132164 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25557] 10:12:38.132191 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132224 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132240 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.132277 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.132299 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132327 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132342 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.132382 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25557] 10:12:38.132405 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132436 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132451 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.132488 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.132509 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132620 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132646 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.132699 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25557] 10:12:38.132722 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132753 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.132769 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.132805 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25557] 10:12:38.132827 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132855 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25557] 10:12:38.132883 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.132921 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.132943 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.132976 <... open resumed> ) = 12
[pid 25557] 10:12:38.132990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25559] 10:12:38.133029 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:38.133050 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.133076 <... ioctl resumed> , 0x7fffca4adf00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:38.133091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25559] 10:12:38.133129 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:38.133156 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25559] 10:12:38.133196 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.133211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.133271 read(12,  <unfinished ...>
[pid 25557] 10:12:38.133293 <... open resumed> ) = 14
[pid 25559] 10:12:38.133320 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25557] 10:12:38.133342 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25559] 10:12:38.133769 read(12,  <unfinished ...>
[pid 25557] 10:12:38.133794 <... ioctl resumed> , 0x7ffc5db6bd30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.133824 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25557] 10:12:38.133845 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25559] 10:12:38.134413 brk(0xac0000 <unfinished ...>
[pid 25557] 10:12:38.134439 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.134490 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25557] 10:12:38.134811 lseek(14, 878, SEEK_SET) = 878
[pid 25557] 10:12:38.134859 lseek(14, 0, SEEK_CUR) = 878
[pid 25557] 10:12:38.134896 close(14)   = 0
[pid 25557] 10:12:38.135154 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25559] 10:12:38.135608 <... brk resumed> ) = 0xac0000
[pid 25559] 10:12:38.135838 read(12, Process 25572 attached
 <unfinished ...>
[pid 25572] 10:12:38.135918 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25557] 10:12:38.136095 brk(0x26ef000 <unfinished ...>
[pid 25572] 10:12:38.136126 <... set_robust_list resumed> ) = 0
[pid 25572] 10:12:38.136172 fcntl(12, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.136209 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25544] 10:12:38.136234 recvfrom(16, "h\16\201\200\0\1\0\10\0\0\0\0\3mx2\6hilton\5iphmx\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\t\273\0\4D\350\217\276\300\f\0\1\0\1\0\0\t\273\0\4D\350\214v\300\f\0\1\0\1\0\0\t\273\0\4D\350\2159\300\f\0\1\0\1\0\0\t\273\0\4D\350\2167\300\f\0\1\0\1\0\0\t\273\0\4D\350\214\344\300\f\0\1\0\1\0\0\t\273\0\4D\350\211\\\300\f\0\1\0\1\0\0\t\273\0\4D\350\211\266\300\f\0\1\0\1\0\0\t\273\0\4D\350\216\t", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 166
[pid 25544] 10:12:38.136290 close(16)   = 0
[pid 25544] 10:12:38.136513 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25544] 10:12:38.136668 open("/etc/passwd", O_RDONLY) = 16
[pid 25544] 10:12:38.136717 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc5380cea0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.136763 lseek(16, 0, SEEK_CUR) = 0
[pid 25544] 10:12:38.136799 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.136846 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.136891 read(16, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25544] 10:12:38.137122 close(16)   = 0
[pid 25544] 10:12:38.137188 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 16
[pid 25544] 10:12:38.137244 alarm(60)   = 0
[pid 25544] 10:12:38.137278 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25544] 10:12:38.137317 alarm(0)    = 60
[pid 25544] 10:12:38.137362 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.137411 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 17
[pid 25544] 10:12:38.137460 read(17, "cpu  123097 1342483 395289 67343100 2509 0 0 0\ncpu0 123097 1342483 395289 67343100 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58620803\nbtime 1450798266\nprocesses 893051\nprocs_running 7\nprocs_blocked 0\n", 8192) = 191
[pid 25544] 10:12:38.137520 close(17)   = 0
[pid 25544] 10:12:38.137641 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25544] 10:12:38.137702 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25544] 10:12:38.137743 fcntl(17, F_GETFD) = 0
[pid 25544] 10:12:38.137776 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.137809 read(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25544] 10:12:38.137854 close(17)   = 0
[pid 25544] 10:12:38.137894 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.137935 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25544] 10:12:38.138008 brk(0x2163000) = 0x2163000
[pid 25544] 10:12:38.138154 open("/var/spool/exim/db/retry", O_RDONLY) = 17
[pid 25544] 10:12:38.138199 fcntl(17, F_GETFD) = 0
[pid 25544] 10:12:38.138231 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.138264 fstat(17, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25544] 10:12:38.138324 pread(17, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25544] 10:12:38.138396 pread(17, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25544] 10:12:38.138457 pread(17, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25544] 10:12:38.138524 close(17)   = 0
[pid 25544] 10:12:38.138662 close(16)   = 0
[pid 25544] 10:12:38.138713 lseek(13, 0, SEEK_SET) = 0
[pid 25544] 10:12:38.138749 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25544] 10:12:38.138803 stat("/jail_owner", 0x7ffc5380b880) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.138850 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25544] 10:12:38.138915 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck", 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.138962 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25544] 10:12:38.139017 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck", 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.139060 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.139126 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25544] 10:12:38.139237 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.139310 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.139379 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.139440 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 16
[pid 25544] 10:12:38.139483 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.139533 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.139667 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c18000
[pid 25544] 10:12:38.139708 lseek(16, 0, SEEK_SET) = 0
[pid 25544] 10:12:38.139742 read(16, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25544] 10:12:38.139820 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4158, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.139895 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY) = 17
[pid 25544] 10:12:38.139941 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc53808820) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.139980 lseek(17, 0, SEEK_CUR) = 0
[pid 25544] 10:12:38.140014 fstat(17, {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4158, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.140060 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.140100 read(17, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4158
[pid 25544] 10:12:38.140914 read(17, "", 8192) = 0
[pid 25544] 10:12:38.140965 close(17)   = 0
[pid 25544] 10:12:38.141021 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.141091 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.141152 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.141225 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25544] 10:12:38.141271 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.141326 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c17000
[pid 25544] 10:12:38.141365 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:38.141419 close(17)   = 0
[pid 25544] 10:12:38.141455 munmap(0x7fa692c17000, 4096) = 0
[pid 25544] 10:12:38.141508 open("/etc/group", O_RDONLY|O_CLOEXEC) = 17
[pid 25544] 10:12:38.141619 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:38.141670 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c17000
[pid 25544] 10:12:38.141707 read(17, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:38.141761 close(17)   = 0
[pid 25544] 10:12:38.141796 munmap(0x7fa692c17000, 4096) = 0
[pid 25544] 10:12:38.141841 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.141894 pipe([17, 18]) = 0
[pid 25544] 10:12:38.141935 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25544] 10:12:38.141979 close(15)   = 0
[pid 25544] 10:12:38.142014 munmap(0x7fa692c19000, 4096) = 0
[pid 25544] 10:12:38.142053 close(14)   = 0
[pid 25544] 10:12:38.142088 munmap(0x7fa692c1a000, 4096) = 0
[pid 25544] 10:12:38.142123 close(9)    = 0
[pid 25544] 10:12:38.142158 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:38.142195 close(13)   = 0
[pid 25544] 10:12:38.142230 munmap(0x7fa692c1b000, 4096) = 0
[pid 25544] 10:12:38.142266 close(12)   = 0
[pid 25544] 10:12:38.142301 munmap(0x7fa692c1c000, 4096) = 0
[pid 25544] 10:12:38.142338 close(16)   = 0
[pid 25544] 10:12:38.142372 munmap(0x7fa692c18000, 4096) = 0
[pid 25544] 10:12:38.142407 close(11)   = 0
[pid 25544] 10:12:38.142442 munmap(0x7fa692c1d000, 4096) = 0
[pid 25544] 10:12:38.142478 close(10)   = 0
[pid 25544] 10:12:38.142513 munmap(0x7fa692c1e000, 4096) = 0
[pid 25544] 10:12:38.142614 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25574
[pid 25544] 10:12:38.142947 close(18)   = 0
[pid 25544] 10:12:38.142985 read(17, Process 25573 attached
 <unfinished ...>
[pid 25572] 10:12:38.143081 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.143097 <... open resumed> ) = 14
[pid 25559] 10:12:38.143113 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25557] 10:12:38.143151 <... brk resumed> ) = 0x26ef000
[pid 25573] 10:12:38.143634 set_robust_list(0x7f33164e4aa0, 24 <unfinished ...>
[pid 25572] 10:12:38.143782 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.143809 fstat(14,  <unfinished ...>
[pid 25559] 10:12:38.143833 read(12,  <unfinished ...>
[pid 25573] 10:12:38.143862 <... set_robust_list resumed> ) = 0
[pid 25572] 10:12:38.143877 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.143924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25557] 10:12:38.143961 read(13,  <unfinished ...>
[pid 25573] 10:12:38.143996 fcntl(12, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.144019 close(6 <unfinished ...>
[pid 25566] 10:12:38.144040 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.144067 <... read resumed> "", 8192) = 0
[pid 25573] 10:12:38.144088 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.144106 <... close resumed> ) = 0
[pid 25566] 10:12:38.144121 <... mmap resumed> ) = 0x7f21d336b000
[pid 25557] 10:12:38.144162 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25573] 10:12:38.144191 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.145320 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25566] 10:12:38.145366 read(14,  <unfinished ...>
[pid 25559] 10:12:38.145396 close(12 <unfinished ...>
[pid 25573] 10:12:38.145429 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.145444 <... open resumed> ) = 6
[pid 25566] 10:12:38.145463 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25557] 10:12:38.145490 brk(0x2710000 <unfinished ...>
[pid 25573] 10:12:38.145592 close(11 <unfinished ...>
[pid 25572] 10:12:38.145622 fcntl(6, F_GETFD <unfinished ...>
[pid 25566] 10:12:38.145645 read(14,  <unfinished ...>
[pid 25559] 10:12:38.145669 <... close resumed> ) = 0
[pid 25573] 10:12:38.145689 <... close resumed> ) = 0
[pid 25572] 10:12:38.146391 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.146421 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25557] 10:12:38.146445 <... brk resumed> ) = 0x2710000
[pid 25573] 10:12:38.146644 close(6 <unfinished ...>
[pid 25572] 10:12:38.146782 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.146809 read(14,  <unfinished ...>
[pid 25559] 10:12:38.146833 read(11,  <unfinished ...>
[pid 25573] 10:12:38.146865 <... close resumed> ) = 0
[pid 25572] 10:12:38.146880 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.146919 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25557] 10:12:38.146974 read(13,  <unfinished ...>
[pid 25573] 10:12:38.147081 open("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25572] 10:12:38.147118 geteuid( <unfinished ...>
[pid 25566] 10:12:38.147141 read(14,  <unfinished ...>
[pid 25559] 10:12:38.147164 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25573] 10:12:38.147190 <... open resumed> ) = 6
[pid 25572] 10:12:38.147995 <... geteuid resumed> ) = 0
[pid 25566] 10:12:38.148033 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25557] 10:12:38.148067 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25573] 10:12:38.148167 fcntl(6, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.148625 getegid( <unfinished ...>
[pid 25566] 10:12:38.148657 read(14,  <unfinished ...>
[pid 25559] 10:12:38.148684 read(11,  <unfinished ...>
[pid 25573] 10:12:38.148722 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.148737 <... getegid resumed> ) = 12
[pid 25566] 10:12:38.148751 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25573] 10:12:38.148798 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.148822 setgid(12 <unfinished ...>
[pid 25566] 10:12:38.148841 read(14,  <unfinished ...>
[pid 25573] 10:12:38.149631 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.149698 <... setgid resumed> ) = 0
[pid 25566] 10:12:38.149717 <... read resumed> "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25573] 10:12:38.149741 geteuid()   = 0
[pid 25572] 10:12:38.149843 setuid(47 <unfinished ...>
[pid 25566] 10:12:38.149865 read(14,  <unfinished ...>
[pid 25573] 10:12:38.149903 getegid( <unfinished ...>
[pid 25572] 10:12:38.149923 <... setuid resumed> ) = 0
[pid 25566] 10:12:38.149936 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25573] 10:12:38.150024 <... getegid resumed> ) = 12
[pid 25572] 10:12:38.150041 close(11 <unfinished ...>
[pid 25566] 10:12:38.150061 read(14,  <unfinished ...>
[pid 25573] 10:12:38.150105 setgid(12 <unfinished ...>
[pid 25572] 10:12:38.150125 <... close resumed> ) = 0
[pid 25566] 10:12:38.150139 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25559] 10:12:38.150157 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25573] 10:12:38.150622 <... setgid resumed> ) = 0
[pid 25572] 10:12:38.150655 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25566] 10:12:38.150686 read(14,  <unfinished ...>
[pid 25573] 10:12:38.150731 setuid(47 <unfinished ...>
[pid 25572] 10:12:38.150752 <... socket resumed> ) = 10
[pid 25566] 10:12:38.150766 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25573] 10:12:38.150810 <... setuid resumed> ) = 0
[pid 25572] 10:12:38.150830 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25566] 10:12:38.150857 read(14,  <unfinished ...>
[pid 25573] 10:12:38.150904 close(10 <unfinished ...>
[pid 25572] 10:12:38.150924 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.150940 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25573] 10:12:38.151611 <... close resumed> ) = 0
[pid 25572] 10:12:38.151642 close(10 <unfinished ...>
[pid 25566] 10:12:38.151666 read(14,  <unfinished ...>
[pid 25573] 10:12:38.151863 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25572] 10:12:38.151887 <... close resumed> ) = 0
[pid 25566] 10:12:38.151901 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25573] 10:12:38.152000 <... socket resumed> ) = 10
[pid 25572] 10:12:38.152019 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25566] 10:12:38.152041 read(14,  <unfinished ...>
[pid 25573] 10:12:38.152078 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25572] 10:12:38.152103 <... socket resumed> ) = 10
[pid 25566] 10:12:38.152116 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25573] 10:12:38.152208 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.152227 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25566] 10:12:38.152251 read(14,  <unfinished ...>
[pid 25573] 10:12:38.152291 close(10 <unfinished ...>
[pid 25572] 10:12:38.152312 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.152325 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25573] 10:12:38.152404 <... close resumed> ) = 0
[pid 25572] 10:12:38.152421 close(10 <unfinished ...>
[pid 25566] 10:12:38.152441 read(14,  <unfinished ...>
[pid 25573] 10:12:38.152484 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25572] 10:12:38.152505 <... close resumed> ) = 0
[pid 25566] 10:12:38.152519 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25573] 10:12:38.152707 <... socket resumed> ) = 10
[pid 25572] 10:12:38.152730 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.152753 read(14,  <unfinished ...>
[pid 25573] 10:12:38.152794 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25572] 10:12:38.152817 <... open resumed> ) = 10
[pid 25566] 10:12:38.152831 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25573] 10:12:38.152890 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.152908 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.152928 read(14,  <unfinished ...>
[pid 25573] 10:12:38.152963 close(10 <unfinished ...>
[pid 25572] 10:12:38.152983 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.153012 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25573] 10:12:38.153124 <... close resumed> ) = 0
[pid 25572] 10:12:38.153143 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.153166 read(14,  <unfinished ...>
[pid 25573] 10:12:38.153237 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.153261 <... mmap resumed> ) = 0x7f33164fa000
[pid 25566] 10:12:38.153275 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25573] 10:12:38.153356 <... open resumed> ) = 10
[pid 25572] 10:12:38.153375 read(10,  <unfinished ...>
[pid 25566] 10:12:38.153395 read(14,  <unfinished ...>
[pid 25573] 10:12:38.153441 fstat(10,  <unfinished ...>
[pid 25572] 10:12:38.153462 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25566] 10:12:38.153480 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25573] 10:12:38.153632 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25572] 10:12:38.153668 close(10 <unfinished ...>
[pid 25566] 10:12:38.153689 read(14,  <unfinished ...>
[pid 25573] 10:12:38.153877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.153903 <... close resumed> ) = 0
[pid 25566] 10:12:38.153917 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25557] 10:12:38.153936 brk(0x2731000 <unfinished ...>
[pid 25573] 10:12:38.154026 <... mmap resumed> ) = 0x7f33164fa000
[pid 25572] 10:12:38.154042 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25566] 10:12:38.154063 read(14,  <unfinished ...>
[pid 25573] 10:12:38.154104 read(10,  <unfinished ...>
[pid 25572] 10:12:38.154125 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.154139 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25573] 10:12:38.154273 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25572] 10:12:38.154304 stat("/etc/mailips",  <unfinished ...>
[pid 25566] 10:12:38.154327 read(14,  <unfinished ...>
[pid 25573] 10:12:38.154501 close(10 <unfinished ...>
[pid 25572] 10:12:38.154529 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.154633 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25559] 10:12:38.154680 read(11,  <unfinished ...>
[pid 25573] 10:12:38.154772 <... close resumed> ) = 0
[pid 25572] 10:12:38.154787 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.154809 read(14,  <unfinished ...>
[pid 25557] 10:12:38.154829 <... brk resumed> ) = 0x2731000
[pid 25573] 10:12:38.155075 munmap(0x7f33164fa000, 4096 <unfinished ...>
[pid 25572] 10:12:38.155114 <... open resumed> ) = 10
[pid 25566] 10:12:38.155130 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25559] 10:12:38.155155 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25557] 10:12:38.155227 read(13,  <unfinished ...>
[pid 25573] 10:12:38.155633 <... munmap resumed> ) = 0
[pid 25572] 10:12:38.155652 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.155674 read(14,  <unfinished ...>
[pid 25573] 10:12:38.155754 stat("/etc/mailips",  <unfinished ...>
[pid 25572] 10:12:38.155779 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.155807 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25573] 10:12:38.155873 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.155905 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.155925 read(14,  <unfinished ...>
[pid 25573] 10:12:38.155988 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.156012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.156037 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25557] 10:12:38.156060 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25573] 10:12:38.156635 <... open resumed> ) = 10
[pid 25572] 10:12:38.156674 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.156714 read(14,  <unfinished ...>
[pid 25573] 10:12:38.156779 fstat(10,  <unfinished ...>
[pid 25572] 10:12:38.156813 <... mmap resumed> ) = 0x7f33164fa000
[pid 25566] 10:12:38.156834 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25573] 10:12:38.156973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.157023 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.157056 read(14,  <unfinished ...>
[pid 25573] 10:12:38.157532 fstat(10,  <unfinished ...>
[pid 25572] 10:12:38.157650 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.157674 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25559] 10:12:38.157705 brk(0xae1000 <unfinished ...>
[pid 25573] 10:12:38.157777 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.157823 read(10,  <unfinished ...>
[pid 25566] 10:12:38.157856 read(14,  <unfinished ...>
[pid 25573] 10:12:38.157909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.157944 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.157967 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25573] 10:12:38.158300 <... mmap resumed> ) = 0x7f33164fa000
[pid 25572] 10:12:38.158333 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.158370 read(14,  <unfinished ...>
[pid 25573] 10:12:38.158434 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.158469 <... open resumed> ) = 11
[pid 25566] 10:12:38.158491 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25573] 10:12:38.159161 <... lseek resumed> ) = 0
[pid 25572] 10:12:38.159190 fstat(11,  <unfinished ...>
[pid 25566] 10:12:38.159214 read(14,  <unfinished ...>
[pid 25557] 10:12:38.159234 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25573] 10:12:38.159275 read(10,  <unfinished ...>
[pid 25572] 10:12:38.159296 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25566] 10:12:38.159330 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25573] 10:12:38.159372 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.159388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.159411 read(14,  <unfinished ...>
[pid 25573] 10:12:38.159466 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.159489 <... mmap resumed> ) = 0x7f33164f9000
[pid 25566] 10:12:38.159503 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25573] 10:12:38.159681 <... lseek resumed> ) = 0
[pid 25572] 10:12:38.159708 read(11,  <unfinished ...>
[pid 25566] 10:12:38.159730 read(14,  <unfinished ...>
[pid 25573] 10:12:38.159771 read(10,  <unfinished ...>
[pid 25572] 10:12:38.159792 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25566] 10:12:38.159811 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25573] 10:12:38.159911 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.159930 close(11 <unfinished ...>
[pid 25566] 10:12:38.159950 read(14,  <unfinished ...>
[pid 25559] 10:12:38.159970 <... brk resumed> ) = 0xae1000
[pid 25573] 10:12:38.160215 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.160248 <... close resumed> ) = 0
[pid 25566] 10:12:38.160262 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25559] 10:12:38.160280 read(11,  <unfinished ...>
[pid 25573] 10:12:38.160327 <... open resumed> ) = 11
[pid 25572] 10:12:38.160342 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25566] 10:12:38.160362 read(14,  <unfinished ...>
[pid 25573] 10:12:38.160410 fstat(11,  <unfinished ...>
[pid 25572] 10:12:38.160431 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.160444 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25559] 10:12:38.160462 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25573] 10:12:38.161233 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25572] 10:12:38.161277 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.161303 read(14,  <unfinished ...>
[pid 25559] 10:12:38.161323 read(11,  <unfinished ...>
[pid 25573] 10:12:38.161370 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.161394 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25566] 10:12:38.161410 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25573] 10:12:38.161681 <... mmap resumed> ) = 0x7f33164f9000
[pid 25572] 10:12:38.161707 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.161729 read(14,  <unfinished ...>
[pid 25573] 10:12:38.161765 read(11,  <unfinished ...>
[pid 25572] 10:12:38.161785 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.161799 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25573] 10:12:38.161902 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25572] 10:12:38.161925 read(10,  <unfinished ...>
[pid 25566] 10:12:38.161945 read(14,  <unfinished ...>
[pid 25573] 10:12:38.161991 close(11 <unfinished ...>
[pid 25572] 10:12:38.162012 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.162025 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25573] 10:12:38.162118 <... close resumed> ) = 0
[pid 25572] 10:12:38.162137 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.162158 read(14,  <unfinished ...>
[pid 25573] 10:12:38.162203 munmap(0x7f33164f9000, 4096 <unfinished ...>
[pid 25572] 10:12:38.162223 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.162236 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25557] 10:12:38.162254 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.162300 <... munmap resumed> ) = 0
[pid 25572] 10:12:38.162316 read(10,  <unfinished ...>
[pid 25566] 10:12:38.162336 read(14,  <unfinished ...>
[pid 25557] 10:12:38.162355 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25573] 10:12:38.162428 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.162453 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.162467 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25557] 10:12:38.162484 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.162716 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25572] 10:12:38.162741 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25566] 10:12:38.162765 read(14,  <unfinished ...>
[pid 25557] 10:12:38.162785 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25573] 10:12:38.162929 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.162955 <... open resumed> ) = 11
[pid 25566] 10:12:38.162969 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25557] 10:12:38.162995 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
Process 25574 attached
[pid 25573] 10:12:38.163102 <... lseek resumed> ) = 0
[pid 25572] 10:12:38.163136 alarm(60 <unfinished ...>
[pid 25566] 10:12:38.163165 read(14,  <unfinished ...>
[pid 25557] 10:12:38.163188 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25574] 10:12:38.163220 set_robust_list(0x7fa692c09aa0, 24 <unfinished ...>
[pid 25573] 10:12:38.163243 read(10,  <unfinished ...>
[pid 25572] 10:12:38.163265 <... alarm resumed> ) = 0
[pid 25566] 10:12:38.163278 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25574] 10:12:38.163304 <... set_robust_list resumed> ) = 0
[pid 25573] 10:12:38.163383 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.163426 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25557] 10:12:38.163464 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.163489 close(17 <unfinished ...>
[pid 25573] 10:12:38.163517 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.163615 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.163638 read(14,  <unfinished ...>
[pid 25574] 10:12:38.163679 <... close resumed> ) = 0
[pid 25573] 10:12:38.163695 <... lseek resumed> ) = 0
[pid 25572] 10:12:38.163720 alarm(0 <unfinished ...>
[pid 25557] 10:12:38.163747 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25574] 10:12:38.163781 geteuid( <unfinished ...>
[pid 25573] 10:12:38.163803 read(10,  <unfinished ...>
[pid 25572] 10:12:38.163825 <... alarm resumed> ) = 60
[pid 25566] 10:12:38.163838 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25574] 10:12:38.163934 <... geteuid resumed> ) = 0
[pid 25573] 10:12:38.163970 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.163988 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25557] 10:12:38.164042 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.164066 getegid( <unfinished ...>
[pid 25573] 10:12:38.164090 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25572] 10:12:38.164122 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25566] 10:12:38.164150 read(14,  <unfinished ...>
[pid 25559] 10:12:38.164185 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25574] 10:12:38.164211 <... getegid resumed> ) = 12
[pid 25573] 10:12:38.164624 <... open resumed> ) = 11
[pid 25572] 10:12:38.164662 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.164705 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25557] 10:12:38.164732 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25574] 10:12:38.164830 setgid(500 <unfinished ...>
[pid 25573] 10:12:38.164855 alarm(60 <unfinished ...>
[pid 25572] 10:12:38.164878 <... open resumed> ) = 13
[pid 25566] 10:12:38.164891 read(14,  <unfinished ...>
[pid 25574] 10:12:38.164923 <... setgid resumed> ) = 0
[pid 25573] 10:12:38.164937 <... alarm resumed> ) = 0
[pid 25572] 10:12:38.164953 fcntl(13, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.164977 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.164999 setuid(503 <unfinished ...>
[pid 25573] 10:12:38.165029 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25572] 10:12:38.165056 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.165070 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25574] 10:12:38.165096 <... setuid resumed> ) = 0
[pid 25573] 10:12:38.165172 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.165222 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.165250 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25574] 10:12:38.165292 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.165323 alarm(0 <unfinished ...>
[pid 25572] 10:12:38.165346 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.165359 read(14,  <unfinished ...>
[pid 25574] 10:12:38.165395 <... open resumed> ) = 9
[pid 25573] 10:12:38.165409 <... alarm resumed> ) = 60
[pid 25572] 10:12:38.165431 read(13,  <unfinished ...>
[pid 25557] 10:12:38.165508 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.165532 fstat(9,  <unfinished ...>
[pid 25573] 10:12:38.165679 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25572] 10:12:38.165712 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25566] 10:12:38.165733 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25574] 10:12:38.165956 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25573] 10:12:38.166059 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25572] 10:12:38.166201 close(13 <unfinished ...>
[pid 25559] 10:12:38.166239 brk(0xb02000 <unfinished ...>
[pid 25557] 10:12:38.166261 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25574] 10:12:38.166299 fstat(9,  <unfinished ...>
[pid 25573] 10:12:38.166322 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.166351 <... close resumed> ) = 0
[pid 25566] 10:12:38.166365 read(14,  <unfinished ...>
[pid 25574] 10:12:38.166415 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25573] 10:12:38.166442 <... open resumed> ) = 13
[pid 25572] 10:12:38.166460 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.166489 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.166511 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.166626 fcntl(13, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.166665 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.166684 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25574] 10:12:38.166713 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25573] 10:12:38.166781 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.166801 stat("/var/tmp",  <unfinished ...>
[pid 25557] 10:12:38.166837 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25574] 10:12:38.166875 read(9,  <unfinished ...>
[pid 25573] 10:12:38.166910 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.166935 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25566] 10:12:38.166963 read(14,  <unfinished ...>
[pid 25559] 10:12:38.167170 <... brk resumed> ) = 0xb02000
[pid 25574] 10:12:38.167194 <... read resumed> "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25573] 10:12:38.167623 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.167654 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.167693 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25557] 10:12:38.167714 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.167804 read(9,  <unfinished ...>
[pid 25573] 10:12:38.167839 read(13,  <unfinished ...>
[pid 25572] 10:12:38.167862 <... open resumed> ) = 13
[pid 25566] 10:12:38.167875 read(14,  <unfinished ...>
[pid 25574] 10:12:38.167907 <... read resumed> " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25573] 10:12:38.167925 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25572] 10:12:38.167949 fcntl(13, F_GETFD <unfinished ...>
[pid 25557] 10:12:38.167984 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25574] 10:12:38.168021 close(9 <unfinished ...>
[pid 25573] 10:12:38.168045 close(13 <unfinished ...>
[pid 25572] 10:12:38.168068 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.168082 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25574] 10:12:38.168107 <... close resumed> ) = 0
[pid 25573] 10:12:38.168132 <... close resumed> ) = 0
[pid 25572] 10:12:38.168147 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25557] 10:12:38.168181 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.168203 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25573] 10:12:38.168235 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.168263 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.168277 read(14,  <unfinished ...>
[pid 25574] 10:12:38.168309 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.168323 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.168838 fstat(13,  <unfinished ...>
[pid 25557] 10:12:38.168878 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25574] 10:12:38.168919 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25573] 10:12:38.168943 stat("/var/tmp",  <unfinished ...>
[pid 25572] 10:12:38.168972 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25566] 10:12:38.169001 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25574] 10:12:38.169057 <... lseek resumed> ) = 19
[pid 25573] 10:12:38.169090 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25572] 10:12:38.169268 pread(13,  <unfinished ...>
[pid 25557] 10:12:38.169469 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25574] 10:12:38.169495 read(6,  <unfinished ...>
[pid 25573] 10:12:38.169521 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.169642 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25566] 10:12:38.169671 read(14,  <unfinished ...>
[pid 25559] 10:12:38.169727 read(11,  <unfinished ...>
[pid 25574] 10:12:38.169757 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2369) = 1858
[pid 25573] 10:12:38.169776 <... open resumed> ) = 13
[pid 25572] 10:12:38.170238 pread(13,  <unfinished ...>
[pid 25566] 10:12:38.170269 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25557] 10:12:38.170298 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25574] 10:12:38.170423 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25573] 10:12:38.170457 fcntl(13, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.170481 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25566] 10:12:38.170501 read(14,  <unfinished ...>
[pid 25574] 10:12:38.170625 <... write resumed> ) = 4
[pid 25573] 10:12:38.170641 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.170657 pread(13,  <unfinished ...>
[pid 25566] 10:12:38.170682 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25559] 10:12:38.170701 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25557] 10:12:38.170779 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25544] 10:12:38.171321 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25574] 10:12:38.171368 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25573] 10:12:38.171397 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.171420 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25566] 10:12:38.171441 read(14,  <unfinished ...>
[pid 25559] 10:12:38.171478 read(11,  <unfinished ...>
[pid 25557] 10:12:38.171499 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.171531 read(17,  <unfinished ...>
[pid 25574] 10:12:38.171634 <... write resumed> ) = 4
[pid 25573] 10:12:38.171650 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.171666 close(13 <unfinished ...>
[pid 25566] 10:12:38.171692 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25557] 10:12:38.171711 <... open resumed> ) = 14
[pid 25544] 10:12:38.171785 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25574] 10:12:38.171821 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25573] 10:12:38.171855 fstat(13,  <unfinished ...>
[pid 25572] 10:12:38.171878 <... close resumed> ) = 0
[pid 25566] 10:12:38.171891 read(14,  <unfinished ...>
[pid 25557] 10:12:38.171946 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:38.171973 read(17,  <unfinished ...>
[pid 25574] 10:12:38.172005 <... write resumed> ) = 4
[pid 25573] 10:12:38.172018 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25572] 10:12:38.172049 close(11 <unfinished ...>
[pid 25566] 10:12:38.172100 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25557] 10:12:38.172120 <... ioctl resumed> , 0x7ffc5db6bd30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.172204 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25574] 10:12:38.172240 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25573] 10:12:38.172268 pread(13,  <unfinished ...>
[pid 25572] 10:12:38.172292 <... close resumed> ) = 0
[pid 25566] 10:12:38.172306 read(14,  <unfinished ...>
[pid 25557] 10:12:38.172361 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.172386 read(17,  <unfinished ...>
[pid 25574] 10:12:38.172421 <... write resumed> ) = 40
[pid 25573] 10:12:38.172435 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25572] 10:12:38.172457 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25566] 10:12:38.172513 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25557] 10:12:38.172533 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.172701 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25574] 10:12:38.172762 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25573] 10:12:38.172792 pread(13,  <unfinished ...>
[pid 25572] 10:12:38.172815 <... socket resumed> ) = 11
[pid 25566] 10:12:38.172829 read(14,  <unfinished ...>
[pid 25557] 10:12:38.172862 read(14,  <unfinished ...>
[pid 25544] 10:12:38.172886 read(17,  <unfinished ...>
[pid 25574] 10:12:38.172918 <... write resumed> ) = 4
[pid 25573] 10:12:38.172931 <... pread resumed> "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25572] 10:12:38.172953 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25566] 10:12:38.172996 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25557] 10:12:38.173021 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25544] 10:12:38.173105 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25574] 10:12:38.173237 close(18 <unfinished ...>
[pid 25573] 10:12:38.173268 pread(13,  <unfinished ...>
[pid 25572] 10:12:38.173291 <... setsockopt resumed> ) = 0
[pid 25566] 10:12:38.173305 read(14,  <unfinished ...>
[pid 25557] 10:12:38.173345 brk(0x2752000 <unfinished ...>
[pid 25544] 10:12:38.173369 wait4(-1,  <unfinished ...>
[pid 25574] 10:12:38.173407 <... close resumed> ) = 0
[pid 25573] 10:12:38.173420 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25572] 10:12:38.173455 alarm(300 <unfinished ...>
[pid 25566] 10:12:38.173490 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25559] 10:12:38.173509 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25557] 10:12:38.173663 <... brk resumed> ) = 0x2752000
[pid 25574] 10:12:38.174037 exit_group(0) = ?
[pid 25573] 10:12:38.174721 close(13 <unfinished ...>
[pid 25572] 10:12:38.175171 <... alarm resumed> ) = 0
[pid 25566] 10:12:38.175198 read(14,  <unfinished ...>
[pid 25559] 10:12:38.175249 brk(0xb23000 <unfinished ...>
[pid 25574] 10:12:38.175393 +++ exited with 0 +++
[pid 25573] 10:12:38.175417 <... close resumed> ) = 0
[pid 25572] 10:12:38.175479 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("208.65.145.3")}, 16 <unfinished ...>
[pid 25566] 10:12:38.175653 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25557] 10:12:38.175693 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.175757 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25574
[pid 25573] 10:12:38.175803 close(11 <unfinished ...>
[pid 25566] 10:12:38.175851 read(14,  <unfinished ...>
[pid 25557] 10:12:38.175890 <... lseek resumed> ) = 4868
[pid 25544] 10:12:38.175912 close(17 <unfinished ...>
[pid 25573] 10:12:38.175966 <... close resumed> ) = 0
[pid 25566] 10:12:38.176023 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25557] 10:12:38.176055 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.176198 <... close resumed> ) = 0
[pid 25573] 10:12:38.176240 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25566] 10:12:38.176289 read(14,  <unfinished ...>
[pid 25557] 10:12:38.176328 <... lseek resumed> ) = 4868
[pid 25544] 10:12:38.176358 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0},  <unfinished ...>
[pid 25573] 10:12:38.176427 <... socket resumed> ) = 11
[pid 25566] 10:12:38.176465 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25559] 10:12:38.176500 <... brk resumed> ) = 0xb23000
[pid 25557] 10:12:38.176716 close(14 <unfinished ...>
[pid 25544] 10:12:38.177236 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25573] 10:12:38.177321 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25566] 10:12:38.177377 read(14,  <unfinished ...>
[pid 25559] 10:12:38.177418 read(11,  <unfinished ...>
[pid 25557] 10:12:38.177453 <... close resumed> ) = 0
[pid 25544] 10:12:38.177476 stat("/etc/userdomains",  <unfinished ...>
[pid 25573] 10:12:38.177630 <... setsockopt resumed> ) = 0
[pid 25566] 10:12:38.177675 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25557] 10:12:38.177707 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.177870 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25573] 10:12:38.177953 alarm(300 <unfinished ...>
[pid 25566] 10:12:38.177999 read(14,  <unfinished ...>
[pid 25557] 10:12:38.178039 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.178066 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.178131 <... alarm resumed> ) = 0
[pid 25566] 10:12:38.178167 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25557] 10:12:38.178200 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.178324 <... open resumed> ) = 9
[pid 25573] 10:12:38.178364 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("208.65.145.3")}, 16 <unfinished ...>
[pid 25566] 10:12:38.178456 brk(0x2449000 <unfinished ...>
[pid 25557] 10:12:38.178499 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.178525 fstat(9,  <unfinished ...>
[pid 25566] 10:12:38.179498 <... brk resumed> ) = 0x2449000
[pid 25557] 10:12:38.179525 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.179607 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.179670 read(14,  <unfinished ...>
[pid 25557] 10:12:38.179720 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.179746 fstat(9,  <unfinished ...>
[pid 25566] 10:12:38.179793 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25559] 10:12:38.179828 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25557] 10:12:38.179962 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.181008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.181071 read(14,  <unfinished ...>
[pid 25557] 10:12:38.181108 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.181131 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.181187 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25557] 10:12:38.181215 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.181376 <... mmap resumed> ) = 0x7fa692c1f000
[pid 25566] 10:12:38.181411 read(14,  <unfinished ...>
[pid 25557] 10:12:38.181446 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.181470 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.181528 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25557] 10:12:38.181555 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.181692 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.181813 read(14,  <unfinished ...>
[pid 25557] 10:12:38.181849 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.181871 read(9,  <unfinished ...>
[pid 25566] 10:12:38.181928 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25557] 10:12:38.181974 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.182127 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25566] 10:12:38.182197 read(14,  <unfinished ...>
[pid 25557] 10:12:38.182236 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.182258 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.182307 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25557] 10:12:38.182333 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.182485 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.182566 read(14,  <unfinished ...>
[pid 25557] 10:12:38.182605 <... stat resumed> 0x7ffc5db6bf40) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.182627 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.182678 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25557] 10:12:38.182795 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.182945 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.183050 read(14,  <unfinished ...>
[pid 25557] 10:12:38.183090 <... stat resumed> 0x7ffc5db6bfe0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.183112 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter",  <unfinished ...>
[pid 25566] 10:12:38.183169 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25557] 10:12:38.183196 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.183338 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.183380 read(14,  <unfinished ...>
[pid 25557] 10:12:38.183416 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25544] 10:12:38.183459 stat("/etc/valiases/finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.183514 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25557] 10:12:38.183540 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.183686 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.183863 read(14,  <unfinished ...>
[pid 25557] 10:12:38.183902 <... open resumed> ) = 14
[pid 25544] 10:12:38.183922 open("/etc/valiases/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.183979 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25557] 10:12:38.184005 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:38.184062 <... open resumed> ) = 10
[pid 25566] 10:12:38.184094 read(14,  <unfinished ...>
[pid 25557] 10:12:38.184128 <... ioctl resumed> , 0x7ffc5db6bd30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.184150 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.184202 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25557] 10:12:38.184228 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.184371 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.184428 read(14,  <unfinished ...>
[pid 25557] 10:12:38.184464 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.184484 fstat(10,  <unfinished ...>
[pid 25566] 10:12:38.184557 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25557] 10:12:38.184585 read(14,  <unfinished ...>
[pid 25544] 10:12:38.184843 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.184899 read(14,  <unfinished ...>
[pid 25557] 10:12:38.185053 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25544] 10:12:38.185083 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.185852 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25559] 10:12:38.185892 read(11,  <unfinished ...>
[pid 25557] 10:12:38.185945 lseek(14, 2366, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.185986 <... mmap resumed> ) = 0x7fa692c1e000
[pid 25566] 10:12:38.186026 read(14,  <unfinished ...>
[pid 25557] 10:12:38.186071 <... lseek resumed> ) = 2366
[pid 25544] 10:12:38.186104 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.186163 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25559] 10:12:38.186198 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25557] 10:12:38.186331 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.186637 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.186683 read(14,  <unfinished ...>
[pid 25557] 10:12:38.186805 <... lseek resumed> ) = 2366
[pid 25544] 10:12:38.186828 read(10,  <unfinished ...>
[pid 25566] 10:12:38.186880 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25557] 10:12:38.186910 close(14 <unfinished ...>
[pid 25544] 10:12:38.186975 <... read resumed> "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25566] 10:12:38.187022 read(14,  <unfinished ...>
[pid 25557] 10:12:38.187056 <... close resumed> ) = 0
[pid 25544] 10:12:38.187076 read(10,  <unfinished ...>
[pid 25566] 10:12:38.187625 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25557] 10:12:38.187878 read(13,  <unfinished ...>
[pid 25544] 10:12:38.187924 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.187988 read(14,  <unfinished ...>
[pid 25557] 10:12:38.188027 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:38.188178 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.188247 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25559] 10:12:38.188275 brk(0xb44000 <unfinished ...>
[pid 25557] 10:12:38.188420 close(13 <unfinished ...>
[pid 25544] 10:12:38.188457 <... open resumed> ) = 11
[pid 25566] 10:12:38.188494 read(14,  <unfinished ...>
[pid 25557] 10:12:38.188529 <... close resumed> ) = 0
[pid 25544] 10:12:38.188548 fstat(11,  <unfinished ...>
[pid 25566] 10:12:38.188923 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25557] 10:12:38.188955 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.189112 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25566] 10:12:38.189170 read(14,  <unfinished ...>
[pid 25559] 10:12:38.189204 <... brk resumed> ) = 0xb44000
[pid 25557] 10:12:38.189224 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.189766 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.189836 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25557] 10:12:38.189866 read(12,  <unfinished ...>
[pid 25544] 10:12:38.190032 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25566] 10:12:38.190066 read(14,  <unfinished ...>
[pid 25557] 10:12:38.190100 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.190120 read(11,  <unfinished ...>
[pid 25566] 10:12:38.190204 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25557] 10:12:38.190232 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.190392 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25566] 10:12:38.190458 read(14,  <unfinished ...>
[pid 25557] 10:12:38.190496 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25544] 10:12:38.190538 close(11 <unfinished ...>
[pid 25566] 10:12:38.190601 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25557] 10:12:38.190629 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.190881 <... close resumed> ) = 0
[pid 25566] 10:12:38.190915 read(14,  <unfinished ...>
[pid 25557] 10:12:38.190950 <... open resumed> ) = 13
[pid 25544] 10:12:38.190969 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25566] 10:12:38.191023 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25557] 10:12:38.191051 fstat(13,  <unfinished ...>
[pid 25544] 10:12:38.191181 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.191239 read(14,  <unfinished ...>
[pid 25557] 10:12:38.191278 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25544] 10:12:38.191319 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.191372 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25557] 10:12:38.191398 fstat(13,  <unfinished ...>
[pid 25544] 10:12:38.191523 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.191602 read(14,  <unfinished ...>
[pid 25557] 10:12:38.191641 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25544] 10:12:38.191679 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25566] 10:12:38.192013 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25557] 10:12:38.192052 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.192188 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25566] 10:12:38.192264 read(14,  <unfinished ...>
[pid 25557] 10:12:38.192301 <... mmap resumed> ) = 0x7fc7a8f3c000
[pid 25544] 10:12:38.192322 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.192378 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25557] 10:12:38.192412 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.192545 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.192643 read(14,  <unfinished ...>
[pid 25557] 10:12:38.192682 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.192787 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.193105 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25557] 10:12:38.193144 read(13,  <unfinished ...>
[pid 25544] 10:12:38.193248 <... open resumed> ) = 11
[pid 25566] 10:12:38.193284 brk(0x246a000 <unfinished ...>
[pid 25559] 10:12:38.193319 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.193351 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.193371 fstat(11,  <unfinished ...>
[pid 25566] 10:12:38.193426 <... brk resumed> ) = 0x246a000
[pid 25557] 10:12:38.193446 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.193541 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.193599 read(14,  <unfinished ...>
[pid 25557] 10:12:38.193633 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25544] 10:12:38.193671 fstat(11,  <unfinished ...>
[pid 25566] 10:12:38.193827 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25557] 10:12:38.193858 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.194011 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.194065 read(14,  <unfinished ...>
[pid 25557] 10:12:38.194099 <... open resumed> ) = 14
[pid 25544] 10:12:38.194119 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.194180 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25557] 10:12:38.194206 fstat(14,  <unfinished ...>
[pid 25544] 10:12:38.194256 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25566] 10:12:38.194290 read(14,  <unfinished ...>
[pid 25559] 10:12:38.194324 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.194351 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:38.194409 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.194465 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25559] 10:12:38.194491 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.194625 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.194662 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.194778 read(14,  <unfinished ...>
[pid 25559] 10:12:38.194820 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.194842 <... mmap resumed> ) = 0x7fc7a8f3b000
[pid 25544] 10:12:38.194869 read(11,  <unfinished ...>
[pid 25566] 10:12:38.194921 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25559] 10:12:38.194948 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.195082 read(14,  <unfinished ...>
[pid 25544] 10:12:38.195119 <... read resumed> "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25566] 10:12:38.195192 read(14,  <unfinished ...>
[pid 25559] 10:12:38.195230 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.195252 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:38.195281 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.195340 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25559] 10:12:38.195366 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.195492 close(14 <unfinished ...>
[pid 25544] 10:12:38.195528 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.195593 read(14,  <unfinished ...>
[pid 25559] 10:12:38.195629 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.195651 <... close resumed> ) = 0
[pid 25544] 10:12:38.195678 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25566] 10:12:38.195821 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25559] 10:12:38.195849 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.195973 munmap(0x7fc7a8f3b000, 4096 <unfinished ...>
[pid 25544] 10:12:38.196012 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25566] 10:12:38.196092 read(14,  <unfinished ...>
[pid 25559] 10:12:38.196129 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.196151 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.196172 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.196247 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25559] 10:12:38.196273 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.196419 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.196468 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.196564 read(14,  <unfinished ...>
[pid 25559] 10:12:38.196603 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.196625 <... open resumed> ) = 14
[pid 25544] 10:12:38.196652 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable",  <unfinished ...>
[pid 25566] 10:12:38.196795 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25559] 10:12:38.196824 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.196971 fstat(14,  <unfinished ...>
[pid 25544] 10:12:38.197005 <... stat resumed> 0x7ffc5380a2d0) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.197320 read(14,  <unfinished ...>
[pid 25559] 10:12:38.197360 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.197385 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25544] 10:12:38.197430 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.197485 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25559] 10:12:38.197514 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.197611 fstat(14,  <unfinished ...>
[pid 25544] 10:12:38.197635 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.197689 read(14,  <unfinished ...>
[pid 25559] 10:12:38.197793 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.197811 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25544] 10:12:38.197844 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.197882 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25559] 10:12:38.197907 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.197949 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.197976 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.198044 read(14,  <unfinished ...>
[pid 25559] 10:12:38.198073 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.198089 <... mmap resumed> ) = 0x7fc7a8f3b000
[pid 25544] 10:12:38.198104 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.198139 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25559] 10:12:38.198156 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.198267 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.198292 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.198346 read(14,  <unfinished ...>
[pid 25559] 10:12:38.198384 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.198399 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.198418 stat("/home/finest09/.spamassassinboxenable",  <unfinished ...>
[pid 25566] 10:12:38.198456 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25559] 10:12:38.198474 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.198562 read(14,  <unfinished ...>
[pid 25544] 10:12:38.198589 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25566] 10:12:38.198638 read(14,  <unfinished ...>
[pid 25559] 10:12:38.198664 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.198679 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25544] 10:12:38.198802 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.198860 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25559] 10:12:38.198878 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.198976 read(14,  <unfinished ...>
[pid 25544] 10:12:38.199006 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.199060 read(14,  <unfinished ...>
[pid 25559] 10:12:38.199087 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.199102 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.199122 lseek(11, 2781, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.199167 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25559] 10:12:38.199186 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25557] 10:12:38.199278 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.199308 <... lseek resumed> ) = 2781
[pid 25566] 10:12:38.199352 read(14,  <unfinished ...>
[pid 25559] 10:12:38.199380 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.199395 <... open resumed> ) = 15
[pid 25544] 10:12:38.199410 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.199446 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25559] 10:12:38.199464 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25557] 10:12:38.199564 fstat(15,  <unfinished ...>
[pid 25544] 10:12:38.199588 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.199632 read(14,  <unfinished ...>
[pid 25559] 10:12:38.199658 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25557] 10:12:38.199685 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.199796 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25566] 10:12:38.199834 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25559] 10:12:38.199852 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.199958 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.199986 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25566] 10:12:38.200035 read(14,  <unfinished ...>
[pid 25559] 10:12:38.200061 <... open resumed> ) = 12
[pid 25557] 10:12:38.200074 <... mmap resumed> ) = 0x7fc7a8f3a000
[pid 25544] 10:12:38.200093 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.200137 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25559] 10:12:38.200156 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:38.200190 read(15,  <unfinished ...>
[pid 25544] 10:12:38.200216 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.200274 read(14,  <unfinished ...>
[pid 25559] 10:12:38.200301 <... ioctl resumed> , 0x7fffca4adf00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:38.200319 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:38.200339 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable",  <unfinished ...>
[pid 25566] 10:12:38.200403 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25559] 10:12:38.200421 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:38.200520 close(15 <unfinished ...>
[pid 25544] 10:12:38.200546 <... stat resumed> 0x7ffc5380a2d0) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.200578 read(14,  <unfinished ...>
[pid 25559] 10:12:38.200603 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.200617 <... close resumed> ) = 0
[pid 25544] 10:12:38.200659 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.200775 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25559] 10:12:38.200799 read(12,  <unfinished ...>
[pid 25557] 10:12:38.200835 munmap(0x7fc7a8f3a000, 4096 <unfinished ...>
[pid 25544] 10:12:38.200863 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.200916 read(14,  <unfinished ...>
[pid 25559] 10:12:38.200942 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25557] 10:12:38.200960 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.201179 stat("/home/finest09/etc/finestweddingsites.com/passwd",  <unfinished ...>
[pid 25566] 10:12:38.201239 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25559] 10:12:38.201259 lseek(12, 878, SEEK_SET <unfinished ...>
[pid 25557] 10:12:38.201346 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.201377 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25566] 10:12:38.201452 read(14,  <unfinished ...>
[pid 25559] 10:12:38.201482 <... lseek resumed> ) = 878
[pid 25557] 10:12:38.201496 <... open resumed> ) = 15
[pid 25544] 10:12:38.201511 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.201551 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25559] 10:12:38.201569 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:38.201604 fstat(15,  <unfinished ...>
[pid 25544] 10:12:38.201627 <... open resumed> ) = 12
[pid 25566] 10:12:38.201650 read(14,  <unfinished ...>
[pid 25559] 10:12:38.201673 <... lseek resumed> ) = 878
[pid 25557] 10:12:38.201687 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25544] 10:12:38.201803 fstat(12,  <unfinished ...>
[pid 25566] 10:12:38.201839 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25559] 10:12:38.201858 close(12 <unfinished ...>
[pid 25557] 10:12:38.201945 fstat(15,  <unfinished ...>
[pid 25544] 10:12:38.201968 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.202007 read(14,  <unfinished ...>
[pid 25559] 10:12:38.202031 <... close resumed> ) = 0
[pid 25557] 10:12:38.202045 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25544] 10:12:38.202313 fstat(12,  <unfinished ...>
[pid 25566] 10:12:38.202363 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25559] 10:12:38.202391 read(11,  <unfinished ...>
[pid 25557] 10:12:38.202502 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.202531 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.202569 read(14,  <unfinished ...>
[pid 25559] 10:12:38.202593 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25557] 10:12:38.202612 <... mmap resumed> ) = 0x7fc7a8f3a000
[pid 25544] 10:12:38.203193 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.203245 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25559] 10:12:38.203273 brk(0xb65000 <unfinished ...>
[pid 25557] 10:12:38.203314 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.203338 <... mmap resumed> ) = 0x7fa692c1c000
[pid 25566] 10:12:38.203361 read(14,  <unfinished ...>
[pid 25559] 10:12:38.203385 <... brk resumed> ) = 0xb65000
[pid 25557] 10:12:38.203398 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.203516 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.203557 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25559] 10:12:38.203577 read(11,  <unfinished ...>
[pid 25557] 10:12:38.203786 read(15,  <unfinished ...>
[pid 25544] 10:12:38.203825 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.203863 read(14,  <unfinished ...>
[pid 25559] 10:12:38.203901 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25557] 10:12:38.203929 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.204764 read(12,  <unfinished ...>
[pid 25566] 10:12:38.204849 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25557] 10:12:38.204878 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.205034 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25566] 10:12:38.205092 read(14,  <unfinished ...>
[pid 25557] 10:12:38.205797 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.205849 stat("/jail_owner",  <unfinished ...>
[pid 25566] 10:12:38.205922 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25557] 10:12:38.205951 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.206121 <... stat resumed> 0x7ffc5380b880) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.206165 read(14,  <unfinished ...>
[pid 25557] 10:12:38.206203 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.206263 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25566] 10:12:38.206323 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25557] 10:12:38.206351 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.206409 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25566] 10:12:38.206481 brk(0x248b000 <unfinished ...>
[pid 25557] 10:12:38.206520 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.206576 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25566] 10:12:38.206631 <... brk resumed> ) = 0x248b000
[pid 25557] 10:12:38.206651 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.206913 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.206961 read(14,  <unfinished ...>
[pid 25557] 10:12:38.206999 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.207064 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25566] 10:12:38.207120 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25557] 10:12:38.207148 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:38.207209 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25566] 10:12:38.207270 read(14,  <unfinished ...>
[pid 25557] 10:12:38.207306 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.207379 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25566] 10:12:38.207433 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25557] 10:12:38.207461 write(8, "2015-12-30 10:12:38 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101 <unfinished ...>
[pid 25544] 10:12:38.207604 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.207646 read(14,  <unfinished ...>
[pid 25557] 10:12:38.207682 <... write resumed> ) = 101
[pid 25544] 10:12:38.207797 stat("/etc/demouids",  <unfinished ...>
[pid 25566] 10:12:38.207848 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25557] 10:12:38.207875 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:38.208031 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.208101 read(14,  <unfinished ...>
[pid 25557] 10:12:38.208139 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.208206 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.208263 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25557] 10:12:38.208547 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:38.208622 <... open resumed> ) = 13
[pid 25566] 10:12:38.208659 read(14,  <unfinished ...>
[pid 25559] 10:12:38.208778 brk(0xb86000 <unfinished ...>
[pid 25557] 10:12:38.208817 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.208871 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.208916 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25557] 10:12:38.208943 close(7 <unfinished ...>
[pid 25544] 10:12:38.209151 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.209209 read(14,  <unfinished ...>
[pid 25557] 10:12:38.209247 <... close resumed> ) = 0
[pid 25544] 10:12:38.209276 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.209319 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25557] 10:12:38.209348 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25544] 10:12:38.209420 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.209475 read(14,  <unfinished ...>
[pid 25557] 10:12:38.209511 <... open resumed> ) = 7
[pid 25544] 10:12:38.209535 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.209589 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25559] 10:12:38.209616 <... brk resumed> ) = 0xb86000
[pid 25557] 10:12:38.209837 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.210050 <... mmap resumed> ) = 0x7fa692c1b000
[pid 25566] 10:12:38.210088 read(14,  <unfinished ...>
[pid 25559] 10:12:38.210121 read(11,  <unfinished ...>
[pid 25557] 10:12:38.210150 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.210172 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.210212 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25557] 10:12:38.210239 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.210377 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.210413 read(14,  <unfinished ...>
[pid 25557] 10:12:38.210450 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.210476 read(13,  <unfinished ...>
[pid 25566] 10:12:38.210526 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25557] 10:12:38.210555 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.210604 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.210651 read(14,  <unfinished ...>
[pid 25559] 10:12:38.210691 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25557] 10:12:38.210803 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388344, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.211534 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25566] 10:12:38.211587 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25557] 10:12:38.211607 write(7, "2015-12-30 10:12:38 [25557] 1aEJMb-0006dx-Iz ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110 <unfinished ...>
[pid 25544] 10:12:38.211769 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25566] 10:12:38.211851 read(14,  <unfinished ...>
[pid 25558] 10:12:38.211880 <... select resumed> ) = 1 (in [11], left {599, 918784})
[pid 25557] 10:12:38.211909 <... write resumed> ) = 110
[pid 25544] 10:12:38.211928 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.211963 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25558] 10:12:38.211981 read(11,  <unfinished ...>
[pid 25557] 10:12:38.212018 close(14 <unfinished ...>
[pid 25544] 10:12:38.212043 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.212086 read(14,  <unfinished ...>
[pid 25558] 10:12:38.212111 <... read resumed> "\27\3\1\0P", 5) = 5
[pid 25557] 10:12:38.212137 <... close resumed> ) = 0
[pid 25544] 10:12:38.212158 lseek(9, 353, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.212189 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25558] 10:12:38.212207 read(11,  <unfinished ...>
[pid 25557] 10:12:38.212294 munmap(0x7fc7a8f3b000, 4096 <unfinished ...>
[pid 25544] 10:12:38.212327 <... lseek resumed> ) = 353
[pid 25566] 10:12:38.212371 read(14,  <unfinished ...>
[pid 25558] 10:12:38.212398 <... read resumed> "\273\244\301\260\262#\326\221o\33#\346Sb\322\261K\332\241\247\247d\306\333\215-P\212\313\217@\276S\343uY\3109\363\331&%k\271\243\250N 8/\n\314ZG\32\267\22\240(\274+>\277\243\3<D#(\244\24\347\5\37\314\314]\27\251\237", 80) = 80
[pid 25557] 10:12:38.212443 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.212468 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.212506 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25558] 10:12:38.212525 write(9, "ltoms@rmrcc.com\n", 16 <unfinished ...>
[pid 25557] 10:12:38.212573 close(15 <unfinished ...>
[pid 25544] 10:12:38.212605 <... open resumed> ) = 14
[pid 25566] 10:12:38.212631 read(14,  <unfinished ...>
[pid 25558] 10:12:38.212656 <... write resumed> ) = 16
[pid 25557] 10:12:38.212673 <... close resumed> ) = 0
[pid 25544] 10:12:38.212688 fstat(14,  <unfinished ...>
[pid 25566] 10:12:38.212801 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25558] 10:12:38.212821 fsync(9 <unfinished ...>
[pid 25557] 10:12:38.212944 munmap(0x7fc7a8f3a000, 4096 <unfinished ...>
[pid 25544] 10:12:38.212973 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25566] 10:12:38.213009 read(14,  <unfinished ...>
[pid 25557] 10:12:38.213033 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.213051 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.213083 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25557] 10:12:38.213101 close(10 <unfinished ...>
[pid 25544] 10:12:38.213183 <... mmap resumed> ) = 0x7fa692c1a000
[pid 25566] 10:12:38.213207 read(14,  <unfinished ...>
[pid 25557] 10:12:38.213230 <... close resumed> ) = 0
[pid 25544] 10:12:38.213246 read(14,  <unfinished ...>
[pid 25566] 10:12:38.213278 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25557] 10:12:38.213296 munmap(0x7fc7a8f3f000, 4096 <unfinished ...>
[pid 25544] 10:12:38.213372 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25566] 10:12:38.213407 read(14,  <unfinished ...>
[pid 25557] 10:12:38.213433 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.213455 close(14 <unfinished ...>
[pid 25566] 10:12:38.213486 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25557] 10:12:38.213504 close(11 <unfinished ...>
[pid 25544] 10:12:38.213541 <... close resumed> ) = 0
[pid 25566] 10:12:38.213563 read(14,  <unfinished ...>
[pid 25557] 10:12:38.213591 <... close resumed> ) = 0
[pid 25544] 10:12:38.213607 munmap(0x7fa692c1a000, 4096 <unfinished ...>
[pid 25566] 10:12:38.213639 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25557] 10:12:38.213657 munmap(0x7fc7a8f3e000, 4096 <unfinished ...>
[pid 25544] 10:12:38.213839 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.213879 read(14,  <unfinished ...>
[pid 25557] 10:12:38.213905 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.213922 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.213955 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25557] 10:12:38.213973 close(9 <unfinished ...>
[pid 25544] 10:12:38.214050 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.214081 read(14,  <unfinished ...>
[pid 25557] 10:12:38.214106 <... close resumed> ) = 0
[pid 25544] 10:12:38.214122 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.214153 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25557] 10:12:38.214170 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.214750 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.214823 read(14,  <unfinished ...>
[pid 25557] 10:12:38.214854 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.214872 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.214908 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25557] 10:12:38.214926 close(13 <unfinished ...>
[pid 25544] 10:12:38.215017 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.215063 read(14,  <unfinished ...>
[pid 25557] 10:12:38.215089 <... close resumed> ) = 0
[pid 25544] 10:12:38.215105 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.215136 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25557] 10:12:38.215154 munmap(0x7fc7a8f3c000, 4096 <unfinished ...>
[pid 25544] 10:12:38.215239 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.215294 read(14,  <unfinished ...>
[pid 25557] 10:12:38.215325 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.215343 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.215375 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25557] 10:12:38.215399 close(12 <unfinished ...>
[pid 25544] 10:12:38.215485 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.215534 read(14,  <unfinished ...>
[pid 25557] 10:12:38.215560 <... close resumed> ) = 0
[pid 25544] 10:12:38.215577 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.215608 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25557] 10:12:38.215625 munmap(0x7fc7a8f3d000, 4096 <unfinished ...>
[pid 25544] 10:12:38.215791 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.215848 read(14,  <unfinished ...>
[pid 25557] 10:12:38.215875 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.215913 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.215947 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25557] 10:12:38.215966 geteuid( <unfinished ...>
[pid 25544] 10:12:38.216042 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.216100 read(14,  <unfinished ...>
[pid 25557] 10:12:38.216127 <... geteuid resumed> ) = 0
[pid 25544] 10:12:38.216143 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25566] 10:12:38.216175 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25557] 10:12:38.216193 getegid( <unfinished ...>
[pid 25544] 10:12:38.216224 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25566] 10:12:38.216252 read(14,  <unfinished ...>
[pid 25557] 10:12:38.216276 <... getegid resumed> ) = 12
[pid 25544] 10:12:38.216295 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.216329 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25557] 10:12:38.216346 setgid(12 <unfinished ...>
[pid 25544] 10:12:38.216432 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.216480 read(14,  <unfinished ...>
[pid 25557] 10:12:38.216506 <... setgid resumed> ) = 0
[pid 25544] 10:12:38.216522 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.216564 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25557] 10:12:38.216582 setuid(47 <unfinished ...>
[pid 25544] 10:12:38.216662 <... open resumed> ) = 14
[pid 25566] 10:12:38.216686 read(14,  <unfinished ...>
[pid 25557] 10:12:38.217062 <... setuid resumed> ) = 0
[pid 25544] 10:12:38.217088 fstat(14,  <unfinished ...>
[pid 25566] 10:12:38.217121 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25559] 10:12:38.217142 brk(0xba7000 <unfinished ...>
[pid 25557] 10:12:38.217176 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fc7a6b406a0},  <unfinished ...>
[pid 25544] 10:12:38.217207 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.217246 read(14,  <unfinished ...>
[pid 25557] 10:12:38.217271 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:38.217305 fstat(14,  <unfinished ...>
[pid 25566] 10:12:38.217335 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25557] 10:12:38.217353 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25544] 10:12:38.217440 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.217480 brk(0x24ac000 <unfinished ...>
[pid 25557] 10:12:38.217504 <... write resumed> ) = 36
[pid 25544] 10:12:38.217524 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.217557 <... brk resumed> ) = 0x24ac000
[pid 25557] 10:12:38.217572 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:38.217618 <... mmap resumed> ) = 0x7fa692c1a000
[pid 25566] 10:12:38.217641 read(14,  <unfinished ...>
[pid 25557] 10:12:38.217666 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.217776 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.217814 <... connect resumed> ) = 0
[pid 25566] 10:12:38.217833 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25557] 10:12:38.217851 stat("/etc/localtime",  <unfinished ...>
[pid 25544] 10:12:38.217891 <... lseek resumed> ) = 0
[pid 25572] 10:12:38.217914 alarm(0 <unfinished ...>
[pid 25566] 10:12:38.217938 read(14,  <unfinished ...>
[pid 25557] 10:12:38.217961 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.217992 read(14,  <unfinished ...>
[pid 25572] 10:12:38.218032 <... alarm resumed> ) = 300
[pid 25566] 10:12:38.218060 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25557] 10:12:38.218079 close(7 <unfinished ...>
[pid 25544] 10:12:38.218166 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.218209 getsockname(11,  <unfinished ...>
[pid 25566] 10:12:38.218235 read(14,  <unfinished ...>
[pid 25559] 10:12:38.218258 <... brk resumed> ) = 0xba7000
[pid 25557] 10:12:38.218272 <... close resumed> ) = 0
[pid 25544] 10:12:38.218532 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.218583 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(55994), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25566] 10:12:38.218617 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25559] 10:12:38.218637 read(11,  <unfinished ...>
[pid 25557] 10:12:38.218795 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25544] 10:12:38.218835 <... open resumed> ) = 15
[pid 25572] 10:12:38.218859 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25566] 10:12:38.218887 read(14,  <unfinished ...>
[pid 25557] 10:12:38.218911 <... open resumed> ) = 7
[pid 25544] 10:12:38.218927 fstat(15,  <unfinished ...>
[pid 25572] 10:12:38.218957 <... setsockopt resumed> ) = 0
[pid 25566] 10:12:38.218978 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25557] 10:12:38.218996 fcntl(7, F_GETFD <unfinished ...>
[pid 25544] 10:12:38.219088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25572] 10:12:38.219126 stat("/etc/mailhelo",  <unfinished ...>
[pid 25566] 10:12:38.219153 read(14,  <unfinished ...>
[pid 25557] 10:12:38.219176 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.219192 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.219225 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.219264 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25557] 10:12:38.219288 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.219381 <... mmap resumed> ) = 0x7fa692c19000
[pid 25572] 10:12:38.219407 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.219437 read(14,  <unfinished ...>
[pid 25559] 10:12:38.219463 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25557] 10:12:38.219481 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.219617 read(15,  <unfinished ...>
[pid 25572] 10:12:38.219665 <... open resumed> ) = 13
[pid 25566] 10:12:38.219683 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25557] 10:12:38.219798 fstat(7,  <unfinished ...>
[pid 25544] 10:12:38.219840 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25572] 10:12:38.219874 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.219898 read(14,  <unfinished ...>
[pid 25557] 10:12:38.219920 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388454, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.220030 close(15 <unfinished ...>
[pid 25573] 10:12:38.220070 <... connect resumed> ) = 0
[pid 25572] 10:12:38.220088 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.220135 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25557] 10:12:38.220156 write(7, "2015-12-30 10:12:38 [25557] 1aEJMb-0006dx-Iz Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25544] 10:12:38.220265 <... close resumed> ) = 0
[pid 25573] 10:12:38.220781 alarm(0 <unfinished ...>
[pid 25572] 10:12:38.220818 fstat(13,  <unfinished ...>
[pid 25566] 10:12:38.220842 read(14,  <unfinished ...>
[pid 25557] 10:12:38.220865 <... write resumed> ) = 77
[pid 25544] 10:12:38.220886 munmap(0x7fa692c19000, 4096 <unfinished ...>
[pid 25573] 10:12:38.220924 <... alarm resumed> ) = 300
[pid 25572] 10:12:38.220950 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.220983 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25557] 10:12:38.221001 open("/var/spool/exim/input/b/hdr.25557", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25544] 10:12:38.221085 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.221128 getsockname(11,  <unfinished ...>
[pid 25572] 10:12:38.221155 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.221183 read(14,  <unfinished ...>
[pid 25557] 10:12:38.221205 <... open resumed> ) = 9
[pid 25544] 10:12:38.221221 stat("/etc/userdomains",  <unfinished ...>
[pid 25573] 10:12:38.221256 <... getsockname resumed> {sa_family=AF_INET, sin_port=htons(55995), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25572] 10:12:38.221287 <... mmap resumed> ) = 0x7f33164f9000
[pid 25566] 10:12:38.221305 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25557] 10:12:38.221329 fchown(9, 47, 12 <unfinished ...>
[pid 25544] 10:12:38.221462 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25573] 10:12:38.221522 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
[pid 25572] 10:12:38.221553 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.221576 read(14,  <unfinished ...>
[pid 25557] 10:12:38.221599 <... fchown resumed> ) = 0
[pid 25544] 10:12:38.221615 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25573] 10:12:38.221651 <... setsockopt resumed> ) = 0
[pid 25572] 10:12:38.221673 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.221690 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25557] 10:12:38.221789 fchmod(9, 0640 <unfinished ...>
[pid 25544] 10:12:38.221830 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.221863 stat("/etc/mailhelo",  <unfinished ...>
[pid 25572] 10:12:38.221891 read(13,  <unfinished ...>
[pid 25566] 10:12:38.221914 read(14,  <unfinished ...>
[pid 25557] 10:12:38.221936 <... fchmod resumed> ) = 0
[pid 25544] 10:12:38.221952 stat("/etc/userdomains",  <unfinished ...>
[pid 25573] 10:12:38.221985 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.222024 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.222094 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25557] 10:12:38.222119 fcntl(9, F_GETFL <unfinished ...>
[pid 25544] 10:12:38.222217 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25573] 10:12:38.222265 open("/etc/mailhelo", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.222297 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.222320 read(14,  <unfinished ...>
[pid 25557] 10:12:38.222344 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25544] 10:12:38.222365 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25573] 10:12:38.222405 <... open resumed> ) = 13
[pid 25572] 10:12:38.222422 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.222439 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25557] 10:12:38.222769 fstat(9,  <unfinished ...>
[pid 25544] 10:12:38.222819 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25573] 10:12:38.222875 fstat(13,  <unfinished ...>
[pid 25572] 10:12:38.222901 read(13,  <unfinished ...>
[pid 25566] 10:12:38.222924 read(14,  <unfinished ...>
[pid 25557] 10:12:38.222947 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080196, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.222983 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25573] 10:12:38.223020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.223052 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.223073 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25557] 10:12:38.223090 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.223184 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.223218 fstat(13,  <unfinished ...>
[pid 25572] 10:12:38.223243 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.223266 read(14,  <unfinished ...>
[pid 25557] 10:12:38.223288 <... mmap resumed> ) = 0x7fc7a8f40000
[pid 25544] 10:12:38.223306 stat("/etc/userdomains",  <unfinished ...>
[pid 25573] 10:12:38.223339 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25572] 10:12:38.223385 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.223403 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25557] 10:12:38.223425 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.223472 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25573] 10:12:38.223525 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.223555 read(13,  <unfinished ...>
[pid 25566] 10:12:38.223579 read(14,  <unfinished ...>
[pid 25557] 10:12:38.223601 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.223774 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25573] 10:12:38.223821 <... mmap resumed> ) = 0x7f33164f9000
[pid 25572] 10:12:38.223838 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.223876 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25557] 10:12:38.223896 write(9, "1aEJMb-0006dx-Iz-H\nmailnull 47 12\n<>\n1451491957 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491958\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25544] 10:12:38.224001 <... stat resumed> 0x7ffc5380e670) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.224035 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25572] 10:12:38.224152 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25566] 10:12:38.224185 read(14,  <unfinished ...>
[pid 25557] 10:12:38.224210 <... write resumed> ) = 268
[pid 25544] 10:12:38.224312 stat("/etc/userdomains",  <unfinished ...>
[pid 25573] 10:12:38.224360 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.224378 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25559] 10:12:38.224396 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25557] 10:12:38.224492 fstat(9,  <unfinished ...>
[pid 25544] 10:12:38.224516 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25573] 10:12:38.224564 read(13,  <unfinished ...>
[pid 25566] 10:12:38.224590 read(14,  <unfinished ...>
[pid 25557] 10:12:38.224613 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080196, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.224658 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25573] 10:12:38.224757 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.224792 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25559] 10:12:38.224813 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.224839 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMb-0006dx-Iz\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:37 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692 <unfinished ...>
[pid 25544] 10:12:38.224873 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25573] 10:12:38.224973 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.225003 read(14,  <unfinished ...>
[pid 25559] 10:12:38.225026 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.225052 <... write resumed> ) = 692
[pid 25544] 10:12:38.225074 lseek(14, 0, SEEK_SET <unfinished ...>
[pid 25573] 10:12:38.225106 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.225122 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25559] 10:12:38.225140 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.225224 fsync(9 <unfinished ...>
[pid 25544] 10:12:38.225292 <... lseek resumed> ) = 0
[pid 25573] 10:12:38.225318 read(13,  <unfinished ...>
[pid 25566] 10:12:38.225344 read(14,  <unfinished ...>
[pid 25559] 10:12:38.225493 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25544] 10:12:38.225521 read(14,  <unfinished ...>
[pid 25573] 10:12:38.225550 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.225624 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25559] 10:12:38.225649 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.225682 <... read resumed> "", 4096) = 0
[pid 25573] 10:12:38.225825 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.225858 read(14,  <unfinished ...>
[pid 25559] 10:12:38.225881 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.225907 <... fsync resumed> ) = 0
[pid 25544] 10:12:38.225923 stat("/etc/vdomainaliases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25573] 10:12:38.225959 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.225976 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25559] 10:12:38.225993 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.226077 fstat(9,  <unfinished ...>
[pid 25544] 10:12:38.226110 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25573] 10:12:38.226160 read(13,  <unfinished ...>
[pid 25566] 10:12:38.226186 read(14,  <unfinished ...>
[pid 25559] 10:12:38.226208 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25557] 10:12:38.226234 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080196, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.226263 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.226301 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.226320 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25559] 10:12:38.226339 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.226415 close(9 <unfinished ...>
[pid 25544] 10:12:38.226450 <... open resumed> ) = 15
[pid 25573] 10:12:38.226478 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.226502 read(14,  <unfinished ...>
[pid 25559] 10:12:38.226524 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.226550 <... close resumed> ) = 0
[pid 25544] 10:12:38.226566 fstat(15,  <unfinished ...>
[pid 25573] 10:12:38.226597 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.226613 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25559] 10:12:38.226631 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.226793 munmap(0x7fc7a8f40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.226836 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25573] 10:12:38.226879 read(13,  <unfinished ...>
[pid 25566] 10:12:38.226903 read(14,  <unfinished ...>
[pid 25559] 10:12:38.226925 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25557] 10:12:38.226960 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.226983 fstat(15,  <unfinished ...>
[pid 25573] 10:12:38.227015 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.227050 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25559] 10:12:38.227076 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.227157 rename("/var/spool/exim/input/b/hdr.25557", "/var/spool/exim/input/b/1aEJMb-0006dx-Iz-H" <unfinished ...>
[pid 25544] 10:12:38.227249 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25573] 10:12:38.227289 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25566] 10:12:38.227319 read(14,  <unfinished ...>
[pid 25559] 10:12:38.227342 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.227371 <... rename resumed> ) = 0
[pid 25544] 10:12:38.227390 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.227424 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25559] 10:12:38.227442 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.227471 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25544] 10:12:38.227508 <... mmap resumed> ) = 0x7fa692c19000
[pid 25566] 10:12:38.227531 read(14,  <unfinished ...>
[pid 25559] 10:12:38.227554 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25557] 10:12:38.227583 <... open resumed> ) = 9
[pid 25544] 10:12:38.227599 lseek(15, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.227628 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25559] 10:12:38.227646 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.227805 fsync(9 <unfinished ...>
[pid 25544] 10:12:38.227839 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.227863 read(14,  <unfinished ...>
[pid 25559] 10:12:38.227887 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.227918 <... fsync resumed> ) = 0
[pid 25544] 10:12:38.227934 read(15,  <unfinished ...>
[pid 25566] 10:12:38.227964 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25559] 10:12:38.227982 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.228058 close(9 <unfinished ...>
[pid 25544] 10:12:38.228092 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.228124 read(14,  <unfinished ...>
[pid 25559] 10:12:38.228149 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25557] 10:12:38.228180 <... close resumed> ) = 0
[pid 25544] 10:12:38.228197 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25566] 10:12:38.228231 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25559] 10:12:38.228254 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25557] 10:12:38.228335 close(8 <unfinished ...>
[pid 25544] 10:12:38.228366 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25566] 10:12:38.228450 read(14,  <unfinished ...>
[pid 25559] 10:12:38.228481 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25557] 10:12:38.228512 <... close resumed> ) = 0
[pid 25544] 10:12:38.228529 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.228566 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25559] 10:12:38.228584 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25557] 10:12:38.228677 munmap(0x7fc7a8f41000, 4096 <unfinished ...>
[pid 25544] 10:12:38.228793 <... open resumed> ) = 16
[pid 25566] 10:12:38.228820 read(14,  <unfinished ...>
[pid 25559] 10:12:38.228844 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25557] 10:12:38.228877 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.228903 fstat(16,  <unfinished ...>
[pid 25566] 10:12:38.228934 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25559] 10:12:38.228952 <... open resumed> ) = 12
[pid 25557] 10:12:38.228977 unlink("/var/spool/exim/input/b/1aEJMb-0006dx-Iz-J" <unfinished ...>
[pid 25544] 10:12:38.229014 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25566] 10:12:38.229050 read(14,  <unfinished ...>
[pid 25559] 10:12:38.229073 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25557] 10:12:38.229099 <... unlink resumed> ) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.229116 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.229150 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25559] 10:12:38.229167 <... ioctl resumed> , 0x7fffca4adf00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25557] 10:12:38.229245 close(6 <unfinished ...>
[pid 25544] 10:12:38.229279 <... mmap resumed> ) = 0x7fa692c18000
[pid 25566] 10:12:38.229303 read(14,  <unfinished ...>
[pid 25559] 10:12:38.229325 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25557] 10:12:38.229348 <... close resumed> ) = 0
[pid 25544] 10:12:38.229497 read(16,  <unfinished ...>
[pid 25566] 10:12:38.229536 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25559] 10:12:38.229561 <... lseek resumed> ) = 0
[pid 25557] 10:12:38.229598 exit_group(0) = ?
[pid 25544] 10:12:38.230249 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25566] 10:12:38.230354 brk(0x24cd000 <unfinished ...>
[pid 25559] 10:12:38.230392 read(12,  <unfinished ...>
[pid 25557] 10:12:38.230418 +++ exited with 0 +++
[pid 25544] 10:12:38.230434 close(16 <unfinished ...>
[pid 25566] 10:12:38.230473 <... brk resumed> ) = 0x24cd000
[pid 25559] 10:12:38.230487 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25544] 10:12:38.230554 <... close resumed> ) = 0
[pid 25566] 10:12:38.230676 read(14,  <unfinished ...>
[pid 25559] 10:12:38.230761 brk(0xbc8000 <unfinished ...>
[pid 25544] 10:12:38.230788 munmap(0x7fa692c18000, 4096 <unfinished ...>
[pid 25566] 10:12:38.230821 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25559] 10:12:38.230841 <... brk resumed> ) = 0xbc8000
[pid 25544] 10:12:38.230911 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.231456 read(14,  <unfinished ...>
[pid 25559] 10:12:38.231495 lseek(12, 4868, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.231519 open("/etc/aliases", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.231556 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25559] 10:12:38.231575 <... lseek resumed> ) = 4868
[pid 25544] 10:12:38.231599 <... open resumed> ) = 16
[pid 25566] 10:12:38.231624 read(14,  <unfinished ...>
[pid 25559] 10:12:38.231647 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.231670 fstat(16,  <unfinished ...>
[pid 25566] 10:12:38.231763 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25559] 10:12:38.231787 <... lseek resumed> ) = 4868
[pid 25544] 10:12:38.231858 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25566] 10:12:38.231905 read(14,  <unfinished ...>
[pid 25559] 10:12:38.231932 close(12 <unfinished ...>
[pid 25544] 10:12:38.231956 fstat(16,  <unfinished ...>
[pid 25566] 10:12:38.231984 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25559] 10:12:38.232002 <... close resumed> ) = 0
[pid 25544] 10:12:38.232068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25566] 10:12:38.232123 read(14,  <unfinished ...>
[pid 25559] 10:12:38.232156 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.232184 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.232216 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25559] 10:12:38.232234 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.232275 <... mmap resumed> ) = 0x7fa692c18000
[pid 25566] 10:12:38.232304 read(14,  <unfinished ...>
[pid 25559] 10:12:38.232327 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.232362 lseek(16, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.232400 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25559] 10:12:38.232420 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.232570 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.232602 read(14,  <unfinished ...>
[pid 25559] 10:12:38.232627 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.232653 read(16,  <unfinished ...>
[pid 25566] 10:12:38.232684 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25559] 10:12:38.232781 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.232810 <... read resumed> "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25566] 10:12:38.232853 read(14,  <unfinished ...>
[pid 25559] 10:12:38.232877 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.232901 read(16,  <unfinished ...>
[pid 25566] 10:12:38.232929 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25559] 10:12:38.232946 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.233029 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.233076 read(14,  <unfinished ...>
[pid 25559] 10:12:38.233103 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.233130 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.233165 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25559] 10:12:38.233183 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.233267 <... open resumed> ) = 17
[pid 25566] 10:12:38.233294 read(14,  <unfinished ...>
[pid 25559] 10:12:38.233318 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.233344 fstat(17,  <unfinished ...>
[pid 25566] 10:12:38.233371 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25559] 10:12:38.233395 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.233484 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25566] 10:12:38.233530 read(14,  <unfinished ...>
[pid 25559] 10:12:38.233554 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.233586 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.233619 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25559] 10:12:38.233636 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.233806 <... mmap resumed> ) = 0x7fa692c17000
[pid 25566] 10:12:38.233838 read(14,  <unfinished ...>
[pid 25559] 10:12:38.233862 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.233892 read(17,  <unfinished ...>
[pid 25566] 10:12:38.233924 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25559] 10:12:38.233942 <... stat resumed> 0x7fffca4ae110) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.233970 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25566] 10:12:38.234013 read(14,  <unfinished ...>
[pid 25559] 10:12:38.234037 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25544] 10:12:38.234065 close(17 <unfinished ...>
[pid 25566] 10:12:38.234095 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25559] 10:12:38.234112 <... stat resumed> 0x7fffca4ae1b0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.234199 <... close resumed> ) = 0
[pid 25566] 10:12:38.234226 read(14,  <unfinished ...>
[pid 25559] 10:12:38.234249 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25544] 10:12:38.234279 munmap(0x7fa692c17000, 4096 <unfinished ...>
[pid 25566] 10:12:38.234313 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25559] 10:12:38.234332 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25544] 10:12:38.234440 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.234487 read(14,  <unfinished ...>
[pid 25559] 10:12:38.234521 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.234565 open("/etc/localaliases", O_RDONLY <unfinished ...>
[pid 25566] 10:12:38.234600 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25559] 10:12:38.234617 <... open resumed> ) = 12
[pid 25544] 10:12:38.234776 <... open resumed> ) = 17
[pid 25566] 10:12:38.234807 read(14,  <unfinished ...>
[pid 25559] 10:12:38.234831 ioctl(12, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:38.234857 fstat(17,  <unfinished ...>
[pid 25566] 10:12:38.234884 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25559] 10:12:38.234903 <... ioctl resumed> , 0x7fffca4adf00) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.234987 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25566] 10:12:38.235032 read(14,  <unfinished ...>
[pid 25559] 10:12:38.235056 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.235078 fstat(17,  <unfinished ...>
[pid 25566] 10:12:38.235106 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25559] 10:12:38.235123 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.235193 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25566] 10:12:38.235249 read(14,  <unfinished ...>
[pid 25559] 10:12:38.235275 read(12,  <unfinished ...>
[pid 25544] 10:12:38.235299 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25566] 10:12:38.235331 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25559] 10:12:38.235349 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25544] 10:12:38.235432 <... mmap resumed> ) = 0x7fa692c17000
[pid 25566] 10:12:38.235966 read(14,  <unfinished ...>
[pid 25559] 10:12:38.236003 lseek(12, 2366, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.236028 lseek(17, 0, SEEK_SET <unfinished ...>
[pid 25566] 10:12:38.236056 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25559] 10:12:38.236076 <... lseek resumed> ) = 2366
[pid 25544] 10:12:38.236099 <... lseek resumed> ) = 0
[pid 25566] 10:12:38.236123 read(14,  <unfinished ...>
[pid 25559] 10:12:38.236153 lseek(12, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.236175 read(17,  <unfinished ...>
[pid 25566] 10:12:38.236202 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25559] 10:12:38.236220 <... lseek resumed> ) = 2366
[pid 25544] 10:12:38.236295 <... read resumed> "", 4096) = 0
[pid 25566] 10:12:38.236387 read(14,  <unfinished ...>
[pid 25559] 10:12:38.236421 close(12 <unfinished ...>
[pid 25544] 10:12:38.236451 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.236489 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25559] 10:12:38.236507 <... close resumed> ) = 0
[pid 25544] 10:12:38.236532 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.236956 read(14,  <unfinished ...>
[pid 25559] 10:12:38.236991 read(11,  <unfinished ...>
[pid 25544] 10:12:38.237016 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.237049 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25559] 10:12:38.237067 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:38.237145 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.237200 read(14,  <unfinished ...>
[pid 25559] 10:12:38.237227 close(11 <unfinished ...>
[pid 25544] 10:12:38.237251 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.237282 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25559] 10:12:38.237300 <... close resumed> ) = 0
[pid 25544] 10:12:38.237389 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.237646 read(14,  <unfinished ...>
[pid 25559] 10:12:38.237678 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.237773 stat("/etc/userdomains",  <unfinished ...>
[pid 25566] 10:12:38.237807 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25559] 10:12:38.237826 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.237909 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25566] 10:12:38.237975 read(14,  <unfinished ...>
[pid 25559] 10:12:38.238003 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.238031 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.238062 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25559] 10:12:38.238080 <... open resumed> ) = 11
[pid 25544] 10:12:38.238108 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.238170 read(14,  <unfinished ...>
[pid 25559] 10:12:38.238197 fstat(11,  <unfinished ...>
[pid 25544] 10:12:38.238219 write(8, "2015-12-30 10:12:38 routing failed for finest09@fin.finestweddingsites.com <embassy-airport@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 177 <unfinished ...>
[pid 25566] 10:12:38.238257 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25559] 10:12:38.238275 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.238358 <... write resumed> ) = 177
[pid 25566] 10:12:38.238391 read(14,  <unfinished ...>
[pid 25559] 10:12:38.238415 fstat(11,  <unfinished ...>
[pid 25544] 10:12:38.238437 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.238468 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25559] 10:12:38.238485 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.238540 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.238589 brk(0x24ee000 <unfinished ...>
[pid 25559] 10:12:38.238616 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.238645 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.238676 <... brk resumed> ) = 0x24ee000
[pid 25559] 10:12:38.238690 <... mmap resumed> ) = 0x7ff9b2d3f000
[pid 25544] 10:12:38.238879 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.238923 read(14,  <unfinished ...>
[pid 25559] 10:12:38.238948 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.238971 close(7 <unfinished ...>
[pid 25566] 10:12:38.239001 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25559] 10:12:38.239026 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.239098 <... close resumed> ) = 0
[pid 25566] 10:12:38.239128 read(14,  <unfinished ...>
[pid 25559] 10:12:38.239152 read(11,  <unfinished ...>
[pid 25544] 10:12:38.239178 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25566] 10:12:38.239221 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25559] 10:12:38.239239 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25544] 10:12:38.239325 <... open resumed> ) = 7
[pid 25566] 10:12:38.239377 read(14,  <unfinished ...>
[pid 25559] 10:12:38.239405 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.239434 fcntl(7, F_GETFD <unfinished ...>
[pid 25566] 10:12:38.239462 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25559] 10:12:38.239480 <... open resumed> ) = 12
[pid 25544] 10:12:38.239569 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.239599 read(14,  <unfinished ...>
[pid 25559] 10:12:38.239626 fstat(12,  <unfinished ...>
[pid 25544] 10:12:38.239649 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.239677 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25559] 10:12:38.239853 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25544] 10:12:38.239888 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.239912 read(14,  <unfinished ...>
[pid 25559] 10:12:38.239935 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.239961 fstat(7,  <unfinished ...>
[pid 25566] 10:12:38.239989 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25559] 10:12:38.240007 <... mmap resumed> ) = 0x7ff9b2d3e000
[pid 25544] 10:12:38.240073 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388531, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25566] 10:12:38.240113 read(14,  <unfinished ...>
[pid 25559] 10:12:38.240137 read(12,  <unfinished ...>
[pid 25544] 10:12:38.240162 write(7, "2015-12-30 10:12:38 [25544] 1aEJMb-0006dm-9U ** finest09@fin.finestweddingsites.com <embassy-airport@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 186 <unfinished ...>
[pid 25566] 10:12:38.240200 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25559] 10:12:38.240223 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25544] 10:12:38.240311 <... write resumed> ) = 186
[pid 25566] 10:12:38.240352 read(14,  <unfinished ...>
[pid 25559] 10:12:38.240376 close(12 <unfinished ...>
[pid 25544] 10:12:38.240400 close(16 <unfinished ...>
[pid 25566] 10:12:38.240429 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25559] 10:12:38.240447 <... close resumed> ) = 0
[pid 25544] 10:12:38.240528 <... close resumed> ) = 0
[pid 25566] 10:12:38.240554 read(14,  <unfinished ...>
[pid 25559] 10:12:38.240578 munmap(0x7ff9b2d3e000, 4096 <unfinished ...>
[pid 25544] 10:12:38.240606 munmap(0x7fa692c18000, 4096 <unfinished ...>
[pid 25566] 10:12:38.240641 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25559] 10:12:38.240660 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.240851 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.240905 read(14,  <unfinished ...>
[pid 25559] 10:12:38.240932 stat("/home/finest09/etc/finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.240964 close(17 <unfinished ...>
[pid 25566] 10:12:38.240994 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25559] 10:12:38.241014 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.241167 <... close resumed> ) = 0
[pid 25566] 10:12:38.241204 read(14,  <unfinished ...>
[pid 25559] 10:12:38.241229 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25544] 10:12:38.241257 munmap(0x7fa692c17000, 4096 <unfinished ...>
[pid 25566] 10:12:38.241289 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25559] 10:12:38.241307 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.241402 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.241439 read(14,  <unfinished ...>
[pid 25559] 10:12:38.241465 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.241495 close(13 <unfinished ...>
[pid 25566] 10:12:38.241528 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25559] 10:12:38.241552 <... open resumed> ) = 12
[pid 25544] 10:12:38.241630 <... close resumed> ) = 0
[pid 25566] 10:12:38.241657 read(14,  <unfinished ...>
[pid 25559] 10:12:38.241681 fstat(12,  <unfinished ...>
[pid 25544] 10:12:38.241772 munmap(0x7fa692c1b000, 4096 <unfinished ...>
[pid 25566] 10:12:38.241808 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25559] 10:12:38.241827 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.241962 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.241995 read(14,  <unfinished ...>
[pid 25559] 10:12:38.242020 fstat(12,  <unfinished ...>
[pid 25544] 10:12:38.242042 close(14 <unfinished ...>
[pid 25566] 10:12:38.242072 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25559] 10:12:38.242090 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25544] 10:12:38.242227 <... close resumed> ) = 0
[pid 25566] 10:12:38.242251 read(14,  <unfinished ...>
[pid 25559] 10:12:38.242274 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.242300 munmap(0x7fa692c1a000, 4096 <unfinished ...>
[pid 25566] 10:12:38.242344 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25559] 10:12:38.242364 <... mmap resumed> ) = 0x7ff9b2d3e000
[pid 25544] 10:12:38.242435 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.242464 read(14,  <unfinished ...>
[pid 25559] 10:12:38.242486 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.242508 close(9 <unfinished ...>
[pid 25566] 10:12:38.242537 <... read resumed> "", 4096) = 0
[pid 25559] 10:12:38.242551 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.242579 <... close resumed> ) = 0
[pid 25566] 10:12:38.242604 close(14 <unfinished ...>
[pid 25559] 10:12:38.242627 read(12,  <unfinished ...>
[pid 25544] 10:12:38.242652 munmap(0x7fa692c1f000, 4096 <unfinished ...>
[pid 25566] 10:12:38.242685 <... close resumed> ) = 0
[pid 25559] 10:12:38.242760 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25544] 10:12:38.242785 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.242821 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25559] 10:12:38.242856 read(12,  <unfinished ...>
[pid 25544] 10:12:38.242879 close(12 <unfinished ...>
[pid 25566] 10:12:38.242908 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.242921 <... read resumed> "", 4096) = 0
[pid 25544] 10:12:38.243689 <... close resumed> ) = 0
[pid 25566] 10:12:38.243817 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.243860 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize",  <unfinished ...>
[pid 25544] 10:12:38.243893 munmap(0x7fa692c1c000, 4096 <unfinished ...>
[pid 25566] 10:12:38.243934 <... open resumed> ) = 14
[pid 25559] 10:12:38.243948 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2985, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.243978 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.244029 fstat(14,  <unfinished ...>
[pid 25559] 10:12:38.244054 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDONLY <unfinished ...>
[pid 25544] 10:12:38.244084 close(15 <unfinished ...>
[pid 25566] 10:12:38.244114 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.244141 <... open resumed> ) = 13
[pid 25544] 10:12:38.244156 <... close resumed> ) = 0
[pid 25566] 10:12:38.244181 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25559] 10:12:38.244207 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25544] 10:12:38.244233 munmap(0x7fa692c19000, 4096 <unfinished ...>
[pid 25566] 10:12:38.244262 <... mmap resumed> ) = 0x7f21d336b000
[pid 25559] 10:12:38.244276 <... ioctl resumed> , 0x7fffca4b0ff0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25544] 10:12:38.244294 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.244319 read(14,  <unfinished ...>
[pid 25559] 10:12:38.244376 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25544] 10:12:38.244400 close(11 <unfinished ...>
[pid 25566] 10:12:38.244429 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          235688 kB\nCached:           337016 kB\nBuffers:               0 kB\nActive:           313216 kB\nInactive:         467952 kB\nActive(anon):     174352 kB\nInactive(anon):   277604 kB\nActive(file):     138864 kB\nInac"..., 1024) = 588
[pid 25559] 10:12:38.244447 <... lseek resumed> ) = 0
[pid 25544] 10:12:38.244473 <... close resumed> ) = 0
[pid 25566] 10:12:38.244500 close(14 <unfinished ...>
[pid 25559] 10:12:38.244527 fstat(13,  <unfinished ...>
[pid 25544] 10:12:38.244550 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25566] 10:12:38.244582 <... close resumed> ) = 0
[pid 25559] 10:12:38.244608 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121922736, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2985, st_atime=2015/12/28-14:31:13, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.244635 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.244662 munmap(0x7f21d336b000, 4096 <unfinished ...>
[pid 25559] 10:12:38.244774 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.244804 close(10 <unfinished ...>
[pid 25566] 10:12:38.244835 <... munmap resumed> ) = 0
[pid 25559] 10:12:38.244848 <... fcntl resumed> ) = 0
[pid 25544] 10:12:38.245537 <... close resumed> ) = 0
[pid 25566] 10:12:38.245626 alarm(300 <unfinished ...>
[pid 25559] 10:12:38.245656 read(13,  <unfinished ...>
[pid 25544] 10:12:38.245679 munmap(0x7fa692c1e000, 4096 <unfinished ...>
[pid 25566] 10:12:38.245762 <... alarm resumed> ) = 0
[pid 25559] 10:12:38.245778 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 8192) = 2985
[pid 25544] 10:12:38.245820 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.246269 brk(0x250f000 <unfinished ...>
[pid 25559] 10:12:38.246297 read(13,  <unfinished ...>
[pid 25544] 10:12:38.246320 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-J", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25566] 10:12:38.246392 <... brk resumed> ) = 0x250f000
[pid 25559] 10:12:38.246413 <... read resumed> "", 8192) = 0
[pid 25544] 10:12:38.246484 <... open resumed> ) = 9
[pid 25566] 10:12:38.246526 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2v\223\230+V3\363\3128E\373\0176\nB\357\2545\223\3403\23C\366\253\234F\223t\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25559] 10:12:38.246589 close(13 <unfinished ...>
[pid 25544] 10:12:38.246619 fcntl(9, F_GETFD <unfinished ...>
[pid 25566] 10:12:38.246648 <... write resumed> ) = 258
[pid 25559] 10:12:38.246661 <... close resumed> ) = 0
[pid 25544] 10:12:38.246680 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.246805 read(11,  <unfinished ...>
[pid 25559] 10:12:38.246835 stat("/etc/userdomains",  <unfinished ...>
[pid 25544] 10:12:38.246866 fcntl(9, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.246894 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.246922 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.246963 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.246994 fchown(9, 47, 12 <unfinished ...>
[pid 25559] 10:12:38.247029 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.247055 <... fchown resumed> ) = 0
[pid 25559] 10:12:38.247087 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.247114 fchmod(9, 0640 <unfinished ...>
[pid 25559] 10:12:38.247144 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.247168 <... fchmod resumed> ) = 0
[pid 25559] 10:12:38.247244 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25544] 10:12:38.247281 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25559] 10:12:38.247319 <... open resumed> ) = 13
[pid 25544] 10:12:38.247337 <... open resumed> ) = 10
[pid 25559] 10:12:38.247363 fstat(13,  <unfinished ...>
[pid 25544] 10:12:38.247387 alarm(60 <unfinished ...>
[pid 25559] 10:12:38.247415 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25544] 10:12:38.247441 <... alarm resumed> ) = 0
[pid 25559] 10:12:38.247462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25544] 10:12:38.247488 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25559] 10:12:38.247520 <... mmap resumed> ) = 0x7ff9b2d3d000
[pid 25544] 10:12:38.247534 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.247555 read(13,  <unfinished ...>
[pid 25544] 10:12:38.247581 alarm(0 <unfinished ...>
[pid 25559] 10:12:38.247608 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25544] 10:12:38.247634 <... alarm resumed> ) = 60
[pid 25559] 10:12:38.247774 close(13 <unfinished ...>
[pid 25544] 10:12:38.247808 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25559] 10:12:38.247843 <... close resumed> ) = 0
[pid 25544] 10:12:38.247857 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.247897 munmap(0x7ff9b2d3d000, 4096 <unfinished ...>
[pid 25544] 10:12:38.247926 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.247962 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.247975 <... open resumed> ) = 11
[pid 25559] 10:12:38.248005 stat("/etc/vfilters/finestweddingsites.com",  <unfinished ...>
[pid 25544] 10:12:38.248033 fcntl(11, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.248059 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25544] 10:12:38.248084 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.248105 pipe( <unfinished ...>
[pid 25544] 10:12:38.248132 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.248159 <... pipe resumed> [13, 14]) = 0
[pid 25544] 10:12:38.248173 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.248195 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25544] 10:12:38.248224 read(11,  <unfinished ...>
[pid 25559] 10:12:38.248251 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25544] 10:12:38.248267 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25559] 10:12:38.248300 close(10 <unfinished ...>
[pid 25544] 10:12:38.248332 close(11 <unfinished ...>
[pid 25559] 10:12:38.248367 <... close resumed> ) = 0
[pid 25544] 10:12:38.248389 <... close resumed> ) = 0
[pid 25559] 10:12:38.248417 munmap(0x7ff9b2d40000, 4096 <unfinished ...>
[pid 25544] 10:12:38.248445 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.248477 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.248490 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.248516 close(11 <unfinished ...>
[pid 25544] 10:12:38.248539 stat("/var/tmp",  <unfinished ...>
[pid 25559] 10:12:38.248573 <... close resumed> ) = 0
[pid 25544] 10:12:38.248586 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25559] 10:12:38.248809 munmap(0x7ff9b2d3f000, 4096 <unfinished ...>
[pid 25544] 10:12:38.248845 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.248882 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.248895 <... open resumed> ) = 11
[pid 25559] 10:12:38.248918 close(12 <unfinished ...>
[pid 25544] 10:12:38.248942 fcntl(11, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.248968 <... close resumed> ) = 0
[pid 25544] 10:12:38.248981 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.249001 munmap(0x7ff9b2d3e000, 4096 <unfinished ...>
[pid 25544] 10:12:38.249026 fcntl(11, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.249059 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.249072 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.249095 close(9 <unfinished ...>
[pid 25544] 10:12:38.249119 fstat(11,  <unfinished ...>
[pid 25559] 10:12:38.249145 <... close resumed> ) = 0
[pid 25544] 10:12:38.249158 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.249209 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25544] 10:12:38.249238 pread(11,  <unfinished ...>
[pid 25559] 10:12:38.249268 <... munmap resumed> ) = 0
[pid 25544] 10:12:38.249281 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25559] 10:12:38.249330 clone( <unfinished ...>
[pid 25544] 10:12:38.249634 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25559] 10:12:38.249758 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25575
[pid 25544] 10:12:38.249782 close(11 <unfinished ...>
[pid 25559] 10:12:38.249835 close(14 <unfinished ...>
[pid 25544] 10:12:38.249858 <... close resumed> ) = 0
[pid 25559] 10:12:38.249894 <... close resumed> ) = 0
[pid 25544] 10:12:38.249911 close(10 <unfinished ...>
[pid 25559] 10:12:38.249943 read(13,  <unfinished ...>
[pid 25544] 10:12:38.249964 <... close resumed> ) = 0
[pid 25544] 10:12:38.249996 open("/etc/userdomains", O_RDONLY) = 10
[pid 25544] 10:12:38.250038 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.250087 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.250132 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25544] 10:12:38.250169 lseek(10, 0, SEEK_SET) = 0
[pid 25544] 10:12:38.250202 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25544] 10:12:38.250265 pipe([11, 12]) = 0
[pid 25544] 10:12:38.250307 close(10)   = 0
[pid 25544] 10:12:38.250341 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:38.250380 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25576
[pid 25544] 10:12:38.250689 close(12)   = 0
[pid 25544] 10:12:38.250791 read(11, Process 25576 attached
 <unfinished ...>
[pid 25576] 10:12:38.250851 set_robust_list(0x7fa692c09aa0, 24) = 0
[pid 25576] 10:12:38.250962 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0}) = 0
[pid 25576] 10:12:38.251177 open("/etc/userdomains", O_RDONLY) = 10
[pid 25576] 10:12:38.251226 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25576] 10:12:38.251286 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25576] 10:12:38.251336 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25576] 10:12:38.251382 lseek(10, 0, SEEK_SET) = 0
[pid 25576] 10:12:38.251441 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25576] 10:12:38.251534 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25576] 10:12:38.251614 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25576] 10:12:38.251658 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25576] 10:12:38.251773 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25576] 10:12:38.251822 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1e000
[pid 25576] 10:12:38.251858 lseek(13, 0, SEEK_SET) = 0
[pid 25576] 10:12:38.251890 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25576] 10:12:38.251936 read(13, "", 4096) = 0
[pid 25576] 10:12:38.251997 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25576] 10:12:38.252040 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25576] 10:12:38.252077 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fa691ad6790}, 8) = 0
[pid 25576] 10:12:38.252116 close(11)   = 0
[pid 25576] 10:12:38.252148 fcntl(12, F_GETFD) = 0
[pid 25576] 10:12:38.252179 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25576] 10:12:38.252222 geteuid()   = 0
[pid 25576] 10:12:38.252256 getegid()   = 12
[pid 25576] 10:12:38.252288 setgid(500) = 0
[pid 25576] 10:12:38.252323 setuid(503) = 0
[pid 25576] 10:12:38.252355 chdir("/")  = 0
[pid 25576] 10:12:38.252413 geteuid()   = 503
[pid 25576] 10:12:38.252448 getegid()   = 500
[pid 25576] 10:12:38.252504 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom", {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25576] 10:12:38.252561 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom") = 0
[pid 25576] 10:12:38.252603 stat("tmp", {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25576] 10:12:38.252651 stat("new", {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25576] 10:12:38.252708 stat("cur", {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25576] 10:12:38.252878 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25576] 10:12:38.252928 read(11, "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2985
[pid 25576] 10:12:38.253023 stat("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", 0x7ffc5380e870) = -1 ENOENT (No such file or directory)
[pid 25576] 10:12:38.253072 open("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25576] 10:12:38.253142 chown("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", 503, 500) = 0
[pid 25576] 10:12:38.253188 chmod("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", 0660) = 0
[pid 25576] 10:12:38.253226 chown("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", 503, 500) = 0
[pid 25576] 10:12:38.253263 chmod("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", 0660) = 0
[pid 25576] 10:12:38.253329 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25576] 10:12:38.253438 lseek(6, 19, SEEK_SET) = 19
[pid 25576] 10:12:38.253482 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25576] 10:12:38.253534 read(6, "", 8192) = 0
[pid 25576] 10:12:38.253568 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2514) = 2514
[pid 25576] 10:12:38.253617 fsync(14Process 25575 attached
 <unfinished ...>
[pid 25575] 10:12:38.253786 set_robust_list(0x7ff9b2d2baa0, 24) = 0
[pid 25575] 10:12:38.253936 close(13)   = 0
[pid 25575] 10:12:38.253984 geteuid()   = 0
[pid 25575] 10:12:38.254037 getegid()   = 12
[pid 25575] 10:12:38.254082 setgid(500 <unfinished ...>
[pid 25576] 10:12:38.254105 <... fsync resumed> ) = 0
[pid 25576] 10:12:38.254127 lseek(11, 0, SEEK_END) = 2985
[pid 25576] 10:12:38.254160 write(11, "2514 1\n", 7) = 7
[pid 25576] 10:12:38.254200 close(11)   = 0
[pid 25576] 10:12:38.254236 fstat(14, {st_dev=makedev(144, 4215), st_ino=122016484, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2514, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25576] 10:12:38.254281 close(14)   = 0
[pid 25576] 10:12:38.254326 rename("tmp/1451491958.H253012P25576.fin.finestweddingsites.com", "new/1451491958.H253012P25576.fin.finestweddingsites.com,S=2514") = 0
[pid 25576] 10:12:38.254412 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254443 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.254479 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254499 <... write resumed> ) = 4
[pid 25576] 10:12:38.254517 write(12, "\322\t\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254541 <... read resumed> "\322\t\0\0", 4) = 4
[pid 25544] 10:12:38.254561 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254580 <... write resumed> ) = 4
[pid 25576] 10:12:38.254597 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254619 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25544] 10:12:38.254638 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254657 <... write resumed> ) = 4
[pid 25576] 10:12:38.254674 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254756 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.254783 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254804 <... write resumed> ) = 4
[pid 25576] 10:12:38.254822 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254844 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.254863 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254882 <... write resumed> ) = 4
[pid 25576] 10:12:38.254900 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.254921 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.254939 read(11,  <unfinished ...>
[pid 25576] 10:12:38.254958 <... write resumed> ) = 4
[pid 25576] 10:12:38.254976 write(12, "\260\343\361\1\0\0\0\0", 8 <unfinished ...>
[pid 25544] 10:12:38.254997 <... read resumed> "\260\343\361\1\0\0\0\0", 8) = 8
[pid 25544] 10:12:38.255017 read(11,  <unfinished ...>
[pid 25576] 10:12:38.255036 <... write resumed> ) = 8
[pid 25576] 10:12:38.255054 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.255075 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.255094 read(11,  <unfinished ...>
[pid 25576] 10:12:38.255113 <... write resumed> ) = 4
[pid 25576] 10:12:38.255131 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.255152 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.255171 close(11)   = 0
[pid 25544] 10:12:38.255211 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55) = 55
[pid 25544] 10:12:38.255263 fsync(9 <unfinished ...>
[pid 25576] 10:12:38.255309 <... write resumed> ) = 4
[pid 25576] 10:12:38.255329 close(12)   = 0
[pid 25576] 10:12:38.255375 close(10)   = 0
[pid 25576] 10:12:38.255461 munmap(0x7fa692c1f000, 4096) = 0
[pid 25576] 10:12:38.255504 close(13)   = 0
[pid 25576] 10:12:38.255551 munmap(0x7fa692c1e000, 4096 <unfinished ...>
[pid 25575] 10:12:38.255578 <... setgid resumed> ) = 0
[pid 25544] 10:12:38.255601 <... fsync resumed> ) = 0
[pid 25544] 10:12:38.255620 wait4(-1,  <unfinished ...>
[pid 25576] 10:12:38.255643 <... munmap resumed> ) = 0
[pid 25575] 10:12:38.255662 setuid(503) = 0
[pid 25575] 10:12:38.255814 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25576] 10:12:38.256163 exit_group(0) = ?
[pid 25575] 10:12:38.256193 <... open resumed> ) = 9
[pid 25575] 10:12:38.256220 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25575] 10:12:38.256298 brk(0xbe9000) = 0xbe9000
[pid 25575] 10:12:38.256404 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25575] 10:12:38.256470 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25575] 10:12:38.256509 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25575] 10:12:38.256563 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25575] 10:12:38.256607 close(9)    = 0
[pid 25575] 10:12:38.256642 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25575] 10:12:38.257119 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25576] 10:12:38.257389 +++ exited with 0 +++
[pid 25544] 10:12:38.257423 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25576
[pid 25544] 10:12:38.257499 open("/etc/userdomains", O_RDONLY) = 10
[pid 25544] 10:12:38.257543 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.257594 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.257639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25544] 10:12:38.257676 lseek(10, 0, SEEK_SET) = 0
[pid 25544] 10:12:38.257765 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25544] 10:12:38.257833 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com", 0x7ffc5380d5c0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.257887 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.257950 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132) = 132
[pid 25544] 10:12:38.258001 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.258059 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.258110 close(7)    = 0
[pid 25544] 10:12:38.258147 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25544] 10:12:38.258192 fcntl(7, F_GETFD) = 0
[pid 25544] 10:12:38.258224 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.258255 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388717, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.258299 write(7, "2015-12-30 10:12:38 [25544] 1aEJMb-0006dm-9U => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2514 QT=1s DT=0s\n", 232) = 232
[pid 25544] 10:12:38.258348 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25544] 10:12:38.258410 alarm(60)   = 0
[pid 25544] 10:12:38.258456 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25544] 10:12:38.258501 alarm(0)    = 60
[pid 25544] 10:12:38.258554 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25544] 10:12:38.258610 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25544] 10:12:38.258650 fcntl(12, F_GETFD) = 0
[pid 25544] 10:12:38.258681 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.258796 read(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25544] 10:12:38.258842 close(12)   = 0
[pid 25544] 10:12:38.258882 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.258924 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25544] 10:12:38.259057 open("/var/spool/exim/db/retry", O_RDONLY) = 12
[pid 25544] 10:12:38.259102 fcntl(12, F_GETFD) = 0
[pid 25544] 10:12:38.259134 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:38.259166 fstat(12, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25544] 10:12:38.259223 pread(12, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25544] 10:12:38.259278 pread(12, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25544] 10:12:38.259327 close(12)   = 0
[pid 25544] 10:12:38.259376 close(11)   = 0
[pid 25544] 10:12:38.259438 pipe([11, 12]) = 0
[pid 25544] 10:12:38.259480 close(10)   = 0
[pid 25544] 10:12:38.259514 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:38.259553 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25577
[pid 25544] 10:12:38.259850 close(12)   = 0
[pid 25544] 10:12:38.259887 read(11,  <unfinished ...>
[pid 25575] 10:12:38.259909 <... lseek resumed> ) = 19
[pid 25575] 10:12:38.259928 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2383) = 1858
[pid 25575] 10:12:38.260420 write(14, "\2\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.260470 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25559] 10:12:38.260493 read(13,  <unfinished ...>
[pid 25575] 10:12:38.260514 <... write resumed> ) = 4
[pid 25566] 10:12:38.260578 <... read resumed> "\26\3\3\0;\2\0", 7) = 7
[pid 25566] 10:12:38.260645 read(11, "\0007\3\3V\204\2vl\35\236 \322\321\354\1\205\346\340\03119x\202\210\313\35\240\27c\232\375\2\26\211]\0\300/\0\0\17\377\1\0\1\0\0#\0\0\0\v\0\2\1\0", 57) = 57
[pid 25566] 10:12:38.260760 read(11, "\26\3\3\16*", 5) = 5
[pid 25566] 10:12:38.260804 read(11, "\v\0\16&\0\16#\0\6\2450\202\6\2410\202\5\211\240\3\2\1\2\2\10R\357\363\340\22\17\266\0040\r\6\t*\206H\206\367\r\1\1\v\5\0000I1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\n\23\nGoogle Inc1%0#\6\3U\4\3\23\34Google Internet Authority G20\36\27\r151210182812Z\27\r160309000000Z0g1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\10\f\nCalifornia1\0260\24\6\3U\4\7\f\rMountain View1\0230\21\6\3U\4\n\f\nGoogle Inc1\0260\24\6\3U\4\3\f\rmx.google"..., 3626) = 3626
[pid 25566] 10:12:38.261616 read(11,  <unfinished ...>
[pid 25572] 10:12:38.261659 <... select resumed> ) = 1 (in [11], left {299, 962540})
[pid 25566] 10:12:38.261672 <... read resumed> "\26\3\3\1M", 5) = 5
[pid 25572] 10:12:38.261759 recvfrom(11,  <unfinished ...>
[pid 25566] 10:12:38.261770 read(11,  <unfinished ...>
[pid 25572] 10:12:38.261796 <... recvfrom resumed> "220 s12p02m011.mxlogic.net ESMTP mxl_mta-8.5.0-4 [7f27773f1700.143038.00-2343]; Wed, 30 Dec 2015 09:12:38 -0700 (MST); NO UCE, INBOUND (s12p02m011.mxlogic.net)\r\n", 4096, 0, NULL, NULL) = 161
[pid 25566] 10:12:38.261807 <... read resumed> "\f\0\1I\3\0\27A\0047\272\300M@\272\16v\2\220\336lb\330\241\2}p\247)\353(\277\253]\203\2118\366@\35\234\277Mg7I&\201\316\360=\323oT/\247@\336\325\237]\2\26\306\324\233\262.\5A-tz\4\1\1\0\247\210_\233\276\250|\334{\306\216_\306\316\211\5\345\204\233\251\5\16\23h\"\262W\37s\221).]\223\210\207J\25\257\203\255w\276q+\341\33\206[eRC\227S]\0\322\354\316\353\213{e\271\240\4B\363v\343\276RR\17\374\23Q\332.|(\322\333\267kagQ\345/P\351\371j\216\351%\242\361\215\37\212\221\203\313*=\365^huJ\3400M\2523\234YM\341h\271/\344\326_\377\0249I\261\205\253\337^e]{+Ip>I\226\341\246\32336\255Ri\361`\266\254\266f\220|:\6\272\260Vj\311\177\314\376L\301\215\237\271z\377z"..., 333) = 333
[pid 25572] 10:12:38.262002 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0 <unfinished ...>
[pid 25566] 10:12:38.262016 read(11,  <unfinished ...>
[pid 25572] 10:12:38.262065 <... sendto resumed> ) = 33
[pid 25566] 10:12:38.262072 <... read resumed> "\26\3\3\0\4", 5) = 5
[pid 25572] 10:12:38.262099 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25566] 10:12:38.262110 read(11, "\16\0\0\0", 4) = 4
[pid 25573] 10:12:38.264371 <... select resumed> ) = 1 (in [11], left {299, 964599})
[pid 25566] 10:12:38.264390 write(11, "\26\3\3\0F\20\0\0BA\4\226uy\232\0377\345\363{\246\377\271\217\212\37\352\343\314\316\366\246*\351\322\6%D\362c\234;\312\203\241\343Y\260N\10>H\220\26o[_\343\264=\250n\302\23\362\364_\232\370m7\236\327\254\346\24\3\3\0\1\1\26\3\3\0(\306.g\244\374G\321\350\263\334\16\202\327E\321\331\322\206\335cp\343\307DBz\263\301\304-I\2013p\364N:\\\305\242", 126 <unfinished ...>
[pid 25573] 10:12:38.264430 recvfrom(11, "220 s12p02m065.mxlogic.net ESMTP mxl_mta-8.5.0-4 [7ffa55bf5700.29957515.00-2253]; Wed, 30 Dec 2015 09:12:38 -0700 (MST); NO UCE, INBOUND (s12p02m065.mxlogic.net)\r\n", 4096, 0, NULL, NULL) = 163
[pid 25573] 10:12:38.264490 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25573] 10:12:38.264554 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25566] 10:12:38.264599 <... write resumed> ) = 126
[pid 25566] 10:12:38.264623 read(11,  <unfinished ...>
[pid 25575] 10:12:38.264647 write(14, "\1\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.264673 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25559] 10:12:38.264751 read(13,  <unfinished ...>
[pid 25575] 10:12:38.264781 <... write resumed> ) = 4
[pid 25575] 10:12:38.264801 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.264825 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.264855 read(13,  <unfinished ...>
[pid 25575] 10:12:38.264876 <... write resumed> ) = 4
[pid 25575] 10:12:38.264895 write(14, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25559] 10:12:38.264920 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25559] 10:12:38.264941 read(13,  <unfinished ...>
[pid 25575] 10:12:38.264961 <... write resumed> ) = 40
[pid 25575] 10:12:38.264979 write(14, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.265001 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.265021 wait4(-1,  <unfinished ...>
[pid 25575] 10:12:38.265041 <... write resumed> ) = 4
[pid 25575] 10:12:38.265059 close(14)   = 0
[pid 25575] 10:12:38.265102 exit_group(0) = ?
[pid 25575] 10:12:38.265358 +++ exited with 0 +++
[pid 25559] 10:12:38.265388 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25575
[pid 25559] 10:12:38.265411 close(13)   = 0
[pid 25559] 10:12:38.265449 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.265511 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.265580 open("/etc/userdomains", O_RDONLY) = 9
[pid 25559] 10:12:38.265622 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.265672 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.265787 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.265826 lseek(9, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.265860 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.265918 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.265979 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.266057 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/filter", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.266109 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.266169 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25559] 10:12:38.266210 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.266258 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.266307 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25559] 10:12:38.266344 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.266378 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25559] 10:12:38.266440 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25559] 10:12:38.266488 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.266534 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.266569 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.266620 close(11)   = 0
[pid 25559] 10:12:38.266655 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.266803 open("/etc/localdomains", O_RDONLY) = 11
[pid 25559] 10:12:38.266853 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.266902 fstat(11, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.266946 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.266982 lseek(11, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.267015 read(11, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.267069 stat("/jail_owner", 0x7fffca4b4050) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.267115 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.267179 stat("/usr/local/cpanel/3rdparty/mailman/lists/mcdowell-mountain_finestweddingsites.com/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.267229 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.267284 stat("/usr/local/cpanel/3rdparty/mailman/lists/mcdowell-mountain/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.267329 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.267405 open("/etc/demouids", O_RDONLY) = 12
[pid 25559] 10:12:38.267452 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.267507 fstat(12, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.267553 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3e000
[pid 25559] 10:12:38.267591 lseek(12, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.267626 read(12, "", 4096) = 0
[pid 25559] 10:12:38.267671 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.267902 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.267976 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.268036 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.268098 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25559] 10:12:38.268144 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.268193 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.268239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3d000
[pid 25559] 10:12:38.268278 lseek(13, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.268313 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25559] 10:12:38.268362 read(13, "", 4096) = 0
[pid 25559] 10:12:38.268427 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.268494 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.268554 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.268634 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25559] 10:12:38.268680 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.268812 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3c000
[pid 25559] 10:12:38.268851 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.268906 close(14)   = 0
[pid 25559] 10:12:38.268943 munmap(0x7ff9b2d3c000, 4096) = 0
[pid 25559] 10:12:38.268990 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.269043 pipe([14, 15]) = 0
[pid 25559] 10:12:38.269081 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.269125 close(12)   = 0
[pid 25559] 10:12:38.269160 munmap(0x7ff9b2d3e000, 4096) = 0
[pid 25559] 10:12:38.269198 close(9)    = 0
[pid 25559] 10:12:38.269233 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.269271 close(11)   = 0
[pid 25559] 10:12:38.269306 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.269343 close(13)   = 0
[pid 25559] 10:12:38.269378 munmap(0x7ff9b2d3d000, 4096) = 0
[pid 25559] 10:12:38.269415 close(10)   = 0
[pid 25559] 10:12:38.269450 munmap(0x7ff9b2d40000, 4096) = 0
[pid 25559] 10:12:38.269487 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25578
[pid 25559] 10:12:38.269780 close(15)   = 0
[pid 25559] 10:12:38.269822 read(14, Process 25577 attached
 <unfinished ...>
[pid 25577] 10:12:38.269879 set_robust_list(0x7fa692c09aa0, 24) = 0
[pid 25577] 10:12:38.269979 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0}) = 0
[pid 25577] 10:12:38.270136 open("/etc/userdomains", O_RDONLY) = 10
[pid 25577] 10:12:38.270187 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25577] 10:12:38.270247 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25577] 10:12:38.270295 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25577] 10:12:38.270334 lseek(10, 0, SEEK_SET) = 0
[pid 25577] 10:12:38.270370 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25577] 10:12:38.270452 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25577] 10:12:38.270529 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25577] 10:12:38.270588 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25577] 10:12:38.270643 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25577] 10:12:38.270688 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1e000
[pid 25577] 10:12:38.270805 lseek(13, 0, SEEK_SET) = 0
[pid 25577] 10:12:38.270841 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25577] 10:12:38.270917 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25577] 10:12:38.270960 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25577] 10:12:38.270998 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fa691ad6790}, 8) = 0
[pid 25577] 10:12:38.271040 close(11)   = 0
[pid 25577] 10:12:38.271072 fcntl(12, F_GETFD) = 0
[pid 25577] 10:12:38.271104 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25577] 10:12:38.271148 geteuid()   = 0
[pid 25577] 10:12:38.271183 getegid()   = 12
[pid 25577] 10:12:38.271215 setgid(500) = 0
[pid 25577] 10:12:38.271249 setuid(503) = 0
[pid 25577] 10:12:38.271282 chdir("/")  = 0
[pid 25577] 10:12:38.271329 geteuid()   = 503
[pid 25577] 10:12:38.271364 getegid()   = 500
[pid 25577] 10:12:38.271423 stat("/home/finest09/mail/finestweddingsites.com/lisa", {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25577] 10:12:38.271480 chdir("/home/finest09/mail/finestweddingsites.com/lisa") = 0
[pid 25577] 10:12:38.271517 stat("tmp", {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25577] 10:12:38.271565 stat("new", {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25577] 10:12:38.271612 stat("cur", {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25577] 10:12:38.271779 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25577] 10:12:38.271833 read(11, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4158
[pid 25577] 10:12:38.271942 stat("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", 0x7ffc5380e870) = -1 ENOENT (No such file or directory)
[pid 25577] 10:12:38.271992 open("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25577] 10:12:38.272064 chown("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", 503, 500) = 0
[pid 25577] 10:12:38.272110 chmod("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", 0660) = 0
Process 25578 attached
[pid 25577] 10:12:38.272176 chown("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25578] 10:12:38.272209 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25577] 10:12:38.272235 <... chown resumed> ) = 0
[pid 25577] 10:12:38.272254 chmod("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", 0660) = 0
[pid 25578] 10:12:38.272292 <... set_robust_list resumed> ) = 0
[pid 25578] 10:12:38.272333 close(14 <unfinished ...>
[pid 25577] 10:12:38.272394 stat("/etc/localtime",  <unfinished ...>
[pid 25578] 10:12:38.272420 <... close resumed> ) = 0
[pid 25578] 10:12:38.272448 geteuid( <unfinished ...>
[pid 25577] 10:12:38.272471 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25577] 10:12:38.272539 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25578] 10:12:38.272563 <... geteuid resumed> ) = 0
[pid 25578] 10:12:38.272583 getegid()   = 12
[pid 25578] 10:12:38.272617 setgid(500) = 0
[pid 25578] 10:12:38.272650 setuid(503) = 0
[pid 25577] 10:12:38.272764 <... lseek resumed> ) = 19
[pid 25578] 10:12:38.272799 open("/etc/vfilters/finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25577] 10:12:38.272824 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25577] 10:12:38.272876 read(6,  <unfinished ...>
[pid 25578] 10:12:38.272901 <... open resumed> ) = 9
[pid 25578] 10:12:38.272927 fstat(9,  <unfinished ...>
[pid 25577] 10:12:38.272947 <... read resumed> "", 8192) = 0
[pid 25577] 10:12:38.272966 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2514) = 2514
[pid 25578] 10:12:38.273012 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25578] 10:12:38.273060 brk(0xbe9000 <unfinished ...>
[pid 25577] 10:12:38.273082 fsync(14 <unfinished ...>
[pid 25578] 10:12:38.273138 <... brk resumed> ) = 0xbe9000
[pid 25578] 10:12:38.273219 fstat(9, {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25578] 10:12:38.273363 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25578] 10:12:38.273421 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25578] 10:12:38.273486 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25578] 10:12:38.273537 close(9 <unfinished ...>
[pid 25577] 10:12:38.273565 <... fsync resumed> ) = 0
[pid 25577] 10:12:38.273587 lseek(11, 0, SEEK_END) = 4158
[pid 25577] 10:12:38.273621 write(11, "2514 1\n", 7) = 7
[pid 25577] 10:12:38.273660 close(11)   = 0
[pid 25577] 10:12:38.273766 fstat(14, {st_dev=makedev(144, 4215), st_ino=122179990, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2514, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25577] 10:12:38.273827 close(14)   = 0
[pid 25577] 10:12:38.273873 rename("tmp/1451491958.H271931P25577.fin.finestweddingsites.com", "new/1451491958.H271931P25577.fin.finestweddingsites.com,S=2514") = 0
[pid 25577] 10:12:38.273939 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25578] 10:12:38.273963 <... close resumed> ) = 0
[pid 25544] 10:12:38.273987 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.274011 read(11,  <unfinished ...>
[pid 25578] 10:12:38.274032 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25577] 10:12:38.274052 <... write resumed> ) = 4
[pid 25578] 10:12:38.274074 <... munmap resumed> ) = 0
[pid 25577] 10:12:38.274093 write(12, "\322\t\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.274118 <... read resumed> "\322\t\0\0", 4) = 4
[pid 25544] 10:12:38.274138 read(11,  <unfinished ...>
[pid 25577] 10:12:38.274158 <... write resumed> ) = 4
[pid 25577] 10:12:38.274176 write(12, "\200\0\0\0", 4 <unfinished ...>
[pid 25578] 10:12:38.274579 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25544] 10:12:38.274610 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25544] 10:12:38.274631 read(11,  <unfinished ...>
[pid 25577] 10:12:38.274652 <... write resumed> ) = 4
[pid 25577] 10:12:38.274670 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.274692 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.274785 read(11,  <unfinished ...>
[pid 25577] 10:12:38.274806 <... write resumed> ) = 4
[pid 25577] 10:12:38.274824 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.274847 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.274866 read(11,  <unfinished ...>
[pid 25577] 10:12:38.274885 <... write resumed> ) = 4
[pid 25577] 10:12:38.274903 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.274924 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.274943 read(11,  <unfinished ...>
[pid 25577] 10:12:38.274963 <... write resumed> ) = 4
[pid 25577] 10:12:38.274981 write(12, "\260\343\361\1\0\0\0\0", 8 <unfinished ...>
[pid 25544] 10:12:38.275003 <... read resumed> "\260\343\361\1\0\0\0\0", 8) = 8
[pid 25544] 10:12:38.275022 read(11,  <unfinished ...>
[pid 25577] 10:12:38.275042 <... write resumed> ) = 8
[pid 25577] 10:12:38.275060 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.275082 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.275101 read(11,  <unfinished ...>
[pid 25577] 10:12:38.275120 <... write resumed> ) = 4
[pid 25577] 10:12:38.275138 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25544] 10:12:38.275159 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25544] 10:12:38.275178 close(11)   = 0
[pid 25544] 10:12:38.275219 write(9, "lisa@finestweddingsites.com\n", 28) = 28
[pid 25544] 10:12:38.275260 fsync(9 <unfinished ...>
[pid 25577] 10:12:38.275297 <... write resumed> ) = 4
[pid 25577] 10:12:38.275320 close(12)   = 0
[pid 25577] 10:12:38.275415 close(10)   = 0
[pid 25577] 10:12:38.275457 munmap(0x7fa692c1f000, 4096) = 0
[pid 25577] 10:12:38.275506 close(13 <unfinished ...>
[pid 25544] 10:12:38.275535 <... fsync resumed> ) = 0
[pid 25544] 10:12:38.275554 wait4(-1,  <unfinished ...>
[pid 25577] 10:12:38.275576 <... close resumed> ) = 0
[pid 25577] 10:12:38.275594 munmap(0x7fa692c1e000, 4096) = 0
[pid 25577] 10:12:38.276058 exit_group(0) = ?
[pid 25578] 10:12:38.276085 <... lseek resumed> ) = 19
[pid 25578] 10:12:38.276108 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2383) = 1858
[pid 25578] 10:12:38.276591 write(15, "\2\0\0\0", 4 <unfinished ...>
[pid 25577] 10:12:38.276931 +++ exited with 0 +++
[pid 25544] 10:12:38.276964 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25577
[pid 25544] 10:12:38.277024 open("/etc/userdomains", O_RDONLY) = 10
[pid 25544] 10:12:38.277069 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.277121 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25544] 10:12:38.277167 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25544] 10:12:38.277204 lseek(10, 0, SEEK_SET) = 0
[pid 25544] 10:12:38.277237 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25544] 10:12:38.277301 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com", 0x7ffc5380d5c0) = -1 ENOENT (No such file or directory)
[pid 25544] 10:12:38.277354 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:38.277419 write(8, "2015-12-30 10:12:38 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126 <unfinished ...>
[pid 25566] 10:12:38.277460 <... read resumed> "\26\3\3\0\256", 5) = 5
[pid 25544] 10:12:38.277468 <... write resumed> ) = 126
[pid 25566] 10:12:38.277500 read(11,  <unfinished ...>
[pid 25544] 10:12:38.277508 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com: children all complete\n", 77 <unfinished ...>
[pid 25566] 10:12:38.277540 <... read resumed> "\4\0\0\252\0\1\211\300\0\244C\34\306\3156\251\362MsK\235\215e\353\211V\21(\0\2031%\371=\237\314\341\321C\307\374\233g\21fg\220T\354\262R\241M\326v|\333I\220\300x\265:X5$\264\261\23\202O\264`']1\3416\364\33\2778\353BB\343T\331\217Z\3461<1\r\236\310%\0268,\327U\212\\\202\30\252=C\212}\305\215\241\322\371\10\275R\326\257\212\301\323\325\350\224\312bO{\201\265g\302\367\21\315X\3426`\342\302a\207\264cb\0208\236\25\357>\261\336\27\353\245\332\245\335}w\331\362\203\332yY&4", 174) = 174
[pid 25544] 10:12:38.277550 <... write resumed> ) = 77
[pid 25566] 10:12:38.277607 read(11,  <unfinished ...>
[pid 25544] 10:12:38.277616 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.277643 <... read resumed> "\24\3\3\0\1", 5) = 5
[pid 25544] 10:12:38.277650 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.277783 read(11,  <unfinished ...>
[pid 25544] 10:12:38.277794 stat("/etc/localtime",  <unfinished ...>
[pid 25566] 10:12:38.277826 <... read resumed> "\1", 1) = 1
[pid 25544] 10:12:38.277833 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25566] 10:12:38.277905 read(11,  <unfinished ...>
[pid 25544] 10:12:38.277913 close(7 <unfinished ...>
[pid 25566] 10:12:38.277939 <... read resumed> "\26\3\3\0(", 5) = 5
[pid 25544] 10:12:38.277947 <... close resumed> ) = 0
[pid 25566] 10:12:38.277972 read(11,  <unfinished ...>
[pid 25544] 10:12:38.277979 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25566] 10:12:38.278015 <... read resumed> "\0\0\0\0\0\0\0\0\3514\234lxm1\310\24.Q\24\211\2307\214\34\203\346e\244^Z\250\217D\25`\362\250\343X", 40) = 40
[pid 25544] 10:12:38.278023 <... open resumed> ) = 7
[pid 25566] 10:12:38.278088 alarm(0 <unfinished ...>
[pid 25544] 10:12:38.278097 fcntl(7, F_GETFD <unfinished ...>
[pid 25566] 10:12:38.278121 <... alarm resumed> ) = 300
[pid 25544] 10:12:38.278126 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.278177 write(11, "\27\3\3\0009\306.g\244\374G\321\351\200\361\333\235Q\227\341\"\6\340\350\373^\223\270\214Ae\7\266\24\326\205,\307\362@\374\275\7L&\235\276\36\327\32\203]!\34O\257\362\331\336\302\7\374", 62 <unfinished ...>
[pid 25544] 10:12:38.278188 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25566] 10:12:38.278231 <... write resumed> ) = 62
[pid 25544] 10:12:38.278239 <... fcntl resumed> ) = 0
[pid 25566] 10:12:38.278266 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25544] 10:12:38.278279 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5388949, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:38.278330 write(7, "2015-12-30 10:12:38 [25544] 1aEJMb-0006dm-9U => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2514 QT=1s "..., 262) = 262
[pid 25544] 10:12:38.278423 pipe([11, 12]) = 0
[pid 25544] 10:12:38.278472 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25544] 10:12:38.278507 close(10)   = 0
[pid 25544] 10:12:38.278541 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:38.278580 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25579
[pid 25544] 10:12:38.278870 close(12)   = 0
[pid 25544] 10:12:38.278925 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:38.278970 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25559] 10:12:38.279003 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25559] 10:12:38.279024 read(14,  <unfinished ...>
[pid 25578] 10:12:38.279045 <... write resumed> ) = 4
[pid 25578] 10:12:38.279063 write(15, "\1\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.279085 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25559] 10:12:38.279104 read(14,  <unfinished ...>
[pid 25578] 10:12:38.279124 <... write resumed> ) = 4
[pid 25578] 10:12:38.279142 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.279163 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.279185 read(14,  <unfinished ...>
[pid 25578] 10:12:38.279205 <... write resumed> ) = 4
[pid 25578] 10:12:38.279223 write(15, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25559] 10:12:38.279247 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25559] 10:12:38.279268 read(14,  <unfinished ...>
[pid 25578] 10:12:38.279288 <... write resumed> ) = 40
[pid 25578] 10:12:38.279306 write(15, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.279328 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.279348 wait4(-1,  <unfinished ...>
[pid 25578] 10:12:38.279368 <... write resumed> ) = 4
[pid 25578] 10:12:38.279386 close(15)   = 0
[pid 25578] 10:12:38.279433 exit_group(0) = ?
[pid 25578] 10:12:38.279671 +++ exited with 0 +++
[pid 25559] 10:12:38.279756 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25578
[pid 25559] 10:12:38.279785 close(14)   = 0
[pid 25559] 10:12:38.279822 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.279882 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.279950 open("/etc/userdomains", O_RDONLY) = 9
[pid 25559] 10:12:38.279992 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.280041 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.280086 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.280123 lseek(9, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.280155 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.280211 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.280270 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.280347 stat("/home/finest09/etc/finestweddingsites.com/mcdowell-mountain/filter", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.280417 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.280485 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25559] 10:12:38.280526 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.280573 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.280616 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25559] 10:12:38.280652 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.280685 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25559] 10:12:38.280817 read(10, "", 4096) = 0
[pid 25559] 10:12:38.280869 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25559] 10:12:38.280914 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.280959 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.280994 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.281050 close(11)   = 0
[pid 25559] 10:12:38.281085 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.281135 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.281199 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25559] 10:12:38.281260 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.281329 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25559] 10:12:38.281373 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.281421 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.281465 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.281500 lseek(11, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.281533 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25559] 10:12:38.281579 read(11, "", 4096) = 0
[pid 25559] 10:12:38.281623 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.281678 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.281832 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.281907 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.281968 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.282034 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.282095 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.282203 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.282242 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25559] 10:12:38.282285 read(10, "", 4096) = 0
[pid 25559] 10:12:38.282343 stat("/etc/vdomainaliases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25559] 10:12:38.282424 open("/etc/vdomainaliases/finestweddingsites.com", O_RDONLY) = 12
[pid 25559] 10:12:38.282472 fstat(12, {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25559] 10:12:38.282521 fstat(12, {st_dev=makedev(144, 4215), st_ino=109093002, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:13:51, st_ctime=2015/12/22-14:13:51}) = 0
[pid 25559] 10:12:38.282565 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3e000
[pid 25559] 10:12:38.282612 lseek(12, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.282646 read(12, "", 4096) = 0
[pid 25559] 10:12:38.282685 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.282833 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25559] 10:12:38.282874 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.282918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3d000
[pid 25559] 10:12:38.282954 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.283005 close(13)   = 0
[pid 25559] 10:12:38.283039 munmap(0x7ff9b2d3d000, 4096) = 0
[pid 25559] 10:12:38.283094 open("/etc/localdomains", O_RDONLY) = 13
[pid 25559] 10:12:38.283137 fstat(13, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.283184 fstat(13, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.283228 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3d000
[pid 25559] 10:12:38.283263 lseek(13, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.283296 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.283345 read(13, "", 4096) = 0
[pid 25559] 10:12:38.283390 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.283454 stat("/usr/local/cpanel/3rdparty/mailman/lists/kgallagher_mcdowellmountaingc.com/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.283508 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.283568 open("/etc/demouids", O_RDONLY) = 14
[pid 25559] 10:12:38.283608 fstat(14, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.283654 fstat(14, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.283793 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3c000
[pid 25559] 10:12:38.283838 lseek(14, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.283872 read(14, "", 4096) = 0
[pid 25559] 10:12:38.283912 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.284065 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25559] 10:12:38.284115 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.284162 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.284198 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.284245 close(15)   = 0
[pid 25559] 10:12:38.284279 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.284365 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25559] 10:12:38.284446 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25559] 10:12:38.284487 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.284544 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.284581 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.284635 close(15)   = 0
[pid 25559] 10:12:38.284670 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.284788 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25559] 10:12:38.284834 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.284879 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.284914 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.284959 close(15)   = 0
[pid 25559] 10:12:38.284993 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.285112 open("/etc/domainusers", O_RDONLY) = 15
[pid 25559] 10:12:38.285160 fstat(15, {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.285208 fstat(15, {st_dev=makedev(144, 4215), st_ino=108270440, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=33, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.285252 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.285288 lseek(15, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.285320 read(15, "finest09: finestweddingsites.com\n", 4096) = 33
[pid 25559] 10:12:38.285361 read(15, "", 4096) = 0
[pid 25559] 10:12:38.285453 lseek(9, 353, SEEK_SET) = 353
[pid 25559] 10:12:38.285496 read(9, "", 4096) = 0
[pid 25559] 10:12:38.285546 lseek(9, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.285582 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.285646 stat("/var/cpanel/email_send_limits/max_deferfail_finestweddingsites.com", 0x7ff9b13df880) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.285788 stat("/etc/email_send_limits", {st_dev=makedev(144, 4215), st_ino=108270446, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=120, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.285866 open("/var/cpanel/email_send_limits/cache/finestweddingsites.com", O_RDONLY) = 16
[pid 25559] 10:12:38.285918 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4b3b50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.285959 lseek(16, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.285992 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25559] 10:12:38.286038 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.286073 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104360, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1, st_atime=2015/12/30-08:44:09, st_mtime=2015/12/30-08:44:09, st_ctime=2015/12/30-08:44:09}) = 0
[pid 25559] 10:12:38.286132 read(16, "0", 8192) = 1
[pid 25559] 10:12:38.286170 read(16, "", 8192) = 0
[pid 25559] 10:12:38.286206 close(16)   = 0
[pid 25559] 10:12:38.286289 stat("/var/cpanel/email_send_limits/track/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=115111478, st_mode=S_IFDIR|0750, st_nlink=2, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/27-23:35:25, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25559] 10:12:38.286385 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.286462 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.286515 close(7)    = 0
[pid 25559] 10:12:38.286552 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25559] 10:12:38.286596 fcntl(7, F_GETFD) = 0
[pid 25559] 10:12:38.286629 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.286662 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5389211, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.286778 write(7, "2015-12-30 10:12:38 [25559] 1aEJMb-0006e1-MY SMTP connection outbound 1451491958 1aEJMb-0006e1-MY finestweddingsites.com kgallagher@mcdowellmountaingc.com\n", 155) = 155
[pid 25559] 10:12:38.286861 open("/var/cpanel/email_send_limits/track/finestweddingsites.com/16.30.11.115", O_WRONLY|O_CREAT|O_APPEND, 0666) = 16
[pid 25559] 10:12:38.286916 lseek(16, 0, SEEK_END) = 20
[pid 25559] 10:12:38.286951 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4b3b50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.286987 lseek(16, 0, SEEK_CUR) = 20
[pid 25559] 10:12:38.287020 fstat(16, {st_dev=makedev(144, 4215), st_ino=115104364, st_mode=S_IFREG|0666, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=20, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.287065 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.287107 write(16, "1", 1) = 1
[pid 25559] 10:12:38.287149 close(16)   = 0
[pid 25559] 10:12:38.287200 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.287250 stat("/var/cpanel/domain_keys/private/fin.finestweddingsites.com", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.287315 open("/etc/resolv.conf", O_RDONLY) = 16
[pid 25559] 10:12:38.287428 fstat(16, {st_dev=makedev(144, 4215), st_ino=108270116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=158, st_atime=2015/12/28-14:29:54, st_mtime=2015/12/28-14:29:54, st_ctime=2015/12/28-14:29:54}) = 0
[pid 25559] 10:12:38.287478 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3a000
[pid 25559] 10:12:38.287515 read(16, "#nameserver 8.8.8.8\n#nameserver 4.2.2.1\n\noptions timeout:1\noptions rotate\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 209.244.0.3\nnameserver 209.244.0.4\n", 4096) = 158
[pid 25559] 10:12:38.287560 read(16, "", 4096) = 0
[pid 25559] 10:12:38.287598 close(16)   = 0
[pid 25559] 10:12:38.287632 munmap(0x7ff9b2d3a000, 4096) = 0
[pid 25559] 10:12:38.287669 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25559] 10:12:38.287778 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 16
[pid 25559] 10:12:38.287830 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16) = 0
[pid 25559] 10:12:38.287878 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25559] 10:12:38.287925 sendto(16, "\267\356\1\0\0\1\0\0\0\0\0\0\22mcdowellmountaingc\3com\0\0\17\0\1", 40, MSG_NOSIGNAL, NULL, 0) = 40
[pid 25559] 10:12:38.287996 poll([{fd=16, events=POLLIN}], 1, 1000Process 25579 attached
 <unfinished ...>
[pid 25579] 10:12:38.288057 set_robust_list(0x7fa692c09aa0, 24) = 0
[pid 25579] 10:12:38.288115 fcntl(12, F_GETFD) = 0
[pid 25579] 10:12:38.288149 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:38.288183 close(6)    = 0
[pid 25579] 10:12:38.288234 open("/var/spool/exim/input/b/1aEJMb-0006dm-9U-D", O_RDWR|O_APPEND) = 6
[pid 25579] 10:12:38.288290 fcntl(6, F_GETFD) = 0
[pid 25579] 10:12:38.288323 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:38.288397 geteuid()   = 0
[pid 25579] 10:12:38.288446 getegid()   = 12
[pid 25579] 10:12:38.288480 setgid(12)  = 0
[pid 25579] 10:12:38.288512 setuid(47)  = 0
[pid 25579] 10:12:38.288544 close(11)   = 0
[pid 25579] 10:12:38.288670 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 10
[pid 25579] 10:12:38.288783 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.288834 close(10)   = 0
[pid 25579] 10:12:38.288873 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 10
[pid 25579] 10:12:38.288909 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.288949 close(10)   = 0
[pid 25579] 10:12:38.289033 open("/etc/services", O_RDONLY|O_CLOEXEC) = 10
[pid 25579] 10:12:38.289083 fstat(10, {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25579] 10:12:38.289133 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25579] 10:12:38.289170 read(10, "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25579] 10:12:38.289239 close(10)   = 0
[pid 25579] 10:12:38.289275 munmap(0x7fa692c1f000, 4096) = 0
[pid 25579] 10:12:38.289348 stat("/etc/mailips", {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.289426 open("/etc/mailips", O_RDONLY) = 10
[pid 25579] 10:12:38.289470 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.289525 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.289571 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25579] 10:12:38.289607 lseek(10, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.289640 read(10, "", 4096) = 0
[pid 25579] 10:12:38.289685 lseek(10, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.289790 read(10, "", 4096) = 0
[pid 25579] 10:12:38.289988 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 11
[pid 25579] 10:12:38.290036 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25579] 10:12:38.290082 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1e000
[pid 25579] 10:12:38.290117 read(11, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25579] 10:12:38.290176 close(11)   = 0
[pid 25579] 10:12:38.290210 munmap(0x7fa692c1e000, 4096) = 0
[pid 25579] 10:12:38.290271 open("/etc/shadow", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
[pid 25579] 10:12:38.290424 lseek(10, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.290465 read(10, "", 4096) = 0
[pid 25579] 10:12:38.290500 lseek(10, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.290531 read(10, "", 4096) = 0
[pid 25579] 10:12:38.290584 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 11
[pid 25579] 10:12:38.290632 alarm(60)   = 0
[pid 25579] 10:12:38.290666 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25579] 10:12:38.290768 alarm(0)    = 60
[pid 25579] 10:12:38.290892 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25579] 10:12:38.290964 open("/var/spool/exim/db/retry", O_RDONLY) = 13
[pid 25579] 10:12:38.291005 fcntl(13, F_GETFD) = 0
[pid 25579] 10:12:38.291036 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:38.291070 read(13, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25579] 10:12:38.291115 close(13)   = 0
[pid 25579] 10:12:38.291157 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.291198 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25566] 10:12:38.291367 <... select resumed> ) = 1 (in [11], left {299, 986933})
[pid 25566] 10:12:38.291404 read(11, "\27\3\3\0\262", 5) = 5
[pid 25566] 10:12:38.291443 read(11, "\0\0\0\0\0\0\0\1w\r\215Z\271\313sL\324&\215\37\203\357/eQ3$eK`\365\336SMD\2\vE\250\204\17,+T\5B\321\321\16\204\347\30\37\2\274\202\22\217LO\325A\25\377#\263gwM]\264\211\2\206\352\r\322-*\250W8W7\305\376\25\237i\377\344A$\345\237T\314\222\3,*\261\315\313\225\332\272\373r\202/\271\0\251F\332]m\372\274\353(u;\352\211\255\322\216G\376\"\337\3434\354[\226K\236{b\342(\205\334\213\"\376D\304\331\350\241\v\0352\313\365\361\335R\337\36\266\211\340E\377F\353\7\350\324O)S7", 178) = 178
[pid 25566] 10:12:38.291515 write(11, "\27\3\3\0}\306.g\244\374G\321\352\26\4\254p\252\234\24\372\34\302r\302\245n_\300\225\332\372\347\360\253\225\333\371\366\2\312a\246p\323@HS\35Ob\321%\367\233\200\336#xRk\20\255\262\370@\205\331v;\230|\r\231Q+F\220\0252k\274\242\307\r\232\362\370\213\n*\346r\376\200\232\320S\344v\334\f\222}\4\222\34\323\214\374Fv\224\376\0342\211\r$\262\34\331{\373\207\375#Ol#", 130) = 130
[pid 25566] 10:12:38.291584 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25579] 10:12:38.291775 open("/var/spool/exim/db/retry", O_RDONLY) = 13
[pid 25579] 10:12:38.291824 fcntl(13, F_GETFD) = 0
[pid 25579] 10:12:38.291856 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:38.291888 fstat(13, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25579] 10:12:38.291979 pread(13, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25579] 10:12:38.292049 pread(13, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25579] 10:12:38.292103 pread(13, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25579] 10:12:38.292152 close(13)   = 0
[pid 25579] 10:12:38.292212 close(11)   = 0
[pid 25579] 10:12:38.292273 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 11
[pid 25579] 10:12:38.292319 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4) = 0
[pid 25579] 10:12:38.292371 alarm(300)  = 0
[pid 25579] 10:12:38.292411 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("68.232.141.57")}, 16 <unfinished ...>
[pid 25572] 10:12:38.304396 <... select resumed> ) = 1 (in [11], left {299, 957746})
[pid 25572] 10:12:38.304448 recvfrom(11, "250-s12p02m011.mxlogic.net\r\n250-SIZE 0\r\n250-STARTTLS\r\n250-SUBMITTER\r\n250-8BITMIME\r\n250 PIPELINING\r\n", 4096, 0, NULL, NULL) = 99
[pid 25572] 10:12:38.304519 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25572] 10:12:38.304585 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25566] 10:12:38.304645 <... select resumed> ) = 1 (in [11], left {299, 986970})
[pid 25566] 10:12:38.304678 read(11, "\27\3\3\0A", 5) = 5
[pid 25566] 10:12:38.304721 read(11, "\0\0\0\0\0\0\0\2d\244\215\306.\361\276+\"\331\17J\251\303\274>x jX\371\374\316&\30c\326\275\337\202\244\255\231\232b\310\361\371\201\217`\3242\326\2272\267I7N\"tj0H\343\10", 65) = 65
[pid 25566] 10:12:38.304788 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25573] 10:12:38.306308 <... select resumed> ) = 1 (in [11], left {299, 958270})
[pid 25573] 10:12:38.306341 recvfrom(11, "250-s12p02m065.mxlogic.net\r\n250-SIZE 0\r\n250-STARTTLS\r\n250-SUBMITTER\r\n250-8BITMIME\r\n250 PIPELINING\r\n", 4096, 0, NULL, NULL) = 99
[pid 25573] 10:12:38.306411 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25573] 10:12:38.306474 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25579] 10:12:38.342242 <... connect resumed> ) = 0
[pid 25579] 10:12:38.342303 alarm(0)    = 300
[pid 25579] 10:12:38.342355 getsockname(11, {sa_family=AF_INET, sin_port=htons(34064), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25579] 10:12:38.342425 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25579] 10:12:38.342472 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.342549 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25579] 10:12:38.342594 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.342645 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.342690 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1e000
[pid 25579] 10:12:38.342729 lseek(13, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.342770 read(13, "", 4096) = 0
[pid 25579] 10:12:38.342814 lseek(13, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.342847 read(13, "", 4096) = 0
[pid 25579] 10:12:38.342939 lseek(13, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.342979 read(13, "", 4096) = 0
[pid 25579] 10:12:38.343015 lseek(13, 0, SEEK_SET) = 0
[pid 25579] 10:12:38.343047 read(13, "", 4096) = 0
[pid 25579] 10:12:38.343096 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25572] 10:12:38.346813 <... select resumed> ) = 1 (in [11], left {299, 957805})
[pid 25572] 10:12:38.346850 recvfrom(11, "220 Ready to start TLS negotiation\r\n", 4096, 0, NULL, NULL) = 36
[pid 25573] 10:12:38.348838 <... select resumed> ) = 1 (in [11], left {299, 957675})
[pid 25572] 10:12:38.348854 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25573] 10:12:38.348882 recvfrom(11, "220 Ready to start TLS negotiation\r\n", 4096, 0, NULL, NULL) = 36
[pid 25573] 10:12:38.350889 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25573] 10:12:38.350952 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25573] 10:12:38.351008 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25573] 10:12:38.351051 read(14, "\30\321\272a\20\253\307\37\267\211h\310[\232\17\217\2554OA\3334n\33\270\225?\246C\212r\211\2679\357e\nfz;p\230\341\225\270\230 \207", 48) = 48
[pid 25573] 10:12:38.351094 close(14)   = 0
[pid 25573] 10:12:38.351144 getuid()    = 47
[pid 25572] 10:12:38.351807 <... open resumed> ) = 14
[pid 25572] 10:12:38.351840 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25572] 10:12:38.351894 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25572] 10:12:38.351935 read(14, "\310\316\276;\362\315\4Q\274\221\360\37\360e\366\277\204\1\326\315\361L\1\301\350\254\223\241U\257\310\367\2219T\243\305\253\331\334\370\326\375H\262\324\237V", 48) = 48
[pid 25572] 10:12:38.351977 close(14)   = 0
[pid 25572] 10:12:38.352023 getuid()    = 47
[pid 25558] 10:12:38.358066 <... fsync resumed> ) = 0
[pid 25558] 10:12:38.358111 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25558] 10:12:38.358168 alarm(60)   = 0
[pid 25558] 10:12:38.358203 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25558] 10:12:38.358243 alarm(0)    = 60
[pid 25558] 10:12:38.358295 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.358345 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25558] 10:12:38.358417 read(15, "cpu  123099 1342489 395298 67343105 2509 0 0 0\ncpu0 123099 1342489 395298 67343105 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58634042\nbtime 1450798266\nprocesses 893057\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25558] 10:12:38.358481 close(15)   = 0
[pid 25558] 10:12:38.358532 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25558] 10:12:38.358598 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25558] 10:12:38.358639 fcntl(15, F_GETFD) = 0
[pid 25558] 10:12:38.358671 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25558] 10:12:38.358704 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25558] 10:12:38.358819 close(15)   = 0
[pid 25558] 10:12:38.358868 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25558] 10:12:38.358911 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25558] 10:12:38.358982 brk(0x1a93000) = 0x1a93000
[pid 25558] 10:12:38.359123 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25558] 10:12:38.359168 fcntl(15, F_GETFD) = 0
[pid 25558] 10:12:38.359200 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25558] 10:12:38.359233 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25558] 10:12:38.359291 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25558] 10:12:38.359346 pread(15, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25558] 10:12:38.359417 close(15)   = 0
[pid 25558] 10:12:38.359484 close(14)   = 0
[pid 25558] 10:12:38.359538 write(11, "\27\3\1\0 \276\343H\n~J\233q\343\227\0055\360;\214\1\362\306\34q~@\30\22\177\325c\22\20W\17\257\27\3\1\0 \371\362\234.\r\365,\310M}\212\344\252\371U\212G\366<5\267\5\213\252\233\274e\300\241\324N\315", 74) = 74
[pid 25558] 10:12:38.359613 write(11, "\25\3\1\0 \264\201\274^]\246\271A\254\247\251\306\367\237\324\35\20=\202a\20\376H\350t\315:\3722\242Z\221", 37) = 37
[pid 25558] 10:12:38.359885 close(11)   = 0
[pid 25558] 10:12:38.359964 close(13)   = 0
[pid 25558] 10:12:38.360001 munmap(0x7f2e40b12000, 4096) = 0
[pid 25558] 10:12:38.360040 close(10)   = 0
[pid 25558] 10:12:38.360074 munmap(0x7f2e40b13000, 4096) = 0
[pid 25558] 10:12:38.360118 write(12, "S000004\27\f\0\0", 11) = 11
[pid 25522] 10:12:38.360154 <... select resumed> ) = 1 (in [11], left {59, 412144})
[pid 25558] 10:12:38.360195 write(12, "X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0", 196 <unfinished ...>
[pid 25522] 10:12:38.360206 read(11,  <unfinished ...>
[pid 25558] 10:12:38.360235 <... write resumed> ) = 196
[pid 25522] 10:12:38.360241 <... read resumed> "S000004\27\f\0\0", 16384) = 11
[pid 25558] 10:12:38.360353 write(12, "X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT\\nMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew\\nHhcNMTQwNDI4MTc0MzMzWhcNMTgwNDMwMDcxMjI1WjCBwDEpMCcGA1UEBRMgNkFL\\nWFplbXhIT2pMTUZWdHlVWF"..., 1888 <unfinished ...>
[pid 25522] 10:12:38.360365 wait4(-1,  <unfinished ...>
[pid 25558] 10:12:38.360398 <... write resumed> ) = 1888
[pid 25522] 10:12:38.360408 <... wait4 resumed> 0x7ffd5c5be400, WNOHANG, NULL) = 0
[pid 25558] 10:12:38.360440 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25522] 10:12:38.360449 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25558] 10:12:38.360477 <... write resumed> ) = 9
[pid 25522] 10:12:38.360483 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25558] 10:12:38.360510 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25522] 10:12:38.360519 read(11,  <unfinished ...>
[pid 25558] 10:12:38.360543 <... write resumed> ) = 11
[pid 25522] 10:12:38.360549 <... read resumed> "X100189TLSv1:AES256-SHA:256\0/serialNumber=6AKXZemxHOjLMFVtyUXXPPrdTpdzw3Bp/OU=GT21850092/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=mx1.emailsrvr.com\0X201881-----BEGIN CERTIFICATE-----\\nMIIFKDCCBBCgAwIBAgIDEn45"..., 16384) = 2093
[pid 25558] 10:12:38.360887 write(12, "A000096\0=\0\0\1\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 2A/D3-30194-67204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000", 103 <unfinished ...>
[pid 25522] 10:12:38.360904 wait4(-1,  <unfinished ...>
[pid 25558] 10:12:38.360945 <... write resumed> ) = 103
[pid 25522] 10:12:38.360952 <... wait4 resumed> 0x7ffd5c5be400, WNOHANG, NULL) = 0
[pid 25558] 10:12:38.360994 write(12, "I00002050.116.78.207\00052863\0", 27 <unfinished ...>
[pid 25522] 10:12:38.361004 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25558] 10:12:38.361042 <... write resumed> ) = 27
[pid 25522] 10:12:38.361049 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25558] 10:12:38.361077 write(12, "Z0000010", 8 <unfinished ...>
[pid 25522] 10:12:38.361085 read(11,  <unfinished ...>
[pid 25558] 10:12:38.361108 <... write resumed> ) = 8
[pid 25522] 10:12:38.361114 <... read resumed> "D000004\2\0\0\0A000096\0=\0\0\1\0\0\0\0\0\0\001250 2.0.0 Ok: queued as 2A/D3-30194-67204865\0\0mx1.emailsrvr.com\00098.129.185.131\0\31\0\0\0000I00002050.116.78.207\00052863\0", 16384) = 141
[pid 25558] 10:12:38.361142 close(12 <unfinished ...>
[pid 25522] 10:12:38.361149 wait4(-1,  <unfinished ...>
[pid 25558] 10:12:38.361172 <... close resumed> ) = 0
[pid 25522] 10:12:38.361178 <... wait4 resumed> 0x7ffd5c5be400, WNOHANG, NULL) = 0
[pid 25558] 10:12:38.361510 exit_group(0) = ?
[pid 25522] 10:12:38.361519 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25559] 10:12:38.361863 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25522] 10:12:38.361875 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25559] 10:12:38.361912 recvfrom(16,  <unfinished ...>
[pid 25522] 10:12:38.361920 read(11,  <unfinished ...>
[pid 25559] 10:12:38.361947 <... recvfrom resumed> "\267\356\201\200\0\1\0\3\0\0\0\0\22mcdowellmountaingc\3com\0\0\17\0\1\300\f\0\17\0\1\0\0008?\0\"\0\n\7d61171a\3ess\21barracudanetworks\300\37\300\f\0\17\0\1\0\0008?\0\f\0\24\7d61171b\300>\300\f\0\17\0\1\0\0008?\0\t\0\36\4mail\300\f", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 131
[pid 25522] 10:12:38.361962 <... read resumed> "Z0000010", 16384) = 8
[pid 25559] 10:12:38.362003 close(16 <unfinished ...>
[pid 25522] 10:12:38.362011 close(11 <unfinished ...>
[pid 25559] 10:12:38.362052 <... close resumed> ) = 0
[pid 25522] 10:12:38.362059 <... close resumed> ) = 0
[pid 25559] 10:12:38.362118 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25522] 10:12:38.362129 wait4(25558,  <unfinished ...>
[pid 25559] 10:12:38.362154 <... socket resumed> ) = 16
[pid 25559] 10:12:38.362173 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, 16) = 0
[pid 25559] 10:12:38.362215 poll([{fd=16, events=POLLOUT}], 1, 0) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25559] 10:12:38.362254 sendto(16, "\223\344\1\0\0\1\0\0\0\0\0\0\7d61171a\3ess\21barracudanetworks\3com\0\0\1\0\1", 51, MSG_NOSIGNAL, NULL, 0) = 51
[pid 25559] 10:12:38.362324 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25558] 10:12:38.362649 +++ exited with 0 +++
[pid 25522] 10:12:38.362681 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25558
[pid 25522] 10:12:38.362717 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.362856 write(8, "2015-12-30 10:12:38 ltoms@rmrcc.com: remote_smtp transport succeeded\n", 69) = 69
[pid 25522] 10:12:38.362918 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.362980 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.363031 close(7)    = 0
[pid 25522] 10:12:38.363069 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25522] 10:12:38.363114 fcntl(7, F_GETFD) = 0
[pid 25522] 10:12:38.363146 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:38.363178 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5389366, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.363223 write(7, "2015-12-30 10:12:38 [25522] 1aEJMa-0006dL-LG => ltoms@rmrcc.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3095 H=mx1.emailsrvr.com [98.129.185.131]:25 X=TLSv1:AES256-SHA:2"..., 500) = 500
[pid 25522] 10:12:38.363293 geteuid()   = 0
[pid 25522] 10:12:38.363326 getegid()   = 12
[pid 25522] 10:12:38.363360 setgid(12)  = 0
[pid 25522] 10:12:38.363394 setuid(47)  = 0
[pid 25522] 10:12:38.363431 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25522] 10:12:38.363484 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.363539 pipe([10, 11]) = 0
[pid 25522] 10:12:38.363576 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:38.363616 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f2e40afda90) = 25580
[pid 25522] 10:12:38.363926 close(10)   = 0
[pid 25522] 10:12:38.363962 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25522] 10:12:38.364006 fstat(11, {st_dev=makedev(0, 8), st_ino=2130170392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.364059 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:38.364098 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25522] 10:12:38.364201 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25522] 10:12:38.364251 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1055) = 1055
[pid 25522] 10:12:38.364304 lseek(6, 19, SEEK_SET) = 19
[pid 25522] 10:12:38.364340 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25522] 10:12:38.364403 read(6, "", 8192) = 0
[pid 25522] 10:12:38.364440 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dL-LG; Wed, 30 Dec 2015 10:12:36 -0600\nTo:  ltoms@rmrcc.co"..., 2415) = 2415
[pid 25522] 10:12:38.364495 write(11, "\n--1451491958-eximdsn-1537644243--\n", 35) = 35
[pid 25522] 10:12:38.364531 close(11)   = 0
[pid 25522] 10:12:38.364563 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:38.364604 wait4(25580,  <unfinished ...>
[pid 25573] 10:12:38.369463 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.369737 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.369794 <... open resumed> ) = 14
[pid 25573] 10:12:38.369824 fstat(14,  <unfinished ...>
[pid 25572] 10:12:38.369851 <... open resumed> ) = 14
[pid 25572] 10:12:38.369875 fstat(14,  <unfinished ...>
[pid 25573] 10:12:38.369896 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25573] 10:12:38.369952 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164f8000
[pid 25572] 10:12:38.369994 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25572] 10:12:38.370027 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.370049 read(14,  <unfinished ...>
[pid 25572] 10:12:38.370070 <... mmap resumed> ) = 0x7f33164f8000
[pid 25573] 10:12:38.370094 <... read resumed> "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25572] 10:12:38.370201 read(14, "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25573] 10:12:38.370265 read(14,  <unfinished ...>
[pid 25572] 10:12:38.370295 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25573] 10:12:38.370341 <... read resumed> "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25573] 10:12:38.370458 read(14,  <unfinished ...>
[pid 25572] 10:12:38.370552 read(14, "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25572] 10:12:38.370605 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25573] 10:12:38.370702 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25573] 10:12:38.370801 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25573] 10:12:38.370909 read(14,  <unfinished ...>
[pid 25572] 10:12:38.370957 read(14, " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25572] 10:12:38.371029 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25572] 10:12:38.371123 read(14,  <unfinished ...>
[pid 25573] 10:12:38.371146 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25573] 10:12:38.371178 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25573] 10:12:38.371264 read(14,  <unfinished ...>
[pid 25572] 10:12:38.371287 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25572] 10:12:38.371363 read(14,  <unfinished ...>
[pid 25573] 10:12:38.371387 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25573] 10:12:38.371462 read(14,  <unfinished ...>
[pid 25572] 10:12:38.371485 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25572] 10:12:38.371566 read(14,  <unfinished ...>
[pid 25573] 10:12:38.371589 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25573] 10:12:38.371675 read(14,  <unfinished ...>
[pid 25572] 10:12:38.371706 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25572] 10:12:38.371815 read(14,  <unfinished ...>
[pid 25573] 10:12:38.371844 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25573] 10:12:38.371878 read(14,  <unfinished ...>
[pid 25572] 10:12:38.371899 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25572] 10:12:38.371975 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372001 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25573] 10:12:38.372073 read(14,  <unfinished ...>
[pid 25572] 10:12:38.372097 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25572] 10:12:38.372168 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372191 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25573] 10:12:38.372261 read(14,  <unfinished ...>
[pid 25572] 10:12:38.372285 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25573] 10:12:38.372309 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25572] 10:12:38.372381 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372450 read(14, "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25572] 10:12:38.372492 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25572] 10:12:38.372564 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372630 read(14, "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25572] 10:12:38.372683 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25572] 10:12:38.372865 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372905 read(14,  <unfinished ...>
[pid 25572] 10:12:38.372928 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25572] 10:12:38.372960 read(14,  <unfinished ...>
[pid 25573] 10:12:38.372981 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25573] 10:12:38.373014 read(14,  <unfinished ...>
[pid 25572] 10:12:38.373035 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25572] 10:12:38.373130 read(14,  <unfinished ...>
[pid 25573] 10:12:38.373153 <... read resumed> "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25573] 10:12:38.373246 read(14,  <unfinished ...>
[pid 25572] 10:12:38.373269 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25573] 10:12:38.373293 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25572] 10:12:38.373359 read(14,  <unfinished ...>
[pid 25573] 10:12:38.373422 read(14, "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25572] 10:12:38.373464 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25573] 10:12:38.373496 read(14,  <unfinished ...>
[pid 25572] 10:12:38.373525 read(14,  <unfinished ...>
[pid 25573] 10:12:38.373546 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25572] 10:12:38.373575 <... read resumed> "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25572] 10:12:38.373680 read(14,  <unfinished ...>
[pid 25573] 10:12:38.373724 read(14,  <unfinished ...>
[pid 25572] 10:12:38.373822 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25572] 10:12:38.373902 read(14,  <unfinished ...>
[pid 25573] 10:12:38.373926 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25573] 10:12:38.373996 read(14,  <unfinished ...>
[pid 25572] 10:12:38.374020 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25573] 10:12:38.374044 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25572] 10:12:38.374114 read(14,  <unfinished ...>
[pid 25573] 10:12:38.374179 read(14, "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25572] 10:12:38.374220 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25573] 10:12:38.374285 read(14,  <unfinished ...>
[pid 25572] 10:12:38.374347 read(14, "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25573] 10:12:38.374389 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25572] 10:12:38.374431 read(14,  <unfinished ...>
[pid 25573] 10:12:38.374457 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25572] 10:12:38.374496 <... read resumed> "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25573] 10:12:38.374571 read(14,  <unfinished ...>
[pid 25572] 10:12:38.374649 read(14,  <unfinished ...>
[pid 25573] 10:12:38.374674 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25572] 10:12:38.374710 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25572] 10:12:38.374890 read(14,  <unfinished ...>
[pid 25573] 10:12:38.374948 read(14, "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25572] 10:12:38.374991 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25572] 10:12:38.375024 read(14,  <unfinished ...>
[pid 25573] 10:12:38.375052 read(14, "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25572] 10:12:38.375090 <... read resumed> "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25573] 10:12:38.375160 read(14,  <unfinished ...>
[pid 25572] 10:12:38.375229 read(14, ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25573] 10:12:38.375270 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25572] 10:12:38.375340 read(14,  <unfinished ...>
[pid 25573] 10:12:38.375407 read(14, "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25572] 10:12:38.375449 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25573] 10:12:38.375480 read(14,  <unfinished ...>
[pid 25572] 10:12:38.375507 read(14,  <unfinished ...>
[pid 25573] 10:12:38.375527 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25572] 10:12:38.375556 <... read resumed> "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25573] 10:12:38.375633 read(14,  <unfinished ...>
[pid 25572] 10:12:38.375721 read(14, "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25573] 10:12:38.375856 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25572] 10:12:38.375936 read(14,  <unfinished ...>
[pid 25573] 10:12:38.376006 read(14, "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25573] 10:12:38.376054 read(14,  <unfinished ...>
[pid 25572] 10:12:38.376075 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25572] 10:12:38.376104 read(14,  <unfinished ...>
[pid 25573] 10:12:38.376124 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25573] 10:12:38.376193 read(14,  <unfinished ...>
[pid 25572] 10:12:38.376215 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25572] 10:12:38.376284 read(14,  <unfinished ...>
[pid 25573] 10:12:38.376307 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25573] 10:12:38.376398 read(14,  <unfinished ...>
[pid 25572] 10:12:38.376423 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25572] 10:12:38.376487 read(14, ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25573] 10:12:38.376537 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25572] 10:12:38.376623 read(14, " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25572] 10:12:38.376914 read(14,  <unfinished ...>
[pid 25573] 10:12:38.376953 read(14, " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25573] 10:12:38.377066 read(14,  <unfinished ...>
[pid 25572] 10:12:38.377093 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25572] 10:12:38.377125 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25572] 10:12:38.377225 read(14,  <unfinished ...>
[pid 25573] 10:12:38.377248 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25573] 10:12:38.377279 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25573] 10:12:38.377376 read(14,  <unfinished ...>
[pid 25572] 10:12:38.377401 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25572] 10:12:38.377484 read(14,  <unfinished ...>
[pid 25573] 10:12:38.377510 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25573] 10:12:38.377592 read(14,  <unfinished ...>
[pid 25572] 10:12:38.377616 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25573] 10:12:38.377715 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25572] 10:12:38.377832 read(14,  <unfinished ...>
[pid 25573] 10:12:38.377919 read(14,  <unfinished ...>
[pid 25572] 10:12:38.378029 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25572] 10:12:38.378067 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25572] 10:12:38.378164 read(14,  <unfinished ...>
[pid 25573] 10:12:38.378189 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25573] 10:12:38.378221 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25573] 10:12:38.378302 read(14,  <unfinished ...>
[pid 25572] 10:12:38.378326 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25572] 10:12:38.378405 read(14,  <unfinished ...>
[pid 25573] 10:12:38.378429 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25573] 10:12:38.378509 read(14,  <unfinished ...>
[pid 25572] 10:12:38.378534 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25572] 10:12:38.378605 read(14,  <unfinished ...>
[pid 25573] 10:12:38.378631 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25573] 10:12:38.378709 read(14,  <unfinished ...>
[pid 25572] 10:12:38.378733 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25572] 10:12:38.378879 read(14,  <unfinished ...>
[pid 25573] 10:12:38.378908 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25573] 10:12:38.378994 read(14,  <unfinished ...>
[pid 25572] 10:12:38.379021 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25572] 10:12:38.379099 read(14,  <unfinished ...>
[pid 25573] 10:12:38.379122 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25573] 10:12:38.379196 read(14,  <unfinished ...>
[pid 25572] 10:12:38.379219 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25572] 10:12:38.379256 read(14, "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25572] 10:12:38.379303 read(14, "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25572] 10:12:38.379409 read(14,  <unfinished ...>
[pid 25573] 10:12:38.379433 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25573] 10:12:38.379464 read(14, "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25573] 10:12:38.379513 read(14, "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25573] 10:12:38.379618 read(14,  <unfinished ...>
[pid 25572] 10:12:38.379641 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25572] 10:12:38.379716 read(14,  <unfinished ...>
[pid 25573] 10:12:38.379738 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25573] 10:12:38.379906 read(14,  <unfinished ...>
[pid 25572] 10:12:38.379951 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25572] 10:12:38.380029 read(14, Process 25580 attached
 <unfinished ...>
[pid 25580] 10:12:38.380088 set_robust_list(0x7f2e40afdaa0, 24) = 0
[pid 25580] 10:12:38.380147 close(0 <unfinished ...>
[pid 25573] 10:12:38.380170 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25573] 10:12:38.380242 read(14,  <unfinished ...>
[pid 25572] 10:12:38.380265 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25572] 10:12:38.380344 read(14,  <unfinished ...>
[pid 25580] 10:12:38.380366 <... close resumed> ) = 0
[pid 25580] 10:12:38.380441 dup2(10, 0 <unfinished ...>
[pid 25573] 10:12:38.380466 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25573] 10:12:38.380555 read(14,  <unfinished ...>
[pid 25572] 10:12:38.380580 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25572] 10:12:38.380661 read(14,  <unfinished ...>
[pid 25580] 10:12:38.380683 <... dup2 resumed> ) = 0
[pid 25580] 10:12:38.380701 close(10)   = 0
[pid 25580] 10:12:38.380733 close(11)   = 0
[pid 25580] 10:12:38.380861 fstat(0, {st_dev=makedev(0, 8), st_ino=2130170392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.380914 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25580] 10:12:38.380960 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25573] 10:12:38.381037 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25580] 10:12:38.381068 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMa-0006dL-LG"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25573] 10:12:38.381235 read(14,  <unfinished ...>
[pid 25580] 10:12:38.381588 <... execve resumed> ) = 0
[pid 25572] 10:12:38.381616 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25572] 10:12:38.381706 read(14,  <unfinished ...>
[pid 25573] 10:12:38.381731 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25573] 10:12:38.381903 read(14,  <unfinished ...>
[pid 25572] 10:12:38.381951 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25572] 10:12:38.382024 read(14, "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25573] 10:12:38.382068 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25572] 10:12:38.382100 read(14,  <unfinished ...>
[pid 25573] 10:12:38.382161 read(14,  <unfinished ...>
[pid 25572] 10:12:38.382184 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25572] 10:12:38.382254 read(14,  <unfinished ...>
[pid 25573] 10:12:38.382277 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25573] 10:12:38.382310 read(14, "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25573] 10:12:38.382394 read(14,  <unfinished ...>
[pid 25572] 10:12:38.382417 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25572] 10:12:38.382484 brk(0x183e000 <unfinished ...>
[pid 25573] 10:12:38.382511 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25573] 10:12:38.382577 brk(0x183e000 <unfinished ...>
[pid 25572] 10:12:38.382601 <... brk resumed> ) = 0x183e000
[pid 25572] 10:12:38.382633 read(14, ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25572] 10:12:38.382735 read(14,  <unfinished ...>
[pid 25573] 10:12:38.382837 <... brk resumed> ) = 0x183e000
[pid 25573] 10:12:38.382913 read(14, ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25573] 10:12:38.383030 read(14,  <unfinished ...>
[pid 25572] 10:12:38.383057 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25572] 10:12:38.383122 read(14,  <unfinished ...>
[pid 25580] 10:12:38.383161 brk(0)      = 0x9aa000
[pid 25580] 10:12:38.383196 fcntl(0, F_GETFD) = 0
[pid 25580] 10:12:38.383228 fcntl(1, F_GETFD) = 0
[pid 25580] 10:12:38.383259 fcntl(2, F_GETFD) = 0
[pid 25580] 10:12:38.383295 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.383339 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25572] 10:12:38.383364 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25573] 10:12:38.383474 read(14,  <unfinished ...>
[pid 25572] 10:12:38.383559 read(14,  <unfinished ...>
[pid 25580] 10:12:38.383600 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eb0000
[pid 25580] 10:12:38.383653 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.383705 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.383730 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25580] 10:12:38.383830 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.383912 read(14,  <unfinished ...>
[pid 25572] 10:12:38.383936 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25572] 10:12:38.384013 read(14,  <unfinished ...>
[pid 25580] 10:12:38.384056 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384098 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384137 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384174 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384213 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384288 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384337 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25573] 10:12:38.384391 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25580] 10:12:38.384416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.384495 read(14,  <unfinished ...>
[pid 25580] 10:12:38.384532 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.384554 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25572] 10:12:38.384641 read(14,  <unfinished ...>
[pid 25580] 10:12:38.384665 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384716 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384845 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.384930 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.384988 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25580] 10:12:38.385017 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.385096 read(14,  <unfinished ...>
[pid 25580] 10:12:38.385125 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.385147 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25572] 10:12:38.385221 read(14,  <unfinished ...>
[pid 25580] 10:12:38.385242 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.385295 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385339 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385425 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385464 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385508 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fffbc561a60) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.385549 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25572] 10:12:38.385574 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25580] 10:12:38.385596 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.385708 read(14,  <unfinished ...>
[pid 25580] 10:12:38.385737 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.385847 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.385905 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25580] 10:12:38.385944 fstat(6,  <unfinished ...>
[pid 25573] 10:12:38.385998 read(14,  <unfinished ...>
[pid 25580] 10:12:38.386020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25580] 10:12:38.386073 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f4555ea6000
[pid 25580] 10:12:38.386112 close(6)    = 0
[pid 25580] 10:12:38.386154 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25572] 10:12:38.386199 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25572] 10:12:38.386280 read(14,  <unfinished ...>
[pid 25580] 10:12:38.386302 read(6,  <unfinished ...>
[pid 25573] 10:12:38.386323 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25580] 10:12:38.386347 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25573] 10:12:38.386423 read(14,  <unfinished ...>
[pid 25580] 10:12:38.386448 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.386498 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4555a78000
[pid 25580] 10:12:38.386547 mprotect(0x7f4555a8e000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.386583 mmap(0x7f4555c8e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f4555c8e000
[pid 25580] 10:12:38.386631 mmap(0x7f4555c90000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4555c90000
[pid 25572] 10:12:38.386720 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25573] 10:12:38.386827 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25572] 10:12:38.386913 read(14,  <unfinished ...>
[pid 25573] 10:12:38.386990 read(14,  <unfinished ...>
[pid 25580] 10:12:38.387017 close(6)    = 0
[pid 25580] 10:12:38.387080 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.387125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.387167 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.387207 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25580] 10:12:38.387235 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.387257 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25573] 10:12:38.387332 read(14,  <unfinished ...>
[pid 25572] 10:12:38.387408 read(14,  <unfinished ...>
[pid 25580] 10:12:38.387437 <... open resumed> ) = 6
[pid 25580] 10:12:38.387455 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.387496 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.387545 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ea5000
[pid 25580] 10:12:38.387585 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f455585f000
[pid 25580] 10:12:38.387626 mprotect(0x7f4555875000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.387671 mmap(0x7f4555a74000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f4555a74000
[pid 25580] 10:12:38.387726 mmap(0x7f4555a76000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.387848 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25572] 10:12:38.387887 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25580] 10:12:38.387930 <... mmap resumed> ) = 0x7f4555a76000
[pid 25573] 10:12:38.388015 read(14,  <unfinished ...>
[pid 25572] 10:12:38.388048 read(14,  <unfinished ...>
[pid 25580] 10:12:38.388073 close(6)    = 0
[pid 25572] 10:12:38.388108 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25580] 10:12:38.388138 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.388219 read(14,  <unfinished ...>
[pid 25580] 10:12:38.388245 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.388266 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.388308 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.388353 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25573] 10:12:38.388398 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25580] 10:12:38.388422 read(6,  <unfinished ...>
[pid 25573] 10:12:38.388450 read(14,  <unfinished ...>
[pid 25580] 10:12:38.388471 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.388497 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.388546 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25572] 10:12:38.388569 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25580] 10:12:38.388595 <... mmap resumed> ) = 0x7f4555628000
[pid 25573] 10:12:38.388626 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25573] 10:12:38.388829 read(14,  <unfinished ...>
[pid 25580] 10:12:38.388858 mprotect(0x7f455562f000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.388896 mmap(0x7f455582f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f455582f000
[pid 25580] 10:12:38.388952 mmap(0x7f4555831000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4555831000
[pid 25572] 10:12:38.389059 read(14,  <unfinished ...>
[pid 25580] 10:12:38.389089 close(6)    = 0
[pid 25580] 10:12:38.389133 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.389179 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25580] 10:12:38.389203 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.389293 read(14,  <unfinished ...>
[pid 25580] 10:12:38.389325 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.389345 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.389387 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25580] 10:12:38.389428 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.389468 fstat(6,  <unfinished ...>
[pid 25572] 10:12:38.389489 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25580] 10:12:38.389516 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25572] 10:12:38.389558 read(14,  <unfinished ...>
[pid 25580] 10:12:38.389578 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f45553a4000
[pid 25580] 10:12:38.389615 mprotect(0x7f4555427000, 2093056, PROT_NONE) = 0
[pid 25572] 10:12:38.389651 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25580] 10:12:38.389833 mmap(0x7f4555626000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f4555626000
[pid 25580] 10:12:38.389892 close(6 <unfinished ...>
[pid 25573] 10:12:38.389916 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25573] 10:12:38.389954 read(14,  <unfinished ...>
[pid 25580] 10:12:38.389981 <... close resumed> ) = 0
[pid 25580] 10:12:38.390006 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.390030 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25580] 10:12:38.390093 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.390176 read(14,  <unfinished ...>
[pid 25580] 10:12:38.390199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.390273 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.390333 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25580] 10:12:38.390445 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25572] 10:12:38.390513 read(14,  <unfinished ...>
[pid 25580] 10:12:38.390535 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25580] 10:12:38.390583 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ea4000
[pid 25580] 10:12:38.390635 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4555196000
[pid 25573] 10:12:38.390696 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25580] 10:12:38.390736 mprotect(0x7f45551a2000, 2097152, PROT_NONE <unfinished ...>
[pid 25573] 10:12:38.390790 read(14,  <unfinished ...>
[pid 25580] 10:12:38.390834 <... mprotect resumed> ) = 0
[pid 25572] 10:12:38.390871 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25572] 10:12:38.390907 read(14,  <unfinished ...>
[pid 25580] 10:12:38.390926 mmap(0x7f45553a2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f45553a2000
[pid 25573] 10:12:38.390967 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25572] 10:12:38.390991 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25580] 10:12:38.391022 close(6 <unfinished ...>
[pid 25573] 10:12:38.391148 read(14,  <unfinished ...>
[pid 25572] 10:12:38.391246 read(14,  <unfinished ...>
[pid 25580] 10:12:38.391269 <... close resumed> ) = 0
[pid 25580] 10:12:38.391297 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25580] 10:12:38.391345 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.391393 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25580] 10:12:38.391464 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4554f73000
[pid 25580] 10:12:38.391518 mprotect(0x7f4554f94000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.391579 mmap(0x7f4555194000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f4555194000
[pid 25572] 10:12:38.391647 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25580] 10:12:38.391691 close(6 <unfinished ...>
[pid 25573] 10:12:38.391899 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25580] 10:12:38.391950 <... close resumed> ) = 0
[pid 25580] 10:12:38.391982 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.392070 read(14,  <unfinished ...>
[pid 25580] 10:12:38.392099 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.392120 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.392162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.392225 read(14,  <unfinished ...>
[pid 25580] 10:12:38.392251 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.392273 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25580] 10:12:38.392313 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.392352 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.392402 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4554d56000
[pid 25580] 10:12:38.392440 mprotect(0x7f4554d6d000, 2097152, PROT_NONE) = 0
[pid 25573] 10:12:38.392478 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25580] 10:12:38.392505 mmap(0x7f4554f6d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25573] 10:12:38.392594 read(14,  <unfinished ...>
[pid 25572] 10:12:38.392617 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25580] 10:12:38.392652 <... mmap resumed> ) = 0x7f4554f6d000
[pid 25572] 10:12:38.392734 read(14,  <unfinished ...>
[pid 25580] 10:12:38.392840 mmap(0x7f4554f6f000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4554f6f000
[pid 25580] 10:12:38.392888 close(6)    = 0
[pid 25580] 10:12:38.392930 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.393000 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25580] 10:12:38.393026 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.393049 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25580] 10:12:38.393079 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.393198 read(14,  <unfinished ...>
[pid 25573] 10:12:38.393384 read(14,  <unfinished ...>
[pid 25580] 10:12:38.393424 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.393503 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25580] 10:12:38.393567 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.393632 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25580] 10:12:38.393713 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ea3000
[pid 25580] 10:12:38.393886 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f45549e2000
[pid 25580] 10:12:38.393979 mprotect(0x7f4554b51000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.394033 mmap(0x7f4554d50000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25572] 10:12:38.394074 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25572] 10:12:38.394447 read(14,  <unfinished ...>
[pid 25580] 10:12:38.394492 <... mmap resumed> ) = 0x7f4554d50000
[pid 25580] 10:12:38.394540 close(6)    = 0
[pid 25580] 10:12:38.394606 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.394692 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25580] 10:12:38.394812 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.394915 read(14,  <unfinished ...>
[pid 25580] 10:12:38.394947 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.394968 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.395037 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25580] 10:12:38.395081 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.395122 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25580] 10:12:38.395170 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4554753000
[pid 25580] 10:12:38.395208 mprotect(0x7f45547de000, 2097152, PROT_NONE) = 0
[pid 25572] 10:12:38.395247 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25580] 10:12:38.395270 mmap(0x7f45549de000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25572] 10:12:38.395363 read(14,  <unfinished ...>
[pid 25580] 10:12:38.395392 <... mmap resumed> ) = 0x7f45549de000
[pid 25580] 10:12:38.395418 mmap(0x7f45549e1000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.395442 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25573] 10:12:38.395535 read(14,  <unfinished ...>
[pid 25580] 10:12:38.395563 <... mmap resumed> ) = 0x7f45549e1000
[pid 25580] 10:12:38.395587 close(6)    = 0
[pid 25580] 10:12:38.395627 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.395670 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.395711 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.395836 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25572] 10:12:38.395887 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25572] 10:12:38.395966 read(14,  <unfinished ...>
[pid 25580] 10:12:38.396020 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.396079 fstat(6,  <unfinished ...>
[pid 25573] 10:12:38.396104 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25580] 10:12:38.396128 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25580] 10:12:38.396161 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25573] 10:12:38.396236 read(14,  <unfinished ...>
[pid 25580] 10:12:38.396263 <... mmap resumed> ) = 0x7f455454d000
[pid 25580] 10:12:38.396282 mprotect(0x7f4554553000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.396318 mmap(0x7f4554752000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f4554752000
[pid 25580] 10:12:38.396363 close(6)    = 0
[pid 25580] 10:12:38.396402 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.396446 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25580] 10:12:38.396469 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25572] 10:12:38.396589 read(14,  <unfinished ...>
[pid 25573] 10:12:38.396618 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25580] 10:12:38.396656 read(6,  <unfinished ...>
[pid 25573] 10:12:38.396722 read(14,  <unfinished ...>
[pid 25580] 10:12:38.396833 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.396870 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.396918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ea2000
[pid 25580] 10:12:38.396959 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4554217000
[pid 25580] 10:12:38.396996 mprotect(0x7f4554343000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.397032 mmap(0x7f4554543000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f4554543000
[pid 25580] 10:12:38.397075 mmap(0x7f455454c000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.397099 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25572] 10:12:38.397174 brk(0x185f000 <unfinished ...>
[pid 25580] 10:12:38.397204 <... mmap resumed> ) = 0x7f455454c000
[pid 25573] 10:12:38.397225 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25573] 10:12:38.397289 brk(0x185f000 <unfinished ...>
[pid 25580] 10:12:38.397316 close(6)    = 0
[pid 25580] 10:12:38.397360 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.397406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.397447 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.397489 <... brk resumed> ) = 0x185f000
[pid 25572] 10:12:38.397513 <... brk resumed> ) = 0x185f000
[pid 25572] 10:12:38.397548 read(14,  <unfinished ...>
[pid 25573] 10:12:38.397580 read(14,  <unfinished ...>
[pid 25580] 10:12:38.397602 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25573] 10:12:38.397646 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25580] 10:12:38.397669 read(6,  <unfinished ...>
[pid 25573] 10:12:38.397739 read(14,  <unfinished ...>
[pid 25580] 10:12:38.397851 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25572] 10:12:38.397879 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25580] 10:12:38.397902 fstat(6,  <unfinished ...>
[pid 25572] 10:12:38.397972 read(14,  <unfinished ...>
[pid 25580] 10:12:38.398017 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.398053 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4554013000
[pid 25580] 10:12:38.398093 mprotect(0x7f4554015000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.398128 mmap(0x7f4554215000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f4554215000
[pid 25580] 10:12:38.398176 close(6)    = 0
[pid 25580] 10:12:38.398217 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.398241 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25580] 10:12:38.398276 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.398355 read(14,  <unfinished ...>
[pid 25572] 10:12:38.398379 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25572] 10:12:38.398455 read(14,  <unfinished ...>
[pid 25580] 10:12:38.398477 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.398524 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.398564 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25580] 10:12:38.398605 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.398646 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25580] 10:12:38.398693 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4553e10000
[pid 25580] 10:12:38.398732 mprotect(0x7f4553e12000, 2093056, PROT_NONE <unfinished ...>
[pid 25572] 10:12:38.398861 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25580] 10:12:38.398892 <... mprotect resumed> ) = 0
[pid 25573] 10:12:38.398912 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25572] 10:12:38.398999 read(14,  <unfinished ...>
[pid 25573] 10:12:38.399106 read(14,  <unfinished ...>
[pid 25580] 10:12:38.399129 mmap(0x7f4554011000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f4554011000
[pid 25580] 10:12:38.399179 close(6)    = 0
[pid 25580] 10:12:38.399219 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.399263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.399305 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.399345 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25573] 10:12:38.399388 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25573] 10:12:38.399423 read(14,  <unfinished ...>
[pid 25572] 10:12:38.399444 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25580] 10:12:38.399472 read(6,  <unfinished ...>
[pid 25572] 10:12:38.399503 read(14,  <unfinished ...>
[pid 25580] 10:12:38.399524 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.399549 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25573] 10:12:38.399597 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25580] 10:12:38.399620 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.399705 read(14,  <unfinished ...>
[pid 25580] 10:12:38.399825 <... mmap resumed> ) = 0x7f4555ea1000
[pid 25572] 10:12:38.399853 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25580] 10:12:38.399881 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25572] 10:12:38.399958 read(14,  <unfinished ...>
[pid 25580] 10:12:38.399985 <... mmap resumed> ) = 0x7f4553a7c000
[pid 25580] 10:12:38.400027 mprotect(0x7f4553c06000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.400065 mmap(0x7f4553e06000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f4553e06000
[pid 25580] 10:12:38.400110 mmap(0x7f4553e0b000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4553e0b000
[pid 25580] 10:12:38.400154 close(6)    = 0
[pid 25580] 10:12:38.400198 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.400223 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25580] 10:12:38.400252 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.400273 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25573] 10:12:38.400350 read(14,  <unfinished ...>
[pid 25572] 10:12:38.400420 read(14,  <unfinished ...>
[pid 25580] 10:12:38.400442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.400485 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.400530 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25580] 10:12:38.400571 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.400615 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25580] 10:12:38.400662 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4553810000
[pid 25572] 10:12:38.400702 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25580] 10:12:38.400725 mprotect(0x7f4553872000, 2093056, PROT_NONE <unfinished ...>
[pid 25572] 10:12:38.400900 read(14,  <unfinished ...>
[pid 25573] 10:12:38.400929 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25573] 10:12:38.401000 read(14,  <unfinished ...>
[pid 25580] 10:12:38.401022 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.401040 mmap(0x7f4553a71000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f4553a71000
[pid 25580] 10:12:38.401089 close(6)    = 0
[pid 25580] 10:12:38.401134 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.401176 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.401224 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25573] 10:12:38.401294 read(14,  <unfinished ...>
[pid 25572] 10:12:38.401318 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25580] 10:12:38.401341 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25559] 10:12:38.401401 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25559] 10:12:38.401431 recvfrom(16, "\223\344\201\200\0\1\0\4\0\0\0\0\7d61171a\3ess\21barracudanetworks\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1,\0\4@\353\232i\300\f\0\1\0\1\0\0\1,\0\4@\353\226\374\300\f\0\1\0\1\0\0\1,\0\4@\353\232m\300\f\0\1\0\1\0\0\1,\0\4@\353\231\2", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("209.244.0.3")}, [16]) = 115
[pid 25559] 10:12:38.401485 close(16)   = 0
[pid 25559] 10:12:38.401560 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 16
[pid 25559] 10:12:38.401603 ioctl(16, SIOCGIFCONF, {160, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0", {AF_INET, inet_addr("127.0.0.1")}}, {"venet0:0", {AF_INET, inet_addr("50.116.78.207")}}, {"venet0:1", {AF_INET, inet_addr("50.116.78.206")}}}}) = 0
[pid 25559] 10:12:38.401651 ioctl(16, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid 25559] 10:12:38.401699 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25559] 10:12:38.401739 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25559] 10:12:38.401866 ioctl(16, SIOCGIFFLAGS, {ifr_name="venet0:1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_POINTOPOINT|IFF_RUNNING|IFF_NOARP}) = 0
[pid 25559] 10:12:38.401905 close(16)   = 0
[pid 25559] 10:12:38.401947 open("/proc/net/if_inet6", O_RDONLY) = 16
[pid 25559] 10:12:38.402037 fstat(16, {st_dev=makedev(144, 4282), st_ino=4027107667, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.402086 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3a000
[pid 25559] 10:12:38.402123 read(16, "00000000000000000000000000000001 01 80 10 80       lo\n", 1024) = 54
[pid 25559] 10:12:38.402183 read(16, "", 1024) = 0
[pid 25559] 10:12:38.402236 read(16,  <unfinished ...>
[pid 25566] 10:12:38.402273 <... select resumed> ) = 1 (in [11], left {299, 902552})
[pid 25559] 10:12:38.402286 <... read resumed> "", 1024) = 0
[pid 25566] 10:12:38.402317 read(11,  <unfinished ...>
[pid 25559] 10:12:38.402326 close(16 <unfinished ...>
[pid 25566] 10:12:38.402355 <... read resumed> "\27\3\3\0A", 5) = 5
[pid 25559] 10:12:38.402363 <... close resumed> ) = 0
[pid 25566] 10:12:38.402386 read(11,  <unfinished ...>
[pid 25559] 10:12:38.402393 munmap(0x7ff9b2d3a000, 4096 <unfinished ...>
[pid 25566] 10:12:38.402424 <... read resumed> "\0\0\0\0\0\0\0\3s\2\371\r\16\246\344Qo}\372\260\35\251\317\21Ro\210\216\302\330\31^\35\232$\0259\251\f(@U\347p\201\254\35>\310\355\247h\352\225\212XN\376)\220\327\351\205x\216", 65) = 65
[pid 25559] 10:12:38.402432 <... munmap resumed> ) = 0
[pid 25566] 10:12:38.402543 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25559] 10:12:38.402574 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25566] 10:12:38.402621 <... select resumed> ) = 1 (in [11], left {299, 999998})
[pid 25559] 10:12:38.402633 <... socket resumed> ) = 16
[pid 25566] 10:12:38.402657 read(11,  <unfinished ...>
[pid 25559] 10:12:38.402678 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16 <unfinished ...>
[pid 25566] 10:12:38.402718 <... read resumed> "\27\3\3\0B", 5) = 5
[pid 25559] 10:12:38.402734 <... connect resumed> ) = 0
[pid 25566] 10:12:38.402830 read(11,  <unfinished ...>
[pid 25559] 10:12:38.402855 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25566] 10:12:38.402893 <... read resumed> "\0\0\0\0\0\0\0\4\242\236\202\347\10\222\27~I7\217\206\215`\304\327\24\r\360x\322\237\373S\244\371\341\244\301\274\313\201\263y\\\306m\301\233\240\341\241| \343\324<\274\335\25\r\334\341\26@@\5r", 66) = 66
[pid 25559] 10:12:38.402910 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25566] 10:12:38.402982 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25559] 10:12:38.403008 sendto(16, "w\1\1\0\0\1\0\0\0\0\0\0\7d61171b\3ess\21barracudanetworks\3com\0\0\1\0\1", 51, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
[pid 25566] 10:12:38.403072 <... lseek resumed> ) = 19
[pid 25559] 10:12:38.403087 <... sendto resumed> ) = 51
[pid 25566] 10:12:38.403113 read(6,  <unfinished ...>
[pid 25559] 10:12:38.403135 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25566] 10:12:38.403174 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25566] 10:12:38.403208 read(6, "", 8192) = 0
[pid 25566] 10:12:38.403245 alarm(300)  = 0
[pid 25566] 10:12:38.403293 write(11, "\27\3\3\f;\306.g\244\374G\321\353\225\364\235wn\341GD{8\217\364\347\261\21\301(!c\266O\t\222y\2?=3\370\3766S\217\354\323\314a\366X\237\370\2412\216+\222+d\262K^\37\16Mg\221Z\246\275o>\350\334n\333\364h\270\27(\270%\227\203\363Nk\31\266*\34A\334\334m*\354GX\374e\r\354\257\315>\333\272?g'\206'\245J|_)\264\213\17\252\367\354\374\326\374L\356\352\200\306\25X\272\7%p\3\305\2303>\361\251\373eB\205\10\214{T\312\341\266)\320\376\1\313/\326\363\256\1\344L\0241\23\236H\26\3666\301P\300\225\10\363\374\17\371\207\244\352\261\255\264\32\217j\321[\201BY\201\0307]\274\210\201\v\v\211D\314+\242\216\350\313p\351\261;\336\224\f\242)\16=\35\243(\366\206|\257s\373#\226I\263Xe\22\255\\\243\342:\3\34=\205v"..., 3136) = 3136
[pid 25566] 10:12:38.403387 alarm(0)    = 300
[pid 25566] 10:12:38.403429 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25580] 10:12:38.403472 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.403497 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25580] 10:12:38.403544 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.403586 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25580] 10:12:38.403692 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f455342d000
[pid 25580] 10:12:38.403738 mprotect(0x7f45535e6000, 2093056, PROT_NONE) = 0
[pid 25573] 10:12:38.403870 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25573] 10:12:38.403958 read(14,  <unfinished ...>
[pid 25580] 10:12:38.403988 mmap(0x7f45537e5000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f45537e5000
[pid 25580] 10:12:38.404060 mmap(0x7f455380c000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f455380c000
[pid 25572] 10:12:38.404110 read(14,  <unfinished ...>
[pid 25580] 10:12:38.404145 close(6)    = 0
[pid 25572] 10:12:38.404180 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25580] 10:12:38.404214 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.404301 read(14,  <unfinished ...>
[pid 25580] 10:12:38.404334 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.404354 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.404401 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.404443 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25573] 10:12:38.404522 read(14,  <unfinished ...>
[pid 25580] 10:12:38.404555 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25580] 10:12:38.404610 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.404662 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25580] 10:12:38.404726 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.404838 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25580] 10:12:38.404867 <... mmap resumed> ) = 0x7f4555ea0000
[pid 25572] 10:12:38.404944 read(14,  <unfinished ...>
[pid 25580] 10:12:38.404977 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4553200000
[pid 25580] 10:12:38.405041 mprotect(0x7f455322c000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.405081 mmap(0x7f455342c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25573] 10:12:38.405112 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25580] 10:12:38.405141 <... mmap resumed> ) = 0x7f455342c000
[pid 25573] 10:12:38.405210 read(14,  <unfinished ...>
[pid 25580] 10:12:38.405262 close(6)    = 0
[pid 25580] 10:12:38.405307 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25572] 10:12:38.405358 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25572] 10:12:38.405429 read(14,  <unfinished ...>
[pid 25580] 10:12:38.405458 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.405503 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25580] 10:12:38.405554 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4552ffb000
[pid 25573] 10:12:38.405599 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25580] 10:12:38.405634 mprotect(0x7f4553000000, 2093056, PROT_NONE <unfinished ...>
[pid 25573] 10:12:38.405689 read(14,  <unfinished ...>
[pid 25580] 10:12:38.405724 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.405820 mmap(0x7f45531ff000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f45531ff000
[pid 25573] 10:12:38.405873 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25573] 10:12:38.405976 read(14,  <unfinished ...>
[pid 25580] 10:12:38.406013 close(6 <unfinished ...>
[pid 25572] 10:12:38.406063 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25572] 10:12:38.406099 read(14,  <unfinished ...>
[pid 25580] 10:12:38.406126 <... close resumed> ) = 0
[pid 25580] 10:12:38.406155 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.406186 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25572] 10:12:38.406283 read(14,  <unfinished ...>
[pid 25580] 10:12:38.406396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.406421 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.406467 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.406513 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25580] 10:12:38.406586 read(6,  <unfinished ...>
[pid 25573] 10:12:38.406630 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25580] 10:12:38.406657 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.406710 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25580] 10:12:38.406769 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4552df8000
[pid 25572] 10:12:38.406813 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25580] 10:12:38.406838 mprotect(0x7f4552dfa000, 2093056, PROT_NONE) = 0
[pid 25572] 10:12:38.406930 read(14,  <unfinished ...>
[pid 25573] 10:12:38.407019 read(14,  <unfinished ...>
[pid 25580] 10:12:38.407047 mmap(0x7f4552ff9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f4552ff9000
[pid 25580] 10:12:38.407104 close(6)    = 0
[pid 25580] 10:12:38.407149 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.407196 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25573] 10:12:38.407280 read(14,  <unfinished ...>
[pid 25580] 10:12:38.407310 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.407357 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25572] 10:12:38.407437 read(14,  <unfinished ...>
[pid 25580] 10:12:38.407466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.407513 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25580] 10:12:38.407557 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.407601 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.407664 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555e9f000
[pid 25580] 10:12:38.407717 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25573] 10:12:38.407860 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25573] 10:12:38.407973 read(14,  <unfinished ...>
[pid 25580] 10:12:38.408012 <... mmap resumed> ) = 0x7f4552bd5000
[pid 25572] 10:12:38.408033 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25580] 10:12:38.408058 mprotect(0x7f4552bec000, 2097152, PROT_NONE <unfinished ...>
[pid 25572] 10:12:38.408143 read(14,  <unfinished ...>
[pid 25580] 10:12:38.408175 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.408194 mmap(0x7f4552dec000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f4552dec000
[pid 25580] 10:12:38.408244 close(6)    = 0
[pid 25580] 10:12:38.408301 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.408348 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25580] 10:12:38.408378 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.408475 read(14,  <unfinished ...>
[pid 25580] 10:12:38.408514 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.408560 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25580] 10:12:38.408627 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25580] 10:12:38.408676 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.408718 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25580] 10:12:38.408851 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4552991000
[pid 25573] 10:12:38.408920 read(14,  <unfinished ...>
[pid 25572] 10:12:38.408951 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25572] 10:12:38.409068 read(14,  <unfinished ...>
[pid 25580] 10:12:38.409099 mprotect(0x7f45529d2000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.409138 mmap(0x7f4552bd2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f4552bd2000
[pid 25580] 10:12:38.409188 close(6 <unfinished ...>
[pid 25573] 10:12:38.409219 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25573] 10:12:38.409310 read(14,  <unfinished ...>
[pid 25580] 10:12:38.409339 <... close resumed> ) = 0
[pid 25580] 10:12:38.409366 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.409414 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.409457 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.409504 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.409538 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25580] 10:12:38.409569 <... open resumed> ) = 6
[pid 25572] 10:12:38.409597 read(14,  <unfinished ...>
[pid 25580] 10:12:38.409623 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25572] 10:12:38.409672 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25580] 10:12:38.409696 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25573] 10:12:38.409866 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25580] 10:12:38.409893 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.409929 read(14,  <unfinished ...>
[pid 25580] 10:12:38.409958 <... mmap resumed> ) = 0x7f4555e9e000
[pid 25580] 10:12:38.409983 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25573] 10:12:38.410049 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25580] 10:12:38.410079 <... mmap resumed> ) = 0x7f45526aa000
[pid 25573] 10:12:38.410155 read(14,  <unfinished ...>
[pid 25580] 10:12:38.410185 mprotect(0x7f4552785000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.410223 mmap(0x7f4552985000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25572] 10:12:38.410276 read(14,  <unfinished ...>
[pid 25580] 10:12:38.410307 <... mmap resumed> ) = 0x7f4552985000
[pid 25580] 10:12:38.410335 close(6)    = 0
[pid 25580] 10:12:38.410379 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.410413 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25572] 10:12:38.410445 read(14,  <unfinished ...>
[pid 25580] 10:12:38.410477 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.410500 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.410531 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25580] 10:12:38.410560 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.410628 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25573] 10:12:38.410664 read(14,  <unfinished ...>
[pid 25580] 10:12:38.410692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.410827 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.410865 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25573] 10:12:38.410945 read(14,  <unfinished ...>
[pid 25580] 10:12:38.410982 <... open resumed> ) = 6
[pid 25580] 10:12:38.411024 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25572] 10:12:38.411093 read(14,  <unfinished ...>
[pid 25580] 10:12:38.411122 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25580] 10:12:38.411172 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f45524a6000
[pid 25580] 10:12:38.411236 mprotect(0x7f45524a9000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.411278 mmap(0x7f45526a8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25572] 10:12:38.411309 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25580] 10:12:38.411338 <... mmap resumed> ) = 0x7f45526a8000
[pid 25572] 10:12:38.411370 read(14,  <unfinished ...>
[pid 25580] 10:12:38.411408 close(6 <unfinished ...>
[pid 25573] 10:12:38.411436 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25572] 10:12:38.411461 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25573] 10:12:38.411495 read(14,  <unfinished ...>
[pid 25572] 10:12:38.411583 read(14,  <unfinished ...>
[pid 25580] 10:12:38.411622 <... close resumed> ) = 0
[pid 25580] 10:12:38.411650 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.411692 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25580] 10:12:38.411722 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.411878 read(14,  <unfinished ...>
[pid 25580] 10:12:38.411916 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.411984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.412036 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25572] 10:12:38.412122 read(14,  <unfinished ...>
[pid 25580] 10:12:38.412154 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25580] 10:12:38.412197 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.412239 fstat(6,  <unfinished ...>
[pid 25573] 10:12:38.412266 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25580] 10:12:38.412290 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25573] 10:12:38.412381 read(14,  <unfinished ...>
[pid 25580] 10:12:38.412413 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f455227a000
[pid 25580] 10:12:38.412455 mprotect(0x7f45522a3000, 2097152, PROT_NONE) = 0
[pid 25580] 10:12:38.412495 mmap(0x7f45524a3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f45524a3000
[pid 25580] 10:12:38.412566 mmap(0x7f45524a5000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f45524a5000
[pid 25572] 10:12:38.412622 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25580] 10:12:38.412655 close(6 <unfinished ...>
[pid 25572] 10:12:38.412706 read(14,  <unfinished ...>
[pid 25580] 10:12:38.412732 <... close resumed> ) = 0
[pid 25580] 10:12:38.412848 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.412884 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25573] 10:12:38.412910 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25572] 10:12:38.413008 read(14,  <unfinished ...>
[pid 25573] 10:12:38.413048 read(14,  <unfinished ...>
[pid 25580] 10:12:38.413080 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.413100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.413130 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25580] 10:12:38.413165 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.413255 read(14,  <unfinished ...>
[pid 25580] 10:12:38.413284 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.413328 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25580] 10:12:38.413371 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.413413 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.413462 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555e9d000
[pid 25580] 10:12:38.413507 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4552064000
[pid 25580] 10:12:38.413549 mprotect(0x7f4552079000, 2093056, PROT_NONE) = 0
[pid 25572] 10:12:38.413592 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25580] 10:12:38.413681 mmap(0x7f4552278000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25573] 10:12:38.413717 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25573] 10:12:38.413897 brk(0x1880000 <unfinished ...>
[pid 25580] 10:12:38.413956 <... mmap resumed> ) = 0x7f4552278000
[pid 25580] 10:12:38.413989 close(6)    = 0
[pid 25580] 10:12:38.414046 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.414089 brk(0x1880000) = 0x1880000
[pid 25572] 10:12:38.414141 read(14,  <unfinished ...>
[pid 25573] 10:12:38.414171 <... brk resumed> ) = 0x1880000
[pid 25580] 10:12:38.414196 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.414231 read(14,  <unfinished ...>
[pid 25580] 10:12:38.414259 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.414304 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25580] 10:12:38.414329 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.414422 read(14,  <unfinished ...>
[pid 25573] 10:12:38.414450 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25580] 10:12:38.414480 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.414704 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25580] 10:12:38.414822 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.414871 fstat(6,  <unfinished ...>
[pid 25573] 10:12:38.414940 read(14,  <unfinished ...>
[pid 25580] 10:12:38.414990 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25580] 10:12:38.415026 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4551e59000
[pid 25580] 10:12:38.415070 mprotect(0x7f4551e63000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.415107 mmap(0x7f4552062000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f4552062000
[pid 25580] 10:12:38.415156 close(6 <unfinished ...>
[pid 25572] 10:12:38.415186 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25572] 10:12:38.415309 read(14,  <unfinished ...>
[pid 25580] 10:12:38.415342 <... close resumed> ) = 0
[pid 25573] 10:12:38.415362 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25580] 10:12:38.415396 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.415509 read(14,  <unfinished ...>
[pid 25580] 10:12:38.415543 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.415564 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.415614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.415667 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25580] 10:12:38.415722 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.415839 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.415895 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4551c56000
[pid 25580] 10:12:38.415940 mprotect(0x7f4551c58000, 2093056, PROT_NONE) = 0
[pid 25573] 10:12:38.415999 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25580] 10:12:38.416035 mmap(0x7f4551e57000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25573] 10:12:38.416077 read(14,  <unfinished ...>
[pid 25580] 10:12:38.416109 <... mmap resumed> ) = 0x7f4551e57000
[pid 25572] 10:12:38.416130 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25580] 10:12:38.416163 close(6 <unfinished ...>
[pid 25572] 10:12:38.416202 read(14,  <unfinished ...>
[pid 25573] 10:12:38.416230 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25580] 10:12:38.416253 <... close resumed> ) = 0
[pid 25573] 10:12:38.416328 read(14,  <unfinished ...>
[pid 25580] 10:12:38.416366 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.416397 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25572] 10:12:38.416470 read(14,  <unfinished ...>
[pid 25580] 10:12:38.416505 <... mmap resumed> ) = 0x7f4555e9c000
[pid 25580] 10:12:38.416541 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.416587 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.416636 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.416687 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25572] 10:12:38.416721 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25573] 10:12:38.416926 read(14,  <unfinished ...>
[pid 25580] 10:12:38.416963 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.417077 read(14,  <unfinished ...>
[pid 25580] 10:12:38.417111 <... open resumed> ) = 6
[pid 25580] 10:12:38.417130 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.417173 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.417229 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4551a37000
[pid 25580] 10:12:38.417272 mprotect(0x7f4551a54000, 2093056, PROT_NONE) = 0
[pid 25580] 10:12:38.417310 mmap(0x7f4551c53000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f4551c53000
[pid 25580] 10:12:38.417356 mmap(0x7f4551c55000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4551c55000
[pid 25580] 10:12:38.417404 close(6 <unfinished ...>
[pid 25573] 10:12:38.417434 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25580] 10:12:38.417458 <... close resumed> ) = 0
[pid 25580] 10:12:38.417518 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.417562 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25572] 10:12:38.417603 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25572] 10:12:38.417664 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25572] 10:12:38.417916 read(14,  <unfinished ...>
[pid 25580] 10:12:38.417974 <... mmap resumed> ) = 0x7f4555e9b000
[pid 25580] 10:12:38.418035 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.418122 read(14,  <unfinished ...>
[pid 25580] 10:12:38.418151 <... mmap resumed> ) = 0x7f4555e9a000
[pid 25580] 10:12:38.418180 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555e98000
[pid 25580] 10:12:38.418221 arch_prctl(ARCH_SET_FS, 0x7f4555e987c0) = 0
[pid 25580] 10:12:38.418297 mprotect(0x7f4551c53000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.418326 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25573] 10:12:38.418363 read(14,  <unfinished ...>
[pid 25572] 10:12:38.418394 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25572] 10:12:38.418427 read(14,  <unfinished ...>
[pid 25573] 10:12:38.418454 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25573] 10:12:38.418544 read(14,  <unfinished ...>
[pid 25572] 10:12:38.418575 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25580] 10:12:38.418660 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.418692 mprotect(0x7f4551e57000, 4096, PROT_READ) = 0
[pid 25580] 10:12:38.418818 mprotect(0x7f4552062000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.418877 read(14,  <unfinished ...>
[pid 25580] 10:12:38.418907 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.418936 mprotect(0x7f4552278000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.418986 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25573] 10:12:38.419068 read(14,  <unfinished ...>
[pid 25580] 10:12:38.419102 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.419135 mprotect(0x7f45524a3000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.419164 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25572] 10:12:38.419238 read(14,  <unfinished ...>
[pid 25580] 10:12:38.419269 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.419299 mprotect(0x7f45526a8000, 4096, PROT_READ) = 0
[pid 25580] 10:12:38.419448 mprotect(0x7f4552985000, 40960, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.419480 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25573] 10:12:38.419515 read(14,  <unfinished ...>
[pid 25572] 10:12:38.419544 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25572] 10:12:38.419574 read(14,  <unfinished ...>
[pid 25573] 10:12:38.419604 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25573] 10:12:38.419690 read(14,  <unfinished ...>
[pid 25572] 10:12:38.419721 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25572] 10:12:38.419879 read(14,  <unfinished ...>
[pid 25573] 10:12:38.419915 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25573] 10:12:38.419949 read(14,  <unfinished ...>
[pid 25572] 10:12:38.419977 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25572] 10:12:38.420030 read(14,  <unfinished ...>
[pid 25573] 10:12:38.420060 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25573] 10:12:38.420141 read(14,  <unfinished ...>
[pid 25572] 10:12:38.420173 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25572] 10:12:38.420244 read(14,  <unfinished ...>
[pid 25580] 10:12:38.420276 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.420378 mprotect(0x7f4552bd2000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.420411 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25573] 10:12:38.420446 read(14,  <unfinished ...>
[pid 25572] 10:12:38.420473 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25572] 10:12:38.420510 read(14,  <unfinished ...>
[pid 25573] 10:12:38.420539 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25572] 10:12:38.420625 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25572] 10:12:38.420705 read(14,  <unfinished ...>
[pid 25580] 10:12:38.420738 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.420855 mprotect(0x7f4552dec000, 4096, PROT_READ) = 0
[pid 25573] 10:12:38.420932 read(14,  <unfinished ...>
[pid 25580] 10:12:38.420985 mprotect(0x7f4552ff9000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.421051 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25572] 10:12:38.421138 read(14,  <unfinished ...>
[pid 25580] 10:12:38.421172 <... mprotect resumed> ) = 0
[pid 25573] 10:12:38.421193 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25573] 10:12:38.421268 read(14,  <unfinished ...>
[pid 25580] 10:12:38.421499 mprotect(0x7f45537e5000, 110592, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.421529 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25572] 10:12:38.421554 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25573] 10:12:38.421666 read(14,  <unfinished ...>
[pid 25572] 10:12:38.421715 read(14,  <unfinished ...>
[pid 25573] 10:12:38.421851 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25573] 10:12:38.421893 read(14,  <unfinished ...>
[pid 25572] 10:12:38.421922 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25572] 10:12:38.421975 read(14, "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25573] 10:12:38.422017 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25573] 10:12:38.422231 read(14, "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25573] 10:12:38.422329 read(14,  <unfinished ...>
[pid 25580] 10:12:38.422363 <... mprotect resumed> ) = 0
[pid 25572] 10:12:38.422383 read(14, "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25580] 10:12:38.422489 mprotect(0x7f4553a71000, 16384, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.422572 read(14,  <unfinished ...>
[pid 25573] 10:12:38.422604 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25573] 10:12:38.422695 read(14,  <unfinished ...>
[pid 25572] 10:12:38.422727 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25572] 10:12:38.422866 read(14,  <unfinished ...>
[pid 25580] 10:12:38.422902 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.423007 mprotect(0x7f4553e06000, 16384, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.423062 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25572] 10:12:38.423089 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25572] 10:12:38.423166 read(14,  <unfinished ...>
[pid 25573] 10:12:38.423246 read(14,  <unfinished ...>
[pid 25580] 10:12:38.423277 <... mprotect resumed> ) = 0
[pid 25572] 10:12:38.423300 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25580] 10:12:38.423336 mprotect(0x7f4554011000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.423366 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25573] 10:12:38.423440 read(14,  <unfinished ...>
[pid 25572] 10:12:38.423521 read(14,  <unfinished ...>
[pid 25580] 10:12:38.423552 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.423580 mprotect(0x7f4554215000, 4096, PROT_READ) = 0
[pid 25572] 10:12:38.423686 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25573] 10:12:38.423716 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25572] 10:12:38.423863 read(14,  <unfinished ...>
[pid 25573] 10:12:38.423962 read(14,  <unfinished ...>
[pid 25580] 10:12:38.424578 mprotect(0x7f4554f6d000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.424621 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25573] 10:12:38.424687 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25572] 10:12:38.424823 read(14,  <unfinished ...>
[pid 25573] 10:12:38.424880 read(14,  <unfinished ...>
[pid 25572] 10:12:38.424909 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25572] 10:12:38.425002 read(14,  <unfinished ...>
[pid 25573] 10:12:38.425034 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25573] 10:12:38.425101 read(14, "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25572] 10:12:38.425145 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25573] 10:12:38.425176 read(14,  <unfinished ...>
[pid 25572] 10:12:38.425209 read(14, ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25573] 10:12:38.425255 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25573] 10:12:38.425330 read(14,  <unfinished ...>
[pid 25572] 10:12:38.425409 read(14, "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25572] 10:12:38.425458 brk(0x18a1000 <unfinished ...>
[pid 25573] 10:12:38.425487 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25573] 10:12:38.425521 brk(0x18a1000 <unfinished ...>
[pid 25572] 10:12:38.425551 <... brk resumed> ) = 0x18a1000
[pid 25573] 10:12:38.425571 <... brk resumed> ) = 0x18a1000
[pid 25573] 10:12:38.425666 read(14,  <unfinished ...>
[pid 25572] 10:12:38.425734 read(14,  <unfinished ...>
[pid 25573] 10:12:38.425842 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25572] 10:12:38.425872 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25573] 10:12:38.425906 read(14,  <unfinished ...>
[pid 25572] 10:12:38.425940 read(14, "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25573] 10:12:38.425980 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25573] 10:12:38.426079 read(14,  <unfinished ...>
[pid 25572] 10:12:38.426163 read(14, ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25572] 10:12:38.426214 read(14, "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25572] 10:12:38.426305 read(14,  <unfinished ...>
[pid 25573] 10:12:38.426335 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25573] 10:12:38.426368 read(14, "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25573] 10:12:38.426467 read(14,  <unfinished ...>
[pid 25572] 10:12:38.426503 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25572] 10:12:38.426577 read(14,  <unfinished ...>
[pid 25573] 10:12:38.426618 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25572] 10:12:38.426681 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25573] 10:12:38.426734 read(14,  <unfinished ...>
[pid 25572] 10:12:38.426909 read(14,  <unfinished ...>
[pid 25573] 10:12:38.426959 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25573] 10:12:38.427044 read(14,  <unfinished ...>
[pid 25572] 10:12:38.427075 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25572] 10:12:38.427156 read(14,  <unfinished ...>
[pid 25580] 10:12:38.427189 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.427231 mprotect(0x7f45553a2000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.427261 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25573] 10:12:38.427345 read(14,  <unfinished ...>
[pid 25580] 10:12:38.427380 <... mprotect resumed> ) = 0
[pid 25572] 10:12:38.427401 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25572] 10:12:38.427435 read(14,  <unfinished ...>
[pid 25580] 10:12:38.427467 mprotect(0x7f4555626000, 4096, PROT_READ) = 0
[pid 25572] 10:12:38.427509 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25580] 10:12:38.427538 mprotect(0x7f455582f000, 4096, PROT_READ) = 0
[pid 25580] 10:12:38.427665 mprotect(0x7f4555a74000, 4096, PROT_READ <unfinished ...>
[pid 25573] 10:12:38.427702 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25573] 10:12:38.427736 read(14,  <unfinished ...>
[pid 25580] 10:12:38.427835 <... mprotect resumed> ) = 0
[pid 25573] 10:12:38.427860 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25573] 10:12:38.427962 read(14,  <unfinished ...>
[pid 25580] 10:12:38.428002 mprotect(0x7f4555c8e000, 4096, PROT_READ) = 0
[pid 25572] 10:12:38.428086 read(14,  <unfinished ...>
[pid 25580] 10:12:38.428143 mprotect(0x7f4555eb1000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.428172 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25572] 10:12:38.428204 read(14, "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25572] 10:12:38.428308 read(14,  <unfinished ...>
[pid 25580] 10:12:38.428341 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.428361 munmap(0x7f4555ea6000, 39387 <unfinished ...>
[pid 25573] 10:12:38.428390 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25580] 10:12:38.428422 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.428451 read(14,  <unfinished ...>
[pid 25580] 10:12:38.428478 set_tid_address(0x7f4555e98a90 <unfinished ...>
[pid 25573] 10:12:38.428509 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25580] 10:12:38.428532 <... set_tid_address resumed> ) = 25580
[pid 25580] 10:12:38.428551 set_robust_list(0x7f4555e98aa0, 24) = 0
[pid 25580] 10:12:38.428624 futex(0x7fffbc56235c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25580] 10:12:38.428664 futex(0x7fffbc56235c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f4555e987c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25580] 10:12:38.428717 rt_sigaction(SIGRTMIN, {0x7f4554d5bc60, [], SA_RESTORER|SA_SIGINFO, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.428837 rt_sigaction(SIGRT_1, {0x7f4554d5bcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.428880 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25573] 10:12:38.428953 read(14,  <unfinished ...>
[pid 25572] 10:12:38.428985 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25580] 10:12:38.429009 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25580] 10:12:38.429059 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25572] 10:12:38.429098 read(14,  <unfinished ...>
[pid 25580] 10:12:38.429124 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25572] 10:12:38.429147 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25580] 10:12:38.429208 statfs("/selinux",  <unfinished ...>
[pid 25572] 10:12:38.429294 read(14,  <unfinished ...>
[pid 25573] 10:12:38.429328 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25573] 10:12:38.429360 read(14, "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25580] 10:12:38.429409 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350311, f_bavail=6350311, f_files=1000000, f_ffree=691065, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25573] 10:12:38.429484 read(14,  <unfinished ...>
[pid 25580] 10:12:38.429568 brk(0 <unfinished ...>
[pid 25572] 10:12:38.429606 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25572] 10:12:38.429649 read(14, "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25573] 10:12:38.429823 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25580] 10:12:38.429858 <... brk resumed> ) = 0x9aa000
[pid 25573] 10:12:38.429889 read(14,  <unfinished ...>
[pid 25580] 10:12:38.429916 brk(0x9cb000) = 0x9cb000
[pid 25580] 10:12:38.429983 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.430016 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25573] 10:12:38.430093 read(14,  <unfinished ...>
[pid 25580] 10:12:38.430135 <... open resumed> ) = 6
[pid 25572] 10:12:38.430166 read(14,  <unfinished ...>
[pid 25580] 10:12:38.430205 fstat(6,  <unfinished ...>
[pid 25572] 10:12:38.430233 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25572] 10:12:38.430267 read(14,  <unfinished ...>
[pid 25580] 10:12:38.430294 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.430328 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eaf000
[pid 25580] 10:12:38.430369 read(6,  <unfinished ...>
[pid 25572] 10:12:38.430396 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25580] 10:12:38.430484 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25572] 10:12:38.430573 read(14,  <unfinished ...>
[pid 25573] 10:12:38.430609 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25573] 10:12:38.430655 read(14, "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25572] 10:12:38.430823 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25572] 10:12:38.430918 read(14,  <unfinished ...>
[pid 25580] 10:12:38.430959 read(6,  <unfinished ...>
[pid 25573] 10:12:38.431007 read(14,  <unfinished ...>
[pid 25580] 10:12:38.431034 <... read resumed> "", 1024) = 0
[pid 25580] 10:12:38.431060 close(6)    = 0
[pid 25573] 10:12:38.431100 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25573] 10:12:38.431182 read(14,  <unfinished ...>
[pid 25580] 10:12:38.431211 munmap(0x7f4555eaf000, 4096) = 0
[pid 25580] 10:12:38.431301 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25572] 10:12:38.431336 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25572] 10:12:38.431368 read(14, "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25572] 10:12:38.431469 read(14,  <unfinished ...>
[pid 25573] 10:12:38.431502 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25573] 10:12:38.431534 read(14,  <unfinished ...>
[pid 25580] 10:12:38.431569 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.431591 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25572] 10:12:38.431816 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25572] 10:12:38.431859 read(14,  <unfinished ...>
[pid 25573] 10:12:38.431906 read(14,  <unfinished ...>
[pid 25572] 10:12:38.431934 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25572] 10:12:38.432023 read(14,  <unfinished ...>
[pid 25573] 10:12:38.432074 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25580] 10:12:38.432106 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f4554d65790},  <unfinished ...>
[pid 25573] 10:12:38.432147 read(14,  <unfinished ...>
[pid 25580] 10:12:38.432173 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.432202 fstat(2,  <unfinished ...>
[pid 25573] 10:12:38.432230 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25573] 10:12:38.432370 read(14,  <unfinished ...>
[pid 25580] 10:12:38.432402 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25580] 10:12:38.432471 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f4554d65790},  <unfinished ...>
[pid 25572] 10:12:38.432510 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25572] 10:12:38.432592 read(14,  <unfinished ...>
[pid 25580] 10:12:38.432628 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.432662 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25580] 10:12:38.432705 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25580] 10:12:38.432819 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790},  <unfinished ...>
[pid 25573] 10:12:38.432860 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25580] 10:12:38.432886 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25573] 10:12:38.432987 read(14,  <unfinished ...>
[pid 25580] 10:12:38.433032 umask(0)    = 0
[pid 25580] 10:12:38.433108 geteuid( <unfinished ...>
[pid 25572] 10:12:38.433139 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25572] 10:12:38.433219 read(14,  <unfinished ...>
[pid 25580] 10:12:38.433251 <... geteuid resumed> ) = 0
[pid 25580] 10:12:38.433273 getuid()    = 47
[pid 25580] 10:12:38.433308 getgid()    = 12
[pid 25580] 10:12:38.433392 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25573] 10:12:38.433424 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25573] 10:12:38.433506 read(14,  <unfinished ...>
[pid 25572] 10:12:38.433538 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25572] 10:12:38.433626 read(14,  <unfinished ...>
[pid 25580] 10:12:38.433668 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25580] 10:12:38.433691 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25580] 10:12:38.433733 getgroups(65536, []) = 0
[pid 25573] 10:12:38.433839 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25580] 10:12:38.433871 setgroups(0, [] <unfinished ...>
[pid 25573] 10:12:38.433961 read(14,  <unfinished ...>
[pid 25580] 10:12:38.434012 <... setgroups resumed> ) = 0
[pid 25572] 10:12:38.434034 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25580] 10:12:38.434061 getegid( <unfinished ...>
[pid 25572] 10:12:38.434099 read(14,  <unfinished ...>
[pid 25580] 10:12:38.434124 <... getegid resumed> ) = 12
[pid 25580] 10:12:38.434143 geteuid()   = 0
[pid 25580] 10:12:38.434181 geteuid( <unfinished ...>
[pid 25572] 10:12:38.434209 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25580] 10:12:38.434232 <... geteuid resumed> ) = 0
[pid 25572] 10:12:38.434307 read(14,  <unfinished ...>
[pid 25580] 10:12:38.434336 getegid()   = 12
[pid 25580] 10:12:38.434371 setgid(12)  = 0
[pid 25580] 10:12:38.434409 setuid(0)   = 0
[pid 25580] 10:12:38.434493 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.434565 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25573] 10:12:38.434615 read(14, "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25573] 10:12:38.434715 read(14,  <unfinished ...>
[pid 25572] 10:12:38.434811 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25572] 10:12:38.434910 read(14,  <unfinished ...>
[pid 25580] 10:12:38.434967 <... open resumed> ) = 6
[pid 25580] 10:12:38.434997 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25580] 10:12:38.435052 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25580] 10:12:38.435099 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eaf000
[pid 25580] 10:12:38.435138 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25580] 10:12:38.435286 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25573] 10:12:38.435324 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25573] 10:12:38.435412 read(14,  <unfinished ...>
[pid 25572] 10:12:38.435443 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25572] 10:12:38.435530 read(14,  <unfinished ...>
[pid 25573] 10:12:38.435562 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25573] 10:12:38.435644 read(14,  <unfinished ...>
[pid 25572] 10:12:38.435674 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25572] 10:12:38.435739 brk(0x18c2000 <unfinished ...>
[pid 25580] 10:12:38.435858 <... socket resumed> ) = 7
[pid 25580] 10:12:38.435878 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.435930 close(7)    = 0
[pid 25580] 10:12:38.435987 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25572] 10:12:38.436022 <... brk resumed> ) = 0x18c2000
[pid 25573] 10:12:38.436043 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25580] 10:12:38.436070 <... socket resumed> ) = 7
[pid 25573] 10:12:38.436136 brk(0x18c2000 <unfinished ...>
[pid 25572] 10:12:38.436190 read(14,  <unfinished ...>
[pid 25580] 10:12:38.436216 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.436261 close(7)    = 0
[pid 25580] 10:12:38.436343 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25572] 10:12:38.436378 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25572] 10:12:38.436411 read(14, "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25572] 10:12:38.436512 read(14,  <unfinished ...>
[pid 25573] 10:12:38.436543 <... brk resumed> ) = 0x18c2000
[pid 25573] 10:12:38.436588 read(14,  <unfinished ...>
[pid 25580] 10:12:38.436622 <... open resumed> ) = 7
[pid 25580] 10:12:38.436645 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25573] 10:12:38.436715 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25580] 10:12:38.436739 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.436855 read(14,  <unfinished ...>
[pid 25580] 10:12:38.436888 <... mmap resumed> ) = 0x7f4555eae000
[pid 25572] 10:12:38.436903 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25580] 10:12:38.436927 read(7,  <unfinished ...>
[pid 25573] 10:12:38.437012 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25580] 10:12:38.437035 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25572] 10:12:38.437133 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437180 read(7,  <unfinished ...>
[pid 25573] 10:12:38.437206 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437232 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.437246 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25580] 10:12:38.437271 close(7 <unfinished ...>
[pid 25573] 10:12:38.437345 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25580] 10:12:38.437368 <... close resumed> ) = 0
[pid 25572] 10:12:38.437433 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437466 munmap(0x7f4555eae000, 4096 <unfinished ...>
[pid 25573] 10:12:38.437494 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437525 <... munmap resumed> ) = 0
[pid 25572] 10:12:38.437539 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25580] 10:12:38.437576 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.437621 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25580] 10:12:38.437643 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.437706 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437738 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.437858 read(14,  <unfinished ...>
[pid 25580] 10:12:38.437887 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.437908 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25580] 10:12:38.437933 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.438041 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25580] 10:12:38.438065 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.438089 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438118 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.438145 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438171 <... open resumed> ) = 7
[pid 25572] 10:12:38.438184 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25580] 10:12:38.438207 fstat(7,  <unfinished ...>
[pid 25573] 10:12:38.438280 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25580] 10:12:38.438303 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25572] 10:12:38.438379 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438410 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25573] 10:12:38.438438 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438479 <... mmap resumed> ) = 0x7f4555e8e000
[pid 25573] 10:12:38.438494 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25572] 10:12:38.438513 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25580] 10:12:38.438582 close(7 <unfinished ...>
[pid 25573] 10:12:38.438619 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438645 <... close resumed> ) = 0
[pid 25572] 10:12:38.438659 read(14,  <unfinished ...>
[pid 25580] 10:12:38.438697 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.438729 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25580] 10:12:38.438832 <... open resumed> ) = 7
[pid 25572] 10:12:38.438862 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25580] 10:12:38.438886 read(7,  <unfinished ...>
[pid 25573] 10:12:38.439060 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439090 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25572] 10:12:38.439111 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439140 fstat(7,  <unfinished ...>
[pid 25573] 10:12:38.439161 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25580] 10:12:38.439182 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25572] 10:12:38.439324 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25580] 10:12:38.439355 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25573] 10:12:38.439401 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439428 <... mmap resumed> ) = 0x7f4551829000
[pid 25572] 10:12:38.439442 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439469 mprotect(0x7f4551835000, 2097152, PROT_NONE <unfinished ...>
[pid 25573] 10:12:38.439495 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25580] 10:12:38.439521 <... mprotect resumed> ) = 0
[pid 25572] 10:12:38.439544 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25580] 10:12:38.439567 mmap(0x7f4551a35000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25573] 10:12:38.439672 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439704 <... mmap resumed> ) = 0x7f4551a35000
[pid 25572] 10:12:38.439719 read(14,  <unfinished ...>
[pid 25580] 10:12:38.439836 close(7 <unfinished ...>
[pid 25573] 10:12:38.439861 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25572] 10:12:38.439883 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25580] 10:12:38.439971 <... close resumed> ) = 0
[pid 25573] 10:12:38.440073 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440129 mprotect(0x7f4551a35000, 4096, PROT_READ <unfinished ...>
[pid 25572] 10:12:38.440155 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440189 <... mprotect resumed> ) = 0
[pid 25573] 10:12:38.440203 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25580] 10:12:38.440230 munmap(0x7f4555e8e000, 39387 <unfinished ...>
[pid 25572] 10:12:38.440329 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25580] 10:12:38.440354 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.440434 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440475 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.440504 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440531 <... open resumed> ) = 7
[pid 25573] 10:12:38.440544 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25580] 10:12:38.440572 fcntl(7, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.440663 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25580] 10:12:38.440686 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25573] 10:12:38.440847 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440887 fstat(7,  <unfinished ...>
[pid 25572] 10:12:38.440910 read(14,  <unfinished ...>
[pid 25580] 10:12:38.440936 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25573] 10:12:38.441034 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25580] 10:12:38.441065 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.441162 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25580] 10:12:38.441187 <... mmap resumed> ) = 0x7f4555eae000
[pid 25573] 10:12:38.441220 read(14,  <unfinished ...>
[pid 25580] 10:12:38.441250 read(7,  <unfinished ...>
[pid 25572] 10:12:38.441275 read(14,  <unfinished ...>
[pid 25580] 10:12:38.441301 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25573] 10:12:38.441319 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25580] 10:12:38.441360 close(7 <unfinished ...>
[pid 25572] 10:12:38.441401 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25580] 10:12:38.441429 <... close resumed> ) = 0
[pid 25573] 10:12:38.441523 read(14,  <unfinished ...>
[pid 25580] 10:12:38.441557 munmap(0x7f4555eae000, 4096 <unfinished ...>
[pid 25572] 10:12:38.441584 read(14,  <unfinished ...>
[pid 25580] 10:12:38.441610 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.441624 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25580] 10:12:38.441669 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25572] 10:12:38.441837 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25580] 10:12:38.441865 <... socket resumed> ) = 7
[pid 25573] 10:12:38.441969 read(14,  <unfinished ...>
[pid 25580] 10:12:38.442003 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25572] 10:12:38.442036 read(14,  <unfinished ...>
[pid 25580] 10:12:38.442063 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.442079 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25580] 10:12:38.442102 close(7 <unfinished ...>
[pid 25572] 10:12:38.442194 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25580] 10:12:38.442217 <... close resumed> ) = 0
[pid 25573] 10:12:38.442293 read(14,  <unfinished ...>
[pid 25580] 10:12:38.442324 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25572] 10:12:38.442350 read(14,  <unfinished ...>
[pid 25580] 10:12:38.442378 <... socket resumed> ) = 7
[pid 25573] 10:12:38.442392 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25580] 10:12:38.442430 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25572] 10:12:38.442524 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25566] 10:12:38.442543 <... select resumed> ) = 1 (in [11], left {599, 961038})
[pid 25580] 10:12:38.442639 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.442657 read(14,  <unfinished ...>
[pid 25572] 10:12:38.442681 read(14,  <unfinished ...>
[pid 25566] 10:12:38.442703 read(11,  <unfinished ...>
[pid 25580] 10:12:38.442734 close(7 <unfinished ...>
[pid 25573] 10:12:38.442838 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25572] 10:12:38.442866 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25566] 10:12:38.442949 <... read resumed> "\27\3\3\1k", 5) = 5
[pid 25580] 10:12:38.443055 <... close resumed> ) = 0
[pid 25573] 10:12:38.443074 read(14,  <unfinished ...>
[pid 25572] 10:12:38.443105 read(14,  <unfinished ...>
[pid 25566] 10:12:38.443128 read(11,  <unfinished ...>
[pid 25580] 10:12:38.443160 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.443189 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25572] 10:12:38.443208 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25566] 10:12:38.443279 <... read resumed> "\0\0\0\0\0\0\0\5\340\266\313\312l\3601\227\315d\274gk\274\334[\245\214y\270\27\372\2\323\342\177\255AX\330\300\5\31S\307|B\n\345q\335\235\245O\301\346\256\304`?\332\315\262PB<\270\220\f\224\353\f\237\33nu:\200y\34\224!D\253\225\10E\223\0\212\376^9\314PW\355\331\247\2074\306\241\277\242]\321\234\343\314RP?\240\33\213l^\370\243o\365!\3666~\"l\210\366\355\f\2067\200\33p\2\366\342\270\377D\366\27\376\311\310\0\306\373\325\201v\260\274\206h\203\343:\266NU\203\276&\2518\"\254V\nFX\22\301\271\rNi\226\325}k!p\310X\267\341\3072\255\337\373\377A \273RB\351W\240\rF\264|\303z\344E\336\244\264\255a\255\340\200\347\372=\206[\346pA\2014\no\312\217\200\221\20A\325\2738\377\226\222\206B\216C\245\247\5\6\240\201\221\345\24"..., 363) = 363
[pid 25580] 10:12:38.443404 <... open resumed> ) = 7
[pid 25573] 10:12:38.443428 read(14,  <unfinished ...>
[pid 25572] 10:12:38.443462 read(14,  <unfinished ...>
[pid 25566] 10:12:38.443486 write(11, "\27\3\3\0\36\306.g\244\374G\321\354\"{\25^\247\3477\335\325]\237k\373F\"\3673\207\341\321\206\270", 35 <unfinished ...>
[pid 25580] 10:12:38.443541 fstat(7,  <unfinished ...>
[pid 25573] 10:12:38.443565 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25572] 10:12:38.443583 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25566] 10:12:38.443666 <... write resumed> ) = 35
[pid 25580] 10:12:38.443709 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25573] 10:12:38.443739 read(14,  <unfinished ...>
[pid 25572] 10:12:38.443848 read(14,  <unfinished ...>
[pid 25566] 10:12:38.443871 write(11, "\25\3\3\0\32\306.g\244\374G\321\355\214\202\3k\275\246\244\330}\4\177\32\252\253\211\276\326#", 31 <unfinished ...>
[pid 25580] 10:12:38.443920 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.443947 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25572] 10:12:38.443974 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25566] 10:12:38.444024 <... write resumed> ) = 31
[pid 25580] 10:12:38.444137 <... mmap resumed> ) = 0x7f4555eae000
[pid 25573] 10:12:38.444159 read(14,  <unfinished ...>
[pid 25572] 10:12:38.444184 read(14,  <unfinished ...>
[pid 25566] 10:12:38.444206 close(11 <unfinished ...>
[pid 25580] 10:12:38.444261 read(7,  <unfinished ...>
[pid 25573] 10:12:38.444289 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25572] 10:12:38.444308 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25566] 10:12:38.444384 <... close resumed> ) = 0
[pid 25580] 10:12:38.444433 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25573] 10:12:38.444453 read(14,  <unfinished ...>
[pid 25572] 10:12:38.444490 read(14,  <unfinished ...>
[pid 25566] 10:12:38.444513 close(13 <unfinished ...>
[pid 25580] 10:12:38.444544 close(7 <unfinished ...>
[pid 25573] 10:12:38.444566 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25572] 10:12:38.444584 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25566] 10:12:38.444611 <... close resumed> ) = 0
[pid 25580] 10:12:38.444687 <... close resumed> ) = 0
[pid 25573] 10:12:38.444703 read(14,  <unfinished ...>
[pid 25572] 10:12:38.444727 read(14,  <unfinished ...>
[pid 25566] 10:12:38.444828 munmap(0x7f21d336c000, 4096 <unfinished ...>
[pid 25580] 10:12:38.444871 munmap(0x7f4555eae000, 4096 <unfinished ...>
[pid 25573] 10:12:38.444897 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25572] 10:12:38.444917 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25566] 10:12:38.444988 <... munmap resumed> ) = 0
[pid 25580] 10:12:38.445097 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.445115 read(14,  <unfinished ...>
[pid 25572] 10:12:38.445159 read(14,  <unfinished ...>
[pid 25566] 10:12:38.445183 close(10 <unfinished ...>
[pid 25580] 10:12:38.445220 read(6,  <unfinished ...>
[pid 25573] 10:12:38.445243 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25572] 10:12:38.445262 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25566] 10:12:38.445361 <... close resumed> ) = 0
[pid 25580] 10:12:38.445451 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25573] 10:12:38.445474 read(14,  <unfinished ...>
[pid 25572] 10:12:38.445537 brk(0x18e3000 <unfinished ...>
[pid 25566] 10:12:38.445561 munmap(0x7f21d336d000, 4096 <unfinished ...>
[pid 25580] 10:12:38.445594 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.445622 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25572] 10:12:38.445640 <... brk resumed> ) = 0x18e3000
[pid 25566] 10:12:38.445696 <... munmap resumed> ) = 0
[pid 25580] 10:12:38.445818 <... open resumed> ) = 7
[pid 25573] 10:12:38.445839 brk(0x18e3000 <unfinished ...>
[pid 25572] 10:12:38.445867 read(14,  <unfinished ...>
[pid 25566] 10:12:38.445892 write(12, "S000004#\f\0\0", 11 <unfinished ...>
[pid 25580] 10:12:38.445937 fstat(7,  <unfinished ...>
[pid 25573] 10:12:38.445960 <... brk resumed> ) = 0x18e3000
[pid 25572] 10:12:38.445973 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25566] 10:12:38.446007 <... write resumed> ) = 11
[pid 25529] 10:12:38.446043 <... select resumed> ) = 1 (in [11], left {59, 573456})
[pid 25580] 10:12:38.446093 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25573] 10:12:38.446126 read(14,  <unfinished ...>
[pid 25572] 10:12:38.446151 read(14,  <unfinished ...>
[pid 25566] 10:12:38.446173 write(12, "X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 113 <unfinished ...>
[pid 25529] 10:12:38.446199 read(11,  <unfinished ...>
[pid 25580] 10:12:38.446233 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.446259 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25572] 10:12:38.446278 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25566] 10:12:38.446306 <... write resumed> ) = 113
[pid 25529] 10:12:38.446437 <... read resumed> "S000004#\f\0\0X100106TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128\0/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com\0", 16384) = 124
[pid 25580] 10:12:38.446480 <... mmap resumed> ) = 0x7f4555eae000
[pid 25573] 10:12:38.446497 read(14,  <unfinished ...>
[pid 25572] 10:12:38.446522 read(14,  <unfinished ...>
[pid 25566] 10:12:38.446545 write(12, "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 2404 <unfinished ...>
[pid 25529] 10:12:38.446573 wait4(-1,  <unfinished ...>
[pid 25580] 10:12:38.446603 read(7,  <unfinished ...>
[pid 25573] 10:12:38.446629 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25572] 10:12:38.446646 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25566] 10:12:38.446717 <... write resumed> ) = 2404
[pid 25529] 10:12:38.446891 <... wait4 resumed> 0x7ffce2d040b0, WNOHANG, NULL) = 0
[pid 25580] 10:12:38.446943 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25573] 10:12:38.446967 read(14,  <unfinished ...>
[pid 25572] 10:12:38.446996 read(14,  <unfinished ...>
[pid 25566] 10:12:38.447018 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25529] 10:12:38.447043 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25580] 10:12:38.447079 close(7 <unfinished ...>
[pid 25573] 10:12:38.447102 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25572] 10:12:38.447120 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25566] 10:12:38.447203 <... write resumed> ) = 9
[pid 25529] 10:12:38.447278 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25580] 10:12:38.447310 <... close resumed> ) = 0
[pid 25573] 10:12:38.447324 read(14,  <unfinished ...>
[pid 25572] 10:12:38.447348 read(14,  <unfinished ...>
[pid 25566] 10:12:38.447385 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25529] 10:12:38.447412 read(11,  <unfinished ...>
[pid 25580] 10:12:38.447453 munmap(0x7f4555eae000, 4096 <unfinished ...>
[pid 25573] 10:12:38.447480 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25572] 10:12:38.447499 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25566] 10:12:38.447576 <... write resumed> ) = 11
[pid 25529] 10:12:38.447684 <... read resumed> "X202397-----BEGIN CERTIFICATE-----\\nMIIGoTCCBYmgAwIBAgIIUu/z4BIPtgQwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE\\nBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl\\ncm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTgyODEyWhcNMTYwMzA5MDAwMDAw\\nWjBnMQswCQYDVQQGEwJVUz"..., 16384) = 2424
[pid 25580] 10:12:38.448059 <... munmap resumed> ) = 0
[pid 25573] 10:12:38.448083 read(14,  <unfinished ...>
[pid 25572] 10:12:38.448122 read(14,  <unfinished ...>
[pid 25566] 10:12:38.448146 write(12, "A000451\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 458 <unfinished ...>
[pid 25529] 10:12:38.448174 wait4(-1,  <unfinished ...>
[pid 25580] 10:12:38.448205 read(6,  <unfinished ...>
[pid 25573] 10:12:38.448227 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25572] 10:12:38.448245 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25566] 10:12:38.448337 <... write resumed> ) = 458
[pid 25529] 10:12:38.448442 <... wait4 resumed> 0x7ffce2d040b0, WNOHANG, NULL) = 0
[pid 25580] 10:12:38.448473 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25573] 10:12:38.448492 read(14,  <unfinished ...>
[pid 25572] 10:12:38.448537 read(14,  <unfinished ...>
[pid 25566] 10:12:38.448559 write(12, "I00002050.116.78.207\00049100\0", 27 <unfinished ...>
[pid 25529] 10:12:38.448585 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25580] 10:12:38.448620 uname( <unfinished ...>
[pid 25573] 10:12:38.448642 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25572] 10:12:38.448659 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25566] 10:12:38.448824 <... write resumed> ) = 27
[pid 25529] 10:12:38.448933 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25580] 10:12:38.448966 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25573] 10:12:38.448984 read(14,  <unfinished ...>
[pid 25572] 10:12:38.449067 read(14,  <unfinished ...>
[pid 25566] 10:12:38.449092 write(12, "Z0000010", 8 <unfinished ...>
[pid 25529] 10:12:38.449117 read(11,  <unfinished ...>
[pid 25580] 10:12:38.449148 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0},  <unfinished ...>
[pid 25573] 10:12:38.449175 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25572] 10:12:38.449202 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25566] 10:12:38.449303 <... write resumed> ) = 8
[pid 25529] 10:12:38.449386 <... read resumed> "A000451\2\0\0\0M\0\0\0\0\0\0\3SMTP error from remote mail server after end of data: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's\\n550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if\\n550-5.7.1 this was a legit"..., 16384) = 493
[pid 25580] 10:12:38.449429 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, 8) = 0
[pid 25573] 10:12:38.449453 read(14,  <unfinished ...>
[pid 25572] 10:12:38.449488 read(14,  <unfinished ...>
[pid 25566] 10:12:38.449512 close(12 <unfinished ...>
[pid 25529] 10:12:38.449535 close(11 <unfinished ...>
[pid 25580] 10:12:38.449569 clone( <unfinished ...>
[pid 25573] 10:12:38.449860 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25572] 10:12:38.449887 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25566] 10:12:38.449964 <... close resumed> ) = 0
[pid 25529] 10:12:38.450377 <... close resumed> ) = 0
[pid 25573] 10:12:38.450424 read(14,  <unfinished ...>
[pid 25572] 10:12:38.450451 read(14,  <unfinished ...>
[pid 25566] 10:12:38.450473 exit_group(0) = ?
[pid 25529] 10:12:38.451023 wait4(25566,  <unfinished ...>
[pid 25580] 10:12:38.451076 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f4555e98a90) = 25581
[pid 25573] 10:12:38.451095 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25572] 10:12:38.451140 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25566] 10:12:38.451236 +++ exited with 0 +++
[pid 25529] 10:12:38.451317 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25566
[pid 25580] 10:12:38.451367 wait4(25581,  <unfinished ...>
[pid 25573] 10:12:38.451394 read(14,  <unfinished ...>
[pid 25572] 10:12:38.451428 read(14,  <unfinished ...>
[pid 25529] 10:12:38.451452 stat("/etc/localtime",  <unfinished ...>
[pid 25573] 10:12:38.451485 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25572] 10:12:38.451503 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25529] 10:12:38.451586 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25573] 10:12:38.451714 read(14,  <unfinished ...>
[pid 25572] 10:12:38.451809 read(14,  <unfinished ...>
[pid 25529] 10:12:38.451840 write(8, "2015-12-30 10:12:38 antiquewedding@gmail.com F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=gmail-smtp-in.l.google.com [173.194.64.27]:25 X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes DN=\"/C="..., 713 <unfinished ...>
[pid 25573] 10:12:38.451879 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25572] 10:12:38.451897 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25529] 10:12:38.451998 <... write resumed> ) = 713
[pid 25573] 10:12:38.452149 read(14,  <unfinished ...>
[pid 25572] 10:12:38.452176 read(14,  <unfinished ...>
[pid 25529] 10:12:38.452199 stat("/etc/localtime",  <unfinished ...>
[pid 25573] 10:12:38.452231 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25572] 10:12:38.452249 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25529] 10:12:38.452382 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25573] 10:12:38.452506 read(14,  <unfinished ...>
[pid 25572] 10:12:38.452535 read(14,  <unfinished ...>
[pid 25529] 10:12:38.452559 stat("/etc/localtime",  <unfinished ...>
[pid 25573] 10:12:38.452590 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25572] 10:12:38.452609 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25529] 10:12:38.452696 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25573] 10:12:38.452882 read(14,  <unfinished ...>
[pid 25572] 10:12:38.452914 read(14,  <unfinished ...>
[pid 25529] 10:12:38.452957 close(7 <unfinished ...>
[pid 25573] 10:12:38.452991 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25572] 10:12:38.453010 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25529] 10:12:38.453095 <... close resumed> ) = 0
[pid 25573] 10:12:38.453208 read(14,  <unfinished ...>
[pid 25572] 10:12:38.453234 read(14,  <unfinished ...>
[pid 25529] 10:12:38.453257 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25573] 10:12:38.453297 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25572] 10:12:38.453317 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25529] 10:12:38.453441 <... open resumed> ) = 7
[pid 25573] 10:12:38.453512 read(14,  <unfinished ...>
[pid 25572] 10:12:38.453538 read(14,  <unfinished ...>
[pid 25529] 10:12:38.453561 fcntl(7, F_GETFD <unfinished ...>
[pid 25573] 10:12:38.453592 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25572] 10:12:38.453611 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25529] 10:12:38.453672 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.453814 read(14,  <unfinished ...>
[pid 25572] 10:12:38.453848 read(14,  <unfinished ...>
[pid 25529] 10:12:38.453871 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.453900 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25572] 10:12:38.453918 <... read resumed> "", 4096) = 0
[pid 25529] 10:12:38.454009 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.454051 read(14,  <unfinished ...>
[pid 25572] 10:12:38.454075 close(14 <unfinished ...>
[pid 25529] 10:12:38.454098 fstat(7,  <unfinished ...>
[pid 25573] 10:12:38.454125 <... read resumed> "", 4096) = 0
[pid 25572] 10:12:38.454139 <... close resumed> ) = 0
[pid 25529] 10:12:38.454161 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10536, st_size=5389866, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25573] 10:12:38.454199 close(14 <unfinished ...>
[pid 25572] 10:12:38.454225 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25529] 10:12:38.454252 write(7, "2015-12-30 10:12:38 [25529] 1aEJMb-0006df-04 ** antiquewedding@gmail.com F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp H=gmail-smtp-in.l.google.com [173.194.64.27]:25 X=TLSv1.2:ECDHE-RSA-AES128-G"..., 741 <unfinished ...>
[pid 25573] 10:12:38.454295 <... close resumed> ) = 0
[pid 25572] 10:12:38.454309 <... munmap resumed> ) = 0
[pid 25529] 10:12:38.454324 <... write resumed> ) = 741
[pid 25573] 10:12:38.455178 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25572] 10:12:38.455217 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25529] 10:12:38.455247 geteuid( <unfinished ...>
[pid 25573] 10:12:38.455275 <... munmap resumed> ) = 0
[pid 25529] 10:12:38.455289 <... geteuid resumed> ) = 0
[pid 25529] 10:12:38.455308 getegid()   = 12
[pid 25529] 10:12:38.455344 setgid(12)  = 0
[pid 25573] 10:12:38.456261 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.456310 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25529] 10:12:38.456335 setuid(47 <unfinished ...>
[pid 25559] 10:12:38.456366 recvfrom(16,  <unfinished ...>
[pid 25529] 10:12:38.456395 <... setuid resumed> ) = 0
[pid 25559] 10:12:38.456419 <... recvfrom resumed> "w\1\201\200\0\1\0\4\0\0\0\0\7d61171b\3ess\21barracudanetworks\3com\0\0\1\0\1\300\f\0\1\0\1\0\0\1+\0\4@\353\232m\300\f\0\1\0\1\0\0\1+\0\4@\353\231\2\300\f\0\1\0\1\0\0\1+\0\4@\353\226\374\300\f\0\1\0\1\0\0\1+\0\4@\353\232i", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 115
[pid 25529] 10:12:38.456452 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:38.456485 close(16 <unfinished ...>
[pid 25529] 10:12:38.456514 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:38.456546 <... close resumed> ) = 0
[pid 25529] 10:12:38.456630 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:38.456667 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP <unfinished ...>
[pid 25529] 10:12:38.456695 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.456739 <... socket resumed> ) = 16
[pid 25529] 10:12:38.456824 pipe( <unfinished ...>
[pid 25559] 10:12:38.456859 connect(16, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, 16 <unfinished ...>
[pid 25529] 10:12:38.456892 <... pipe resumed> [10, 11]) = 0
[pid 25559] 10:12:38.456913 <... connect resumed> ) = 0
[pid 25529] 10:12:38.456943 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0},  <unfinished ...>
[pid 25559] 10:12:38.457000 poll([{fd=16, events=POLLOUT}], 1, 0 <unfinished ...>
[pid 25529] 10:12:38.457046 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25559] 10:12:38.457092 <... poll resumed> ) = 1 ([{fd=16, revents=POLLOUT}])
[pid 25529] 10:12:38.457127 clone( <unfinished ...>
[pid 25559] 10:12:38.457465 sendto(16, "\27\236\1\0\0\1\0\0\0\0\0\0\4mail\22mcdowellmountaingc\3com\0\0\1\0\1", 45, MSG_NOSIGNAL, NULL, 0) = 45
[pid 25529] 10:12:38.457552 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f21d3357a90) = 25582
[pid 25559] 10:12:38.457596 poll([{fd=16, events=POLLIN}], 1, 1000 <unfinished ...>
[pid 25529] 10:12:38.457626 close(10)   = 0
[pid 25529] 10:12:38.457660 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25529] 10:12:38.457701 fstat(11, {st_dev=makedev(0, 8), st_ino=2130170492, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25529] 10:12:38.457815 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336d000
[pid 25529] 10:12:38.457858 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25529] 10:12:38.457997 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25529] 10:12:38.458054 write(11, "X-Failed-Recipients: antiquewedding@gmail.com,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; "..., 2057) = 2057
[pid 25529] 10:12:38.458115 lseek(6, 19, SEEK_SET) = 19
[pid 25529] 10:12:38.458152 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25529] 10:12:38.458204 read(6, "", 8192) = 0
[pid 25529] 10:12:38.458238 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006df-04; Wed, 30 Dec 2015 10:12:37 -0600\nTo:  antiquewedding"..., 2427) = 2427
[pid 25529] 10:12:38.458278 write(11, "\n--1451491958-eximdsn-686915313--\n", 34) = 34
[pid 25529] 10:12:38.458313 close(11)   = 0
[pid 25529] 10:12:38.458347 munmap(0x7f21d336d000, 4096) = 0
[pid 25529] 10:12:38.458389 wait4(25582,  <unfinished ...>
[pid 25573] 10:12:38.458441 <... open resumed> ) = 14
[pid 25572] 10:12:38.458456 <... open resumed> ) = 14
[pid 25573] 10:12:38.458479 fstat(14,  <unfinished ...>
[pid 25572] 10:12:38.458504 fstat(14,  <unfinished ...>
[pid 25573] 10:12:38.458534 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25572] 10:12:38.458561 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25573] 10:12:38.458594 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25572] 10:12:38.458617 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25573] 10:12:38.458649 <... mmap resumed> ) = 0x7f33164f8000
[pid 25572] 10:12:38.458663 <... mmap resumed> ) = 0x7f33164f8000
[pid 25573] 10:12:38.458691 read(14,  <unfinished ...>
[pid 25572] 10:12:38.458733 read(14,  <unfinished ...>
[pid 25573] 10:12:38.458918 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          234880 kB\nCached:           337436 kB\nBuffers:               0 kB\nActive:           313500 kB\nInactive:         468000 kB\nActive(anon):     174264 kB\nInactive(anon):   277604 kB\nActive(file):     139236 kB\nInac"..., 1024) = 588
[pid 25573] 10:12:38.458989 close(14 <unfinished ...>
[pid 25572] 10:12:38.459014 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          234872 kB\nCached:           337436 kB\nBuffers:               0 kB\nActive:           313500 kB\nInactive:         468000 kB\nActive(anon):     174264 kB\nInactive(anon):   277604 kB\nActive(file):     139236 kB\nInac"..., 1024) = 588
[pid 25573] 10:12:38.459051 <... close resumed> ) = 0
[pid 25572] 10:12:38.459066 close(14 <unfinished ...>
[pid 25573] 10:12:38.459098 munmap(0x7f33164f8000, 4096 <unfinished ...>
[pid 25572] 10:12:38.459118 <... close resumed> ) = 0
[pid 25573] 10:12:38.459145 <... munmap resumed> ) = 0
[pid 25572] 10:12:38.459160 munmap(0x7f33164f8000, 4096) = 0
[pid 25572] 10:12:38.460513 alarm(300 <unfinished ...>
[pid 25573] 10:12:38.460674 alarm(300)  = 0
[pid 25573] 10:12:38.460733 brk(0x1906000 <unfinished ...>
[pid 25572] 10:12:38.460813 <... alarm resumed> ) = 0
[pid 25573] 10:12:38.460837 <... brk resumed> ) = 0x1906000
[pid 25572] 10:12:38.460873 brk(0x1906000 <unfinished ...>
[pid 25573] 10:12:38.460962 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2v\327\303\305f\347\371kV\37\366\277%\305{\320?@\335\0065\330`\311\0\20\351A\332\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25572] 10:12:38.461010 <... brk resumed> ) = 0x1906000
[pid 25572] 10:12:38.461063 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2vY\200@\315]\252\34z\26fKS}\227\303%M\206q\267\16u4 \277\311\252\7\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25573] 10:12:38.461123 <... write resumed> ) = 258
[pid 25572] 10:12:38.461160 <... write resumed> ) = 258
[pid 25573] 10:12:38.461187 read(11,  <unfinished ...>
[pid 25572] 10:12:38.461217 read(11, Process 25582 attached
 <unfinished ...>
[pid 25582] 10:12:38.461281 set_robust_list(0x7f21d3357aa0, 24) = 0
[pid 25582] 10:12:38.461341 close(0)    = 0
[pid 25582] 10:12:38.461449 dup2(10, 0) = 0
[pid 25582] 10:12:38.461488 close(10)   = 0
[pid 25582] 10:12:38.461526 close(11)   = 0
[pid 25582] 10:12:38.461573 fstat(0, {st_dev=makedev(0, 8), st_ino=2130170492, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.461625 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25582] 10:12:38.461675 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25582] 10:12:38.461728 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMb-0006df-04"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25582] 10:12:38.462333 brk(0)      = 0x1def000
[pid 25582] 10:12:38.462400 fcntl(0, F_GETFD) = 0
[pid 25582] 10:12:38.462442 fcntl(1, F_GETFD) = 0
[pid 25582] 10:12:38.462476 fcntl(2, F_GETFD) = 0
[pid 25582] 10:12:38.462520 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462605 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe78b000
[pid 25582] 10:12:38.462664 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462720 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462843 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462889 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462951 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.462992 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463033 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463073 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.463147 <... select resumed> ) = 1 (in [11], left {299, 879976})
[pid 25579] 10:12:38.463184 recvfrom(11, "220 esa7.hilton.iphmx.com ESMTP\r\n", 4096, 0, NULL, NULL) = 33
[pid 25579] 10:12:38.463241 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25579] 10:12:38.463304 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25582] 10:12:38.463342 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25582] 10:12:38.463412 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463463 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463508 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463551 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463592 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463647 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463690 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463733 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25582] 10:12:38.463870 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463914 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.463978 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464020 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464060 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464100 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffe2827c6e0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464184 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25582] 10:12:38.464237 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25582] 10:12:38.464278 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25582] 10:12:38.464324 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f81fe781000
[pid 25582] 10:12:38.464362 close(6)    = 0
[pid 25582] 10:12:38.464409 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.464456 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.464502 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.464552 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fe353000
[pid 25582] 10:12:38.464592 mprotect(0x7f81fe369000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.464633 mmap(0x7f81fe569000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f81fe569000
[pid 25582] 10:12:38.464680 mmap(0x7f81fe56b000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fe56b000
[pid 25582] 10:12:38.464725 close(6)    = 0
[pid 25582] 10:12:38.464851 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464899 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.464945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.465007 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25582] 10:12:38.465059 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.465108 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.465158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe780000
[pid 25582] 10:12:38.465200 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fe13a000
[pid 25582] 10:12:38.465240 mprotect(0x7f81fe150000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.465279 mmap(0x7f81fe34f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f81fe34f000
[pid 25582] 10:12:38.465326 mmap(0x7f81fe351000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fe351000
[pid 25582] 10:12:38.465382 close(6)    = 0
[pid 25582] 10:12:38.465430 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.465481 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.465530 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
Process 25581 attached
[pid 25582] 10:12:38.465602 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25581] 10:12:38.465645 set_robust_list(0x7f4555e98aa0, 24 <unfinished ...>
[pid 25582] 10:12:38.465680 <... open resumed> ) = 6
[pid 25582] 10:12:38.465700 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25581] 10:12:38.465814 <... set_robust_list resumed> ) = 0
[pid 25582] 10:12:38.465843 fstat(6,  <unfinished ...>
[pid 25581] 10:12:38.465896 geteuid( <unfinished ...>
[pid 25582] 10:12:38.465924 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.465959 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fdf03000
[pid 25582] 10:12:38.465999 mprotect(0x7f81fdf0a000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.466037 mmap(0x7f81fe10a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f81fe10a000
[pid 25581] 10:12:38.466078 <... geteuid resumed> ) = 0
[pid 25581] 10:12:38.466104 geteuid( <unfinished ...>
[pid 25582] 10:12:38.466137 mmap(0x7f81fe10c000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fe10c000
[pid 25581] 10:12:38.466177 <... geteuid resumed> ) = 0
[pid 25581] 10:12:38.466197 getegid()   = 12
[pid 25582] 10:12:38.466235 close(6 <unfinished ...>
[pid 25581] 10:12:38.466267 setgid(12)  = 0
[pid 25582] 10:12:38.466302 <... close resumed> ) = 0
[pid 25582] 10:12:38.466326 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25581] 10:12:38.466359 setuid(47)  = 0
[pid 25582] 10:12:38.466818 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.466855 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.466926 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.466973 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25582] 10:12:38.467016 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.467059 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.467109 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fdc7f000
[pid 25582] 10:12:38.467150 mprotect(0x7f81fdd02000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.467189 mmap(0x7f81fdf01000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f81fdf01000
[pid 25582] 10:12:38.467242 close(6)    = 0
[pid 25582] 10:12:38.467285 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.467332 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.467391 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.467448 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25582] 10:12:38.467493 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.467538 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25582] 10:12:38.467587 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77f000
[pid 25582] 10:12:38.467629 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fda71000
[pid 25582] 10:12:38.467669 mprotect(0x7f81fda7d000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.467707 mmap(0x7f81fdc7d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f81fdc7d000
[pid 25582] 10:12:38.467833 close(6)    = 0
[pid 25582] 10:12:38.467882 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.467930 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.467979 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25582] 10:12:38.468055 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fd84e000
[pid 25582] 10:12:38.468095 mprotect(0x7f81fd86f000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.468134 mmap(0x7f81fda6f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f81fda6f000
[pid 25582] 10:12:38.468180 close(6)    = 0
[pid 25582] 10:12:38.468222 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.468268 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.468314 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.468357 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25582] 10:12:38.468404 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.468445 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.468496 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fd631000
[pid 25582] 10:12:38.468537 mprotect(0x7f81fd648000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.468574 mmap(0x7f81fd848000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f81fd848000
[pid 25582] 10:12:38.468619 mmap(0x7f81fd84a000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fd84a000
[pid 25582] 10:12:38.468665 close(6)    = 0
[pid 25582] 10:12:38.468849 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.468897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.468942 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.469002 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25582] 10:12:38.469053 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.469095 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.469144 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77e000
[pid 25582] 10:12:38.469387 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fd2bd000
[pid 25582] 10:12:38.469432 mprotect(0x7f81fd42c000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.469470 mmap(0x7f81fd62b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f81fd62b000
[pid 25582] 10:12:38.469523 close(6)    = 0
[pid 25582] 10:12:38.469577 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.469624 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.469669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.469712 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25582] 10:12:38.469825 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.469870 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25582] 10:12:38.469920 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fd02e000
[pid 25582] 10:12:38.469960 mprotect(0x7f81fd0b9000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.470020 mmap(0x7f81fd2b9000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f81fd2b9000
[pid 25582] 10:12:38.470068 mmap(0x7f81fd2bc000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fd2bc000
[pid 25582] 10:12:38.470113 close(6)    = 0
[pid 25582] 10:12:38.470156 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.470202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.470247 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.470290 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.470808 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.470861 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25582] 10:12:38.470912 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fce28000
[pid 25582] 10:12:38.470954 mprotect(0x7f81fce2e000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.471015 mmap(0x7f81fd02d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f81fd02d000
[pid 25582] 10:12:38.471070 close(6)    = 0
[pid 25582] 10:12:38.471112 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.471158 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25582] 10:12:38.471203 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.471246 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25582] 10:12:38.471295 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77d000
[pid 25582] 10:12:38.471340 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fcaf2000
[pid 25582] 10:12:38.471393 mprotect(0x7f81fcc1e000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.471432 mmap(0x7f81fce1e000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f81fce1e000
[pid 25582] 10:12:38.471478 mmap(0x7f81fce27000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fce27000
[pid 25582] 10:12:38.471528 close(6)    = 0
[pid 25582] 10:12:38.471570 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.471615 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.471661 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.471704 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.471824 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.471877 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.471927 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fc8ee000
[pid 25582] 10:12:38.471990 mprotect(0x7f81fc8f0000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.472031 mmap(0x7f81fcaf0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f81fcaf0000
[pid 25582] 10:12:38.472080 close(6)    = 0
[pid 25582] 10:12:38.472123 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472169 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472257 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25582] 10:12:38.472307 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.472349 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.472399 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fc6eb000
[pid 25582] 10:12:38.472441 mprotect(0x7f81fc6ed000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.472479 mmap(0x7f81fc8ec000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f81fc8ec000
[pid 25582] 10:12:38.472534 close(6)    = 0
[pid 25582] 10:12:38.472576 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472622 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472667 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.472711 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25582] 10:12:38.472847 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.472894 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.472964 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77c000
[pid 25582] 10:12:38.473008 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fc357000
[pid 25582] 10:12:38.473049 mprotect(0x7f81fc4e1000, 2097152, PROT_NONE) = 0
[pid 25581] 10:12:38.473643 brk(0x9ec000 <unfinished ...>
[pid 25582] 10:12:38.473676 mmap(0x7f81fc6e1000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f81fc6e1000
[pid 25582] 10:12:38.473724 mmap(0x7f81fc6e6000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fc6e6000
[pid 25582] 10:12:38.473835 close(6)    = 0
[pid 25582] 10:12:38.473881 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.473928 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.473997 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.474044 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25582] 10:12:38.474092 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.474154 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25582] 10:12:38.474206 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fc0eb000
[pid 25582] 10:12:38.474247 mprotect(0x7f81fc14d000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.474285 mmap(0x7f81fc34c000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f81fc34c000
[pid 25582] 10:12:38.474336 close(6)    = 0
[pid 25582] 10:12:38.474396 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.474443 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.474489 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.474532 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25582] 10:12:38.474581 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.474668 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25582] 10:12:38.474845 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fbd08000
[pid 25582] 10:12:38.474894 mprotect(0x7f81fbec1000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.474933 mmap(0x7f81fc0c0000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f81fc0c0000
[pid 25582] 10:12:38.475003 mmap(0x7f81fc0e7000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fc0e7000
[pid 25582] 10:12:38.475050 close(6)    = 0
[pid 25582] 10:12:38.475095 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.475142 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.475187 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.475231 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25582] 10:12:38.475275 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.475318 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25582] 10:12:38.475376 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77b000
[pid 25582] 10:12:38.475418 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fbadb000
[pid 25582] 10:12:38.475460 mprotect(0x7f81fbb07000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.475498 mmap(0x7f81fbd07000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f81fbd07000
[pid 25582] 10:12:38.475544 close(6)    = 0
[pid 25582] 10:12:38.475585 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25582] 10:12:38.475632 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.475675 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25582] 10:12:38.475724 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fb8d6000
[pid 25582] 10:12:38.475853 mprotect(0x7f81fb8db000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.475896 mmap(0x7f81fbada000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f81fbada000
[pid 25582] 10:12:38.475959 close(6)    = 0
[pid 25582] 10:12:38.476011 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476057 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476147 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25582] 10:12:38.476188 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.476230 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25582] 10:12:38.476279 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fb6d3000
[pid 25582] 10:12:38.476335 mprotect(0x7f81fb6d5000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.476378 mmap(0x7f81fb8d4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f81fb8d4000
[pid 25582] 10:12:38.476427 close(6)    = 0
[pid 25582] 10:12:38.476471 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476516 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476567 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.476611 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25581] 10:12:38.476657 <... brk resumed> ) = 0x9ec000
[pid 25582] 10:12:38.476678 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.476842 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25582] 10:12:38.476896 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe77a000
[pid 25582] 10:12:38.476957 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fb4b0000
[pid 25582] 10:12:38.477003 mprotect(0x7f81fb4c7000, 2097152, PROT_NONE) = 0
[pid 25581] 10:12:38.477376 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25582] 10:12:38.477416 mmap(0x7f81fb6c7000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f81fb6c7000
[pid 25582] 10:12:38.477468 close(6)    = 0
[pid 25582] 10:12:38.477527 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.477575 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.477622 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.477667 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.477730 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.477849 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.477903 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fb26c000
[pid 25582] 10:12:38.477946 mprotect(0x7f81fb2ad000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.478006 mmap(0x7f81fb4ad000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f81fb4ad000
[pid 25582] 10:12:38.478061 close(6)    = 0
[pid 25582] 10:12:38.478107 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478152 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478328 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25582] 10:12:38.478382 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.478428 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.478478 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe779000
[pid 25582] 10:12:38.478521 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81faf85000
[pid 25582] 10:12:38.478562 mprotect(0x7f81fb060000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.478601 mmap(0x7f81fb260000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f81fb260000
[pid 25582] 10:12:38.478651 close(6)    = 0
[pid 25582] 10:12:38.478695 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478797 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478855 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.478900 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25582] 10:12:38.478966 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.479010 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.479060 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fad81000
[pid 25581] 10:12:38.479113 <... open resumed> ) = 7
[pid 25582] 10:12:38.479136 mprotect(0x7f81fad84000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.479176 mmap(0x7f81faf83000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25581] 10:12:38.479213 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.479244 <... mmap resumed> ) = 0x7f81faf83000
[pid 25582] 10:12:38.479272 close(6 <unfinished ...>
[pid 25581] 10:12:38.479301 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25581] 10:12:38.479339 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25582] 10:12:38.479385 <... close resumed> ) = 0
[pid 25581] 10:12:38.479407 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25581] 10:12:38.479440 read(7,  <unfinished ...>
[pid 25582] 10:12:38.479481 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25581] 10:12:38.479515 <... read resumed> "\207\256CN\27\241\355\315\223\372&B\322\n+\24{\264\343J\223\30\17\331\234\210-\240*\207\320$\276\330t%6!\271\32\223\256\213\320\304\267\200T", 48) = 48
[pid 25582] 10:12:38.479549 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25581] 10:12:38.479572 close(7 <unfinished ...>
[pid 25582] 10:12:38.479599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25581] 10:12:38.479627 <... close resumed> ) = 0
[pid 25582] 10:12:38.479653 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25581] 10:12:38.479690 getuid( <unfinished ...>
[pid 25582] 10:12:38.479718 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.479841 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25581] 10:12:38.479875 <... getuid resumed> ) = 47
[pid 25581] 10:12:38.480054 exit_group(0) = ?
[pid 25582] 10:12:38.480089 <... open resumed> ) = 6
[pid 25582] 10:12:38.480109 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.480152 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.480203 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fab55000
[pid 25582] 10:12:38.480246 mprotect(0x7f81fab7e000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.480285 mmap(0x7f81fad7e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f81fad7e000
[pid 25582] 10:12:38.480332 mmap(0x7f81fad80000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81fad80000
[pid 25582] 10:12:38.480377 close(6)    = 0
[pid 25582] 10:12:38.480426 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.480471 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.480516 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.480558 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25582] 10:12:38.480601 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.480642 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25582] 10:12:38.480691 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe778000
[pid 25582] 10:12:38.480732 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f81fa93f000
[pid 25582] 10:12:38.480854 mprotect(0x7f81fa954000, 2093056, PROT_NONE) = 0
[pid 25582] 10:12:38.480898 mmap(0x7f81fab53000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25581] 10:12:38.481181 +++ exited with 0 +++
[pid 25580] 10:12:38.481196 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25581
[pid 25580] 10:12:38.481220 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, 8) = 0
[pid 25580] 10:12:38.481287 getcwd("/var/spool/exim", 16380) = 16
[pid 25580] 10:12:38.481368 open("/etc/localtime", O_RDONLY) = 7
[pid 25580] 10:12:38.481426 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.481480 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.481523 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.481559 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25580] 10:12:38.481606 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25580] 10:12:38.481639 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25580] 10:12:38.481687 close(7)    = 0
[pid 25580] 10:12:38.481722 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.481853 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25580] 10:12:38.481910 fcntl(7, F_GETFD) = 0
[pid 25580] 10:12:38.481966 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25580] 10:12:38.482000 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5390607, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.482048 write(7, "2015-12-30 10:12:38 [25580] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMa-0006dL-LG\n", 108) = 108
[pid 25580] 10:12:38.482090 chdir("/var/spool/exim") = 0
[pid 25580] 10:12:38.482132 geteuid()   = 0
[pid 25580] 10:12:38.482165 getegid()   = 12
[pid 25580] 10:12:38.482207 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.482252 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25580] 10:12:38.482303 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.482342 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25580] 10:12:38.482390 close(8)    = 0
[pid 25580] 10:12:38.482425 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.482465 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25580] 10:12:38.482509 read(8, "65536\n", 31) = 6
[pid 25580] 10:12:38.482560 close(8)    = 0
[pid 25580] 10:12:38.482603 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.482646 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25580] 10:12:38.482691 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.482726 lseek(8, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.482830 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25580] 10:12:38.482886 read(8, "", 4096) = 0
[pid 25580] 10:12:38.482924 close(8)    = 0
[pid 25580] 10:12:38.482980 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.483021 setgroups(1, [12]) = 0
[pid 25580] 10:12:38.483060 setgid(12)  = 0
[pid 25580] 10:12:38.483093 setuid(47)  = 0
[pid 25580] 10:12:38.483155 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25580] 10:12:38.483238 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25580] 10:12:38.483322 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25580] 10:12:38.483409 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25580] 10:12:38.483499 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25580] 10:12:38.483593 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25580] 10:12:38.483708 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25580] 10:12:38.483873 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.483924 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25580] 10:12:38.483996 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.484035 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25580] 10:12:38.484083 close(8)    = 0
[pid 25580] 10:12:38.484119 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.484217 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25580] 10:12:38.484313 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25580] 10:12:38.484469 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25580] 10:12:38.484599 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25580] 10:12:38.484713 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25580] 10:12:38.484845 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.484909 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25580] 10:12:38.484964 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.485002 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25580] 10:12:38.485052 close(8)    = 0
[pid 25580] 10:12:38.485088 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.485135 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.485177 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25580] 10:12:38.485223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.485259 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25580] 10:12:38.485313 close(8)    = 0
[pid 25580] 10:12:38.485348 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.485420 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.485477 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25580] 10:12:38.485524 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555eae000
[pid 25580] 10:12:38.485560 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25580] 10:12:38.485608 close(8 <unfinished ...>
[pid 25582] 10:12:38.485644 <... mmap resumed> ) = 0x7f81fab53000
[pid 25580] 10:12:38.485659 <... close resumed> ) = 0
[pid 25582] 10:12:38.485689 close(6 <unfinished ...>
[pid 25580] 10:12:38.485714 munmap(0x7f4555eae000, 4096 <unfinished ...>
[pid 25582] 10:12:38.485819 <... close resumed> ) = 0
[pid 25580] 10:12:38.485838 <... munmap resumed> ) = 0
[pid 25582] 10:12:38.485973 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.486011 read(6,  <unfinished ...>
[pid 25582] 10:12:38.486039 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.486054 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25582] 10:12:38.486170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.486204 read(6,  <unfinished ...>
[pid 25582] 10:12:38.486233 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.486247 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25582] 10:12:38.486333 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.486369 read(6,  <unfinished ...>
[pid 25582] 10:12:38.486403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.486425 <... read resumed> "", 4096) = 0
[pid 25582] 10:12:38.486452 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.486484 read(6,  <unfinished ...>
[pid 25582] 10:12:38.486510 <... open resumed> ) = 6
[pid 25580] 10:12:38.486523 <... read resumed> "", 4096) = 0
[pid 25582] 10:12:38.486547 read(6,  <unfinished ...>
[pid 25580] 10:12:38.486570 close(6 <unfinished ...>
[pid 25582] 10:12:38.486598 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.486618 <... close resumed> ) = 0
[pid 25582] 10:12:38.486640 fstat(6,  <unfinished ...>
[pid 25580] 10:12:38.486667 munmap(0x7f4555eaf000, 4096 <unfinished ...>
[pid 25582] 10:12:38.486699 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25580] 10:12:38.486727 <... munmap resumed> ) = 0
[pid 25582] 10:12:38.486832 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25580] 10:12:38.486870 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25582] 10:12:38.486907 <... mmap resumed> ) = 0x7f81fa734000
[pid 25580] 10:12:38.486922 <... open resumed> ) = 6
[pid 25582] 10:12:38.486967 mprotect(0x7f81fa73e000, 2093056, PROT_NONE <unfinished ...>
[pid 25580] 10:12:38.486995 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.487040 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.487053 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.487087 mmap(0x7f81fa93d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25580] 10:12:38.487116 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.487145 <... mmap resumed> ) = 0x7f81fa93d000
[pid 25580] 10:12:38.487159 <... mmap resumed> ) = 0x7f4555eaf000
[pid 25582] 10:12:38.487189 close(6 <unfinished ...>
[pid 25580] 10:12:38.487213 read(6,  <unfinished ...>
[pid 25582] 10:12:38.487242 <... close resumed> ) = 0
[pid 25580] 10:12:38.487255 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.487296 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.487329 close(6 <unfinished ...>
[pid 25582] 10:12:38.487357 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.487378 <... close resumed> ) = 0
[pid 25582] 10:12:38.487406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.487447 munmap(0x7f4555eaf000, 4096 <unfinished ...>
[pid 25582] 10:12:38.487479 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.487494 <... munmap resumed> ) = 0
[pid 25582] 10:12:38.487525 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.487561 fstat(1,  <unfinished ...>
[pid 25582] 10:12:38.487588 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.487602 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25582] 10:12:38.487650 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.487685 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f4554d65790},  <unfinished ...>
[pid 25582] 10:12:38.487717 <... open resumed> ) = 6
[pid 25580] 10:12:38.487730 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25582] 10:12:38.487847 read(6,  <unfinished ...>
[pid 25580] 10:12:38.487877 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0},  <unfinished ...>
[pid 25582] 10:12:38.487912 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.487958 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25582] 10:12:38.487986 fstat(6,  <unfinished ...>
[pid 25580] 10:12:38.488009 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0},  <unfinished ...>
[pid 25582] 10:12:38.488039 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.488065 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25582] 10:12:38.488093 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25580] 10:12:38.488125 fstat(0,  <unfinished ...>
[pid 25582] 10:12:38.488151 <... mmap resumed> ) = 0x7f81fa531000
[pid 25580] 10:12:38.488165 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130170392, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.488197 mprotect(0x7f81fa533000, 2093056, PROT_NONE <unfinished ...>
[pid 25580] 10:12:38.488224 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.488253 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.488266 <... mmap resumed> ) = 0x7f4555eaf000
[pid 25582] 10:12:38.488286 mmap(0x7f81fa732000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25580] 10:12:38.488314 read(0,  <unfinished ...>
[pid 25582] 10:12:38.488346 <... mmap resumed> ) = 0x7f81fa732000
[pid 25580] 10:12:38.488360 <... read resumed> "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3505
[pid 25582] 10:12:38.488437 close(6 <unfinished ...>
[pid 25580] 10:12:38.488464 stat("/etc/localtime",  <unfinished ...>
[pid 25582] 10:12:38.488494 <... close resumed> ) = 0
[pid 25580] 10:12:38.488507 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.488564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25580] 10:12:38.488592 open("/var/spool/exim/input/c/1aEJMc-0006ea-Fj-D", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25582] 10:12:38.488664 <... mmap resumed> ) = 0x7f81fe777000
[pid 25580] 10:12:38.488679 <... open resumed> ) = 6
[pid 25582] 10:12:38.488720 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.488831 fchown(6, 47, 12 <unfinished ...>
[pid 25582] 10:12:38.488868 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.488885 <... fchown resumed> ) = 0
[pid 25582] 10:12:38.488910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.488960 fchmod(6, 0640 <unfinished ...>
[pid 25582] 10:12:38.488995 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.489009 <... fchmod resumed> ) = 0
[pid 25582] 10:12:38.489033 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.489063 fcntl(6, F_GETFL <unfinished ...>
[pid 25582] 10:12:38.489095 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.489110 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25582] 10:12:38.489134 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.489163 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.489190 <... open resumed> ) = 6
[pid 25580] 10:12:38.489203 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080198, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.489236 read(6,  <unfinished ...>
[pid 25580] 10:12:38.489259 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.489288 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25580] 10:12:38.489308 <... mmap resumed> ) = 0x7f4555eae000
[pid 25582] 10:12:38.489330 fstat(6,  <unfinished ...>
[pid 25580] 10:12:38.489356 lseek(6, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.489394 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25580] 10:12:38.489424 <... lseek resumed> ) = 0
[pid 25582] 10:12:38.489453 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25580] 10:12:38.489483 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19} <unfinished ...>
[pid 25582] 10:12:38.489516 <... mmap resumed> ) = 0x7f81fa312000
[pid 25580] 10:12:38.489529 <... fcntl resumed> ) = 0
[pid 25582] 10:12:38.489631 mprotect(0x7f81fa32f000, 2093056, PROT_NONE <unfinished ...>
[pid 25580] 10:12:38.489659 read(0,  <unfinished ...>
[pid 25582] 10:12:38.489686 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.489699 <... read resumed> "", 4096) = 0
[pid 25582] 10:12:38.489720 mmap(0x7f81fa52e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25580] 10:12:38.489824 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f4554d65790},  <unfinished ...>
[pid 25582] 10:12:38.489862 <... mmap resumed> ) = 0x7f81fa52e000
[pid 25580] 10:12:38.489876 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25582] 10:12:38.489902 mmap(0x7f81fa530000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25580] 10:12:38.489930 write(6, "1aEJMc-0006ea-Fj-D\n--1451491958-eximdsn-1537644243\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3150 <unfinished ...>
[pid 25582] 10:12:38.489992 <... mmap resumed> ) = 0x7f81fa530000
[pid 25580] 10:12:38.490008 <... write resumed> ) = 3150
[pid 25582] 10:12:38.490038 close(6 <unfinished ...>
[pid 25580] 10:12:38.490063 fsync(6 <unfinished ...>
[pid 25582] 10:12:38.490118 <... close resumed> ) = 0
[pid 25582] 10:12:38.490183 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe776000
[pid 25582] 10:12:38.490343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe775000
[pid 25582] 10:12:38.490392 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe773000
[pid 25582] 10:12:38.490439 arch_prctl(ARCH_SET_FS, 0x7f81fe7737c0 <unfinished ...>
[pid 25580] 10:12:38.490471 <... fsync resumed> ) = 0
[pid 25582] 10:12:38.490509 <... arch_prctl resumed> ) = 0
[pid 25580] 10:12:38.490525 stat("/etc/localtime",  <unfinished ...>
[pid 25582] 10:12:38.490596 mprotect(0x7f81fa52e000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.490622 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.490694 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.490711 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.490809 mprotect(0x7f81fa732000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.490840 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080198, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3150, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.491005 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491028 brk(0x9ec000 <unfinished ...>
[pid 25582] 10:12:38.491077 mprotect(0x7f81fa93d000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491102 <... brk resumed> ) = 0x9ec000
[pid 25582] 10:12:38.491148 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491164 getuid( <unfinished ...>
[pid 25582] 10:12:38.491201 mprotect(0x7f81fab53000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491225 <... getuid resumed> ) = 47
[pid 25582] 10:12:38.491247 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491261 geteuid( <unfinished ...>
[pid 25582] 10:12:38.491301 mprotect(0x7f81fad7e000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491326 <... geteuid resumed> ) = 47
[pid 25582] 10:12:38.491348 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491362 getgid( <unfinished ...>
[pid 25582] 10:12:38.491399 mprotect(0x7f81faf83000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491424 <... getgid resumed> ) = 12
[pid 25582] 10:12:38.491445 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491459 getegid( <unfinished ...>
[pid 25582] 10:12:38.491601 mprotect(0x7f81fb260000, 40960, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491632 <... getegid resumed> ) = 12
[pid 25582] 10:12:38.491727 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.491809 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.491937 mprotect(0x7f81fb4ad000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.491963 <... open resumed> ) = 8
[pid 25582] 10:12:38.492003 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.492021 read(8,  <unfinished ...>
[pid 25582] 10:12:38.492070 mprotect(0x7f81fb6c7000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.492094 <... read resumed> "\312\252iC", 4) = 4
[pid 25582] 10:12:38.492119 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.492132 close(8 <unfinished ...>
[pid 25582] 10:12:38.492165 mprotect(0x7f81fb8d4000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.492189 <... close resumed> ) = 0
[pid 25582] 10:12:38.492293 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.492311 readlink("/proc/self/exe",  <unfinished ...>
[pid 25582] 10:12:38.492565 mprotect(0x7f81fc0c0000, 110592, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.492596 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25582] 10:12:38.492674 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.492692 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.492871 mprotect(0x7f81fc34c000, 16384, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.492899 <... ioctl resumed> , 0x7fffbc51d5f0) = -1 EINVAL (Invalid argument)
[pid 25582] 10:12:38.492925 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.492939 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.493071 mprotect(0x7f81fc6e1000, 16384, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.493099 <... lseek resumed> ) = -1 ESPIPE (Illegal seek)
[pid 25582] 10:12:38.493131 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.493146 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.493180 mprotect(0x7f81fc8ec000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.493204 <... ioctl resumed> , 0x7fffbc51d5f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.493226 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.493239 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.493275 mprotect(0x7f81fcaf0000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.493300 <... lseek resumed> ) = 0
[pid 25582] 10:12:38.493321 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.493335 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.494060 mprotect(0x7f81fd848000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.494085 <... ioctl resumed> , 0x7fffbc51d600) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25580] 10:12:38.494107 lseek(2, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.494143 open("/dev/null", O_RDONLY) = 8
[pid 25580] 10:12:38.494188 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbc51d6d0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25580] 10:12:38.494224 lseek(8, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.494257 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25580] 10:12:38.494292 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f4554d65790}, 8) = 0
[pid 25580] 10:12:38.494333 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f4554d65790}, 8) = 0
[pid 25580] 10:12:38.494617 read(8, "", 8192) = 0
[pid 25580] 10:12:38.494675 close(8)    = 0
[pid 25580] 10:12:38.494965 brk(0xa0d000) = 0xa0d000
[pid 25580] 10:12:38.495199 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.495274 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.495289 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.495347 mprotect(0x7f81fdc7d000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.495374 <... open resumed> ) = 8
[pid 25582] 10:12:38.495398 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.495413 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.495447 mprotect(0x7f81fdf01000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.495472 <... ioctl resumed> , 0x7fffbc51d500) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.495494 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.495508 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.495541 mprotect(0x7f81fe10a000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.495566 <... lseek resumed> ) = 0
[pid 25582] 10:12:38.495616 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.495634 read(8,  <unfinished ...>
[pid 25582] 10:12:38.495691 mprotect(0x7f81fe34f000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.495718 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25582] 10:12:38.496837 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.496877 brk(0xa2e000 <unfinished ...>
[pid 25582] 10:12:38.496956 mprotect(0x7f81fe569000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.496988 <... brk resumed> ) = 0xa2e000
[pid 25582] 10:12:38.497200 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.497223 read(8,  <unfinished ...>
[pid 25582] 10:12:38.497284 mprotect(0x7f81fe78c000, 4096, PROT_READ <unfinished ...>
[pid 25580] 10:12:38.497314 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25582] 10:12:38.497344 <... mprotect resumed> ) = 0
[pid 25580] 10:12:38.498334 brk(0xa4f000 <unfinished ...>
[pid 25582] 10:12:38.498381 munmap(0x7f81fe781000, 39387 <unfinished ...>
[pid 25580] 10:12:38.498419 <... brk resumed> ) = 0xa4f000
[pid 25582] 10:12:38.498437 <... munmap resumed> ) = 0
[pid 25580] 10:12:38.498850 read(8,  <unfinished ...>
[pid 25582] 10:12:38.498893 set_tid_address(0x7f81fe773a90 <unfinished ...>
[pid 25580] 10:12:38.498921 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25582] 10:12:38.498945 <... set_tid_address resumed> ) = 25582
[pid 25580] 10:12:38.499867 brk(0xa70000 <unfinished ...>
[pid 25582] 10:12:38.499950 set_robust_list(0x7f81fe773aa0, 24 <unfinished ...>
[pid 25580] 10:12:38.499982 <... brk resumed> ) = 0xa70000
[pid 25582] 10:12:38.499999 <... set_robust_list resumed> ) = 0
[pid 25580] 10:12:38.500250 read(8,  <unfinished ...>
[pid 25582] 10:12:38.500288 futex(0x7ffe2827cfdc, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25580] 10:12:38.500316 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25582] 10:12:38.500339 <... futex resumed> ) = 0
[pid 25580] 10:12:38.500624 read(8,  <unfinished ...>
[pid 25582] 10:12:38.500668 futex(0x7ffe2827cfdc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f81fe7737c0 <unfinished ...>
[pid 25580] 10:12:38.500701 <... read resumed> "", 8192) = 0
[pid 25582] 10:12:38.500718 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25580] 10:12:38.500803 close(8 <unfinished ...>
[pid 25582] 10:12:38.500838 rt_sigaction(SIGRTMIN, {0x7f81fd636c60, [], SA_RESTORER|SA_SIGINFO, 0x7f81fd640790},  <unfinished ...>
[pid 25580] 10:12:38.500870 <... close resumed> ) = 0
[pid 25582] 10:12:38.500886 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.500923 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25582] 10:12:38.500958 rt_sigaction(SIGRT_1, {0x7f81fd636cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f81fd640790},  <unfinished ...>
[pid 25580] 10:12:38.500987 <... stat resumed> 0x7f455454c880) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.501005 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.501026 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25582] 10:12:38.501056 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25580] 10:12:38.501083 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.501112 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25580] 10:12:38.501132 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25582] 10:12:38.501171 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25580] 10:12:38.501195 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.501222 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25580] 10:12:38.501243 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.501344 statfs("/selinux",  <unfinished ...>
[pid 25580] 10:12:38.501381 <... open resumed> ) = 8
[pid 25582] 10:12:38.501399 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350310, f_bavail=6350310, f_files=1000000, f_ffree=691064, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25580] 10:12:38.501424 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.501504 brk(0 <unfinished ...>
[pid 25580] 10:12:38.501530 <... ioctl resumed> , 0x7fffbc51d500) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.501548 <... brk resumed> ) = 0x1def000
[pid 25580] 10:12:38.501566 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.501598 brk(0x1e10000 <unfinished ...>
[pid 25580] 10:12:38.501631 <... lseek resumed> ) = 0
[pid 25582] 10:12:38.501649 <... brk resumed> ) = 0x1e10000
[pid 25580] 10:12:38.501693 read(8,  <unfinished ...>
[pid 25582] 10:12:38.501737 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25580] 10:12:38.501852 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25582] 10:12:38.501875 <... open resumed> ) = 6
[pid 25580] 10:12:38.502317 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25582] 10:12:38.502375 fstat(6,  <unfinished ...>
[pid 25580] 10:12:38.502403 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.502422 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.502454 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25582] 10:12:38.502485 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25580] 10:12:38.502517 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.502535 <... mmap resumed> ) = 0x7f81fe78a000
[pid 25580] 10:12:38.502556 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25582] 10:12:38.502590 read(6,  <unfinished ...>
[pid 25580] 10:12:38.502697 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.502721 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25580] 10:12:38.502819 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25582] 10:12:38.502880 read(6,  <unfinished ...>
[pid 25580] 10:12:38.502958 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.502995 <... read resumed> "", 1024) = 0
[pid 25573] 10:12:38.503038 <... read resumed> "\26\3\3\0:\2\0", 7) = 7
[pid 25582] 10:12:38.503153 close(6 <unfinished ...>
[pid 25580] 10:12:38.503204 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25573] 10:12:38.503265 read(11,  <unfinished ...>
[pid 25582] 10:12:38.503351 <... close resumed> ) = 0
[pid 25580] 10:12:38.503379 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.503399 <... read resumed> "\0006\3\3V\204\2v\230\231R\313\244k3\301\275\223\344\336\347^(\250\242 *\16\355\237\\~\376\361#\253\0\0\235\0\0\16\377\1\0\1\0\0#\0\0\0\17\0\1\1", 56) = 56
[pid 25582] 10:12:38.503451 munmap(0x7f81fe78a000, 4096 <unfinished ...>
[pid 25580] 10:12:38.503481 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25573] 10:12:38.503515 read(11,  <unfinished ...>
[pid 25582] 10:12:38.503662 <... munmap resumed> ) = 0
[pid 25580] 10:12:38.503683 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.503816 <... read resumed> "\26\3\3\25O", 5) = 5
[pid 25572] 10:12:38.503849 <... read resumed> "\26\3\3\0:\2\0", 7) = 7
[pid 25582] 10:12:38.503908 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25580] 10:12:38.503943 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25573] 10:12:38.503972 read(11,  <unfinished ...>
[pid 25572] 10:12:38.504002 read(11,  <unfinished ...>
[pid 25582] 10:12:38.504032 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.504046 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.504126 <... read resumed> "\v\0\25K\0\25H\0\5\2240\202\5\2200\202\4x\240\3\2\1\2\2\21\0\212\357\311f\205>F*Z\306\230gZE\367\2070\r\6\t*\206H\206\367\r\1\1\v\5\0000d1\v0\t\6\3U\4\6\23\2US1\v0\t\6\3U\4\10\23\2CA1\0240\22\6\3U\4\7\23\vSanta Clara1\0250\23\6\3U\4\n\23\fMcAfee, Inc.1\0330\31\6\3U\4\3\23\22McAfee OV SSL CA 20\36\27\r150109000000Z\27\r160109235959Z0\201\3731\v0\t\6\3U\4\6\23\2US1\0160\f\6\3U\4\21\23\005970061\v0\t\6\3U\4\10\23\2OR1\0220\20\6\3U\4\7\23\tBEAVERTON"..., 5455) = 4611
[pid 25572] 10:12:38.504156 <... read resumed> "\0006\3\3V\204\2v_\2\215\223\341e\367\330\22\264:\314\265\357\341\212\3353~\372\206\227\241i\31\\\27k\0\0\235\0\0\16\377\1\0\1\0\0#\0\0\0\17\0\1\1", 56) = 56
[pid 25582] 10:12:38.504225 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25580] 10:12:38.504273 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25573] 10:12:38.504307 read(11,  <unfinished ...>
[pid 25572] 10:12:38.504330 read(11,  <unfinished ...>
[pid 25582] 10:12:38.504361 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.504375 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.504405 <... read resumed> "\26\3\3\25O", 5) = 5
[pid 25582] 10:12:38.504438 fstat(2,  <unfinished ...>
[pid 25580] 10:12:38.504462 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25572] 10:12:38.504492 read(11,  <unfinished ...>
[pid 25582] 10:12:38.504529 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25580] 10:12:38.504558 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:38.504617 <... read resumed> "\v\0\25K\0\25H\0\5\2240\202\5\2200\202\4x\240\3\2\1\2\2\21\0\212\357\311f\205>F*Z\306\230gZE\367\2070\r\6\t*\206H\206\367\r\1\1\v\5\0000d1\v0\t\6\3U\4\6\23\2US1\v0\t\6\3U\4\10\23\2CA1\0240\22\6\3U\4\7\23\vSanta Clara1\0250\23\6\3U\4\n\23\fMcAfee, Inc.1\0330\31\6\3U\4\3\23\22McAfee OV SSL CA 20\36\27\r150109000000Z\27\r160109235959Z0\201\3731\v0\t\6\3U\4\6\23\2US1\0160\f\6\3U\4\21\23\005970061\v0\t\6\3U\4\10\23\2OR1\0220\20\6\3U\4\7\23\tBEAVERTON"..., 5455) = 4609
[pid 25582] 10:12:38.504652 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f81fd640790},  <unfinished ...>
[pid 25580] 10:12:38.504678 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25572] 10:12:38.504707 read(11,  <unfinished ...>
[pid 25582] 10:12:38.504734 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.504829 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.504859 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25580] 10:12:38.504926 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25582] 10:12:38.504961 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25580] 10:12:38.504987 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.505007 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25580] 10:12:38.505037 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25582] 10:12:38.505067 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25580] 10:12:38.505085 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25582] 10:12:38.505116 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25580] 10:12:38.505146 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.505178 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25580] 10:12:38.505195 <... open resumed> ) = 9
[pid 25582] 10:12:38.505223 umask(0 <unfinished ...>
[pid 25580] 10:12:38.505253 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25582] 10:12:38.505278 <... umask resumed> ) = 0
[pid 25580] 10:12:38.505293 <... ioctl resumed> , 0x7fffbc51cf10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.505355 geteuid( <unfinished ...>
[pid 25580] 10:12:38.505385 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.505411 <... geteuid resumed> ) = 0
[pid 25580] 10:12:38.505427 <... lseek resumed> ) = 0
[pid 25582] 10:12:38.505445 getuid( <unfinished ...>
[pid 25580] 10:12:38.505484 brk(0xa91000 <unfinished ...>
[pid 25582] 10:12:38.505525 <... getuid resumed> ) = 47
[pid 25580] 10:12:38.505554 <... brk resumed> ) = 0xa91000
[pid 25582] 10:12:38.505580 getgid( <unfinished ...>
[pid 25580] 10:12:38.505631 read(9,  <unfinished ...>
[pid 25582] 10:12:38.505657 <... getgid resumed> ) = 12
[pid 25582] 10:12:38.505738 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25580] 10:12:38.505838 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25582] 10:12:38.505863 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25580] 10:12:38.506167 read(9,  <unfinished ...>
[pid 25582] 10:12:38.506203 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25580] 10:12:38.506228 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25582] 10:12:38.506250 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25580] 10:12:38.507061 read(9,  <unfinished ...>
[pid 25582] 10:12:38.507108 getgroups(65536,  <unfinished ...>
[pid 25580] 10:12:38.507135 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25582] 10:12:38.507157 <... getgroups resumed> []) = 0
[pid 25580] 10:12:38.507246 brk(0xab2000 <unfinished ...>
[pid 25582] 10:12:38.507288 setgroups(0, [] <unfinished ...>
[pid 25580] 10:12:38.507314 <... brk resumed> ) = 0xab2000
[pid 25582] 10:12:38.507331 <... setgroups resumed> ) = 0
[pid 25580] 10:12:38.507721 read(9,  <unfinished ...>
[pid 25582] 10:12:38.507823 getegid( <unfinished ...>
[pid 25580] 10:12:38.507850 <... read resumed> "", 8192) = 0
[pid 25582] 10:12:38.507874 <... getegid resumed> ) = 12
[pid 25580] 10:12:38.507895 close(9 <unfinished ...>
[pid 25582] 10:12:38.507924 geteuid( <unfinished ...>
[pid 25580] 10:12:38.507968 <... close resumed> ) = 0
[pid 25582] 10:12:38.507987 <... geteuid resumed> ) = 0
[pid 25580] 10:12:38.508692 read(8,  <unfinished ...>
[pid 25582] 10:12:38.508810 geteuid( <unfinished ...>
[pid 25580] 10:12:38.508840 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25582] 10:12:38.508864 <... geteuid resumed> ) = 0
[pid 25582] 10:12:38.509632 getegid()   = 12
[pid 25582] 10:12:38.509718 setgid(12)  = 0
[pid 25582] 10:12:38.509820 setuid(0)   = 0
[pid 25582] 10:12:38.509888 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25582] 10:12:38.509970 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.510028 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.510076 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe78a000
[pid 25582] 10:12:38.510115 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25582] 10:12:38.510261 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25582] 10:12:38.510309 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.510361 close(7)    = 0
[pid 25582] 10:12:38.510401 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25582] 10:12:38.510439 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.510481 close(7)    = 0
[pid 25582] 10:12:38.510529 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25582] 10:12:38.510574 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25582] 10:12:38.510630 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.510679 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25582] 10:12:38.510822 read(7, "", 4096) = 0
[pid 25582] 10:12:38.510869 close(7)    = 0
[pid 25582] 10:12:38.510906 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.510961 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.511009 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.511082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.511127 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25582] 10:12:38.511167 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25582] 10:12:38.511221 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f81fe769000
[pid 25582] 10:12:38.511265 close(7)    = 0
[pid 25582] 10:12:38.511310 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25582] 10:12:38.511354 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.511400 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.511452 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f81fa104000
[pid 25582] 10:12:38.511499 mprotect(0x7f81fa110000, 2097152, PROT_NONE) = 0
[pid 25582] 10:12:38.511541 mmap(0x7f81fa310000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f81fa310000
[pid 25582] 10:12:38.511591 close(7)    = 0
[pid 25582] 10:12:38.511660 mprotect(0x7f81fa310000, 4096, PROT_READ) = 0
[pid 25582] 10:12:38.511714 munmap(0x7f81fe769000, 39387) = 0
[pid 25582] 10:12:38.511836 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25582] 10:12:38.511885 fcntl(7, F_GETFD <unfinished ...>
[pid 25580] 10:12:38.511957 read(8,  <unfinished ...>
[pid 25582] 10:12:38.512035 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25582] 10:12:38.512065 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25580] 10:12:38.512117 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25582] 10:12:38.512140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.512691 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.512818 close(7)    = 0
[pid 25582] 10:12:38.512863 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.512949 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25582] 10:12:38.512994 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.513043 close(7)    = 0
[pid 25582] 10:12:38.513081 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25582] 10:12:38.513118 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.513160 close(7)    = 0
[pid 25582] 10:12:38.513202 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25582] 10:12:38.513276 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25582] 10:12:38.513331 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.513377 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25582] 10:12:38.513441 close(7)    = 0
[pid 25582] 10:12:38.513481 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.513542 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25582] 10:12:38.513629 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25582] 10:12:38.513687 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.513736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.513871 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.513927 close(7)    = 0
[pid 25582] 10:12:38.513965 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.514031 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25580] 10:12:38.514418 read(8,  <unfinished ...>
[pid 25582] 10:12:38.514478 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25582] 10:12:38.514558 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790}, 8) = 0
[pid 25582] 10:12:38.514629 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f81fe773a90) = 25583
[pid 25582] 10:12:38.515012 wait4(25583,  <unfinished ...>
[pid 25579] 10:12:38.515041 <... select resumed> ) = 1 (in [11], left {299, 948329})
[pid 25579] 10:12:38.515068 recvfrom(11, "250-esa7.hilton.iphmx.com\r\n250-8BITMIME\r\n250-SIZE 20971520\r\n250 STARTTLS\r\n", 4096, 0, NULL, NULL) = 74
[pid 25579] 10:12:38.515133 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25579] 10:12:38.515195 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25580] 10:12:38.515237 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25580] 10:12:38.515993 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25580] 10:12:38.516311 brk(0xad3000) = 0xad3000
[pid 25580] 10:12:38.516999 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25580] 10:12:38.517952 brk(0xaf4000) = 0xaf4000
[pid 25580] 10:12:38.518169 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25580] 10:12:38.518713 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25580] 10:12:38.519302 brk(0xb15000) = 0xb15000
[pid 25580] 10:12:38.519489 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25580] 10:12:38.520226 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25580] 10:12:38.520731 brk(0xb36000) = 0xb36000
[pid 25580] 10:12:38.521152 stat("/usr/local/cpanel/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521209 stat("/usr/local/cpanel/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521252 stat("/etc/exim/perl/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521290 stat("/etc/exim/perl/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521329 stat("/usr/local/cpanel/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521366 stat("/usr/local/cpanel/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521405 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521450 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521498 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521541 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521583 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521643 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521686 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.521728 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.521865 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25580] 10:12:38.521910 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbc51cf10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25580] 10:12:38.521948 lseek(9, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.522003 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25580] 10:12:38.522270 lseek(9, 878, SEEK_SET) = 878
[pid 25580] 10:12:38.522314 lseek(9, 0, SEEK_CUR) = 878
[pid 25580] 10:12:38.522347 close(9)    = 0
[pid 25580] 10:12:38.522594 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25580] 10:12:38.523252 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25580] 10:12:38.523441 brk(0xb57000) = 0xb57000
Process 25583 attached
[pid 25583] 10:12:38.523854 set_robust_list(0x7f81fe773aa0, 24) = 0
[pid 25583] 10:12:38.523921 geteuid()   = 0
[pid 25583] 10:12:38.523962 geteuid()   = 0
[pid 25583] 10:12:38.523996 getegid()   = 12
[pid 25583] 10:12:38.524649 setgid(12)  = 0
[pid 25583] 10:12:38.524689 setuid(47)  = 0
[pid 25583] 10:12:38.526349 brk(0x1e31000 <unfinished ...>
[pid 25580] 10:12:38.526604 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25580] 10:12:38.526850 brk(0xb78000) = 0xb78000
[pid 25583] 10:12:38.527807 <... brk resumed> ) = 0x1e31000
[pid 25583] 10:12:38.528249 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25580] 10:12:38.528498 read(8,  <unfinished ...>
[pid 25583] 10:12:38.528539 <... open resumed> ) = 7
[pid 25583] 10:12:38.528568 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25583] 10:12:38.528625 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25583] 10:12:38.528669 read(7, "1\347\217Xw\370\4.-Lz\36\n\230\2567v\37\257\35\2640\232z\257w\233dVUIRV\260\325\267\244\250\266{-\275\265\245^Z\34I", 48) = 48
[pid 25583] 10:12:38.528712 close(7)    = 0
[pid 25583] 10:12:38.528818 getuid( <unfinished ...>
[pid 25580] 10:12:38.528847 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25580] 10:12:38.528983 brk(0xb99000 <unfinished ...>
[pid 25583] 10:12:38.529011 <... getuid resumed> ) = 47
[pid 25583] 10:12:38.529172 exit_group(0) = ?
[pid 25580] 10:12:38.529197 <... brk resumed> ) = 0xb99000
[pid 25583] 10:12:38.530020 +++ exited with 0 +++
[pid 25582] 10:12:38.530061 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25583
[pid 25582] 10:12:38.530090 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, 8) = 0
[pid 25582] 10:12:38.530160 getcwd("/var/spool/exim", 16380) = 16
[pid 25582] 10:12:38.530240 open("/etc/localtime", O_RDONLY) = 7
[pid 25582] 10:12:38.530284 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.530336 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.530388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.530426 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25582] 10:12:38.530474 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25582] 10:12:38.530511 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25582] 10:12:38.530579 close(7)    = 0
[pid 25582] 10:12:38.530616 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.530668 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25582] 10:12:38.530730 fcntl(7, F_GETFD) = 0
[pid 25582] 10:12:38.530851 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25582] 10:12:38.530906 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5390715, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.530959 write(7, "2015-12-30 10:12:38 [25582] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMb-0006df-04\n", 108) = 108
[pid 25582] 10:12:38.531003 chdir("/var/spool/exim") = 0
[pid 25582] 10:12:38.531046 geteuid()   = 0
[pid 25582] 10:12:38.531079 getegid()   = 12
[pid 25582] 10:12:38.531121 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.531165 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.531215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.531251 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.531303 close(8)    = 0
[pid 25582] 10:12:38.531339 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.531379 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25582] 10:12:38.531425 read(8, "65536\n", 31) = 6
[pid 25582] 10:12:38.531460 close(8)    = 0
[pid 25582] 10:12:38.531499 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.531552 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25582] 10:12:38.531609 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.531646 lseek(8, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.531681 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25582] 10:12:38.531732 read(8, "", 4096) = 0
[pid 25582] 10:12:38.531852 close(8)    = 0
[pid 25582] 10:12:38.531888 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.531927 setgroups(1, [12]) = 0
[pid 25582] 10:12:38.531965 setgid(12)  = 0
[pid 25582] 10:12:38.532001 setuid(47)  = 0
[pid 25582] 10:12:38.532063 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25582] 10:12:38.532147 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25582] 10:12:38.532231 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25582] 10:12:38.532306 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25582] 10:12:38.532384 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25582] 10:12:38.532481 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25582] 10:12:38.532605 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25582] 10:12:38.532700 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.532826 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.532889 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.532958 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.533043 close(8)    = 0
[pid 25582] 10:12:38.533096 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.533198 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25582] 10:12:38.533296 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25582] 10:12:38.533417 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25582] 10:12:38.533544 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25582] 10:12:38.533673 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25582] 10:12:38.533738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.533858 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.533907 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.533943 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.533997 close(8)    = 0
[pid 25582] 10:12:38.534033 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.534081 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.534122 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25582] 10:12:38.534168 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.534203 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25582] 10:12:38.534252 close(8)    = 0
[pid 25582] 10:12:38.534285 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.534344 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25582] 10:12:38.534386 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25582] 10:12:38.534432 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.534468 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25582] 10:12:38.534524 close(8)    = 0
[pid 25582] 10:12:38.534559 munmap(0x7f81fe789000, 4096) = 0
[pid 25582] 10:12:38.534682 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25582] 10:12:38.534897 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25582] 10:12:38.535025 read(6, "", 4096) = 0
[pid 25582] 10:12:38.535068 read(6, "", 4096) = 0
[pid 25582] 10:12:38.535104 close(6)    = 0
[pid 25582] 10:12:38.535138 munmap(0x7f81fe78a000, 4096) = 0
[pid 25582] 10:12:38.535180 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25582] 10:12:38.535221 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25582] 10:12:38.535267 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe78a000
[pid 25582] 10:12:38.535304 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25582] 10:12:38.535350 close(6)    = 0
[pid 25582] 10:12:38.535385 munmap(0x7f81fe78a000, 4096) = 0
[pid 25582] 10:12:38.535430 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25582] 10:12:38.535493 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f81fd640790}, NULL, 8) = 0
[pid 25582] 10:12:38.535549 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25582] 10:12:38.535603 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25582] 10:12:38.535650 fstat(0, {st_dev=makedev(0, 8), st_ino=2130170492, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.535702 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe78a000
[pid 25582] 10:12:38.535737 read(0, "X-Failed-Recipients: antiquewedding@gmail.com,\n  finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; "..., 4096) = 4096
[pid 25582] 10:12:38.535903 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.535975 open("/var/spool/exim/input/c/1aEJMc-0006ec-HH-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25582] 10:12:38.536131 fchown(6, 47, 12) = 0
[pid 25582] 10:12:38.536173 fchmod(6, 0640) = 0
[pid 25582] 10:12:38.536211 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25582] 10:12:38.536246 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080200, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.536297 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81fe789000
[pid 25582] 10:12:38.536395 lseek(6, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.536445 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25582] 10:12:38.536581 read(0, " : </span></td>        <td width=\"50%\" bgcolor=\"#FFFFFF\" class=\"style3\">&nbsp;March 13 2016</td>      </tr>      <tr>        <td width=\"50%\" align=\"right\" bgcolor=\"#FFFFFF\"><span class=\"style3\">Preferred Contact Method : </span></td>        <td width=\"50%\""..., 4096) = 422
[pid 25582] 10:12:38.536631 write(6, "1aEJMc-0006ec-HH-D\n--1451491958-eximdsn-686915313\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a perm"..., 4096) = 4096
[pid 25582] 10:12:38.536678 read(0, "", 4096) = 0
[pid 25582] 10:12:38.536711 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f81fd640790}, NULL, 8) = 0
[pid 25582] 10:12:38.536812 write(6, "html>\n\n--1451491958-eximdsn-686915313--\n", 40) = 40
[pid 25582] 10:12:38.536861 fsync(6 <unfinished ...>
[pid 25580] 10:12:38.537227 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25582] 10:12:38.537263 <... fsync resumed> ) = 0
[pid 25582] 10:12:38.537302 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25582] 10:12:38.537394 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080200, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4136, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25582] 10:12:38.537536 brk(0x1e31000) = 0x1e31000
[pid 25582] 10:12:38.537603 getuid()    = 47
[pid 25582] 10:12:38.537638 geteuid()   = 47
[pid 25582] 10:12:38.537673 getgid()    = 12
[pid 25582] 10:12:38.537706 getegid()   = 12
[pid 25582] 10:12:38.537866 open("/dev/urandom", O_RDONLY) = 8
[pid 25582] 10:12:38.537943 read(8, "\265\23v\360", 4) = 4
[pid 25582] 10:12:38.537984 close(8)    = 0
[pid 25582] 10:12:38.538099 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25582] 10:12:38.538212 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238270) = -1 EINVAL (Invalid argument)
[pid 25582] 10:12:38.538257 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25582] 10:12:38.538296 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238270) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.538331 lseek(1, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.538380 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238280) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.538421 lseek(2, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.538463 open("/dev/null", O_RDONLY) = 8
[pid 25582] 10:12:38.538510 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.538546 lseek(8, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.538580 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25582] 10:12:38.538615 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f81fd640790}, 8) = 0
[pid 25582] 10:12:38.538655 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f81fd640790}, 8) = 0
[pid 25582] 10:12:38.539022 read(8, "", 8192) = 0
[pid 25582] 10:12:38.539071 close(8)    = 0
[pid 25582] 10:12:38.539283 brk(0x1e52000) = 0x1e52000
[pid 25582] 10:12:38.539423 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.539495 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25582] 10:12:38.539539 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238180) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.539577 lseek(8, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.539630 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25582] 10:12:38.540726 brk(0x1e73000) = 0x1e73000
[pid 25582] 10:12:38.540991 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25582] 10:12:38.541983 brk(0x1e94000) = 0x1e94000
[pid 25582] 10:12:38.542325 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25559] 10:12:38.543178 <... poll resumed> ) = 1 ([{fd=16, revents=POLLIN}])
[pid 25559] 10:12:38.543217 recvfrom(16, "\27\236\201\200\0\1\0\1\0\0\0\0\4mail\22mcdowellmountaingc\3com\0\0\1\0\1\300\f\0\1\0\1\0\0008?\0\4E\2458V", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.4.4")}, [16]) = 61
[pid 25559] 10:12:38.543271 close(16)   = 0
[pid 25559] 10:12:38.543413 stat("/etc/eximmailtrap", {st_dev=makedev(144, 4215), st_ino=108284124, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-09:42:16, st_mtime=2015/12/22-09:42:16, st_ctime=2015/12/22-09:42:16}) = 0
[pid 25559] 10:12:38.543491 open("/etc/passwd", O_RDONLY) = 16
[pid 25559] 10:12:38.543539 ioctl(16, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4b5670) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.543577 lseek(16, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.543612 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.543658 fcntl(16, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.543705 read(16, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 8192) = 2429
[pid 25559] 10:12:38.544051 close(16)   = 0
[pid 25559] 10:12:38.544150 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 16
[pid 25559] 10:12:38.544204 alarm(60)   = 0
[pid 25559] 10:12:38.544239 fcntl(16, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25559] 10:12:38.544278 alarm(0)    = 60
[pid 25559] 10:12:38.544410 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.544481 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.544542 <... read resumed> "nal TTP Network1\"0 \6\3U\4\3\23\31AddTrust External CA Root0\202\1\"0\r\6\t*\206H\206\367\r\1\1\1\5\0\3\202\1\17\0000\202\1\n\2\202\1\1\0\267\367\0323\346\362\0\4-9\340N[\355\37\274l\17\315\265\372#\266\316\336\233\0213\227\244)L}\223\237\275J\274\223\355\3\32\343\217\317\345mPZ\326\227)\224Z\200\260Iz\333.\225\375\270\312\27778-\36>\221A\255pV\307\360O?\3502\236t\312\310\220T\351\306_\17x\235\232@<\16\254a\252^\24\217\236\207\241jP\334\327\232N\257\5\263\246q\224\234q\263P`\n\307\23\2358\7\206\2\250\351\250i&\30\220\253L\260O#\253:O\204\330\337\316\237\341io\273\327B\327kD\344\307\255\356mA_rZq\0107"..., 844) = 844
[pid 25559] 10:12:38.544556 <... open resumed> ) = 17
[pid 25573] 10:12:38.545778 stat("/etc/localtime",  <unfinished ...>
[pid 25572] 10:12:38.545795 <... read resumed> "ernal TTP Network1\"0 \6\3U\4\3\23\31AddTrust External CA Root0\202\1\"0\r\6\t*\206H\206\367\r\1\1\1\5\0\3\202\1\17\0000\202\1\n\2\202\1\1\0\267\367\0323\346\362\0\4-9\340N[\355\37\274l\17\315\265\372#\266\316\336\233\0213\227\244)L}\223\237\275J\274\223\355\3\32\343\217\317\345mPZ\326\227)\224Z\200\260Iz\333.\225\375\270\312\27778-\36>\221A\255pV\307\360O?\3502\236t\312\310\220T\351\306_\17x\235\232@<\16\254a\252^\24\217\236\207\241jP\334\327\232N\257\5\263\246q\224\234q\263P`\n\307\23\2358\7\206\2\250\351\250i&\30\220\253L\260O#\253:O\204\330\337\316\237\341io\273\327B\327kD\344\307\255\356mA_rZq"..., 846) = 846
[pid 25559] 10:12:38.545806 fcntl(17, F_GETFD <unfinished ...>
[pid 25573] 10:12:38.546892 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25572] 10:12:38.546916 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:38.546924 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.546977 stat("/etc/localtime",  <unfinished ...>
[pid 25572] 10:12:38.546988 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.547005 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.547052 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25572] 10:12:38.547069 stat("/etc/localtime",  <unfinished ...>
[pid 25559] 10:12:38.547075 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.547110 close(7 <unfinished ...>
[pid 25572] 10:12:38.547118 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.547133 read(17,  <unfinished ...>
[pid 25573] 10:12:38.547220 <... close resumed> ) = 0
[pid 25572] 10:12:38.547232 close(7 <unfinished ...>
[pid 25559] 10:12:38.547241 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25573] 10:12:38.547309 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25572] 10:12:38.547326 <... close resumed> ) = 0
[pid 25559] 10:12:38.547334 close(17 <unfinished ...>
[pid 25573] 10:12:38.547404 <... open resumed> ) = 7
[pid 25572] 10:12:38.547415 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25559] 10:12:38.547427 <... close resumed> ) = 0
[pid 25573] 10:12:38.547492 fcntl(7, F_GETFD <unfinished ...>
[pid 25572] 10:12:38.547503 <... open resumed> ) = 7
[pid 25559] 10:12:38.547508 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.547542 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.547548 fcntl(7, F_GETFD <unfinished ...>
[pid 25559] 10:12:38.547554 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:38.547583 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25572] 10:12:38.547591 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.547599 stat("/var/tmp",  <unfinished ...>
[pid 25573] 10:12:38.547642 <... fcntl resumed> ) = 0
[pid 25572] 10:12:38.547648 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25559] 10:12:38.547653 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25573] 10:12:38.547840 fstat(7,  <unfinished ...>
[pid 25572] 10:12:38.547853 <... fcntl resumed> ) = 0
[pid 25559] 10:12:38.547858 brk(0xc16000 <unfinished ...>
[pid 25573] 10:12:38.547895 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5390823, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25572] 10:12:38.547913 fstat(7,  <unfinished ...>
[pid 25559] 10:12:38.547935 <... brk resumed> ) = 0xc16000
[pid 25573] 10:12:38.548092 write(7, "2015-12-30 10:12:38 [25573] 1aEJMZ-0006cs-RM [208.65.145.3] SSL verify error: certificate name mismatch: \"/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU="..., 295 <unfinished ...>
[pid 25572] 10:12:38.548106 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5390823, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.548121 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.548164 <... write resumed> ) = 295
[pid 25572] 10:12:38.548170 write(7, "2015-12-30 10:12:38 [25572] 1aEJMZ-0006cs-RM [208.65.145.3] SSL verify error: certificate name mismatch: \"/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU="..., 295 <unfinished ...>
[pid 25559] 10:12:38.548178 <... open resumed> ) = 17
[pid 25573] 10:12:38.548236 read(11,  <unfinished ...>
[pid 25572] 10:12:38.548245 <... write resumed> ) = 295
[pid 25559] 10:12:38.548249 fcntl(17, F_GETFD <unfinished ...>
[pid 25573] 10:12:38.548295 <... read resumed> "\26\3\3\0\302", 5) = 5
[pid 25572] 10:12:38.548304 read(11,  <unfinished ...>
[pid 25559] 10:12:38.548309 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.548337 read(11,  <unfinished ...>
[pid 25572] 10:12:38.548345 <... read resumed> "\26\3\3\0\302", 5) = 5
[pid 25559] 10:12:38.548351 fcntl(17, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.548379 <... read resumed> "\r\0\0\272\3\1\2@\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\222\0\2200\201\2151\v0\t\6\3U\4\6\23\2AT1H0F\6\3U\4\n\f?A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH1\0310\27\6\3U\4\v\f\20A-Trust-nQual-031\0310\27\6\3U\4\3\f\20A-Trust-nQual-03\16\0\0\0", 194) = 194
[pid 25572] 10:12:38.548388 read(11,  <unfinished ...>
[pid 25559] 10:12:38.548394 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.548695 write(11, "\26\3\3\0\7\v\0\0\3\0\0\0\26\3\3\1\6\20\0\1\2\1\0H\340\370\257u(Z\r\372=R\35n\261\212\221\267 N\26xm\200k_\302\346\25\210\275\357\230`8\271\303l\206$E$\200\354\364N\266U\34\262R\350\276>bv\305\275\v\223)}B\227E\3458\224\203B\r\343\373\33W3\223l\214\333\30q\262`\22\204`-J\243\240\354\213&1e\34(w\301\337C\0\21g\336\252>|\204U\17&o\274#\266\37g>\342\330\226v:o:Qi:+\323\330\344\230c9\242\35\r\213\306.\346\\\355oX\250bce\263\212w\241\256^\7\370d\353P\23fO\30G\363\25\304\351=\3277p\16\0038\224\341\343}.\266Y\301g\337\2556h\366|\200Zl\315\313\260\242\352MLh\326CL\0106r{\230\3\6\0341CH\213Q\2\4\247\274\355\346\371\213\363>\274\273\317"..., 330 <unfinished ...>
[pid 25572] 10:12:38.548717 <... read resumed> "\r\0\0\272\3\1\2@\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\222\0\2200\201\2151\v0\t\6\3U\4\6\23\2AT1H0F\6\3U\4\n\f?A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH1\0310\27\6\3U\4\v\f\20A-Trust-nQual-031\0310\27\6\3U\4\3\f\20A-Trust-nQual-03\16\0\0\0", 194) = 194
[pid 25559] 10:12:38.548725 fstat(17,  <unfinished ...>
[pid 25573] 10:12:38.549134 <... write resumed> ) = 330
[pid 25572] 10:12:38.549149 write(11, "\26\3\3\0\7\v\0\0\3\0\0\0\26\3\3\1\6\20\0\1\2\1\0\312\320\361\217\315\252*V\313\330u\215\237=\327kek\362\226t\327\2\234\270IY\25E~\201\325`\275\377O\244O \210K\341\237\315D:[\321\\\272\355\300\6\35$\341\6H\307n\277c\27\325\314\222[\322\7\237\354\320\307P\355,\221\34\273\215L\1&\337,1z\26\0\2405\276N\210\315\206 K\256=94\242Jez9\356\252\26\201\30.Q\312\362#<\366A\361R\376\314r\200M/\3320\376\323\3529\352\332\260\377\35Ek@\365\243>uU\243\266\237w\270+%\5\3512\321>\311il\300\177>,\242R\215Y\376\274[\0\242+\374T[\277\3\206\225it\205\21\346\310\201J\255\313wIGxAsW\207\202\3&\312\323\355+_43\225\267\26\222\263\1d\201J\357o3\357\37d\27u\220\2\314dB"..., 330 <unfinished ...>
[pid 25559] 10:12:38.549170 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25573] 10:12:38.549263 read(11,  <unfinished ...>
[pid 25572] 10:12:38.549273 <... write resumed> ) = 330
[pid 25559] 10:12:38.549278 pread(17,  <unfinished ...>
[pid 25572] 10:12:38.549312 read(11,  <unfinished ...>
[pid 25559] 10:12:38.549319 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25559] 10:12:38.549373 pread(17, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25559] 10:12:38.549434 pread(17, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\n\0\327\f\0\r\305\17\200\17\\\17\33\17\366\16\265\16\212\16\305\r\213\r\327\f\32\rf\f\237\n\330\t\261\t\352\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25559] 10:12:38.549503 close(17)   = 0
[pid 25559] 10:12:38.549559 close(16)   = 0
[pid 25559] 10:12:38.549620 lseek(13, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.549657 read(13, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.549728 stat("/jail_owner", 0x7fffca4b4050) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.549867 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.549961 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa_finestweddingsites.com/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.550013 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.550068 stat("/usr/local/cpanel/3rdparty/mailman/lists/lisa/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.550112 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.550182 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.550300 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.550371 stat("/home/finest09/etc/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=121902042, st_mode=S_IFDIR|0750, st_nlink=22, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-14:19:13, st_mtime=2015/12/29-14:39:10, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.550433 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.550494 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 16
[pid 25559] 10:12:38.550539 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.550588 fstat(16, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.550646 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3a000
[pid 25559] 10:12:38.550689 lseek(16, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.550729 read(16, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25559] 10:12:38.550897 stat("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4165, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.550981 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDONLY) = 17
[pid 25559] 10:12:38.551030 ioctl(17, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffca4b0ff0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25559] 10:12:38.551068 lseek(17, 0, SEEK_CUR) = 0
[pid 25559] 10:12:38.551102 fstat(17, {st_dev=makedev(144, 4215), st_ino=122170952, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4165, st_atime=2015/12/28-14:09:19, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.551148 fcntl(17, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.551187 read(17, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 8192) = 4165
[pid 25559] 10:12:38.551866 read(17, "", 8192) = 0
[pid 25559] 10:12:38.551918 close(17)   = 0
[pid 25559] 10:12:38.551974 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.552045 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.552105 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.552177 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25559] 10:12:38.552221 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.552267 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d39000
[pid 25559] 10:12:38.552304 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.552357 close(17)   = 0
[pid 25559] 10:12:38.552394 munmap(0x7ff9b2d39000, 4096) = 0
[pid 25559] 10:12:38.552444 open("/etc/group", O_RDONLY|O_CLOEXEC) = 17
[pid 25559] 10:12:38.552488 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.552537 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d39000
[pid 25559] 10:12:38.552573 read(17, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.552636 close(17)   = 0
[pid 25559] 10:12:38.552672 munmap(0x7ff9b2d39000, 4096) = 0
[pid 25559] 10:12:38.552726 stat("/etc/vfilters/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25559] 10:12:38.552870 pipe([17, 18]) = 0
[pid 25559] 10:12:38.552909 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.552977 close(15)   = 0
[pid 25559] 10:12:38.553012 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.553051 close(14)   = 0
[pid 25559] 10:12:38.553085 munmap(0x7ff9b2d3c000, 4096) = 0
[pid 25559] 10:12:38.553119 close(9)    = 0
[pid 25559] 10:12:38.553153 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.553189 close(13)   = 0
[pid 25559] 10:12:38.553222 munmap(0x7ff9b2d3d000, 4096) = 0
[pid 25559] 10:12:38.553257 close(12)   = 0
[pid 25559] 10:12:38.553290 munmap(0x7ff9b2d3e000, 4096) = 0
[pid 25559] 10:12:38.553324 close(16)   = 0
[pid 25559] 10:12:38.553357 munmap(0x7ff9b2d3a000, 4096) = 0
[pid 25559] 10:12:38.553393 close(11)   = 0
[pid 25559] 10:12:38.553427 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.553462 close(10)   = 0
[pid 25559] 10:12:38.553498 munmap(0x7ff9b2d40000, 4096) = 0
[pid 25559] 10:12:38.553536 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25584
[pid 25559] 10:12:38.553938 close(18)   = 0
[pid 25559] 10:12:38.553998 read(17,  <unfinished ...>
[pid 25582] 10:12:38.554294 brk(0x1eb5000) = 0x1eb5000
[pid 25582] 10:12:38.554578 read(8,  <unfinished ...>
[pid 25580] 10:12:38.554626 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554651 stat("/usr/local/cpanel/Errno.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554708 stat("/etc/exim/perl/Errno.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554803 stat("/etc/exim/perl/Errno.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554850 stat("/usr/local/cpanel/Errno.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554888 stat("/usr/local/cpanel/Errno.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554926 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.554990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.555043 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25582] 10:12:38.555067 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25580] 10:12:38.555096 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.555388 read(8,  <unfinished ...>
[pid 25580] 10:12:38.555418 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.555466 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.555513 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.555571 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25580] 10:12:38.555635 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbc51cf10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25580] 10:12:38.555674 lseek(9, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.555816 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25580] 10:12:38.556064 brk(0xbba000 <unfinished ...>
[pid 25582] 10:12:38.556093 <... read resumed> "", 8192) = 0
[pid 25582] 10:12:38.556117 close(8)    = 0
[pid 25582] 10:12:38.556173 stat("/usr/share/amavis/amavis-filter", 0x7f81fce27880) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.556219 <... brk resumed> ) = 0xbba000
[pid 25582] 10:12:38.556241 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.556680 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25582] 10:12:38.556733 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25582] 10:12:38.556844 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28238180) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.556884 lseek(8, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.556958 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25582] 10:12:38.557414 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25580] 10:12:38.557549 lseek(9, 4868, SEEK_SET) = 4868
[pid 25580] 10:12:38.557593 lseek(9, 0, SEEK_CUR) = 4868
[pid 25580] 10:12:38.557627 close(9)    = 0
[pid 25580] 10:12:38.557676 stat("/usr/local/cpanel/Exporter.pmc", 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.557722 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.557798 stat("/usr/local/cpanel/Exporter.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.557846 stat("/etc/exim/perl/warnings.pm", 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.557887 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25582] 10:12:38.557912 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25580] 10:12:38.557935 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.557958 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558001 stat("/etc/exim/perl/Exporter.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558040 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25580] 10:12:38.558064 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25582] 10:12:38.558088 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558110 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558133 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25580] 10:12:38.558154 stat("/usr/local/cpanel/Exporter.pm", 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558197 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558226 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25582] 10:12:38.558249 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25580] 10:12:38.558276 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558301 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558320 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25582] 10:12:38.558347 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25580] 10:12:38.558374 <... stat resumed> 0x7fffbc51d120) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558401 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558423 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25582] 10:12:38.558445 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25580] 10:12:38.558471 <... stat resumed> 0x7fffbc51d1c0) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558502 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558523 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25582] 10:12:38.558580 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558624 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25582] 10:12:38.558666 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25580] 10:12:38.558710 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffbc51cf10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25580] 10:12:38.558834 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25582] 10:12:38.558864 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25580] 10:12:38.558888 <... lseek resumed> ) = 0
[pid 25580] 10:12:38.558922 read(9,  <unfinished ...>
[pid 25582] 10:12:38.558950 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.558971 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25580] 10:12:38.559053 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25580] 10:12:38.559478 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25582] 10:12:38.559515 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25582] 10:12:38.559583 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe28237b90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25582] 10:12:38.559642 lseek(9, 0, SEEK_CUR) = 0
[pid 25582] 10:12:38.559717 brk(0x1ed6000) = 0x1ed6000
[pid 25582] 10:12:38.559855 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25582] 10:12:38.560195 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25580] 10:12:38.560808 <... lseek resumed> ) = 2366
[pid 25580] 10:12:38.560849 lseek(9, 0, SEEK_CUR) = 2366
[pid 25580] 10:12:38.560888 close(9)    = 0
[pid 25580] 10:12:38.561237 read(8, "", 8192) = 0
[pid 25580] 10:12:38.561288 close(8)    = 0
[pid 25580] 10:12:38.561533 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25580] 10:12:38.561837 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25580] 10:12:38.561892 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ead000
[pid 25580] 10:12:38.561931 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25580] 10:12:38.562003 close(8)    = 0
[pid 25580] 10:12:38.562048 munmap(0x7f4555ead000, 4096) = 0
[pid 25580] 10:12:38.562204 lseek(6, 19, SEEK_SET) = 19
[pid 25580] 10:12:38.562249 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562290 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562327 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562364 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562402 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562441 alarm(300)  = 0
[pid 25580] 10:12:38.562477 alarm(0 <unfinished ...>
[pid 25582] 10:12:38.562580 read(9,  <unfinished ...>
[pid 25580] 10:12:38.562610 <... alarm resumed> ) = 300
[pid 25580] 10:12:38.562631 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562673 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562710 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562801 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562845 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f4554d65790}, NULL, 8) = 0
[pid 25580] 10:12:38.562884 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, 8) = 0
[pid 25580] 10:12:38.562924 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, 8) = 0
[pid 25580] 10:12:38.562981 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.563048 open("/var/spool/exim/input/c/hdr.25580", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25582] 10:12:38.563131 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25582] 10:12:38.563255 brk(0x1ef7000 <unfinished ...>
[pid 25580] 10:12:38.563290 fchown(8, 47, 12) = 0
[pid 25580] 10:12:38.563330 fchmod(8, 0640) = 0
[pid 25580] 10:12:38.563367 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25580] 10:12:38.563408 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.563464 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ead000
[pid 25580] 10:12:38.563506 lseek(8, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.563556 write(8, "1aEJMc-0006ea-Fj-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25580] 10:12:38.563619 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.563684 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMc-0006ea-Fj\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:38 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692 <unfinished ...>
[pid 25582] 10:12:38.563718 <... brk resumed> ) = 0x1ef7000
[pid 25580] 10:12:38.563838 <... write resumed> ) = 692
[pid 25582] 10:12:38.564211 read(9,  <unfinished ...>
[pid 25580] 10:12:38.564251 fsync(8 <unfinished ...>
[pid 25582] 10:12:38.564316 <... read resumed> "", 8192) = 0
[pid 25582] 10:12:38.564341 close(9)    = 0
[pid 25580] 10:12:38.564683 <... fsync resumed> ) = 0
[pid 25580] 10:12:38.564734 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.564848 close(8)    = 0
[pid 25580] 10:12:38.564885 munmap(0x7f4555ead000, 4096) = 0
[pid 25580] 10:12:38.564931 rename("/var/spool/exim/input/c/hdr.25580", "/var/spool/exim/input/c/1aEJMc-0006ea-Fj-H") = 0
[pid 25580] 10:12:38.565024 open("/var/spool/exim/input/c/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25580] 10:12:38.565072 fsync(8)    = 0
[pid 25580] 10:12:38.565110 close(8)    = 0
[pid 25580] 10:12:38.565146 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080198, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3150, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.565208 open("/var/spool/exim/msglog/c/1aEJMc-0006ea-Fj", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25579] 10:12:38.565262 <... select resumed> ) = 1 (in [11], left {299, 949970})
[pid 25579] 10:12:38.565290 recvfrom(11, "220 Go ahead with TLS\r\n", 4096, 0, NULL, NULL) = 23
[pid 25579] 10:12:38.567354 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25579] 10:12:38.567456 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25579] 10:12:38.567523 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25579] 10:12:38.567569 read(14, "\221~\246)\374\230:\320@\355\33.=\243\243\204Um\1>\305}\n\27+\355\337\315\212\307\247xn\310\v4d\332]\4\236\24\267\202\315\322&\227", 48) = 48
[pid 25579] 10:12:38.567615 close(14)   = 0
[pid 25579] 10:12:38.567669 getuid()    = 47
[pid 25580] 10:12:38.573428 <... open resumed> ) = 8
[pid 25580] 10:12:38.573473 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25580] 10:12:38.573514 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080204, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.573564 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4555ead000
[pid 25580] 10:12:38.573603 lseek(8, 0, SEEK_CUR) = 0
[pid 25580] 10:12:38.573641 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.573702 write(8, "2015-12-30 10:12:38 Received from <> R=1aEJMa-0006dL-LG U=mailnull P=local S=3774 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25580] 10:12:38.573756 close(8)    = 0
[pid 25580] 10:12:38.573794 munmap(0x7f4555ead000, 4096) = 0
[pid 25580] 10:12:38.573839 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.573903 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25580] 10:12:38.573956 close(7)    = 0
[pid 25580] 10:12:38.573996 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25580] 10:12:38.574045 fcntl(7, F_GETFD) = 0
[pid 25580] 10:12:38.574080 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25580] 10:12:38.574116 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5391413, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25580] 10:12:38.574163 write(7, "2015-12-30 10:12:38 [25580] 1aEJMc-0006ea-Fj <= <> R=1aEJMa-0006dL-LG U=mailnull P=local S=3774 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25580] 10:12:38.574208 close(6)    = 0
[pid 25580] 10:12:38.574290 munmap(0x7f4555eae000, 4096) = 0
[pid 25580] 10:12:38.574333 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, 8) = 0
[pid 25580] 10:12:38.574378 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f4553aae6a0}, 8) = 0
[pid 25580] 10:12:38.574425 open("/proc/loadavg", O_RDONLY) = 6
[pid 25580] 10:12:38.574478 read(6, "0.18 0.08 0.01 4/256 25584\n", 40) = 27
[pid 25580] 10:12:38.574522 close(6)    = 0
[pid 25580] 10:12:38.574572 clone( <unfinished ...>
[pid 25582] 10:12:38.575416 read(8,  <unfinished ...>
[pid 25580] 10:12:38.575580 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f4555e98a90) = 25585
[pid 25580] 10:12:38.575847 exit_group(0) = ?
[pid 25580] 10:12:38.576133 +++ exited with 0 +++
[pid 25522] 10:12:38.576217 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25580
[pid 25522] 10:12:38.576272 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f2e3e7136a0}, 8) = 0
[pid 25522] 10:12:38.576343 write(8, "2015-12-30 10:12:38 redmountainranch@finestweddingsites.com: children all complete\n", 83) = 83
[pid 25522] 10:12:38.576394 open("/var/spool/exim/input/a/hdr.25522", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25522] 10:12:38.576470 fchown(10, 47, 12) = 0
[pid 25522] 10:12:38.576510 fchmod(10, 0640) = 0
[pid 25522] 10:12:38.576554 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25522] 10:12:38.576593 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080206, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.576644 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e40b13000
[pid 25522] 10:12:38.576683 lseek(10, 0, SEEK_CUR) = 0
[pid 25522] 10:12:38.576731 write(10, "1aEJMa-0006dL-LG-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 704) = 704
[pid 25522] 10:12:38.576859 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080206, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=704, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.576917 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dL-LG; Wed, 30 Dec 2015 10:12:36 -0600\n062T To:  ltoms@rmrcc.com, redmountainranch@finestweddingsites.co"..., 545) = 545
[pid 25522] 10:12:38.576965 fsync(10 <unfinished ...>
[pid 25582] 10:12:38.577034 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25522] 10:12:38.577557 <... fsync resumed> ) = 0
[pid 25522] 10:12:38.577593 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080206, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1249, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.577648 close(10)   = 0
[pid 25522] 10:12:38.577685 munmap(0x7f2e40b13000, 4096) = 0
[pid 25522] 10:12:38.577731 rename("/var/spool/exim/input/a/hdr.25522", "/var/spool/exim/input/a/1aEJMa-0006dL-LG-H") = 0
[pid 25522] 10:12:38.577895 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25522] 10:12:38.577942 fsync(10)   = 0
[pid 25522] 10:12:38.577977 close(10)   = 0
[pid 25522] 10:12:38.578017 unlink("/var/spool/exim/msglog/a/1aEJMa-0006dL-LG") = 0
[pid 25522] 10:12:38.578071 unlink("/var/spool/exim/input/a/1aEJMa-0006dL-LG-D") = 0
[pid 25522] 10:12:38.578121 unlink("/var/spool/exim/input/a/1aEJMa-0006dL-LG-H") = 0
[pid 25522] 10:12:38.578190 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.578256 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25522] 10:12:38.578313 close(7)    = 0
[pid 25522] 10:12:38.578352 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25522] 10:12:38.578401 fcntl(7, F_GETFD) = 0
[pid 25522] 10:12:38.578435 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25522] 10:12:38.578469 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5391617, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25522] 10:12:38.578516 write(7, "2015-12-30 10:12:38 [25522] 1aEJMa-0006dL-LG Completed QT=2s\n", 61) = 61
[pid 25522] 10:12:38.578561 close(8)    = 0
[pid 25522] 10:12:38.578617 munmap(0x7f2e40b14000, 4096) = 0
[pid 25522] 10:12:38.578662 close(9)    = 0
[pid 25522] 10:12:38.578701 unlink("/var/spool/exim/input/a/1aEJMa-0006dL-LG-J") = 0
[pid 25522] 10:12:38.578839 close(6)    = 0
[pid 25522] 10:12:38.579027 exit_group(0) = ?
[pid 25522] 10:12:38.579635 +++ exited with 0 +++
[pid 25582] 10:12:38.580244 read(8,  <unfinished ...>
[pid 25579] 10:12:38.580354 open("/etc/pki/tls/cert.pem", O_RDONLY) = 14
[pid 25579] 10:12:38.580420 fstat(14, {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25579] 10:12:38.580476 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1d000
[pid 25579] 10:12:38.580517 read(14, "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25579] 10:12:38.580575 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25579] 10:12:38.580709 read(14,  <unfinished ...>
[pid 25582] 10:12:38.580801 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25579] 10:12:38.581394 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25579] 10:12:38.581455 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25579] 10:12:38.581569 read(14, " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25579] 10:12:38.581624 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25579] 10:12:38.581720 read(14, "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25579] 10:12:38.581898 read(14, "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25579] 10:12:38.582003 read(14, " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25579] 10:12:38.582062 read(14, "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25579] 10:12:38.582155 read(14, "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25579] 10:12:38.582247 read(14, "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25579] 10:12:38.582339 read(14, "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25579] 10:12:38.582427 read(14,  <unfinished ...>
[pid 25582] 10:12:38.582724 read(8,  <unfinished ...>
[pid 25579] 10:12:38.582826 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25579] 10:12:38.582907 read(14, "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25579] 10:12:38.582961 read(14, "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25579] 10:12:38.583103 read(14, "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25579] 10:12:38.583192 read(14, "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25579] 10:12:38.583243 read(14, "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25579] 10:12:38.583322 read(14, Process 25584 attached
"52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25582] 10:12:38.583448 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25579] 10:12:38.583522 read(14,  <unfinished ...>
[pid 25584] 10:12:38.583561 set_robust_list(0x7ff9b2d2baa0, 24) = 0
[pid 25584] 10:12:38.583871 close(17 <unfinished ...>
[pid 25579] 10:12:38.583898 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25579] 10:12:38.584000 read(14,  <unfinished ...>
[pid 25584] 10:12:38.584026 <... close resumed> ) = 0
[pid 25584] 10:12:38.584056 geteuid()   = 0
[pid 25584] 10:12:38.584091 getegid()   = 12
[pid 25584] 10:12:38.584125 setgid(500) = 0
[pid 25584] 10:12:38.584160 setuid(503) = 0
[pid 25584] 10:12:38.584224 open("/etc/vfilters/finestweddingsites.com", O_RDONLY) = 9
[pid 25584] 10:12:38.584277 fstat(9,  <unfinished ...>
[pid 25579] 10:12:38.584299 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25579] 10:12:38.584384 read(14,  <unfinished ...>
[pid 25584] 10:12:38.584410 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25584] 10:12:38.584556 fstat(9,  <unfinished ...>
[pid 25579] 10:12:38.584821 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25579] 10:12:38.584862 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25579] 10:12:38.584958 read(14,  <unfinished ...>
[pid 25584] 10:12:38.585004 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109093004, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=40, st_size=16913, st_atime=2015/12/22-14:13:51, st_mtime=2015/12/22-14:14:47, st_ctime=2015/12/22-14:14:47}) = 0
[pid 25584] 10:12:38.585083 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25584] 10:12:38.585145 read(9, "# Exim filter\n\n# Auto Generated by cPanel.  Do not manually edit this file as your changes will be overwritten.  If you must edit this filter, edit the corresponding .yaml file as well.\n\nif not first_delivery and error_message then finish endif\n\n#Spam1\nif\n"..., 16384) = 16384
[pid 25579] 10:12:38.585277 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25579] 10:12:38.585411 read(14,  <unfinished ...>
[pid 25584] 10:12:38.585453 read(9, " contains \"diabete\"\n or $header_from: contains \"discreet\"\n or $header_subject: contains \"discreet\"\n or $header_from: contains \"repair score\"\n or $header_subject: contains \"repair score\"\n or $header_from: contains \"protect\"\n or $header_subject: contains \"pr"..., 4096) = 529
[pid 25584] 10:12:38.585531 close(9)    = 0
[pid 25584] 10:12:38.585590 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25582] 10:12:38.586387 read(8,  <unfinished ...>
[pid 25579] 10:12:38.586458 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25579] 10:12:38.586525 read(14, "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25579] 10:12:38.586686 read(14,  <unfinished ...>
[pid 25584] 10:12:38.587282 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25579] 10:12:38.587331 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25579] 10:12:38.587465 read(14, "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25579] 10:12:38.587555 read(14, "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25579] 10:12:38.587708 read(14, "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25579] 10:12:38.588035 read(14, "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25579] 10:12:38.588129 read(14, "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25579] 10:12:38.588293 read(14,  <unfinished ...>
[pid 25582] 10:12:38.588342 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25582] 10:12:38.588689 brk(0x1f18000 <unfinished ...>
[pid 25579] 10:12:38.588738 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25579] 10:12:38.589000 read(14,  <unfinished ...>
[pid 25584] 10:12:38.589048 <... lseek resumed> ) = 19
[pid 25584] 10:12:38.589085 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 2383) = 1858
[pid 25579] 10:12:38.589831 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25579] 10:12:38.589988 read(14, " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25579] 10:12:38.590191 read(14,  <unfinished ...>
[pid 25582] 10:12:38.590236 <... brk resumed> ) = 0x1f18000
[pid 25579] 10:12:38.590392 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25579] 10:12:38.590459 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25579] 10:12:38.591000 read(14, "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25579] 10:12:38.591182 read(14,  <unfinished ...>
[pid 25582] 10:12:38.591644 read(8,  <unfinished ...>
[pid 25579] 10:12:38.591699 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25579] 10:12:38.591890 read(14,  <unfinished ...>
[pid 25584] 10:12:38.592035 write(18, "\2\0\0\0", 4 <unfinished ...>
[pid 25579] 10:12:38.592065 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25579] 10:12:38.592101 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25579] 10:12:38.592193 read(14, "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25579] 10:12:38.592293 read(14,  <unfinished ...>
[pid 25559] 10:12:38.592323 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25559] 10:12:38.592346 read(17,  <unfinished ...>
[pid 25584] 10:12:38.592367 <... write resumed> ) = 4
[pid 25584] 10:12:38.592385 write(18, "\1\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.592408 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25559] 10:12:38.592428 read(17,  <unfinished ...>
[pid 25584] 10:12:38.592448 <... write resumed> ) = 4
[pid 25584] 10:12:38.592465 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.592489 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25573] 10:12:38.592524 <... read resumed> "\26\3\3\0\252", 5) = 5
[pid 25559] 10:12:38.592533 read(17,  <unfinished ...>
[pid 25573] 10:12:38.592558 read(11, "\4\0\0\246\0\0\1,\0\240M\306\217\307\236\345o:?a^\367\5ra\245!\226\344\23($O\246\326\310\304G4\315)g~\275U\240\237W\333@\304j33\321\315]\307c\203\365\376\336\201\27\10\261\362Ai\345\300e\30\372\t\r\233im\3+,\261Y$\226\274\232\314`P\4\235\340\206\223D6\315\226b\305\367\214d\252\v)*7\7\340\317\177\256\0\35,'\373\365w]\3\337\362>\313\177\303\327E\373\343\277\357>\244\356pC\230$Q\16\22<D9\344V\341\7\344\37\330\253\352\37\217\311A\345\266\213\345\373\26w", 170) = 170
[pid 25573] 10:12:38.592623 read(11, "\24\3\3\0\1", 5) = 5
[pid 25573] 10:12:38.592674 read(11, "\1", 1) = 1
[pid 25573] 10:12:38.592827 read(11, "\26\3\3\0(", 5) = 5
[pid 25573] 10:12:38.592869 read(11, "7\26\202\32D\2623\300\36\220U)\255)\274\302\363d\247\235\23q\2\224Z\371\254\v\0~\351\236\335\205\330T\377\6\327k", 40) = 40
[pid 25573] 10:12:38.592946 alarm(0)    = 300
[pid 25573] 10:12:38.593019 write(11, "\27\3\3\0009K\221h\235\34\260\330\33\256Z0\343\317[B\226\340U'\201\367O$\3:\16z\337\3215\334\303)q\22FM\205~\213\376T\355\241\211\302\32\331\24d\25\3276\26\222\0\275", 62) = 62
[pid 25573] 10:12:38.593086 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25584] 10:12:38.593118 <... write resumed> ) = 4
[pid 25584] 10:12:38.593138 write(18, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25559] 10:12:38.593166 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25559] 10:12:38.593188 read(17,  <unfinished ...>
[pid 25584] 10:12:38.593208 <... write resumed> ) = 40
[pid 25584] 10:12:38.593226 write(18, "\0\0\0\0", 4 <unfinished ...>
[pid 25559] 10:12:38.593265 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25572] 10:12:38.593298 <... read resumed> "\26\3\3\0\252", 5) = 5
[pid 25559] 10:12:38.593307 wait4(-1,  <unfinished ...>
[pid 25572] 10:12:38.593331 read(11, "\4\0\0\246\0\0\1,\0\2406\363p>\2\226\205\335\254\321!\322('.\0=\17}\235G@\275\303\225\321\3441\322m\17\17r:\346\255\24\224A\245(e\321\321\4W\203 \23\340\364\211\4\360\206F\343\337oJQ\275\333T\264\3\324\31\216\6\375\326\345\327\360\374YC\305\217f\325uo\223\372\364\363ZG\317\2657'\357P\263 \276\374o\330W\245/\f\25\223V\23521\363.ef\346\316/\240\321B\344\251\17\320\277fk@\302Jk\343\37\216\325\205\344\241\356\31\213\341\345I\306\177R\3744\367\265\216\242^?\206\306\364", 170) = 170
[pid 25572] 10:12:38.593387 read(11, "\24\3\3\0\1", 5) = 5
[pid 25572] 10:12:38.593422 read(11, "\1", 1) = 1
[pid 25572] 10:12:38.593483 read(11, "\26\3\3\0(", 5) = 5
[pid 25572] 10:12:38.593523 read(11, "\0358\355\344\247\267G\210\273\3127v\32\343\20O\27d!\356\276a\223n3\224\2440\232e\350\16\207\342y\23\267\t]Q", 40) = 40
[pid 25572] 10:12:38.593590 alarm(0)    = 300
[pid 25572] 10:12:38.593651 write(11, "\27\3\3\0009B\321\5\374\316Y\v\347|\203\326\n\177\370u\234\336\354N#\354RD\30169\t\"\"\10\254\357#\326\277\374\20\231Y\237\212\323\fT\273\20283\260\f\f\20\211\34k\\\341", 62) = 62
[pid 25572] 10:12:38.593714 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25584] 10:12:38.593808 <... write resumed> ) = 4
[pid 25584] 10:12:38.593833 close(18)   = 0
[pid 25584] 10:12:38.593883 exit_group(0) = ?
[pid 25579] 10:12:38.593905 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25579] 10:12:38.594012 read(14,  <unfinished ...>
[pid 25584] 10:12:38.594287 +++ exited with 0 +++
[pid 25559] 10:12:38.594316 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25584
[pid 25559] 10:12:38.594340 close(17)   = 0
[pid 25559] 10:12:38.594390 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:38.594466 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.594541 open("/etc/userdomains", O_RDONLY) = 9
[pid 25559] 10:12:38.594583 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.594635 fstat(9, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.594686 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.594726 lseek(9, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.594832 read(9, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.594899 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.594962 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.595045 stat("/home/finest09/etc/finestweddingsites.com/lisa/filter", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.595098 stat("/etc/valiases/finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.595159 open("/etc/valiases/finestweddingsites.com", O_RDONLY) = 10
[pid 25559] 10:12:38.595201 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.595248 fstat(10, {st_dev=makedev(144, 4215), st_ino=109093042, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=870, st_atime=2015/12/22-14:14:47, st_mtime=2015/12/28-15:45:09, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.595292 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25559] 10:12:38.595328 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.595361 read(10, "advertise@finestweddingsites.com: teri@finestweddingsites.com\nashley@finestweddingsites.com: \"|/usr/local/cpanel/bin/autorespond ashley@finestweddingsites.com /home/finest09/.autorespond\"\nbridesfrom@finestweddingsites.com: lisa@finestweddingsites.com\nchris"..., 4096) = 870
[pid 25559] 10:12:38.595408 read(10, "", 4096) = 0
[pid 25559] 10:12:38.595461 open("/etc/group", O_RDONLY|O_CLOEXEC) = 11
[pid 25559] 10:12:38.595511 fstat(11, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.595559 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.595599 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.595662 close(11)   = 0
[pid 25559] 10:12:38.595707 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.595849 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.595924 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25559] 10:12:38.595987 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.596088 open("/home/finest09/etc/finestweddingsites.com/passwd", O_RDONLY) = 11
[pid 25559] 10:12:38.596134 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.596181 fstat(11, {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.596226 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25559] 10:12:38.596262 lseek(11, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.596295 read(11, "bridalleads:x:689:689::/home/finest09/mail/finestweddingsites.com/bridalleads:/usr/local/cpanel/bin/noshell\nbruce:x:689:689::/home/finest09/mail/finestweddingsites.com/bruce:/usr/local/cpanel/bin/noshell\nteri:x:689:689::/home/finest09/mail/finestweddingsit"..., 4096) = 2781
[pid 25559] 10:12:38.596359 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.596419 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.596483 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.596561 stat("/home/finest09/etc/finestweddingsites.com/lisa/.boxtrapperenable", 0x7fffca4b2aa0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.596611 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.596671 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.596829 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.596899 stat("/home/finest09/.spamassassinboxenable", {st_dev=makedev(144, 4215), st_ino=120336318, st_mode=S_IFREG|0644, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/22-14:19:07, st_mtime=2014/08/12-11:10:20, st_ctime=2015/12/29-14:48:34}) = 0
[pid 25559] 10:12:38.596965 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.597033 lseek(11, 2781, SEEK_SET) = 2781
[pid 25559] 10:12:38.597084 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.597140 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.597198 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.597266 stat("/home/finest09/etc/finestweddingsites.com/bridesfrom/.boxtrapperenable", 0x7fffca4b2aa0) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.597315 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.597388 stat("/home/finest09/etc/finestweddingsites.com/passwd", {st_dev=makedev(144, 4215), st_ino=121902516, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=2781, st_atime=2015/12/22-14:19:13, st_mtime=2015/03/28-15:47:39, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25559] 10:12:38.597463 open("/etc/localdomains", O_RDONLY) = 12
[pid 25559] 10:12:38.597512 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.597561 fstat(12, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.597605 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3e000
[pid 25559] 10:12:38.597643 lseek(12, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.597676 read(12, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25559] 10:12:38.597728 stat("/jail_owner", 0x7fffca4b4050) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.597862 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.597928 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.597980 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25559] 10:12:38.598071 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.598120 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.598183 open("/etc/demouids", O_RDONLY) = 13
[pid 25559] 10:12:38.598226 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.598276 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.598323 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3d000
[pid 25559] 10:12:38.598362 lseek(13, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.598399 read(13, "", 4096) = 0
[pid 25559] 10:12:38.598442 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.598531 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.598612 lseek(9, 353, SEEK_SET) = 353
[pid 25559] 10:12:38.598664 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
[pid 25559] 10:12:38.598715 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.598850 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3c000
[pid 25559] 10:12:38.598895 read(14, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.598947 close(14)   = 0
[pid 25559] 10:12:38.598986 munmap(0x7ff9b2d3c000, 4096) = 0
[pid 25559] 10:12:38.599039 stat("//etc/fin.finestweddingsites.com", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.599112 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.599180 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.599242 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.599310 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.599379 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.599441 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.599522 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.599571 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.599631 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 14
[pid 25559] 10:12:38.599675 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.599725 fstat(14, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.599867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3c000
[pid 25559] 10:12:38.599909 lseek(14, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.599945 read(14, "", 4096) = 0
[pid 25559] 10:12:38.599993 open("/etc/group", O_RDONLY|O_CLOEXEC) = 15
[pid 25559] 10:12:38.600057 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.600112 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.600151 read(15, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.600202 close(15)   = 0
[pid 25559] 10:12:38.600243 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.600295 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.600362 stat("//.spamassassinboxenable", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.600411 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.600468 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25559] 10:12:38.600535 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.600592 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.600667 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fffca4b6e40) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.600713 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.600859 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.600974 lseek(14, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.601039 read(14, "", 4096) = 0
[pid 25559] 10:12:38.601097 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.601164 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 15
[pid 25559] 10:12:38.601280 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.601333 fstat(15, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.601386 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3b000
[pid 25559] 10:12:38.601428 lseek(15, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.601464 read(15, "", 4096) = 0
[pid 25559] 10:12:38.601510 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25559] 10:12:38.601577 open("/etc/group", O_RDONLY|O_CLOEXEC) = 16
[pid 25559] 10:12:38.601621 fstat(16, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25559] 10:12:38.601670 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3a000
[pid 25559] 10:12:38.601708 read(16, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25559] 10:12:38.601833 close(16)   = 0
[pid 25559] 10:12:38.601878 munmap(0x7ff9b2d3a000, 4096) = 0
[pid 25559] 10:12:38.601932 open("/etc/aliases", O_RDONLY) = 16
[pid 25559] 10:12:38.601979 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25559] 10:12:38.602054 fstat(16, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25559] 10:12:38.602109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3a000
[pid 25559] 10:12:38.602149 lseek(16, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.602185 read(16, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25559] 10:12:38.602243 read(16, "", 4096) = 0
[pid 25559] 10:12:38.602292 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 17
[pid 25559] 10:12:38.602339 fstat(17, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25559] 10:12:38.602400 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d39000
[pid 25559] 10:12:38.602448 read(17, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25559] 10:12:38.602513 close(17)   = 0
[pid 25559] 10:12:38.602552 munmap(0x7ff9b2d39000, 4096) = 0
[pid 25559] 10:12:38.602602 open("/etc/localaliases", O_RDONLY) = 17
[pid 25559] 10:12:38.602648 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25559] 10:12:38.602698 fstat(17, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25559] 10:12:38.602818 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d39000
[pid 25559] 10:12:38.602867 lseek(17, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.602904 read(17, "", 4096) = 0
[pid 25559] 10:12:38.602951 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.603016 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.603102 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.603163 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.603224 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.603299 write(8, "2015-12-30 10:12:38 routing failed for finest09@fin.finestweddingsites.com <mcdowell-mountain@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 179) = 179
[pid 25559] 10:12:38.603350 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.603418 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.603472 close(7)    = 0
[pid 25559] 10:12:38.603518 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25559] 10:12:38.603566 fcntl(7, F_GETFD) = 0
[pid 25559] 10:12:38.603602 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.603641 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5391678, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.603689 write(7, "2015-12-30 10:12:38 [25559] 1aEJMb-0006e1-MY ** finest09@fin.finestweddingsites.com <mcdowell-mountain@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com>: Unrouteable address\n", 188) = 188
[pid 25559] 10:12:38.603735 close(16)   = 0
[pid 25559] 10:12:38.603865 munmap(0x7ff9b2d3a000, 4096) = 0
[pid 25559] 10:12:38.603909 close(17)   = 0
[pid 25559] 10:12:38.603946 munmap(0x7ff9b2d39000, 4096) = 0
[pid 25559] 10:12:38.603984 close(13)   = 0
[pid 25559] 10:12:38.604044 munmap(0x7ff9b2d3d000, 4096) = 0
[pid 25559] 10:12:38.604085 close(14)   = 0
[pid 25559] 10:12:38.604122 munmap(0x7ff9b2d3c000, 4096) = 0
[pid 25559] 10:12:38.604159 close(9)    = 0
[pid 25559] 10:12:38.604198 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.604239 close(12)   = 0
[pid 25559] 10:12:38.604279 munmap(0x7ff9b2d3e000, 4096) = 0
[pid 25559] 10:12:38.604317 close(15)   = 0
[pid 25559] 10:12:38.604355 munmap(0x7ff9b2d3b000, 4096) = 0
[pid 25559] 10:12:38.604394 close(11)   = 0
[pid 25559] 10:12:38.604431 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25559] 10:12:38.604480 close(10)   = 0
[pid 25559] 10:12:38.604521 munmap(0x7ff9b2d40000, 4096) = 0
[pid 25559] 10:12:38.604566 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-J", O_WRONLY|O_CREAT|O_APPEND, 0640) = 9
[pid 25559] 10:12:38.604645 fcntl(9, F_GETFD) = 0
[pid 25559] 10:12:38.604681 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.604716 fchown(9, 47, 12) = 0
[pid 25559] 10:12:38.604838 fchmod(9, 0640) = 0
[pid 25559] 10:12:38.604906 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 10
[pid 25559] 10:12:38.604988 alarm(60)   = 0
[pid 25559] 10:12:38.605027 fcntl(10, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25559] 10:12:38.605069 alarm(0)    = 60
[pid 25559] 10:12:38.605140 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.605206 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25559] 10:12:38.605251 fcntl(11, F_GETFD) = 0
[pid 25559] 10:12:38.605286 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.605364 read(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25559] 10:12:38.605447 close(11)   = 0
[pid 25559] 10:12:38.605499 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.605548 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25559] 10:12:38.605712 open("/var/spool/exim/db/retry", O_RDONLY) = 11
[pid 25559] 10:12:38.605831 fcntl(11, F_GETFD) = 0
[pid 25559] 10:12:38.605872 fcntl(11, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.605908 fstat(11, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25559] 10:12:38.605975 pread(11, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25559] 10:12:38.606062 pread(11, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25559] 10:12:38.606121 close(11)   = 0
[pid 25559] 10:12:38.606180 close(10)   = 0
[pid 25559] 10:12:38.606233 open("/etc/userdomains", O_RDONLY) = 10
[pid 25559] 10:12:38.606279 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.606331 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.606392 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.606437 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.606480 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.606548 pipe([11, 12]) = 0
[pid 25559] 10:12:38.606595 close(10)   = 0
[pid 25559] 10:12:38.606636 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.606678 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25586
[pid 25559] 10:12:38.607090 close(12)   = 0
[pid 25559] 10:12:38.607131 read(11, Process 25585 attached
 <unfinished ...>
[pid 25585] 10:12:38.607196 set_robust_list(0x7f4555e98aa0, 24) = 0
[pid 25585] 10:12:38.607257 close(0 <unfinished ...>
[pid 25579] 10:12:38.607289 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25579] 10:12:38.607383 read(14,  <unfinished ...>
[pid 25585] 10:12:38.607421 <... close resumed> ) = 0
[pid 25585] 10:12:38.607447 close(1)    = 0
[pid 25585] 10:12:38.607483 close(2)    = 0
[pid 25585] 10:12:38.607580 setsid( <unfinished ...>
[pid 25579] 10:12:38.607612 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25579] 10:12:38.607696 read(14,  <unfinished ...>
[pid 25585] 10:12:38.607729 <... setsid resumed> ) = 25585
[pid 25582] 10:12:38.607816 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25585] 10:12:38.607852 fstat(0, 0x7fffbc521a40) = -1 EBADF (Bad file descriptor)
[pid 25585] 10:12:38.608391 open("/dev/null", O_RDWR) = 0
[pid 25585] 10:12:38.608471 fstat(1, 0x7fffbc521a40) = -1 EBADF (Bad file descriptor)
[pid 25585] 10:12:38.608523 dup2(0, 1 <unfinished ...>
[pid 25579] 10:12:38.608554 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25579] 10:12:38.608590 read(14,  <unfinished ...>
[pid 25585] 10:12:38.608618 <... dup2 resumed> ) = 1
[pid 25585] 10:12:38.608638 fstat(2, 0x7fffbc521a40) = -1 EBADF (Bad file descriptor)
[pid 25585] 10:12:38.608674 dup2(0, 2)  = 2
[pid 25585] 10:12:38.608709 geteuid( <unfinished ...>
[pid 25579] 10:12:38.608736 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25585] 10:12:38.608826 <... geteuid resumed> ) = 47
[pid 25579] 10:12:38.608864 read(14,  <unfinished ...>
[pid 25585] 10:12:38.608902 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25585] 10:12:38.608953 fstat(1,  <unfinished ...>
[pid 25579] 10:12:38.609003 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25585] 10:12:38.609033 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25579] 10:12:38.609148 read(14,  <unfinished ...>
[pid 25585] 10:12:38.609181 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25585] 10:12:38.609236 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMc-0006ea-Fj"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25579] 10:12:38.609850 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25579] 10:12:38.609941 read(14, "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25579] 10:12:38.610061 read(14, "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25579] 10:12:38.610170 read(14, "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25579] 10:12:38.610277 read(14, "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25579] 10:12:38.610394 read(14, "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25579] 10:12:38.610542 read(14,  <unfinished ...>
[pid 25585] 10:12:38.610673 <... execve resumed> ) = 0
[pid 25579] 10:12:38.610823 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25579] 10:12:38.610870 read(14, "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25582] 10:12:38.611286 brk(0x1f39000 <unfinished ...>
[pid 25579] 10:12:38.611395 read(14,  <unfinished ...>
[pid 25585] 10:12:38.611445 brk(0)      = 0x158b000
[pid 25585] 10:12:38.611485 fcntl(0, F_GETFD) = 0
[pid 25585] 10:12:38.611525 fcntl(1, F_GETFD) = 0
[pid 25585] 10:12:38.611559 fcntl(2, F_GETFD) = 0
[pid 25585] 10:12:38.611597 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25579] 10:12:38.611630 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25585] 10:12:38.611659 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.611735 read(14,  <unfinished ...>
[pid 25585] 10:12:38.611854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63709000
[pid 25585] 10:12:38.611912 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.611967 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.612017 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25579] 10:12:38.612054 brk(0x2184000 <unfinished ...>
[pid 25585] 10:12:38.612107 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612151 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.612181 <... brk resumed> ) = 0x2184000
[pid 25585] 10:12:38.612205 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.612283 read(14,  <unfinished ...>
[pid 25585] 10:12:38.612316 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612362 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612416 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612468 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612513 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25585] 10:12:38.612570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.612622 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25579] 10:12:38.612694 read(14,  <unfinished ...>
[pid 25585] 10:12:38.612725 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612849 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612905 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612948 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.612991 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64",  <unfinished ...>
[pid 25579] 10:12:38.613020 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25585] 10:12:38.613049 <... stat resumed> 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.613152 read(14,  <unfinished ...>
[pid 25585] 10:12:38.613184 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613229 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25585] 10:12:38.613287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613328 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613368 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613411 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613450 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.613495 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25579] 10:12:38.613581 read(14,  <unfinished ...>
[pid 25585] 10:12:38.613611 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffc4d862770) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613652 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.613694 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25585] 10:12:38.613835 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25585] 10:12:38.613882 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.613911 <... brk resumed> ) = 0x1f39000
[pid 25585] 10:12:38.613931 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25582] 10:12:38.614143 read(8,  <unfinished ...>
[pid 25585] 10:12:38.614179 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f4b636ff000
[pid 25585] 10:12:38.614219 close(6)    = 0
[pid 25585] 10:12:38.614262 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.614294 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25579] 10:12:38.614391 read(14,  <unfinished ...>
[pid 25585] 10:12:38.614433 <... open resumed> ) = 6
[pid 25585] 10:12:38.614455 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.614516 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.614569 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b632d1000
[pid 25585] 10:12:38.614609 mprotect(0x7f4b632e7000, 2097152, PROT_NONE) = 0
[pid 25585] 10:12:38.614649 mmap(0x7f4b634e7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f4b634e7000
[pid 25585] 10:12:38.614697 mmap(0x7f4b634e9000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4b634e9000
[pid 25585] 10:12:38.614815 close(6)    = 0
[pid 25579] 10:12:38.614861 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25585] 10:12:38.614898 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.614996 read(14,  <unfinished ...>
[pid 25585] 10:12:38.615031 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.615053 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.615102 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.615149 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25585] 10:12:38.615193 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.615235 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.615285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b636fe000
[pid 25585] 10:12:38.615328 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.615359 <... read resumed> "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25582] 10:12:38.615388 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25579] 10:12:38.615479 read(14,  <unfinished ...>
[pid 25585] 10:12:38.615517 <... mmap resumed> ) = 0x7f4b630b8000
[pid 25585] 10:12:38.615831 mprotect(0x7f4b630ce000, 2093056, PROT_NONE) = 0
[pid 25585] 10:12:38.615881 mmap(0x7f4b632cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f4b632cd000
[pid 25585] 10:12:38.615931 mmap(0x7f4b632cf000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4b632cf000
[pid 25585] 10:12:38.615978 close(6)    = 0
[pid 25585] 10:12:38.616047 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.616096 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25579] 10:12:38.616193 read(14,  <unfinished ...>
[pid 25585] 10:12:38.616225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.616271 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.616321 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25585] 10:12:38.616365 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.616431 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.616485 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b62e81000
[pid 25585] 10:12:38.616530 mprotect(0x7f4b62e88000, 2097152, PROT_NONE) = 0
[pid 25579] 10:12:38.616568 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25585] 10:12:38.616653 mmap(0x7f4b63088000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000 <unfinished ...>
[pid 25579] 10:12:38.616681 read(14,  <unfinished ...>
[pid 25585] 10:12:38.616713 <... mmap resumed> ) = 0x7f4b63088000
[pid 25585] 10:12:38.616739 mmap(0x7f4b6308a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4b6308a000
[pid 25585] 10:12:38.616881 close(6 <unfinished ...>
[pid 25579] 10:12:38.616905 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25585] 10:12:38.617388 <... close resumed> ) = 0
[pid 25582] 10:12:38.617416 read(8,  <unfinished ...>
[pid 25579] 10:12:38.617454 read(14,  <unfinished ...>
[pid 25585] 10:12:38.617486 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.617547 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.617572 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25585] 10:12:38.617617 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.617634 read(14,  <unfinished ...>
[pid 25585] 10:12:38.617664 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.617686 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25585] 10:12:38.617858 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.617882 read(14,  <unfinished ...>
[pid 25585] 10:12:38.617912 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25585] 10:12:38.617964 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.618006 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25585] 10:12:38.618125 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.618152 read(14,  <unfinished ...>
[pid 25585] 10:12:38.618179 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.618215 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b62bfd000
[pid 25585] 10:12:38.618256 mprotect(0x7f4b62c80000, 2093056, PROT_NONE) = 0
[pid 25585] 10:12:38.618295 mmap(0x7f4b62e7f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f4b62e7f000
[pid 25585] 10:12:38.618349 close(6 <unfinished ...>
[pid 25579] 10:12:38.618372 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25585] 10:12:38.618411 <... close resumed> ) = 0
[pid 25579] 10:12:38.618426 read(14,  <unfinished ...>
[pid 25585] 10:12:38.618465 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.618488 <... read resumed> "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25585] 10:12:38.618591 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.618612 read(14,  <unfinished ...>
[pid 25585] 10:12:38.618645 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.618692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.618733 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25585] 10:12:38.618861 open("/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.618890 read(14,  <unfinished ...>
[pid 25585] 10:12:38.618928 <... open resumed> ) = 6
[pid 25579] 10:12:38.618942 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25585] 10:12:38.619068 read(6,  <unfinished ...>
[pid 25579] 10:12:38.619095 read(14,  <unfinished ...>
[pid 25585] 10:12:38.619129 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.619164 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.619187 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25585] 10:12:38.619697 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25582] 10:12:38.619820 brk(0x1f5a000 <unfinished ...>
[pid 25585] 10:12:38.619858 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.619882 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25585] 10:12:38.619982 <... mmap resumed> ) = 0x7f4b636fd000
[pid 25579] 10:12:38.620002 read(14,  <unfinished ...>
[pid 25585] 10:12:38.620056 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b629ef000
[pid 25579] 10:12:38.620098 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25585] 10:12:38.620190 mprotect(0x7f4b629fb000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.620292 read(14,  <unfinished ...>
[pid 25585] 10:12:38.620334 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.620357 mmap(0x7f4b62bfb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f4b62bfb000
[pid 25585] 10:12:38.620413 close(6)    = 0
[pid 25579] 10:12:38.620449 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25585] 10:12:38.620567 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.620596 read(14,  <unfinished ...>
[pid 25585] 10:12:38.620633 <... open resumed> ) = 6
[pid 25585] 10:12:38.620652 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.620695 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25585] 10:12:38.620836 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.620867 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25585] 10:12:38.620973 <... mmap resumed> ) = 0x7f4b627cc000
[pid 25579] 10:12:38.620992 read(14,  <unfinished ...>
[pid 25585] 10:12:38.621019 mprotect(0x7f4b627ed000, 2097152, PROT_NONE) = 0
[pid 25585] 10:12:38.621080 mmap(0x7f4b629ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f4b629ed000
[pid 25585] 10:12:38.621131 close(6)    = 0
[pid 25585] 10:12:38.621179 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.621204 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25585] 10:12:38.621303 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.621323 read(14,  <unfinished ...>
[pid 25585] 10:12:38.621350 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.621410 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.621463 open("/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.621486 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25585] 10:12:38.621583 <... open resumed> ) = 6
[pid 25579] 10:12:38.621602 read(14,  <unfinished ...>
[pid 25585] 10:12:38.621628 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.621676 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.621733 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.621849 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25585] 10:12:38.621875 <... mmap resumed> ) = 0x7f4b625af000
[pid 25582] 10:12:38.621944 <... brk resumed> ) = 0x1f5a000
[pid 25585] 10:12:38.621967 mprotect(0x7f4b625c6000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.622174 read(14,  <unfinished ...>
[pid 25585] 10:12:38.622207 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.622222 read(8,  <unfinished ...>
[pid 25585] 10:12:38.622247 mmap(0x7f4b627c6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25579] 10:12:38.622270 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25585] 10:12:38.622358 <... mmap resumed> ) = 0x7f4b627c6000
[pid 25579] 10:12:38.622379 read(14,  <unfinished ...>
[pid 25585] 10:12:38.622416 mmap(0x7f4b627c8000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.622439 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25585] 10:12:38.622479 <... mmap resumed> ) = 0x7f4b627c8000
[pid 25579] 10:12:38.622495 brk(0x21a5000 <unfinished ...>
[pid 25585] 10:12:38.622534 close(6 <unfinished ...>
[pid 25579] 10:12:38.622555 <... brk resumed> ) = 0x21a5000
[pid 25585] 10:12:38.622625 <... close resumed> ) = 0
[pid 25579] 10:12:38.622642 read(14,  <unfinished ...>
[pid 25585] 10:12:38.622680 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.622722 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25585] 10:12:38.622877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.622903 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25579] 10:12:38.622925 read(14,  <unfinished ...>
[pid 25585] 10:12:38.623407 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.623472 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25585] 10:12:38.623571 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.623606 read(14,  <unfinished ...>
[pid 25585] 10:12:38.623640 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.623664 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25585] 10:12:38.623705 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.623821 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.623851 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25585] 10:12:38.623890 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25579] 10:12:38.623926 read(14,  <unfinished ...>
[pid 25585] 10:12:38.623959 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.623981 <... read resumed> "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25585] 10:12:38.624089 <... mmap resumed> ) = 0x7f4b636fc000
[pid 25579] 10:12:38.624110 read(14,  <unfinished ...>
[pid 25585] 10:12:38.624142 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b6223b000
[pid 25579] 10:12:38.624181 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25585] 10:12:38.624264 mprotect(0x7f4b623aa000, 2093056, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.624289 read(14,  <unfinished ...>
[pid 25585] 10:12:38.624320 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.624340 mmap(0x7f4b625a9000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f4b625a9000
[pid 25585] 10:12:38.624396 close(6 <unfinished ...>
[pid 25579] 10:12:38.624420 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25585] 10:12:38.624553 <... close resumed> ) = 0
[pid 25579] 10:12:38.624575 read(14,  <unfinished ...>
[pid 25585] 10:12:38.624610 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.624655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.624699 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25585] 10:12:38.624844 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.624937 read(14,  <unfinished ...>
[pid 25585] 10:12:38.624968 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25585] 10:12:38.625041 read(6,  <unfinished ...>
[pid 25579] 10:12:38.625065 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25585] 10:12:38.625157 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.625183 read(14,  <unfinished ...>
[pid 25585] 10:12:38.625211 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25585] 10:12:38.625380 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b61fac000
[pid 25579] 10:12:38.625443 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25585] 10:12:38.625508 mprotect(0x7f4b62037000, 2097152, PROT_NONE) = 0
[pid 25579] 10:12:38.625585 read(14,  <unfinished ...>
[pid 25585] 10:12:38.625613 mmap(0x7f4b62237000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f4b62237000
[pid 25585] 10:12:38.625661 mmap(0x7f4b6223a000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4b6223a000
[pid 25579] 10:12:38.625710 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25585] 10:12:38.625873 close(6 <unfinished ...>
[pid 25579] 10:12:38.625902 read(14,  <unfinished ...>
[pid 25585] 10:12:38.626142 <... close resumed> ) = 0
[pid 25582] 10:12:38.626160 read(8,  <unfinished ...>
[pid 25585] 10:12:38.626196 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.626247 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.626270 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25585] 10:12:38.626325 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.626343 read(14,  <unfinished ...>
[pid 25585] 10:12:38.626373 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.626398 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25585] 10:12:38.626536 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.626573 read(14,  <unfinished ...>
[pid 25585] 10:12:38.626604 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25585] 10:12:38.626649 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.626692 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25585] 10:12:38.626819 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.626849 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25585] 10:12:38.626946 <... mmap resumed> ) = 0x7f4b61da6000
[pid 25579] 10:12:38.626966 read(14,  <unfinished ...>
[pid 25585] 10:12:38.627021 mprotect(0x7f4b61dac000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.627043 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25585] 10:12:38.627396 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.627422 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25585] 10:12:38.627506 mmap(0x7f4b61fab000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f4b61fab000
[pid 25585] 10:12:38.627562 close(6)    = 0
[pid 25579] 10:12:38.627634 read(14,  <unfinished ...>
[pid 25585] 10:12:38.627670 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.627715 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25579] 10:12:38.627833 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25585] 10:12:38.627928 read(6,  <unfinished ...>
[pid 25579] 10:12:38.627953 read(14,  <unfinished ...>
[pid 25585] 10:12:38.627980 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.628008 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25585] 10:12:38.628101 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.628128 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25585] 10:12:38.628210 <... mmap resumed> ) = 0x7f4b636fb000
[pid 25579] 10:12:38.628231 read(14,  <unfinished ...>
[pid 25585] 10:12:38.628262 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b61a70000
[pid 25579] 10:12:38.628300 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25585] 10:12:38.628395 mprotect(0x7f4b61b9c000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.628422 read(14,  <unfinished ...>
[pid 25585] 10:12:38.628453 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.628472 mmap(0x7f4b61d9c000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f4b61d9c000
[pid 25585] 10:12:38.628520 mmap(0x7f4b61da5000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4b61da5000
[pid 25585] 10:12:38.628570 close(6 <unfinished ...>
[pid 25579] 10:12:38.628593 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25585] 10:12:38.628842 <... close resumed> ) = 0
[pid 25579] 10:12:38.628866 read(14,  <unfinished ...>
[pid 25585] 10:12:38.628907 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.628931 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25585] 10:12:38.629059 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.629082 read(14,  <unfinished ...>
[pid 25585] 10:12:38.629109 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.629155 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.629199 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25579] 10:12:38.629242 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25585] 10:12:38.629286 read(6,  <unfinished ...>
[pid 25579] 10:12:38.629311 read(14,  <unfinished ...>
[pid 25585] 10:12:38.629401 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.629431 <... read resumed> "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25585] 10:12:38.629557 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.629664 read(14,  <unfinished ...>
[pid 25585] 10:12:38.629691 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.629721 brk(0x1f7b000 <unfinished ...>
[pid 25585] 10:12:38.629834 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b6186c000
[pid 25585] 10:12:38.629895 mprotect(0x7f4b6186e000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.629928 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25585] 10:12:38.629952 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.629979 <... brk resumed> ) = 0x1f7b000
[pid 25585] 10:12:38.629998 mmap(0x7f4b61a6e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25579] 10:12:38.630413 read(14,  <unfinished ...>
[pid 25585] 10:12:38.630449 <... mmap resumed> ) = 0x7f4b61a6e000
[pid 25582] 10:12:38.630474 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25585] 10:12:38.630516 close(6 <unfinished ...>
[pid 25579] 10:12:38.630537 <... read resumed> "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25585] 10:12:38.630627 <... close resumed> ) = 0
[pid 25579] 10:12:38.630645 read(14,  <unfinished ...>
[pid 25585] 10:12:38.630684 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.630707 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25585] 10:12:38.630880 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.630903 read(14,  <unfinished ...>
[pid 25585] 10:12:38.630932 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.630977 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25585] 10:12:38.631017 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.631068 read(14,  <unfinished ...>
[pid 25585] 10:12:38.631108 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.631123 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25585] 10:12:38.631227 open("/lib64/libutil.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.631281 read(14, Process 25586 attached
 <unfinished ...>
[pid 25585] 10:12:38.631317 <... open resumed> ) = 6
[pid 25586] 10:12:38.631355 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25585] 10:12:38.631378 read(6,  <unfinished ...>
[pid 25586] 10:12:38.631414 <... set_robust_list resumed> ) = 0
[pid 25585] 10:12:38.631428 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.631529 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25586] 10:12:38.631556 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25585] 10:12:38.631647 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.631681 read(14,  <unfinished ...>
[pid 25585] 10:12:38.631709 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25586] 10:12:38.631832 <... setrlimit resumed> ) = 0
[pid 25585] 10:12:38.631853 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.632107 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25586] 10:12:38.632134 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.632167 <... mmap resumed> ) = 0x7f4b61669000
[pid 25579] 10:12:38.632184 brk(0x21c6000 <unfinished ...>
[pid 25585] 10:12:38.632223 mprotect(0x7f4b6166b000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.632254 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.632274 <... brk resumed> ) = 0x21c6000
[pid 25585] 10:12:38.632295 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.632379 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25585] 10:12:38.632428 mmap(0x7f4b6186a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25579] 10:12:38.632458 read(14,  <unfinished ...>
[pid 25585] 10:12:38.632488 <... mmap resumed> ) = 0x7f4b6186a000
[pid 25582] 10:12:38.632503 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.632532 close(6 <unfinished ...>
[pid 25579] 10:12:38.632562 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25585] 10:12:38.632585 <... close resumed> ) = 0
[pid 25582] 10:12:38.632681 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25585] 10:12:38.632725 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.632842 read(14,  <unfinished ...>
[pid 25585] 10:12:38.632873 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.632889 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.632916 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.632950 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25585] 10:12:38.632973 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.633028 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25586] 10:12:38.633066 <... open resumed> ) = 10
[pid 25585] 10:12:38.633079 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.633119 read(14,  <unfinished ...>
[pid 25586] 10:12:38.633147 fstat(10,  <unfinished ...>
[pid 25585] 10:12:38.633171 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.633185 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.633209 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.633243 open("/lib64/libc.so.6", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.633291 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25586] 10:12:38.633315 fstat(10,  <unfinished ...>
[pid 25585] 10:12:38.633396 <... open resumed> ) = 6
[pid 25582] 10:12:38.633411 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25586] 10:12:38.633443 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.633470 read(6,  <unfinished ...>
[pid 25579] 10:12:38.633495 read(14,  <unfinished ...>
[pid 25586] 10:12:38.633524 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.633550 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.633571 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.633593 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25585] 10:12:38.633609 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.633635 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25586] 10:12:38.633657 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.633829 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25582] 10:12:38.633862 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25586] 10:12:38.633903 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.633918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.633948 read(14,  <unfinished ...>
[pid 25586] 10:12:38.633976 read(10,  <unfinished ...>
[pid 25585] 10:12:38.634022 <... mmap resumed> ) = 0x7f4b636fa000
[pid 25582] 10:12:38.634040 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.634066 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25585] 10:12:38.634092 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.634170 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25586] 10:12:38.634195 stat("/home/finest09/etc/finestweddingsites.com/quota",  <unfinished ...>
[pid 25585] 10:12:38.634240 <... mmap resumed> ) = 0x7f4b612d5000
[pid 25582] 10:12:38.634254 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25586] 10:12:38.634293 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25585] 10:12:38.634322 mprotect(0x7f4b6145f000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.634389 read(14,  <unfinished ...>
[pid 25586] 10:12:38.634425 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.634461 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.634475 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.634497 <... open resumed> ) = 13
[pid 25585] 10:12:38.634513 mmap(0x7f4b6165f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000 <unfinished ...>
[pid 25579] 10:12:38.634544 <... read resumed> "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25586] 10:12:38.634568 fstat(13,  <unfinished ...>
[pid 25585] 10:12:38.634692 <... mmap resumed> ) = 0x7f4b6165f000
[pid 25582] 10:12:38.634708 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25586] 10:12:38.634831 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25585] 10:12:38.634864 mmap(0x7f4b61664000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.634898 read(14,  <unfinished ...>
[pid 25586] 10:12:38.634927 fstat(13,  <unfinished ...>
[pid 25585] 10:12:38.634949 <... mmap resumed> ) = 0x7f4b61664000
[pid 25582] 10:12:38.634962 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.635008 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25585] 10:12:38.635047 close(6 <unfinished ...>
[pid 25579] 10:12:38.635072 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25586] 10:12:38.635102 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.635144 <... close resumed> ) = 0
[pid 25582] 10:12:38.635158 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25586] 10:12:38.635203 <... mmap resumed> ) = 0x7ff9b2d40000
[pid 25585] 10:12:38.635218 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.635248 read(14,  <unfinished ...>
[pid 25586] 10:12:38.635276 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.635299 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.635316 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.635338 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.635353 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.635386 <... read resumed> "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25586] 10:12:38.635410 read(13,  <unfinished ...>
[pid 25585] 10:12:38.635507 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.635524 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25586] 10:12:38.635561 <... read resumed> "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25585] 10:12:38.635579 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.635615 read(14,  <unfinished ...>
[pid 25586] 10:12:38.635643 read(13,  <unfinished ...>
[pid 25585] 10:12:38.635665 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.635679 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25586] 10:12:38.635702 <... read resumed> "", 4096) = 0
[pid 25585] 10:12:38.635722 open("/usr/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.635888 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25586] 10:12:38.635915 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25585] 10:12:38.636008 <... open resumed> ) = 6
[pid 25582] 10:12:38.636059 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25586] 10:12:38.636101 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25585] 10:12:38.636118 read(6,  <unfinished ...>
[pid 25579] 10:12:38.636143 read(14,  <unfinished ...>
[pid 25572] 10:12:38.636198 <... select resumed> ) = 1 (in [11], left {299, 957675})
[pid 25586] 10:12:38.636263 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25585] 10:12:38.636331 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.636377 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.636415 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25573] 10:12:38.636447 <... select resumed> ) = 1 (in [11], left {299, 956915})
[pid 25572] 10:12:38.636501 read(11,  <unfinished ...>
[pid 25586] 10:12:38.636563 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25585] 10:12:38.636587 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.636623 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25579] 10:12:38.636673 read(14,  <unfinished ...>
[pid 25573] 10:12:38.636707 read(11,  <unfinished ...>
[pid 25572] 10:12:38.636829 <... read resumed> "\27\3\3\0m", 5) = 5
[pid 25586] 10:12:38.636883 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0},  <unfinished ...>
[pid 25585] 10:12:38.636946 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25582] 10:12:38.636992 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.637019 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25573] 10:12:38.637053 <... read resumed> "\27\3\3\0m", 5) = 5
[pid 25572] 10:12:38.637182 read(11,  <unfinished ...>
[pid 25586] 10:12:38.637238 <... rt_sigaction resumed> {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff9b1bf8790}, 8) = 0
[pid 25585] 10:12:38.637266 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.637315 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc",  <unfinished ...>
[pid 25579] 10:12:38.637358 read(14,  <unfinished ...>
[pid 25573] 10:12:38.637394 read(11,  <unfinished ...>
[pid 25572] 10:12:38.637429 <... read resumed> "\0358\355\344\247\267G\211A\25\253Z\234\214\243\4[Vg\0\366g\242\335\370\261\347\246\23\356L$v\263\265\340\227\201\345q\210\247\265\234\30\216\263\371P\347\304\nN\261\316\227Fs\342\363\233\r\17\31{\241\220\266\345G{O\377\356\317\342\241>\232\16\303PC\311t\360\272#\2160\302\316\244-\366\366S\237\222\266\306\340\216b\250\217HNq", 109) = 109
[pid 25586] 10:12:38.637524 close(11 <unfinished ...>
[pid 25585] 10:12:38.637563 <... mmap resumed> ) = 0x7f4b61069000
[pid 25582] 10:12:38.637584 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.637609 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25573] 10:12:38.637638 <... read resumed> "7\26\202\32D\2623\301\23\351\311U;c=\20\20\236\307\261J\1\256\n}x\nZW\275\n\225\236\343G^\345\204\v\25\t\20F8+\320\32 8\2733\255\320\357\1\314\323\366ue\327\222\275\3753\3\220\300\257\30\254\375\\g)R\267\352)\226\335\356b\246\342V\247\326\244\1\37+\326\247WF\226\1771\203xW\2Q\202\274\22V\366", 109) = 109
[pid 25572] 10:12:38.637722 write(11, "\27\3\3\0\234B\321\5\374\316Y\v\350\335\343$\356f\201\205\35>5V\227qJ\34\r\230\21\202B\250\2772\246\341{\312\320\211\216\256G,\237\363\200\345\261\244Fe\245^0s\205!L\v\317\203D\17.\327\346.\324,\300\356\33j\\\367\276\355:\350\342s\302\252\24P\331z|H\302[\23>R\267\256\300\235?\361h\3575/8\311\266?\343\354+\351\0175\327\240eD:\224(\272\350\6'9\230\33X\224\214\334\344\243Q\203\307\305\226'H\21\311@\352P\237\v\333\300]z'\263Ju\\\254", 161 <unfinished ...>
[pid 25586] 10:12:38.637903 <... close resumed> ) = 0
[pid 25585] 10:12:38.637925 mprotect(0x7f4b610cb000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.637968 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm",  <unfinished ...>
[pid 25579] 10:12:38.638036 read(14,  <unfinished ...>
[pid 25573] 10:12:38.638071 write(11, "\27\3\3\0|K\221h\235\34\260\330\0348\260&\357=m\\\f$\357\277eT,m\357u<\233\324\v\262\257Ehi\10m\377\271\363da\264'h\220E\35s\245\341\363\7\f \vm\337\207\32\270\304\26w=i\33\210\33\177\251\322\20\334\240\227\255:\4\267,C\t>\202\0071\215\230H|1\245\3330W;02\273G\23\306\211\334g\377\365\253\217\240mH\30\312f\273,\16\206\224WmV\347", 129 <unfinished ...>
[pid 25572] 10:12:38.638135 <... write resumed> ) = 161
[pid 25586] 10:12:38.638179 fcntl(12, F_GETFD <unfinished ...>
[pid 25585] 10:12:38.638214 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.638234 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25579] 10:12:38.638277 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25573] 10:12:38.638309 <... write resumed> ) = 129
[pid 25572] 10:12:38.638441 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25586] 10:12:38.638505 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.638526 mmap(0x7f4b612ca000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25582] 10:12:38.638570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.638617 read(14,  <unfinished ...>
[pid 25573] 10:12:38.638651 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25586] 10:12:38.638700 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.638735 <... mmap resumed> ) = 0x7f4b612ca000
[pid 25582] 10:12:38.638846 <... open resumed> ) = 9
[pid 25579] 10:12:38.638891 <... read resumed> "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25586] 10:12:38.638962 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.639008 close(6 <unfinished ...>
[pid 25582] 10:12:38.639067 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25586] 10:12:38.639207 geteuid( <unfinished ...>
[pid 25585] 10:12:38.639253 <... close resumed> ) = 0
[pid 25579] 10:12:38.639275 read(14,  <unfinished ...>
[pid 25586] 10:12:38.639335 <... geteuid resumed> ) = 0
[pid 25585] 10:12:38.639360 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.639408 <... ioctl resumed> , 0x7ffe28237b90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25586] 10:12:38.639440 getegid( <unfinished ...>
[pid 25585] 10:12:38.639475 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.639496 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25586] 10:12:38.639541 <... getegid resumed> ) = 12
[pid 25585] 10:12:38.639668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.639726 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25586] 10:12:38.639839 setgid(500 <unfinished ...>
[pid 25585] 10:12:38.639877 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.639900 read(14,  <unfinished ...>
[pid 25586] 10:12:38.639943 <... setgid resumed> ) = 0
[pid 25585] 10:12:38.639963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.640007 <... lseek resumed> ) = 0
[pid 25586] 10:12:38.640055 setuid(503 <unfinished ...>
[pid 25585] 10:12:38.640134 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.640156 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25586] 10:12:38.640196 <... setuid resumed> ) = 0
[pid 25585] 10:12:38.640324 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.640390 read(9,  <unfinished ...>
[pid 25586] 10:12:38.640434 chdir("/" <unfinished ...>
[pid 25585] 10:12:38.640469 <... open resumed> ) = 6
[pid 25579] 10:12:38.640488 read(14,  <unfinished ...>
[pid 25586] 10:12:38.640532 <... chdir resumed> ) = 0
[pid 25585] 10:12:38.640551 read(6,  <unfinished ...>
[pid 25582] 10:12:38.640602 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25586] 10:12:38.640636 geteuid( <unfinished ...>
[pid 25585] 10:12:38.641101 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.641138 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25586] 10:12:38.641176 <... geteuid resumed> ) = 503
[pid 25585] 10:12:38.641284 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.641323 lseek(9, 878, SEEK_SET <unfinished ...>
[pid 25586] 10:12:38.641364 getegid( <unfinished ...>
[pid 25585] 10:12:38.641402 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25579] 10:12:38.641444 read(14,  <unfinished ...>
[pid 25586] 10:12:38.641488 <... getegid resumed> ) = 500
[pid 25585] 10:12:38.641511 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.641587 <... lseek resumed> ) = 878
[pid 25586] 10:12:38.641617 stat("/home/finest09/mail/finestweddingsites.com/bridesfrom",  <unfinished ...>
[pid 25585] 10:12:38.641663 <... mmap resumed> ) = 0x7f4b60c86000
[pid 25579] 10:12:38.641690 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25586] 10:12:38.641727 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121902946, st_mode=S_IFDIR|0700, st_nlink=10, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25585] 10:12:38.641888 mprotect(0x7f4b60e3f000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.641930 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25586] 10:12:38.641970 chdir("/home/finest09/mail/finestweddingsites.com/bridesfrom" <unfinished ...>
[pid 25585] 10:12:38.642009 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.642028 read(14,  <unfinished ...>
[pid 25586] 10:12:38.642098 <... chdir resumed> ) = 0
[pid 25585] 10:12:38.642127 mmap(0x7f4b6103e000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25582] 10:12:38.642173 <... lseek resumed> ) = 878
[pid 25586] 10:12:38.642202 stat("tmp",  <unfinished ...>
[pid 25585] 10:12:38.642246 <... mmap resumed> ) = 0x7f4b6103e000
[pid 25579] 10:12:38.642267 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25586] 10:12:38.642309 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921354, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:33:48, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.642468 mmap(0x7f4b61065000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.642525 close(9 <unfinished ...>
[pid 25586] 10:12:38.642570 stat("new",  <unfinished ...>
[pid 25585] 10:12:38.642607 <... mmap resumed> ) = 0x7f4b61065000
[pid 25579] 10:12:38.642627 read(14,  <unfinished ...>
[pid 25586] 10:12:38.642679 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921352, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.642730 close(6 <unfinished ...>
[pid 25582] 10:12:38.642855 <... close resumed> ) = 0
[pid 25586] 10:12:38.642885 stat("cur",  <unfinished ...>
[pid 25585] 10:12:38.643317 <... close resumed> ) = 0
[pid 25579] 10:12:38.643341 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25586] 10:12:38.643392 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=121921350, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=7464, st_size=3817472, st_atime=2015/12/22-14:30:30, st_mtime=2015/12/30-10:10:23, st_ctime=2015/12/30-10:10:23}) = 0
[pid 25585] 10:12:38.643528 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.643662 read(8,  <unfinished ...>
[pid 25586] 10:12:38.643708 open("/home/finest09/mail/finestweddingsites.com/bridesfrom/maildirsize", O_RDWR|O_APPEND <unfinished ...>
[pid 25585] 10:12:38.643824 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.643854 read(14,  <unfinished ...>
[pid 25586] 10:12:38.643908 <... open resumed> ) = 11
[pid 25585] 10:12:38.643929 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.643989 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25586] 10:12:38.644026 read(11,  <unfinished ...>
[pid 25585] 10:12:38.645050 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.645082 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25586] 10:12:38.645136 <... read resumed> "786432000S,0C\n469419106 37871\n2608 1\n2612 1\n2603 1\n2650 1\n2611 1\n2638 1\n2616 1\n2611 1\n2601 1\n2611 1\n2651 1\n2619 1\n2624 1\n2619 1\n10595 1\n2632 1\n2610 1\n2590 1\n2613 1\n2663 1\n2617 1\n2653 1\n2666 1\n2612 1\n2604 1\n2660 1\n2686 1\n2616 1\n2609 1\n2623 1\n2591 1\n2618 1\n2"..., 5120) = 2992
[pid 25585] 10:12:38.645265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.645440 read(8,  <unfinished ...>
[pid 25586] 10:12:38.645485 stat("tmp/1451491958.H645400P25586.fin.finestweddingsites.com",  <unfinished ...>
[pid 25585] 10:12:38.645531 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.645554 read(14,  <unfinished ...>
[pid 25586] 10:12:38.645605 <... stat resumed> 0x7fffca4b7040) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.645627 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.645675 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25586] 10:12:38.645715 open("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660 <unfinished ...>
[pid 25585] 10:12:38.646107 <... open resumed> ) = 6
[pid 25579] 10:12:38.646133 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25586] 10:12:38.646172 <... open resumed> ) = 14
[pid 25585] 10:12:38.646303 read(6,  <unfinished ...>
[pid 25582] 10:12:38.646358 brk(0x1f9c000 <unfinished ...>
[pid 25586] 10:12:38.646408 chown("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25585] 10:12:38.646452 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.646488 read(14,  <unfinished ...>
[pid 25586] 10:12:38.646530 <... chown resumed> ) = 0
[pid 25585] 10:12:38.646549 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.646590 <... brk resumed> ) = 0x1f9c000
[pid 25586] 10:12:38.646618 chmod("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25585] 10:12:38.648364 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25579] 10:12:38.648429 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25586] 10:12:38.648466 <... chmod resumed> ) = 0
[pid 25585] 10:12:38.648587 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.648636 read(8,  <unfinished ...>
[pid 25586] 10:12:38.648678 chown("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", 503, 500 <unfinished ...>
[pid 25585] 10:12:38.648721 <... mmap resumed> ) = 0x7f4b636f9000
[pid 25579] 10:12:38.648821 read(14,  <unfinished ...>
[pid 25586] 10:12:38.648872 <... chown resumed> ) = 0
[pid 25585] 10:12:38.648892 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25586] 10:12:38.648946 chmod("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", 0660 <unfinished ...>
[pid 25585] 10:12:38.648987 <... mmap resumed> ) = 0x7f4b60a59000
[pid 25579] 10:12:38.649041 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25586] 10:12:38.649075 <... chmod resumed> ) = 0
[pid 25585] 10:12:38.649179 mprotect(0x7f4b60a85000, 2097152, PROT_NONE <unfinished ...>
[pid 25586] 10:12:38.649283 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.649328 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.649353 read(14,  <unfinished ...>
[pid 25586] 10:12:38.649393 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.649437 mmap(0x7f4b60c85000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25586] 10:12:38.649551 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.649587 <... mmap resumed> ) = 0x7f4b60c85000
[pid 25579] 10:12:38.649620 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25586] 10:12:38.649656 <... lseek resumed> ) = 19
[pid 25585] 10:12:38.649878 close(6 <unfinished ...>
[pid 25586] 10:12:38.649935 read(6,  <unfinished ...>
[pid 25585] 10:12:38.649977 <... close resumed> ) = 0
[pid 25579] 10:12:38.650020 read(14,  <unfinished ...>
[pid 25586] 10:12:38.650066 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25585] 10:12:38.650096 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25586] 10:12:38.650176 read(6,  <unfinished ...>
[pid 25585] 10:12:38.650211 <... open resumed> ) = 6
[pid 25579] 10:12:38.650236 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25586] 10:12:38.650270 <... read resumed> "", 8192) = 0
[pid 25585] 10:12:38.650413 read(6,  <unfinished ...>
[pid 25586] 10:12:38.650479 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2528 <unfinished ...>
[pid 25585] 10:12:38.650544 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.650583 read(14,  <unfinished ...>
[pid 25586] 10:12:38.650626 <... write resumed> ) = 2528
[pid 25585] 10:12:38.650648 fstat(6,  <unfinished ...>
[pid 25586] 10:12:38.650699 fsync(14 <unfinished ...>
[pid 25585] 10:12:38.650863 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25579] 10:12:38.650933 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25585] 10:12:38.651053 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f4b60854000
[pid 25579] 10:12:38.651111 read(14,  <unfinished ...>
[pid 25585] 10:12:38.651125 mprotect(0x7f4b60859000, 2093056, PROT_NONE) = 0
[pid 25579] 10:12:38.651160 <... read resumed> ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25585] 10:12:38.651177 mmap(0x7f4b60a58000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25586] 10:12:38.651361 <... fsync resumed> ) = 0
[pid 25585] 10:12:38.651386 <... mmap resumed> ) = 0x7f4b60a58000
[pid 25579] 10:12:38.651430 read(14,  <unfinished ...>
[pid 25586] 10:12:38.651474 lseek(11, 0, SEEK_END <unfinished ...>
[pid 25585] 10:12:38.651511 close(6 <unfinished ...>
[pid 25586] 10:12:38.651556 <... lseek resumed> ) = 2992
[pid 25585] 10:12:38.651577 <... close resumed> ) = 0
[pid 25579] 10:12:38.651622 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25586] 10:12:38.651664 write(11, "2528 1\n", 7 <unfinished ...>
[pid 25585] 10:12:38.651860 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25586] 10:12:38.651957 <... write resumed> ) = 7
[pid 25585] 10:12:38.651983 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.652016 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25579] 10:12:38.652046 brk(0x21e7000 <unfinished ...>
[pid 25586] 10:12:38.652424 close(11 <unfinished ...>
[pid 25585] 10:12:38.652477 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25586] 10:12:38.652554 <... close resumed> ) = 0
[pid 25585] 10:12:38.652577 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.652611 <... brk resumed> ) = 0x21e7000
[pid 25586] 10:12:38.652640 fstat(14,  <unfinished ...>
[pid 25585] 10:12:38.652736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25586] 10:12:38.652886 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=122016486, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2528, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.652933 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.652967 read(14,  <unfinished ...>
[pid 25586] 10:12:38.653011 close(14 <unfinished ...>
[pid 25585] 10:12:38.653073 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25586] 10:12:38.653136 <... close resumed> ) = 0
[pid 25585] 10:12:38.653158 <... open resumed> ) = 6
[pid 25579] 10:12:38.653207 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25586] 10:12:38.653247 rename("tmp/1451491958.H645400P25586.fin.finestweddingsites.com", "new/1451491958.H645400P25586.fin.finestweddingsites.com,S=2528" <unfinished ...>
[pid 25585] 10:12:38.653345 read(6,  <unfinished ...>
[pid 25586] 10:12:38.653398 <... rename resumed> ) = 0
[pid 25585] 10:12:38.653424 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.653542 read(14,  <unfinished ...>
[pid 25586] 10:12:38.653595 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.653643 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.653680 brk(0x1fbd000 <unfinished ...>
[pid 25586] 10:12:38.653722 <... write resumed> ) = 4
[pid 25585] 10:12:38.653833 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25579] 10:12:38.653900 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25559] 10:12:38.653932 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.654084 write(12, "\340\t\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.654129 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.654178 <... brk resumed> ) = 0x1fbd000
[pid 25579] 10:12:38.654199 read(14,  <unfinished ...>
[pid 25559] 10:12:38.654411 read(11,  <unfinished ...>
[pid 25586] 10:12:38.654475 <... write resumed> ) = 4
[pid 25585] 10:12:38.654500 <... mmap resumed> ) = 0x7f4b60651000
[pid 25579] 10:12:38.654529 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25559] 10:12:38.654560 <... read resumed> "\340\t\0\0", 4) = 4
[pid 25586] 10:12:38.654626 write(12, "\0\0\20\0", 4 <unfinished ...>
[pid 25585] 10:12:38.654856 mprotect(0x7f4b60653000, 2093056, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.654905 read(14,  <unfinished ...>
[pid 25559] 10:12:38.654943 read(11,  <unfinished ...>
[pid 25586] 10:12:38.654991 <... write resumed> ) = 4
[pid 25585] 10:12:38.655018 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.655048 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25559] 10:12:38.655077 <... read resumed> "\0\0\20\0", 4) = 4
[pid 25586] 10:12:38.655827 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.655884 mmap(0x7f4b60852000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25579] 10:12:38.655959 read(14,  <unfinished ...>
[pid 25559] 10:12:38.656003 read(11,  <unfinished ...>
[pid 25586] 10:12:38.656051 <... write resumed> ) = 4
[pid 25585] 10:12:38.656074 <... mmap resumed> ) = 0x7f4b60852000
[pid 25579] 10:12:38.656113 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25559] 10:12:38.656146 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.656293 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.656338 close(6 <unfinished ...>
[pid 25579] 10:12:38.656377 read(14,  <unfinished ...>
[pid 25559] 10:12:38.656420 read(11,  <unfinished ...>
[pid 25586] 10:12:38.656467 <... write resumed> ) = 4
[pid 25585] 10:12:38.656496 <... close resumed> ) = 0
[pid 25579] 10:12:38.656541 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25559] 10:12:38.656571 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.656720 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.656933 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.656984 read(14,  <unfinished ...>
[pid 25559] 10:12:38.657052 read(11,  <unfinished ...>
[pid 25586] 10:12:38.657100 <... write resumed> ) = 4
[pid 25585] 10:12:38.657122 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.657150 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25559] 10:12:38.657180 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.657338 write(12, "\260\23\235\0\0\0\0\0", 8 <unfinished ...>
[pid 25585] 10:12:38.657383 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.657453 read(14,  <unfinished ...>
[pid 25559] 10:12:38.657487 read(11,  <unfinished ...>
[pid 25586] 10:12:38.657535 <... write resumed> ) = 8
[pid 25585] 10:12:38.657556 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.657592 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25559] 10:12:38.657620 <... read resumed> "\260\23\235\0\0\0\0\0", 8) = 8
[pid 25586] 10:12:38.657676 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.657723 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.657868 read(14,  <unfinished ...>
[pid 25559] 10:12:38.657905 read(11,  <unfinished ...>
[pid 25586] 10:12:38.657954 <... write resumed> ) = 4
[pid 25585] 10:12:38.657975 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.658042 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25559] 10:12:38.658074 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.658238 write(12, "\0\0\0\0", 4 <unfinished ...>
[pid 25585] 10:12:38.658415 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.658479 read(14,  <unfinished ...>
[pid 25559] 10:12:38.658516 read(11,  <unfinished ...>
[pid 25586] 10:12:38.658565 <... write resumed> ) = 4
[pid 25585] 10:12:38.658591 <... open resumed> ) = 6
[pid 25579] 10:12:38.658620 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25559] 10:12:38.658649 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25586] 10:12:38.658703 close(12 <unfinished ...>
[pid 25585] 10:12:38.658857 read(6,  <unfinished ...>
[pid 25579] 10:12:38.658897 read(14,  <unfinished ...>
[pid 25559] 10:12:38.659847 close(11 <unfinished ...>
[pid 25586] 10:12:38.659907 <... close resumed> ) = 0
[pid 25585] 10:12:38.659931 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.659976 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25559] 10:12:38.660035 <... close resumed> ) = 0
[pid 25586] 10:12:38.660212 close(10 <unfinished ...>
[pid 25585] 10:12:38.660257 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.660296 read(14,  <unfinished ...>
[pid 25559] 10:12:38.660333 write(9, "BridesFrom@finestweddingsites.com/virtual_userdelivery\n", 55 <unfinished ...>
[pid 25586] 10:12:38.660416 <... close resumed> ) = 0
[pid 25585] 10:12:38.660439 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25579] 10:12:38.660502 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25559] 10:12:38.660533 <... write resumed> ) = 55
[pid 25586] 10:12:38.660594 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25585] 10:12:38.660641 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.660686 read(14,  <unfinished ...>
[pid 25559] 10:12:38.660721 fsync(9 <unfinished ...>
[pid 25586] 10:12:38.660919 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.660954 <... mmap resumed> ) = 0x7f4b636f8000
[pid 25579] 10:12:38.661108 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25586] 10:12:38.661150 close(13 <unfinished ...>
[pid 25585] 10:12:38.661301 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25586] 10:12:38.661365 <... close resumed> ) = 0
[pid 25585] 10:12:38.661388 <... mmap resumed> ) = 0x7f4b6042e000
[pid 25579] 10:12:38.661415 read(14,  <unfinished ...>
[pid 25559] 10:12:38.661450 <... fsync resumed> ) = 0
[pid 25586] 10:12:38.661486 munmap(0x7ff9b2d40000, 4096 <unfinished ...>
[pid 25585] 10:12:38.661527 mprotect(0x7f4b60445000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.661571 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25559] 10:12:38.661607 wait4(-1,  <unfinished ...>
[pid 25586] 10:12:38.661671 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.661693 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.662272 read(14,  <unfinished ...>
[pid 25586] 10:12:38.662326 exit_group(0) = ?
[pid 25585] 10:12:38.662350 mmap(0x7f4b60645000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25586] 10:12:38.662916 +++ exited with 0 +++
[pid 25585] 10:12:38.662940 <... mmap resumed> ) = 0x7f4b60645000
[pid 25579] 10:12:38.662984 <... read resumed> "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25559] 10:12:38.663045 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25586
[pid 25585] 10:12:38.663235 close(6 <unfinished ...>
[pid 25579] 10:12:38.663280 read(14,  <unfinished ...>
[pid 25559] 10:12:38.663317 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.663386 <... close resumed> ) = 0
[pid 25579] 10:12:38.663450 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25559] 10:12:38.663483 <... open resumed> ) = 10
[pid 25585] 10:12:38.663539 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.663594 read(14,  <unfinished ...>
[pid 25559] 10:12:38.663629 fstat(10,  <unfinished ...>
[pid 25585] 10:12:38.663673 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.663702 <... read resumed> "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25559] 10:12:38.663731 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.664008 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.664096 read(14,  <unfinished ...>
[pid 25559] 10:12:38.664141 fstat(10,  <unfinished ...>
[pid 25585] 10:12:38.664186 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.664214 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25559] 10:12:38.664338 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.664523 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.664587 read(14,  <unfinished ...>
[pid 25559] 10:12:38.664867 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.664954 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.664991 read(8,  <unfinished ...>
[pid 25579] 10:12:38.665022 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25559] 10:12:38.665049 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25585] 10:12:38.665098 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.665147 read(14,  <unfinished ...>
[pid 25559] 10:12:38.665186 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.665228 <... open resumed> ) = 6
[pid 25579] 10:12:38.665251 <... read resumed> "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25559] 10:12:38.665277 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.665424 read(6,  <unfinished ...>
[pid 25579] 10:12:38.665465 read(14,  <unfinished ...>
[pid 25559] 10:12:38.665499 read(10,  <unfinished ...>
[pid 25585] 10:12:38.665546 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.665582 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25559] 10:12:38.665608 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25585] 10:12:38.665700 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.665739 read(14,  <unfinished ...>
[pid 25559] 10:12:38.665901 stat("/home/finest09/.cpanel/rim/bis/bridesfrom@finestweddingsites.com",  <unfinished ...>
[pid 25585] 10:12:38.665956 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.666014 <... read resumed> "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25579] 10:12:38.666042 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25559] 10:12:38.666201 <... stat resumed> 0x7fffca4b5d90) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.666377 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.666430 brk(0x1fde000 <unfinished ...>
[pid 25579] 10:12:38.666473 read(14,  <unfinished ...>
[pid 25559] 10:12:38.666508 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.666561 <... mmap resumed> ) = 0x7f4b601ea000
[pid 25579] 10:12:38.666585 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25559] 10:12:38.666611 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.666877 mprotect(0x7f4b6022b000, 2097152, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.666930 <... brk resumed> ) = 0x1fde000
[pid 25579] 10:12:38.666957 read(14,  <unfinished ...>
[pid 25559] 10:12:38.667844 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 132 <unfinished ...>
[pid 25585] 10:12:38.667909 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.667935 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25559] 10:12:38.667962 <... write resumed> ) = 132
[pid 25585] 10:12:38.668147 mmap(0x7f4b6042b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25579] 10:12:38.668202 read(14,  <unfinished ...>
[pid 25559] 10:12:38.668236 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.668282 <... mmap resumed> ) = 0x7f4b6042b000
[pid 25579] 10:12:38.668321 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25559] 10:12:38.668465 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.668540 close(6 <unfinished ...>
[pid 25579] 10:12:38.668577 read(14,  <unfinished ...>
[pid 25559] 10:12:38.668611 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.668655 <... close resumed> ) = 0
[pid 25579] 10:12:38.668695 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25559] 10:12:38.668730 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.668909 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.668969 read(14,  <unfinished ...>
[pid 25559] 10:12:38.669003 close(7 <unfinished ...>
[pid 25585] 10:12:38.669046 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.669072 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25559] 10:12:38.669098 <... close resumed> ) = 0
[pid 25585] 10:12:38.669236 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.669292 read(14,  <unfinished ...>
[pid 25559] 10:12:38.669325 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25585] 10:12:38.669396 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.669422 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25559] 10:12:38.669449 <... open resumed> ) = 7
[pid 25585] 10:12:38.669586 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.669635 read(14,  <unfinished ...>
[pid 25559] 10:12:38.669668 fcntl(7, F_GETFD <unfinished ...>
[pid 25585] 10:12:38.669709 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.669737 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25559] 10:12:38.669857 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.670034 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.670088 read(14,  <unfinished ...>
[pid 25559] 10:12:38.670121 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.670167 <... open resumed> ) = 6
[pid 25579] 10:12:38.670189 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25559] 10:12:38.670215 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.670342 read(6,  <unfinished ...>
[pid 25579] 10:12:38.670390 brk(0x2208000 <unfinished ...>
[pid 25559] 10:12:38.670425 fstat(7,  <unfinished ...>
[pid 25585] 10:12:38.670500 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.670545 <... brk resumed> ) = 0x2208000
[pid 25559] 10:12:38.670567 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5391866, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.670651 fstat(6,  <unfinished ...>
[pid 25579] 10:12:38.670688 read(14,  <unfinished ...>
[pid 25559] 10:12:38.670720 write(7, "2015-12-30 10:12:38 [25559] 1aEJMb-0006e1-MY => bridesfrom <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2528 QT=1s DT=0s\n", 232 <unfinished ...>
[pid 25585] 10:12:38.670871 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25579] 10:12:38.670919 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25559] 10:12:38.670946 <... write resumed> ) = 232
[pid 25585] 10:12:38.671006 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.671048 read(14,  <unfinished ...>
[pid 25559] 10:12:38.671562 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25585] 10:12:38.671616 <... mmap resumed> ) = 0x7f4b636f7000
[pid 25582] 10:12:38.671645 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.671676 <... read resumed> "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25559] 10:12:38.671695 <... open resumed> ) = 11
[pid 25585] 10:12:38.671859 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25579] 10:12:38.671900 read(14,  <unfinished ...>
[pid 25559] 10:12:38.671927 alarm(60 <unfinished ...>
[pid 25585] 10:12:38.671958 <... mmap resumed> ) = 0x7f4b5ff03000
[pid 25579] 10:12:38.671995 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25559] 10:12:38.672018 <... alarm resumed> ) = 0
[pid 25585] 10:12:38.672101 mprotect(0x7f4b5ffde000, 2097152, PROT_NONE <unfinished ...>
[pid 25579] 10:12:38.672135 read(14,  <unfinished ...>
[pid 25559] 10:12:38.672158 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25585] 10:12:38.672193 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.672209 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25559] 10:12:38.672227 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.672299 mmap(0x7f4b601de000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25579] 10:12:38.672338 read(14,  <unfinished ...>
[pid 25559] 10:12:38.672362 alarm(0 <unfinished ...>
[pid 25585] 10:12:38.672396 <... mmap resumed> ) = 0x7f4b601de000
[pid 25579] 10:12:38.672423 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25559] 10:12:38.672450 <... alarm resumed> ) = 60
[pid 25585] 10:12:38.672539 close(6 <unfinished ...>
[pid 25579] 10:12:38.672567 read(14,  <unfinished ...>
[pid 25559] 10:12:38.672590 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25585] 10:12:38.672625 <... close resumed> ) = 0
[pid 25579] 10:12:38.672657 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25559] 10:12:38.672677 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25585] 10:12:38.672863 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.672909 read(14,  <unfinished ...>
[pid 25559] 10:12:38.672934 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.672972 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.672990 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25559] 10:12:38.673031 <... open resumed> ) = 12
[pid 25585] 10:12:38.673109 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.673149 read(14,  <unfinished ...>
[pid 25559] 10:12:38.673172 fcntl(12, F_GETFD <unfinished ...>
[pid 25585] 10:12:38.673200 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.673217 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25559] 10:12:38.673235 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.673271 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.673303 read(14,  <unfinished ...>
[pid 25559] 10:12:38.673327 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.673358 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.673378 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25559] 10:12:38.673397 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.673544 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.673581 read(14,  <unfinished ...>
[pid 25559] 10:12:38.673605 read(12,  <unfinished ...>
[pid 25585] 10:12:38.673633 <... open resumed> ) = 6
[pid 25579] 10:12:38.673649 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25559] 10:12:38.673667 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25585] 10:12:38.673715 read(6,  <unfinished ...>
[pid 25579] 10:12:38.673833 read(14,  <unfinished ...>
[pid 25559] 10:12:38.673863 close(12 <unfinished ...>
[pid 25585] 10:12:38.673895 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.673919 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.673935 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25559] 10:12:38.673955 <... close resumed> ) = 0
[pid 25585] 10:12:38.674057 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.674086 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.674121 read(14,  <unfinished ...>
[pid 25559] 10:12:38.674146 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.674181 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.674213 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.674228 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25559] 10:12:38.674252 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.674347 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.674387 stat("/etc/exim/perl/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.674414 read(14,  <unfinished ...>
[pid 25559] 10:12:38.674436 stat("/var/tmp",  <unfinished ...>
[pid 25585] 10:12:38.674473 <... mmap resumed> ) = 0x7f4b5fcff000
[pid 25582] 10:12:38.674489 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.674504 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25559] 10:12:38.674524 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25585] 10:12:38.674734 mprotect(0x7f4b5fd02000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.674864 stat("/etc/exim/perl/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.674893 read(14,  <unfinished ...>
[pid 25559] 10:12:38.674916 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.674954 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.674971 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.674986 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25559] 10:12:38.675038 <... open resumed> ) = 12
[pid 25585] 10:12:38.675138 mmap(0x7f4b5ff01000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25582] 10:12:38.675174 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.675201 read(14,  <unfinished ...>
[pid 25559] 10:12:38.675224 fcntl(12, F_GETFD <unfinished ...>
[pid 25585] 10:12:38.675253 <... mmap resumed> ) = 0x7f4b5ff01000
[pid 25582] 10:12:38.675279 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.675296 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25559] 10:12:38.675326 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.675364 close(6 <unfinished ...>
[pid 25582] 10:12:38.675389 stat("/usr/local/cpanel/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.675415 read(14,  <unfinished ...>
[pid 25559] 10:12:38.675438 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.675467 <... close resumed> ) = 0
[pid 25582] 10:12:38.675493 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.675509 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25559] 10:12:38.675536 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.675636 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.675678 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.675714 read(14,  <unfinished ...>
[pid 25559] 10:12:38.675845 fstat(12,  <unfinished ...>
[pid 25585] 10:12:38.675881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.675899 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.675919 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25559] 10:12:38.675941 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25585] 10:12:38.676092 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.676134 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.676164 read(14,  <unfinished ...>
[pid 25559] 10:12:38.676187 pread(12,  <unfinished ...>
[pid 25585] 10:12:38.676218 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.676235 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.676250 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25559] 10:12:38.676279 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25585] 10:12:38.676391 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.676430 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.676459 read(14,  <unfinished ...>
[pid 25559] 10:12:38.676482 pread(12,  <unfinished ...>
[pid 25585] 10:12:38.676518 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.676538 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.676553 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25559] 10:12:38.676573 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25585] 10:12:38.676689 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.676739 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.676869 read(14,  <unfinished ...>
[pid 25559] 10:12:38.676914 close(12 <unfinished ...>
[pid 25585] 10:12:38.676966 <... open resumed> ) = 6
[pid 25582] 10:12:38.676984 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.676999 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25559] 10:12:38.677022 <... close resumed> ) = 0
[pid 25585] 10:12:38.677155 read(6,  <unfinished ...>
[pid 25582] 10:12:38.677187 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc",  <unfinished ...>
[pid 25579] 10:12:38.677218 read(14,  <unfinished ...>
[pid 25559] 10:12:38.677241 close(11 <unfinished ...>
[pid 25585] 10:12:38.677279 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.677303 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.677319 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25559] 10:12:38.677345 <... close resumed> ) = 0
[pid 25585] 10:12:38.677462 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.677493 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm",  <unfinished ...>
[pid 25579] 10:12:38.677524 read(14,  <unfinished ...>
[pid 25559] 10:12:38.677547 pipe( <unfinished ...>
[pid 25585] 10:12:38.677581 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25582] 10:12:38.677613 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25579] 10:12:38.677658 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25559] 10:12:38.677677 <... pipe resumed> [11, 12]) = 0
[pid 25585] 10:12:38.677720 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.677858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.677895 read(14,  <unfinished ...>
[pid 25559] 10:12:38.677918 close(10 <unfinished ...>
[pid 25585] 10:12:38.677951 <... mmap resumed> ) = 0x7f4b5fad3000
[pid 25582] 10:12:38.677968 <... open resumed> ) = 9
[pid 25579] 10:12:38.677981 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25559] 10:12:38.678004 <... close resumed> ) = 0
[pid 25585] 10:12:38.678111 mprotect(0x7f4b5fafc000, 2097152, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.678144 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25579] 10:12:38.678170 read(14,  <unfinished ...>
[pid 25559] 10:12:38.678193 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25585] 10:12:38.678228 <... mprotect resumed> ) = 0
[pid 25582] 10:12:38.678244 <... ioctl resumed> , 0x7ffe28237b90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25579] 10:12:38.678260 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25559] 10:12:38.678281 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.678326 mmap(0x7f4b5fcfc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25582] 10:12:38.678359 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25579] 10:12:38.678383 read(14,  <unfinished ...>
[pid 25559] 10:12:38.678407 clone( <unfinished ...>
[pid 25585] 10:12:38.678719 <... mmap resumed> ) = 0x7f4b5fcfc000
[pid 25582] 10:12:38.678819 <... lseek resumed> ) = 0
[pid 25579] 10:12:38.678840 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25585] 10:12:38.678913 mmap(0x7f4b5fcfe000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.679019 read(9,  <unfinished ...>
[pid 25559] 10:12:38.679047 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25587
[pid 25585] 10:12:38.679112 <... mmap resumed> ) = 0x7f4b5fcfe000
[pid 25582] 10:12:38.679140 <... read resumed> "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25579] 10:12:38.679161 read(14,  <unfinished ...>
[pid 25559] 10:12:38.679387 close(12 <unfinished ...>
[pid 25585] 10:12:38.679422 close(6 <unfinished ...>
[pid 25582] 10:12:38.679444 brk(0x1fff000 <unfinished ...>
[pid 25579] 10:12:38.679468 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25559] 10:12:38.679490 <... close resumed> ) = 0
[pid 25585] 10:12:38.679586 <... close resumed> ) = 0
[pid 25582] 10:12:38.679619 <... brk resumed> ) = 0x1fff000
[pid 25579] 10:12:38.679641 read(14,  <unfinished ...>
[pid 25559] 10:12:38.680252 read(11,  <unfinished ...>
[pid 25585] 10:12:38.680288 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.680322 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25579] 10:12:38.680346 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25573] 10:12:38.680365 <... select resumed> ) = 1 (in [11], left {299, 958852})
[pid 25585] 10:12:38.680457 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.680481 <... lseek resumed> ) = 4868
[pid 25579] 10:12:38.680495 read(14,  <unfinished ...>
[pid 25573] 10:12:38.680521 read(11,  <unfinished ...>
[pid 25585] 10:12:38.680553 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.680586 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25579] 10:12:38.680609 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25573] 10:12:38.680631 <... read resumed> "\27\3\3\0'", 5) = 5
[pid 25585] 10:12:38.680708 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.680734 <... lseek resumed> ) = 4868
[pid 25579] 10:12:38.680831 brk(0x2229000 <unfinished ...>
[pid 25573] 10:12:38.680862 read(11,  <unfinished ...>
[pid 25572] 10:12:38.680888 <... select resumed> ) = 1 (in [11], left {299, 957785})
[pid 25585] 10:12:38.680924 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.680978 close(9 <unfinished ...>
[pid 25579] 10:12:38.681004 <... brk resumed> ) = 0x2229000
[pid 25573] 10:12:38.681019 <... read resumed> "7\26\202\32D\2623\302\277\326\f?\37hl#\233\377\235\277\21\311\220\2\303:}\22\361x\362Bv~p~Z/\264", 39) = 39
[pid 25572] 10:12:38.681056 read(11,  <unfinished ...>
[pid 25585] 10:12:38.681091 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25582] 10:12:38.681111 <... close resumed> ) = 0
[pid 25579] 10:12:38.681125 read(14,  <unfinished ...>
[pid 25573] 10:12:38.681168 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25572] 10:12:38.681198 <... read resumed> "\27\3\3\0'", 5) = 5
[pid 25585] 10:12:38.681230 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.681265 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25579] 10:12:38.681294 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25572] 10:12:38.681315 read(11,  <unfinished ...>
[pid 25585] 10:12:38.681413 <... open resumed> ) = 6
[pid 25582] 10:12:38.681431 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.681447 read(14,  <unfinished ...>
[pid 25572] 10:12:38.681472 <... read resumed> "\0358\355\344\247\267G\212\r\207\v\256\37\0\326~[\315f\210\33F\354B\346\0016^\245\330\3422<\3651\37C\2221", 39) = 39
[pid 25585] 10:12:38.681504 read(6,  <unfinished ...>
[pid 25582] 10:12:38.681530 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25579] 10:12:38.681556 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25572] 10:12:38.681574 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25585] 10:12:38.681677 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25582] 10:12:38.681702 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.681718 read(14,  <unfinished ...>
[pid 25585] 10:12:38.681834 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.681865 stat("/etc/exim/perl/Exporter.pmc",  <unfinished ...>
[pid 25585] 10:12:38.681897 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25579] 10:12:38.681929 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25585] 10:12:38.681952 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.682068 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.682090 <... mmap resumed> ) = 0x7f4b636f6000
[pid 25579] 10:12:38.682113 read(14,  <unfinished ...>
[pid 25585] 10:12:38.682141 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.682174 stat("/etc/exim/perl/Exporter.pm",  <unfinished ...>
[pid 25585] 10:12:38.682203 <... mmap resumed> ) = 0x7f4b5f8bd000
[pid 25579] 10:12:38.682220 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25585] 10:12:38.682241 mprotect(0x7f4b5f8d2000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.682342 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.682368 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.682390 read(14,  <unfinished ...>
[pid 25585] 10:12:38.682420 mmap(0x7f4b5fad1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25582] 10:12:38.682450 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25585] 10:12:38.682481 <... mmap resumed> ) = 0x7f4b5fad1000
[pid 25579] 10:12:38.682512 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25585] 10:12:38.682537 close(6 <unfinished ...>
[pid 25582] 10:12:38.682641 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.682661 <... close resumed> ) = 0
[pid 25579] 10:12:38.682716 read(14,  <unfinished ...>
[pid 25585] 10:12:38.682831 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.682869 stat("/usr/local/cpanel/Exporter.pm",  <unfinished ...>
[pid 25585] 10:12:38.682900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.682918 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25585] 10:12:38.682940 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.683089 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.683110 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.683133 read(14,  <unfinished ...>
[pid 25585] 10:12:38.683161 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.683195 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc",  <unfinished ...>
[pid 25585] 10:12:38.683231 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.683251 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25585] 10:12:38.683273 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.683363 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.683383 <... open resumed> ) = 6
[pid 25579] 10:12:38.683402 read(14,  <unfinished ...>
[pid 25585] 10:12:38.683428 read(6,  <unfinished ...>
[pid 25582] 10:12:38.683452 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm",  <unfinished ...>
[pid 25585] 10:12:38.683485 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.683510 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25585] 10:12:38.683537 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.683633 <... stat resumed> 0x7ffe28237da0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.683653 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25579] 10:12:38.683693 read(14,  <unfinished ...>
[pid 25585] 10:12:38.683722 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.683842 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25585] 10:12:38.683879 <... mmap resumed> ) = 0x7f4b5f6b2000
[pid 25579] 10:12:38.683897 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25585] 10:12:38.683918 mprotect(0x7f4b5f6bc000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.684045 <... stat resumed> 0x7ffe28237e40) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.684067 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.684086 read(14,  <unfinished ...>
[pid 25585] 10:12:38.684113 mmap(0x7f4b5f8bb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25582] 10:12:38.684144 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm",  <unfinished ...>
[pid 25585] 10:12:38.684178 <... mmap resumed> ) = 0x7f4b5f8bb000
[pid 25579] 10:12:38.684206 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25585] 10:12:38.684230 close(6 <unfinished ...>
[pid 25582] 10:12:38.684327 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25585] 10:12:38.684361 <... close resumed> ) = 0
[pid 25579] 10:12:38.684392 read(14,  <unfinished ...>
[pid 25585] 10:12:38.684434 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.684467 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.684503 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.684522 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25585] 10:12:38.684544 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.684705 <... open resumed> ) = 9
[pid 25585] 10:12:38.684723 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.684830 read(14,  <unfinished ...>
[pid 25585] 10:12:38.684865 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.684904 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25585] 10:12:38.684934 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.684972 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25585] 10:12:38.685007 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.685117 <... ioctl resumed> , 0x7ffe28237b90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25585] 10:12:38.685138 <... open resumed> ) = 6
[pid 25579] 10:12:38.685156 read(14,  <unfinished ...>
[pid 25585] 10:12:38.685183 read(6,  <unfinished ...>
[pid 25582] 10:12:38.685206 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25585] 10:12:38.685232 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.685256 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25585] 10:12:38.685277 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.685367 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.685388 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25579] 10:12:38.685444 read(14,  <unfinished ...>
[pid 25585] 10:12:38.685476 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.685510 read(9,  <unfinished ...>
[pid 25585] 10:12:38.685538 <... mmap resumed> ) = 0x7f4b5f4af000
[pid 25579] 10:12:38.685555 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25585] 10:12:38.685579 mprotect(0x7f4b5f4b1000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.685705 <... read resumed> "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25585] 10:12:38.685729 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.686329 read(14,  <unfinished ...>
[pid 25585] 10:12:38.686372 mmap(0x7f4b5f6b0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25582] 10:12:38.686406 lseek(9, 2366, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.686433 <... mmap resumed> ) = 0x7f4b5f6b0000
[pid 25579] 10:12:38.686459 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25585] 10:12:38.686486 close(6 <unfinished ...>
[pid 25582] 10:12:38.686567 <... lseek resumed> ) = 2366
[pid 25585] 10:12:38.686586 <... close resumed> ) = 0
[pid 25579] 10:12:38.686613 read(14,  <unfinished ...>
[pid 25585] 10:12:38.686641 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.686674 lseek(9, 0, SEEK_CUR <unfinished ...>
[pid 25585] 10:12:38.686701 <... mmap resumed> ) = 0x7f4b636f5000
[pid 25579] 10:12:38.686739 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25585] 10:12:38.686769 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.686864 <... lseek resumed> ) = 2366
[pid 25585] 10:12:38.686883 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.686904 read(14,  <unfinished ...>
[pid 25585] 10:12:38.686930 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.686962 close(9 <unfinished ...>
[pid 25585] 10:12:38.686989 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.687006 <... read resumed> "", 4096) = 0
[pid 25585] 10:12:38.687024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.687097 <... close resumed> ) = 0
[pid 25585] 10:12:38.687114 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:38.687452 close(14 <unfinished ...>
[pid 25585] 10:12:38.687493 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.687527 read(8,  <unfinished ...>
[pid 25585] 10:12:38.687555 <... open resumed> ) = 6
[pid 25579] 10:12:38.687571 <... close resumed> ) = 0
[pid 25585] 10:12:38.687588 read(6,  <unfinished ...>
[pid 25582] 10:12:38.687613 <... read resumed> "", 8192) = 0
[pid 25585] 10:12:38.687631 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25579] 10:12:38.687658 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25585] 10:12:38.687692 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.687717 close(8 <unfinished ...>
[pid 25585] 10:12:38.687836 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25579] 10:12:38.687884 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.687903 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25582] 10:12:38.688796 <... close resumed> ) = 0
[pid 25585] 10:12:38.688818 <... mmap resumed> ) = 0x7f4b5f290000
[pid 25579] 10:12:38.689069 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.689126 mprotect(0x7f4b5f2ad000, 2093056, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.689157 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.689191 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.689208 <... open resumed> ) = 14
[pid 25585] 10:12:38.689225 mmap(0x7f4b5f4ac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25582] 10:12:38.689260 <... open resumed> ) = 8
[pid 25585] 10:12:38.689277 <... mmap resumed> ) = 0x7f4b5f4ac000
[pid 25579] 10:12:38.689302 fstat(14,  <unfinished ...>
[pid 25585] 10:12:38.689330 mmap(0x7f4b5f4ae000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.689359 fstat(8,  <unfinished ...>
[pid 25585] 10:12:38.689385 <... mmap resumed> ) = 0x7f4b5f4ae000
[pid 25579] 10:12:38.689412 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.689463 close(6 <unfinished ...>
[pid 25582] 10:12:38.689489 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.689518 <... close resumed> ) = 0
[pid 25579] 10:12:38.689574 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.689606 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.689632 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.689663 <... mmap resumed> ) = 0x7f4b636f4000
[pid 25579] 10:12:38.689720 <... mmap resumed> ) = 0x7fa692c1d000
[pid 25585] 10:12:38.689739 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.689847 <... mmap resumed> ) = 0x7f81fe788000
[pid 25585] 10:12:38.689865 <... mmap resumed> ) = 0x7f4b636f3000
[pid 25579] 10:12:38.689894 read(14,  <unfinished ...>
[pid 25585] 10:12:38.689953 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.689979 read(8,  <unfinished ...>
[pid 25585] 10:12:38.690035 <... mmap resumed> ) = 0x7f4b636f1000
[pid 25579] 10:12:38.690057 <... read resumed> "MemTotal:        1048576 kB\nMemFree:          234044 kB\nCached:           337884 kB\nBuffers:               0 kB\nActive:           314560 kB\nInactive:         468036 kB\nActive(anon):     174912 kB\nInactive(anon):   277604 kB\nActive(file):     139648 kB\nInac"..., 1024) = 588
[pid 25585] 10:12:38.690080 arch_prctl(ARCH_SET_FS, 0x7f4b636f17c0 <unfinished ...>
[pid 25582] 10:12:38.690117 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.690139 <... arch_prctl resumed> ) = 0
[pid 25579] 10:12:38.690203 close(14 <unfinished ...>
[pid 25585] 10:12:38.690236 mprotect(0x7f4b5f4ac000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.690267 close(8 <unfinished ...>
[pid 25585] 10:12:38.690295 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.690316 <... close resumed> ) = 0
[pid 25585] 10:12:38.690333 mprotect(0x7f4b5f6b0000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.690361 <... close resumed> ) = 0
[pid 25585] 10:12:38.690379 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.690415 munmap(0x7fa692c1d000, 4096 <unfinished ...>
[pid 25585] 10:12:38.690448 mprotect(0x7f4b5f8bb000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.690474 munmap(0x7f81fe788000, 4096 <unfinished ...>
[pid 25585] 10:12:38.690503 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.690528 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.690546 mprotect(0x7f4b5fad1000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.691355 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.691377 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.691473 alarm(300 <unfinished ...>
[pid 25585] 10:12:38.691508 mprotect(0x7f4b5fcfc000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.691536 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25585] 10:12:38.691563 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.691590 <... alarm resumed> ) = 0
[pid 25585] 10:12:38.691608 mprotect(0x7f4b5ff01000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.691658 <... lseek resumed> ) = 19
[pid 25585] 10:12:38.691676 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.691807 brk(0x224c000 <unfinished ...>
[pid 25585] 10:12:38.691838 mprotect(0x7f4b601de000, 40960, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.691871 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.691905 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.692022 <... brk resumed> ) = 0x224c000
[pid 25585] 10:12:38.692048 mprotect(0x7f4b6042b000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.692124 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.692143 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.692175 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2v\221\361p\356\351\336\244n\2104/\364\35287,v\247({u\\\314\33;2\247Q\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258 <unfinished ...>
[pid 25585] 10:12:38.692238 mprotect(0x7f4b60645000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.692271 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.692302 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.692324 <... write resumed> ) = 258
[pid 25585] 10:12:38.692341 mprotect(0x7f4b60852000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.692374 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.692394 <... mprotect resumed> ) = 0
[pid 25579] 10:12:38.692606 read(11,  <unfinished ...>
[pid 25585] 10:12:38.692651 mprotect(0x7f4b6103e000, 110592, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.692682 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.692719 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.692880 mprotect(0x7f4b612ca000, 16384, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.692915 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.692932 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.693037 mprotect(0x7f4b6165f000, 16384, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.693068 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.693097 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.693121 mprotect(0x7f4b6186a000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.693148 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.693164 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.693194 mprotect(0x7f4b61a6e000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.693224 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.693253 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.693975 mprotect(0x7f4b627c6000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694015 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.694033 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694080 mprotect(0x7f4b62bfb000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694109 alarm(300 <unfinished ...>
[pid 25585] 10:12:38.694135 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694159 mprotect(0x7f4b62e7f000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694186 <... alarm resumed> ) = 0
[pid 25585] 10:12:38.694201 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694227 mprotect(0x7f4b63088000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694255 alarm(0 <unfinished ...>
[pid 25585] 10:12:38.694279 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694313 mprotect(0x7f4b632cd000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694358 <... alarm resumed> ) = 300
[pid 25585] 10:12:38.694386 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694437 mprotect(0x7f4b634e7000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694485 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.694545 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694617 mprotect(0x7f4b6370a000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.694672 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.694698 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.694739 munmap(0x7f4b636ff000, 39387 <unfinished ...>
[pid 25582] 10:12:38.694851 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.694882 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.694903 set_tid_address(0x7f4b636f1a90 <unfinished ...>
[pid 25582] 10:12:38.694926 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.694942 <... set_tid_address resumed> ) = 25585
[pid 25585] 10:12:38.694963 set_robust_list(0x7f4b636f1aa0, 24 <unfinished ...>
[pid 25582] 10:12:38.694986 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.695023 <... set_robust_list resumed> ) = 0
[pid 25585] 10:12:38.695043 futex(0x7ffc4d86306c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25582] 10:12:38.695068 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695083 <... futex resumed> ) = 0
[pid 25585] 10:12:38.695107 futex(0x7ffc4d86306c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f4b636f17c0 <unfinished ...>
[pid 25582] 10:12:38.695133 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.695160 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25585] 10:12:38.695188 rt_sigaction(SIGRTMIN, {0x7f4b625b4c60, [], SA_RESTORER|SA_SIGINFO, 0x7f4b625be790},  <unfinished ...>
[pid 25582] 10:12:38.695215 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695231 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695255 rt_sigaction(SIGRT_1, {0x7f4b625b4cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f4b625be790},  <unfinished ...>
[pid 25582] 10:12:38.695283 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f81fd640790},  <unfinished ...>
[pid 25585] 10:12:38.695309 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695328 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25582] 10:12:38.695354 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695369 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25585] 10:12:38.695402 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25582] 10:12:38.695430 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25585] 10:12:38.695458 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25585] 10:12:38.695520 statfs("/selinux",  <unfinished ...>
[pid 25582] 10:12:38.695556 <... rt_sigaction resumed> {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, 8) = 0
[pid 25585] 10:12:38.695576 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350308, f_bavail=6350308, f_files=1000000, f_ffree=691063, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25585] 10:12:38.695654 brk(0 <unfinished ...>
[pid 25582] 10:12:38.695681 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25585] 10:12:38.695710 <... brk resumed> ) = 0x158b000
[pid 25585] 10:12:38.695730 brk(0x15ac000 <unfinished ...>
[pid 25582] 10:12:38.695837 <... rt_sigaction resumed> {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, 8) = 0
[pid 25585] 10:12:38.695863 <... brk resumed> ) = 0x15ac000
[pid 25585] 10:12:38.695905 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.695945 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.695973 <... open resumed> ) = 6
[pid 25585] 10:12:38.696004 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.696028 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.696090 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.696140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.696170 open("/var/spool/exim/input/c/hdr.25582", O_RDWR|O_CREAT|O_EXCL, 0640 <unfinished ...>
[pid 25585] 10:12:38.696254 <... mmap resumed> ) = 0x7f4b63708000
[pid 25585] 10:12:38.696280 read(6,  <unfinished ...>
[pid 25582] 10:12:38.696352 <... open resumed> ) = 8
[pid 25585] 10:12:38.696369 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25585] 10:12:38.696405 read(6,  <unfinished ...>
[pid 25582] 10:12:38.696430 fchown(8, 47, 12 <unfinished ...>
[pid 25585] 10:12:38.696459 <... read resumed> "", 1024) = 0
[pid 25585] 10:12:38.696486 close(6 <unfinished ...>
[pid 25582] 10:12:38.696517 <... fchown resumed> ) = 0
[pid 25585] 10:12:38.696533 <... close resumed> ) = 0
[pid 25585] 10:12:38.696555 munmap(0x7f4b63708000, 4096 <unfinished ...>
[pid 25582] 10:12:38.696583 fchmod(8, 0640 <unfinished ...>
[pid 25585] 10:12:38.696610 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.696682 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25582] 10:12:38.696723 <... fchmod resumed> ) = 0
[pid 25585] 10:12:38.696739 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.696917 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f4b625be790},  <unfinished ...>
[pid 25582] 10:12:38.696950 fcntl(8, F_GETFL <unfinished ...>
[pid 25585] 10:12:38.696976 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.697004 fstat(2,  <unfinished ...>
[pid 25582] 10:12:38.697029 <... fcntl resumed> ) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25585] 10:12:38.697070 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25585] 10:12:38.697149 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f4b625be790},  <unfinished ...>
[pid 25582] 10:12:38.697181 fstat(8,  <unfinished ...>
[pid 25585] 10:12:38.697205 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.697229 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f4b613076a0},  <unfinished ...>
[pid 25582] 10:12:38.697256 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.697283 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25585] 10:12:38.697308 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f4b613076a0},  <unfinished ...>
[pid 25582] 10:12:38.697335 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.697364 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25585] 10:12:38.697386 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f4b625be790},  <unfinished ...>
[pid 25582] 10:12:38.697417 <... mmap resumed> ) = 0x7f81fe788000
[pid 25585] 10:12:38.697435 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25585] 10:12:38.697468 umask(0 <unfinished ...>
[pid 25582] 10:12:38.697494 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25585] 10:12:38.697522 <... umask resumed> ) = 0
[pid 25585] 10:12:38.697582 geteuid( <unfinished ...>
[pid 25582] 10:12:38.697608 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.697623 <... geteuid resumed> ) = 0
[pid 25585] 10:12:38.697662 getuid( <unfinished ...>
[pid 25582] 10:12:38.697693 write(8, "1aEJMc-0006ec-HH-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268 <unfinished ...>
[pid 25585] 10:12:38.697730 <... getuid resumed> ) = 47
[pid 25585] 10:12:38.697835 getgid( <unfinished ...>
[pid 25582] 10:12:38.697866 <... write resumed> ) = 268
[pid 25585] 10:12:38.697882 <... getgid resumed> ) = 12
[pid 25585] 10:12:38.697931 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25582] 10:12:38.697956 fstat(8,  <unfinished ...>
[pid 25585] 10:12:38.697980 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25585] 10:12:38.698005 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25582] 10:12:38.698027 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.698058 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25585] 10:12:38.698090 getgroups(65536,  <unfinished ...>
[pid 25582] 10:12:38.698114 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMc-0006ec-HH\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:38 -0600\n085  X-Failed-Recipients: antiquewedding@gmail.com,\n  finest09@fin.finestweddin"..., 719 <unfinished ...>
[pid 25585] 10:12:38.698145 <... getgroups resumed> [12]) = 1
[pid 25585] 10:12:38.698171 setgroups(0, [] <unfinished ...>
[pid 25582] 10:12:38.698196 <... write resumed> ) = 719
[pid 25585] 10:12:38.698212 <... setgroups resumed> ) = 0
[pid 25585] 10:12:38.698236 getegid( <unfinished ...>
[pid 25582] 10:12:38.698258 fsync(8 <unfinished ...>
[pid 25585] 10:12:38.698315 <... getegid resumed> ) = 12
[pid 25585] 10:12:38.698339 geteuid()   = 0
[pid 25585] 10:12:38.698386 geteuid()   = 0
[pid 25585] 10:12:38.698520 getegid()   = 12
[pid 25585] 10:12:38.698554 setgid(12)  = 0
[pid 25585] 10:12:38.698589 setuid(0)   = 0
[pid 25585] 10:12:38.698656 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25582] 10:12:38.698724 <... fsync resumed> ) = 0
[pid 25585] 10:12:38.698813 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.698843 fstat(8,  <unfinished ...>
[pid 25585] 10:12:38.698868 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25585] 10:12:38.698908 fstat(6,  <unfinished ...>
[pid 25582] 10:12:38.698931 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=987, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.698959 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25585] 10:12:38.699015 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.699045 close(8 <unfinished ...>
[pid 25585] 10:12:38.699072 <... mmap resumed> ) = 0x7f4b63708000
[pid 25585] 10:12:38.699093 read(6,  <unfinished ...>
[pid 25582] 10:12:38.699121 <... close resumed> ) = 0
[pid 25585] 10:12:38.699137 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25585] 10:12:38.699271 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25582] 10:12:38.699315 munmap(0x7f81fe788000, 4096 <unfinished ...>
[pid 25585] 10:12:38.699349 <... socket resumed> ) = 7
[pid 25585] 10:12:38.699371 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25582] 10:12:38.699419 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.699436 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.699465 close(7 <unfinished ...>
[pid 25582] 10:12:38.699494 rename("/var/spool/exim/input/c/hdr.25582", "/var/spool/exim/input/c/1aEJMc-0006ec-HH-H" <unfinished ...>
[pid 25585] 10:12:38.699550 <... close resumed> ) = 0
[pid 25585] 10:12:38.699572 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25582] 10:12:38.699599 <... rename resumed> ) = 0
[pid 25585] 10:12:38.699615 <... socket resumed> ) = 7
[pid 25585] 10:12:38.699638 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25582] 10:12:38.699669 open("/var/spool/exim/input/c/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25585] 10:12:38.699702 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.699727 close(7 <unfinished ...>
[pid 25582] 10:12:38.699849 <... open resumed> ) = 8
[pid 25585] 10:12:38.699868 <... close resumed> ) = 0
[pid 25585] 10:12:38.699897 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.699929 fsync(8 <unfinished ...>
[pid 25585] 10:12:38.699955 <... open resumed> ) = 7
[pid 25585] 10:12:38.699980 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.700005 <... fsync resumed> ) = 0
[pid 25585] 10:12:38.700020 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25585] 10:12:38.700062 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.700089 close(8 <unfinished ...>
[pid 25585] 10:12:38.700115 <... mmap resumed> ) = 0x7f4b63707000
[pid 25585] 10:12:38.700136 read(7,  <unfinished ...>
[pid 25582] 10:12:38.700163 <... close resumed> ) = 0
[pid 25585] 10:12:38.700179 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25585] 10:12:38.700222 read(7,  <unfinished ...>
[pid 25582] 10:12:38.700247 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.700272 <... read resumed> "", 4096) = 0
[pid 25585] 10:12:38.700292 close(7 <unfinished ...>
[pid 25582] 10:12:38.700316 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080200, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4136, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.700344 <... close resumed> ) = 0
[pid 25585] 10:12:38.700382 munmap(0x7f4b63707000, 4096 <unfinished ...>
[pid 25582] 10:12:38.700415 open("/var/spool/exim/msglog/c/1aEJMc-0006ec-HH", O_WRONLY|O_CREAT|O_APPEND, 0640 <unfinished ...>
[pid 25585] 10:12:38.700519 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.700563 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.700600 <... open resumed> ) = 8
[pid 25585] 10:12:38.700615 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.700648 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.700688 fcntl(8, F_GETFL <unfinished ...>
[pid 25585] 10:12:38.700716 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.700736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.700853 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25585] 10:12:38.700881 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.700947 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.701007 fstat(8,  <unfinished ...>
[pid 25585] 10:12:38.701047 <... open resumed> ) = 7
[pid 25585] 10:12:38.701082 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.701119 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.701151 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25585] 10:12:38.701185 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0 <unfinished ...>
[pid 25582] 10:12:38.701212 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.701240 <... mmap resumed> ) = 0x7f4b636e7000
[pid 25585] 10:12:38.701260 close(7 <unfinished ...>
[pid 25582] 10:12:38.701283 <... mmap resumed> ) = 0x7f81fe788000
[pid 25585] 10:12:38.701298 <... close resumed> ) = 0
[pid 25585] 10:12:38.701330 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25582] 10:12:38.701365 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25585] 10:12:38.701392 <... open resumed> ) = 7
[pid 25585] 10:12:38.701411 read(7,  <unfinished ...>
[pid 25582] 10:12:38.701435 <... lseek resumed> ) = 0
[pid 25585] 10:12:38.701450 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.701483 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.701511 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.701540 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25585] 10:12:38.701581 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25582] 10:12:38.701616 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.701647 <... mmap resumed> ) = 0x7f4b5f082000
[pid 25585] 10:12:38.701680 mprotect(0x7f4b5f08e000, 2097152, PROT_NONE <unfinished ...>
[pid 25582] 10:12:38.701711 write(8, "2015-12-30 10:12:38 Received from <> R=1aEJMb-0006df-04 U=mailnull P=local S=4787 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142 <unfinished ...>
[pid 25585] 10:12:38.701833 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.701862 mmap(0x7f4b5f28e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000 <unfinished ...>
[pid 25582] 10:12:38.701893 <... write resumed> ) = 142
[pid 25585] 10:12:38.701910 <... mmap resumed> ) = 0x7f4b5f28e000
[pid 25585] 10:12:38.701945 close(7 <unfinished ...>
[pid 25582] 10:12:38.701970 close(8 <unfinished ...>
[pid 25585] 10:12:38.702019 <... close resumed> ) = 0
[pid 25585] 10:12:38.702067 mprotect(0x7f4b5f28e000, 4096, PROT_READ <unfinished ...>
[pid 25582] 10:12:38.702097 <... close resumed> ) = 0
[pid 25585] 10:12:38.702113 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.702138 munmap(0x7f4b636e7000, 39387 <unfinished ...>
[pid 25582] 10:12:38.702168 munmap(0x7f81fe788000, 4096 <unfinished ...>
[pid 25585] 10:12:38.702199 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.702228 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25582] 10:12:38.702259 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.702275 <... open resumed> ) = 7
[pid 25585] 10:12:38.702305 fcntl(7, F_GETFD <unfinished ...>
[pid 25582] 10:12:38.702332 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.702362 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25585] 10:12:38.702385 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.702408 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.702437 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.702479 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.702511 stat("/etc/localtime",  <unfinished ...>
[pid 25585] 10:12:38.702539 <... mmap resumed> ) = 0x7f4b63707000
[pid 25585] 10:12:38.702559 read(7,  <unfinished ...>
[pid 25582] 10:12:38.702587 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.702614 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.702662 close(7 <unfinished ...>
[pid 25582] 10:12:38.702689 close(7 <unfinished ...>
[pid 25585] 10:12:38.702715 <... close resumed> ) = 0
[pid 25585] 10:12:38.702735 munmap(0x7f4b63707000, 4096 <unfinished ...>
[pid 25582] 10:12:38.702845 <... close resumed> ) = 0
[pid 25585] 10:12:38.702864 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.702911 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25582] 10:12:38.702965 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25585] 10:12:38.703004 <... socket resumed> ) = 7
[pid 25585] 10:12:38.703024 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25582] 10:12:38.703058 <... open resumed> ) = 7
[pid 25585] 10:12:38.703073 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.703096 close(7 <unfinished ...>
[pid 25582] 10:12:38.703125 fcntl(7, F_GETFD <unfinished ...>
[pid 25585] 10:12:38.703150 <... close resumed> ) = 0
[pid 25585] 10:12:38.703170 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25582] 10:12:38.703196 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.703211 <... socket resumed> ) = 7
[pid 25585] 10:12:38.703232 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25582] 10:12:38.703262 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25585] 10:12:38.703287 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.703307 close(7 <unfinished ...>
[pid 25582] 10:12:38.703332 <... fcntl resumed> ) = 0
[pid 25585] 10:12:38.703347 <... close resumed> ) = 0
[pid 25585] 10:12:38.703378 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25582] 10:12:38.703417 fstat(7,  <unfinished ...>
[pid 25585] 10:12:38.703443 <... open resumed> ) = 7
[pid 25585] 10:12:38.703463 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.703490 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392098, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.703523 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25585] 10:12:38.703557 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.703583 write(7, "2015-12-30 10:12:38 [25582] 1aEJMc-0006ec-HH <= <> R=1aEJMb-0006df-04 U=mailnull P=local S=4787 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204 <unfinished ...>
[pid 25585] 10:12:38.703618 <... mmap resumed> ) = 0x7f4b63707000
[pid 25585] 10:12:38.703638 read(7,  <unfinished ...>
[pid 25582] 10:12:38.703665 <... write resumed> ) = 204
[pid 25585] 10:12:38.703681 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25585] 10:12:38.703721 close(7 <unfinished ...>
[pid 25582] 10:12:38.703829 close(6 <unfinished ...>
[pid 25585] 10:12:38.703867 <... close resumed> ) = 0
[pid 25585] 10:12:38.703888 munmap(0x7f4b63707000, 4096 <unfinished ...>
[pid 25582] 10:12:38.703915 <... close resumed> ) = 0
[pid 25585] 10:12:38.703931 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.703976 read(6,  <unfinished ...>
[pid 25582] 10:12:38.704028 munmap(0x7f81fe789000, 4096 <unfinished ...>
[pid 25585] 10:12:38.704058 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25585] 10:12:38.704125 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25582] 10:12:38.704159 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.704175 <... open resumed> ) = 7
[pid 25585] 10:12:38.704199 fstat(7,  <unfinished ...>
[pid 25582] 10:12:38.704223 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25585] 10:12:38.704253 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.704286 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25582] 10:12:38.704312 <... rt_sigaction resumed> {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, 8) = 0
[pid 25585] 10:12:38.704333 <... mmap resumed> ) = 0x7f4b63707000
[pid 25585] 10:12:38.704355 read(7,  <unfinished ...>
[pid 25582] 10:12:38.704382 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0},  <unfinished ...>
[pid 25585] 10:12:38.704411 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.704437 close(7 <unfinished ...>
[pid 25582] 10:12:38.704462 <... rt_sigaction resumed> {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f81fc3896a0}, 8) = 0
[pid 25585] 10:12:38.704487 <... close resumed> ) = 0
[pid 25585] 10:12:38.704521 munmap(0x7f4b63707000, 4096 <unfinished ...>
[pid 25582] 10:12:38.704573 open("/proc/loadavg", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.704625 <... munmap resumed> ) = 0
[pid 25585] 10:12:38.704657 read(6,  <unfinished ...>
[pid 25582] 10:12:38.704683 <... open resumed> ) = 6
[pid 25585] 10:12:38.704698 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25585] 10:12:38.704825 uname( <unfinished ...>
[pid 25582] 10:12:38.704856 read(6,  <unfinished ...>
[pid 25585] 10:12:38.704886 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25585] 10:12:38.704942 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0},  <unfinished ...>
[pid 25582] 10:12:38.704991 <... read resumed> "0.18 0.08 0.01 3/255 25587\n", 40) = 27
[pid 25585] 10:12:38.705016 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f4b625be790}, 8) = 0
[pid 25585] 10:12:38.705050 clone( <unfinished ...>
[pid 25582] 10:12:38.705272 close(6 <unfinished ...>
[pid 25585] 10:12:38.705300 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f4b636f1a90) = 25588
[pid 25585] 10:12:38.705345 wait4(25588,  <unfinished ...>
[pid 25582] 10:12:38.705382 <... close resumed> ) = 0
[pid 25582] 10:12:38.705414 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f81fe773a90) = 25589
[pid 25582] 10:12:38.706028 exit_group(0) = ?
[pid 25582] 10:12:38.706381 +++ exited with 0 +++
[pid 25529] 10:12:38.706404 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25582
[pid 25529] 10:12:38.706431 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f21d0f6d6a0}, 8) = 0
[pid 25529] 10:12:38.706485 write(8, "2015-12-30 10:12:38 antiqueweddinghouse@finestweddingsites.com: children all complete\n", 86) = 86
[pid 25529] 10:12:38.706537 open("/var/spool/exim/input/b/hdr.25529", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25529] 10:12:38.706623 fchown(10, 47, 12) = 0
[pid 25529] 10:12:38.706664 fchmod(10, 0640) = 0
[pid 25529] 10:12:38.706701 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25529] 10:12:38.706739 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25529] 10:12:38.706856 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f21d336d000
[pid 25529] 10:12:38.706895 lseek(10, 0, SEEK_CUR) = 0
[pid 25529] 10:12:38.706950 write(10, "1aEJMb-0006df-04-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 728) = 728
[pid 25529] 10:12:38.707025 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=728, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25529] 10:12:38.707080 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006df-04; Wed, 30 Dec 2015 10:12:37 -0600\n074T To:  antiquewedding@gmail.com, antiqueweddinghouse@finestwed"..., 557) = 557
[pid 25529] 10:12:38.707126 fsync(10Process 25587 attached
 <unfinished ...>
[pid 25587] 10:12:38.707368 set_robust_list(0x7ff9b2d2baa0, 24) = 0
[pid 25587] 10:12:38.707519 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0} <unfinished ...>
[pid 25529] 10:12:38.707583 <... fsync resumed> ) = 0
[pid 25529] 10:12:38.707618 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1285, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25529] 10:12:38.707708 close(10)   = 0
[pid 25587] 10:12:38.707868 <... setrlimit resumed> ) = 0
[pid 25529] 10:12:38.707897 munmap(0x7f21d336d000, 4096) = 0
[pid 25529] 10:12:38.707965 rename("/var/spool/exim/input/b/hdr.25529", "/var/spool/exim/input/b/1aEJMb-0006df-04-H") = 0
[pid 25529] 10:12:38.708140 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid 25573] 10:12:38.708204 <... select resumed> ) = 1 (in [11], left {299, 973001})
[pid 25529] 10:12:38.708234 <... open resumed> ) = 10
[pid 25573] 10:12:38.708255 read(11,  <unfinished ...>
[pid 25529] 10:12:38.708280 fsync(10 <unfinished ...>
[pid 25573] 10:12:38.708307 <... read resumed> "\27\3\3\0T", 5) = 5
[pid 25529] 10:12:38.708326 <... fsync resumed> ) = 0
[pid 25573] 10:12:38.708345 read(11,  <unfinished ...>
[pid 25529] 10:12:38.708395 close(10 <unfinished ...>
[pid 25573] 10:12:38.708440 <... read resumed> "7\26\202\32D\2623\303h\265HS\34\20%\305\215\313\307,]%1\334\231\373=/\247\303H|~\371\3473\n\250\244\37\236\376^\301\336%\2\344\215\376\303\347U\340\0\205$H\244\220\371\355\210vs\227\231\316\243\307\223\205j\376\320\373o\271K\223\351\203\36{", 84) = 84
[pid 25529] 10:12:38.708482 <... close resumed> ) = 0
[pid 25587] 10:12:38.708710 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25573] 10:12:38.708738 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25529] 10:12:38.708838 unlink("/var/spool/exim/msglog/b/1aEJMb-0006df-04" <unfinished ...>
[pid 25587] 10:12:38.708886 <... open resumed> ) = 10
[pid 25573] 10:12:38.708900 <... select resumed> ) = 1 (in [11], left {299, 999998})
[pid 25529] 10:12:38.708940 <... unlink resumed> ) = 0
[pid 25573] 10:12:38.708968 read(11,  <unfinished ...>
[pid 25529] 10:12:38.708994 unlink("/var/spool/exim/input/b/1aEJMb-0006df-04-D" <unfinished ...>
[pid 25573] 10:12:38.709035 <... read resumed> "\27\3\3\0F", 5) = 5
[pid 25529] 10:12:38.709053 <... unlink resumed> ) = 0
[pid 25573] 10:12:38.709075 read(11,  <unfinished ...>
[pid 25529] 10:12:38.709100 unlink("/var/spool/exim/input/b/1aEJMb-0006df-04-H" <unfinished ...>
[pid 25573] 10:12:38.709157 <... read resumed> "7\26\202\32D\2623\304\371\301\36}\7\2728\207y\276\4=Y\265\177\2425\355\241\303\243\217\361bu}\265\203Y}\213\10\vO\262yO$\202\355xP\266o\216\256\273\274\20\3764gW\344\310P\23\320\373\315\357\4", 70) = 70
[pid 25529] 10:12:38.709202 <... unlink resumed> ) = 0
[pid 25573] 10:12:38.709234 lseek(6, 19, SEEK_SET <unfinished ...>
[pid 25529] 10:12:38.709289 stat("/etc/localtime",  <unfinished ...>
[pid 25573] 10:12:38.709324 <... lseek resumed> ) = 19
[pid 25572] 10:12:38.709340 <... select resumed> ) = 1 (in [11], left {299, 972386})
[pid 25529] 10:12:38.709364 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25573] 10:12:38.709413 read(6,  <unfinished ...>
[pid 25572] 10:12:38.709533 read(11,  <unfinished ...>
[pid 25529] 10:12:38.709561 stat("/etc/localtime",  <unfinished ...>
[pid 25573] 10:12:38.709594 <... read resumed> "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25572] 10:12:38.709630 <... read resumed> "\27\3\3\0R", 5) = 5
[pid 25529] 10:12:38.709667 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25587] 10:12:38.709715 fstat(10,  <unfinished ...>
[pid 25573] 10:12:38.709737 read(6,  <unfinished ...>
[pid 25572] 10:12:38.709765 read(11,  <unfinished ...>
[pid 25529] 10:12:38.709811 close(7 <unfinished ...>
[pid 25573] 10:12:38.709844 <... read resumed> "", 8192) = 0
[pid 25572] 10:12:38.709861 <... read resumed> "\0358\355\344\247\267G\213\222-}\241\"\16\243\271\353\262f\27\220\342f\247^1\236Lv\225\30\177\251\256P-\332\24\314\244xw\330\33\203P5\254b\2273z1&\21\260\226+T\2477.\216|\247\2613\271jJ\223\333\373!^\23\0060|x\27L", 82) = 82
[pid 25529] 10:12:38.709890 <... close resumed> ) = 0
[pid 25573] 10:12:38.709917 alarm(300 <unfinished ...>
[pid 25572] 10:12:38.709949 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25529] 10:12:38.709999 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25573] 10:12:38.710042 <... alarm resumed> ) = 0
[pid 25529] 10:12:38.710071 <... open resumed> ) = 7
[pid 25573] 10:12:38.710093 write(11, "\27\3\3\fkK\221h\235\34\260\330\35\3373\361\366\227\311\202\1\200ELtY\35y\334\n\255\241\300a1\327\323u\300\210\30\312\n+\237>\37\353\266\3y%\237\370$\356\7\2101{b7\200\277\255\260I%\202\375\262\340$\347'\243\246\311\205a\340&\255Iafq\300Vf\265Q\260Y\r\334\341\261T\324^\343\247\375!\210\253tgi\303\230F\327>@\203\346\306\343'\220\351\257\256Zp\230`\267\311\10\20\3777\276\352'1\235\252\350e\254\204S\331\22)i\317R\16\2274L\275\263gsz7$\241\35te\233\203*Sl\213Ze\325X\376\235\253\0259\213\333\244\357B\327t\363\177\253\346\353\216\337\20\22\221\232`\305\307\0018\26\333_\231>\223\314z\265o\264\367\t\370\351x7\335F\3\302\322\206\350\3\3]\343 \312\232S\257.\276\373\201\234\322\3051\365H1\304j6jP\332\257"..., 3184 <unfinished ...>
[pid 25529] 10:12:38.710166 fcntl(7, F_GETFD <unfinished ...>
[pid 25573] 10:12:38.710197 <... write resumed> ) = 3184
[pid 25529] 10:12:38.710214 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.710234 alarm(0 <unfinished ...>
[pid 25529] 10:12:38.710257 fcntl(7, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25573] 10:12:38.710284 <... alarm resumed> ) = 300
[pid 25529] 10:12:38.710301 <... fcntl resumed> ) = 0
[pid 25573] 10:12:38.710321 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25529] 10:12:38.710348 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392302, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25529] 10:12:38.710395 write(7, "2015-12-30 10:12:38 [25529] 1aEJMb-0006df-04 Completed QT=1s\n", 61) = 61
[pid 25529] 10:12:38.710440 close(8 <unfinished ...>
[pid 25587] 10:12:38.710499 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25529] 10:12:38.710531 <... close resumed> ) = 0
[pid 25529] 10:12:38.710551 munmap(0x7f21d336e000, 4096) = 0
[pid 25529] 10:12:38.710589 close(9)    = 0
[pid 25529] 10:12:38.710627 unlink("/var/spool/exim/input/b/1aEJMb-0006df-04-J") = 0
[pid 25529] 10:12:38.710693 close(6)    = 0
[pid 25529] 10:12:38.710972 exit_group(0) = ?
[pid 25529] 10:12:38.711594 +++ exited with 0 +++
[pid 25587] 10:12:38.711637 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25587] 10:12:38.711693 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25587] 10:12:38.711739 lseek(10, 0, SEEK_SET) = 0
[pid 25587] 10:12:38.711834 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25587] 10:12:38.711938 stat("/home/finest09/etc/finestweddingsites.com/quota", {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25587] 10:12:38.712022 open("/home/finest09/etc/finestweddingsites.com/quota", O_RDONLY) = 13
[pid 25587] 10:12:38.712069 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25587] 10:12:38.712120 fstat(13, {st_dev=makedev(144, 4215), st_ino=121902520, st_mode=S_IFREG|0640, st_nlink=1, st_uid=503, st_gid=12, st_blksize=4096, st_blocks=8, st_size=494, st_atime=2015/12/22-14:19:13, st_mtime=2015/11/03-10:54:05, st_ctime=2015/12/29-14:48:39}) = 0
[pid 25587] 10:12:38.712166 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25587] 10:12:38.712204 lseek(13, 0, SEEK_SET) = 0
[pid 25587] 10:12:38.712239 read(13, "bridalleads:104857600\npostmaster:104857600\nbruce:262144000\nlisa:262144000\nresponse:262144000\nrespond:262144000\ninfo:262144000\nshanna:262144000\nvanessa:262144000\nuploads:262144000\nblog:262144000\ndistribution:262144000\ncontactus:262144000\nadvertising:2621440"..., 4096) = 494
[pid 25587] 10:12:38.712312 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25587] 10:12:38.712363 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25587] 10:12:38.712403 rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7ff9b1bf8790}, 8) = 0
[pid 25587] 10:12:38.712445 close(11)   = 0
[pid 25587] 10:12:38.712481 fcntl(12, F_GETFD) = 0
[pid 25587] 10:12:38.712519 fcntl(12, F_SETFD, FD_CLOEXEC) = 0
[pid 25587] 10:12:38.712568 geteuid()   = 0
[pid 25587] 10:12:38.712605 getegid()   = 12
[pid 25587] 10:12:38.712641 setgid(500) = 0
[pid 25587] 10:12:38.712676 setuid(503) = 0
[pid 25587] 10:12:38.712712 chdir("/")  = 0
[pid 25587] 10:12:38.712834 geteuid()   = 503
[pid 25587] 10:12:38.712878 getegid()   = 500
[pid 25587] 10:12:38.712936 stat("/home/finest09/mail/finestweddingsites.com/lisa", {st_dev=makedev(144, 4215), st_ino=121902962, st_mode=S_IFDIR|0700, st_nlink=11, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25587] 10:12:38.712997 chdir("/home/finest09/mail/finestweddingsites.com/lisa") = 0
[pid 25587] 10:12:38.713056 stat("tmp", {st_dev=makedev(144, 4215), st_ino=122159212, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/29-16:32:04, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25587] 10:12:38.713115 stat("new", {st_dev=makedev(144, 4215), st_ino=122159210, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25587] 10:12:38.713164 stat("cur", {st_dev=makedev(144, 4215), st_ino=122159208, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-16:30:46, st_mtime=2015/12/30-10:05:09, st_ctime=2015/12/30-10:05:09}) = 0
[pid 25587] 10:12:38.713280 open("/home/finest09/mail/finestweddingsites.com/lisa/maildirsize", O_RDWR|O_APPEND) = 11
[pid 25587] 10:12:38.713334 read(11, "262144000S,0C\n1496918 39\n2647 1\n2598 1\n2648 1\n-16881 -7\n2624 1\n498592 1\n-501216 -2\n7142 1\n2805 1\n2809 1\n2803 1\n2815 1\n2803 1\n2833 1\n2819 1\n2809 1\n2826 1\n2823 1\n2851 1\n2842 1\n2821 1\n2825 1\n-46626 -15\n2578 1\n2612 1\n2618 1\n2615 1\n2641 1\n2601 1\n2608 1\n2612 1\n2"..., 5120) = 4165
[pid 25587] 10:12:38.713458 stat("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", 0x7fffca4b7040) = -1 ENOENT (No such file or directory)
[pid 25587] 10:12:38.713517 open("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", O_WRONLY|O_CREAT|O_EXCL, 0660) = 14
[pid 25587] 10:12:38.713592 chown("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", 503, 500) = 0
[pid 25587] 10:12:38.713640 chmod("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", 0660) = 0
[pid 25587] 10:12:38.713682 chown("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", 503, 500) = 0
[pid 25587] 10:12:38.713722 chmod("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", 0660) = 0
[pid 25587] 10:12:38.713912 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25587] 10:12:38.714023 lseek(6, 19, SEEK_SET) = 19
[pid 25587] 10:12:38.714065 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25587] 10:12:38.714126 read(6, "", 8192) = 0
[pid 25587] 10:12:38.714163 write(14, "Return-path: <finest09@fin.finestweddingsites.com>\nEnvelope-to: BridesFrom@finestweddingsites.com\nDelivery-date: Wed, 30 Dec 2015 10:12:38 -0600\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.fine"..., 2528) = 2528
[pid 25587] 10:12:38.714212 fsync(14Process 25588 attached
 <unfinished ...>
[pid 25588] 10:12:38.714319 set_robust_list(0x7f4b636f1aa0, 24) = 0
[pid 25588] 10:12:38.714472 geteuid()   = 0
[pid 25588] 10:12:38.714518 geteuid()   = 0
[pid 25588] 10:12:38.714554 getegid()   = 12
[pid 25588] 10:12:38.714590 setgid(12)  = 0
[pid 25588] 10:12:38.714626 setuid(47 <unfinished ...>
[pid 25587] 10:12:38.714654 <... fsync resumed> ) = 0
[pid 25587] 10:12:38.714676 lseek(11, 0, SEEK_END) = 4165
[pid 25587] 10:12:38.714714 write(11, "2528 1\n", 7) = 7
[pid 25587] 10:12:38.714832 close(11)   = 0
[pid 25587] 10:12:38.714877 fstat(14, {st_dev=makedev(144, 4215), st_ino=122179992, st_mode=S_IFREG|0660, st_nlink=1, st_uid=503, st_gid=500, st_blksize=4096, st_blocks=8, st_size=2528, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25587] 10:12:38.714928 close(14)   = 0
[pid 25587] 10:12:38.714976 rename("tmp/1451491958.H713447P25587.fin.finestweddingsites.com", "new/1451491958.H713447P25587.fin.finestweddingsites.com,S=2528") = 0
[pid 25587] 10:12:38.715046 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715087 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715111 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715141 write(12, "\340\t\0\0", 4) = 4
[pid 25559] 10:12:38.715177 <... read resumed> "\340\t\0\0", 4) = 4
[pid 25559] 10:12:38.715197 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715226 write(12, "\200\0\0\0", 4) = 4
[pid 25559] 10:12:38.715258 <... read resumed> "\200\0\0\0", 4) = 4
[pid 25559] 10:12:38.715278 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715309 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715343 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715362 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715392 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715425 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715444 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715471 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715507 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715532 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715561 write(12, "\260\23\235\0\0\0\0\0", 8) = 8
[pid 25559] 10:12:38.715594 <... read resumed> "\260\23\235\0\0\0\0\0", 8) = 8
[pid 25559] 10:12:38.715614 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715667 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715702 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715722 read(11,  <unfinished ...>
[pid 25587] 10:12:38.715817 write(12, "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715855 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25559] 10:12:38.715875 close(11)   = 0
[pid 25559] 10:12:38.715925 write(9, "lisa@finestweddingsites.com\n", 28) = 28
[pid 25559] 10:12:38.715970 fsync(9 <unfinished ...>
[pid 25587] 10:12:38.716019 close(12)   = 0
[pid 25587] 10:12:38.716105 close(10)   = 0
[pid 25587] 10:12:38.716143 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25587] 10:12:38.716184 close(13)   = 0
[pid 25587] 10:12:38.716220 munmap(0x7ff9b2d40000, 4096) = 0
[pid 25559] 10:12:38.716258 <... fsync resumed> ) = 0
[pid 25559] 10:12:38.716277 wait4(-1,  <unfinished ...>
[pid 25587] 10:12:38.716695 exit_group(0) = ?
[pid 25587] 10:12:38.717133 +++ exited with 0 +++
[pid 25559] 10:12:38.717154 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25587
[pid 25559] 10:12:38.717240 open("/etc/userdomains", O_RDONLY) = 10
[pid 25559] 10:12:38.717289 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.717342 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25559] 10:12:38.717390 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:38.717430 lseek(10, 0, SEEK_SET) = 0
[pid 25559] 10:12:38.717464 read(10, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25559] 10:12:38.717533 stat("/home/finest09/.cpanel/rim/bis/lisa@finestweddingsites.com", 0x7fffca4b5d90) = -1 ENOENT (No such file or directory)
[pid 25559] 10:12:38.717590 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.717652 write(8, "2015-12-30 10:12:38 lisa@finestweddingsites.com <BridesFrom@finestweddingsites.com>: virtual_userdelivery transport succeeded\n", 126) = 126
[pid 25559] 10:12:38.717706 write(8, "2015-12-30 10:12:38 BridesFrom@finestweddingsites.com: children all complete\n", 77) = 77
[pid 25559] 10:12:38.717824 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.717896 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:38.717949 close(7)    = 0
[pid 25559] 10:12:38.717987 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25559] 10:12:38.718032 fcntl(7, F_GETFD) = 0
[pid 25559] 10:12:38.718065 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:38.718098 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392363, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25559] 10:12:38.718182 write(7, "2015-12-30 10:12:38 [25559] 1aEJMb-0006e1-MY => lisa (BridesFrom@finestweddingsites.com) <BridesFrom@finestweddingsites.com> F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=virtual_user T=virtual_userdelivery S=2528 QT=1s "..., 262) = 262
[pid 25559] 10:12:38.718264 pipe([11, 12]) = 0
[pid 25559] 10:12:38.718308 fcntl(11, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid 25559] 10:12:38.718367 close(10)   = 0
[pid 25559] 10:12:38.718404 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:38.718448 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25590
[pid 25559] 10:12:38.718695 close(12)   = 0
[pid 25559] 10:12:38.718831 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:38.718890 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25588] 10:12:38.718936 <... setuid resumed> ) = 0
Process 25589 attached
[pid 25589] 10:12:38.719838 set_robust_list(0x7f81fe773aa0, 24) = 0
[pid 25589] 10:12:38.719899 close(0)    = 0
[pid 25589] 10:12:38.719942 close(1)    = 0
[pid 25589] 10:12:38.720002 close(2)    = 0
[pid 25589] 10:12:38.720090 setsid()    = 25589
[pid 25589] 10:12:38.720134 fstat(0,  <unfinished ...>
[pid 25572] 10:12:38.720188 <... select resumed> ) = 1 (in [11], left {299, 989830})
[pid 25572] 10:12:38.720219 read(11, "\27\3\3\0S", 5) = 5
[pid 25572] 10:12:38.720257 read(11, "\0358\355\344\247\267G\214D\3411\302\272\374\2377o\3466\305Z\216+\371\327\332\3145\204\270nf\373Z'\347\10\200\362\270\212\313\227\344\37L\242:\211\32q}G}\343\232*Y\7\246\340\334\357=\350\227s!&\333\6\266\257\310)\310\245\16\313\244\221\205n", 83) = 83
[pid 25572] 10:12:38.720305 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25589] 10:12:38.720345 <... fstat resumed> 0x7ffe2823c6c0) = -1 EBADF (Bad file descriptor)
[pid 25589] 10:12:38.720371 open("/dev/null", O_RDWR) = 0
[pid 25572] 10:12:38.720437 <... select resumed> ) = 1 (in [11], left {299, 999896})
[pid 25572] 10:12:38.720464 read(11, "\27\3\3\0F", 5) = 5
[pid 25572] 10:12:38.720504 read(11, "\0358\355\344\247\267G\2151\263s\377d\300\237\350\37\276lv\210K\251\323]\252\244u\3=\341\344\333&On\336\230\376\206%\330\206\20\10\207\23\31\371Ce\215\247\331\22TF\1\321\225\30\34\255f\6D\342Y\206\350", 70) = 70
[pid 25572] 10:12:38.720588 lseek(6, 19, SEEK_SET) = 19
[pid 25572] 10:12:38.720627 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25572] 10:12:38.720685 read(6, "", 8192) = 0
[pid 25572] 10:12:38.720721 alarm(300)  = 0
[pid 25572] 10:12:38.720840 write(11, "\27\3\3\fkB\321\5\374\316Y\v\351\207G]\"3\275t>\210\24\201\342\30\372[\275\17O\26\10\0=Ib\332\325\325\306\0373\2408|@\316{\206\3769\205\203\325eS\365A(9\211\266M\246a-\240us|\fh)\375hO>F\347\326\346\323\376C\217\335q\fQ\f\214\355-\204\357\247\323\35\337J\311\341\33\262y\317\17\261\200\320\21\253\17\310'\234N\372y6N\240\202\24o[\5\260\243\211\367\t\302\0172\260I\372\302xRp9\245:)\345\343\341\221\322~Y\4$\266 |$\2611\365\331\333D\215^\371\35\263\366\324J\0057\264\237\346I\343\33\305m*\f\2\202\f:+|\3567\5\253\10\305\371\232\243\305\302\3158\375\37\322\217\311X\212\376\232l\314jYX\263\275VF=\364[.\347\"@Y\323\322\334\311\241\341\347\365'd\251ve\30v\221\344\216\254p\2303\205\234\277"..., 3184) = 3184
[pid 25572] 10:12:38.720925 alarm(0)    = 300
[pid 25572] 10:12:38.720961 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25589] 10:12:38.720999 fstat(1, 0x7ffe2823c6c0) = -1 EBADF (Bad file descriptor)
[pid 25589] 10:12:38.721066 dup2(0, 1)  = 1
[pid 25589] 10:12:38.721104 fstat(2, 0x7ffe2823c6c0) = -1 EBADF (Bad file descriptor)
[pid 25589] 10:12:38.721140 dup2(0, 2)  = 2
[pid 25589] 10:12:38.721181 geteuid()   = 47
[pid 25589] 10:12:38.721225 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25589] 10:12:38.721282 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25589] 10:12:38.721329 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25589] 10:12:38.721383 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMc-0006ec-HH"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25588] 10:12:38.722830 brk(0x15cd000 <unfinished ...>
[pid 25589] 10:12:38.722982 <... execve resumed> ) = 0
[pid 25589] 10:12:38.723020 brk(0)      = 0x1ac5000
[pid 25589] 10:12:38.723061 fcntl(0, F_GETFD) = 0
[pid 25589] 10:12:38.723097 fcntl(1, F_GETFD) = 0
[pid 25589] 10:12:38.723129 fcntl(2, F_GETFD) = 0
[pid 25589] 10:12:38.723167 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723224 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ef000
[pid 25589] 10:12:38.723278 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723332 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723382 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723423 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723470 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723512 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723555 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723594 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723634 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25589] 10:12:38.723690 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723739 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723860 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723903 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.723944 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724008 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724057 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724106 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.724168 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724209 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724253 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724294 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724334 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724374 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fff445e9aa0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.724456 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.724511 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25589] 10:12:38.724553 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25589] 10:12:38.724605 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fd7578e5000
[pid 25589] 10:12:38.724644 close(6)    = 0
[pid 25589] 10:12:38.724687 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25589] 10:12:38.724732 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.724872 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.724925 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd7574b7000
[pid 25589] 10:12:38.724965 mprotect(0x7fd7574cd000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.725004 mmap(0x7fd7576cd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fd7576cd000
[pid 25589] 10:12:38.725067 mmap(0x7fd7576cf000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd7576cf000
[pid 25589] 10:12:38.725121 close(6)    = 0
[pid 25589] 10:12:38.725165 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725256 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725301 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25589] 10:12:38.725347 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.725390 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.725441 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e4000
[pid 25589] 10:12:38.725485 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd75729e000
[pid 25589] 10:12:38.725528 mprotect(0x7fd7572b4000, 2093056, PROT_NONE) = 0
[pid 25589] 10:12:38.725567 mmap(0x7fd7574b3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fd7574b3000
[pid 25589] 10:12:38.725613 mmap(0x7fd7574b5000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd7574b5000
[pid 25589] 10:12:38.725657 close(6)    = 0
[pid 25589] 10:12:38.725699 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725842 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725901 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.725957 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25589] 10:12:38.726002 read(6,  <unfinished ...>
[pid 25588] 10:12:38.726033 <... brk resumed> ) = 0x15cd000
[pid 25589] 10:12:38.726056 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25588] 10:12:38.726476 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25589] 10:12:38.726520 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.726572 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd757067000
[pid 25589] 10:12:38.726611 mprotect(0x7fd75706e000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.726654 mmap(0x7fd75726e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fd75726e000
[pid 25589] 10:12:38.726701 mmap(0x7fd757270000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd757270000
[pid 25589] 10:12:38.726851 close(6)    = 0
[pid 25589] 10:12:38.726899 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.726945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.726989 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.727058 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25589] 10:12:38.727102 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.727145 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.727193 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd756de3000
[pid 25589] 10:12:38.727237 mprotect(0x7fd756e66000, 2093056, PROT_NONE) = 0
[pid 25589] 10:12:38.727275 mmap(0x7fd757065000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fd757065000
[pid 25589] 10:12:38.727323 close(6)    = 0
[pid 25589] 10:12:38.727367 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.727411 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.727455 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.727501 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25589] 10:12:38.727542 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.727590 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25589] 10:12:38.727638 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e3000
[pid 25589] 10:12:38.727679 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd756bd5000
[pid 25589] 10:12:38.727718 mprotect(0x7fd756be1000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.727846 mmap(0x7fd756de1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fd756de1000
[pid 25589] 10:12:38.727899 close(6)    = 0
[pid 25589] 10:12:38.727942 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25589] 10:12:38.727992 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.728034 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25589] 10:12:38.728083 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd7569b2000
[pid 25589] 10:12:38.728145 mprotect(0x7fd7569d3000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.728184 mmap(0x7fd756bd3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fd756bd3000
[pid 25589] 10:12:38.728228 close(6)    = 0
[pid 25589] 10:12:38.728269 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.728313 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.728358 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.728405 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25589] 10:12:38.728449 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.728492 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.728540 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd756795000
[pid 25589] 10:12:38.728583 mprotect(0x7fd7567ac000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.728620 mmap(0x7fd7569ac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fd7569ac000
[pid 25588] 10:12:38.728675 <... open resumed> ) = 7
[pid 25589] 10:12:38.728707 mmap(0x7fd7569ae000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd7569ae000
[pid 25588] 10:12:38.728835 fstat(7,  <unfinished ...>
[pid 25589] 10:12:38.728877 close(6)    = 0
[pid 25588] 10:12:38.728912 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25589] 10:12:38.728954 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25588] 10:12:38.728989 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25589] 10:12:38.729031 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25588] 10:12:38.729054 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25588] 10:12:38.729082 read(7, "\333t%\267\277|\277&<\336z!\344*\376\237\305$5\306\4\3739V\357\367\267\37\r\\%tU\310'\366\0301\254a\233\232\250TET\310\260", 48) = 48
[pid 25589] 10:12:38.729125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25588] 10:12:38.729171 close(7)    = 0
[pid 25589] 10:12:38.729205 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25588] 10:12:38.729251 getuid( <unfinished ...>
[pid 25589] 10:12:38.729283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.729305 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25589] 10:12:38.729344 read(6,  <unfinished ...>
[pid 25588] 10:12:38.729370 <... getuid resumed> ) = 47
[pid 25589] 10:12:38.729390 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25588] 10:12:38.729559 exit_group(0) = ?
[pid 25589] 10:12:38.729584 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25589] 10:12:38.729639 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e2000
[pid 25589] 10:12:38.729680 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd756421000
[pid 25589] 10:12:38.729719 mprotect(0x7fd756590000, 2093056, PROT_NONE) = 0
[pid 25589] 10:12:38.729836 mmap(0x7fd75678f000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fd75678f000
[pid 25589] 10:12:38.729890 close(6)    = 0
[pid 25589] 10:12:38.729935 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.729981 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.730053 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.730097 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25589] 10:12:38.730143 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.730192 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25589] 10:12:38.730248 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd756192000
[pid 25589] 10:12:38.730287 mprotect(0x7fd75621d000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.730327 mmap(0x7fd75641d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fd75641d000
[pid 25589] 10:12:38.730373 mmap(0x7fd756420000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd756420000
[pid 25589] 10:12:38.730444 close(6 <unfinished ...>
[pid 25588] 10:12:38.730712 +++ exited with 0 +++
[pid 25585] 10:12:38.730727 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25588
[pid 25585] 10:12:38.730834 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0}, 8) = 0
[pid 25585] 10:12:38.730910 getcwd("/var/spool/exim", 16380) = 16
[pid 25585] 10:12:38.730989 open("/etc/localtime", O_RDONLY) = 7
[pid 25585] 10:12:38.731058 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.731106 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.731151 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.731188 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25585] 10:12:38.731236 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25585] 10:12:38.731271 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25585] 10:12:38.731327 close(7)    = 0
[pid 25585] 10:12:38.731364 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.731422 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25585] 10:12:38.731475 fcntl(7, F_GETFD) = 0
[pid 25585] 10:12:38.731510 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25585] 10:12:38.731543 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392625, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.731590 write(7, "2015-12-30 10:12:38 [25585] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMc-0006ea-Fj\n", 92) = 92
[pid 25585] 10:12:38.731633 chdir("/var/spool/exim") = 0
[pid 25585] 10:12:38.731678 setgid(12)  = 0
[pid 25585] 10:12:38.731824 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25585] 10:12:38.731918 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25585] 10:12:38.732031 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25585] 10:12:38.732114 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25585] 10:12:38.732193 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25585] 10:12:38.732288 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25585] 10:12:38.732407 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25585] 10:12:38.732484 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25585] 10:12:38.732532 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.732580 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.732623 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.732673 close(8)    = 0
[pid 25585] 10:12:38.732833 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.732938 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25585] 10:12:38.733100 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25585] 10:12:38.733231 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25585] 10:12:38.733360 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25585] 10:12:38.733479 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25585] 10:12:38.733549 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25585] 10:12:38.733595 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.733643 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.733681 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.733732 close(8)    = 0
[pid 25585] 10:12:38.733848 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.733900 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25585] 10:12:38.733946 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25585] 10:12:38.733994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.734053 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25585] 10:12:38.734107 close(8)    = 0
[pid 25585] 10:12:38.734159 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.734295 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25585] 10:12:38.734345 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25585] 10:12:38.734401 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.734440 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25585] 10:12:38.734496 close(8)    = 0
[pid 25585] 10:12:38.734532 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.734642 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25585] 10:12:38.734879 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25585] 10:12:38.735016 read(6, "", 4096) = 0
[pid 25585] 10:12:38.735060 read(6, "", 4096) = 0
[pid 25585] 10:12:38.735098 close(6)    = 0
[pid 25585] 10:12:38.735136 munmap(0x7f4b63708000, 4096) = 0
[pid 25585] 10:12:38.735192 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f4b625be790}, NULL, 8) = 0
[pid 25585] 10:12:38.735246 open("/var/spool/exim/input/c/1aEJMc-0006ea-Fj-D", O_RDWR|O_APPEND) = 6
[pid 25585] 10:12:38.735298 fcntl(6, F_GETFD) = 0
[pid 25585] 10:12:38.735331 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25585] 10:12:38.735365 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25585] 10:12:38.735404 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080198, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3150, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.735458 open("/var/spool/exim/input/c/1aEJMc-0006ea-Fj-H", O_RDONLY) = 8
[pid 25585] 10:12:38.735503 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.735549 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63708000
[pid 25585] 10:12:38.735591 read(8, "1aEJMc-0006ea-Fj-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25585] 10:12:38.735670 read(8, "", 4096) = 0
[pid 25585] 10:12:38.735708 close(8)    = 0
[pid 25585] 10:12:38.735808 munmap(0x7f4b63708000, 4096) = 0
[pid 25585] 10:12:38.735861 open("/var/spool/exim/input/c/1aEJMc-0006ea-Fj-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.735918 open("/var/spool/exim/msglog/c/1aEJMc-0006ea-Fj", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25585] 10:12:38.735966 fcntl(8, F_GETFD <unfinished ...>
[pid 25589] 10:12:38.735998 <... close resumed> ) = 0
[pid 25585] 10:12:38.736035 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.736068 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.736102 fcntl(8, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.736130 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.736144 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.736173 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.736208 fchown(8, 47, 12 <unfinished ...>
[pid 25589] 10:12:38.736243 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.736257 <... fchown resumed> ) = 0
[pid 25589] 10:12:38.736280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.736342 fchmod(8, 0640 <unfinished ...>
[pid 25589] 10:12:38.736375 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.736389 <... fchmod resumed> ) = 0
[pid 25589] 10:12:38.736418 open("/usr/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.736457 fcntl(8, F_GETFL <unfinished ...>
[pid 25589] 10:12:38.736484 <... open resumed> ) = 6
[pid 25585] 10:12:38.736497 <... fcntl resumed> ) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25589] 10:12:38.736520 read(6,  <unfinished ...>
[pid 25585] 10:12:38.736552 fstat(8,  <unfinished ...>
[pid 25589] 10:12:38.736584 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.736605 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=125080204, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.736640 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.736662 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.736692 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25585] 10:12:38.736717 <... mmap resumed> ) = 0x7f4b63708000
[pid 25589] 10:12:38.736817 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.736855 lseek(8, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.736883 <... mmap resumed> ) = 0x7fd755f8c000
[pid 25585] 10:12:38.736896 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.736925 mprotect(0x7fd755f92000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.736972 stat("/etc/cpanel_exim_system_filter",  <unfinished ...>
[pid 25589] 10:12:38.737010 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.737023 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.737061 mmap(0x7fd756191000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000 <unfinished ...>
[pid 25585] 10:12:38.737091 pipe( <unfinished ...>
[pid 25589] 10:12:38.737123 <... mmap resumed> ) = 0x7fd756191000
[pid 25585] 10:12:38.737136 <... pipe resumed> [9, 10]) = 0
[pid 25589] 10:12:38.737165 close(6 <unfinished ...>
[pid 25585] 10:12:38.737187 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0},  <unfinished ...>
[pid 25589] 10:12:38.737218 <... close resumed> ) = 0
[pid 25585] 10:12:38.737231 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f4b625be790}, 8) = 0
[pid 25589] 10:12:38.737265 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.737295 clone( <unfinished ...>
[pid 25589] 10:12:38.737522 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.737542 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f4b636f1a90) = 25591
[pid 25585] 10:12:38.737589 close(10)   = 0
[pid 25585] 10:12:38.737626 read(9,  <unfinished ...>
[pid 25589] 10:12:38.737655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25589] 10:12:38.737700 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.737820 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.737877 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e1000
[pid 25589] 10:12:38.737919 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd755c56000
[pid 25589] 10:12:38.737987 mprotect(0x7fd755d82000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.738028 mmap(0x7fd755f82000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fd755f82000
[pid 25589] 10:12:38.738076 mmap(0x7fd755f8b000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd755f8b000
[pid 25589] 10:12:38.738121 close(6)    = 0
[pid 25589] 10:12:38.738167 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.738213 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.738274 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.738348 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25589] 10:12:38.738423 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.738492 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.738579 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd755a52000
[pid 25589] 10:12:38.738648 mprotect(0x7fd755a54000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.738708 mmap(0x7fd755c54000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fd755c54000
[pid 25589] 10:12:38.738838 close(6)    = 0
[pid 25589] 10:12:38.738912 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.738977 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.739072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.739126 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25589] 10:12:38.739172 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.739220 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.739274 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd75584f000
[pid 25589] 10:12:38.739314 mprotect(0x7fd755851000, 2093056, PROT_NONE) = 0
[pid 25589] 10:12:38.739351 mmap(0x7fd755a50000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fd755a50000
[pid 25589] 10:12:38.739400 close(6)    = 0
[pid 25589] 10:12:38.739444 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.739489 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.739532 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.739574 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25589] 10:12:38.739617 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.739658 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.739706 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e0000
[pid 25589] 10:12:38.739831 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd7554bb000
[pid 25589] 10:12:38.739877 mprotect(0x7fd755645000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.739915 mmap(0x7fd755845000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fd755845000
[pid 25589] 10:12:38.739962 mmap(0x7fd75584a000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd75584a000
[pid 25589] 10:12:38.740030 close(6)    = 0
[pid 25589] 10:12:38.740095 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.740143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.740188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.740238 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25589] 10:12:38.740318 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.740394 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25589] 10:12:38.740490 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fd75524f000
[pid 25589] 10:12:38.740558 mprotect(0x7fd7552b1000, 2093056, PROT_NONE) = 0
[pid 25589] 10:12:38.740620 mmap(0x7fd7554b0000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fd7554b0000
[pid 25589] 10:12:38.740693 close(6)    = 0
[pid 25589] 10:12:38.740794 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLYProcess 25591 attached
Process 25590 attached
) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.741052 set_robust_list(0x7f4b636f1aa0, 24 <unfinished ...>
[pid 25590] 10:12:38.741094 set_robust_list(0x7ff9b2d2baa0, 24 <unfinished ...>
[pid 25589] 10:12:38.741125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.741179 <... set_robust_list resumed> ) = 0
[pid 25590] 10:12:38.741198 <... set_robust_list resumed> ) = 0
[pid 25589] 10:12:38.741286 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.741349 close(9 <unfinished ...>
[pid 25590] 10:12:38.741385 fcntl(12, F_GETFD <unfinished ...>
[pid 25589] 10:12:38.741416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.741465 <... close resumed> ) = 0
[pid 25590] 10:12:38.741484 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.741519 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.741568 geteuid( <unfinished ...>
[pid 25590] 10:12:38.741600 fcntl(12, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.741631 open("/usr/lib64/libcrypto.so.10", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.741681 <... geteuid resumed> ) = 0
[pid 25590] 10:12:38.741700 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.741721 <... open resumed> ) = 6
[pid 25591] 10:12:38.741859 getegid( <unfinished ...>
[pid 25590] 10:12:38.741896 close(6 <unfinished ...>
[pid 25589] 10:12:38.741928 read(6,  <unfinished ...>
[pid 25591] 10:12:38.741989 <... getegid resumed> ) = 12
[pid 25590] 10:12:38.742012 <... close resumed> ) = 0
[pid 25589] 10:12:38.742037 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25591] 10:12:38.742110 setgid(494 <unfinished ...>
[pid 25590] 10:12:38.742146 open("/var/spool/exim/input/b/1aEJMb-0006e1-MY-D", O_RDWR|O_APPEND <unfinished ...>
[pid 25589] 10:12:38.742202 fstat(6,  <unfinished ...>
[pid 25591] 10:12:38.742243 <... setgid resumed> ) = 0
[pid 25590] 10:12:38.742294 <... open resumed> ) = 6
[pid 25589] 10:12:38.742349 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25591] 10:12:38.742422 setuid(495 <unfinished ...>
[pid 25590] 10:12:38.742462 fcntl(6, F_GETFD <unfinished ...>
[pid 25589] 10:12:38.742496 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25591] 10:12:38.742563 <... setuid resumed> ) = 0
[pid 25590] 10:12:38.742589 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.742640 <... mmap resumed> ) = 0x7fd754e6c000
[pid 25591] 10:12:38.742679 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.742722 fcntl(6, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.742852 mprotect(0x7fd755025000, 2093056, PROT_NONE <unfinished ...>
[pid 25591] 10:12:38.742938 <... open resumed> ) = 9
[pid 25590] 10:12:38.742963 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.742998 <... mprotect resumed> ) = 0
[pid 25591] 10:12:38.743080 fstat(9,  <unfinished ...>
[pid 25590] 10:12:38.743117 geteuid( <unfinished ...>
[pid 25589] 10:12:38.743148 mmap(0x7fd755224000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000 <unfinished ...>
[pid 25591] 10:12:38.743202 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25590] 10:12:38.743247 <... geteuid resumed> ) = 0
[pid 25589] 10:12:38.743321 <... mmap resumed> ) = 0x7fd755224000
[pid 25591] 10:12:38.743373 fstat(9,  <unfinished ...>
[pid 25590] 10:12:38.743409 getegid( <unfinished ...>
[pid 25589] 10:12:38.743442 mmap(0x7fd75524b000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25591] 10:12:38.743493 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25590] 10:12:38.743537 <... getegid resumed> ) = 12
[pid 25589] 10:12:38.743565 <... mmap resumed> ) = 0x7fd75524b000
[pid 25591] 10:12:38.743609 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25590] 10:12:38.743651 setgid(12 <unfinished ...>
[pid 25589] 10:12:38.743684 close(6 <unfinished ...>
[pid 25591] 10:12:38.743725 <... mmap resumed> ) = 0x7f4b63707000
[pid 25590] 10:12:38.743874 <... setgid resumed> ) = 0
[pid 25589] 10:12:38.743905 <... close resumed> ) = 0
[pid 25591] 10:12:38.743962 read(9,  <unfinished ...>
[pid 25590] 10:12:38.744008 setuid(47 <unfinished ...>
[pid 25589] 10:12:38.744068 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.744125 <... read resumed> "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25590] 10:12:38.744152 <... setuid resumed> ) = 0
[pid 25589] 10:12:38.744176 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.744213 read(9,  <unfinished ...>
[pid 25590] 10:12:38.744254 close(11 <unfinished ...>
[pid 25589] 10:12:38.744289 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.744346 <... read resumed> "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25590] 10:12:38.744374 <... close resumed> ) = 0
[pid 25589] 10:12:38.744403 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.744562 close(9 <unfinished ...>
[pid 25590] 10:12:38.744600 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25589] 10:12:38.744631 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.744668 <... close resumed> ) = 0
[pid 25590] 10:12:38.744681 <... socket resumed> ) = 10
[pid 25589] 10:12:38.744700 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25591] 10:12:38.744725 munmap(0x7f4b63707000, 4096 <unfinished ...>
[pid 25590] 10:12:38.744833 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25589] 10:12:38.744882 open("/lib64/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25591] 10:12:38.744922 <... munmap resumed> ) = 0
[pid 25590] 10:12:38.744942 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.745003 <... open resumed> ) = 6
[pid 25591] 10:12:38.745029 brk(0x15ce000 <unfinished ...>
[pid 25590] 10:12:38.745075 close(10 <unfinished ...>
[pid 25589] 10:12:38.745106 read(6,  <unfinished ...>
[pid 25591] 10:12:38.745137 <... brk resumed> ) = 0x15ce000
[pid 25590] 10:12:38.745151 <... close resumed> ) = 0
[pid 25589] 10:12:38.745269 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25591] 10:12:38.745308 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25590] 10:12:38.745340 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25589] 10:12:38.745366 fstat(6,  <unfinished ...>
[pid 25591] 10:12:38.745399 <... write resumed> ) = 4
[pid 25590] 10:12:38.745412 <... socket resumed> ) = 10
[pid 25589] 10:12:38.745427 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25585] 10:12:38.745459 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25591] 10:12:38.745484 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25590] 10:12:38.745511 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25589] 10:12:38.745542 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.745570 read(9,  <unfinished ...>
[pid 25591] 10:12:38.745599 <... write resumed> ) = 4
[pid 25590] 10:12:38.745612 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.745629 <... mmap resumed> ) = 0x7fd7578df000
[pid 25585] 10:12:38.745650 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25591] 10:12:38.745674 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25590] 10:12:38.745697 close(10 <unfinished ...>
[pid 25589] 10:12:38.745725 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.745829 read(9,  <unfinished ...>
[pid 25591] 10:12:38.745864 <... write resumed> ) = 4
[pid 25590] 10:12:38.745877 <... close resumed> ) = 0
[pid 25589] 10:12:38.745893 <... mmap resumed> ) = 0x7fd754c3f000
[pid 25585] 10:12:38.745964 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25591] 10:12:38.745993 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25590] 10:12:38.746017 open("/etc/services", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.746070 mprotect(0x7fd754c6b000, 2097152, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.746099 read(9,  <unfinished ...>
[pid 25591] 10:12:38.746128 <... write resumed> ) = 4
[pid 25590] 10:12:38.746141 <... open resumed> ) = 10
[pid 25589] 10:12:38.746156 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.746181 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25591] 10:12:38.746206 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25590] 10:12:38.746229 fstat(10,  <unfinished ...>
[pid 25589] 10:12:38.746251 mmap(0x7fd754e6b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000 <unfinished ...>
[pid 25585] 10:12:38.746293 read(9,  <unfinished ...>
[pid 25591] 10:12:38.746331 <... write resumed> ) = 4
[pid 25590] 10:12:38.746344 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1256, st_size=641020, st_atime=2015/12/22-09:30:28, st_mtime=2013/10/02-04:06:18, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.746380 <... mmap resumed> ) = 0x7fd754e6b000
[pid 25585] 10:12:38.746405 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25591] 10:12:38.746429 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25590] 10:12:38.746454 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.746480 close(6 <unfinished ...>
[pid 25585] 10:12:38.746513 read(9,  <unfinished ...>
[pid 25591] 10:12:38.746553 <... write resumed> ) = 40
[pid 25590] 10:12:38.746567 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25589] 10:12:38.746583 <... close resumed> ) = 0
[pid 25585] 10:12:38.746609 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25591] 10:12:38.746636 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25590] 10:12:38.746666 read(10,  <unfinished ...>
[pid 25589] 10:12:38.746714 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.746826 read(9,  <unfinished ...>
[pid 25591] 10:12:38.746858 <... write resumed> ) = 4
[pid 25590] 10:12:38.746872 <... read resumed> "# /etc/services:\n# $Id: services,v 1.48 2009/11/11 14:32:31 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2009-11-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for "..., 4096) = 4096
[pid 25589] 10:12:38.746893 <... open resumed> ) = 6
[pid 25585] 10:12:38.746944 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25591] 10:12:38.746975 close(10 <unfinished ...>
[pid 25590] 10:12:38.747021 close(10 <unfinished ...>
[pid 25589] 10:12:38.747046 read(6,  <unfinished ...>
[pid 25585] 10:12:38.747094 wait4(-1,  <unfinished ...>
[pid 25591] 10:12:38.747123 <... close resumed> ) = 0
[pid 25590] 10:12:38.747137 <... close resumed> ) = 0
[pid 25589] 10:12:38.747162 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25591] 10:12:38.747193 exit_group(0) = ?
[pid 25590] 10:12:38.747207 munmap(0x7ff9b2d41000, 4096 <unfinished ...>
[pid 25589] 10:12:38.747463 fstat(6,  <unfinished ...>
[pid 25591] 10:12:38.747510 +++ exited with 0 +++
[pid 25590] 10:12:38.747526 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.747539 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25585] 10:12:38.747619 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25591
[pid 25590] 10:12:38.747648 stat("/etc/mailips",  <unfinished ...>
[pid 25589] 10:12:38.747674 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.747705 close(9 <unfinished ...>
[pid 25590] 10:12:38.747736 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.747843 <... mmap resumed> ) = 0x7fd754a3a000
[pid 25585] 10:12:38.747890 <... close resumed> ) = 0
[pid 25590] 10:12:38.747915 open("/etc/mailips", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.747943 mprotect(0x7fd754a3f000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.747970 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0},  <unfinished ...>
[pid 25590] 10:12:38.748035 <... open resumed> ) = 10
[pid 25589] 10:12:38.748050 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.748071 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0}, 8) = 0
[pid 25590] 10:12:38.748129 fstat(10,  <unfinished ...>
[pid 25589] 10:12:38.748157 mmap(0x7fd754c3e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000 <unfinished ...>
[pid 25585] 10:12:38.748188 brk(0x15cd000 <unfinished ...>
[pid 25590] 10:12:38.748218 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.748244 <... mmap resumed> ) = 0x7fd754c3e000
[pid 25585] 10:12:38.748278 <... brk resumed> ) = 0x15cd000
[pid 25590] 10:12:38.748313 fstat(10,  <unfinished ...>
[pid 25589] 10:12:38.748337 close(6 <unfinished ...>
[pid 25585] 10:12:38.748362 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25590] 10:12:38.748404 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270350, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.748430 <... close resumed> ) = 0
[pid 25585] 10:12:38.748457 <... open resumed> ) = 9
[pid 25590] 10:12:38.748483 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.748514 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.748545 alarm(60 <unfinished ...>
[pid 25590] 10:12:38.748574 <... mmap resumed> ) = 0x7ff9b2d41000
[pid 25589] 10:12:38.748589 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.748610 <... alarm resumed> ) = 0
[pid 25590] 10:12:38.748631 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.748654 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.748686 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25590] 10:12:38.748723 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.748736 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.748846 <... fcntl resumed> ) = 0
[pid 25590] 10:12:38.748869 read(10,  <unfinished ...>
[pid 25589] 10:12:38.748895 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.748926 alarm(0 <unfinished ...>
[pid 25590] 10:12:38.748975 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.748991 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.749030 <... alarm resumed> ) = 60
[pid 25590] 10:12:38.749100 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.749126 open("/lib64/libfreebl3.so", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.749157 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25590] 10:12:38.749198 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.749211 <... open resumed> ) = 6
[pid 25585] 10:12:38.749229 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:38.749250 read(10,  <unfinished ...>
[pid 25589] 10:12:38.749272 read(6,  <unfinished ...>
[pid 25585] 10:12:38.749297 open("/proc/stat", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25590] 10:12:38.749344 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.749358 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.749572 <... open resumed> ) = 10
[pid 25590] 10:12:38.749602 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.749631 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.749655 read(10,  <unfinished ...>
[pid 25590] 10:12:38.749706 <... open resumed> ) = 11
[pid 25589] 10:12:38.749724 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25585] 10:12:38.749831 <... read resumed> "cpu  123104 1342501 395320 67343106 2509 0 0 0\ncpu0 123104 1342501 395320 67343106 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58667686\nbtime 1450798266\nprocesses 893069\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25590] 10:12:38.749864 fstat(11,  <unfinished ...>
[pid 25589] 10:12:38.749892 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.749925 close(10 <unfinished ...>
[pid 25590] 10:12:38.749957 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.749984 <... mmap resumed> ) = 0x7fd754837000
[pid 25585] 10:12:38.750024 <... close resumed> ) = 0
[pid 25590] 10:12:38.750102 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.750132 mprotect(0x7fd754839000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.750159 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25590] 10:12:38.750194 <... mmap resumed> ) = 0x7ff9b2d40000
[pid 25589] 10:12:38.750208 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.750225 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25590] 10:12:38.750267 read(11,  <unfinished ...>
[pid 25589] 10:12:38.750295 mmap(0x7fd754a38000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25585] 10:12:38.750326 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.750362 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.750380 <... mmap resumed> ) = 0x7fd754a38000
[pid 25585] 10:12:38.750419 <... open resumed> ) = 10
[pid 25590] 10:12:38.750445 close(11 <unfinished ...>
[pid 25589] 10:12:38.750469 close(6 <unfinished ...>
[pid 25585] 10:12:38.750498 fcntl(10, F_GETFD <unfinished ...>
[pid 25590] 10:12:38.750527 <... close resumed> ) = 0
[pid 25589] 10:12:38.750540 <... close resumed> ) = 0
[pid 25585] 10:12:38.750567 <... fcntl resumed> ) = 0
[pid 25590] 10:12:38.750589 munmap(0x7ff9b2d40000, 4096 <unfinished ...>
[pid 25589] 10:12:38.750616 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.750647 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25590] 10:12:38.750676 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.750692 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.750818 <... fcntl resumed> ) = 0
[pid 25590] 10:12:38.750858 open("/etc/shadow", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.750889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.750928 read(10,  <unfinished ...>
[pid 25590] 10:12:38.750957 <... open resumed> ) = -1 EACCES (Permission denied)
[pid 25589] 10:12:38.750972 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.751131 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25590] 10:12:38.751181 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.751206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.751239 close(10 <unfinished ...>
[pid 25590] 10:12:38.751268 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.751281 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.751303 <... close resumed> ) = 0
[pid 25590] 10:12:38.751340 read(10,  <unfinished ...>
[pid 25589] 10:12:38.751365 open("/lib64/libaudit.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.751403 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.751443 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.751461 <... open resumed> ) = 6
[pid 25585] 10:12:38.751488 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:38.751517 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.751542 read(6,  <unfinished ...>
[pid 25585] 10:12:38.751566 stat("/var/tmp",  <unfinished ...>
[pid 25590] 10:12:38.751601 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.751615 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.751639 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25590] 10:12:38.751728 read(10,  <unfinished ...>
[pid 25589] 10:12:38.751838 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.751864 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25590] 10:12:38.751896 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.751910 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25585] 10:12:38.751968 <... mmap resumed> ) = 0x7f4b636c0000
[pid 25590] 10:12:38.752145 open("/var/spool/exim/db/retry.lockfile", O_RDWR <unfinished ...>
[pid 25589] 10:12:38.752184 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.752212 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.752247 <... open resumed> ) = 11
[pid 25589] 10:12:38.752260 <... mmap resumed> ) = 0x7fd7578de000
[pid 25585] 10:12:38.752289 <... open resumed> ) = 10
[pid 25590] 10:12:38.752312 alarm(60 <unfinished ...>
[pid 25589] 10:12:38.752336 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.752372 fcntl(10, F_GETFD <unfinished ...>
[pid 25590] 10:12:38.752402 <... alarm resumed> ) = 0
[pid 25589] 10:12:38.752415 <... mmap resumed> ) = 0x7fd754614000
[pid 25585] 10:12:38.752432 <... fcntl resumed> ) = 0
[pid 25590] 10:12:38.752453 fcntl(11, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0} <unfinished ...>
[pid 25589] 10:12:38.752480 mprotect(0x7fd75462b000, 2097152, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.752514 fcntl(10, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25590] 10:12:38.752542 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.752556 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.752573 <... fcntl resumed> ) = 0
[pid 25590] 10:12:38.752597 alarm(0 <unfinished ...>
[pid 25589] 10:12:38.752620 mmap(0x7fd75482b000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000 <unfinished ...>
[pid 25585] 10:12:38.752650 fstat(10,  <unfinished ...>
[pid 25590] 10:12:38.752677 <... alarm resumed> ) = 60
[pid 25589] 10:12:38.752690 <... mmap resumed> ) = 0x7fd75482b000
[pid 25585] 10:12:38.752864 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25590] 10:12:38.752969 stat("/var/spool/exim/db/retry",  <unfinished ...>
[pid 25589] 10:12:38.753003 close(6 <unfinished ...>
[pid 25585] 10:12:38.753027 pread(10,  <unfinished ...>
[pid 25590] 10:12:38.753055 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25589] 10:12:38.753082 <... close resumed> ) = 0
[pid 25585] 10:12:38.753194 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25590] 10:12:38.753296 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.753338 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.753369 pread(10,  <unfinished ...>
[pid 25590] 10:12:38.753402 <... open resumed> ) = 13
[pid 25589] 10:12:38.753429 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.753447 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25590] 10:12:38.753516 fcntl(13, F_GETFD <unfinished ...>
[pid 25589] 10:12:38.753558 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.753610 close(10 <unfinished ...>
[pid 25590] 10:12:38.753658 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.753688 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.753710 <... close resumed> ) = 0
[pid 25590] 10:12:38.753827 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.753857 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.753897 munmap(0x7f4b636c0000, 200704 <unfinished ...>
[pid 25590] 10:12:38.753948 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.753962 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.754006 <... munmap resumed> ) = 0
[pid 25590] 10:12:38.754047 read(13,  <unfinished ...>
[pid 25589] 10:12:38.754077 open("/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.754112 close(9 <unfinished ...>
[pid 25590] 10:12:38.754143 <... read resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25589] 10:12:38.754164 <... open resumed> ) = 6
[pid 25585] 10:12:38.754186 <... close resumed> ) = 0
[pid 25590] 10:12:38.754228 close(13 <unfinished ...>
[pid 25589] 10:12:38.754255 read(6,  <unfinished ...>
[pid 25585] 10:12:38.754279 open("/etc/localdomains", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.754313 <... close resumed> ) = 0
[pid 25589] 10:12:38.754326 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.754360 <... open resumed> ) = 9
[pid 25590] 10:12:38.754386 open("DB_CONFIG", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.754414 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.754438 fstat(9,  <unfinished ...>
[pid 25590] 10:12:38.754465 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.754480 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25585] 10:12:38.754518 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.754559 stat("/var/tmp",  <unfinished ...>
[pid 25589] 10:12:38.754589 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.754620 fstat(9,  <unfinished ...>
[pid 25590] 10:12:38.754648 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25589] 10:12:38.754678 <... mmap resumed> ) = 0x7fd7543d0000
[pid 25585] 10:12:38.754957 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.755022 open("/var/spool/exim/db/retry", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.755056 mprotect(0x7fd754411000, 2097152, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.755084 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25590] 10:12:38.755126 <... open resumed> ) = 13
[pid 25589] 10:12:38.755140 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.755157 <... mmap resumed> ) = 0x7f4b63707000
[pid 25590] 10:12:38.755178 fcntl(13, F_GETFD <unfinished ...>
[pid 25589] 10:12:38.755200 mmap(0x7fd754611000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000 <unfinished ...>
[pid 25585] 10:12:38.755229 lseek(9, 0, SEEK_SET <unfinished ...>
[pid 25590] 10:12:38.755258 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.755275 <... mmap resumed> ) = 0x7fd754611000
[pid 25585] 10:12:38.755302 <... lseek resumed> ) = 0
[pid 25590] 10:12:38.755326 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.755349 close(6 <unfinished ...>
[pid 25585] 10:12:38.755373 read(9,  <unfinished ...>
[pid 25590] 10:12:38.755405 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.755418 <... close resumed> ) = 0
[pid 25585] 10:12:38.755444 <... read resumed> "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25590] 10:12:38.755502 fstat(13,  <unfinished ...>
[pid 25589] 10:12:38.755530 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.755562 stat("/jail_owner",  <unfinished ...>
[pid 25590] 10:12:38.755593 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25589] 10:12:38.755620 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.755673 <... stat resumed> 0x7ffc4d81ee90) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:38.755711 pread(13,  <unfinished ...>
[pid 25589] 10:12:38.755738 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.755851 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25590] 10:12:38.755894 <... pread resumed> "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25589] 10:12:38.755915 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.755957 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25590] 10:12:38.756006 pread(13,  <unfinished ...>
[pid 25589] 10:12:38.756031 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.756085 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck",  <unfinished ...>
[pid 25590] 10:12:38.756122 <... pread resumed> "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25589] 10:12:38.756148 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.756183 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:38.756216 close(13 <unfinished ...>
[pid 25589] 10:12:38.756241 open("/lib64/libkrb5.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.756275 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman",  <unfinished ...>
[pid 25590] 10:12:38.756307 <... close resumed> ) = 0
[pid 25589] 10:12:38.756321 <... open resumed> ) = 6
[pid 25585] 10:12:38.756365 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25590] 10:12:38.756409 close(11 <unfinished ...>
[pid 25589] 10:12:38.756437 read(6,  <unfinished ...>
[pid 25585] 10:12:38.756465 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck",  <unfinished ...>
[pid 25590] 10:12:38.756503 <... close resumed> ) = 0
[pid 25589] 10:12:38.756516 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.756568 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:38.756598 socket(PF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 25589] 10:12:38.756628 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.756651 stat("/etc/demouids",  <unfinished ...>
[pid 25590] 10:12:38.756683 <... socket resumed> ) = 11
[pid 25589] 10:12:38.756696 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25585] 10:12:38.756736 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.756919 setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4 <unfinished ...>
[pid 25589] 10:12:38.756951 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.756979 open("/etc/demouids", O_RDONLY <unfinished ...>
[pid 25590] 10:12:38.757035 <... setsockopt resumed> ) = 0
[pid 25589] 10:12:38.757052 <... mmap resumed> ) = 0x7fd7578dd000
[pid 25585] 10:12:38.757087 <... open resumed> ) = 10
[pid 25590] 10:12:38.757111 alarm(300 <unfinished ...>
[pid 25589] 10:12:38.757135 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.757165 fstat(10,  <unfinished ...>
[pid 25590] 10:12:38.757193 <... alarm resumed> ) = 0
[pid 25589] 10:12:38.757209 <... mmap resumed> ) = 0x7fd7540e9000
[pid 25585] 10:12:38.757233 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.757270 connect(11, {sa_family=AF_INET, sin_port=htons(25), sin_addr=inet_addr("64.235.154.105")}, 16 <unfinished ...>
[pid 25589] 10:12:38.757348 mprotect(0x7fd7541c4000, 2097152, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.757390 fstat(10,  <unfinished ...>
[pid 25589] 10:12:38.757418 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.757434 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.757473 mmap(0x7fd7543c4000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000 <unfinished ...>
[pid 25585] 10:12:38.757584 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.757618 <... mmap resumed> ) = 0x7fd7543c4000
[pid 25585] 10:12:38.757650 <... mmap resumed> ) = 0x7f4b63706000
[pid 25579] 10:12:38.757671 <... read resumed> "\26\3\1\0005\2\0", 7) = 7
[pid 25589] 10:12:38.757812 close(6 <unfinished ...>
[pid 25585] 10:12:38.757843 lseek(10, 0, SEEK_SET <unfinished ...>
[pid 25579] 10:12:38.757867 read(11,  <unfinished ...>
[pid 25589] 10:12:38.757898 <... close resumed> ) = 0
[pid 25585] 10:12:38.757924 <... lseek resumed> ) = 0
[pid 25579] 10:12:38.757963 <... read resumed> "\0001\3\1V\204\2w!EU\22'\230\215\224\25\306\276[_\3\223A\370\311\323K\333\331\30\264E\251\\R\0\0009\0\0\t\377\1\0\1\0\0#\0\0", 51) = 51
[pid 25589] 10:12:38.758031 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.758067 read(10,  <unfinished ...>
[pid 25579] 10:12:38.758090 read(11,  <unfinished ...>
[pid 25589] 10:12:38.758118 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.758136 <... read resumed> "", 4096) = 0
[pid 25579] 10:12:38.758162 <... read resumed> "\26\3\1\n\27", 5) = 5
[pid 25589] 10:12:38.758188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.758221 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25579] 10:12:38.758253 read(11,  <unfinished ...>
[pid 25589] 10:12:38.758283 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.758301 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25579] 10:12:38.758376 <... read resumed> "\v\0\n\23\0\n\20\0\00560\202\00520\202\4\32\240\3\2\1\2\2\t\0\210\340\207\345T\361\313\3270\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2641\v0\t\6\3U\4\6\23\2US1\0200\16\6\3U\4\10\23\7Arizona1\0230\21\6\3U\4\7\23\nScottsdale1\0320\30\6\3U\4\n\23\21GoDaddy.com, Inc.1-0+\6\3U\4\v\23$http://certs.godaddy.com/repository/1301\6\3U\4\3\23*Go Daddy Secure Certificate Authority - G20\36\27\r151125010838Z\27\r18112"..., 2583) = 2583
[pid 25589] 10:12:38.759176 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.759224 stat("/etc/userdomains",  <unfinished ...>
[pid 25579] 10:12:38.759253 read(11,  <unfinished ...>
[pid 25589] 10:12:38.759282 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.759303 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.759344 <... read resumed> "\26\3\1\2\r", 5) = 5
[pid 25589] 10:12:38.759370 open("/lib64/libcom_err.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.759405 open("/etc/userdomains", O_RDONLY <unfinished ...>
[pid 25579] 10:12:38.759434 read(11,  <unfinished ...>
[pid 25589] 10:12:38.759467 <... open resumed> ) = 6
[pid 25585] 10:12:38.759483 <... open resumed> ) = 11
[pid 25579] 10:12:38.759503 <... read resumed> "\f\0\2\t\0\200\370\325\314\350z9a\265\365\313\3104@\305\30V\340\346\372mZ\262\203\20x\310gb\34\244l\250}\177\243\261\257u\2704<i\223t\323i \362\343\232e=\350\360rZ\246\342\322\227u7U\214\342~xOKT\233\357\265X\222{\243\f\213\330\35\254\334\256\223\2{]\316\33\301vp\257}\354\350\21I\253\327\3262\331\270\nc\227\316\274\307\251a\234\3178(\216\243\325#(wC\260No\263\0\1\2\0\200\361\340\232\215e\361\357\364\227\346\323\37>\347hQ\201:\326\357?<\256\365Q\357\203#\22B\342\31\246B\241\326UA\234\25270\314_c\347\277g\207>\370\344y\366\\\257\343Ws\250}\0174\305M\372\233h#}\207#\327;\264\264$\316:\326\204\270.\302Q;\330B\363q\33Ep\215rp\3W)k@\270\272{\330n\347`\265k\346Ka[\306\322H"..., 525) = 525
[pid 25589] 10:12:38.759640 read(6,  <unfinished ...>
[pid 25585] 10:12:38.759669 fstat(11,  <unfinished ...>
[pid 25579] 10:12:38.759692 read(11,  <unfinished ...>
[pid 25589] 10:12:38.759720 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.759812 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.759855 <... read resumed> "\26\3\1\0\4", 5) = 5
[pid 25589] 10:12:38.759881 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.759904 fstat(11,  <unfinished ...>
[pid 25579] 10:12:38.759927 read(11,  <unfinished ...>
[pid 25589] 10:12:38.759956 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25585] 10:12:38.759986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25579] 10:12:38.760013 <... read resumed> "\16\0\0\0", 4) = 4
[pid 25589] 10:12:38.761926 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.761974 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25579] 10:12:38.762002 write(11, "\26\3\1\0\206\20\0\0\202\0\200\33\265\1\243-@\310\374\274\307o\16\26\217\326qJK\342\346R\335\254\207\376d\324\370\227\250C\2\26\330\344\ny@\247\231\365\231\211\241\254\375\326\247\325P\303\277t>\2542\232-#J}\360\tW\266\374\20\32\37\264\315\2255\206-\23\5\267\212\25g\310|\267\23\316\35\23\231o\234\26\234\"\257\211\336\7\" r\202M5\372{\316\\}\26\340z\37<OF\260[\230C\221\376\327%\5\314^\320\24\3\1\0\1\1\26\3\1\0000\327\23p\2119\35&Z\t]\223\307\352\212%\206W\335q\16\237\300k\372\177\242\177\2556\331\355\303\310Q[\5\207|\353g\376\241\261mlO\247\253", 198 <unfinished ...>
[pid 25589] 10:12:38.762064 <... mmap resumed> ) = 0x7fd753ee5000
[pid 25585] 10:12:38.762083 <... mmap resumed> ) = 0x7f4b63705000
[pid 25579] 10:12:38.762130 <... write resumed> ) = 198
[pid 25589] 10:12:38.762173 mprotect(0x7fd753ee8000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.762208 lseek(11, 0, SEEK_SET <unfinished ...>
[pid 25579] 10:12:38.762231 read(11,  <unfinished ...>
[pid 25589] 10:12:38.762258 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.762275 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.762296 mmap(0x7fd7540e7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000 <unfinished ...>
[pid 25585] 10:12:38.762326 read(11,  <unfinished ...>
[pid 25589] 10:12:38.762364 <... mmap resumed> ) = 0x7fd7540e7000
[pid 25585] 10:12:38.762396 <... read resumed> "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25589] 10:12:38.762477 close(6 <unfinished ...>
[pid 25585] 10:12:38.762520 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.762559 <... close resumed> ) = 0
[pid 25585] 10:12:38.762585 <... open resumed> ) = 12
[pid 25589] 10:12:38.762612 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.762650 fstat(12,  <unfinished ...>
[pid 25589] 10:12:38.762677 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.762695 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.762728 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.762854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.762887 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.762907 <... mmap resumed> ) = 0x7f4b63704000
[pid 25589] 10:12:38.762928 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.762958 read(12,  <unfinished ...>
[pid 25589] 10:12:38.762989 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.763008 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.763041 open("/lib64/libk5crypto.so.3", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.763074 close(12 <unfinished ...>
[pid 25589] 10:12:38.763143 <... open resumed> ) = 6
[pid 25585] 10:12:38.763161 <... close resumed> ) = 0
[pid 25589] 10:12:38.763180 read(6,  <unfinished ...>
[pid 25585] 10:12:38.763204 munmap(0x7f4b63704000, 4096 <unfinished ...>
[pid 25589] 10:12:38.763235 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.763259 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.763303 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.763330 stat("//etc/fin.finestweddingsites.com",  <unfinished ...>
[pid 25589] 10:12:38.763362 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25585] 10:12:38.763394 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.763423 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.763455 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.763484 <... mmap resumed> ) = 0x7fd753cb9000
[pid 25585] 10:12:38.763504 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.763559 mprotect(0x7fd753ce2000, 2097152, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.763591 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25589] 10:12:38.763628 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.763644 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.763709 mmap(0x7fd753ee2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25585] 10:12:38.763825 stat("/etc/vfilters/fin.finestweddingsites.com",  <unfinished ...>
[pid 25589] 10:12:38.763866 <... mmap resumed> ) = 0x7fd753ee2000
[pid 25585] 10:12:38.763888 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.763941 mmap(0x7fd753ee4000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.763974 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.764004 <... mmap resumed> ) = 0x7fd753ee4000
[pid 25585] 10:12:38.764026 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.764093 close(6 <unfinished ...>
[pid 25585] 10:12:38.764120 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.764149 <... close resumed> ) = 0
[pid 25585] 10:12:38.764175 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.764219 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.764257 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.764286 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.764303 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.764355 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.764393 stat("//etc/fin.finestweddingsites.com/finest09/filter",  <unfinished ...>
[pid 25589] 10:12:38.764434 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.764452 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.764477 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.764511 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25589] 10:12:38.764542 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.764561 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.764601 open("/lib64/libz.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.764636 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.764668 <... open resumed> ) = 6
[pid 25585] 10:12:38.764690 <... open resumed> ) = 12
[pid 25589] 10:12:38.764710 read(6,  <unfinished ...>
[pid 25585] 10:12:38.764738 fstat(12,  <unfinished ...>
[pid 25589] 10:12:38.764874 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.764901 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.764936 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.764960 fstat(12,  <unfinished ...>
[pid 25589] 10:12:38.764986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25585] 10:12:38.765038 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.765071 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.765098 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.765126 <... mmap resumed> ) = 0x7fd7578dc000
[pid 25585] 10:12:38.765146 <... mmap resumed> ) = 0x7f4b63704000
[pid 25589] 10:12:38.765167 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.765197 lseek(12, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.765223 <... mmap resumed> ) = 0x7fd753aa3000
[pid 25585] 10:12:38.765239 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.765259 mprotect(0x7fd753ab8000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.765286 read(12,  <unfinished ...>
[pid 25589] 10:12:38.765313 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.765329 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.765367 mmap(0x7fd753cb7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000 <unfinished ...>
[pid 25585] 10:12:38.765402 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.765439 <... mmap resumed> ) = 0x7fd753cb7000
[pid 25585] 10:12:38.765467 <... open resumed> ) = 13
[pid 25589] 10:12:38.765497 close(6 <unfinished ...>
[pid 25585] 10:12:38.765537 fstat(13,  <unfinished ...>
[pid 25589] 10:12:38.765572 <... close resumed> ) = 0
[pid 25585] 10:12:38.765616 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25589] 10:12:38.765652 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.765682 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25589] 10:12:38.765712 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.765729 <... mmap resumed> ) = 0x7f4b63703000
[pid 25589] 10:12:38.765833 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.765873 read(13,  <unfinished ...>
[pid 25589] 10:12:38.765907 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.765931 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25589] 10:12:38.765963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.765999 close(13 <unfinished ...>
[pid 25589] 10:12:38.766030 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.766049 <... close resumed> ) = 0
[pid 25589] 10:12:38.766089 open("/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.766126 munmap(0x7f4b63703000, 4096 <unfinished ...>
[pid 25589] 10:12:38.766159 <... open resumed> ) = 6
[pid 25585] 10:12:38.766175 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.766212 read(6,  <unfinished ...>
[pid 25585] 10:12:38.766240 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.766324 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.766367 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.766430 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.766457 stat("//.spamassassinboxenable",  <unfinished ...>
[pid 25589] 10:12:38.766487 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25585] 10:12:38.766522 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.766549 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.766584 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.766618 <... mmap resumed> ) = 0x7fd753898000
[pid 25585] 10:12:38.766635 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.766684 mprotect(0x7fd7538a2000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.766719 stat("/usr/local/cpanel/bin/boxtrapper",  <unfinished ...>
[pid 25589] 10:12:38.766855 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.766874 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25589] 10:12:38.766920 mmap(0x7fd753aa1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000 <unfinished ...>
[pid 25585] 10:12:38.766953 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25589] 10:12:38.766983 <... mmap resumed> ) = 0x7fd753aa1000
[pid 25585] 10:12:38.767008 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.767037 close(6 <unfinished ...>
[pid 25585] 10:12:38.767061 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.767097 <... close resumed> ) = 0
[pid 25585] 10:12:38.767122 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.767169 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.767214 stat("//etc/fin.finestweddingsites.com/passwd",  <unfinished ...>
[pid 25589] 10:12:38.767245 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.767262 <... stat resumed> 0x7ffc4d821c80) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.767287 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.767321 stat("/etc/userdomains",  <unfinished ...>
[pid 25589] 10:12:38.767350 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.767366 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.767407 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.767444 stat("/etc/valiases/fin.finestweddingsites.com",  <unfinished ...>
[pid 25589] 10:12:38.767474 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.767495 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.767623 open("/lib64/libkeyutils.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.767674 getuid( <unfinished ...>
[pid 25589] 10:12:38.767705 <... open resumed> ) = 6
[pid 25585] 10:12:38.767726 <... getuid resumed> ) = 0
[pid 25589] 10:12:38.767829 read(6,  <unfinished ...>
[pid 25585] 10:12:38.767861 geteuid( <unfinished ...>
[pid 25589] 10:12:38.767886 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.767911 <... geteuid resumed> ) = 0
[pid 25589] 10:12:38.767933 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.767958 getgid( <unfinished ...>
[pid 25589] 10:12:38.767986 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25585] 10:12:38.768017 <... getgid resumed> ) = 12
[pid 25589] 10:12:38.768054 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.768105 getegid( <unfinished ...>
[pid 25589] 10:12:38.768149 <... mmap resumed> ) = 0x7fd753695000
[pid 25585] 10:12:38.768176 <... getegid resumed> ) = 12
[pid 25589] 10:12:38.768289 mprotect(0x7fd753697000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.768325 open("/dev/urandom", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.768365 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.768385 <... open resumed> ) = 13
[pid 25589] 10:12:38.768411 mmap(0x7fd753896000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000 <unfinished ...>
[pid 25585] 10:12:38.768450 read(13,  <unfinished ...>
[pid 25589] 10:12:38.768483 <... mmap resumed> ) = 0x7fd753896000
[pid 25585] 10:12:38.768512 <... read resumed> "\360\353\214(", 4) = 4
[pid 25589] 10:12:38.768538 close(6 <unfinished ...>
[pid 25585] 10:12:38.768562 close(13 <unfinished ...>
[pid 25589] 10:12:38.768589 <... close resumed> ) = 0
[pid 25585] 10:12:38.768612 <... close resumed> ) = 0
[pid 25589] 10:12:38.768835 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.768875 readlink("/proc/self/exe",  <unfinished ...>
[pid 25589] 10:12:38.768951 <... mmap resumed> ) = 0x7fd7578db000
[pid 25585] 10:12:38.768996 <... readlink resumed> "/usr/sbin/exim", 4095) = 14
[pid 25589] 10:12:38.769076 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.769112 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.769145 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.769163 <... ioctl resumed> , 0x7ffc4d81eae0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.769188 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.769222 lseek(0, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.769249 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.769265 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.769289 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.769321 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.769348 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.769367 <... ioctl resumed> , 0x7ffc4d81eae0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.769388 open("/lib64/libselinux.so.1", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.769419 lseek(1, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.769446 <... open resumed> ) = 6
[pid 25585] 10:12:38.769461 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.769483 read(6,  <unfinished ...>
[pid 25585] 10:12:38.769510 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.769542 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25585] 10:12:38.769569 <... ioctl resumed> , 0x7ffc4d81eaf0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.769592 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.769616 lseek(2, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.769642 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25585] 10:12:38.769683 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.769708 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25585] 10:12:38.769825 open("/dev/null", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.769873 <... mmap resumed> ) = 0x7fd753476000
[pid 25585] 10:12:38.769891 <... open resumed> ) = 13
[pid 25589] 10:12:38.769914 mprotect(0x7fd753493000, 2093056, PROT_NONE <unfinished ...>
[pid 25585] 10:12:38.769943 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.769986 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.770004 <... ioctl resumed> , 0x7ffc4d81ebc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.770026 mmap(0x7fd753692000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000 <unfinished ...>
[pid 25585] 10:12:38.770081 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.770109 <... mmap resumed> ) = 0x7fd753692000
[pid 25585] 10:12:38.770130 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.770154 mmap(0x7fd753694000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.770184 fcntl(13, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 25589] 10:12:38.770211 <... mmap resumed> ) = 0x7fd753694000
[pid 25585] 10:12:38.770236 <... fcntl resumed> ) = 0
[pid 25589] 10:12:38.770261 close(6 <unfinished ...>
[pid 25585] 10:12:38.770285 rt_sigaction(SIGCHLD, NULL,  <unfinished ...>
[pid 25589] 10:12:38.770312 <... close resumed> ) = 0
[pid 25585] 10:12:38.770364 <... rt_sigaction resumed> {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f4b613076a0}, 8) = 0
[pid 25589] 10:12:38.770635 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.770682 brk(0x15ef000 <unfinished ...>
[pid 25589] 10:12:38.770712 <... mmap resumed> ) = 0x7fd7578da000
[pid 25585] 10:12:38.770849 <... brk resumed> ) = 0x15ef000
[pid 25589] 10:12:38.770891 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.770920 read(13,  <unfinished ...>
[pid 25589] 10:12:38.770947 <... mmap resumed> ) = 0x7fd7578d9000
[pid 25585] 10:12:38.770973 <... read resumed> "", 8192) = 0
[pid 25589] 10:12:38.771001 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.771052 close(13 <unfinished ...>
[pid 25589] 10:12:38.771081 <... mmap resumed> ) = 0x7fd7578d7000
[pid 25585] 10:12:38.771102 <... close resumed> ) = 0
[pid 25589] 10:12:38.771412 arch_prctl(ARCH_SET_FS, 0x7fd7578d77c0 <unfinished ...>
[pid 25585] 10:12:38.771450 stat("/etc/exim.pl",  <unfinished ...>
[pid 25589] 10:12:38.771483 <... arch_prctl resumed> ) = 0
[pid 25585] 10:12:38.771541 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.771580 mprotect(0x7fd753692000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.771609 open("/etc/exim.pl", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.771642 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.771666 <... open resumed> ) = 13
[pid 25589] 10:12:38.771696 mprotect(0x7fd753896000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.771726 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.771833 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.771870 <... ioctl resumed> , 0x7ffc4d81e9f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.771895 mprotect(0x7fd753aa1000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.771922 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.771949 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.771980 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.772025 mprotect(0x7fd753cb7000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.772080 read(13,  <unfinished ...>
[pid 25589] 10:12:38.772110 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.772140 <... read resumed> "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25589] 10:12:38.773167 mprotect(0x7fd753ee2000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.773225 brk(0x1610000 <unfinished ...>
[pid 25589] 10:12:38.773258 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.773287 <... brk resumed> ) = 0x1610000
[pid 25589] 10:12:38.773678 mprotect(0x7fd7540e7000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.773721 read(13,  <unfinished ...>
[pid 25589] 10:12:38.773811 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.773941 <... read resumed> "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25589] 10:12:38.774795 mprotect(0x7fd7543c4000, 40960, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.774841 brk(0x1631000 <unfinished ...>
[pid 25589] 10:12:38.774872 <... mprotect resumed> ) = 0
[pid 25585] 10:12:38.774998 <... brk resumed> ) = 0x1631000
[pid 25589] 10:12:38.775437 mprotect(0x7fd754611000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.775481 read(13,  <unfinished ...>
[pid 25589] 10:12:38.775514 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.775550 mprotect(0x7fd75482b000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.775582 <... read resumed> "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25589] 10:12:38.775605 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.776393 mprotect(0x7fd754a38000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.776441 brk(0x1652000 <unfinished ...>
[pid 25589] 10:12:38.776473 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.776700 mprotect(0x7fd755224000, 110592, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.776733 <... brk resumed> ) = 0x1652000
[pid 25589] 10:12:38.776775 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.777312 mprotect(0x7fd7554b0000, 16384, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.777358 read(13,  <unfinished ...>
[pid 25589] 10:12:38.777387 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.777494 mprotect(0x7fd755845000, 16384, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.777529 <... read resumed> "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25589] 10:12:38.777552 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.777934 mprotect(0x7fd755a50000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.778001 read(13,  <unfinished ...>
[pid 25589] 10:12:38.778029 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.778060 mprotect(0x7fd755c54000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.778088 <... read resumed> "", 8192) = 0
[pid 25589] 10:12:38.778105 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.778817 mprotect(0x7fd7569ac000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.778857 close(13 <unfinished ...>
[pid 25589] 10:12:38.778885 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.778930 mprotect(0x7fd756de1000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.778959 <... close resumed> ) = 0
[pid 25589] 10:12:38.778975 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779021 mprotect(0x7fd757065000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.779050 stat("/usr/share/amavis/amavis-filter",  <unfinished ...>
[pid 25589] 10:12:38.779083 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779107 mprotect(0x7fd75726e000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.779135 <... stat resumed> 0x7f4b61da5880) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.779162 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779204 mprotect(0x7fd7574b3000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.779239 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25589] 10:12:38.779269 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779297 mprotect(0x7fd7576cd000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.779324 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.779356 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779408 mprotect(0x7fd7578f0000, 4096, PROT_READ <unfinished ...>
[pid 25585] 10:12:38.779438 stat("/etc/exim.pl.local",  <unfinished ...>
[pid 25589] 10:12:38.779466 <... mprotect resumed> ) = 0
[pid 25589] 10:12:38.779485 munmap(0x7fd7578e5000, 39387 <unfinished ...>
[pid 25585] 10:12:38.779517 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.779546 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.779570 set_tid_address(0x7fd7578d7a90 <unfinished ...>
[pid 25585] 10:12:38.779594 open("/etc/exim.pl.local", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.779626 <... set_tid_address resumed> ) = 25589
[pid 25589] 10:12:38.779646 set_robust_list(0x7fd7578d7aa0, 24 <unfinished ...>
[pid 25585] 10:12:38.779681 <... open resumed> ) = 13
[pid 25589] 10:12:38.779698 <... set_robust_list resumed> ) = 0
[pid 25589] 10:12:38.779726 futex(0x7fff445ea39c, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 25585] 10:12:38.779836 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.779866 <... futex resumed> ) = 0
[pid 25589] 10:12:38.779886 futex(0x7fff445ea39c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fd7578d77c0 <unfinished ...>
[pid 25585] 10:12:38.779911 <... ioctl resumed> , 0x7ffc4d81e9f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.779929 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25589] 10:12:38.779957 rt_sigaction(SIGRTMIN, {0x7fd75679ac60, [], SA_RESTORER|SA_SIGINFO, 0x7fd7567a4790},  <unfinished ...>
[pid 25585] 10:12:38.779989 lseek(13, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.780038 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25589] 10:12:38.780059 rt_sigaction(SIGRT_1, {0x7fd75679acf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fd7567a4790},  <unfinished ...>
[pid 25585] 10:12:38.780087 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.780103 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25589] 10:12:38.780146 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid 25585] 10:12:38.780177 read(13,  <unfinished ...>
[pid 25589] 10:12:38.780203 <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 25589] 10:12:38.780233 getrlimit(RLIMIT_STACK,  <unfinished ...>
[pid 25585] 10:12:38.780257 <... read resumed> "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25589] 10:12:38.780277 <... getrlimit resumed> {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25589] 10:12:38.780631 statfs("/selinux",  <unfinished ...>
[pid 25585] 10:12:38.780690 brk(0x1673000 <unfinished ...>
[pid 25589] 10:12:38.780719 <... statfs resumed> {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350309, f_bavail=6350309, f_files=1000000, f_ffree=691064, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25589] 10:12:38.780863 brk(0 <unfinished ...>
[pid 25585] 10:12:38.780895 <... brk resumed> ) = 0x1673000
[pid 25589] 10:12:38.780912 <... brk resumed> ) = 0x1ac5000
[pid 25589] 10:12:38.781105 brk(0x1ae6000 <unfinished ...>
[pid 25585] 10:12:38.781139 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.781177 <... brk resumed> ) = 0x1ae6000
[pid 25589] 10:12:38.781208 open("/proc/filesystems", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.781248 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.781267 <... open resumed> ) = 6
[pid 25589] 10:12:38.781301 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.781326 stat("/etc/exim/perl/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.781353 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.781388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.781417 <... stat resumed> 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.781434 <... mmap resumed> ) = 0x7fd7578ee000
[pid 25589] 10:12:38.781459 read(6,  <unfinished ...>
[pid 25585] 10:12:38.781558 stat("/usr/local/cpanel/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.781591 <... read resumed> "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25589] 10:12:38.781623 read(6,  <unfinished ...>
[pid 25585] 10:12:38.781647 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.781664 <... read resumed> "", 1024) = 0
[pid 25589] 10:12:38.781692 close(6 <unfinished ...>
[pid 25585] 10:12:38.781720 stat("/usr/local/cpanel/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.781837 <... close resumed> ) = 0
[pid 25589] 10:12:38.781862 munmap(0x7fd7578ee000, 4096 <unfinished ...>
[pid 25585] 10:12:38.781892 <... stat resumed> 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.781931 <... munmap resumed> ) = 0
[pid 25589] 10:12:38.782018 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25585] 10:12:38.782057 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.782094 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.782187 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fd7567a4790},  <unfinished ...>
[pid 25585] 10:12:38.782219 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.782236 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25589] 10:12:38.782267 fstat(2,  <unfinished ...>
[pid 25585] 10:12:38.782292 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.782325 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25589] 10:12:38.782392 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fd7567a4790},  <unfinished ...>
[pid 25585] 10:12:38.782422 <... stat resumed> 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.782439 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25589] 10:12:38.782468 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0},  <unfinished ...>
[pid 25585] 10:12:38.782496 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.782527 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25589] 10:12:38.782549 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0},  <unfinished ...>
[pid 25585] 10:12:38.782575 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.782591 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25589] 10:12:38.782622 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fd7567a4790},  <unfinished ...>
[pid 25585] 10:12:38.782648 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.782679 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25589] 10:12:38.782708 umask(0 <unfinished ...>
[pid 25585] 10:12:38.782732 <... stat resumed> 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.782825 <... umask resumed> ) = 0
[pid 25589] 10:12:38.782898 geteuid( <unfinished ...>
[pid 25585] 10:12:38.782927 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.782962 <... geteuid resumed> ) = 0
[pid 25589] 10:12:38.782984 getuid( <unfinished ...>
[pid 25585] 10:12:38.783007 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.783024 <... getuid resumed> ) = 47
[pid 25589] 10:12:38.783049 getgid( <unfinished ...>
[pid 25585] 10:12:38.783072 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.783102 <... getgid resumed> ) = 12
[pid 25589] 10:12:38.783149 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25585] 10:12:38.783174 <... stat resumed> 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.783191 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25589] 10:12:38.783218 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25585] 10:12:38.783242 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc",  <unfinished ...>
[pid 25589] 10:12:38.783272 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25589] 10:12:38.783296 getgroups(65536,  <unfinished ...>
[pid 25585] 10:12:38.783332 <... stat resumed> 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.783353 <... getgroups resumed> [12]) = 1
[pid 25589] 10:12:38.783382 setgroups(0, [] <unfinished ...>
[pid 25585] 10:12:38.783407 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm",  <unfinished ...>
[pid 25589] 10:12:38.783438 <... setgroups resumed> ) = 0
[pid 25589] 10:12:38.783459 getegid( <unfinished ...>
[pid 25585] 10:12:38.783481 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.783514 <... getegid resumed> ) = 12
[pid 25589] 10:12:38.783537 geteuid( <unfinished ...>
[pid 25585] 10:12:38.783560 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY <unfinished ...>
[pid 25589] 10:12:38.783592 <... geteuid resumed> ) = 0
[pid 25589] 10:12:38.783617 geteuid( <unfinished ...>
[pid 25585] 10:12:38.783641 <... open resumed> ) = 14
[pid 25589] 10:12:38.783656 <... geteuid resumed> ) = 0
[pid 25589] 10:12:38.783679 getegid( <unfinished ...>
[pid 25585] 10:12:38.783702 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS <unfinished ...>
[pid 25589] 10:12:38.783728 <... getegid resumed> ) = 12
[pid 25589] 10:12:38.783818 setgid(12 <unfinished ...>
[pid 25585] 10:12:38.783851 <... ioctl resumed> , 0x7ffc4d81e400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.783870 <... setgid resumed> ) = 0
[pid 25589] 10:12:38.783894 setuid(0 <unfinished ...>
[pid 25585] 10:12:38.783919 lseek(14, 0, SEEK_CUR <unfinished ...>
[pid 25589] 10:12:38.783950 <... setuid resumed> ) = 0
[pid 25589] 10:12:38.783999 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.784034 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.784092 <... open resumed> ) = 6
[pid 25589] 10:12:38.784161 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.784196 read(14,  <unfinished ...>
[pid 25589] 10:12:38.784224 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.784274 fstat(6,  <unfinished ...>
[pid 25585] 10:12:38.784300 <... read resumed> "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25589] 10:12:38.784320 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.784667 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.784715 read(14,  <unfinished ...>
[pid 25589] 10:12:38.784812 <... mmap resumed> ) = 0x7fd7578ee000
[pid 25589] 10:12:38.784841 read(6,  <unfinished ...>
[pid 25585] 10:12:38.784870 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25589] 10:12:38.784893 <... read resumed> "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25589] 10:12:38.785606 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25585] 10:12:38.785666 brk(0x1694000 <unfinished ...>
[pid 25589] 10:12:38.785697 <... socket resumed> ) = 7
[pid 25589] 10:12:38.785730 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25585] 10:12:38.785855 <... brk resumed> ) = 0x1694000
[pid 25589] 10:12:38.785874 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.786099 close(7 <unfinished ...>
[pid 25585] 10:12:38.786136 read(14,  <unfinished ...>
[pid 25589] 10:12:38.786164 <... close resumed> ) = 0
[pid 25589] 10:12:38.786184 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25585] 10:12:38.786212 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25589] 10:12:38.786234 <... socket resumed> ) = 7
[pid 25589] 10:12:38.786630 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25585] 10:12:38.786686 read(14,  <unfinished ...>
[pid 25589] 10:12:38.786714 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.786736 close(7 <unfinished ...>
[pid 25585] 10:12:38.786826 <... read resumed> "", 8192) = 0
[pid 25589] 10:12:38.786845 <... close resumed> ) = 0
[pid 25589] 10:12:38.786878 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.786920 close(14 <unfinished ...>
[pid 25589] 10:12:38.786947 <... open resumed> ) = 7
[pid 25589] 10:12:38.786971 fstat(7,  <unfinished ...>
[pid 25585] 10:12:38.786994 <... close resumed> ) = 0
[pid 25589] 10:12:38.787010 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25589] 10:12:38.787926 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25585] 10:12:38.787991 read(13,  <unfinished ...>
[pid 25589] 10:12:38.788023 <... mmap resumed> ) = 0x7fd7578ed000
[pid 25589] 10:12:38.788067 read(7,  <unfinished ...>
[pid 25585] 10:12:38.788114 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25589] 10:12:38.788149 <... read resumed> "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25589] 10:12:38.789026 read(7,  <unfinished ...>
[pid 25585] 10:12:38.789065 read(13,  <unfinished ...>
[pid 25589] 10:12:38.789095 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.789117 close(7 <unfinished ...>
[pid 25585] 10:12:38.789142 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25589] 10:12:38.789164 <... close resumed> ) = 0
[pid 25589] 10:12:38.789812 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.789886 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.790195 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.790246 read(13,  <unfinished ...>
[pid 25589] 10:12:38.790271 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.790292 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.790355 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25589] 10:12:38.790402 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25589] 10:12:38.790452 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fd7578cd000
[pid 25589] 10:12:38.790491 close(7)    = 0
[pid 25589] 10:12:38.790544 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25589] 10:12:38.790589 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25589] 10:12:38.790630 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25589] 10:12:38.790683 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fd753268000
[pid 25589] 10:12:38.790727 mprotect(0x7fd753274000, 2097152, PROT_NONE) = 0
[pid 25589] 10:12:38.790843 mmap(0x7fd753474000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fd753474000
[pid 25589] 10:12:38.790898 close(7)    = 0
[pid 25589] 10:12:38.791020 mprotect(0x7fd753474000, 4096, PROT_READ) = 0
[pid 25589] 10:12:38.791067 munmap(0x7fd7578cd000, 39387) = 0
[pid 25585] 10:12:38.791128 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25589] 10:12:38.791160 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25589] 10:12:38.791456 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25589] 10:12:38.791500 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.791550 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.791588 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.791649 close(7)    = 0
[pid 25589] 10:12:38.791687 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.791822 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25589] 10:12:38.791869 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.791917 close(7)    = 0
[pid 25589] 10:12:38.791953 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25589] 10:12:38.791991 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.792032 close(7)    = 0
[pid 25589] 10:12:38.792071 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25589] 10:12:38.792113 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25589] 10:12:38.792158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25585] 10:12:38.792565 brk(0x16b5000 <unfinished ...>
[pid 25589] 10:12:38.792593 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25589] 10:12:38.792656 close(7)    = 0
[pid 25589] 10:12:38.792701 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.792826 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25589] 10:12:38.792921 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25589] 10:12:38.792970 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.793019 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.793117 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.793188 close(7)    = 0
[pid 25589] 10:12:38.793251 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.793308 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25589] 10:12:38.793375 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25589] 10:12:38.793451 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fd7567a4790}, 8) = 0
[pid 25589] 10:12:38.793519 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fd7578d7a90) = 25592
[pid 25589] 10:12:38.793861 wait4(25592,  <unfinished ...>
[pid 25585] 10:12:38.793898 <... brk resumed> ) = 0x16b5000
[pid 25585] 10:12:38.793968 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25585] 10:12:38.794586 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25585] 10:12:38.795199 brk(0x16d6000) = 0x16d6000
[pid 25585] 10:12:38.795671 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25585] 10:12:38.796299 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25585] 10:12:38.796706 brk(0x16f7000) = 0x16f7000
[pid 25585] 10:12:38.797109 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25585] 10:12:38.797869 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25585] 10:12:38.798189 brk(0x1718000) = 0x1718000
[pid 25585] 10:12:38.798815 stat("/usr/local/cpanel/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.798885 stat("/usr/local/cpanel/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.798955 stat("/etc/exim/perl/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.798995 stat("/etc/exim/perl/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799034 stat("/usr/local/cpanel/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799072 stat("/usr/local/cpanel/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799112 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799160 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799203 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799294 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799337 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799380 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.799422 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25585] 10:12:38.799489 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25585] 10:12:38.799539 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc4d81e400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25585] 10:12:38.799578 lseek(14, 0, SEEK_CUR) = 0
[pid 25585] 10:12:38.799635 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
Process 25592 attached
[pid 25592] 10:12:38.799847 set_robust_list(0x7fd7578d7aa0, 24) = 0
[pid 25592] 10:12:38.799917 geteuid( <unfinished ...>
[pid 25585] 10:12:38.800129 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25592] 10:12:38.800159 <... geteuid resumed> ) = 0
[pid 25592] 10:12:38.800185 geteuid()   = 0
[pid 25592] 10:12:38.800219 getegid()   = 12
[pid 25592] 10:12:38.800257 setgid(12)  = 0
[pid 25592] 10:12:38.800291 setuid(47)  = 0
[pid 25585] 10:12:38.800690 <... lseek resumed> ) = 878
[pid 25585] 10:12:38.800717 lseek(14, 0, SEEK_CUR) = 878
[pid 25585] 10:12:38.800808 close(14)   = 0
[pid 25585] 10:12:38.801067 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25585] 10:12:38.802277 brk(0x1739000) = 0x1739000
[pid 25585] 10:12:38.802711 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25592] 10:12:38.804262 brk(0x1b07000) = 0x1b07000
[pid 25592] 10:12:38.804708 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25585] 10:12:38.804954 brk(0x175a000 <unfinished ...>
[pid 25592] 10:12:38.804995 <... open resumed> ) = 7
[pid 25592] 10:12:38.805024 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25592] 10:12:38.805081 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25592] 10:12:38.805129 read(7, "@Q\264U\254YG\263\210\333X\265c\254A\357\246R\240\3\214\326\347\215\22Uk;\262>?3\303)\226\316\211\357\327*qU\"\321\244\341\t\355", 48) = 48
[pid 25592] 10:12:38.805173 close(7)    = 0
[pid 25592] 10:12:38.805224 getuid( <unfinished ...>
[pid 25585] 10:12:38.805247 <... brk resumed> ) = 0x175a000
[pid 25585] 10:12:38.805356 read(13,  <unfinished ...>
[pid 25592] 10:12:38.805386 <... getuid resumed> ) = 47
[pid 25592] 10:12:38.805569 exit_group(0) = ?
[pid 25585] 10:12:38.805597 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25592] 10:12:38.806071 +++ exited with 0 +++
[pid 25589] 10:12:38.806111 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25592
[pid 25589] 10:12:38.806140 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, 8) = 0
[pid 25589] 10:12:38.806209 getcwd("/var/spool/exim", 16380) = 16
[pid 25589] 10:12:38.806295 open("/etc/localtime", O_RDONLY) = 7
[pid 25589] 10:12:38.806339 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.806390 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.806437 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.806476 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25589] 10:12:38.806527 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25589] 10:12:38.806562 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25589] 10:12:38.806612 close(7)    = 0
[pid 25589] 10:12:38.806650 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.806703 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25589] 10:12:38.806978 fcntl(7, F_GETFD) = 0
[pid 25589] 10:12:38.807038 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.807088 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392717, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.807252 write(7, "2015-12-30 10:12:38 [25589] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMc-0006ec-HH\n", 92) = 92
[pid 25589] 10:12:38.807338 chdir("/var/spool/exim") = 0
[pid 25589] 10:12:38.807411 setgid(12)  = 0
[pid 25589] 10:12:38.807508 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25589] 10:12:38.807644 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25589] 10:12:38.807852 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25589] 10:12:38.807968 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25589] 10:12:38.808078 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25589] 10:12:38.808213 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25589] 10:12:38.808371 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25589] 10:12:38.808478 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25589] 10:12:38.808543 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.808623 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.808681 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.808859 close(8)    = 0
[pid 25589] 10:12:38.808919 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.809110 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25589] 10:12:38.809270 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25589] 10:12:38.809464 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25589] 10:12:38.809681 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25589] 10:12:38.809979 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25589] 10:12:38.810068 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25589] 10:12:38.810129 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.810200 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.810258 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.810331 close(8)    = 0
[pid 25589] 10:12:38.810381 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.810446 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25589] 10:12:38.810505 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25589] 10:12:38.810572 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.810629 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25589] 10:12:38.810698 close(8)    = 0
[pid 25589] 10:12:38.810844 munmap(0x7fd7578ed000, 4096) = 0
[pid 25590] 10:12:38.810971 <... connect resumed> ) = 0
[pid 25589] 10:12:38.810984 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25590] 10:12:38.811019 alarm(0)    = 300
[pid 25590] 10:12:38.811084 getsockname(11, {sa_family=AF_INET, sin_port=htons(36090), sin_addr=inet_addr("50.116.78.207")}, [16]) = 0
[pid 25590] 10:12:38.811153 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid 25590] 10:12:38.811226 stat("/etc/mailhelo", {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.811334 open("/etc/mailhelo", O_RDONLY) = 13
[pid 25590] 10:12:38.811408 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.811502 fstat(13, {st_dev=makedev(144, 4215), st_ino=108270352, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25590] 10:12:38.811582 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d40000
[pid 25590] 10:12:38.811640 lseek(13, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.811685 <... open resumed> ) = 8
[pid 25590] 10:12:38.811721 read(13,  <unfinished ...>
[pid 25589] 10:12:38.811733 fstat(8,  <unfinished ...>
[pid 25590] 10:12:38.811892 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.811908 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25590] 10:12:38.811993 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.812007 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25590] 10:12:38.812059 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.812070 <... mmap resumed> ) = 0x7fd7578ed000
[pid 25590] 10:12:38.812105 read(13,  <unfinished ...>
[pid 25589] 10:12:38.812116 read(8,  <unfinished ...>
[pid 25590] 10:12:38.812156 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.812167 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25590] 10:12:38.812299 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.812314 close(8 <unfinished ...>
[pid 25590] 10:12:38.812352 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.812362 <... close resumed> ) = 0
[pid 25590] 10:12:38.812395 read(13,  <unfinished ...>
[pid 25589] 10:12:38.812406 munmap(0x7fd7578ed000, 4096 <unfinished ...>
[pid 25590] 10:12:38.812448 <... read resumed> "", 4096) = 0
[pid 25589] 10:12:38.812459 <... munmap resumed> ) = 0
[pid 25590] 10:12:38.812617 lseek(13, 0, SEEK_SET <unfinished ...>
[pid 25589] 10:12:38.812637 read(6,  <unfinished ...>
[pid 25590] 10:12:38.812679 <... lseek resumed> ) = 0
[pid 25589] 10:12:38.812690 <... read resumed> "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25590] 10:12:38.812982 read(13,  <unfinished ...>
[pid 25589] 10:12:38.812999 read(6,  <unfinished ...>
[pid 25590] 10:12:38.813034 <... read resumed> "", 4096) = 0
[pid 25590] 10:12:38.813116 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25589] 10:12:38.813165 <... read resumed> "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25589] 10:12:38.813303 read(6, "", 4096) = 0
[pid 25589] 10:12:38.813364 read(6, "", 4096) = 0
[pid 25589] 10:12:38.813423 close(6)    = 0
[pid 25589] 10:12:38.813473 munmap(0x7fd7578ee000, 4096) = 0
[pid 25589] 10:12:38.813562 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fd7567a4790}, NULL, 8) = 0
[pid 25589] 10:12:38.813640 open("/var/spool/exim/input/c/1aEJMc-0006ec-HH-D", O_RDWR|O_APPEND) = 6
[pid 25589] 10:12:38.813725 fcntl(6, F_GETFD) = 0
[pid 25589] 10:12:38.813881 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.814065 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25589] 10:12:38.814134 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080200, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=16, st_size=4136, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.814217 open("/var/spool/exim/input/c/1aEJMc-0006ec-HH-H", O_RDONLY) = 8
[pid 25589] 10:12:38.814283 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=987, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.814360 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ee000
[pid 25589] 10:12:38.814427 read(8, "1aEJMc-0006ec-HH-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 987
[pid 25589] 10:12:38.814547 read(8, "", 4096) = 0
[pid 25589] 10:12:38.814611 close(8)    = 0
[pid 25589] 10:12:38.814668 munmap(0x7fd7578ee000, 4096) = 0
[pid 25589] 10:12:38.814737 open("/var/spool/exim/input/c/1aEJMc-0006ec-HH-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.814926 open("/var/spool/exim/msglog/c/1aEJMc-0006ec-HH", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25589] 10:12:38.815074 fcntl(8, F_GETFD) = 0
[pid 25589] 10:12:38.815140 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.815207 fchown(8, 47, 12) = 0
[pid 25589] 10:12:38.815281 fchmod(8, 0640) = 0
[pid 25589] 10:12:38.815343 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25589] 10:12:38.815399 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080162, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.815473 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ee000
[pid 25589] 10:12:38.815537 lseek(8, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.815613 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.815714 pipe([9, 10]) = 0
[pid 25589] 10:12:38.815876 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fd7567a4790}, 8) = 0
[pid 25589] 10:12:38.815948 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fd7578d7a90) = 25593
[pid 25589] 10:12:38.816307 close(10)   = 0
[pid 25589] 10:12:38.816365 read(9,  <unfinished ...>
[pid 25579] 10:12:38.817607 <... read resumed> "\26\3\1\0\312", 5) = 5
[pid 25579] 10:12:38.817659 read(11, "\4\0\0\306\0\0\0\0\0\300;\6\203#\r\3377K\350\301\352\207\255M\276\334K\231\231\10\332\256)C\313\4\212\16\244A\";\376L\336\0\224K\2'\266\371\302\276t\230\331R\225\24\353\0p\3\215`\27\343\261K\217\314\"&\6Ke5\366\324\351j\225\355\25 \355\201W`\36\201\305\257\21\366\364\0\2478!\2423\265\235\2547\302\247Y\215\33\351\220\5\344\315\31\240\273ud\353\333\360\267\322\v`\360L\230\222\fS\342\30[\0079\247\206\361\341\253\367\301E\206p\313\222\314\v\317\304\214s\307\0\2726\3362\267\317GY\356\337\364$\205\232\264!3\243L\7\262\263s\334`~1\375#\6Y{\7%o\276\203V\6k\360\343", 202) = 202
[pid 25579] 10:12:38.817774 read(11, "\24\3\1\0\1", 5) = 5
[pid 25579] 10:12:38.817827 read(11, "\1", 1) = 1
[pid 25579] 10:12:38.817940 read(11, "\26\3\1\0000", 5) = 5
[pid 25579] 10:12:38.818021 read(11, "u-\214If\262\342\0378\336\264\300\202\10E%\314\244J\227\331\323\212\357\313\327\344\37\206wB\352(}\342\272*/3\277\344x!\334\376\364\314r", 48) = 48
[pid 25579] 10:12:38.818149 alarm(0)    = 300
[pid 25579] 10:12:38.818252 write(11, "\27\3\1\0 R$N\356\212\0\205\10\367\2\17~\344\314\242\340\374!\300\300\224\2413\26\344\225\220\3210\31\247\356\27\3\1\0@L\20\205\232\207m\263\232B?w\277\265\2329cP\2141\357\223\225\341\26\322\306\211\23\255\354-\270\371R\212\260\301\205\365\216\314\266\220\217\v-\17\274w\264\263\203t\245M\25\211.\207\306\360\214\371\33", 106) = 106
[pid 25579] 10:12:38.818363 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25585] 10:12:38.819182 brk(0x177b000) = 0x177b000
[pid 25585] 10:12:38.819550 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25585] 10:12:38.821153 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821239 stat("/usr/local/cpanel/Errno.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821308 stat("/etc/exim/perl/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821377 stat("/etc/exim/perl/Errno.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821439 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821496 stat("/usr/local/cpanel/Errno.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821555 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821637 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821715 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821877 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.821942 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.822010 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25585] 10:12:38.822099 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25585] 10:12:38.822169 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc4d81e400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25585] 10:12:38.822234 lseek(14, 0, SEEK_CUR) = 0
[pid 25585] 10:12:38.822313 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25585] 10:12:38.822513 brk(0x179c000) = 0x179c000
[pid 25585] 10:12:38.823406 lseek(14, 4868, SEEK_SET) = 4868
[pid 25585] 10:12:38.823460 lseek(14, 0, SEEK_CUR) = 4868
[pid 25585] 10:12:38.823498 close(14)   = 0
[pid 25585] 10:12:38.823549 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823595 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823652 stat("/etc/exim/perl/Exporter.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823706 stat("/etc/exim/perl/Exporter.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823755 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823794 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823833 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823876 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffc4d81e610) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823918 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffc4d81e6b0) = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.823977 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25585] 10:12:38.824036 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25585] 10:12:38.824081 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc4d81e400) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25585] 10:12:38.824120 lseek(14, 0, SEEK_CUR) = 0
[pid 25585] 10:12:38.824168 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25585] 10:12:38.824717 lseek(14, 2366, SEEK_SET) = 2366
[pid 25585] 10:12:38.824854 lseek(14, 0, SEEK_CUR) = 2366
[pid 25585] 10:12:38.824892 close(14)   = 0
[pid 25585] 10:12:38.825260 read(13, "", 8192) = 0
[pid 25585] 10:12:38.825310 close(13)   = 0
[pid 25585] 10:12:38.825532 lseek(12, 0, SEEK_SET) = 0
[pid 25585] 10:12:38.825588 read(12, "", 4096) = 0
[pid 25585] 10:12:38.825650 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25585] 10:12:38.825723 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25585] 10:12:38.825830 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25585] 10:12:38.825883 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25585] 10:12:38.825929 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63703000
[pid 25585] 10:12:38.825971 lseek(13, 0, SEEK_SET) = 0
[pid 25585] 10:12:38.826005 read(13, "", 4096) = 0
[pid 25585] 10:12:38.826046 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25585] 10:12:38.826115 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25585] 10:12:38.826159 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25585] 10:12:38.826204 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63702000
[pid 25585] 10:12:38.826240 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25585] 10:12:38.826288 close(14)   = 0
[pid 25585] 10:12:38.826324 munmap(0x7f4b63702000, 4096) = 0
[pid 25585] 10:12:38.826387 open("/etc/aliases", O_RDONLY) = 14
[pid 25585] 10:12:38.826433 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25585] 10:12:38.826488 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25585] 10:12:38.826539 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63702000
[pid 25585] 10:12:38.826575 lseek(14, 0, SEEK_SET) = 0
[pid 25585] 10:12:38.826609 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25585] 10:12:38.826662 read(14, "", 4096) = 0
[pid 25585] 10:12:38.826706 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25585] 10:12:38.826849 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25585] 10:12:38.826903 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63701000
[pid 25585] 10:12:38.826946 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25585] 10:12:38.827000 close(15)   = 0
[pid 25585] 10:12:38.827035 munmap(0x7f4b63701000, 4096) = 0
[pid 25585] 10:12:38.827086 open("/etc/localaliases", O_RDONLY) = 15
[pid 25585] 10:12:38.827131 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25585] 10:12:38.827179 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25585] 10:12:38.827223 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63701000
[pid 25585] 10:12:38.827259 lseek(15, 0, SEEK_SET) = 0
[pid 25585] 10:12:38.827292 read(15, "", 4096) = 0
[pid 25585] 10:12:38.827337 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.827400 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.827472 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.827542 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25585] 10:12:38.827605 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.827684 write(8, "2015-12-30 10:12:38 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25585] 10:12:38.827732 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.827887 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.827943 close(7)    = 0
[pid 25585] 10:12:38.827982 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25585] 10:12:38.828058 fcntl(7, F_GETFD) = 0
[pid 25585] 10:12:38.828093 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25585] 10:12:38.828128 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392809, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.828175 write(7, "2015-12-30 10:12:38 [25585] 1aEJMc-0006ea-Fj ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25585] 10:12:38.828223 close(14)   = 0
[pid 25585] 10:12:38.828258 munmap(0x7f4b63702000, 4096) = 0
[pid 25585] 10:12:38.828298 close(15)   = 0
[pid 25585] 10:12:38.828331 munmap(0x7f4b63701000, 4096) = 0
[pid 25585] 10:12:38.828366 close(10)   = 0
[pid 25585] 10:12:38.828402 munmap(0x7f4b63706000, 4096) = 0
[pid 25585] 10:12:38.828437 close(11)   = 0
[pid 25585] 10:12:38.828470 munmap(0x7f4b63705000, 4096) = 0
[pid 25585] 10:12:38.828509 close(9)    = 0
[pid 25585] 10:12:38.828543 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.828579 close(13)   = 0
[pid 25585] 10:12:38.828612 munmap(0x7f4b63703000, 4096) = 0
[pid 25585] 10:12:38.828649 close(12)   = 0
[pid 25585] 10:12:38.828684 munmap(0x7f4b63704000, 4096) = 0
[pid 25585] 10:12:38.828739 geteuid()   = 0
[pid 25585] 10:12:38.828864 getegid()   = 12
[pid 25585] 10:12:38.828900 setgid(12)  = 0
[pid 25585] 10:12:38.828935 setuid(47)  = 0
[pid 25585] 10:12:38.828973 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f4b613076a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25585] 10:12:38.829026 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25585] 10:12:38.829092 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.829151 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25585] 10:12:38.829204 close(7)    = 0
[pid 25585] 10:12:38.829242 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25585] 10:12:38.829285 fcntl(7, F_GETFD) = 0
[pid 25585] 10:12:38.829319 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25585] 10:12:38.829356 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392919, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.829403 write(7, "2015-12-30 10:12:38 [25585] 1aEJMc-0006ea-Fj Frozen (delivery error message)\n", 77) = 77
[pid 25585] 10:12:38.829443 open("/var/spool/exim/input/c/hdr.25585", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25585] 10:12:38.829525 fchown(9, 47, 12) = 0
[pid 25585] 10:12:38.829564 fchmod(9, 0640) = 0
[pid 25585] 10:12:38.829599 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25585] 10:12:38.829639 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.829685 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b63707000
[pid 25585] 10:12:38.829721 lseek(9, 0, SEEK_CUR) = 0
[pid 25585] 10:12:38.829850 write(9, "1aEJMc-0006ea-Fj-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491958\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25585] 10:12:38.829900 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.829959 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMc-0006ea-Fj\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:38 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25585] 10:12:38.830003 fsync(9Process 25593 attached
 <unfinished ...>
[pid 25593] 10:12:38.830096 set_robust_list(0x7fd7578d7aa0, 24) = 0
[pid 25593] 10:12:38.830299 close(9)    = 0
[pid 25593] 10:12:38.830349 geteuid()   = 0
[pid 25593] 10:12:38.830382 getegid()   = 12
[pid 25593] 10:12:38.830416 setgid(494) = 0
[pid 25593] 10:12:38.830449 setuid(495) = 0
[pid 25593] 10:12:38.830506 open("/etc/cpanel_exim_system_filter", O_RDONLY <unfinished ...>
[pid 25585] 10:12:38.830536 <... fsync resumed> ) = 0
[pid 25585] 10:12:38.830556 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064868, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25585] 10:12:38.830602 close(9)    = 0
[pid 25585] 10:12:38.830637 munmap(0x7f4b63707000, 4096) = 0
[pid 25585] 10:12:38.830680 rename("/var/spool/exim/input/c/hdr.25585", "/var/spool/exim/input/c/1aEJMc-0006ea-Fj-H") = 0
[pid 25585] 10:12:38.830839 open("/var/spool/exim/input/c/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25585] 10:12:38.830885 fsync(9)    = 0
[pid 25585] 10:12:38.830917 close(9)    = 0
[pid 25585] 10:12:38.830951 close(8)    = 0
[pid 25585] 10:12:38.831002 munmap(0x7f4b63708000, 4096) = 0
[pid 25585] 10:12:38.831052 unlink("/var/spool/exim/input/c/1aEJMc-0006ea-Fj-J") = -1 ENOENT (No such file or directory)
[pid 25585] 10:12:38.831097 close(6)    = 0
[pid 25585] 10:12:38.831294 exit_group(0) = ?
[pid 25593] 10:12:38.831334 <... open resumed> ) = 9
[pid 25593] 10:12:38.831364 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25593] 10:12:38.831457 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25593] 10:12:38.831509 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25593] 10:12:38.831547 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25593] 10:12:38.831592 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25593] 10:12:38.831642 close(9)    = 0
[pid 25593] 10:12:38.831677 munmap(0x7fd7578ed000, 4096) = 0
[pid 25593] 10:12:38.832103 brk(0x1b08000 <unfinished ...>
[pid 25585] 10:12:38.832390 +++ exited with 0 +++
[pid 25593] 10:12:38.832473 <... brk resumed> ) = 0x1b08000
[pid 25593] 10:12:38.832598 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25589] 10:12:38.832633 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25589] 10:12:38.832656 read(9,  <unfinished ...>
[pid 25593] 10:12:38.832677 <... write resumed> ) = 4
[pid 25593] 10:12:38.832695 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25589] 10:12:38.832717 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25589] 10:12:38.832736 read(9,  <unfinished ...>
[pid 25593] 10:12:38.832814 <... write resumed> ) = 4
[pid 25593] 10:12:38.832835 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25589] 10:12:38.832858 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25589] 10:12:38.832878 read(9,  <unfinished ...>
[pid 25593] 10:12:38.832903 <... write resumed> ) = 4
[pid 25593] 10:12:38.832923 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25589] 10:12:38.832946 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25589] 10:12:38.832965 read(9,  <unfinished ...>
[pid 25593] 10:12:38.832984 <... write resumed> ) = 4
[pid 25593] 10:12:38.833001 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25589] 10:12:38.833022 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25589] 10:12:38.833041 read(9,  <unfinished ...>
[pid 25593] 10:12:38.833060 <... write resumed> ) = 4
[pid 25593] 10:12:38.833077 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25589] 10:12:38.833126 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25589] 10:12:38.833150 read(9,  <unfinished ...>
[pid 25593] 10:12:38.833170 <... write resumed> ) = 40
[pid 25593] 10:12:38.833188 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25589] 10:12:38.833210 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25589] 10:12:38.833233 wait4(-1,  <unfinished ...>
[pid 25593] 10:12:38.833252 <... write resumed> ) = 4
[pid 25593] 10:12:38.833270 close(10)   = 0
[pid 25593] 10:12:38.833312 exit_group(0) = ?
[pid 25593] 10:12:38.833553 +++ exited with 0 +++
[pid 25589] 10:12:38.833597 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25593
[pid 25589] 10:12:38.833624 close(9)    = 0
[pid 25589] 10:12:38.833662 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, 8) = 0
[pid 25589] 10:12:38.833726 brk(0x1b07000) = 0x1b07000
[pid 25589] 10:12:38.833795 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25589] 10:12:38.833848 alarm(60)   = 0
[pid 25589] 10:12:38.833883 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25589] 10:12:38.833923 alarm(0)    = 60
[pid 25589] 10:12:38.834012 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.834064 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25589] 10:12:38.834113 read(10, "cpu  123105 1342504 395324 67343106 2509 0 0 0\ncpu0 123105 1342504 395324 67343106 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58673942\nbtime 1450798266\nprocesses 893071\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25589] 10:12:38.834174 close(10)   = 0
[pid 25589] 10:12:38.834263 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25589] 10:12:38.834326 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25589] 10:12:38.834367 fcntl(10, F_GETFD) = 0
[pid 25589] 10:12:38.834400 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.834442 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25589] 10:12:38.834524 close(10)   = 0
[pid 25589] 10:12:38.834574 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.834616 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25589] 10:12:38.834717 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578a6000
[pid 25589] 10:12:38.834882 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25589] 10:12:38.834926 fcntl(10, F_GETFD) = 0
[pid 25589] 10:12:38.834971 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.835007 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25589] 10:12:38.835202 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25589] 10:12:38.835298 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25589] 10:12:38.835371 close(10)   = 0
[pid 25589] 10:12:38.835441 munmap(0x7fd7578a6000, 200704) = 0
[pid 25589] 10:12:38.835594 close(9)    = 0
[pid 25589] 10:12:38.835653 open("/etc/localdomains", O_RDONLY) = 9
[pid 25589] 10:12:38.835700 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.835764 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.835827 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.835876 lseek(9, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.835930 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25589] 10:12:38.836015 stat("/jail_owner", 0x7fff445a61c0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.836084 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25589] 10:12:38.836183 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.836246 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25589] 10:12:38.836350 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.836418 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.836596 open("/etc/demouids", O_RDONLY) = 10
[pid 25589] 10:12:38.836647 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.836697 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.836742 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ec000
[pid 25589] 10:12:38.836781 lseek(10, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.836814 read(10, "", 4096) = 0
[pid 25589] 10:12:38.836855 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25589] 10:12:38.836956 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.837017 open("/etc/userdomains", O_RDONLY) = 11
[pid 25589] 10:12:38.837057 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.837115 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.837160 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578eb000
[pid 25589] 10:12:38.837195 lseek(11, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.837228 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25589] 10:12:38.837292 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25589] 10:12:38.837339 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.837391 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ea000
[pid 25589] 10:12:38.837434 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.837576 close(12)   = 0
[pid 25589] 10:12:38.837635 munmap(0x7fd7578ea000, 4096) = 0
[pid 25589] 10:12:38.837729 stat("//etc/fin.finestweddingsites.com", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.837797 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.837892 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.837982 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.838080 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.838165 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.838263 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.838467 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.838601 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.838692 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25589] 10:12:38.838758 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.838846 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.838924 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ea000
[pid 25589] 10:12:38.838989 lseek(12, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.839044 read(12, "", 4096) = 0
[pid 25589] 10:12:38.839124 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25589] 10:12:38.839184 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25589] 10:12:38.839251 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e9000
[pid 25589] 10:12:38.839288 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25589] 10:12:38.839335 close(13)   = 0
[pid 25589] 10:12:38.839387 munmap(0x7fd7578e9000, 4096) = 0
[pid 25589] 10:12:38.839474 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.839685 stat("//.spamassassinboxenable", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.839759 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.839840 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25589] 10:12:38.839937 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.840007 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.840103 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff445a8fb0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.840174 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.840231 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.840372 getuid()    = 0
[pid 25589] 10:12:38.840420 geteuid()   = 0
[pid 25589] 10:12:38.840456 getgid()    = 12
[pid 25589] 10:12:38.840489 getegid()   = 12
[pid 25589] 10:12:38.840679 open("/dev/urandom", O_RDONLY) = 13
[pid 25589] 10:12:38.840730 read(13, "n\374\230\10", 4) = 4
[pid 25589] 10:12:38.840772 close(13)   = 0
[pid 25589] 10:12:38.840892 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25589] 10:12:38.841004 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5e10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.841048 lseek(0, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.841084 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5e10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.841119 lseek(1, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.841151 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5e20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.841184 lseek(2, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.841219 open("/dev/null", O_RDONLY) = 13
[pid 25589] 10:12:38.841260 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5ef0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.841317 lseek(13, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.841354 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.841391 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, 8) = 0
[pid 25589] 10:12:38.841739 brk(0x1b29000) = 0x1b29000
[pid 25589] 10:12:38.841806 read(13, "", 8192) = 0
[pid 25589] 10:12:38.841850 close(13)   = 0
[pid 25589] 10:12:38.842225 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.842292 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25589] 10:12:38.842335 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5d20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.842373 lseek(13, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.842428 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25589] 10:12:38.843339 brk(0x1b4a000) = 0x1b4a000
[pid 25589] 10:12:38.843791 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25589] 10:12:38.844965 brk(0x1b6b000) = 0x1b6b000
[pid 25589] 10:12:38.845800 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25589] 10:12:38.846995 brk(0x1b8c000) = 0x1b8c000
[pid 25589] 10:12:38.847761 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25589] 10:12:38.848217 read(13, "", 8192) = 0
[pid 25589] 10:12:38.848283 close(13)   = 0
[pid 25589] 10:12:38.848361 stat("/usr/share/amavis/amavis-filter", 0x7fd755f8b880) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.848435 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.848593 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25589] 10:12:38.848681 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25589] 10:12:38.848746 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5d20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.848806 lseek(13, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.848883 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25589] 10:12:38.849372 brk(0x1bad000) = 0x1bad000
[pid 25589] 10:12:38.849749 stat("/etc/exim/perl/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.849834 stat("/etc/exim/perl/warnings.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.849898 stat("/usr/local/cpanel/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.849960 stat("/usr/local/cpanel/warnings.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850021 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850091 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850157 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850223 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850292 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850376 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850465 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.850634 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.850729 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25589] 10:12:38.850805 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.850865 lseek(14, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.850949 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25589] 10:12:38.851475 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25589] 10:12:38.852138 brk(0x1bce000) = 0x1bce000
[pid 25589] 10:12:38.852346 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25589] 10:12:38.852845 read(14, "", 8192) = 0
[pid 25589] 10:12:38.852896 close(14)   = 0
[pid 25589] 10:12:38.853664 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25589] 10:12:38.854415 read(13, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25589] 10:12:38.855202 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25589] 10:12:38.855877 brk(0x1bef000) = 0x1bef000
[pid 25589] 10:12:38.855986 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25589] 10:12:38.857042 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25589] 10:12:38.857887 brk(0x1c10000) = 0x1c10000
[pid 25589] 10:12:38.858717 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25589] 10:12:38.859677 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25589] 10:12:38.860289 brk(0x1c31000) = 0x1c31000
[pid 25589] 10:12:38.860815 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25589] 10:12:38.861904 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25589] 10:12:38.862350 brk(0x1c52000) = 0x1c52000
[pid 25589] 10:12:38.863281 stat("/usr/local/cpanel/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863373 stat("/usr/local/cpanel/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863445 stat("/etc/exim/perl/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863580 stat("/etc/exim/perl/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863651 stat("/usr/local/cpanel/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863715 stat("/usr/local/cpanel/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863781 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863857 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863926 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.863995 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.864064 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.864133 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.864213 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.864282 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.864377 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25589] 10:12:38.864454 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.864618 lseek(14, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.864704 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25589] 10:12:38.865038 lseek(14, 878, SEEK_SET) = 878
[pid 25589] 10:12:38.865102 lseek(14, 0, SEEK_CUR) = 878
[pid 25589] 10:12:38.865161 close(14)   = 0
[pid 25589] 10:12:38.865582 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25589] 10:12:38.866226 brk(0x1c73000) = 0x1c73000
[pid 25589] 10:12:38.866394 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25589] 10:12:38.867850 brk(0x1c94000) = 0x1c94000
[pid 25589] 10:12:38.868020 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25589] 10:12:38.869546 brk(0x1cb5000) = 0x1cb5000
[pid 25579] 10:12:38.869747 <... select resumed> ) = 1 (in [11], left {299, 948665})
[pid 25579] 10:12:38.869811 read(11, "\27\3\1\0 ", 5) = 5
[pid 25579] 10:12:38.869860 read(11, "\200%qu\256\16\361\257BS\"~\223\310\331\7\216\3209\253w\3557D\247\341\5\376\204\250\354\\", 32) = 32
[pid 25579] 10:12:38.869905 read(11, "\27\3\1\0`", 5) = 5
[pid 25579] 10:12:38.869944 read(11, "_g\253\10A\30\331\231\200\236\372\260\200\31\352\271\235y&u\205\331\355 \331.!\5\\\4\25}\275\330\371-%\315\230\33\244\3008\343\3328?JG\207\303u\273\353\252\16\257\244\371\263\222L?\3245S\334\331\352\210\3626\207\263lV*\30$\254\266\360\252\30\264\235\332\36\242\277I\26\372[\377\262", 96) = 96
[pid 25579] 10:12:38.870013 write(11, "\27\3\1\0 \214\317\247\326\375\266g\370t\200\260k\306\220W\0363\217\323\364\200\374\235\35\306Q\36757\356\5\340\27\3\1\0P\322\243\202\346^(\320\376\236\357\203\330\253h\232:B{\rU(\216AA\254\"d\5\350\216\277\376\\~Fo\374@\7\353\330\346\1\362b\350w\331nV\0024\7\333\206_\356N\203D|\205jz\325\335\2\327\215\215\311\272}\\:\24\231\25I\25", 122) = 122
[pid 25579] 10:12:38.870085 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25589] 10:12:38.870225 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25589] 10:12:38.871175 stat("/usr/local/cpanel/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871247 stat("/usr/local/cpanel/Errno.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871290 stat("/etc/exim/perl/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871328 stat("/etc/exim/perl/Errno.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871365 stat("/usr/local/cpanel/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871402 stat("/usr/local/cpanel/Errno.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871441 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871489 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871601 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871642 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871683 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.871733 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25589] 10:12:38.871795 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25589] 10:12:38.871841 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.871879 lseek(14, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.871933 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25589] 10:12:38.872059 brk(0x1cd6000) = 0x1cd6000
[pid 25589] 10:12:38.872659 lseek(14, 4868, SEEK_SET) = 4868
[pid 25589] 10:12:38.872707 lseek(14, 0, SEEK_CUR) = 4868
[pid 25589] 10:12:38.872746 close(14)   = 0
[pid 25589] 10:12:38.872807 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.872851 stat("/usr/local/cpanel/Exporter.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.872891 stat("/etc/exim/perl/Exporter.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.872931 stat("/etc/exim/perl/Exporter.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.872969 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.873006 stat("/usr/local/cpanel/Exporter.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.873044 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.873085 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff445a5940) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.873126 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fff445a59e0) = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.873165 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25589] 10:12:38.873228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25589] 10:12:38.873271 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff445a5730) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25589] 10:12:38.873308 lseek(14, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.873355 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25589] 10:12:38.873939 lseek(14, 2366, SEEK_SET) = 2366
[pid 25589] 10:12:38.873998 lseek(14, 0, SEEK_CUR) = 2366
[pid 25589] 10:12:38.874042 close(14)   = 0
[pid 25589] 10:12:38.874437 read(13, "", 8192) = 0
[pid 25589] 10:12:38.874488 close(13)   = 0
[pid 25589] 10:12:38.874781 lseek(12, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.874825 read(12, "", 4096) = 0
[pid 25589] 10:12:38.874887 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.874958 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25589] 10:12:38.875000 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.875049 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.875093 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e9000
[pid 25589] 10:12:38.875130 lseek(13, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.875162 read(13, "", 4096) = 0
[pid 25589] 10:12:38.875200 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25589] 10:12:38.875266 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25589] 10:12:38.875311 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25589] 10:12:38.875356 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e8000
[pid 25589] 10:12:38.875392 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25589] 10:12:38.875440 close(14)   = 0
[pid 25589] 10:12:38.875474 munmap(0x7fd7578e8000, 4096) = 0
[pid 25589] 10:12:38.875614 open("/etc/aliases", O_RDONLY) = 14
[pid 25589] 10:12:38.875662 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25589] 10:12:38.875711 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25589] 10:12:38.875768 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e8000
[pid 25589] 10:12:38.875804 lseek(14, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.875837 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25589] 10:12:38.875892 read(14, "", 4096) = 0
[pid 25589] 10:12:38.875938 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25589] 10:12:38.875980 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25589] 10:12:38.876024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e7000
[pid 25589] 10:12:38.876059 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25589] 10:12:38.876111 close(15)   = 0
[pid 25589] 10:12:38.876147 munmap(0x7fd7578e7000, 4096) = 0
[pid 25589] 10:12:38.876194 open("/etc/localaliases", O_RDONLY) = 15
[pid 25589] 10:12:38.876236 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25589] 10:12:38.876283 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25589] 10:12:38.876326 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578e7000
[pid 25589] 10:12:38.876360 lseek(15, 0, SEEK_SET) = 0
[pid 25589] 10:12:38.876394 read(15, "", 4096) = 0
[pid 25589] 10:12:38.876437 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.876594 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.876659 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.876720 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25589] 10:12:38.876784 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.876855 write(8, "2015-12-30 10:12:38 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25589] 10:12:38.876924 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.876983 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.877035 close(7)    = 0
[pid 25589] 10:12:38.877074 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25589] 10:12:38.877122 fcntl(7, F_GETFD) = 0
[pid 25589] 10:12:38.877155 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.877186 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5392996, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.877231 write(7, "2015-12-30 10:12:38 [25589] 1aEJMc-0006ec-HH ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25589] 10:12:38.877272 close(14)   = 0
[pid 25589] 10:12:38.877306 munmap(0x7fd7578e8000, 4096) = 0
[pid 25589] 10:12:38.877346 close(15)   = 0
[pid 25589] 10:12:38.877379 munmap(0x7fd7578e7000, 4096) = 0
[pid 25589] 10:12:38.877413 close(10)   = 0
[pid 25589] 10:12:38.877445 munmap(0x7fd7578ec000, 4096) = 0
[pid 25589] 10:12:38.877484 close(11)   = 0
[pid 25589] 10:12:38.877614 munmap(0x7fd7578eb000, 4096) = 0
[pid 25589] 10:12:38.877653 close(9)    = 0
[pid 25589] 10:12:38.877693 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.877728 close(13)   = 0
[pid 25589] 10:12:38.877764 munmap(0x7fd7578e9000, 4096) = 0
[pid 25589] 10:12:38.877800 close(12)   = 0
[pid 25589] 10:12:38.877834 munmap(0x7fd7578ea000, 4096) = 0
[pid 25589] 10:12:38.877886 geteuid()   = 0
[pid 25589] 10:12:38.877921 getegid()   = 12
[pid 25589] 10:12:38.877955 setgid(12)  = 0
[pid 25589] 10:12:38.877988 setuid(47)  = 0
[pid 25589] 10:12:38.878026 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fd7554ed6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25589] 10:12:38.878079 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25589] 10:12:38.878120 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.878175 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25589] 10:12:38.878225 close(7)    = 0
[pid 25589] 10:12:38.878262 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25589] 10:12:38.878306 fcntl(7, F_GETFD) = 0
[pid 25589] 10:12:38.878340 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25589] 10:12:38.878372 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5393106, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.878416 write(7, "2015-12-30 10:12:38 [25589] 1aEJMc-0006ec-HH Frozen (delivery error message)\n", 77) = 77
[pid 25589] 10:12:38.878456 open("/var/spool/exim/input/c/hdr.25589", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25589] 10:12:38.878609 fchown(9, 47, 12) = 0
[pid 25589] 10:12:38.878683 fchmod(9, 0640) = 0
[pid 25589] 10:12:38.878718 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25589] 10:12:38.878766 fstat(9, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.878821 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd7578ed000
[pid 25589] 10:12:38.878859 lseek(9, 0, SEEK_CUR) = 0
[pid 25589] 10:12:38.878909 write(9, "1aEJMc-0006ec-HH-H\nmailnull 47 12\n<>\n1451491958 0\n-ident mailnull\n-received_protocol local\n-body_linecount 57\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491958\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25589] 10:12:38.878960 fstat(9, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.879010 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMc-0006ec-HH\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:38 -0600\n085  X-Failed-Recipients: antiquewedding@gmail.com,\n  finest09@fin.finestweddin"..., 719) = 719
[pid 25589] 10:12:38.879052 fsync(9)    = 0
[pid 25589] 10:12:38.879591 fstat(9, {st_dev=makedev(144, 4215), st_ino=125080164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=987, st_atime=2015/12/30-10:12:38, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25589] 10:12:38.879648 close(9)    = 0
[pid 25589] 10:12:38.879690 munmap(0x7fd7578ed000, 4096) = 0
[pid 25589] 10:12:38.879747 rename("/var/spool/exim/input/c/hdr.25589", "/var/spool/exim/input/c/1aEJMc-0006ec-HH-H") = 0
[pid 25589] 10:12:38.879841 open("/var/spool/exim/input/c/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25589] 10:12:38.879883 fsync(9)    = 0
[pid 25589] 10:12:38.879930 close(9)    = 0
[pid 25589] 10:12:38.879985 close(8)    = 0
[pid 25589] 10:12:38.880038 munmap(0x7fd7578ee000, 4096) = 0
[pid 25589] 10:12:38.880091 unlink("/var/spool/exim/input/c/1aEJMc-0006ec-HH-J") = -1 ENOENT (No such file or directory)
[pid 25589] 10:12:38.880137 close(6)    = 0
[pid 25589] 10:12:38.880303 exit_group(0) = ?
[pid 25589] 10:12:38.880923 +++ exited with 0 +++
[pid 25579] 10:12:38.921510 <... select resumed> ) = 1 (in [11], left {299, 948641})
[pid 25579] 10:12:38.921621 read(11, "\27\3\1\0 ", 5) = 5
[pid 25579] 10:12:38.921684 read(11, "\347t\252\322\237\342\37\253\365\355\256w\23\237\264\336qc\310\235\306\354\27\356A\310\310M\326i\332\372", 32) = 32
[pid 25579] 10:12:38.921749 read(11, "\27\3\1\0P", 5) = 5
[pid 25579] 10:12:38.921803 read(11, "^\34\336\216_W\274ymC\10\252\207\330\243G\3353\206l\235-p/ik\301\327\322\352\345\315\200z\6\262\v\307\231\205S\n:\314\246c\346\372\253\301\2\6\335Z\253|>15\243\224\257A\373\206\345\230\250\215`\tm(w\274\306Z\266\374\24", 80) = 80
[pid 25579] 10:12:38.921887 write(11, "\27\3\1\0 \232m\\\375\350\361\216\367\276Z\330\314P\315\216\252\261O\2341~\1\225\t\220\363uNN\227\25\24\27\3\1\0@\377\255Z\200\"\202!f\255(Z\21CCJ\36G\345.X_ut7%q3.\367\221~\2074l\353\374;\252U\324I\255N\315\230\250\366\330\316P\325:\267E\322\31\203]\t\257N\3072r", 106) = 106
[pid 25579] 10:12:38.922004 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25590] 10:12:38.950588 <... select resumed> ) = 1 (in [11], left {299, 862592})
[pid 25590] 10:12:38.950691 recvfrom(11, "220 mail14.ess.barracuda.com ESMTP (mx1408.ess.rzc)\r\n", 4096, 0, NULL, NULL) = 53
[pid 25590] 10:12:38.950797 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25590] 10:12:38.950947 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25579] 10:12:38.972266 <... select resumed> ) = 1 (in [11], left {299, 949809})
[pid 25579] 10:12:38.972425 read(11, "\27\3\1\0 ", 5) = 5
[pid 25579] 10:12:38.972502 read(11, "\236\271\300kJ\332\275{\334\202\314\325\211\212w\322\327\347I'\222\253s:\31j\323-\n\302=\343", 32) = 32
[pid 25579] 10:12:38.972584 read(11, "\27\3\1\0@", 5) = 5
[pid 25579] 10:12:38.972658 read(11, "\373S\354\310j\303\361\353roE\3\376\220uI\233\201\262\240k\227\333\253\302j\374K:=\372\361\277\n\362\212\364\256>_\371[\223\244\367\325\10\1\35\306\344B\374Y\3508[\232|d\244\251r\270", 64) = 64
[pid 25579] 10:12:38.972796 write(11, "\27\3\1\0 \230y\342xjs\335\364\376\36\t\372\253\217\5\22\363\6\264\371\37\314\333\264\216a\374\350\315\351A\204\27\3\1\0 \233\252<\342L\306wxU\261\303z\1\361\24\226\220V\335\357\272\243\2608\207t%\214\217\310\207\32", 74) = 74
[pid 25579] 10:12:38.972907 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25590] 10:12:39.006255 <... select resumed> ) = 1 (in [11], left {299, 944757})
[pid 25590] 10:12:39.006409 recvfrom(11, "250-mx1408.ess.rzc.cudaops.com Hello fin.finestweddingsites.com [50.116.78.207], pleased to meet you\r\n250-PIPELINING\r\n250-AUTH LOGIN\r\n250-STARTTLS\r\n250 HELP\r\n", 4096, 0, NULL, NULL) = 158
[pid 25590] 10:12:39.006528 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25590] 10:12:39.006625 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25579] 10:12:39.022749 <... select resumed> ) = 1 (in [11], left {299, 950294})
[pid 25579] 10:12:39.022845 read(11, "\27\3\1\0 ", 5) = 5
[pid 25579] 10:12:39.022917 read(11, "`\377\v\311\223j)3\24\232fe\330\236\2150\304\324f,\320\235\322\22\224\23\314\265N:? ", 32) = 32
[pid 25579] 10:12:39.022988 read(11, "\27\3\1\0000", 5) = 5
[pid 25579] 10:12:39.023046 read(11, "\0\354\255\371F\201\220\351\232\213b\201\357^\347\16+x\307\362\367>=\224\342\207\341\23\t\1%\4\221o\255\232\16\201e\251`\277\316\336y\374=l", 48) = 48
[pid 25579] 10:12:39.023143 lseek(6, 19, SEEK_SET) = 19
[pid 25579] 10:12:39.023200 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25579] 10:12:39.023285 read(6, "", 8192) = 0
[pid 25579] 10:12:39.023345 alarm(300)  = 0
[pid 25579] 10:12:39.023447 write(11, "\27\3\1\0 Iaz\363u\335*cBCT\235\205\270\22\356\224\n\21y\336<X\203\264\222ql\326Q*\"\27\3\1\f@\236)2\n\252K5\360{\226\34\360\275vZ\262nv=\0031\310a\361Q\350<\2\307pH\345\1yRzVn\251\201I\5f\5d^\10E\335\217\2559\347\347\361\204]\2016\272\35\245\220\205\352\252\30\0064\257\243\24\"^iJ\200\330)e\220n\236f9\0\f\f\246\314\30I\277%\4\263\355\20C\263@\333\304ZR\vpN$\22\7`\364\222\275z\210\2125\322\340\240\3\r4\35).\34\f=\344U\266\216b\323\3445\351H\237\326\34\371;|a\341oq\23?o\357\376\2659\205\201\35\252z9b}d\223G\242E\271#Z3oZ`oF\367\325\360\311\256UiV\314Q0\26\37A\241\277\246\342\2710B\346\32\1\314\235`\263\265\277Ka\307\210"..., 3178) = 3178
[pid 25579] 10:12:39.023601 alarm(0)    = 300
[pid 25579] 10:12:39.023673 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25590] 10:12:39.061413 <... select resumed> ) = 1 (in [11], left {299, 945324})
[pid 25590] 10:12:39.061501 recvfrom(11, "220 Ready to start TLS\r\n", 4096, 0, NULL, NULL) = 24
[pid 25590] 10:12:39.065223 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25590] 10:12:39.065326 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25590] 10:12:39.065434 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25590] 10:12:39.065504 read(14, "\311X\33\250P\2516\205\250T\204\263\230\256\322_\1778\211>;\tG\3369\3301\2W[\221\0028=(Y\276\271\31\315\316\231\361\376\216\3263y", 48) = 48
[pid 25590] 10:12:39.065627 close(14)   = 0
[pid 25590] 10:12:39.065712 getuid()    = 47
[pid 25590] 10:12:39.072333 open("/etc/pki/tls/cert.pem", O_RDONLY) = 14
[pid 25590] 10:12:39.072435 fstat(14, {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25590] 10:12:39.072514 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25590] 10:12:39.072579 read(14, "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25590] 10:12:39.072669 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25590] 10:12:39.072862 read(14, "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25590] 10:12:39.072937 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25590] 10:12:39.073098 read(14, " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25590] 10:12:39.073171 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25590] 10:12:39.073302 read(14, "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25590] 10:12:39.073445 read(14, "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25590] 10:12:39.073580 read(14, " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25590] 10:12:39.073649 read(14, "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25590] 10:12:39.073777 read(14, "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25590] 10:12:39.073905 read(14, "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25590] 10:12:39.074045 read(14, "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25590] 10:12:39.074195 read(14, "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25590] 10:12:39.074328 read(14, "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25590] 10:12:39.074520 read(14, "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25590] 10:12:39.074664 read(14, "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25590] 10:12:39.074757 read(14, "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25590] 10:12:39.074809 read(14, "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25590] 10:12:39.074892 read(14, "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25590] 10:12:39.074980 read(14, "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25590] 10:12:39.075071 read(14, "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25590] 10:12:39.075155 read(14, "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25590] 10:12:39.075202 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25590] 10:12:39.075288 read(14, "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25590] 10:12:39.075371 read(14, "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25590] 10:12:39.075436 read(14, "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25590] 10:12:39.075545 read(14, ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25590] 10:12:39.075636 read(14, "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25590] 10:12:39.075688 read(14, "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25590] 10:12:39.075777 read(14, "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25590] 10:12:39.075865 read(14, "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25590] 10:12:39.075912 read(14, "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25590] 10:12:39.075995 read(14, "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25590] 10:12:39.076082 read(14, ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25590] 10:12:39.076182 read(14, " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25590] 10:12:39.076276 read(14, ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25590] 10:12:39.076498 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25590] 10:12:39.076618 read(14, "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25590] 10:12:39.076742 read(14, "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25590] 10:12:39.076846 read(14, "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25590] 10:12:39.076897 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25590] 10:12:39.076982 read(14, "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25590] 10:12:39.077076 read(14, "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25590] 10:12:39.077165 read(14, "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25590] 10:12:39.077250 read(14, " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25590] 10:12:39.077342 read(14, "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25590] 10:12:39.077390 read(14, "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25590] 10:12:39.077531 read(14, "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25590] 10:12:39.077643 read(14, "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25590] 10:12:39.077750 read(14, "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25590] 10:12:39.077855 read(14, "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25590] 10:12:39.077963 read(14, "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25590] 10:12:39.078063 read(14, "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25590] 10:12:39.078162 read(14, "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25590] 10:12:39.078245 read(14, "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25590] 10:12:39.078295 read(14, "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25590] 10:12:39.078381 read(14, "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25590] 10:12:39.078564 read(14, ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25590] 10:12:39.078623 brk(0xc37000) = 0xc37000
[pid 25590] 10:12:39.078719 read(14, "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25590] 10:12:39.078802 read(14, ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25590] 10:12:39.078893 read(14, "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25590] 10:12:39.078988 read(14, "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25590] 10:12:39.079079 read(14, "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25590] 10:12:39.079174 read(14, "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25590] 10:12:39.079268 read(14, " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25590] 10:12:39.079358 read(14, ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25590] 10:12:39.079530 read(14, "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25590] 10:12:39.079637 read(14, ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25579] 10:12:39.079680 <... select resumed> ) = 1 (in [11], left {599, 944039})
[pid 25579] 10:12:39.079728 read(11, "\27\3\1\0 ", 5) = 5
[pid 25579] 10:12:39.079768 read(11, "\355\240\3577wk\32\212\351q\202\277A\364}\365*\300)\36\327\vY\336\307\201\374\366\3\325\203\321", 32) = 32
[pid 25579] 10:12:39.079820 read(11, "\27\3\1\0@", 5) = 5
[pid 25579] 10:12:39.079856 read(11, ",\322\354|\352\251\27\325\\\211A\343\306\306]\n-\0\373)KE\222\345s(\205\177\36\206z_\251J*\234\"\0171 +\312\321\215\25\366yP\203\0005@\257\314\226\210\211\362\226\225J\244\\\334", 64) = 64
[pid 25579] 10:12:39.079909 write(9, "wendy.laws@hilton.com\n", 22) = 22
[pid 25579] 10:12:39.079957 fsync(9 <unfinished ...>
[pid 25590] 10:12:39.080018 read(14, "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25590] 10:12:39.080129 read(14, "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25590] 10:12:39.080273 read(14, "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25590] 10:12:39.080327 read(14, "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25579] 10:12:39.080384 <... fsync resumed> ) = 0
[pid 25579] 10:12:39.080486 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25579] 10:12:39.080543 alarm(60)   = 0
[pid 25579] 10:12:39.080577 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25579] 10:12:39.080616 alarm(0)    = 60
[pid 25579] 10:12:39.080669 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:39.080733 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25579] 10:12:39.080788 read(15, "cpu  123105 1342508 395327 67343123 2509 0 0 0\ncpu0 123105 1342508 395327 67343123 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58676861\nbtime 1450798266\nprocesses 893072\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25579] 10:12:39.080853 close(15)   = 0
[pid 25579] 10:12:39.080904 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25579] 10:12:39.080963 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25579] 10:12:39.081003 fcntl(15, F_GETFD) = 0
[pid 25579] 10:12:39.081034 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:39.081067 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25579] 10:12:39.081110 close(15)   = 0
[pid 25579] 10:12:39.081149 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25579] 10:12:39.081189 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25579] 10:12:39.081257 brk(0x228a000) = 0x228a000
[pid 25579] 10:12:39.081462 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25579] 10:12:39.081516 fcntl(15, F_GETFD) = 0
[pid 25579] 10:12:39.081548 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25579] 10:12:39.081580 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25579] 10:12:39.081637 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25579] 10:12:39.081699 pread(15, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25579] 10:12:39.081766 close(15)   = 0
[pid 25579] 10:12:39.081818 close(14)   = 0
[pid 25579] 10:12:39.081871 write(11, "\27\3\1\0 =\353\224\350\360P\243\225\251&\274\252\375p\353\22/\231\246V\2X\217\261\323\344\270\262\315\r\307.\27\3\1\0 \251\376+\23,c%\255\273;\215]X\243\22\177\346\374<\263\214\4V\334\201\355\362\36\250\345n\7", 74) = 74
[pid 25579] 10:12:39.081944 write(11, "\25\3\1\0 \6\346\305\360\276\3277\275\346t\314\300\372\366]\300G\314\363U\231\230\1\23\21-X\265F\225\214x", 37) = 37
[pid 25579] 10:12:39.082049 close(11)   = 0
[pid 25579] 10:12:39.082125 close(13)   = 0
[pid 25579] 10:12:39.082162 munmap(0x7fa692c1e000, 4096) = 0
[pid 25579] 10:12:39.082201 close(10)   = 0
[pid 25579] 10:12:39.082235 munmap(0x7fa692c1f000, 4096) = 0
[pid 25579] 10:12:39.082281 write(12, "S000004\35\f\0\0", 11) = 11
[pid 25544] 10:12:39.082321 <... select resumed> ) = 1 (in [11], left {59, 196678})
[pid 25544] 10:12:39.082347 read(11, "S000004\35\f\0\0", 16384) = 11
[pid 25544] 10:12:39.082391 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.082498 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.082534 write(12, "X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0", 87) = 87
[pid 25544] 10:12:39.082570 <... select resumed> ) = 1 (in [11], left {59, 999952})
[pid 25544] 10:12:39.082592 read(11, "X100080TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=*.hilton.iphmx.com\0", 16384) = 87
[pid 25544] 10:12:39.082635 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.082671 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.082752 write(12, "X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 1900) = 1900
[pid 25544] 10:12:39.082791 <... select resumed> ) = 1 (in [11], left {59, 999903})
[pid 25544] 10:12:39.082813 read(11, "X201893-----BEGIN CERTIFICATE-----\\nMIIFMjCCBBqgAwIBAgIJAIjgh+VU8cvXMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 16384) = 1900
[pid 25544] 10:12:39.083091 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.083128 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.083158 write(12, "X4000021\0", 9) = 9
[pid 25544] 10:12:39.083186 <... select resumed> ) = 1 (in [11], left {59, 999962})
[pid 25544] 10:12:39.083207 read(11, "X4000021\0", 16384) = 9
[pid 25544] 10:12:39.083241 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.083273 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.083299 write(12, "D000004\2\0\0\0", 11) = 11
[pid 25544] 10:12:39.083325 <... select resumed> ) = 1 (in [11], left {59, 999966})
[pid 25544] 10:12:39.083346 read(11, "D000004\2\0\0\0", 16384) = 11
[pid 25544] 10:12:39.083380 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.083497 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.083534 write(12, "A000089\0=\0\0\1\0\0\0\0\0\0\001250 ok:  Message 141459299 accepted\0\0mx1.hilton.iphmx.com\00068.232.141.57\0\31\0\0\0000", 96) = 96
[pid 25544] 10:12:39.083567 <... select resumed> ) = 1 (in [11], left {59, 999952})
[pid 25544] 10:12:39.083589 read(11, "A000089\0=\0\0\1\0\0\0\0\0\0\001250 ok:  Message 141459299 accepted\0\0mx1.hilton.iphmx.com\00068.232.141.57\0\31\0\0\0000", 16384) = 96
[pid 25544] 10:12:39.083626 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.083661 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.083690 write(12, "I00002050.116.78.207\00034064\0", 27) = 27
[pid 25544] 10:12:39.083717 <... select resumed> ) = 1 (in [11], left {59, 999963})
[pid 25544] 10:12:39.083743 read(11, "I00002050.116.78.207\00034064\0", 16384) = 27
[pid 25544] 10:12:39.083780 wait4(-1, 0x7ffc5380eb70, WNOHANG, NULL) = 0
[pid 25544] 10:12:39.083813 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25579] 10:12:39.083839 write(12, "Z0000010", 8) = 8
[pid 25544] 10:12:39.083865 <... select resumed> ) = 1 (in [11], left {59, 999966})
[pid 25544] 10:12:39.083886 read(11, "Z0000010", 16384) = 8
[pid 25544] 10:12:39.083919 close(11)   = 0
[pid 25544] 10:12:39.083951 wait4(25579,  <unfinished ...>
[pid 25579] 10:12:39.083971 close(12)   = 0
[pid 25579] 10:12:39.084366 exit_group(0) = ?
[pid 25579] 10:12:39.085014 +++ exited with 0 +++
[pid 25544] 10:12:39.085050 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25579
[pid 25544] 10:12:39.085089 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.085156 write(8, "2015-12-30 10:12:39 wendy.laws@hilton.com: remote_smtp transport succeeded\n", 75) = 75
[pid 25544] 10:12:39.085217 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.085277 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.085328 close(7)    = 0
[pid 25544] 10:12:39.085365 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25544] 10:12:39.085468 fcntl(7, F_GETFD) = 0
[pid 25544] 10:12:39.085503 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:39.085541 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5393306, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:38, st_ctime=2015/12/30-10:12:38}) = 0
[pid 25544] 10:12:39.085588 write(7, "2015-12-30 10:12:39 [25544] 1aEJMb-0006dm-9U => wendy.laws@hilton.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3101 H=mx1.hilton.iphmx.com [68.232.141.57]:25 X=TLSv1:DHE-"..., 390) = 390
[pid 25544] 10:12:39.085662 geteuid()   = 0
[pid 25544] 10:12:39.085696 getegid()   = 12
[pid 25544] 10:12:39.085730 setgid(12)  = 0
[pid 25544] 10:12:39.085762 setuid(47)  = 0
[pid 25544] 10:12:39.085799 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25544] 10:12:39.085847 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.085902 pipe([10, 11]) = 0
[pid 25544] 10:12:39.085940 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25544] 10:12:39.085981 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa692c09a90) = 25595
[pid 25544] 10:12:39.086287 close(10)   = 0
[pid 25544] 10:12:39.086327 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25544] 10:12:39.086368 fstat(11, {st_dev=makedev(0, 8), st_ino=2130171192, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25544] 10:12:39.086494 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25544] 10:12:39.086533 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25544] 10:12:39.086633 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25544] 10:12:39.086688 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1054) = 1054
[pid 25544] 10:12:39.086749 lseek(6, 19, SEEK_SET) = 19
[pid 25544] 10:12:39.086785 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25544] 10:12:39.086835 read(6, "", 8192) = 0
[pid 25544] 10:12:39.086868 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006dm-9U; Wed, 30 Dec 2015 10:12:37 -0600\nTo:  wendy.laws@hil"..., 2420) = 2420
[pid 25544] 10:12:39.086907 write(11, "\n--1451491959-eximdsn-2046906309--\n", 35) = 35
[pid 25544] 10:12:39.086941 close(11)   = 0
[pid 25544] 10:12:39.086973 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:39.087015 wait4(25595,  <unfinished ...>
[pid 25590] 10:12:39.087099 read(14, "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25590] 10:12:39.087156 read(14, "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25590] 10:12:39.087270 read(14, "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25590] 10:12:39.087369 read(14, "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25590] 10:12:39.087571 read(14, "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25590] 10:12:39.087692 read(14, "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25590] 10:12:39.087797 read(14, "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25590] 10:12:39.087900 read(14, "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25590] 10:12:39.087992 read(14, "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25590] 10:12:39.088078 read(14, "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25590] 10:12:39.088170 read(14, "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25590] 10:12:39.088220 brk(0xc58000) = 0xc58000
[pid 25590] 10:12:39.088297 read(14, "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25590] 10:12:39.088395 read(14, ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25590] 10:12:39.088627 read(14, "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25590] 10:12:39.088682 read(14, "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25590] 10:12:39.088769 read(14, ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25590] 10:12:39.088861 read(14, "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25590] 10:12:39.088947 read(14, "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25590] 10:12:39.089030 read(14, "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25590] 10:12:39.089120 read(14, "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25590] 10:12:39.089209 read(14, "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25590] 10:12:39.089292 read(14, "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25590] 10:12:39.089345 read(14, "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25590] 10:12:39.089544 read(14, "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25590] 10:12:39.089641 read(14, "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25590] 10:12:39.089746 read(14, "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25590] 10:12:39.089841 read(14, "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25590] 10:12:39.089934 read(14, "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25590] 10:12:39.090044 read(14, "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25590] 10:12:39.090093 read(14, "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25590] 10:12:39.090183 read(14, ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25590] 10:12:39.090231 read(14, "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25590] 10:12:39.090315 read(14, "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25590] 10:12:39.090365 read(14, "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25590] 10:12:39.090549 read(14, ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25590] 10:12:39.090655 read(14, "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25590] 10:12:39.090715 read(14, "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25590] 10:12:39.090821 read(14, "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25590] 10:12:39.090919 read(14, "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25590] 10:12:39.090966 brk(0xc79000) = 0xc79000
[pid 25590] 10:12:39.091057 read(14, "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25590] 10:12:39.091168 read(14, ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25590] 10:12:39.091222 read(14, "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25590] 10:12:39.091312 read(14, "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25590] 10:12:39.091491 read(14, " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25590] 10:12:39.091553 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25590] 10:12:39.091690 read(14, ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25590] 10:12:39.091744 read(14, "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25590] 10:12:39.091842 read(14, "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25590] 10:12:39.091937 read(14, "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25590] 10:12:39.091986 read(14, "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25590] 10:12:39.092074 read(14, "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25590] 10:12:39.092124 read(14, "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25590] 10:12:39.092207 read(14, "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25590] 10:12:39.092258 read(14, "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25590] 10:12:39.092352 read(14, "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25590] 10:12:39.092528 read(14, "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25590] 10:12:39.092622 read(14, "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25590] 10:12:39.092682 read(14, "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25590] 10:12:39.092791 read(14, "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25590] 10:12:39.092882 read(14, "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25590] 10:12:39.092972 read(14, ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25590] 10:12:39.093066 read(14, ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25590] 10:12:39.093155 read(14, ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25590] 10:12:39.093241 read(14, "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25590] 10:12:39.093327 read(14, ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25590] 10:12:39.093510 read(14, "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25590] 10:12:39.093568 read(14, ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25590] 10:12:39.093662 read(14, "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25590] 10:12:39.093729 brk(0xc9a000) = 0xc9a000
[pid 25590] 10:12:39.093792 read(14, "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25590] 10:12:39.093841 read(14, "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25590] 10:12:39.093930 read(14, ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25590] 10:12:39.093981 read(14, "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25590] 10:12:39.094065 read(14, "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25590] 10:12:39.094155 read(14, ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25590] 10:12:39.094257 read(14, "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25590] 10:12:39.094357 read(14, "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25590] 10:12:39.094510 read(14, "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25590] 10:12:39.094640 read(14, ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25590] 10:12:39.094700 read(14, "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25590] 10:12:39.094807 read(14, "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25590] 10:12:39.094856 read(14, "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25590] 10:12:39.094944 read(14, "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25590] 10:12:39.094994 read(14, "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25590] 10:12:39.095081 read(14, "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25590] 10:12:39.095131 read(14, "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25590] 10:12:39.095219 read(14, "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25590] 10:12:39.095313 read(14, "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25590] 10:12:39.095366 read(14, "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25590] 10:12:39.095559 read(14, ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25590] 10:12:39.095614 read(14, "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25590] 10:12:39.095715 read(14, "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25590] 10:12:39.095809 read(14, "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
Process 25595 attached
[pid 25590] 10:12:39.095932 read(14,  <unfinished ...>
[pid 25595] 10:12:39.095971 set_robust_list(0x7fa692c09aa0, 24) = 0
[pid 25595] 10:12:39.096030 close(0)    = 0
[pid 25595] 10:12:39.096121 dup2(10, 0 <unfinished ...>
[pid 25590] 10:12:39.096144 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25590] 10:12:39.096303 read(14,  <unfinished ...>
[pid 25595] 10:12:39.096330 <... dup2 resumed> ) = 0
[pid 25595] 10:12:39.096350 close(10)   = 0
[pid 25595] 10:12:39.096382 close(11)   = 0
[pid 25595] 10:12:39.096476 fstat(0,  <unfinished ...>
[pid 25590] 10:12:39.096506 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25590] 10:12:39.096542 read(14,  <unfinished ...>
[pid 25595] 10:12:39.096562 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130171192, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.096595 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25595] 10:12:39.096639 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25590] 10:12:39.096683 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25595] 10:12:39.096718 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMb-0006dm-9U"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25590] 10:12:39.096879 read(14, "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25590] 10:12:39.097289 read(14, "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25590] 10:12:39.097393 read(14, ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25590] 10:12:39.097627 brk(0xcbb000) = 0xcbb000
[pid 25590] 10:12:39.097679 read(14, "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25590] 10:12:39.097727 read(14, "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25590] 10:12:39.097819 read(14,  <unfinished ...>
[pid 25595] 10:12:39.097883 <... execve resumed> ) = 0
[pid 25595] 10:12:39.097922 brk(0 <unfinished ...>
[pid 25590] 10:12:39.097950 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25590] 10:12:39.098032 read(14,  <unfinished ...>
[pid 25595] 10:12:39.098054 <... brk resumed> ) = 0x1585000
[pid 25595] 10:12:39.098076 fcntl(0, F_GETFD) = 0
[pid 25595] 10:12:39.098108 fcntl(1, F_GETFD) = 0
[pid 25595] 10:12:39.098138 fcntl(2, F_GETFD) = 0
[pid 25595] 10:12:39.098173 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f883000
[pid 25595] 10:12:39.098285 access("/etc/ld.so.preload", R_OK <unfinished ...>
[pid 25590] 10:12:39.098310 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25590] 10:12:39.098383 read(14,  <unfinished ...>
[pid 25595] 10:12:39.098494 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098536 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098585 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098623 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098662 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.098700 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25595] 10:12:39.098723 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.098752 read(14,  <unfinished ...>
[pid 25595] 10:12:39.098775 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098793 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.098836 <... read resumed> "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25595] 10:12:39.098858 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.098929 read(14,  <unfinished ...>
[pid 25595] 10:12:39.098956 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.098975 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25595] 10:12:39.099025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099070 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099108 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099153 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099192 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.099233 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25590] 10:12:39.099305 read(14,  <unfinished ...>
[pid 25595] 10:12:39.099327 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099370 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099527 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.099588 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099628 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099665 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.099703 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25595] 10:12:39.099726 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls",  <unfinished ...>
[pid 25590] 10:12:39.099761 read(14,  <unfinished ...>
[pid 25595] 10:12:39.099784 <... stat resumed> 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099803 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.099841 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffd881da9c0) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.099881 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25590] 10:12:39.100025 read(14,  <unfinished ...>
[pid 25595] 10:12:39.100047 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.100087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.100137 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25595] 10:12:39.100175 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25595] 10:12:39.100218 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f830f879000
[pid 25595] 10:12:39.100254 close(6)    = 0
[pid 25595] 10:12:39.100298 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.100339 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.100378 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.100528 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830f44b000
[pid 25595] 10:12:39.100572 mprotect(0x7f830f461000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.100608 mmap(0x7f830f661000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f830f661000
[pid 25595] 10:12:39.100650 mmap(0x7f830f663000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830f663000
[pid 25595] 10:12:39.100693 close(6)    = 0
[pid 25595] 10:12:39.100731 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.100773 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.100815 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25590] 10:12:39.100848 read(14,  <unfinished ...>
[pid 25595] 10:12:39.100867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.100908 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.100930 <... read resumed> "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25595] 10:12:39.100958 <... open resumed> ) = 6
[pid 25590] 10:12:39.101047 read(14,  <unfinished ...>
[pid 25595] 10:12:39.101070 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.101109 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.101154 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f878000
[pid 25595] 10:12:39.101192 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830f232000
[pid 25595] 10:12:39.101227 mprotect(0x7f830f248000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.101262 mmap(0x7f830f447000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f830f447000
[pid 25595] 10:12:39.101309 mmap(0x7f830f449000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830f449000
[pid 25595] 10:12:39.101351 close(6)    = 0
[pid 25595] 10:12:39.101389 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.101531 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25590] 10:12:39.101633 read(14,  <unfinished ...>
[pid 25595] 10:12:39.101663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.101706 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.101750 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25595] 10:12:39.101789 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.101827 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.101872 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830effb000
[pid 25595] 10:12:39.101908 mprotect(0x7f830f002000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.101942 mmap(0x7f830f202000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f830f202000
[pid 25595] 10:12:39.101984 mmap(0x7f830f204000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830f204000
[pid 25595] 10:12:39.102026 close(6 <unfinished ...>
[pid 25590] 10:12:39.102048 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25590] 10:12:39.102142 read(14,  <unfinished ...>
[pid 25595] 10:12:39.102165 <... close resumed> ) = 0
[pid 25595] 10:12:39.102187 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102228 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102271 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102310 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25595] 10:12:39.102350 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.102389 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.102546 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830ed77000
[pid 25595] 10:12:39.102586 mprotect(0x7f830edfa000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.102621 mmap(0x7f830eff9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f830eff9000
[pid 25590] 10:12:39.102660 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25590] 10:12:39.102757 read(14,  <unfinished ...>
[pid 25595] 10:12:39.102791 close(6)    = 0
[pid 25595] 10:12:39.102831 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102873 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102913 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.102953 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25595] 10:12:39.102992 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.103030 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25595] 10:12:39.103075 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f877000
[pid 25595] 10:12:39.103113 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830eb69000
[pid 25590] 10:12:39.103150 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25590] 10:12:39.103185 read(14,  <unfinished ...>
[pid 25595] 10:12:39.103204 mprotect(0x7f830eb75000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.103239 mmap(0x7f830ed75000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f830ed75000
[pid 25590] 10:12:39.103277 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25595] 10:12:39.103307 close(6 <unfinished ...>
[pid 25590] 10:12:39.103498 read(14,  <unfinished ...>
[pid 25595] 10:12:39.103530 <... close resumed> ) = 0
[pid 25595] 10:12:39.103562 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.103607 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.103652 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25595] 10:12:39.103698 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830e946000
[pid 25595] 10:12:39.103735 mprotect(0x7f830e967000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.103770 mmap(0x7f830eb67000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f830eb67000
[pid 25595] 10:12:39.103812 close(6)    = 0
[pid 25595] 10:12:39.103849 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.103872 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25595] 10:12:39.103900 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25449] 10:12:39.103937 <... select resumed> ) = 1 (in [11], left {596, 302543})
[pid 25449] 10:12:39.103964 recvfrom(11, "250 OK\r\n", 4096, 0, NULL, NULL) = 8
[pid 25449] 10:12:39.104013 write(9, "salesadmin@phoenixmarriottmesa.com\n", 35) = 35
[pid 25449] 10:12:39.104059 write(9, "rivankovich@phoenixmarriottmesa.com\n", 36) = 36
[pid 25449] 10:12:39.104095 fsync(9 <unfinished ...>
[pid 25595] 10:12:39.104138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.104371 read(14,  <unfinished ...>
[pid 25595] 10:12:39.104484 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25449] 10:12:39.104499 <... fsync resumed> ) = 0
[pid 25449] 10:12:39.104534 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25449] 10:12:39.104591 alarm(60)   = 0
[pid 25449] 10:12:39.104625 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25449] 10:12:39.104670 alarm(0)    = 60
[pid 25449] 10:12:39.104725 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25449] 10:12:39.104771 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25449] 10:12:39.104816 read(15, "cpu  123106 1342509 395328 67343123 2509 0 0 0\ncpu0 123106 1342509 395328 67343123 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58678892\nbtime 1450798266\nprocesses 893073\nprocs_running 4\nprocs_blocked 0\n", 8192) = 191
[pid 25449] 10:12:39.104874 close(15)   = 0
[pid 25449] 10:12:39.104931 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25449] 10:12:39.104992 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25449] 10:12:39.105033 fcntl(15, F_GETFD) = 0
[pid 25449] 10:12:39.105064 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25449] 10:12:39.105097 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25449] 10:12:39.105144 close(15)   = 0
[pid 25449] 10:12:39.105185 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25449] 10:12:39.105225 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25449] 10:12:39.105343 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25449] 10:12:39.105389 fcntl(15, F_GETFD) = 0
[pid 25449] 10:12:39.105505 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25449] 10:12:39.105541 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25449] 10:12:39.105600 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25449] 10:12:39.105654 pread(15, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25449] 10:12:39.105716 close(15)   = 0
[pid 25449] 10:12:39.105775 close(14)   = 0
[pid 25449] 10:12:39.105816 sendto(11, "QUIT\r\n", 6, 0, NULL, 0) = 6
[pid 25449] 10:12:39.105880 close(11)   = 0
[pid 25449] 10:12:39.105954 close(13)   = 0
[pid 25449] 10:12:39.105991 munmap(0x7f816929f000, 4096) = 0
[pid 25449] 10:12:39.106028 close(10)   = 0
[pid 25449] 10:12:39.106061 munmap(0x7f81692a0000, 4096) = 0
[pid 25449] 10:12:39.106106 write(12, "S000004`\f\0\0", 11) = 11
[pid 25411] 10:12:39.106144 <... select resumed> ) = 1 (in [11], left {55, 645102})
[pid 25449] 10:12:39.106177 write(12, "D000004\1\0\0\0", 11 <unfinished ...>
[pid 25411] 10:12:39.106186 read(11,  <unfinished ...>
[pid 25449] 10:12:39.106212 <... write resumed> ) = 11
[pid 25411] 10:12:39.106218 <... read resumed> "S000004`\f\0\0", 16384) = 11
[pid 25449] 10:12:39.106247 write(12, "A000062\0=\0\0\5\0\0\0\0\0\0\000250 OK\0\0phoenixmarriottmesa.com\00069.53.212.18\0\31\0\0\0000", 69 <unfinished ...>
[pid 25411] 10:12:39.106256 wait4(-1,  <unfinished ...>
[pid 25449] 10:12:39.106279 <... write resumed> ) = 69
[pid 25411] 10:12:39.106284 <... wait4 resumed> 0x7ffdf4a546e0, WNOHANG, NULL) = 0
[pid 25449] 10:12:39.106309 write(12, "D000004\1\0\0\0", 11 <unfinished ...>
[pid 25411] 10:12:39.106317 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25449] 10:12:39.106345 <... write resumed> ) = 11
[pid 25411] 10:12:39.106350 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25449] 10:12:39.106377 write(12, "A000062\0-\0\0\5\0\0\0\0\0\0\000250 OK\0\0phoenixmarriottmesa.com\00069.53.212.18\0\31\0\0\0000", 69 <unfinished ...>
[pid 25411] 10:12:39.106386 read(11,  <unfinished ...>
[pid 25449] 10:12:39.106506 <... write resumed> ) = 69
[pid 25411] 10:12:39.106516 <... read resumed> "D000004\1\0\0\0A000062\0=\0\0\5\0\0\0\0\0\0\000250 OK\0\0phoenixmarriottmesa.com\00069.53.212.18\0\31\0\0\0000D000004\1\0\0\0", 16384) = 91
[pid 25449] 10:12:39.106558 write(12, "I00002050.116.78.207\00047463\0", 27 <unfinished ...>
[pid 25411] 10:12:39.106567 wait4(-1,  <unfinished ...>
[pid 25449] 10:12:39.106596 <... write resumed> ) = 27
[pid 25411] 10:12:39.106602 <... wait4 resumed> 0x7ffdf4a546e0, WNOHANG, NULL) = 0
[pid 25449] 10:12:39.106626 write(12, "Z0000010", 8 <unfinished ...>
[pid 25411] 10:12:39.106635 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25449] 10:12:39.106661 <... write resumed> ) = 8
[pid 25411] 10:12:39.106667 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25449] 10:12:39.106691 close(12 <unfinished ...>
[pid 25411] 10:12:39.106697 read(11,  <unfinished ...>
[pid 25449] 10:12:39.106719 <... close resumed> ) = 0
[pid 25411] 10:12:39.106725 <... read resumed> "A000062\0-\0\0\5\0\0\0\0\0\0\000250 OK\0\0phoenixmarriottmesa.com\00069.53.212.18\0\31\0\0\0000I00002050.116.78.207\00047463\0Z0000010", 16384) = 104
[pid 25449] 10:12:39.107128 exit_group(0) = ?
[pid 25411] 10:12:39.107138 close(11 <unfinished ...>
[pid 25449] 10:12:39.107648 +++ exited with 0 +++
[pid 25411] 10:12:39.107655 <... close resumed> ) = 0
[pid 25411] 10:12:39.107680 wait4(25449, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25449
[pid 25411] 10:12:39.107747 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.107814 write(8, "2015-12-30 10:12:39 salesadmin@phoenixmarriottmesa.com: remote_smtp transport succeeded\n", 88) = 88
[pid 25411] 10:12:39.107872 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.107930 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.107979 close(7)    = 0
[pid 25411] 10:12:39.108015 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25411] 10:12:39.108058 fcntl(7, F_GETFD) = 0
[pid 25411] 10:12:39.108089 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:39.108121 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5393696, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.108164 write(7, "2015-12-30 10:12:39 [25411] 1aEJMX-0006bl-RX => salesadmin@phoenixmarriottmesa.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3168 H=phoenixmarriottmesa.com [69.53.212.18]:"..., 282) = 282
[pid 25411] 10:12:39.108207 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.108261 write(8, "2015-12-30 10:12:39 rivankovich@phoenixmarriottmesa.com: remote_smtp transport succeeded\n", 89) = 89
[pid 25411] 10:12:39.108305 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.108358 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.108489 close(7)    = 0
[pid 25411] 10:12:39.108537 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25411] 10:12:39.108583 fcntl(7, F_GETFD) = 0
[pid 25411] 10:12:39.108614 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:39.108646 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5393978, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.108690 write(7, "2015-12-30 10:12:39 [25411] 1aEJMX-0006bl-RX -> rivankovich@phoenixmarriottmesa.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3168 H=phoenixmarriottmesa.com [69.53.212.18]"..., 283) = 283
[pid 25411] 10:12:39.108732 geteuid()   = 0
[pid 25411] 10:12:39.108763 getegid()   = 12
[pid 25411] 10:12:39.108797 setgid(12)  = 0
[pid 25411] 10:12:39.108829 setuid(47)  = 0
[pid 25411] 10:12:39.108866 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25411] 10:12:39.108913 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.108965 pipe([10, 11]) = 0
[pid 25411] 10:12:39.109002 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:39.109042 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f816928aa90) = 25596
[pid 25411] 10:12:39.109307 close(10)   = 0
[pid 25411] 10:12:39.109341 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25411] 10:12:39.109381 fstat(11, {st_dev=makedev(0, 8), st_ino=2130171202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.109509 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:39.109553 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25411] 10:12:39.109662 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:33, st_mtime=2015/12/30-10:12:33, st_ctime=2015/12/30-10:12:33}) = 0
[pid 25411] 10:12:39.109710 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1054) = 1054
[pid 25411] 10:12:39.109764 lseek(6, 19, SEEK_SET) = 19
[pid 25411] 10:12:39.109797 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25411] 10:12:39.109846 read(6, "", 8192) = 0
[pid 25411] 10:12:39.109879 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bl-RX; Wed, 30 Dec 2015 10:12:33 -0600\nTo:  salesadmin@pho"..., 2474) = 2474
[pid 25411] 10:12:39.109917 write(11, "\n--1451491959-eximdsn-467078250--\n", 34) = 34
[pid 25411] 10:12:39.109951 close(11)   = 0
[pid 25411] 10:12:39.109982 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:39.110024 wait4(25596,  <unfinished ...>
[pid 25595] 10:12:39.110052 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.110074 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25595] 10:12:39.110114 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.110158 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.110204 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830e729000
[pid 25595] 10:12:39.110242 mprotect(0x7f830e740000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.110278 mmap(0x7f830e940000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f830e940000
[pid 25595] 10:12:39.110321 mmap(0x7f830e942000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830e942000
[pid 25590] 10:12:39.110362 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25595] 10:12:39.110391 close(6 <unfinished ...>
[pid 25590] 10:12:39.110591 read(14,  <unfinished ...>
[pid 25595] 10:12:39.110617 <... close resumed> ) = 0
[pid 25595] 10:12:39.110648 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.110692 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.110733 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.110832 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25595] 10:12:39.110874 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.110913 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.110958 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f876000
[pid 25595] 10:12:39.110997 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830e3b5000
[pid 25595] 10:12:39.111033 mprotect(0x7f830e524000, 2093056, PROT_NONE) = 0
[pid 25590] 10:12:39.111071 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25590] 10:12:39.111163 read(14,  <unfinished ...>
[pid 25595] 10:12:39.111185 mmap(0x7f830e723000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f830e723000
[pid 25595] 10:12:39.111235 close(6)    = 0
[pid 25595] 10:12:39.111276 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.111322 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.111362 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.111475 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25590] 10:12:39.111534 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25595] 10:12:39.111559 read(6,  <unfinished ...>
[pid 25590] 10:12:39.111638 read(14,  <unfinished ...>
[pid 25595] 10:12:39.111662 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.111687 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25595] 10:12:39.111733 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830e126000
[pid 25595] 10:12:39.111769 mprotect(0x7f830e1b1000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.111805 mmap(0x7f830e3b1000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f830e3b1000
[pid 25595] 10:12:39.111849 mmap(0x7f830e3b4000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830e3b4000
[pid 25595] 10:12:39.111891 close(6)    = 0
[pid 25595] 10:12:39.111931 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.111973 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25590] 10:12:39.112060 read(14,  <unfinished ...>
[pid 25595] 10:12:39.112083 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.112125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.112164 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.112203 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.112240 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25595] 10:12:39.112290 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830df20000
[pid 25595] 10:12:39.112327 mprotect(0x7f830df26000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.112362 mmap(0x7f830e125000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f830e125000
[pid 25595] 10:12:39.112497 close(6 <unfinished ...>
[pid 25590] 10:12:39.112528 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25590] 10:12:39.112565 read(14,  <unfinished ...>
[pid 25595] 10:12:39.112585 <... close resumed> ) = 0
[pid 25595] 10:12:39.112609 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.112632 <... read resumed> "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25595] 10:12:39.112659 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.112737 read(14,  <unfinished ...>
[pid 25595] 10:12:39.112759 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25595] 10:12:39.112801 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.112840 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.112885 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f875000
[pid 25595] 10:12:39.112923 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830dbea000
[pid 25595] 10:12:39.112958 mprotect(0x7f830dd16000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.112993 mmap(0x7f830df16000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f830df16000
[pid 25595] 10:12:39.113037 mmap(0x7f830df1f000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830df1f000
[pid 25590] 10:12:39.113075 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25590] 10:12:39.113108 read(14,  <unfinished ...>
[pid 25595] 10:12:39.113133 close(6)    = 0
[pid 25595] 10:12:39.113171 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.113194 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25590] 10:12:39.113271 read(14,  <unfinished ...>
[pid 25595] 10:12:39.113298 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.113318 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.113364 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.113525 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.113574 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.113619 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.113667 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830d9e6000
[pid 25595] 10:12:39.113706 mprotect(0x7f830d9e8000, 2097152, PROT_NONE <unfinished ...>
[pid 25590] 10:12:39.113726 <... read resumed> "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25595] 10:12:39.113754 <... mprotect resumed> ) = 0
[pid 25590] 10:12:39.113837 read(14,  <unfinished ...>
[pid 25595] 10:12:39.113860 mmap(0x7f830dbe8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f830dbe8000
[pid 25595] 10:12:39.113907 close(6)    = 0
[pid 25595] 10:12:39.113947 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.113988 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.114028 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.114067 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25595] 10:12:39.114106 read(6,  <unfinished ...>
[pid 25590] 10:12:39.114125 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25595] 10:12:39.114148 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25590] 10:12:39.114223 read(14,  <unfinished ...>
[pid 25595] 10:12:39.114246 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.114292 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830d7e3000
[pid 25595] 10:12:39.114329 mprotect(0x7f830d7e5000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.114365 mmap(0x7f830d9e4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f830d9e4000
[pid 25595] 10:12:39.114501 close(6)    = 0
[pid 25595] 10:12:39.114544 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.114588 <... read resumed> "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25595] 10:12:39.114611 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.114644 brk(0xcdc000 <unfinished ...>
[pid 25595] 10:12:39.114672 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.114691 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.114730 <... brk resumed> ) = 0xcdc000
[pid 25590] 10:12:39.114754 read(14,  <unfinished ...>
[pid 25595] 10:12:39.114774 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25590] 10:12:39.114816 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25590] 10:12:39.114896 read(14,  <unfinished ...>
[pid 25595] 10:12:39.114918 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.114957 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.115001 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f874000
[pid 25595] 10:12:39.115040 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830d44f000
[pid 25595] 10:12:39.115076 mprotect(0x7f830d5d9000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.115111 mmap(0x7f830d7d9000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f830d7d9000
[pid 25595] 10:12:39.115152 mmap(0x7f830d7de000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830d7de000
[pid 25595] 10:12:39.115193 close(6 <unfinished ...>
[pid 25590] 10:12:39.115215 <... read resumed> "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25595] 10:12:39.115237 <... close resumed> ) = 0
[pid 25595] 10:12:39.115262 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.115350 read(14,  <unfinished ...>
[pid 25595] 10:12:39.115377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.115484 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.115535 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.115575 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25595] 10:12:39.115620 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.115659 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25595] 10:12:39.115704 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830d1e3000
[pid 25595] 10:12:39.115742 mprotect(0x7f830d245000, 2093056, PROT_NONE) = 0
[pid 25590] 10:12:39.115778 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25595] 10:12:39.115801 mmap(0x7f830d444000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000 <unfinished ...>
[pid 25590] 10:12:39.115883 read(14,  <unfinished ...>
[pid 25595] 10:12:39.115910 <... mmap resumed> ) = 0x7f830d444000
[pid 25595] 10:12:39.115938 close(6)    = 0
[pid 25595] 10:12:39.115980 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.116024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.116073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.116115 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25590] 10:12:39.116157 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25590] 10:12:39.116246 read(14,  <unfinished ...>
[pid 25595] 10:12:39.116269 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.116307 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25595] 10:12:39.116352 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830ce00000
[pid 25595] 10:12:39.116389 mprotect(0x7f830cfb9000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.116532 mmap(0x7f830d1b8000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f830d1b8000
[pid 25595] 10:12:39.116582 mmap(0x7f830d1df000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830d1df000
[pid 25595] 10:12:39.116627 close(6)    = 0
[pid 25595] 10:12:39.116668 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.116717 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25595] 10:12:39.116740 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.116841 read(14,  <unfinished ...>
[pid 25595] 10:12:39.116870 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.116889 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.116929 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25595] 10:12:39.116968 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.117006 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25595] 10:12:39.117050 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f873000
[pid 25595] 10:12:39.117089 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830cbd3000
[pid 25595] 10:12:39.117125 mprotect(0x7f830cbff000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.117159 mmap(0x7f830cdff000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f830cdff000
[pid 25595] 10:12:39.117202 close(6)    = 0
[pid 25595] 10:12:39.117240 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25590] 10:12:39.117283 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25590] 10:12:39.117391 read(14,  <unfinished ...>
[pid 25595] 10:12:39.117508 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.117551 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25595] 10:12:39.117597 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830c9ce000
[pid 25595] 10:12:39.117634 mprotect(0x7f830c9d3000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.117669 mmap(0x7f830cbd2000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f830cbd2000
[pid 25595] 10:12:39.117710 close(6)    = 0
[pid 25595] 10:12:39.117754 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.117803 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.117844 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.117883 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25590] 10:12:39.117921 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25595] 10:12:39.117943 read(6,  <unfinished ...>
[pid 25590] 10:12:39.118018 read(14,  <unfinished ...>
[pid 25595] 10:12:39.118041 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.118065 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25595] 10:12:39.118110 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830c7cb000
[pid 25595] 10:12:39.118148 mprotect(0x7f830c7cd000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.118183 mmap(0x7f830c9cc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f830c9cc000
[pid 25595] 10:12:39.118228 close(6)    = 0
[pid 25595] 10:12:39.118271 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.118324 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25595] 10:12:39.118348 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.118541 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.118584 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25595] 10:12:39.118624 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25590] 10:12:39.118714 read(14,  <unfinished ...>
[pid 25595] 10:12:39.118736 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25595] 10:12:39.118782 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f872000
[pid 25595] 10:12:39.118824 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830c5a8000
[pid 25595] 10:12:39.118868 mprotect(0x7f830c5bf000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.118904 mmap(0x7f830c7bf000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f830c7bf000
[pid 25595] 10:12:39.118951 close(6)    = 0
[pid 25595] 10:12:39.119005 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.119029 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25590] 10:12:39.119122 read(14,  <unfinished ...>
[pid 25595] 10:12:39.119150 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119170 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119211 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119250 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.119289 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.119326 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.119371 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830c364000
[pid 25595] 10:12:39.119520 mprotect(0x7f830c3a5000, 2097152, PROT_NONE <unfinished ...>
[pid 25590] 10:12:39.119549 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25595] 10:12:39.119579 <... mprotect resumed> ) = 0
[pid 25590] 10:12:39.119671 read(14,  <unfinished ...>
[pid 25595] 10:12:39.119694 mmap(0x7f830c5a5000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f830c5a5000
[pid 25595] 10:12:39.119743 close(6)    = 0
[pid 25595] 10:12:39.119784 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119826 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119866 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.119905 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25595] 10:12:39.119943 read(6,  <unfinished ...>
[pid 25590] 10:12:39.119963 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25595] 10:12:39.119986 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25590] 10:12:39.120142 read(14,  <unfinished ...>
[pid 25595] 10:12:39.120165 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.120215 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f871000
[pid 25595] 10:12:39.120256 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830c07d000
[pid 25595] 10:12:39.120295 mprotect(0x7f830c158000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.120334 mmap(0x7f830c358000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f830c358000
[pid 25595] 10:12:39.120382 close(6)    = 0
[pid 25595] 10:12:39.120525 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.120577 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.120621 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.120663 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.120704 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.120746 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.120801 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830be79000
[pid 25595] 10:12:39.120843 mprotect(0x7f830be7c000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.120881 mmap(0x7f830c07b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f830c07b000
[pid 25595] 10:12:39.120928 close(6 <unfinished ...>
[pid 25590] 10:12:39.120958 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25590] 10:12:39.121056 read(14,  <unfinished ...>
[pid 25595] 10:12:39.121086 <... close resumed> ) = 0
[pid 25595] 10:12:39.121113 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121157 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121241 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25595] 10:12:39.121282 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.121329 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.121380 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830bc4d000
[pid 25595] 10:12:39.121520 mprotect(0x7f830bc76000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.121567 mmap(0x7f830be76000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000 <unfinished ...>
[pid 25590] 10:12:39.121597 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25595] 10:12:39.121627 <... mmap resumed> ) = 0x7f830be76000
[pid 25590] 10:12:39.121714 read(14,  <unfinished ...>
[pid 25595] 10:12:39.121749 mmap(0x7f830be78000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830be78000
[pid 25595] 10:12:39.121793 close(6)    = 0
[pid 25595] 10:12:39.121837 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121881 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121923 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.121963 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25590] 10:12:39.122007 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25595] 10:12:39.122030 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25590] 10:12:39.122161 read(14,  <unfinished ...>
[pid 25595] 10:12:39.122191 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25595] 10:12:39.122239 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f870000
[pid 25595] 10:12:39.122279 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830ba37000
[pid 25595] 10:12:39.122318 mprotect(0x7f830ba4c000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.122355 mmap(0x7f830bc4b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f830bc4b000
[pid 25595] 10:12:39.122491 close(6)    = 0
[pid 25595] 10:12:39.122559 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.122621 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:39.122666 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25595] 10:12:39.122691 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY <unfinished ...>
[pid 25590] 10:12:39.122770 read(14,  <unfinished ...>
[pid 25595] 10:12:39.122802 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.122823 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25595] 10:12:39.122865 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.122906 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.122953 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830b82c000
[pid 25595] 10:12:39.122993 mprotect(0x7f830b836000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.123030 mmap(0x7f830ba35000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f830ba35000
[pid 25590] 10:12:39.123069 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25590] 10:12:39.123149 read(14,  <unfinished ...>
[pid 25595] 10:12:39.123195 close(6)    = 0
[pid 25595] 10:12:39.123237 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.123280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.123322 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.123363 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25590] 10:12:39.123495 <... read resumed> "", 4096) = 0
[pid 25595] 10:12:39.123521 read(6,  <unfinished ...>
[pid 25590] 10:12:39.123570 close(14 <unfinished ...>
[pid 25595] 10:12:39.123597 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.123623 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25595] 10:12:39.123672 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830b629000
[pid 25590] 10:12:39.123755 <... close resumed> ) = 0
[pid 25590] 10:12:39.123778 munmap(0x7ff9b2d3f000, 4096 <unfinished ...>
[pid 25595] 10:12:39.123804 mprotect(0x7f830b62b000, 2093056, PROT_NONE <unfinished ...>
[pid 25590] 10:12:39.123835 <... munmap resumed> ) = 0
[pid 25595] 10:12:39.123857 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.123875 mmap(0x7f830b82a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f830b82a000
[pid 25595] 10:12:39.124507 close(6)    = 0
[pid 25595] 10:12:39.124562 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f86f000
[pid 25595] 10:12:39.124617 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.124663 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.124705 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.124746 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25595] 10:12:39.124785 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.124825 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25595] 10:12:39.124874 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f830b40a000
[pid 25595] 10:12:39.124914 mprotect(0x7f830b427000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.124951 mmap(0x7f830b626000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f830b626000
[pid 25595] 10:12:39.124996 mmap(0x7f830b628000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f830b628000
[pid 25595] 10:12:39.125040 close(6)    = 0
[pid 25595] 10:12:39.125109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f86e000
[pid 25595] 10:12:39.125182 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f86d000
[pid 25595] 10:12:39.125228 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f86b000
[pid 25595] 10:12:39.125268 arch_prctl(ARCH_SET_FS, 0x7f830f86b7c0) = 0
[pid 25595] 10:12:39.125344 mprotect(0x7f830b626000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125386 mprotect(0x7f830b82a000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125525 mprotect(0x7f830ba35000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125580 mprotect(0x7f830bc4b000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125634 mprotect(0x7f830be76000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125686 mprotect(0x7f830c07b000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.125845 mprotect(0x7f830c358000, 40960, PROT_READ) = 0
[pid 25595] 10:12:39.126027 mprotect(0x7f830c5a5000, 4096, PROT_READ <unfinished ...>
[pid 25590] 10:12:39.126322 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25595] 10:12:39.126358 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.126389 mprotect(0x7f830c7bf000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.126481 mprotect(0x7f830c9cc000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.126729 mprotect(0x7f830d1b8000, 110592, PROT_READ <unfinished ...>
[pid 25590] 10:12:39.126777 <... open resumed> ) = 14
[pid 25590] 10:12:39.126804 fstat(14, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25590] 10:12:39.126854 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d3f000
[pid 25590] 10:12:39.126892 read(14, "MemTotal:        1048576 kB\nMemFree:          240196 kB\nCached:           338344 kB\nBuffers:               0 kB\nActive:           308884 kB\nInactive:         468056 kB\nActive(anon):     168796 kB\nInactive(anon):   277604 kB\nActive(file):     140088 kB\nInac"..., 1024) = 588
[pid 25590] 10:12:39.126977 close(14 <unfinished ...>
[pid 25595] 10:12:39.127009 <... mprotect resumed> ) = 0
[pid 25590] 10:12:39.127033 <... close resumed> ) = 0
[pid 25595] 10:12:39.127129 mprotect(0x7f830d444000, 16384, PROT_READ <unfinished ...>
[pid 25590] 10:12:39.127158 munmap(0x7ff9b2d3f000, 4096) = 0
[pid 25595] 10:12:39.127381 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.127551 mprotect(0x7f830d7d9000, 16384, PROT_READ) = 0
[pid 25595] 10:12:39.127600 mprotect(0x7f830d9e4000, 4096, PROT_READ <unfinished ...>
[pid 25590] 10:12:39.128147 alarm(300 <unfinished ...>
[pid 25595] 10:12:39.128179 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.128208 mprotect(0x7f830dbe8000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.128969 mprotect(0x7f830e940000, 4096, PROT_READ <unfinished ...>
[pid 25590] 10:12:39.129008 <... alarm resumed> ) = 0
[pid 25590] 10:12:39.129047 brk(0xcff000) = 0xcff000
[pid 25590] 10:12:39.129128 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2wsd\0\262\305\317\f\32\205\267\321K\232O^\n\330\233\216/\33\2\342\4\217\216L\333\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258) = 258
[pid 25590] 10:12:39.129204 read(11, Process 25596 attached
 <unfinished ...>
[pid 25596] 10:12:39.129269 set_robust_list(0x7f816928aaa0, 24) = 0
[pid 25595] 10:12:39.129307 <... mprotect resumed> ) = 0
[pid 25596] 10:12:39.129350 close(0 <unfinished ...>
[pid 25595] 10:12:39.129449 mprotect(0x7f830ed75000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.129494 <... close resumed> ) = 0
[pid 25596] 10:12:39.129563 dup2(10, 0 <unfinished ...>
[pid 25595] 10:12:39.129602 mprotect(0x7f830eff9000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.129651 mprotect(0x7f830f202000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.129704 mprotect(0x7f830f447000, 4096, PROT_READ) = 0
[pid 25595] 10:12:39.129752 mprotect(0x7f830f661000, 4096, PROT_READ <unfinished ...>
[pid 25596] 10:12:39.129779 <... dup2 resumed> ) = 0
[pid 25596] 10:12:39.129797 close(10)   = 0
[pid 25596] 10:12:39.129830 close(11)   = 0
[pid 25595] 10:12:39.129866 <... mprotect resumed> ) = 0
[pid 25596] 10:12:39.129898 fstat(0,  <unfinished ...>
[pid 25595] 10:12:39.129950 mprotect(0x7f830f884000, 4096, PROT_READ <unfinished ...>
[pid 25596] 10:12:39.129976 <... fstat resumed> {st_dev=makedev(0, 8), st_ino=2130171202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.130010 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25596] 10:12:39.130055 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25596] 10:12:39.130111 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMX-0006bl-RX"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "] <unfinished ...>
[pid 25595] 10:12:39.130214 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.130549 munmap(0x7f830f879000, 39387) = 0
[pid 25595] 10:12:39.130600 set_tid_address(0x7f830f86ba90) = 25595
[pid 25595] 10:12:39.130634 set_robust_list(0x7f830f86baa0, 24) = 0
[pid 25595] 10:12:39.130666 futex(0x7ffd881db2bc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25595] 10:12:39.130700 futex(0x7ffd881db2bc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f830f86b7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25595] 10:12:39.130741 rt_sigaction(SIGRTMIN, {0x7f830e72ec60, [], SA_RESTORER|SA_SIGINFO, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.130781 rt_sigaction(SIGRT_1, {0x7f830e72ecf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.130819 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25595] 10:12:39.130863 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25595] 10:12:39.130937 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350309, f_bavail=6350309, f_files=1000000, f_ffree=691064, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25595] 10:12:39.131034 brk(0)      = 0x1585000
[pid 25595] 10:12:39.131070 brk(0x15a6000) = 0x15a6000
[pid 25595] 10:12:39.131113 open("/proc/filesystems", O_RDONLY) = 6
[pid 25595] 10:12:39.131168 fstat(6,  <unfinished ...>
[pid 25596] 10:12:39.131281 <... execve resumed> ) = 0
[pid 25595] 10:12:39.131302 <... fstat resumed> {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.131342 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f882000
[pid 25595] 10:12:39.131380 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25595] 10:12:39.131570 read(6, "", 1024) = 0
[pid 25595] 10:12:39.131614 close(6)    = 0
[pid 25595] 10:12:39.131652 munmap(0x7f830f882000, 4096) = 0
[pid 25595] 10:12:39.131735 access("/usr/share/dracut/modules.d/01fips", F_OK <unfinished ...>
[pid 25596] 10:12:39.131783 brk(0)      = 0x16d1000
[pid 25596] 10:12:39.131818 fcntl(0, F_GETFD) = 0
[pid 25596] 10:12:39.131852 fcntl(1, F_GETFD) = 0
[pid 25596] 10:12:39.131884 fcntl(2, F_GETFD) = 0
[pid 25596] 10:12:39.131921 access("/etc/suid-debug", F_OK <unfinished ...>
[pid 25595] 10:12:39.131955 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.131978 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.132058 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f830e738790},  <unfinished ...>
[pid 25596] 10:12:39.132106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096994000
[pid 25596] 10:12:39.132158 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132207 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132250 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132288 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.132327 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25595] 10:12:39.132358 fstat(2,  <unfinished ...>
[pid 25596] 10:12:39.132385 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132493 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.132523 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25596] 10:12:39.132561 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.132612 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f830e738790},  <unfinished ...>
[pid 25596] 10:12:39.132646 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132685 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.132727 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25596] 10:12:39.132777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.132820 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25595] 10:12:39.132844 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f830d4816a0},  <unfinished ...>
[pid 25596] 10:12:39.132875 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.132916 <... rt_sigaction resumed> {SIG_IGN, [], 0}, 8) = 0
[pid 25595] 10:12:39.132938 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25596] 10:12:39.132983 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.133011 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790},  <unfinished ...>
[pid 25596] 10:12:39.133046 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.133066 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25595] 10:12:39.133095 umask(0 <unfinished ...>
[pid 25596] 10:12:39.133122 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.133162 <... umask resumed> ) = 0
[pid 25596] 10:12:39.133181 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.133246 geteuid( <unfinished ...>
[pid 25596] 10:12:39.133279 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133299 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133342 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133384 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.133521 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.133558 <... geteuid resumed> ) = 0
[pid 25595] 10:12:39.133585 getuid( <unfinished ...>
[pid 25596] 10:12:39.133613 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133633 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64",  <unfinished ...>
[pid 25595] 10:12:39.133659 <... getuid resumed> ) = 47
[pid 25595] 10:12:39.133680 getgid( <unfinished ...>
[pid 25596] 10:12:39.133709 <... stat resumed> 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.133728 <... getgid resumed> ) = 12
[pid 25596] 10:12:39.133747 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.133826 getrlimit(RLIMIT_NOFILE,  <unfinished ...>
[pid 25596] 10:12:39.133857 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133877 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133917 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133957 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffd2e5562c0) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.133996 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.134035 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.134086 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25595] 10:12:39.134125 <... getrlimit resumed> {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25595] 10:12:39.134147 getrlimit(RLIMIT_NPROC,  <unfinished ...>
[pid 25596] 10:12:39.134172 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.134196 <... getrlimit resumed> {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25596] 10:12:39.134217 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25595] 10:12:39.134255 getgroups(65536,  <unfinished ...>
[pid 25596] 10:12:39.134281 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fb09698a000
[pid 25595] 10:12:39.134318 <... getgroups resumed> []) = 0
[pid 25595] 10:12:39.134344 setgroups(0, [] <unfinished ...>
[pid 25596] 10:12:39.134370 close(6)    = 0
[pid 25596] 10:12:39.134499 open("/lib64/libresolv.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.134547 <... setgroups resumed> ) = 0
[pid 25595] 10:12:39.134571 getegid()   = 12
[pid 25595] 10:12:39.134605 geteuid( <unfinished ...>
[pid 25596] 10:12:39.134637 <... open resumed> ) = 6
[pid 25595] 10:12:39.134655 <... geteuid resumed> ) = 0
[pid 25595] 10:12:39.134679 geteuid( <unfinished ...>
[pid 25596] 10:12:39.134704 read(6,  <unfinished ...>
[pid 25595] 10:12:39.134728 <... geteuid resumed> ) = 0
[pid 25596] 10:12:39.134747 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.134774 getegid( <unfinished ...>
[pid 25596] 10:12:39.134800 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.134825 <... getegid resumed> ) = 12
[pid 25595] 10:12:39.134845 setgid(12 <unfinished ...>
[pid 25596] 10:12:39.134870 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.134903 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.134930 <... setgid resumed> ) = 0
[pid 25596] 10:12:39.134951 <... mmap resumed> ) = 0x7fb09655c000
[pid 25595] 10:12:39.134973 setuid(0 <unfinished ...>
[pid 25596] 10:12:39.134998 mprotect(0x7fb096572000, 2097152, PROT_NONE <unfinished ...>
[pid 25595] 10:12:39.135024 <... setuid resumed> ) = 0
[pid 25596] 10:12:39.135046 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.135092 open("/etc/exim.conf", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.135130 mmap(0x7fb096772000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fb096772000
[pid 25596] 10:12:39.135177 mmap(0x7fb096774000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb096774000
[pid 25596] 10:12:39.135220 close(6 <unfinished ...>
[pid 25595] 10:12:39.135251 <... open resumed> ) = 6
[pid 25596] 10:12:39.135270 <... close resumed> ) = 0
[pid 25596] 10:12:39.135294 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.135332 fstat(6,  <unfinished ...>
[pid 25596] 10:12:39.135362 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.135382 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.135508 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.135550 fstat(6,  <unfinished ...>
[pid 25596] 10:12:39.135584 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.135604 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25595] 10:12:39.135641 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25596] 10:12:39.135669 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.135697 <... mmap resumed> ) = 0x7f830f882000
[pid 25596] 10:12:39.135728 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.135749 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25596] 10:12:39.135795 open("/lib64/libnsl.so.1", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.135935 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25596] 10:12:39.135972 <... open resumed> ) = 6
[pid 25596] 10:12:39.135991 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.136032 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.136079 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096989000
[pid 25596] 10:12:39.136121 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb096343000
[pid 25596] 10:12:39.136158 mprotect(0x7fb096359000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.136196 mmap(0x7fb096558000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fb096558000
[pid 25596] 10:12:39.136240 mmap(0x7fb09655a000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb09655a000
[pid 25596] 10:12:39.136284 close(6)    = 0
[pid 25596] 10:12:39.136354 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.136488 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.136550 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.136598 open("/lib64/libcrypt.so.1", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.136632 <... socket resumed> ) = 7
[pid 25596] 10:12:39.136658 <... open resumed> ) = 6
[pid 25595] 10:12:39.136678 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.136726 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.136767 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.136820 close(7 <unfinished ...>
[pid 25596] 10:12:39.136849 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.136881 <... close resumed> ) = 0
[pid 25596] 10:12:39.136903 <... mmap resumed> ) = 0x7fb09610c000
[pid 25595] 10:12:39.136924 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25596] 10:12:39.136960 mprotect(0x7fb096113000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.136997 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.137039 mmap(0x7fb096313000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fb096313000
[pid 25595] 10:12:39.137079 close(7)    = 0
[pid 25596] 10:12:39.137119 mmap(0x7fb096315000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25595] 10:12:39.137156 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.137186 <... mmap resumed> ) = 0x7fb096315000
[pid 25595] 10:12:39.137209 <... open resumed> ) = 7
[pid 25596] 10:12:39.137234 close(6 <unfinished ...>
[pid 25595] 10:12:39.137263 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.137288 <... close resumed> ) = 0
[pid 25596] 10:12:39.137312 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.137341 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25595] 10:12:39.137372 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25596] 10:12:39.137511 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.137541 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25596] 10:12:39.137588 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.137650 read(7,  <unfinished ...>
[pid 25596] 10:12:39.137677 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.137718 open("/lib64/libm.so.6", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.137746 <... read resumed> "", 4096) = 0
[pid 25596] 10:12:39.137771 <... open resumed> ) = 6
[pid 25595] 10:12:39.137791 close(7)    = 0
[pid 25595] 10:12:39.137825 munmap(0x7f830f881000, 4096 <unfinished ...>
[pid 25596] 10:12:39.137850 read(6,  <unfinished ...>
[pid 25595] 10:12:39.137880 <... munmap resumed> ) = 0
[pid 25596] 10:12:39.137899 <... read resumed> "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.137927 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.137965 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.137993 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.138030 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb095e88000
[pid 25596] 10:12:39.138070 mprotect(0x7fb095f0b000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.138113 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.138133 mmap(0x7fb09610a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000 <unfinished ...>
[pid 25595] 10:12:39.138161 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.138192 <... mmap resumed> ) = 0x7fb09610a000
[pid 25595] 10:12:39.138217 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.138246 close(6 <unfinished ...>
[pid 25595] 10:12:39.138273 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.138314 <... close resumed> ) = 0
[pid 25595] 10:12:39.138333 open("/etc/ld.so.cache", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.138366 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.138484 <... open resumed> ) = 7
[pid 25595] 10:12:39.138514 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.138545 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.138566 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25595] 10:12:39.138598 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f830f861000
[pid 25596] 10:12:39.138635 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.138678 close(7)    = 0
[pid 25595] 10:12:39.138726 open("/lib64/libnss_files.so.2", O_RDONLY <unfinished ...>
[pid 25596] 10:12:39.138754 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.138800 <... open resumed> ) = 7
[pid 25596] 10:12:39.138820 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25595] 10:12:39.138861 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.138901 read(6,  <unfinished ...>
[pid 25595] 10:12:39.138926 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.138951 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.138975 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.139006 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.139035 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0 <unfinished ...>
[pid 25596] 10:12:39.139068 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25596] 10:12:39.139099 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25595] 10:12:39.139132 <... mmap resumed> ) = 0x7f830b1fc000
[pid 25596] 10:12:39.139152 <... mmap resumed> ) = 0x7fb096988000
[pid 25596] 10:12:39.139174 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.139201 mprotect(0x7f830b208000, 2097152, PROT_NONE <unfinished ...>
[pid 25596] 10:12:39.139228 <... mmap resumed> ) = 0x7fb095c7a000
[pid 25595] 10:12:39.139251 <... mprotect resumed> ) = 0
[pid 25596] 10:12:39.139270 mprotect(0x7fb095c86000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.139307 mmap(0x7f830b408000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f830b408000
[pid 25596] 10:12:39.139346 mmap(0x7fb095e86000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fb095e86000
[pid 25595] 10:12:39.139392 close(7 <unfinished ...>
[pid 25596] 10:12:39.139539 close(6 <unfinished ...>
[pid 25595] 10:12:39.139567 <... close resumed> ) = 0
[pid 25595] 10:12:39.139604 mprotect(0x7f830b408000, 4096, PROT_READ <unfinished ...>
[pid 25596] 10:12:39.139632 <... close resumed> ) = 0
[pid 25596] 10:12:39.139657 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25595] 10:12:39.139706 <... mprotect resumed> ) = 0
[pid 25596] 10:12:39.139726 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.139767 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.139798 munmap(0x7f830f861000, 39387 <unfinished ...>
[pid 25596] 10:12:39.139825 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25596] 10:12:39.139857 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.139892 <... munmap resumed> ) = 0
[pid 25596] 10:12:39.139914 <... mmap resumed> ) = 0x7fb095a57000
[pid 25596] 10:12:39.139934 mprotect(0x7fb095a78000, 2097152, PROT_NONE) = 0
[pid 25595] 10:12:39.139979 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25596] 10:12:39.140008 mmap(0x7fb095c78000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fb095c78000
[pid 25595] 10:12:39.140050 <... open resumed> ) = 7
[pid 25596] 10:12:39.140074 close(6 <unfinished ...>
[pid 25595] 10:12:39.140105 fcntl(7, F_GETFD <unfinished ...>
[pid 25596] 10:12:39.140130 <... close resumed> ) = 0
[pid 25596] 10:12:39.140154 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.140182 <... fcntl resumed> ) = 0x1 (flags FD_CLOEXEC)
[pid 25595] 10:12:39.140205 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.140235 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.140255 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.140292 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25596] 10:12:39.140322 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.140351 <... mmap resumed> ) = 0x7f830f881000
[pid 25596] 10:12:39.140377 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.140473 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.140528 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.140590 close(7 <unfinished ...>
[pid 25596] 10:12:39.140619 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25596] 10:12:39.140660 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.140701 <... close resumed> ) = 0
[pid 25596] 10:12:39.140721 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.140746 munmap(0x7f830f881000, 4096 <unfinished ...>
[pid 25596] 10:12:39.140771 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25595] 10:12:39.140807 <... munmap resumed> ) = 0
[pid 25596] 10:12:39.140828 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb09583a000
[pid 25595] 10:12:39.140889 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25596] 10:12:39.140919 mprotect(0x7fb095851000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.140956 mmap(0x7fb095a51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fb095a51000
[pid 25596] 10:12:39.140999 mmap(0x7fb095a53000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb095a53000
[pid 25595] 10:12:39.141042 <... socket resumed> ) = 7
[pid 25596] 10:12:39.141067 close(6 <unfinished ...>
[pid 25595] 10:12:39.141096 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.141141 <... close resumed> ) = 0
[pid 25596] 10:12:39.141167 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.141195 close(7)    = 0
[pid 25596] 10:12:39.141236 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.141256 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25595] 10:12:39.141292 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
[pid 25596] 10:12:39.141321 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.141352 <... connect resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.141378 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.141477 close(7 <unfinished ...>
[pid 25596] 10:12:39.141511 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.141542 <... close resumed> ) = 0
[pid 25596] 10:12:39.141566 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.141598 open("/etc/group", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25596] 10:12:39.141629 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25595] 10:12:39.141676 <... open resumed> ) = 7
[pid 25596] 10:12:39.141697 read(6,  <unfinished ...>
[pid 25595] 10:12:39.141722 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.141748 <... read resumed> "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.141774 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25596] 10:12:39.141806 fstat(6,  <unfinished ...>
[pid 25595] 10:12:39.141830 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25596] 10:12:39.141857 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25595] 10:12:39.141889 <... mmap resumed> ) = 0x7f830f881000
[pid 25596] 10:12:39.141909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25595] 10:12:39.141935 read(7,  <unfinished ...>
[pid 25596] 10:12:39.141961 <... mmap resumed> ) = 0x7fb096987000
[pid 25595] 10:12:39.141983 <... read resumed> "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25596] 10:12:39.142010 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.142050 close(7 <unfinished ...>
[pid 25596] 10:12:39.142078 <... mmap resumed> ) = 0x7fb0954c6000
[pid 25596] 10:12:39.142097 mprotect(0x7fb095635000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.142133 mmap(0x7fb095834000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000 <unfinished ...>
[pid 25595] 10:12:39.142161 <... close resumed> ) = 0
[pid 25596] 10:12:39.142183 <... mmap resumed> ) = 0x7fb095834000
[pid 25595] 10:12:39.142203 munmap(0x7f830f881000, 4096 <unfinished ...>
[pid 25596] 10:12:39.142240 close(6 <unfinished ...>
[pid 25595] 10:12:39.142275 <... munmap resumed> ) = 0
[pid 25595] 10:12:39.142313 read(6,  <unfinished ...>
[pid 25596] 10:12:39.142342 <... close resumed> ) = 0
[pid 25596] 10:12:39.142369 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.142510 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25596] 10:12:39.142537 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.142609 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25596] 10:12:39.142651 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.142676 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.142727 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25596] 10:12:39.142769 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25595] 10:12:39.142813 <... open resumed> ) = 7
[pid 25596] 10:12:39.142833 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25595] 10:12:39.142882 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.142908 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.142935 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.142969 <... mmap resumed> ) = 0x7fb095237000
[pid 25595] 10:12:39.142989 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25596] 10:12:39.143026 mprotect(0x7fb0952c2000, 2097152, PROT_NONE <unfinished ...>
[pid 25595] 10:12:39.143052 read(7,  <unfinished ...>
[pid 25596] 10:12:39.143082 <... mprotect resumed> ) = 0
[pid 25595] 10:12:39.143105 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.143129 mmap(0x7fb0954c2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000 <unfinished ...>
[pid 25595] 10:12:39.143159 close(7 <unfinished ...>
[pid 25596] 10:12:39.143189 <... mmap resumed> ) = 0x7fb0954c2000
[pid 25595] 10:12:39.143210 <... close resumed> ) = 0
[pid 25596] 10:12:39.143233 mmap(0x7fb0954c5000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid 25595] 10:12:39.143261 munmap(0x7f830f881000, 4096) = 0
[pid 25596] 10:12:39.143300 <... mmap resumed> ) = 0x7fb0954c5000
[pid 25595] 10:12:39.143327 read(6,  <unfinished ...>
[pid 25596] 10:12:39.143360 close(6)    = 0
[pid 25595] 10:12:39.143477 <... read resumed> "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25596] 10:12:39.143518 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY <unfinished ...>
[pid 25595] 10:12:39.143568 uname( <unfinished ...>
[pid 25596] 10:12:39.143599 <... open resumed> ) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.143619 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.143662 <... uname resumed> {sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25595] 10:12:39.143716 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f830d4816a0},  <unfinished ...>
[pid 25596] 10:12:39.143751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.143800 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25596] 10:12:39.143841 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.143881 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25595] 10:12:39.143927 <... rt_sigaction resumed> {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, 8) = 0
[pid 25596] 10:12:39.143951 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0 <unfinished ...>
[pid 25595] 10:12:39.143987 clone( <unfinished ...>
[pid 25596] 10:12:39.144016 <... mmap resumed> ) = 0x7fb095031000
[pid 25596] 10:12:39.144035 mprotect(0x7fb095037000, 2093056, PROT_NONE) = 0
[pid 25595] 10:12:39.144269 <... clone resumed> child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f830f86ba90) = 25597
[pid 25596] 10:12:39.144296 mmap(0x7fb095236000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fb095236000
[pid 25596] 10:12:39.144343 close(6)    = 0
[pid 25596] 10:12:39.144384 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.144521 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25596] 10:12:39.144572 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.144613 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.144661 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096986000
[pid 25596] 10:12:39.144702 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb094cfb000
[pid 25596] 10:12:39.144741 mprotect(0x7fb094e27000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.144778 mmap(0x7fb095027000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fb095027000
[pid 25596] 10:12:39.144822 mmap(0x7fb095030000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb095030000
[pid 25596] 10:12:39.144866 close(6)    = 0
[pid 25596] 10:12:39.144907 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.144949 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.144992 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145033 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25596] 10:12:39.145073 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.145119 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.145166 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb094af7000
[pid 25596] 10:12:39.145204 mprotect(0x7fb094af9000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.145240 mmap(0x7fb094cf9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fb094cf9000
[pid 25596] 10:12:39.145287 close(6 <unfinished ...>
[pid 25595] 10:12:39.145340 wait4(25597,  <unfinished ...>
[pid 25596] 10:12:39.145369 <... close resumed> ) = 0
[pid 25596] 10:12:39.145393 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145522 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145567 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145608 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.145649 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.145689 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.145736 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb0948f4000
[pid 25596] 10:12:39.145774 mprotect(0x7fb0948f6000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.145810 mmap(0x7fb094af5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fb094af5000
[pid 25596] 10:12:39.145860 close(6)    = 0
[pid 25596] 10:12:39.145901 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145943 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.145985 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.146026 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25596] 10:12:39.146142 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.146196 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.146244 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096985000
[pid 25596] 10:12:39.146285 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb094560000
[pid 25596] 10:12:39.146324 mprotect(0x7fb0946ea000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.146360 mmap(0x7fb0948ea000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fb0948ea000
[pid 25596] 10:12:39.146458 mmap(0x7fb0948ef000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb0948ef000
[pid 25596] 10:12:39.146510 close(6)    = 0
[pid 25596] 10:12:39.146558 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.146609 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.146653 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.146696 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25596] 10:12:39.146739 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.146782 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25596] 10:12:39.146830 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb0942f4000
[pid 25596] 10:12:39.146870 mprotect(0x7fb094356000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.146908 mmap(0x7fb094555000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fb094555000
[pid 25596] 10:12:39.146955 close(6)    = 0
[pid 25596] 10:12:39.147001 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147089 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147131 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25596] 10:12:39.147174 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.147215 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25596] 10:12:39.147269 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb093f11000
[pid 25596] 10:12:39.147310 mprotect(0x7fb0940ca000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.147347 mmap(0x7fb0942c9000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fb0942c9000
[pid 25596] 10:12:39.147394 mmap(0x7fb0942f0000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb0942f0000
[pid 25596] 10:12:39.147526 close(6)    = 0
[pid 25596] 10:12:39.147571 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147616 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147666 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.147710 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25596] 10:12:39.147752 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.147793 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25596] 10:12:39.147841 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096984000
[pid 25596] 10:12:39.147881 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb093ce4000
[pid 25596] 10:12:39.147920 mprotect(0x7fb093d10000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.147958 mmap(0x7fb093f10000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fb093f10000
[pid 25596] 10:12:39.148000 close(6)    = 0
[pid 25596] 10:12:39.148041 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.148085 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.148126 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25596] 10:12:39.148173 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb093adf000
[pid 25596] 10:12:39.148212 mprotect(0x7fb093ae4000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.148249 mmap(0x7fb093ce3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7fb093ce3000
[pid 25596] 10:12:39.148295 close(6)    = 0
[pid 25596] 10:12:39.148339 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148382 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148522 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148568 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25596] 10:12:39.148609 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.148650 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25596] 10:12:39.148698 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb0938dc000
[pid 25596] 10:12:39.148739 mprotect(0x7fb0938de000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.148776 mmap(0x7fb093add000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fb093add000
[pid 25596] 10:12:39.148823 close(6)    = 0
[pid 25596] 10:12:39.148869 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148912 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148956 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.148997 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.149039 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.149079 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25596] 10:12:39.149127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096983000
[pid 25596] 10:12:39.149167 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb0936b9000
[pid 25596] 10:12:39.149207 mprotect(0x7fb0936d0000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.149243 mmap(0x7fb0938d0000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fb0938d0000
[pid 25596] 10:12:39.149290 close(6)    = 0
[pid 25596] 10:12:39.149349 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.149393 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.149522 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.149567 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25596] 10:12:39.149609 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.149656 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25596] 10:12:39.149705 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb093475000
[pid 25596] 10:12:39.149745 mprotect(0x7fb0934b6000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.149782 mmap(0x7fb0936b6000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7fb0936b6000
[pid 25596] 10:12:39.149831 close(6)    = 0
[pid 25596] 10:12:39.149874 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.149918 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.149961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150003 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25596] 10:12:39.150046 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.150087 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25596] 10:12:39.150134 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096982000
[pid 25596] 10:12:39.150174 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb09318e000
[pid 25596] 10:12:39.150214 mprotect(0x7fb093269000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.150250 mmap(0x7fb093469000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fb093469000
[pid 25596] 10:12:39.150297 close(6)    = 0
[pid 25596] 10:12:39.150340 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150515 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150560 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25596] 10:12:39.150603 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.150651 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25596] 10:12:39.150705 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb092f8a000
[pid 25596] 10:12:39.150750 mprotect(0x7fb092f8d000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.150795 mmap(0x7fb09318c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fb09318c000
[pid 25596] 10:12:39.150845 close(6)    = 0
[pid 25596] 10:12:39.150887 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150931 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.150974 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.151016 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25596] 10:12:39.151058 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.151099 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25596] 10:12:39.151146 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb092d5e000
[pid 25596] 10:12:39.151185 mprotect(0x7fb092d87000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.151223 mmap(0x7fb092f87000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fb092f87000
[pid 25596] 10:12:39.151268 mmap(0x7fb092f89000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb092f89000
[pid 25596] 10:12:39.151312 close(6)    = 0
[pid 25596] 10:12:39.151360 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.151522 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.151576 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.151620 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.151662 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.151703 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25596] 10:12:39.151776 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096981000
[pid 25596] 10:12:39.151821 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb092b48000
[pid 25596] 10:12:39.151868 mprotect(0x7fb092b5d000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.151906 mmap(0x7fb092d5c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fb092d5c000
[pid 25596] 10:12:39.151954 close(6)    = 0
[pid 25596] 10:12:39.152006 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152050 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152094 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152136 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25596] 10:12:39.152178 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.152219 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25596] 10:12:39.152267 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb09293d000
[pid 25596] 10:12:39.152307 mprotect(0x7fb092947000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.152344 mmap(0x7fb092b46000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fb092b46000
[pid 25596] 10:12:39.152394 close(6)    = 0
[pid 25596] 10:12:39.152524 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152570 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152613 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.152655 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.152698 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.152739 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25596] 10:12:39.152790 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb09273a000
[pid 25596] 10:12:39.152832 mprotect(0x7fb09273c000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.152872 mmap(0x7fb09293b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fb09293b000
[pid 25596] 10:12:39.152920 close(6)    = 0
[pid 25596] 10:12:39.152963 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096980000
[pid 25596] 10:12:39.153017 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.153068 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.153112 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.153154 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25596] 10:12:39.153194 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.153235 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25596] 10:12:39.153283 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fb09251b000
[pid 25596] 10:12:39.153323 mprotect(0x7fb092538000, 2093056, PROT_NONE) = 0
[pid 25596] 10:12:39.153360 mmap(0x7fb092737000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fb092737000
[pid 25596] 10:12:39.153486 mmap(0x7fb092739000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb092739000
[pid 25596] 10:12:39.153538 close(6)    = 0
[pid 25596] 10:12:39.153612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb09697f000
[pid 25596] 10:12:39.153692 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb09697e000
[pid 25596] 10:12:39.153746 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb09697c000
[pid 25596] 10:12:39.153792 arch_prctl(ARCH_SET_FS, 0x7fb09697c7c0) = 0
[pid 25596] 10:12:39.153872 mprotect(0x7fb092737000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.153915 mprotect(0x7fb09293b000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.153971 mprotect(0x7fb092b46000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154016 mprotect(0x7fb092d5c000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154067 mprotect(0x7fb092f87000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154115 mprotect(0x7fb09318c000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154279 mprotect(0x7fb093469000, 40960, PROT_READ) = 0
[pid 25596] 10:12:39.154471 mprotect(0x7fb0936b6000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154534 mprotect(0x7fb0938d0000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154582 mprotect(0x7fb093add000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.154842 mprotect(0x7fb0942c9000, 110592, PROT_READ) = 0
[pid 25596] 10:12:39.154961 mprotect(0x7fb094555000, 16384, PROT_READ) = 0
[pid 25596] 10:12:39.155102 mprotect(0x7fb0948ea000, 16384, PROT_READ) = 0
[pid 25596] 10:12:39.155146 mprotect(0x7fb094af5000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.155191 mprotect(0x7fb094cf9000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.155989 mprotect(0x7fb095a51000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156064 mprotect(0x7fb095e86000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156108 mprotect(0x7fb09610a000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156150 mprotect(0x7fb096313000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156204 mprotect(0x7fb096558000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156250 mprotect(0x7fb096772000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156313 mprotect(0x7fb096995000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.156352 munmap(0x7fb09698a000, 39387) = 0
[pid 25596] 10:12:39.156446 set_tid_address(0x7fb09697ca90) = 25596
[pid 25596] 10:12:39.156494 set_robust_list(0x7fb09697caa0, 24) = 0
[pid 25596] 10:12:39.156536 futex(0x7ffd2e556bbc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25596] 10:12:39.156572 futex(0x7ffd2e556bbc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fb09697c7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25596] 10:12:39.156622 rt_sigaction(SIGRTMIN, {0x7fb09583fc60, [], SA_RESTORER|SA_SIGINFO, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.156673 rt_sigaction(SIGRT_1, {0x7fb09583fcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.156714 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25596] 10:12:39.156760 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25596] 10:12:39.156834 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350309, f_bavail=6350309, f_files=1000000, f_ffree=691064, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25596] 10:12:39.156933 brk(0)      = 0x16d1000
[pid 25596] 10:12:39.156971 brk(0x16f2000) = 0x16f2000
[pid 25596] 10:12:39.157018 open("/proc/filesystems", O_RDONLY) = 6
[pid 25596] 10:12:39.157078 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.157129 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096993000
[pid 25596] 10:12:39.157168 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25596] 10:12:39.157264 read(6, "", 1024) = 0
[pid 25596] 10:12:39.157306 close(6)    = 0
[pid 25596] 10:12:39.157345 munmap(0x7fb096993000, 4096) = 0
[pid 25596] 10:12:39.157566 access("/usr/share/dracut/modules.d/01fips", F_OKProcess 25597 attached
 <unfinished ...>
[pid 25597] 10:12:39.157677 set_robust_list(0x7f830f86baa0, 24) = 0
[pid 25597] 10:12:39.157759 geteuid( <unfinished ...>
[pid 25596] 10:12:39.157799 <... access resumed> ) = -1 ENOENT (No such file or directory)
[pid 25597] 10:12:39.157829 <... geteuid resumed> ) = 0
[pid 25597] 10:12:39.157862 geteuid( <unfinished ...>
[pid 25596] 10:12:39.157976 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb095849790},  <unfinished ...>
[pid 25597] 10:12:39.158015 <... geteuid resumed> ) = 0
[pid 25597] 10:12:39.158042 getegid()   = 12
[pid 25597] 10:12:39.158093 setgid(12)  = 0
[pid 25597] 10:12:39.158141 setuid(47)  = 0
[pid 25596] 10:12:39.159940 <... rt_sigaction resumed> NULL, 8) = 0
[pid 25596] 10:12:39.159997 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25596] 10:12:39.160110 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.160175 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25596] 10:12:39.160238 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25596] 10:12:39.160292 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.160357 umask(0)    = 0
[pid 25596] 10:12:39.160469 geteuid()   = 0
[pid 25596] 10:12:39.160696 getuid()    = 47
[pid 25596] 10:12:39.160733 getgid()    = 12
[pid 25596] 10:12:39.160828 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25597] 10:12:39.161161 brk(0x15c7000 <unfinished ...>
[pid 25596] 10:12:39.161185 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25596] 10:12:39.161222 getgroups(65536, []) = 0
[pid 25596] 10:12:39.161259 setgroups(0, []) = 0
[pid 25596] 10:12:39.161294 getegid()   = 12
[pid 25596] 10:12:39.161326 geteuid()   = 0
[pid 25596] 10:12:39.161367 geteuid()   = 0
[pid 25596] 10:12:39.161452 getegid()   = 12
[pid 25596] 10:12:39.161496 setgid(12)  = 0
[pid 25596] 10:12:39.161532 setuid(0)   = 0
[pid 25596] 10:12:39.161604 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25596] 10:12:39.161659 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.161712 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.161756 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096993000
[pid 25596] 10:12:39.161793 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25596] 10:12:39.161943 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25596] 10:12:39.161996 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.162045 close(7)    = 0
[pid 25596] 10:12:39.162081 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25596] 10:12:39.162115 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.162155 close(7)    = 0
[pid 25596] 10:12:39.162195 open("/etc/nsswitch.conf", O_RDONLY <unfinished ...>
[pid 25597] 10:12:39.162219 <... brk resumed> ) = 0x15c7000
[pid 25596] 10:12:39.162486 <... open resumed> ) = 7
[pid 25596] 10:12:39.162516 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25596] 10:12:39.162569 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.162611 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25596] 10:12:39.162670 read(7, "", 4096) = 0
[pid 25596] 10:12:39.162704 close(7)    = 0
[pid 25596] 10:12:39.162737 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.162789 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.162835 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.162880 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.162919 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25596] 10:12:39.162956 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25596] 10:12:39.163001 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fb096972000
[pid 25596] 10:12:39.163036 close(7)    = 0
[pid 25596] 10:12:39.163077 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25596] 10:12:39.163118 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25596] 10:12:39.163164 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25596] 10:12:39.163218 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fb09230d000
[pid 25596] 10:12:39.163519 mprotect(0x7fb092319000, 2097152, PROT_NONE) = 0
[pid 25596] 10:12:39.163563 mmap(0x7fb092519000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fb092519000
[pid 25596] 10:12:39.163617 close(7)    = 0
[pid 25596] 10:12:39.163673 mprotect(0x7fb092519000, 4096, PROT_READ) = 0
[pid 25596] 10:12:39.163714 munmap(0x7fb096972000, 39387) = 0
[pid 25596] 10:12:39.163761 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25596] 10:12:39.163807 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25596] 10:12:39.163844 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.163890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.163925 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.163983 close(7)    = 0
[pid 25596] 10:12:39.164018 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.164075 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
[pid 25597] 10:12:39.164189 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25596] 10:12:39.164219 <... socket resumed> ) = 7
[pid 25596] 10:12:39.164238 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.164281 close(7)    = 0
[pid 25596] 10:12:39.164316 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25596] 10:12:39.164350 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.164392 close(7)    = 0
[pid 25596] 10:12:39.164559 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25596] 10:12:39.164604 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25596] 10:12:39.164649 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.164685 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25596] 10:12:39.164738 close(7 <unfinished ...>
[pid 25597] 10:12:39.164765 <... open resumed> ) = 7
[pid 25596] 10:12:39.164786 <... close resumed> ) = 0
[pid 25596] 10:12:39.164803 munmap(0x7fb096992000, 4096) = 0
[pid 25597] 10:12:39.164846 fstat(7,  <unfinished ...>
[pid 25596] 10:12:39.164884 read(6,  <unfinished ...>
[pid 25597] 10:12:39.164904 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25597] 10:12:39.164947 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25597] 10:12:39.164992 read(7,  <unfinished ...>
[pid 25596] 10:12:39.165013 <... read resumed> "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25596] 10:12:39.165069 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25597] 10:12:39.165098 <... read resumed> "\f\372\f\322\242bl\304\301\6\177*Z\254\314\226/U\271\213>\ft\314\306'xq#J/\270\360<e\23\250O\365o\242\30P\212\5\342)3", 48) = 48
[pid 25597] 10:12:39.165122 close(7)    = 0
[pid 25597] 10:12:39.165173 getuid()    = 47
[pid 25596] 10:12:39.165209 <... open resumed> ) = 7
[pid 25597] 10:12:39.165373 exit_group(0) = ?
[pid 25596] 10:12:39.165416 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.165583 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.165621 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.165665 close(7)    = 0
[pid 25596] 10:12:39.165705 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.165749 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25596] 10:12:39.165807 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25596] 10:12:39.165870 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, 8) = 0
[pid 25596] 10:12:39.165922 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb09697ca90) = 25598
[pid 25597] 10:12:39.166484 +++ exited with 0 +++
[pid 25595] 10:12:39.166494 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25597
[pid 25595] 10:12:39.166527 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, 8) = 0
[pid 25595] 10:12:39.166599 getcwd("/var/spool/exim", 16380) = 16
[pid 25595] 10:12:39.166679 open("/etc/localtime", O_RDONLY) = 7
[pid 25595] 10:12:39.166720 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.166774 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.166818 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.166853 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25595] 10:12:39.166912 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25595] 10:12:39.166946 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25595] 10:12:39.166994 close(7)    = 0
[pid 25595] 10:12:39.167028 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.167079 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25595] 10:12:39.167126 fcntl(7, F_GETFD) = 0
[pid 25595] 10:12:39.167157 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25595] 10:12:39.167189 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5394261, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.167235 write(7, "2015-12-30 10:12:39 [25595] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMb-0006dm-9U\n", 108) = 108
[pid 25595] 10:12:39.167278 chdir("/var/spool/exim") = 0
[pid 25595] 10:12:39.167320 geteuid()   = 0
[pid 25595] 10:12:39.167353 getegid()   = 12
[pid 25595] 10:12:39.167497 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.167550 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.167596 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.167635 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25595] 10:12:39.167689 close(8)    = 0
[pid 25595] 10:12:39.167723 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.167763 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25595] 10:12:39.167807 read(8, "65536\n", 31) = 6
[pid 25595] 10:12:39.167843 close(8)    = 0
[pid 25595] 10:12:39.167882 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.167922 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25595] 10:12:39.167973 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.168008 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.168042 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25595] 10:12:39.168097 read(8, "", 4096) = 0
[pid 25595] 10:12:39.168135 close(8)    = 0
[pid 25595] 10:12:39.168167 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.168205 setgroups(1, [12]) = 0
[pid 25595] 10:12:39.168241 setgid(12)  = 0
[pid 25595] 10:12:39.168273 setuid(47)  = 0
[pid 25595] 10:12:39.168332 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25595] 10:12:39.168485 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25595] 10:12:39.168582 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25595] 10:12:39.168657 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25595] 10:12:39.168732 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25595] 10:12:39.168823 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25595] 10:12:39.168939 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25595] 10:12:39.169010 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.169052 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.169098 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.169139 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25595] 10:12:39.169188 close(8)    = 0
[pid 25595] 10:12:39.169221 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.169317 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25595] 10:12:39.169500 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25595] 10:12:39.169633 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25595] 10:12:39.169757 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25595] 10:12:39.169871 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25595] 10:12:39.169927 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.169968 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.170014 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.170050 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25595] 10:12:39.170098 close(8)    = 0
[pid 25595] 10:12:39.170132 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.170178 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.170218 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25595] 10:12:39.170262 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.170297 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25595] 10:12:39.170344 close(8)    = 0
[pid 25595] 10:12:39.170378 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.170539 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.170582 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25595] 10:12:39.170629 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.170664 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25595] 10:12:39.170711 close(8)    = 0
[pid 25595] 10:12:39.170745 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.170848 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25595] 10:12:39.170982 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25595] 10:12:39.171085 read(6, "", 4096) = 0
[pid 25595] 10:12:39.171123 read(6, "", 4096) = 0
[pid 25595] 10:12:39.171159 close(6)    = 0
[pid 25595] 10:12:39.171192 munmap(0x7f830f882000, 4096) = 0
[pid 25595] 10:12:39.171234 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25595] 10:12:39.171275 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.171320 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f882000
[pid 25595] 10:12:39.171356 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25595] 10:12:39.171476 close(6)    = 0
[pid 25595] 10:12:39.171516 munmap(0x7f830f882000, 4096) = 0
[pid 25595] 10:12:39.171569 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25595] 10:12:39.171633 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.171686 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25595] 10:12:39.171726 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25595] 10:12:39.171766 fstat(0, {st_dev=makedev(0, 8), st_ino=2130171192, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.171811 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f882000
[pid 25595] 10:12:39.171846 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3509
[pid 25595] 10:12:39.171936 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.172006 open("/var/spool/exim/input/d/1aEJMd-0006ep-5X-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25595] 10:12:39.172093 fchown(6, 47, 12) = 0
[pid 25595] 10:12:39.172135 fchmod(6, 0640) = 0
[pid 25595] 10:12:39.172172 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25595] 10:12:39.172206 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.172251 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f881000
[pid 25595] 10:12:39.172286 lseek(6, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.172318 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25595] 10:12:39.172528 read(0, "", 4096) = 0
[pid 25595] 10:12:39.172570 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.172613 write(6, "1aEJMd-0006ep-5X-D\n--1451491959-eximdsn-2046906309\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3154) = 3154
[pid 25595] 10:12:39.172661 fsync(6 <unfinished ...>
[pid 25596] 10:12:39.172760 wait4(25598, Process 25598 attached
 <unfinished ...>
[pid 25598] 10:12:39.172943 set_robust_list(0x7fb09697caa0, 24) = 0
[pid 25598] 10:12:39.173002 geteuid()   = 0
[pid 25598] 10:12:39.173040 geteuid()   = 0
[pid 25598] 10:12:39.173072 getegid()   = 12
[pid 25598] 10:12:39.173106 setgid(12)  = 0
[pid 25598] 10:12:39.173138 setuid(47 <unfinished ...>
[pid 25595] 10:12:39.173159 <... fsync resumed> ) = 0
[pid 25595] 10:12:39.173188 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.173276 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.173499 brk(0x15c7000) = 0x15c7000
[pid 25595] 10:12:39.173574 getuid()    = 47
[pid 25595] 10:12:39.173610 geteuid()   = 47
[pid 25595] 10:12:39.173644 getgid()    = 12
[pid 25595] 10:12:39.173677 getegid()   = 12
[pid 25595] 10:12:39.173788 open("/dev/urandom", O_RDONLY) = 8
[pid 25595] 10:12:39.173836 read(8, "\220\21\324\343", 4) = 4
[pid 25595] 10:12:39.173874 close(8)    = 0
[pid 25595] 10:12:39.174012 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25595] 10:12:39.174135 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196550) = -1 EINVAL (Invalid argument)
[pid 25595] 10:12:39.174181 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25595] 10:12:39.174219 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196550) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.174254 lseek(1, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.174286 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196560) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.174321 lseek(2, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.174362 open("/dev/null", O_RDONLY) = 8
[pid 25595] 10:12:39.174478 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196630) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.174524 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.174558 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25595] 10:12:39.174593 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f830e738790}, 8) = 0
[pid 25595] 10:12:39.174634 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f830e738790}, 8) = 0
[pid 25595] 10:12:39.174931 read(8, "", 8192) = 0
[pid 25595] 10:12:39.174978 close(8)    = 0
[pid 25595] 10:12:39.175228 brk(0x15e8000) = 0x15e8000
[pid 25595] 10:12:39.175380 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25595] 10:12:39.175502 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25595] 10:12:39.175544 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.175581 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.175634 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25595] 10:12:39.176699 brk(0x1609000) = 0x1609000
[pid 25595] 10:12:39.176930 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25595] 10:12:39.177897 brk(0x162a000) = 0x162a000
[pid 25595] 10:12:39.178234 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25595] 10:12:39.179152 brk(0x164b000) = 0x164b000
[pid 25595] 10:12:39.179487 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25595] 10:12:39.179797 read(8, "", 8192) = 0
[pid 25595] 10:12:39.179844 close(8)    = 0
[pid 25595] 10:12:39.179899 stat("/usr/share/amavis/amavis-filter", 0x7f830df1f880) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.179949 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25595] 10:12:39.180005 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25595] 10:12:39.180054 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25595] 10:12:39.180095 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88196460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.180131 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.180182 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25595] 10:12:39.180725 stat("/etc/exim/perl/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180781 stat("/etc/exim/perl/warnings.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180822 stat("/usr/local/cpanel/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180862 stat("/usr/local/cpanel/warnings.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180901 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180954 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.180996 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.181036 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.181081 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.181124 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.181174 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.181214 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.181270 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25595] 10:12:39.181313 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88195e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.181352 lseek(9, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.181395 brk(0x166c000) = 0x166c000
[pid 25595] 10:12:39.181536 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25595] 10:12:39.181876 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25595] 10:12:39.182680 read(9,  <unfinished ...>
[pid 25598] 10:12:39.182718 <... setuid resumed> ) = 0
[pid 25595] 10:12:39.183332 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25595] 10:12:39.183531 brk(0x168d000) = 0x168d000
[pid 25595] 10:12:39.183919 read(9, "", 8192) = 0
[pid 25595] 10:12:39.183970 close(9)    = 0
[pid 25595] 10:12:39.185349 read(8,  <unfinished ...>
[pid 25598] 10:12:39.186004 brk(0x1713000 <unfinished ...>
[pid 25595] 10:12:39.186037 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25590] 10:12:39.186094 <... read resumed> "\26\3\3\0B\2\0", 7) = 7
[pid 25590] 10:12:39.186172 read(11, "\0>\3\3\342\334\204%\24\244\322\326\201_2\20v\374\32\276z^\34\f\245\363\333h\314\216\343`\213\311\365\375\0\3000\0\0\26\377\1\0\1\0\0\v\0\4\3\0\1\2\0#\0\0\0\17\0\1\1", 64) = 64
[pid 25590] 10:12:39.186240 read(11, "\26\3\3\no", 5) = 5
[pid 25590] 10:12:39.186278 read(11, "\v\0\nk\0\nh\0\5\2550\202\5\2510\202\4\221\240\3\2\1\2\2\20\t\32\17\321\311My\223\325\0\332V_\355\201)0\r\6\t*\206H\206\367\r\1\1\v\5\0000p1\v0\t\6\3U\4\6\23\2US1\0250\23\6\3U\4\n\23\fDigiCert Inc1\0310\27\6\3U\4\v\23\20www.digicert.com1/0-\6\3U\4\3\23&DigiCert SHA2 High Assurance Server CA0\36\27\r151007000000Z\27\r181025120000Z0v1\v0\t\6\3U\4\6\23\2US1\0230\21\6\3U\4\10\23\nCalifornia1\0210\17\6\3U\4\7\23\10Campbel"..., 2671) = 2671
[pid 25590] 10:12:39.187055 read(11, "\26\3\3\1M", 5) = 5
[pid 25590] 10:12:39.187107 read(11, "\f\0\1I\3\0\27A\4\r$T\275\376f\247;\32\265\7fvmKTB\364\340\310\322\2\253\204\361\350\337\266\22\333\201\336\302\211\363\327A\273\264z\265UR\325\261*I\262a\336\27\204\214\337'\364V\244\346\241\354\212\236-\6\1\1\0\254\373\326\346DA\266bs\334\36R\230\7\345\232\"\211\254\201\2\276,w\234s\211_\205j\337\31\27\360H;}\254g*;\177\377\26GIx\34\320\213\262S\273\220\7^5\304\360\302\2767\3504\215\311Zs\251\230\222\353+&\201\2751\274\255\260\276\262z\0079\277\241\334\\\336\210u\243r#A\251n\211\33\213-h\31R\274\10\1d\305\266P\35\264!z\203\27\2\343W1V\36\5\312\34\334\215\342D\34\34S\270.N-\326\322T\\\245h\327&(\17\2371\f\n\1@\273ff\366\240\263\7\37i\224\224\327p\340\34\223\203\215z4l:)\220N"..., 333) = 333
[pid 25590] 10:12:39.187316 read(11, "\26\3\3\0\4", 5) = 5
[pid 25590] 10:12:39.187359 read(11, "\16\0\0\0", 4) = 4
[pid 25590] 10:12:39.189604 write(11, "\26\3\3\0F\20\0\0BA\4Z\305V\220il\31R\36qb\313\267\205dN\262\n\335E\335\7\311gZ\271Qb\235A\343f\204\32D1/\312\312\235\204\260\207\t+i&]\367c\372%\320\210n\313\315\2654\202G\347\336\307\24\3\3\0\1\1\26\3\3\0(\312+\243\215{\253Md\373:\250\301\2274\206L\1\243\33g\3222\312\230z\243\204Wa\345\16\365T]\204n=\351P\1", 126) = 126
[pid 25590] 10:12:39.189702 read(11,  <unfinished ...>
[pid 25598] 10:12:39.190369 <... brk resumed> ) = 0x1713000
[pid 25598] 10:12:39.190898 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK <unfinished ...>
[pid 25595] 10:12:39.191147 read(8,  <unfinished ...>
[pid 25598] 10:12:39.191184 <... open resumed> ) = 7
[pid 25598] 10:12:39.191221 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25598] 10:12:39.191281 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25598] 10:12:39.191326 read(7, "\311b\250\0D\321\245\213%\236*/\266\32\1\235\2206h\276\304\20J\362i\245'\274\250W~0\312\244\223\21O-\177\235(\10h\0$\355h\32", 48) = 48
[pid 25598] 10:12:39.191369 close(7)    = 0
[pid 25598] 10:12:39.191479 getuid( <unfinished ...>
[pid 25595] 10:12:39.191507 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25598] 10:12:39.191532 <... getuid resumed> ) = 47
[pid 25595] 10:12:39.192230 read(8,  <unfinished ...>
[pid 25598] 10:12:39.192487 exit_group(0) = ?
[pid 25598] 10:12:39.192759 +++ exited with 0 +++
[pid 25596] 10:12:39.192793 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25598
[pid 25596] 10:12:39.192820 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, 8) = 0
[pid 25596] 10:12:39.192890 getcwd("/var/spool/exim", 16380) = 16
[pid 25596] 10:12:39.192971 open("/etc/localtime", O_RDONLY) = 7
[pid 25596] 10:12:39.193015 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.193063 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.193107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.193144 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25596] 10:12:39.193200 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25596] 10:12:39.193234 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25596] 10:12:39.193298 close(7)    = 0
[pid 25596] 10:12:39.193369 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.193545 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25596] 10:12:39.193602 fcntl(7, F_GETFD) = 0
[pid 25596] 10:12:39.193636 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25596] 10:12:39.193668 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10544, st_size=5394369, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.193715 write(7, "2015-12-30 10:12:39 [25596] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMX-0006bl-RX\n", 108) = 108
[pid 25596] 10:12:39.193764 chdir("/var/spool/exim") = 0
[pid 25596] 10:12:39.193807 geteuid()   = 0
[pid 25596] 10:12:39.193839 getegid()   = 12
[pid 25596] 10:12:39.193885 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.193929 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.193974 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.194009 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.194057 close(8)    = 0
[pid 25596] 10:12:39.194091 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.194131 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25596] 10:12:39.194174 read(8, "65536\n", 31) = 6
[pid 25596] 10:12:39.194210 close(8)    = 0
[pid 25596] 10:12:39.194248 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.194293 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25596] 10:12:39.194347 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.194384 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.194494 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25596] 10:12:39.194547 read(8, "", 4096) = 0
[pid 25596] 10:12:39.194585 close(8)    = 0
[pid 25596] 10:12:39.194617 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.194655 setgroups(1, [12]) = 0
[pid 25596] 10:12:39.194691 setgid(12)  = 0
[pid 25596] 10:12:39.194723 setuid(47)  = 0
[pid 25596] 10:12:39.194785 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25596] 10:12:39.194882 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25596] 10:12:39.194966 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25596] 10:12:39.195039 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25596] 10:12:39.195115 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25596] 10:12:39.195207 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25596] 10:12:39.195332 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25596] 10:12:39.195519 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.195567 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.195626 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.195663 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.195716 close(8)    = 0
[pid 25596] 10:12:39.195752 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.195849 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25596] 10:12:39.195943 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25596] 10:12:39.196069 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25596] 10:12:39.196193 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25596] 10:12:39.196313 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25596] 10:12:39.196369 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.196457 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.196517 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.196557 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.196636 close(8)    = 0
[pid 25596] 10:12:39.196674 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.196725 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.196769 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25596] 10:12:39.196815 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.196850 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25596] 10:12:39.196900 close(8)    = 0
[pid 25596] 10:12:39.196933 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.196997 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.197039 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25596] 10:12:39.197084 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.197118 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25596] 10:12:39.197166 close(8)    = 0
[pid 25596] 10:12:39.197199 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.197307 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25596] 10:12:39.197438 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25596] 10:12:39.197543 read(6, "", 4096) = 0
[pid 25596] 10:12:39.197587 read(6, "", 4096) = 0
[pid 25596] 10:12:39.197624 close(6)    = 0
[pid 25596] 10:12:39.197664 munmap(0x7fb096993000, 4096) = 0
[pid 25596] 10:12:39.197706 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25596] 10:12:39.197747 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.197792 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096993000
[pid 25596] 10:12:39.197828 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.197873 close(6)    = 0
[pid 25596] 10:12:39.197907 munmap(0x7fb096993000, 4096) = 0
[pid 25596] 10:12:39.197951 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25596] 10:12:39.198013 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.198068 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25596] 10:12:39.198108 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25596] 10:12:39.198148 fstat(0, {st_dev=makedev(0, 8), st_ino=2130171202, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.198194 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096993000
[pid 25596] 10:12:39.198229 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3562
[pid 25596] 10:12:39.198331 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.198405 open("/var/spool/exim/input/d/1aEJMd-0006eq-6O-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25596] 10:12:39.198487 fchown(6, 47, 12) = 0
[pid 25596] 10:12:39.198515 fchmod(6, 0640) = 0
[pid 25596] 10:12:39.198540 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25596] 10:12:39.198564 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.198605 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096992000
[pid 25596] 10:12:39.198634 lseek(6, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.198657 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25596] 10:12:39.198993 read(0, "", 4096) = 0
[pid 25596] 10:12:39.199034 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.199072 write(6, "1aEJMd-0006eq-6O-D\n--1451491959-eximdsn-467078250\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a perm"..., 3208) = 3208
[pid 25596] 10:12:39.199120 fsync(6 <unfinished ...>
[pid 25595] 10:12:39.199183 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25596] 10:12:39.199570 <... fsync resumed> ) = 0
[pid 25596] 10:12:39.199639 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.199762 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3208, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.199921 brk(0x1713000) = 0x1713000
[pid 25596] 10:12:39.199987 getuid()    = 47
[pid 25596] 10:12:39.200078 geteuid()   = 47
[pid 25596] 10:12:39.200113 getgid()    = 12
[pid 25596] 10:12:39.200163 getegid()   = 12
[pid 25596] 10:12:39.200273 open("/dev/urandom", O_RDONLY) = 8
[pid 25596] 10:12:39.200401 read(8, "\251\v\352\273", 4) = 4
[pid 25596] 10:12:39.200442 close(8)    = 0
[pid 25596] 10:12:39.200576 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25596] 10:12:39.200715 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511e50) = -1 EINVAL (Invalid argument)
[pid 25596] 10:12:39.200768 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25596] 10:12:39.200807 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511e50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.200842 lseek(1, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.200875 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511e60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.200908 lseek(2, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.200944 open("/dev/null", O_RDONLY) = 8
[pid 25596] 10:12:39.200985 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511f30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.201018 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.201051 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25596] 10:12:39.201086 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb095849790}, 8) = 0
[pid 25596] 10:12:39.201126 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fb095849790}, 8) = 0
[pid 25596] 10:12:39.201427 read(8, "", 8192) = 0
[pid 25596] 10:12:39.201496 close(8)    = 0
[pid 25596] 10:12:39.201744 brk(0x1734000) = 0x1734000
[pid 25596] 10:12:39.201895 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.201961 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25596] 10:12:39.202003 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511d60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.202040 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.202092 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25596] 10:12:39.203226 brk(0x1755000) = 0x1755000
[pid 25596] 10:12:39.203465 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25596] 10:12:39.204489 brk(0x1776000) = 0x1776000
[pid 25596] 10:12:39.204894 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25596] 10:12:39.205823 brk(0x1797000) = 0x1797000
[pid 25596] 10:12:39.206098 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25596] 10:12:39.206787 read(8,  <unfinished ...>
[pid 25595] 10:12:39.207037 read(8,  <unfinished ...>
[pid 25596] 10:12:39.207068 <... read resumed> "", 8192) = 0
[pid 25596] 10:12:39.207092 close(8)    = 0
[pid 25596] 10:12:39.207147 stat("/usr/share/amavis/amavis-filter", 0x7fb095030880) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.207196 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.207249 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25596] 10:12:39.207297 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25596] 10:12:39.207345 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511d60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.207382 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.207433 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25595] 10:12:39.207593 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25595] 10:12:39.207835 brk(0x16ae000 <unfinished ...>
[pid 25596] 10:12:39.208194 stat("/etc/exim/perl/warnings.pmc",  <unfinished ...>
[pid 25595] 10:12:39.208229 <... brk resumed> ) = 0x16ae000
[pid 25596] 10:12:39.208608 <... stat resumed> 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.208649 stat("/etc/exim/perl/warnings.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.208695 stat("/usr/local/cpanel/warnings.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.208736 stat("/usr/local/cpanel/warnings.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.208799 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.209093 read(8,  <unfinished ...>
[pid 25596] 10:12:39.209129 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209179 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209220 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209262 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209314 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209360 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.209400 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.209457 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25596] 10:12:39.209501 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511770) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.209537 lseek(9, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.209596 brk(0x17b8000) = 0x17b8000
[pid 25596] 10:12:39.209665 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25596] 10:12:39.210010 read(9,  <unfinished ...>
[pid 25595] 10:12:39.210040 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25596] 10:12:39.210400 <... read resumed> "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25595] 10:12:39.211173 brk(0x16cf000 <unfinished ...>
[pid 25596] 10:12:39.211822 read(9,  <unfinished ...>
[pid 25595] 10:12:39.211856 <... brk resumed> ) = 0x16cf000
[pid 25595] 10:12:39.212028 read(8,  <unfinished ...>
[pid 25596] 10:12:39.212058 <... read resumed> "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25596] 10:12:39.212162 brk(0x17d9000 <unfinished ...>
[pid 25595] 10:12:39.212191 <... read resumed> " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25596] 10:12:39.212370 <... brk resumed> ) = 0x17d9000
[pid 25596] 10:12:39.212758 read(9,  <unfinished ...>
[pid 25595] 10:12:39.213230 read(8,  <unfinished ...>
[pid 25596] 10:12:39.213260 <... read resumed> "", 8192) = 0
[pid 25596] 10:12:39.213284 close(9)    = 0
[pid 25595] 10:12:39.213637 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25595] 10:12:39.214151 brk(0x16f0000) = 0x16f0000
[pid 25595] 10:12:39.214770 read(8,  <unfinished ...>
[pid 25596] 10:12:39.214946 read(8,  <unfinished ...>
[pid 25595] 10:12:39.214977 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25595] 10:12:39.215619 read(8,  <unfinished ...>
[pid 25596] 10:12:39.215655 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25595] 10:12:39.216376 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25595] 10:12:39.216847 brk(0x1711000 <unfinished ...>
[pid 25596] 10:12:39.217018 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25596] 10:12:39.217736 read(8,  <unfinished ...>
[pid 25595] 10:12:39.217772 <... brk resumed> ) = 0x1711000
[pid 25595] 10:12:39.218111 stat("/usr/local/cpanel/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218168 stat("/usr/local/cpanel/strict.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218209 stat("/etc/exim/perl/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218247 stat("/etc/exim/perl/strict.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218284 stat("/usr/local/cpanel/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218393 stat("/usr/local/cpanel/strict.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218437 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218494 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218566 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218630 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218696 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.218740 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm",  <unfinished ...>
[pid 25596] 10:12:39.218763 <... read resumed> "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25595] 10:12:39.218791 <... stat resumed> 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.219449 read(8,  <unfinished ...>
[pid 25595] 10:12:39.219486 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.219535 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.219601 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25595] 10:12:39.219654 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88195e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.219694 lseek(9, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.219775 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25595] 10:12:39.220024 lseek(9, 878, SEEK_SET) = 878
[pid 25595] 10:12:39.220067 lseek(9, 0, SEEK_CUR) = 878
[pid 25595] 10:12:39.220100 close(9)    = 0
[pid 25595] 10:12:39.220461 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25596] 10:12:39.220673 <... read resumed> "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25596] 10:12:39.220894 brk(0x17fa000 <unfinished ...>
[pid 25595] 10:12:39.221379 read(8,  <unfinished ...>
[pid 25596] 10:12:39.221412 <... brk resumed> ) = 0x17fa000
[pid 25596] 10:12:39.221871 read(8,  <unfinished ...>
[pid 25595] 10:12:39.221904 <... read resumed> "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25595] 10:12:39.222046 brk(0x1732000) = 0x1732000
[pid 25596] 10:12:39.222373 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25596] 10:12:39.223159 brk(0x181b000 <unfinished ...>
[pid 25595] 10:12:39.224074 read(8,  <unfinished ...>
[pid 25596] 10:12:39.224109 <... brk resumed> ) = 0x181b000
[pid 25596] 10:12:39.224284 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25596] 10:12:39.224902 read(8,  <unfinished ...>
[pid 25595] 10:12:39.224947 <... read resumed> "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25595] 10:12:39.225184 brk(0x1753000) = 0x1753000
[pid 25596] 10:12:39.225614 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25596] 10:12:39.226826 brk(0x183c000) = 0x183c000
[pid 25596] 10:12:39.227001 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25595] 10:12:39.228090 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25595] 10:12:39.228287 brk(0x1774000 <unfinished ...>
[pid 25596] 10:12:39.228780 read(8,  <unfinished ...>
[pid 25595] 10:12:39.228824 <... brk resumed> ) = 0x1774000
[pid 25596] 10:12:39.229389 <... read resumed> "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25596] 10:12:39.230095 brk(0x185d000 <unfinished ...>
[pid 25595] 10:12:39.230845 stat("/usr/local/cpanel/Errno.pmc",  <unfinished ...>
[pid 25596] 10:12:39.230892 <... brk resumed> ) = 0x185d000
[pid 25595] 10:12:39.231425 <... stat resumed> 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231470 stat("/usr/local/cpanel/Errno.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231533 stat("/etc/exim/perl/Errno.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231589 stat("/etc/exim/perl/Errno.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231645 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231699 stat("/usr/local/cpanel/Errno.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231755 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231827 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231889 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.231947 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.232006 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.232066 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25595] 10:12:39.232151 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25595] 10:12:39.232216 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88195e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.232270 lseek(9, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.232352 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25595] 10:12:39.232671 brk(0x1795000 <unfinished ...>
[pid 25596] 10:12:39.232806 stat("/usr/local/cpanel/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.232872 stat("/usr/local/cpanel/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.232930 stat("/etc/exim/perl/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.232983 stat("/etc/exim/perl/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233045 stat("/usr/local/cpanel/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233099 stat("/usr/local/cpanel/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233155 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233215 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233275 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc",  <unfinished ...>
[pid 25595] 10:12:39.233428 <... brk resumed> ) = 0x1795000
[pid 25596] 10:12:39.233464 <... stat resumed> 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233494 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233663 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233725 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233786 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.233842 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.233922 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25596] 10:12:39.233983 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511770) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.234610 lseek(9, 4868, SEEK_SET <unfinished ...>
[pid 25596] 10:12:39.234653 lseek(9, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.234752 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25596] 10:12:39.235069 lseek(9, 878, SEEK_SET) = 878
[pid 25596] 10:12:39.235127 lseek(9, 0, SEEK_CUR) = 878
[pid 25596] 10:12:39.235175 close(9)    = 0
[pid 25596] 10:12:39.235666 read(8,  <unfinished ...>
[pid 25595] 10:12:39.235708 <... lseek resumed> ) = 4868
[pid 25595] 10:12:39.235737 lseek(9, 0, SEEK_CUR) = 4868
[pid 25595] 10:12:39.235785 close(9)    = 0
[pid 25595] 10:12:39.235854 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.235915 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.235972 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.236035 stat("/etc/exim/perl/Exporter.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.236090 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.236144 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.236200 <... read resumed> "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25595] 10:12:39.236247 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.236437 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd88196080) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.236502 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd88196120) = -1 ENOENT (No such file or directory)
[pid 25595] 10:12:39.237380 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25595] 10:12:39.237490 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25595] 10:12:39.237558 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd88195e70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25595] 10:12:39.237616 lseek(9, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.237686 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25595] 10:12:39.238380 lseek(9, 2366, SEEK_SET) = 2366
[pid 25595] 10:12:39.238448 lseek(9, 0, SEEK_CUR) = 2366
[pid 25595] 10:12:39.238504 close(9)    = 0
[pid 25595] 10:12:39.239034 read(8,  <unfinished ...>
[pid 25596] 10:12:39.239394 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25596] 10:12:39.239650 brk(0x187e000) = 0x187e000
[pid 25595] 10:12:39.239793 <... read resumed> "", 8192) = 0
[pid 25595] 10:12:39.239835 close(8)    = 0
[pid 25595] 10:12:39.240177 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25595] 10:12:39.241389 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25595] 10:12:39.241457 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f880000
[pid 25595] 10:12:39.241497 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25595] 10:12:39.241548 close(8)    = 0
[pid 25595] 10:12:39.241582 munmap(0x7f830f880000, 4096) = 0
[pid 25595] 10:12:39.241683 lseek(6, 19, SEEK_SET) = 19
[pid 25595] 10:12:39.241723 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.241763 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.241797 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.241830 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.241864 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.241900 alarm(300)  = 0
[pid 25595] 10:12:39.241933 alarm(0)    = 300
[pid 25595] 10:12:39.241971 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.242006 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.242039 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.242080 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.242114 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f830e738790}, NULL, 8) = 0
[pid 25595] 10:12:39.242149 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, 8) = 0
[pid 25595] 10:12:39.242186 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, 8) = 0
[pid 25595] 10:12:39.242230 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.242293 open("/var/spool/exim/input/d/hdr.25595", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25595] 10:12:39.242379 fchown(8, 47, 12) = 0
[pid 25595] 10:12:39.242417 fchmod(8, 0640) = 0
[pid 25595] 10:12:39.242451 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25595] 10:12:39.242488 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.242533 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f880000
[pid 25595] 10:12:39.242571 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.242619 write(8, "1aEJMd-0006ep-5X-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25595] 10:12:39.242673 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.242725 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMd-0006ep-5X\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:39 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25595] 10:12:39.242764 fsync(8 <unfinished ...>
[pid 25596] 10:12:39.243022 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25596] 10:12:39.243395 brk(0x189f000 <unfinished ...>
[pid 25595] 10:12:39.243536 <... fsync resumed> ) = 0
[pid 25595] 10:12:39.243562 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.243611 close(8)    = 0
[pid 25595] 10:12:39.243645 munmap(0x7f830f880000, 4096) = 0
[pid 25595] 10:12:39.243694 rename("/var/spool/exim/input/d/hdr.25595", "/var/spool/exim/input/d/1aEJMd-0006ep-5X-H") = 0
[pid 25595] 10:12:39.243765 open("/var/spool/exim/input/d/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25595] 10:12:39.243808 fsync(8)    = 0
[pid 25595] 10:12:39.243842 close(8)    = 0
[pid 25595] 10:12:39.243877 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.243935 open("/var/spool/exim/msglog/d/1aEJMd-0006ep-5X", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25595] 10:12:39.244012 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25595] 10:12:39.244058 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080192, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25595] 10:12:39.244107 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f830f880000
[pid 25595] 10:12:39.244149 lseek(8, 0, SEEK_CUR) = 0
[pid 25595] 10:12:39.244184 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.244239 write(8, "2015-12-30 10:12:39 Received from <> R=1aEJMb-0006dm-9U U=mailnull P=local S=3778 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25595] 10:12:39.244282 close(8)    = 0
[pid 25595] 10:12:39.244316 munmap(0x7f830f880000, 4096) = 0
[pid 25595] 10:12:39.244362 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.244420 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25595] 10:12:39.244469 close(7)    = 0
[pid 25595] 10:12:39.244506 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25595] 10:12:39.244547 fcntl(7, F_GETFD) = 0
[pid 25595] 10:12:39.244578 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25595] 10:12:39.244609 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5394477, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25590] 10:12:39.244741 <... read resumed> "\26\3\3\0\252", 5) = 5
[pid 25590] 10:12:39.244774 read(11, "\4\0\0\246\0\0\1,\0\240\16\256\242\367\320|\227\364\327\245k\370\3013\312T\36\315\4\316.\367\210\303[P\274/c\212\257\226\213\370\326\320\250\264\2066\356\304u,\344\346\363'b\25\211`\241\257\331\206\v\312\372M,\302\374\322\6;9\31Z\224\275\r/\234\232\353HQ\266\206\257\336]\356\207\372\252\210\2Q\373\2347\367#\31ad\36\246\"O90\231\305\355;\331\344\356\23\323\3\vQId\337\331}\340\330\314\210\301\367\224.Y_Q^.\216\351(\"\267\321Hv\10\240\6\240\273\235\214\333\312b\235h]'\356\360i\316", 170) = 170
[pid 25590] 10:12:39.244842 read(11, "\24\3\3\0\1", 5) = 5
[pid 25590] 10:12:39.244879 read(11, "\1", 1) = 1
[pid 25590] 10:12:39.244956 read(11, "\26\3\3\0(", 5) = 5
[pid 25590] 10:12:39.244994 read(11, "\334M\266m\335\366\2\321#\347_\367\312\314<\375\327\221\3109\323\204\276\326\316-\\X\256U\20\212\"\237\371\20\324R_\261", 40) = 40
[pid 25590] 10:12:39.245072 alarm(0)    = 300
[pid 25590] 10:12:39.245142 write(11, "\27\3\3\0009\312+\243\215{\253Me\\B\2707\204\32p\243/\"7\372\16Wr\217*1\0\332\217\354\277n\6\333,\26W\245\340\244\377\247\\f[]\205\303\236a\350MZ\33\372u\10", 62) = 62
[pid 25590] 10:12:39.245209 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25595] 10:12:39.245242 write(7, "2015-12-30 10:12:39 [25595] 1aEJMd-0006ep-5X <= <> R=1aEJMb-0006dm-9U U=mailnull P=local S=3778 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25595] 10:12:39.245286 close(6)    = 0
[pid 25595] 10:12:39.245321 munmap(0x7f830f881000, 4096) = 0
[pid 25595] 10:12:39.245358 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, 8) = 0
[pid 25595] 10:12:39.245399 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f830d4816a0}, 8) = 0
[pid 25595] 10:12:39.245443 open("/proc/loadavg", O_RDONLY) = 6
[pid 25595] 10:12:39.245490 read(6, "0.41 0.13 0.03 2/253 25598\n", 40) = 27
[pid 25595] 10:12:39.245528 close(6)    = 0
[pid 25595] 10:12:39.245577 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f830f86ba90) = 25599
[pid 25595] 10:12:39.246206 exit_group(0) = ?
[pid 25596] 10:12:39.246233 <... brk resumed> ) = 0x189f000
[pid 25595] 10:12:39.246995 +++ exited with 0 +++
[pid 25544] 10:12:39.247039 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25595
[pid 25544] 10:12:39.247069 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fa69081f6a0}, 8) = 0
[pid 25544] 10:12:39.247124 write(8, "2015-12-30 10:12:39 embassy-airport@finestweddingsites.com: children all complete\n", 82) = 82
[pid 25544] 10:12:39.247171 open("/var/spool/exim/input/b/hdr.25544", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25544] 10:12:39.247241 fchown(10, 47, 12) = 0
[pid 25544] 10:12:39.247278 fchmod(10, 0640) = 0
[pid 25544] 10:12:39.247313 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25544] 10:12:39.247351 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25544] 10:12:39.247399 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa692c1f000
[pid 25544] 10:12:39.247436 lseek(10, 0, SEEK_CUR) = 0
[pid 25544] 10:12:39.247483 write(10, "1aEJMb-0006dm-9U-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 714) = 714
[pid 25544] 10:12:39.247529 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=714, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25544] 10:12:39.247579 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006dm-9U; Wed, 30 Dec 2015 10:12:37 -0600\n067T To:  wendy.laws@hilton.com, embassy-airport@finestweddingsit"..., 550) = 550
[pid 25544] 10:12:39.247625 fsync(10)   = 0
[pid 25544] 10:12:39.248151 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080202, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1264, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25544] 10:12:39.248206 close(10)   = 0
[pid 25544] 10:12:39.248241 munmap(0x7fa692c1f000, 4096) = 0
[pid 25544] 10:12:39.248285 rename("/var/spool/exim/input/b/hdr.25544", "/var/spool/exim/input/b/1aEJMb-0006dm-9U-H") = 0
[pid 25544] 10:12:39.248374 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25544] 10:12:39.248419 fsync(10)   = 0
[pid 25544] 10:12:39.248451 close(10)   = 0
[pid 25544] 10:12:39.248489 unlink("/var/spool/exim/msglog/b/1aEJMb-0006dm-9U") = 0
[pid 25544] 10:12:39.248540 unlink("/var/spool/exim/input/b/1aEJMb-0006dm-9U-D") = 0
[pid 25544] 10:12:39.248585 unlink("/var/spool/exim/input/b/1aEJMb-0006dm-9U-H") = 0
[pid 25544] 10:12:39.248715 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.248785 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25544] 10:12:39.248843 close(7)    = 0
[pid 25544] 10:12:39.248884 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25544] 10:12:39.248927 fcntl(7, F_GETFD) = 0
[pid 25544] 10:12:39.248958 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25544] 10:12:39.248989 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5394681, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25544] 10:12:39.249033 write(7, "2015-12-30 10:12:39 [25544] 1aEJMb-0006dm-9U Completed QT=2s\n", 61) = 61
[pid 25544] 10:12:39.249076 close(8)    = 0
[pid 25544] 10:12:39.249127 munmap(0x7fa692c20000, 4096) = 0
[pid 25544] 10:12:39.249165 close(9)    = 0
[pid 25544] 10:12:39.249202 unlink("/var/spool/exim/input/b/1aEJMb-0006dm-9U-J") = 0
[pid 25544] 10:12:39.249267 close(6)    = 0
[pid 25544] 10:12:39.249460 exit_group(0) = ?
[pid 25544] 10:12:39.250247 +++ exited with 0 +++
[pid 25596] 10:12:39.250858 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25596] 10:12:39.251002 brk(0x18c0000) = 0x18c0000
[pid 25596] 10:12:39.251863 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.251925 stat("/usr/local/cpanel/Errno.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.251966 stat("/etc/exim/perl/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252003 stat("/etc/exim/perl/Errno.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252040 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252077 stat("/usr/local/cpanel/Errno.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252116 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252161 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252201 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252240 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252280 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.252321 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25596] 10:12:39.252391 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25596] 10:12:39.252437 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511770) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.252475 lseek(9, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.252530 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25596] 10:12:39.252827 brk(0x18e1000) = 0x18e1000
[pid 25596] 10:12:39.253280 lseek(9, 4868, SEEK_SET) = 4868
[pid 25596] 10:12:39.253328 lseek(9, 0, SEEK_CUR) = 4868
[pid 25596] 10:12:39.253362 close(9)    = 0
[pid 25596] 10:12:39.253411 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253454 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253494 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253530 stat("/etc/exim/perl/Exporter.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253566 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253603 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253641 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253744 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd2e511980) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253789 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd2e511a20) = -1 ENOENT (No such file or directory)
[pid 25596] 10:12:39.253828 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25596] 10:12:39.253883 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25596] 10:12:39.253933 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd2e511770) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25596] 10:12:39.253969 lseek(9, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.254014 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25596] 10:12:39.254533 lseek(9, 2366, SEEK_SET) = 2366
[pid 25596] 10:12:39.254582 lseek(9, 0, SEEK_CUR) = 2366
[pid 25596] 10:12:39.254616 close(9)    = 0
[pid 25596] 10:12:39.255018 read(8, "", 8192) = 0
[pid 25596] 10:12:39.255067 close(8)    = 0
[pid 25596] 10:12:39.255315 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25596] 10:12:39.255368 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25596] 10:12:39.255417 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096991000
[pid 25596] 10:12:39.255455 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25596] 10:12:39.255503 close(8)    = 0
[pid 25596] 10:12:39.255536 munmap(0x7fb096991000, 4096) = 0
[pid 25596] 10:12:39.255624 lseek(6, 19, SEEK_SET) = 19
[pid 25596] 10:12:39.255724 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.255766 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.255801 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.255836 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.255878 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.255917 alarm(300)  = 0
[pid 25596] 10:12:39.255950 alarm(0)    = 300
[pid 25596] 10:12:39.255986 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.256021 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.256055 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.256089 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.256122 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fb095849790}, NULL, 8) = 0
[pid 25596] 10:12:39.256157 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, 8) = 0
[pid 25596] 10:12:39.256195 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, 8) = 0
[pid 25596] 10:12:39.256238 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.256307 open("/var/spool/exim/input/d/hdr.25596", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25596] 10:12:39.256389 fchown(8, 47, 12) = 0
[pid 25596] 10:12:39.256428 fchmod(8, 0640) = 0
[pid 25596] 10:12:39.256463 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25596] 10:12:39.256499 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.256544 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096991000
[pid 25596] 10:12:39.256581 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.256641 write(8, "1aEJMd-0006eq-6O-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25596] 10:12:39.256765 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.256818 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMd-0006eq-6O\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:39 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691) = 691
[pid 25596] 10:12:39.256857 fsync(8Process 25599 attached
 <unfinished ...>
[pid 25599] 10:12:39.256953 set_robust_list(0x7f830f86baa0, 24) = 0
[pid 25599] 10:12:39.257133 close(0)    = 0
[pid 25599] 10:12:39.257171 close(1)    = 0
[pid 25599] 10:12:39.257202 close(2)    = 0
[pid 25599] 10:12:39.257293 setsid()    = 25599
[pid 25599] 10:12:39.257331 fstat(0, 0x7ffd8819a9a0) = -1 EBADF (Bad file descriptor)
[pid 25596] 10:12:39.257373 <... fsync resumed> ) = 0
[pid 25596] 10:12:39.257393 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.257439 close(8)    = 0
[pid 25596] 10:12:39.257473 munmap(0x7fb096991000, 4096) = 0
[pid 25596] 10:12:39.257514 rename("/var/spool/exim/input/d/hdr.25596", "/var/spool/exim/input/d/1aEJMd-0006eq-6O-H") = 0
[pid 25596] 10:12:39.257580 open("/var/spool/exim/input/d/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25596] 10:12:39.257633 fsync(8)    = 0
[pid 25596] 10:12:39.257741 close(8)    = 0
[pid 25596] 10:12:39.257777 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3208, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.257836 open("/var/spool/exim/msglog/d/1aEJMd-0006eq-6O", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25596] 10:12:39.257908 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25596] 10:12:39.257944 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.257988 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb096991000
[pid 25596] 10:12:39.258023 lseek(8, 0, SEEK_CUR) = 0
[pid 25596] 10:12:39.258057 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.258128 write(8, "2015-12-30 10:12:39 Received from <> R=1aEJMX-0006bl-RX U=mailnull P=local S=3831 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25596] 10:12:39.258173 close(8)    = 0
[pid 25596] 10:12:39.258206 munmap(0x7fb096991000, 4096) = 0
[pid 25596] 10:12:39.258245 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.258299 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25596] 10:12:39.258355 close(7)    = 0
[pid 25596] 10:12:39.258397 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25596] 10:12:39.258441 fcntl(7, F_GETFD) = 0
[pid 25596] 10:12:39.258472 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25596] 10:12:39.258504 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5394742, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25596] 10:12:39.258547 write(7, "2015-12-30 10:12:39 [25596] 1aEJMd-0006eq-6O <= <> R=1aEJMX-0006bl-RX U=mailnull P=local S=3831 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25596] 10:12:39.258589 close(6)    = 0
[pid 25596] 10:12:39.258624 munmap(0x7fb096992000, 4096) = 0
[pid 25596] 10:12:39.258747 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, 8) = 0
[pid 25596] 10:12:39.258791 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fb0945926a0}, 8) = 0
[pid 25596] 10:12:39.258829 open("/proc/loadavg", O_RDONLY) = 6
[pid 25596] 10:12:39.258876 read(6, "0.41 0.13 0.03 2/252 25599\n", 40) = 27
[pid 25596] 10:12:39.258915 close(6)    = 0
[pid 25596] 10:12:39.258961 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb09697ca90) = 25600
[pid 25596] 10:12:39.259505 exit_group(0) = ?
[pid 25596] 10:12:39.259836 +++ exited with 0 +++
[pid 25411] 10:12:39.259878 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25596
[pid 25411] 10:12:39.259904 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f8166ea06a0}, 8) = 0
[pid 25411] 10:12:39.259964 write(8, "2015-12-30 10:12:39 phoenixmarriottmesa@finestweddingsites.com: children all complete\n", 86) = 86
[pid 25411] 10:12:39.260007 open("/var/spool/exim/input/X/hdr.25411", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25411] 10:12:39.260073 fchown(10, 47, 12) = 0
[pid 25411] 10:12:39.260109 fchmod(10, 0640) = 0
[pid 25411] 10:12:39.260143 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25411] 10:12:39.260179 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.260225 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81692a0000
[pid 25411] 10:12:39.260261 lseek(10, 0, SEEK_CUR) = 0
[pid 25411] 10:12:39.260307 write(10, "1aEJMX-0006bl-RX-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491953 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 823) = 823
[pid 25411] 10:12:39.260362 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=823, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.260414 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMX-0006bl-RX; Wed, 30 Dec 2015 10:12:33 -0600\n121T To:  salesadmin@phoenixmarriottmesa.com, rivankovich@phoenix"..., 604) = 604
[pid 25411] 10:12:39.260459 fsync(10 <unfinished ...>
[pid 25599] 10:12:39.260509 open("/dev/null", O_RDWR) = 0
[pid 25599] 10:12:39.260641 fstat(1, 0x7ffd8819a9a0) = -1 EBADF (Bad file descriptor)
[pid 25599] 10:12:39.260758 dup2(0, 1)  = 1
[pid 25599] 10:12:39.260792 fstat(2,  <unfinished ...>
[pid 25411] 10:12:39.260817 <... fsync resumed> ) = 0
[pid 25411] 10:12:39.260835 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080182, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1427, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.260880 close(10)   = 0
[pid 25411] 10:12:39.260913 munmap(0x7f81692a0000, 4096) = 0
[pid 25411] 10:12:39.260955 rename("/var/spool/exim/input/X/hdr.25411", "/var/spool/exim/input/X/1aEJMX-0006bl-RX-H") = 0
[pid 25411] 10:12:39.261037 open("/var/spool/exim/input/X/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25411] 10:12:39.261085 fsync(10)   = 0
[pid 25411] 10:12:39.261117 close(10)   = 0
[pid 25411] 10:12:39.261155 unlink("/var/spool/exim/msglog/X/1aEJMX-0006bl-RX") = 0
[pid 25411] 10:12:39.261204 unlink("/var/spool/exim/input/X/1aEJMX-0006bl-RX-D") = 0
[pid 25411] 10:12:39.261248 unlink("/var/spool/exim/input/X/1aEJMX-0006bl-RX-H") = 0
[pid 25411] 10:12:39.261317 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.261380 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25411] 10:12:39.261430 close(7)    = 0
[pid 25411] 10:12:39.261466 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25411] 10:12:39.261505 fcntl(7, F_GETFD) = 0
[pid 25411] 10:12:39.261536 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25411] 10:12:39.261567 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5394946, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25411] 10:12:39.261615 write(7, "2015-12-30 10:12:39 [25411] 1aEJMX-0006bl-RX Completed QT=6s\n", 61) = 61
[pid 25411] 10:12:39.261730 close(8)    = 0
[pid 25411] 10:12:39.261780 munmap(0x7f81692a1000, 4096) = 0
[pid 25411] 10:12:39.261823 close(9)    = 0
[pid 25411] 10:12:39.261858 unlink("/var/spool/exim/input/X/1aEJMX-0006bl-RX-J") = 0
[pid 25411] 10:12:39.261924 close(6)    = 0
[pid 25411] 10:12:39.262106 exit_group(0) = ?
[pid 25411] 10:12:39.264104 +++ exited with 0 +++
[pid 25599] 10:12:39.264297 <... fstat resumed> 0x7ffd8819a9a0) = -1 EBADF (Bad file descriptor)
[pid 25599] 10:12:39.264328 dup2(0, 2)  = 2
[pid 25599] 10:12:39.264363 geteuid()   = 47
[pid 25599] 10:12:39.264405 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25599] 10:12:39.264455 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25599] 10:12:39.264498 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25599] 10:12:39.264547 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMd-0006ep-5X"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25599] 10:12:39.265248 brk(0)      = 0x1442000
[pid 25599] 10:12:39.265288 fcntl(0, F_GETFD) = 0
[pid 25599] 10:12:39.265320 fcntl(1, F_GETFD) = 0
[pid 25599] 10:12:39.265350 fcntl(2, F_GETFD) = 0
[pid 25599] 10:12:39.265391 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265446 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b4000
[pid 25599] 10:12:39.265497 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265545 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265591 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265637 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265740 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265779 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265821 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265860 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265897 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25599] 10:12:39.265946 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.265990 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266027 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266065 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266142 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266219 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.266267 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266305 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266341 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266377 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266416 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266454 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fff15a3a7d0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266490 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.266534 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.266588 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25599] 10:12:39.266633 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25599] 10:12:39.266767 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fc0da9aa000
[pid 25599] 10:12:39.266803 close(6)    = 0
[pid 25599] 10:12:39.266841 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.266882 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.266922 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.266967 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0da57c000
[pid 25599] 10:12:39.267002 mprotect(0x7fc0da592000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.267044 mmap(0x7fc0da792000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fc0da792000
[pid 25599] 10:12:39.267086 mmap(0x7fc0da794000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0da794000
[pid 25599] 10:12:39.267128 close(6)    = 0
[pid 25599] 10:12:39.267166 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267207 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267247 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267287 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.267326 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.267364 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.267408 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a9000
[pid 25599] 10:12:39.267446 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0da363000
[pid 25599] 10:12:39.267481 mprotect(0x7fc0da379000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.267514 mmap(0x7fc0da578000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fc0da578000
[pid 25599] 10:12:39.267561 mmap(0x7fc0da57a000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0da57a000
[pid 25599] 10:12:39.267605 close(6)    = 0
[pid 25599] 10:12:39.267743 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267793 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267834 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.267877 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.267916 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.267954 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.267998 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0da12c000
[pid 25599] 10:12:39.268034 mprotect(0x7fc0da133000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.268067 mmap(0x7fc0da333000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fc0da333000
[pid 25599] 10:12:39.268107 mmap(0x7fc0da335000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0da335000
[pid 25599] 10:12:39.268149 close(6)    = 0
[pid 25599] 10:12:39.268197 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268239 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268279 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268317 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25599] 10:12:39.268354 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.268393 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.268437 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d9ea8000
[pid 25599] 10:12:39.268472 mprotect(0x7fc0d9f2b000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.268505 mmap(0x7fc0da12a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fc0da12a000
[pid 25599] 10:12:39.268549 close(6)    = 0
[pid 25599] 10:12:39.268587 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268636 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268790 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.268839 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25599] 10:12:39.268878 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.268917 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25599] 10:12:39.268961 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a8000
[pid 25599] 10:12:39.268999 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d9c9a000
[pid 25599] 10:12:39.269034 mprotect(0x7fc0d9ca6000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.269068 mmap(0x7fc0d9ea6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fc0d9ea6000
[pid 25599] 10:12:39.269113 close(6)    = 0
[pid 25599] 10:12:39.269152 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.269193 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.269231 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25599] 10:12:39.269275 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d9a77000
[pid 25599] 10:12:39.269309 mprotect(0x7fc0d9a98000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.269342 mmap(0x7fc0d9c98000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fc0d9c98000
[pid 25599] 10:12:39.269381 close(6)    = 0
[pid 25599] 10:12:39.269419 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.269459 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.269499 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.269537 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25599] 10:12:39.269574 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.269626 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.269790 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d985a000
[pid 25599] 10:12:39.269827 mprotect(0x7fc0d9871000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.269861 mmap(0x7fc0d9a71000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fc0d9a71000
[pid 25599] 10:12:39.269902 mmap(0x7fc0d9a73000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d9a73000
[pid 25599] 10:12:39.269943 close(6)    = 0
[pid 25599] 10:12:39.269982 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270065 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270104 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25599] 10:12:39.270141 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.270179 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.270222 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a7000
[pid 25599] 10:12:39.270259 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d94e6000
[pid 25599] 10:12:39.270294 mprotect(0x7fc0d9655000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.270327 mmap(0x7fc0d9854000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fc0d9854000
[pid 25599] 10:12:39.270371 close(6)    = 0
[pid 25599] 10:12:39.270412 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270452 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270492 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.270530 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25599] 10:12:39.270569 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.270617 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25599] 10:12:39.270812 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d9257000
[pid 25599] 10:12:39.270851 mprotect(0x7fc0d92e2000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.270885 mmap(0x7fc0d94e2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fc0d94e2000
[pid 25599] 10:12:39.270927 mmap(0x7fc0d94e5000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d94e5000
[pid 25599] 10:12:39.270968 close(6)    = 0
[pid 25599] 10:12:39.271008 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271089 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271128 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.271165 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.271204 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25599] 10:12:39.271248 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d9051000
[pid 25599] 10:12:39.271284 mprotect(0x7fc0d9057000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.271318 mmap(0x7fc0d9256000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fc0d9256000
[pid 25599] 10:12:39.271358 close(6)    = 0
[pid 25599] 10:12:39.271395 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271438 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25599] 10:12:39.271478 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.271517 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.271561 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a6000
[pid 25599] 10:12:39.271607 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d8d1b000
[pid 25599] 10:12:39.271645 mprotect(0x7fc0d8e47000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.271765 mmap(0x7fc0d9047000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fc0d9047000
[pid 25599] 10:12:39.271814 mmap(0x7fc0d9050000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d9050000
[pid 25599] 10:12:39.271862 close(6)    = 0
[pid 25599] 10:12:39.271901 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271942 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.271991 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272031 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.272069 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.272107 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.272151 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d8b17000
[pid 25599] 10:12:39.272187 mprotect(0x7fc0d8b19000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.272221 mmap(0x7fc0d8d19000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fc0d8d19000
[pid 25599] 10:12:39.272264 close(6)    = 0
[pid 25599] 10:12:39.272302 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272345 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272386 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272425 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.272463 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.272500 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.272544 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d8914000
[pid 25599] 10:12:39.272579 mprotect(0x7fc0d8916000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.272622 mmap(0x7fc0d8b15000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fc0d8b15000
[pid 25599] 10:12:39.272752 close(6)    = 0
[pid 25599] 10:12:39.272800 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272843 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272883 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.272922 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25599] 10:12:39.272960 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.273011 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.273056 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a5000
[pid 25599] 10:12:39.273094 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d8580000
[pid 25599] 10:12:39.273129 mprotect(0x7fc0d870a000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.273163 mmap(0x7fc0d890a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fc0d890a000
[pid 25599] 10:12:39.273207 mmap(0x7fc0d890f000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d890f000
[pid 25599] 10:12:39.273248 close(6)    = 0
[pid 25599] 10:12:39.273287 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273327 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273366 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273406 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25599] 10:12:39.273445 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.273482 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25599] 10:12:39.273526 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d8314000
[pid 25599] 10:12:39.273561 mprotect(0x7fc0d8376000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.273601 mmap(0x7fc0d8575000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fc0d8575000
[pid 25599] 10:12:39.273731 close(6)    = 0
[pid 25599] 10:12:39.273780 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273822 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273862 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.273900 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25599] 10:12:39.273939 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.273983 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25599] 10:12:39.274028 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d7f31000
[pid 25599] 10:12:39.274064 mprotect(0x7fc0d80ea000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.274097 mmap(0x7fc0d82e9000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fc0d82e9000
[pid 25599] 10:12:39.274138 mmap(0x7fc0d8310000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d8310000
[pid 25599] 10:12:39.274187 close(6)    = 0
[pid 25599] 10:12:39.274227 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.274267 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.274308 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.274346 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25599] 10:12:39.274384 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.274423 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25599] 10:12:39.274467 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a4000
[pid 25599] 10:12:39.274504 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d7d04000
[pid 25599] 10:12:39.274540 mprotect(0x7fc0d7d30000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.274574 mmap(0x7fc0d7f30000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fc0d7f30000
[pid 25599] 10:12:39.274614 close(6)    = 0
[pid 25599] 10:12:39.274684 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.274804 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.274845 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25599] 10:12:39.274889 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d7aff000
[pid 25599] 10:12:39.274925 mprotect(0x7fc0d7b04000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.274965 mmap(0x7fc0d7d03000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7fc0d7d03000
[pid 25599] 10:12:39.275006 close(6)    = 0
[pid 25599] 10:12:39.275046 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275126 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275164 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25599] 10:12:39.275273 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.275316 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25599] 10:12:39.275370 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d78fc000
[pid 25599] 10:12:39.275411 mprotect(0x7fc0d78fe000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.275445 mmap(0x7fc0d7afd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fc0d7afd000
[pid 25599] 10:12:39.275490 close(6)    = 0
[pid 25599] 10:12:39.275531 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275573 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275612 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.275708 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.275755 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.275793 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25599] 10:12:39.275837 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a3000
[pid 25599] 10:12:39.275875 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d76d9000
[pid 25599] 10:12:39.275910 mprotect(0x7fc0d76f0000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.275944 mmap(0x7fc0d78f0000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fc0d78f0000
[pid 25599] 10:12:39.275990 close(6)    = 0
[pid 25599] 10:12:39.276040 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276081 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276128 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276167 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.276205 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.276242 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.276287 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d7495000
[pid 25599] 10:12:39.276323 mprotect(0x7fc0d74d6000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.276356 mmap(0x7fc0d76d6000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7fc0d76d6000
[pid 25599] 10:12:39.276403 close(6)    = 0
[pid 25599] 10:12:39.276444 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276484 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276523 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.276561 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25599] 10:12:39.276598 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.276636 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.276790 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a2000
[pid 25599] 10:12:39.276829 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d71ae000
[pid 25599] 10:12:39.276865 mprotect(0x7fc0d7289000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.276899 mmap(0x7fc0d7489000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fc0d7489000
[pid 25599] 10:12:39.276944 close(6)    = 0
[pid 25599] 10:12:39.276984 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277064 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277103 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25599] 10:12:39.277141 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.277192 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.277239 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d6faa000
[pid 25599] 10:12:39.277276 mprotect(0x7fc0d6fad000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.277312 mmap(0x7fc0d71ac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fc0d71ac000
[pid 25599] 10:12:39.277358 close(6)    = 0
[pid 25599] 10:12:39.277397 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277437 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277476 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277515 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25599] 10:12:39.277554 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.277591 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.277635 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d6d7e000
[pid 25599] 10:12:39.277761 mprotect(0x7fc0d6da7000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.277804 mmap(0x7fc0d6fa7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fc0d6fa7000
[pid 25599] 10:12:39.277853 mmap(0x7fc0d6fa9000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d6fa9000
[pid 25599] 10:12:39.277895 close(6)    = 0
[pid 25599] 10:12:39.277937 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.277979 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278058 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.278096 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.278139 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25599] 10:12:39.278185 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a1000
[pid 25599] 10:12:39.278228 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d6b68000
[pid 25599] 10:12:39.278270 mprotect(0x7fc0d6b7d000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.278305 mmap(0x7fc0d6d7c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fc0d6d7c000
[pid 25599] 10:12:39.278355 close(6)    = 0
[pid 25599] 10:12:39.278409 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278451 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278491 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278529 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25599] 10:12:39.278568 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.278614 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25599] 10:12:39.278752 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d695d000
[pid 25599] 10:12:39.278793 mprotect(0x7fc0d6967000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.278827 mmap(0x7fc0d6b66000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fc0d6b66000
[pid 25599] 10:12:39.278871 close(6)    = 0
[pid 25599] 10:12:39.278912 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.278960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.279001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.279040 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.279078 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.279116 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25599] 10:12:39.279160 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d675a000
[pid 25599] 10:12:39.279203 mprotect(0x7fc0d675c000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.279238 mmap(0x7fc0d695b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fc0d695b000
[pid 25599] 10:12:39.279281 close(6)    = 0
[pid 25599] 10:12:39.279319 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9a0000
[pid 25599] 10:12:39.279369 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.279412 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.279452 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.279491 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25599] 10:12:39.279527 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.279571 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25599] 10:12:39.279626 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fc0d653b000
[pid 25599] 10:12:39.279850 mprotect(0x7fc0d6558000, 2093056, PROT_NONE) = 0
[pid 25599] 10:12:39.279889 mmap(0x7fc0d6757000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fc0d6757000
[pid 25599] 10:12:39.279931 mmap(0x7fc0d6759000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc0d6759000
[pid 25599] 10:12:39.279972 close(6)    = 0
[pid 25599] 10:12:39.280039 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da99f000
[pid 25599] 10:12:39.280112 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da99e000
[pid 25599] 10:12:39.280156 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da99c000
[pid 25599] 10:12:39.280194 arch_prctl(ARCH_SET_FS, 0x7fc0da99c7c0) = 0
[pid 25599] 10:12:39.280265 mprotect(0x7fc0d6757000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280305 mprotect(0x7fc0d695b000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280358 mprotect(0x7fc0d6b66000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280401 mprotect(0x7fc0d6d7c000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280449 mprotect(0x7fc0d6fa7000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280494 mprotect(0x7fc0d71ac000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280708 mprotect(0x7fc0d7489000, 40960, PROT_READ) = 0
[pid 25599] 10:12:39.280845 mprotect(0x7fc0d76d6000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280892 mprotect(0x7fc0d78f0000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.280931 mprotect(0x7fc0d7afd000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.281164 mprotect(0x7fc0d82e9000, 110592, PROT_READ) = 0
[pid 25599] 10:12:39.281275 mprotect(0x7fc0d8575000, 16384, PROT_READ) = 0
[pid 25599] 10:12:39.281406 mprotect(0x7fc0d890a000, 16384, PROT_READ) = 0
[pid 25599] 10:12:39.281450 mprotect(0x7fc0d8b15000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.281492 mprotect(0x7fc0d8d19000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282272 mprotect(0x7fc0d9a71000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282335 mprotect(0x7fc0d9ea6000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282377 mprotect(0x7fc0da12a000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282425 mprotect(0x7fc0da333000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282474 mprotect(0x7fc0da578000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282518 mprotect(0x7fc0da792000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282579 mprotect(0x7fc0da9b5000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.282624 munmap(0x7fc0da9aa000, 39387) = 0
[pid 25599] 10:12:39.282730 set_tid_address(0x7fc0da99ca90) = 25599
[pid 25599] 10:12:39.282764 set_robust_list(0x7fc0da99caa0, 24) = 0
[pid 25599] 10:12:39.282794 futex(0x7fff15a3b0cc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25599] 10:12:39.282826 futex(0x7fff15a3b0cc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fc0da99c7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25599] 10:12:39.282864 rt_sigaction(SIGRTMIN, {0x7fc0d985fc60, [], SA_RESTORER|SA_SIGINFO, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.282903 rt_sigaction(SIGRT_1, {0x7fc0d985fcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.282938 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25599] 10:12:39.282980 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25599] 10:12:39.283048 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350311, f_bavail=6350311, f_files=1000000, f_ffree=691066, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25599] 10:12:39.283152 brk(0)      = 0x1442000
[pid 25599] 10:12:39.283187 brk(0x1463000) = 0x1463000
[pid 25599] 10:12:39.283229 open("/proc/filesystems", O_RDONLY) = 6
[pid 25599] 10:12:39.283289 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.283336 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b3000
[pid 25599] 10:12:39.283371 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25599] 10:12:39.283459 read(6, "", 1024) = 0
[pid 25599] 10:12:39.283497 close(6)    = 0
[pid 25599] 10:12:39.283532 munmap(0x7fc0da9b3000, 4096) = 0
[pid 25599] 10:12:39.283621 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.283814 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.283865 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25599] 10:12:39.283943 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.283983 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25599] 10:12:39.284021 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25599] 10:12:39.284056 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.284098 umask(0)    = 0
[pid 25599] 10:12:39.284163 geteuid()   = 0
[pid 25599] 10:12:39.284197 getuid()    = 47
[pid 25599] 10:12:39.284228 getgid()    = 12
[pid 25599] 10:12:39.284282 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25599] 10:12:39.284323 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25599] 10:12:39.284358 getgroups(65536, [12]) = 1
[pid 25599] 10:12:39.284397 setgroups(0, []) = 0
[pid 25599] 10:12:39.284431 getegid()   = 12
[pid 25599] 10:12:39.284461 geteuid()   = 0
[pid 25599] 10:12:39.284495 geteuid()   = 0
[pid 25599] 10:12:39.284525 getegid()   = 12
[pid 25599] 10:12:39.284556 setgid(12)  = 0
[pid 25599] 10:12:39.284604 setuid(0)   = 0
[pid 25599] 10:12:39.284733 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25599] 10:12:39.284809 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.284868 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.284918 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b3000
[pid 25599] 10:12:39.284954 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25599] 10:12:39.285105 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25599] 10:12:39.285148 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.285195 close(7)    = 0
[pid 25599] 10:12:39.285229 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25599] 10:12:39.285263 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.285301 close(7)    = 0
[pid 25599] 10:12:39.285340 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25599] 10:12:39.285380 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25599] 10:12:39.285426 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.285461 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25599] 10:12:39.285520 read(7, "", 4096) = 0
[pid 25599] 10:12:39.285555 close(7)    = 0
[pid 25599] 10:12:39.285596 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.285645 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.285764 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.285807 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.285854 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25599] 10:12:39.285891 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25599] 10:12:39.285935 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fc0da992000
[pid 25599] 10:12:39.285970 close(7)    = 0
[pid 25599] 10:12:39.286008 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25599] 10:12:39.286048 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25599] 10:12:39.286092 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25599] 10:12:39.286142 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fc0d632d000
[pid 25599] 10:12:39.286180 mprotect(0x7fc0d6339000, 2097152, PROT_NONE) = 0
[pid 25599] 10:12:39.286214 mmap(0x7fc0d6539000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fc0d6539000
[pid 25599] 10:12:39.286260 close(7)    = 0
[pid 25599] 10:12:39.286310 mprotect(0x7fc0d6539000, 4096, PROT_READ) = 0
[pid 25599] 10:12:39.286351 munmap(0x7fc0da992000, 39387) = 0
[pid 25599] 10:12:39.286394 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25599] 10:12:39.286438 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25599] 10:12:39.286474 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.286518 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.286552 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.286618 close(7)    = 0
[pid 25599] 10:12:39.286735 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.286795 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25599] 10:12:39.286834 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.286876 close(7)    = 0
[pid 25599] 10:12:39.286910 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25599] 10:12:39.286943 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.286980 close(7)    = 0
[pid 25599] 10:12:39.287018 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25599] 10:12:39.287057 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25599] 10:12:39.287101 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.287135 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25599] 10:12:39.287186 close(7)    = 0
[pid 25599] 10:12:39.287218 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.287268 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25599] 10:12:39.287341 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25599] 10:12:39.287382 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.287427 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.287466 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.287508 close(7)    = 0
[pid 25599] 10:12:39.287540 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.287580 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25599] 10:12:39.287635 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25599] 10:12:39.287780 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0d9869790}, 8) = 0
[pid 25599] 10:12:39.287831 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fc0da99ca90) = 25601
[pid 25599] 10:12:39.288070 wait4(25601, Process 25600 attached
 <unfinished ...>
[pid 25600] 10:12:39.288127 set_robust_list(0x7fb09697caa0, 24) = 0
[pid 25600] 10:12:39.288181 close(0)    = 0
[pid 25600] 10:12:39.288217 close(1)    = 0
[pid 25600] 10:12:39.288248 close(2)    = 0
[pid 25600] 10:12:39.288335 setsid()    = 25600
[pid 25600] 10:12:39.288376 fstat(0, 0x7ffd2e5162a0) = -1 EBADF (Bad file descriptor)
[pid 25600] 10:12:39.288413 open("/dev/null", O_RDWR) = 0
[pid 25600] 10:12:39.288456 fstat(1, 0x7ffd2e5162a0) = -1 EBADF (Bad file descriptor)
[pid 25600] 10:12:39.288498 dup2(0, 1)  = 1
[pid 25600] 10:12:39.288532 fstat(2, 0x7ffd2e5162a0) = -1 EBADF (Bad file descriptor)
[pid 25600] 10:12:39.288563 dup2(0, 2)  = 2
[pid 25600] 10:12:39.288594 geteuid()   = 47
[pid 25600] 10:12:39.288631 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25600] 10:12:39.288736 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25600] 10:12:39.288784 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25600] 10:12:39.288831 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMd-0006eq-6O"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25600] 10:12:39.289452 brk(0)      = 0xa3e000
[pid 25600] 10:12:39.289490 fcntl(0, F_GETFD) = 0
[pid 25600] 10:12:39.289521 fcntl(1, F_GETFD) = 0
[pid 25600] 10:12:39.289551 fcntl(2, F_GETFD) = 0
[pid 25600] 10:12:39.289586 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d70000
[pid 25600] 10:12:39.289775 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289828 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289869 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289905 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289941 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.289977 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290013 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290048 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290085 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25600] 10:12:39.290132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290172 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290209 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290247 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290291 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290331 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290369 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290409 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25600] 10:12:39.290465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290503 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290540 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290578 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290738 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fff0d20a120) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290784 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.290822 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25600] 10:12:39.290875 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25600] 10:12:39.290913 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25600] 10:12:39.290955 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fcc46d66000
[pid 25600] 10:12:39.290990 close(6)    = 0
[pid 25600] 10:12:39.291028 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.291128 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.291170 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.291215 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc46938000
[pid 25600] 10:12:39.291250 mprotect(0x7fcc4694e000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.291284 mmap(0x7fcc46b4e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fcc46b4e000
[pid 25600] 10:12:39.291327 mmap(0x7fcc46b50000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc46b50000
[pid 25600] 10:12:39.291368 close(6)    = 0
[pid 25600] 10:12:39.291407 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.291448 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.291496 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.291537 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.291576 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.291620 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.291736 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d65000
[pid 25600] 10:12:39.291776 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc4671f000
[pid 25600] 10:12:39.291811 mprotect(0x7fcc46735000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.291846 mmap(0x7fcc46934000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fcc46934000
[pid 25600] 10:12:39.291886 mmap(0x7fcc46936000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc46936000
[pid 25600] 10:12:39.291927 close(6)    = 0
[pid 25600] 10:12:39.291965 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292005 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292046 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292089 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.292127 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.292165 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.292209 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc464e8000
[pid 25600] 10:12:39.292243 mprotect(0x7fcc464ef000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.292277 mmap(0x7fcc466ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fcc466ef000
[pid 25600] 10:12:39.292316 mmap(0x7fcc466f1000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc466f1000
[pid 25600] 10:12:39.292357 close(6)    = 0
[pid 25600] 10:12:39.292393 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292434 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292473 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292512 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25600] 10:12:39.292548 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.292591 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.292636 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc46264000
[pid 25600] 10:12:39.292784 mprotect(0x7fcc462e7000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.292820 mmap(0x7fcc464e6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fcc464e6000
[pid 25600] 10:12:39.292866 close(6)    = 0
[pid 25600] 10:12:39.292905 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292945 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.292985 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.293023 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25600] 10:12:39.293065 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.293124 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25600] 10:12:39.293201 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d64000
[pid 25600] 10:12:39.293261 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc46056000
[pid 25600] 10:12:39.293314 mprotect(0x7fcc46062000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.293364 mmap(0x7fcc46262000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fcc46262000
[pid 25600] 10:12:39.293430 close(6)    = 0
[pid 25600] 10:12:39.293486 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.293549 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.293615 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25600] 10:12:39.293797 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc45e33000
[pid 25600] 10:12:39.293855 mprotect(0x7fcc45e54000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.293905 mmap(0x7fcc46054000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fcc46054000
[pid 25600] 10:12:39.293969 close(6)    = 0
[pid 25600] 10:12:39.294020 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294076 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294132 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294186 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25600] 10:12:39.294237 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.294291 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.294354 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc45c16000
[pid 25600] 10:12:39.294406 mprotect(0x7fcc45c2d000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.294455 mmap(0x7fcc45e2d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fcc45e2d000
[pid 25600] 10:12:39.294511 mmap(0x7fcc45e2f000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc45e2f000
[pid 25600] 10:12:39.294567 close(6)    = 0
[pid 25600] 10:12:39.294618 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294767 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294835 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.294901 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25600] 10:12:39.294961 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.295020 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.295098 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d63000
[pid 25600] 10:12:39.295154 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc458a2000
[pid 25600] 10:12:39.295208 mprotect(0x7fcc45a11000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.295262 mmap(0x7fcc45c10000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fcc45c10000
[pid 25600] 10:12:39.295331 close(6)    = 0
[pid 25600] 10:12:39.295392 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.295462 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.295525 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.295594 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25600] 10:12:39.295753 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.295821 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25600] 10:12:39.295897 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc45613000
[pid 25600] 10:12:39.295955 mprotect(0x7fcc4569e000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.296016 mmap(0x7fcc4589e000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fcc4589e000
[pid 25600] 10:12:39.296082 mmap(0x7fcc458a1000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc458a1000
[pid 25600] 10:12:39.296141 close(6)    = 0
[pid 25600] 10:12:39.296191 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.296257 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.296320 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.296380 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.296442 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.296502 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25600] 10:12:39.296574 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc4540d000
[pid 25600] 10:12:39.296629 mprotect(0x7fcc45413000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.296794 mmap(0x7fcc45612000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fcc45612000
[pid 25600] 10:12:39.296868 close(6)    = 0
[pid 25600] 10:12:39.296924 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.296985 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25600] 10:12:39.297047 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.297114 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25600] 10:12:39.297186 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d62000
[pid 25600] 10:12:39.297244 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc450d7000
[pid 25600] 10:12:39.297298 mprotect(0x7fcc45203000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.297350 mmap(0x7fcc45403000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fcc45403000
[pid 25600] 10:12:39.297416 mmap(0x7fcc4540c000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc4540c000
[pid 25600] 10:12:39.297489 close(6)    = 0
[pid 25600] 10:12:39.297545 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.297607 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.297758 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.297822 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.297878 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.297937 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.298008 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc44ed3000
[pid 25600] 10:12:39.298062 mprotect(0x7fcc44ed5000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.298114 mmap(0x7fcc450d5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fcc450d5000
[pid 25600] 10:12:39.298178 close(6)    = 0
[pid 25600] 10:12:39.298236 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.298296 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.298361 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.298431 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.298489 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.298553 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.298623 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc44cd0000
[pid 25600] 10:12:39.298832 mprotect(0x7fcc44cd2000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.298901 mmap(0x7fcc44ed1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fcc44ed1000
[pid 25600] 10:12:39.298978 close(6)    = 0
[pid 25600] 10:12:39.299032 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.299076 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.299116 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.299155 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25600] 10:12:39.299194 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.299236 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.299283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d61000
[pid 25600] 10:12:39.299323 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc4493c000
[pid 25600] 10:12:39.299360 mprotect(0x7fcc44ac6000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.299395 mmap(0x7fcc44cc6000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fcc44cc6000
[pid 25600] 10:12:39.299441 mmap(0x7fcc44ccb000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc44ccb000
[pid 25590] 10:12:39.299485 <... select resumed> ) = 1 (in [11], left {299, 945753})
[pid 25590] 10:12:39.299522 read(11, "\27\3\3\0\250", 5) = 5
[pid 25590] 10:12:39.299559 read(11, "\334M\266m\335\366\2\322}\213\272X\257\354\332\312\34\255\321\203\304\273I\262\247\250\246z-*\20\253\366~91\264\204\340\363\5&ul\23\213\242\21\262\375\275u\350\205\313\234 \f1\214\342\364\225\274\0v+\274\343=\364s\327\3567[6P\32\3340c\200IF\177\v\367\364\23\2079\325t\273\205\\\207\355'\320ig:\356\376\316\22\33\225]l7\301Z\251\326\320@\366\254\252\276\307\r\276U\356\343\256\202#\0V\320@Q\215\26\3269\26\20\224Q\310$2P\34\362d\2601\223\16\315#F\374\300\320 _w\217\t\320", 168) = 168
[pid 25590] 10:12:39.299730 write(11, "\27\3\3\0|\312+\243\215{\253Mfg&j\266W'\371'T\342y!\370\234\220\24\260\372\361K\260\204\364\201i\207\334r\330=\364A\254\211\373\346\27\343\300\326Qv\330\213\234\r3{8\264B\204\23: \340\342\3401\212\\\n\34\241o9\r;\2\r\206r^\342\205\331jI\332V\305\375\363*\201\372\24\234\205\340\271\244\v\314wP\376P\375V\t\230\373'\313k>\322\312o\204\0303m\262\300", 129) = 129
[pid 25590] 10:12:39.299800 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25600] 10:12:39.299841 close(6)    = 0
[pid 25600] 10:12:39.299883 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.299924 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.299971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300010 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25600] 10:12:39.300049 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.300088 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25600] 10:12:39.300134 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc446d0000
[pid 25600] 10:12:39.300170 mprotect(0x7fcc44732000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.300205 mmap(0x7fcc44931000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fcc44931000
[pid 25600] 10:12:39.300251 close(6)    = 0
[pid 25600] 10:12:39.300292 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300331 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300371 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300415 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25600] 10:12:39.300455 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.300494 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25600] 10:12:39.300538 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc442ed000
[pid 25600] 10:12:39.300573 mprotect(0x7fcc444a6000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.300607 mmap(0x7fcc446a5000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fcc446a5000
[pid 25600] 10:12:39.300729 mmap(0x7fcc446cc000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc446cc000
[pid 25600] 10:12:39.300779 close(6)    = 0
[pid 25600] 10:12:39.300820 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300861 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.300938 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25600] 10:12:39.300976 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.301026 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25600] 10:12:39.301072 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d60000
[pid 25600] 10:12:39.301110 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc440c0000
[pid 25600] 10:12:39.301147 mprotect(0x7fcc440ec000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.301181 mmap(0x7fcc442ec000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fcc442ec000
[pid 25600] 10:12:39.301221 close(6)    = 0
[pid 25600] 10:12:39.301257 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.301298 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.301337 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25600] 10:12:39.301381 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc43ebb000
[pid 25600] 10:12:39.301420 mprotect(0x7fcc43ec0000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.301455 mmap(0x7fcc440bf000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7fcc440bf000
[pid 25600] 10:12:39.301502 close(6)    = 0
[pid 25600] 10:12:39.301543 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.301583 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.301624 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.301746 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25600] 10:12:39.301786 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.301824 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25600] 10:12:39.301869 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc43cb8000
[pid 25600] 10:12:39.301906 mprotect(0x7fcc43cba000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.301946 mmap(0x7fcc43eb9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fcc43eb9000
[pid 25600] 10:12:39.301991 close(6)    = 0
[pid 25600] 10:12:39.302031 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302071 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302111 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302148 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.302187 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.302231 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25600] 10:12:39.302276 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5f000
[pid 25600] 10:12:39.302314 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc43a95000
[pid 25600] 10:12:39.302349 mprotect(0x7fcc43aac000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.302384 mmap(0x7fcc43cac000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fcc43cac000
[pid 25600] 10:12:39.302434 close(6)    = 0
[pid 25600] 10:12:39.302488 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302528 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.302607 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.302645 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.302776 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.302830 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc43851000
[pid 25600] 10:12:39.302867 mprotect(0x7fcc43892000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.302901 mmap(0x7fcc43a92000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7fcc43a92000
[pid 25600] 10:12:39.302946 close(6)    = 0
[pid 25600] 10:12:39.302987 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303027 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303073 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303111 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25600] 10:12:39.303149 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.303187 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.303231 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5e000
[pid 25600] 10:12:39.303268 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc4356a000
[pid 25600] 10:12:39.303305 mprotect(0x7fcc43645000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.303341 mmap(0x7fcc43845000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fcc43845000
[pid 25600] 10:12:39.303388 close(6)    = 0
[pid 25600] 10:12:39.303439 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303480 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303519 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303557 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25600] 10:12:39.303594 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.303632 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.303785 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc43366000
[pid 25600] 10:12:39.303823 mprotect(0x7fcc43369000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.303857 mmap(0x7fcc43568000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fcc43568000
[pid 25600] 10:12:39.303902 close(6)    = 0
[pid 25600] 10:12:39.303941 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.303982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304025 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304063 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25600] 10:12:39.304101 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.304145 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.304190 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc4313a000
[pid 25600] 10:12:39.304227 mprotect(0x7fcc43163000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.304260 mmap(0x7fcc43363000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fcc43363000
[pid 25600] 10:12:39.304302 mmap(0x7fcc43365000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc43365000
[pid 25600] 10:12:39.304344 close(6)    = 0
[pid 25600] 10:12:39.304385 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304429 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304468 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304506 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.304543 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.304580 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25600] 10:12:39.304624 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5d000
[pid 25600] 10:12:39.304745 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc42f24000
[pid 25600] 10:12:39.304787 mprotect(0x7fcc42f39000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.304821 mmap(0x7fcc43138000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fcc43138000
[pid 25600] 10:12:39.304865 close(6)    = 0
[pid 25600] 10:12:39.304913 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304954 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.304994 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305033 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25600] 10:12:39.305071 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.305115 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25600] 10:12:39.305160 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc42d19000
[pid 25600] 10:12:39.305198 mprotect(0x7fcc42d23000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.305232 mmap(0x7fcc42f22000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fcc42f22000
[pid 25600] 10:12:39.305276 close(6)    = 0
[pid 25600] 10:12:39.305318 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305359 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305440 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.305479 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.305516 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25600] 10:12:39.305560 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc42b16000
[pid 25600] 10:12:39.305597 mprotect(0x7fcc42b18000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.305631 mmap(0x7fcc42d17000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fcc42d17000
[pid 25600] 10:12:39.305760 close(6)    = 0
[pid 25600] 10:12:39.305808 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5c000
[pid 25600] 10:12:39.305859 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305900 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305940 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.305978 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25600] 10:12:39.306014 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.306052 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25600] 10:12:39.306103 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fcc428f7000
[pid 25600] 10:12:39.306140 mprotect(0x7fcc42914000, 2093056, PROT_NONE) = 0
[pid 25600] 10:12:39.306174 mmap(0x7fcc42b13000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fcc42b13000
[pid 25600] 10:12:39.306217 mmap(0x7fcc42b15000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcc42b15000
[pid 25600] 10:12:39.306261 close(6)    = 0
[pid 25600] 10:12:39.306328 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5b000
[pid 25600] 10:12:39.306403 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d5a000
[pid 25600] 10:12:39.306449 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d58000
[pid 25600] 10:12:39.306498 arch_prctl(ARCH_SET_FS, 0x7fcc46d587c0) = 0
[pid 25600] 10:12:39.306572 mprotect(0x7fcc42b13000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.306611 mprotect(0x7fcc42d17000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.306732 mprotect(0x7fcc42f22000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.306781 mprotect(0x7fcc43138000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.306829 mprotect(0x7fcc43363000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.306872 mprotect(0x7fcc43568000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.307028 mprotect(0x7fcc43845000, 40960, PROT_READ) = 0
[pid 25600] 10:12:39.307157 mprotect(0x7fcc43a92000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.307204 mprotect(0x7fcc43cac000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.307242 mprotect(0x7fcc43eb9000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.307478 mprotect(0x7fcc446a5000, 110592, PROT_READ) = 0
[pid 25600] 10:12:39.307589 mprotect(0x7fcc44931000, 16384, PROT_READ) = 0
[pid 25600] 10:12:39.307778 mprotect(0x7fcc44cc6000, 16384, PROT_READ) = 0
[pid 25600] 10:12:39.307824 mprotect(0x7fcc44ed1000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.307866 mprotect(0x7fcc450d5000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308630 mprotect(0x7fcc45e2d000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308701 mprotect(0x7fcc46262000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308742 mprotect(0x7fcc464e6000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308779 mprotect(0x7fcc466ef000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308828 mprotect(0x7fcc46934000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308870 mprotect(0x7fcc46b4e000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308928 mprotect(0x7fcc46d71000, 4096, PROT_READ) = 0
[pid 25600] 10:12:39.308964 munmap(0x7fcc46d66000, 39387) = 0
[pid 25600] 10:12:39.309002 set_tid_address(0x7fcc46d58a90) = 25600
[pid 25600] 10:12:39.309032 set_robust_list(0x7fcc46d58aa0, 24) = 0
[pid 25600] 10:12:39.309062 futex(0x7fff0d20aa1c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25600] 10:12:39.309093 futex(0x7fff0d20aa1c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fcc46d587c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25600] 10:12:39.309131 rt_sigaction(SIGRTMIN, {0x7fcc45c1bc60, [], SA_RESTORER|SA_SIGINFO, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.309169 rt_sigaction(SIGRT_1, {0x7fcc45c1bcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.309204 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25600] 10:12:39.309245 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25600] 10:12:39.309315 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350311, f_bavail=6350311, f_files=1000000, f_ffree=691066, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25600] 10:12:39.309413 brk(0)      = 0xa3e000
[pid 25600] 10:12:39.309447 brk(0xa5f000) = 0xa5f000
[pid 25600] 10:12:39.309489 open("/proc/filesystems", O_RDONLY) = 6
[pid 25600] 10:12:39.309546 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.309599 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6f000
[pid 25600] 10:12:39.309635 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25600] 10:12:39.309818 read(6, "", 1024) = 0
[pid 25600] 10:12:39.309859 close(6)    = 0
[pid 25600] 10:12:39.309894 munmap(0x7fcc46d6f000, 4096) = 0
[pid 25600] 10:12:39.309978 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.310088 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.310136 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25600] 10:12:39.310213 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.310254 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25600] 10:12:39.310292 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25600] 10:12:39.310330 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.310372 umask(0)    = 0
[pid 25600] 10:12:39.310450 geteuid()   = 0
[pid 25600] 10:12:39.310488 getuid()    = 47
[pid 25600] 10:12:39.310520 getgid()    = 12
[pid 25600] 10:12:39.310573 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25600] 10:12:39.310608 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25600] 10:12:39.310642 getgroups(65536, [12]) = 1
[pid 25600] 10:12:39.310763 setgroups(0, []) = 0
[pid 25600] 10:12:39.310799 getegid()   = 12
[pid 25600] 10:12:39.310829 geteuid()   = 0
[pid 25600] 10:12:39.310864 geteuid()   = 0
[pid 25600] 10:12:39.310894 getegid()   = 12
[pid 25600] 10:12:39.310928 setgid(12)  = 0
[pid 25600] 10:12:39.310961 setuid(0)   = 0
[pid 25600] 10:12:39.311021 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25600] 10:12:39.311079 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.311131 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.311175 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6f000
[pid 25600] 10:12:39.311210 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25600] 10:12:39.311352 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25600] 10:12:39.311397 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.311443 close(7)    = 0
[pid 25600] 10:12:39.311478 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25600] 10:12:39.311512 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.311550 close(7)    = 0
[pid 25600] 10:12:39.311589 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25600] 10:12:39.311640 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25600] 10:12:39.311774 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.311810 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25600] 10:12:39.311865 read(7, "", 4096) = 0
[pid 25600] 10:12:39.311898 close(7)    = 0
[pid 25600] 10:12:39.311937 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.311985 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.312027 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.312067 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.312105 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25600] 10:12:39.312140 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25600] 10:12:39.312183 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fcc46d4e000
[pid 25600] 10:12:39.312218 close(7)    = 0
[pid 25600] 10:12:39.312257 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25600] 10:12:39.312307 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25600] 10:12:39.312350 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25600] 10:12:39.312400 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fcc426e9000
[pid 25600] 10:12:39.312441 mprotect(0x7fcc426f5000, 2097152, PROT_NONE) = 0
[pid 25600] 10:12:39.312477 mmap(0x7fcc428f5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fcc428f5000
[pid 25600] 10:12:39.312523 close(7Process 25601 attached
)    = 0
[pid 25600] 10:12:39.312593 mprotect(0x7fcc428f5000, 4096, PROT_READ <unfinished ...>
[pid 25601] 10:12:39.312628 set_robust_list(0x7fc0da99caa0, 24) = 0
[pid 25601] 10:12:39.312773 geteuid( <unfinished ...>
[pid 25600] 10:12:39.312795 <... mprotect resumed> ) = 0
[pid 25600] 10:12:39.312816 munmap(0x7fcc46d4e000, 39387) = 0
[pid 25600] 10:12:39.312861 open("/etc/passwd", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25601] 10:12:39.312883 <... geteuid resumed> ) = 0
[pid 25600] 10:12:39.312906 <... open resumed> ) = 7
[pid 25601] 10:12:39.312944 geteuid( <unfinished ...>
[pid 25600] 10:12:39.312970 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25601] 10:12:39.313004 <... geteuid resumed> ) = 0
[pid 25600] 10:12:39.313024 fstat(7,  <unfinished ...>
[pid 25601] 10:12:39.313043 getegid()   = 12
[pid 25601] 10:12:39.313076 setgid(12 <unfinished ...>
[pid 25600] 10:12:39.313095 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.313137 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25601] 10:12:39.313174 <... setgid resumed> ) = 0
[pid 25601] 10:12:39.313192 setuid(47 <unfinished ...>
[pid 25600] 10:12:39.313210 read(7,  <unfinished ...>
[pid 25601] 10:12:39.313229 <... setuid resumed> ) = 0
[pid 25600] 10:12:39.313250 <... read resumed> "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.313632 close(7)    = 0
[pid 25600] 10:12:39.313749 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.313807 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25600] 10:12:39.313845 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.313889 close(7)    = 0
[pid 25600] 10:12:39.313927 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25600] 10:12:39.313961 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.313999 close(7)    = 0
[pid 25600] 10:12:39.314037 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25600] 10:12:39.314076 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25600] 10:12:39.314120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.314162 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25600] 10:12:39.314214 close(7)    = 0
[pid 25600] 10:12:39.314247 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.314297 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25600] 10:12:39.314369 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25600] 10:12:39.314410 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.314453 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.314487 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.314528 close(7)    = 0
[pid 25600] 10:12:39.314560 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.314609 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25600] 10:12:39.314762 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25600] 10:12:39.314832 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fcc45c25790}, 8) = 0
[pid 25600] 10:12:39.314883 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fcc46d58a90) = 25602
[pid 25600] 10:12:39.315634 wait4(25602,  <unfinished ...>
[pid 25601] 10:12:39.316446 brk(0x1484000) = 0x1484000
[pid 25601] 10:12:39.316909 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25601] 10:12:39.316968 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25601] 10:12:39.317024 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25601] 10:12:39.317065 read(7, "\274\347\32!\360\231\360\6\356\355\th\242=\261A\376\362$F\333\225\263s\335q3\270\312\221\365;)\216\0\217\237\32i\262\276\362\260t\365%We", 48) = 48
[pid 25601] 10:12:39.317108 close(7)    = 0
[pid 25601] 10:12:39.317157 getuid()    = 47
[pid 25601] 10:12:39.317322 exit_group(0) = ?
[pid 25601] 10:12:39.317576 +++ exited with 0 +++
[pid 25599] 10:12:39.317584 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25601
[pid 25599] 10:12:39.317610 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, 8) = 0
[pid 25599] 10:12:39.317731 getcwd("/var/spool/exim", 16380) = 16
[pid 25599] 10:12:39.317811 open("/etc/localtime", O_RDONLY) = 7
[pid 25599] 10:12:39.317852 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.317898 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.317941 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.317976 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25599] 10:12:39.318022 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25599] 10:12:39.318055 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25599] 10:12:39.318107 close(7)    = 0
[pid 25599] 10:12:39.318142 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.318190 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25599] 10:12:39.318236 fcntl(7, F_GETFD) = 0
[pid 25599] 10:12:39.318267 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.318300 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5395213, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.318345 write(7, "2015-12-30 10:12:39 [25599] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMd-0006ep-5X\n", 92) = 92
[pid 25599] 10:12:39.318386 chdir("/var/spool/exim") = 0
[pid 25599] 10:12:39.318428 setgid(12)  = 0
[pid 25599] 10:12:39.318505 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25599] 10:12:39.318589 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25599] 10:12:39.318769 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25599] 10:12:39.318849 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25599] 10:12:39.318929 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25599] 10:12:39.319023 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25599] 10:12:39.319134 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25599] 10:12:39.319206 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25599] 10:12:39.319249 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.319295 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.319335 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.319397 close(8)    = 0
[pid 25599] 10:12:39.319436 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.319533 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25599] 10:12:39.319635 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25599] 10:12:39.319833 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25599] 10:12:39.319955 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25599] 10:12:39.320067 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25599] 10:12:39.320128 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25599] 10:12:39.320168 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.320214 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.320249 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.320296 close(8)    = 0
[pid 25599] 10:12:39.320329 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.320373 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25599] 10:12:39.320414 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25599] 10:12:39.320458 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.320491 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25599] 10:12:39.320538 close(8)    = 0
[pid 25599] 10:12:39.320570 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.320626 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25599] 10:12:39.320747 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25599] 10:12:39.320794 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.320828 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25599] 10:12:39.320875 close(8)    = 0
[pid 25599] 10:12:39.320907 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.321016 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25599] 10:12:39.321145 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25599] 10:12:39.321242 read(6, "", 4096) = 0
[pid 25599] 10:12:39.321285 read(6, "", 4096) = 0
[pid 25599] 10:12:39.321321 close(6)    = 0
[pid 25599] 10:12:39.321360 munmap(0x7fc0da9b3000, 4096) = 0
[pid 25599] 10:12:39.321423 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fc0d9869790}, NULL, 8) = 0
[pid 25599] 10:12:39.321476 open("/var/spool/exim/input/d/1aEJMd-0006ep-5X-D", O_RDWR|O_APPEND) = 6
[pid 25599] 10:12:39.321522 fcntl(6, F_GETFD) = 0
[pid 25599] 10:12:39.321553 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.321584 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25599] 10:12:39.321620 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080160, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3154, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.321745 open("/var/spool/exim/input/d/1aEJMd-0006ep-5X-H", O_RDONLY) = 8
[pid 25599] 10:12:39.321790 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.321834 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b3000
[pid 25599] 10:12:39.321869 read(8, "1aEJMd-0006ep-5X-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25599] 10:12:39.321942 read(8, "", 4096) = 0
[pid 25599] 10:12:39.321976 close(8)    = 0
[pid 25599] 10:12:39.322009 munmap(0x7fc0da9b3000, 4096) = 0
[pid 25599] 10:12:39.322047 open("/var/spool/exim/input/d/1aEJMd-0006ep-5X-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.322099 open("/var/spool/exim/msglog/d/1aEJMd-0006ep-5X", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25599] 10:12:39.322144 fcntl(8, F_GETFD) = 0
[pid 25599] 10:12:39.322176 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.322211 fchown(8, 47, 12) = 0
[pid 25599] 10:12:39.322250 fchmod(8, 0640) = 0
[pid 25599] 10:12:39.322288 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25599] 10:12:39.322322 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080192, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.322365 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b3000
[pid 25599] 10:12:39.322400 lseek(8, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.322438 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.322489 pipe([9, 10]) = 0
[pid 25599] 10:12:39.322526 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_DFL, [], SA_RESTORER, 0x7fc0d9869790}, 8) = 0
[pid 25599] 10:12:39.322566 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fc0da99ca90) = 25603
[pid 25599] 10:12:39.322843 close(10)   = 0
[pid 25599] 10:12:39.322881 read(9, Process 25602 attached
 <unfinished ...>
[pid 25602] 10:12:39.322930 set_robust_list(0x7fcc46d58aa0, 24) = 0
[pid 25602] 10:12:39.322981 geteuid()   = 0
[pid 25602] 10:12:39.323017 geteuid()   = 0
[pid 25602] 10:12:39.323048 getegid()   = 12
[pid 25602] 10:12:39.323082 setgid(12)  = 0
[pid 25602] 10:12:39.323114 setuid(47)  = 0
[pid 25602] 10:12:39.324708 brk(0xa80000) = 0xa80000
[pid 25602] 10:12:39.325072 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
Process 25603 attached
[pid 25602] 10:12:39.325146 fstat(7,  <unfinished ...>
[pid 25603] 10:12:39.325177 set_robust_list(0x7fc0da99caa0, 24 <unfinished ...>
[pid 25602] 10:12:39.325199 <... fstat resumed> {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25602] 10:12:39.325236 poll([{fd=7, events=POLLIN}], 1, 10 <unfinished ...>
[pid 25603] 10:12:39.325257 <... set_robust_list resumed> ) = 0
[pid 25603] 10:12:39.325320 close(9 <unfinished ...>
[pid 25602] 10:12:39.325343 <... poll resumed> ) = 1 ([{fd=7, revents=POLLIN}])
[pid 25602] 10:12:39.325368 read(7, "\316-\271\372\3J\7i\362jS\274\264\354\231TL\227f|8\226mE\217\241\370\220\33\301\332\3Xs\26\371%a^\353\17\27\226h\200\n\376\265", 48) = 48
[pid 25602] 10:12:39.325409 close(7)    = 0
[pid 25602] 10:12:39.325455 getuid()    = 47
[pid 25602] 10:12:39.325610 exit_group(0) = ?
[pid 25603] 10:12:39.325632 <... close resumed> ) = 0
[pid 25603] 10:12:39.325713 geteuid()   = 0
[pid 25603] 10:12:39.325751 getegid()   = 12
[pid 25603] 10:12:39.325784 setgid(494) = 0
[pid 25603] 10:12:39.325815 setuid(495) = 0
[pid 25603] 10:12:39.325865 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25603] 10:12:39.325921 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25603] 10:12:39.326003 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25603] 10:12:39.326052 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25603] 10:12:39.326089 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25602] 10:12:39.326296 +++ exited with 0 +++
[pid 25600] 10:12:39.326322 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25602
[pid 25600] 10:12:39.326347 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, 8) = 0
[pid 25600] 10:12:39.326409 getcwd("/var/spool/exim", 16380) = 16
[pid 25600] 10:12:39.326477 open("/etc/localtime", O_RDONLY) = 7
[pid 25600] 10:12:39.326516 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.326560 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.326602 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.326642 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25600] 10:12:39.326773 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25600] 10:12:39.326807 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25600] 10:12:39.326853 close(7)    = 0
[pid 25600] 10:12:39.326887 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.326934 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25600] 10:12:39.326978 fcntl(7, F_GETFD) = 0
[pid 25600] 10:12:39.327009 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.327039 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5395305, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.327084 write(7, "2015-12-30 10:12:39 [25600] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMd-0006eq-6O\n", 92) = 92
[pid 25600] 10:12:39.327123 chdir("/var/spool/exim") = 0
[pid 25600] 10:12:39.327160 setgid(12)  = 0
[pid 25600] 10:12:39.327218 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25600] 10:12:39.327308 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25600] 10:12:39.327400 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25600] 10:12:39.327483 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25600] 10:12:39.327556 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25600] 10:12:39.327765 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25600] 10:12:39.327889 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25600] 10:12:39.327961 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25600] 10:12:39.328003 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.328049 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.328084 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.328128 close(8)    = 0
[pid 25600] 10:12:39.328161 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.328256 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25600] 10:12:39.328351 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25600] 10:12:39.328476 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25600] 10:12:39.328608 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25600] 10:12:39.328797 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25600] 10:12:39.328855 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25600] 10:12:39.328897 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.328942 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.328977 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.329025 close(8)    = 0
[pid 25600] 10:12:39.329059 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.329169 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25600] 10:12:39.329215 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25600] 10:12:39.329259 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.329294 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25600] 10:12:39.329343 close(8)    = 0
[pid 25600] 10:12:39.329386 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.329442 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25600] 10:12:39.329483 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25600] 10:12:39.329527 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.329560 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25600] 10:12:39.329606 close(8)    = 0
[pid 25600] 10:12:39.329640 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.329810 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25600] 10:12:39.329939 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25600] 10:12:39.330034 read(6, "", 4096) = 0
[pid 25600] 10:12:39.330071 read(6, "", 4096) = 0
[pid 25600] 10:12:39.330105 close(6)    = 0
[pid 25600] 10:12:39.330137 munmap(0x7fcc46d6f000, 4096) = 0
[pid 25600] 10:12:39.330187 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fcc45c25790}, NULL, 8) = 0
[pid 25600] 10:12:39.330235 open("/var/spool/exim/input/d/1aEJMd-0006eq-6O-D", O_RDWR|O_APPEND) = 6
[pid 25600] 10:12:39.330280 fcntl(6, F_GETFD) = 0
[pid 25600] 10:12:39.330311 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.330341 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25600] 10:12:39.330376 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080168, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3208, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.330426 open("/var/spool/exim/input/d/1aEJMd-0006eq-6O-H", O_RDONLY) = 8
[pid 25600] 10:12:39.330470 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.330512 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6f000
[pid 25600] 10:12:39.330547 read(8, "1aEJMd-0006eq-6O-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 959
[pid 25600] 10:12:39.330617 read(8, "", 4096) = 0
[pid 25600] 10:12:39.330726 close(8)    = 0
[pid 25600] 10:12:39.330765 munmap(0x7fcc46d6f000, 4096) = 0
[pid 25600] 10:12:39.330805 open("/var/spool/exim/input/d/1aEJMd-0006eq-6O-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.330857 open("/var/spool/exim/msglog/d/1aEJMd-0006eq-6O", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25600] 10:12:39.330900 fcntl(8, F_GETFD) = 0
[pid 25600] 10:12:39.330931 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.330966 fchown(8, 47, 12) = 0
[pid 25600] 10:12:39.331003 fchmod(8, 0640) = 0
[pid 25600] 10:12:39.331040 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25600] 10:12:39.331076 fstat(8, {st_dev=makedev(144, 4215), st_ino=125080176, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.331120 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6f000
[pid 25600] 10:12:39.331154 lseek(8, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.331190 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.331240 pipe([9, 10]) = 0
[pid 25600] 10:12:39.331275 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_DFL, [], SA_RESTORER, 0x7fcc45c25790}, 8) = 0
[pid 25600] 10:12:39.331316 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fcc46d58a90) = 25604
[pid 25600] 10:12:39.331507 close(10)   = 0
[pid 25600] 10:12:39.331543 read(9,  <unfinished ...>
[pid 25603] 10:12:39.331564 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25603] 10:12:39.331608 close(9)    = 0
[pid 25603] 10:12:39.331641 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25603] 10:12:39.331788 brk(0x1485000) = 0x1485000
[pid 25603] 10:12:39.331920 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25599] 10:12:39.331950 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25599] 10:12:39.331971 read(9,  <unfinished ...>
[pid 25603] 10:12:39.331990 <... write resumed> ) = 4
[pid 25603] 10:12:39.332008 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25599] 10:12:39.332031 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25599] 10:12:39.332049 read(9,  <unfinished ...>
[pid 25603] 10:12:39.332068 <... write resumed> ) = 4
[pid 25603] 10:12:39.332085 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25599] 10:12:39.332106 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25599] 10:12:39.332124 read(9,  <unfinished ...>
[pid 25603] 10:12:39.332143 <... write resumed> ) = 4
[pid 25603] 10:12:39.332160 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25599] 10:12:39.332181 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25599] 10:12:39.332200 read(9,  <unfinished ...>
[pid 25603] 10:12:39.332218 <... write resumed> ) = 4
[pid 25603] 10:12:39.332235 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25599] 10:12:39.332256 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25599] 10:12:39.332274 read(9,  <unfinished ...>
[pid 25603] 10:12:39.332293 <... write resumed> ) = 4
[pid 25603] 10:12:39.332310 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25599] 10:12:39.332335 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25599] 10:12:39.332356 read(9,  <unfinished ...>
[pid 25603] 10:12:39.332375 <... write resumed> ) = 40
[pid 25603] 10:12:39.332397 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25599] 10:12:39.332419 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25599] 10:12:39.332441 wait4(-1,  <unfinished ...>
[pid 25603] 10:12:39.332460 <... write resumed> ) = 4
[pid 25603] 10:12:39.332478 close(10)   = 0
[pid 25603] 10:12:39.332517 exit_group(0) = ?
[pid 25603] 10:12:39.332730 +++ exited with 0 +++
[pid 25599] 10:12:39.332759 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25603
[pid 25599] 10:12:39.332782 close(9)    = 0
[pid 25599] 10:12:39.332817 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, 8) = 0
[pid 25599] 10:12:39.332871 brk(0x1484000) = 0x1484000
[pid 25599] 10:12:39.332913 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25599] 10:12:39.332958 alarm(60)   = 0
[pid 25599] 10:12:39.332991 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25599] 10:12:39.333026 alarm(0)    = 60
[pid 25599] 10:12:39.333100 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.333146 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25599] 10:12:39.333190 read(10, "cpu  123108 1342516 395340 67343124 2509 0 0 0\ncpu0 123108 1342516 395340 67343124 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58698282\nbtime 1450798266\nprocesses 893082\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25599] 10:12:39.333258 close(10)   = 0
[pid 25599] 10:12:39.333346 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25599] 10:12:39.333419 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25599] 10:12:39.333460 fcntl(10, F_GETFD) = 0
[pid 25599] 10:12:39.333491 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.333528 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25599] 10:12:39.333581 close(10)   = 0
[pid 25599] 10:12:39.333628 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.333740 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25599] 10:12:39.333849 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da96b000
[pid 25599] 10:12:39.333987 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25599] 10:12:39.334027 fcntl(10, F_GETFD) = 0
[pid 25599] 10:12:39.334058 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.334091 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25599] 10:12:39.334170 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25599] 10:12:39.334258 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25599] 10:12:39.334323 close(10)   = 0
[pid 25599] 10:12:39.334380 munmap(0x7fc0da96b000, 200704) = 0
[pid 25599] 10:12:39.334448 close(9)    = 0
[pid 25599] 10:12:39.334510 open("/etc/localdomains", O_RDONLY) = 9
[pid 25599] 10:12:39.334552 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.334604 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.334725 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.334770 lseek(9, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.334803 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25599] 10:12:39.334870 stat("/jail_owner", 0x7fff159f6ef0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.334916 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25599] 10:12:39.334981 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.335029 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25599] 10:12:39.335083 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.335125 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335189 open("/etc/demouids", O_RDONLY) = 10
[pid 25599] 10:12:39.335228 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335274 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335317 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b1000
[pid 25599] 10:12:39.335375 lseek(10, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.335423 read(10, "", 4096) = 0
[pid 25599] 10:12:39.335466 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25599] 10:12:39.335556 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335613 open("/etc/userdomains", O_RDONLY) = 11
[pid 25599] 10:12:39.335731 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335785 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.335828 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b0000
[pid 25599] 10:12:39.335863 lseek(11, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.335895 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25599] 10:12:39.335957 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25599] 10:12:39.336001 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.336045 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9af000
[pid 25599] 10:12:39.336079 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.336123 close(12)   = 0
[pid 25599] 10:12:39.336156 munmap(0x7fc0da9af000, 4096) = 0
[pid 25599] 10:12:39.336211 stat("//etc/fin.finestweddingsites.com", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.336258 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.336334 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.336406 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.336471 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.336527 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.336588 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.336735 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.336786 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.336850 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25599] 10:12:39.336889 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.336935 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.336977 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9af000
[pid 25599] 10:12:39.337012 lseek(12, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.337044 read(12, "", 4096) = 0
[pid 25599] 10:12:39.337089 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25599] 10:12:39.337130 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25599] 10:12:39.337174 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ae000
[pid 25599] 10:12:39.337208 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25599] 10:12:39.337252 close(13)   = 0
[pid 25599] 10:12:39.337285 munmap(0x7fc0da9ae000, 4096) = 0
[pid 25599] 10:12:39.337335 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.337399 stat("//.spamassassinboxenable", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.337442 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.337493 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25599] 10:12:39.337550 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.337591 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.337731 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff159f9ce0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.337781 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.337834 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.337974 getuid()    = 0
[pid 25599] 10:12:39.338019 geteuid()   = 0
[pid 25599] 10:12:39.338053 getgid()    = 12
[pid 25599] 10:12:39.338085 getegid()   = 12
[pid 25599] 10:12:39.338183 open("/dev/urandom", O_RDONLY) = 13
[pid 25599] 10:12:39.338227 read(13, "\334\1\213\374", 4) = 4
[pid 25599] 10:12:39.338264 close(13)   = 0
[pid 25599] 10:12:39.338384 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25599] 10:12:39.338496 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6b40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.338539 lseek(0, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.338574 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6b40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.338621 lseek(1, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.338729 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6b50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.338769 lseek(2, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.338804 open("/dev/null", O_RDONLY) = 13
[pid 25599] 10:12:39.338845 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6c20) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.338879 lseek(13, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.338911 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.338945 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0}, 8) = 0
[pid 25599] 10:12:39.339221 brk(0x14a6000) = 0x14a6000
[pid 25599] 10:12:39.339274 read(13, "", 8192) = 0
[pid 25599] 10:12:39.339314 close(13)   = 0
[pid 25599] 10:12:39.339708 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.339777 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25599] 10:12:39.339819 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6a50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.339855 lseek(13, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.339909 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25599] 10:12:39.340820 brk(0x14c7000) = 0x14c7000
[pid 25599] 10:12:39.341178 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25599] 10:12:39.342034 brk(0x14e8000) = 0x14e8000
[pid 25599] 10:12:39.342478 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25599] 10:12:39.343228 brk(0x1509000) = 0x1509000
[pid 25599] 10:12:39.343750 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25599] 10:12:39.344066 read(13, "", 8192) = 0
[pid 25599] 10:12:39.344112 close(13)   = 0
[pid 25599] 10:12:39.344165 stat("/usr/share/amavis/amavis-filter", 0x7fc0d9050880) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.344210 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.344261 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25599] 10:12:39.344308 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25599] 10:12:39.344347 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6a50) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.344384 lseek(13, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.344435 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25599] 10:12:39.344824 brk(0x152a000) = 0x152a000
[pid 25599] 10:12:39.345013 stat("/etc/exim/perl/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345061 stat("/etc/exim/perl/warnings.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345099 stat("/usr/local/cpanel/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345136 stat("/usr/local/cpanel/warnings.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345183 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345226 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345266 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345304 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345344 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345384 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345424 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.345462 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.345515 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25599] 10:12:39.345563 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.345599 lseek(14, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.345720 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25599] 10:12:39.346055 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25599] 10:12:39.346631 brk(0x154b000) = 0x154b000
[pid 25599] 10:12:39.346892 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25599] 10:12:39.347286 read(14, "", 8192) = 0
[pid 25599] 10:12:39.347333 close(14)   = 0
[pid 25599] 10:12:39.348081 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25599] 10:12:39.348887 read(13, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25599] 10:12:39.349596 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25599] 10:12:39.350221 brk(0x156c000) = 0x156c000
[pid 25599] 10:12:39.350306 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25599] 10:12:39.350998 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25599] 10:12:39.351512 brk(0x158d000) = 0x158d000
[pid 25599] 10:12:39.352028 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25599] 10:12:39.352558 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25599] 10:12:39.353015 brk(0x15ae000Process 25604 attached
 <unfinished ...>
[pid 25604] 10:12:39.353080 set_robust_list(0x7fcc46d58aa0, 24) = 0
[pid 25604] 10:12:39.353166 close(9)    = 0
[pid 25604] 10:12:39.353207 geteuid()   = 0
[pid 25604] 10:12:39.353239 getegid()   = 12
[pid 25604] 10:12:39.353271 setgid(494) = 0
[pid 25604] 10:12:39.353303 setuid(495) = 0
[pid 25604] 10:12:39.353362 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25604] 10:12:39.353410 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25604] 10:12:39.353506 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25604] 10:12:39.353557 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25604] 10:12:39.353596 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25604] 10:12:39.353723 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25604] 10:12:39.353777 close(9)    = 0
[pid 25604] 10:12:39.353812 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25604] 10:12:39.353889 brk(0xa81000 <unfinished ...>
[pid 25599] 10:12:39.353912 <... brk resumed> ) = 0x15ae000
[pid 25599] 10:12:39.354193 read(13,  <unfinished ...>
[pid 25604] 10:12:39.354223 <... brk resumed> ) = 0xa81000
[pid 25590] 10:12:39.354248 <... select resumed> ) = 1 (in [11], left {299, 945590})
[pid 25590] 10:12:39.354279 read(11, "\27\3\3\0M", 5) = 5
[pid 25590] 10:12:39.354316 read(11, "\334M\266m\335\366\2\323\333L\277H\31\202\341\210\245@\"\276\35\251\24\f7g\354\332\5\16V\367\310\333\17\16p\v\3760wS\10Y\240\316\236z\371\375XU{\220\17\257\365\324\25\355\245\1\324\334l\275\237\205\20\207\r\306d\234\5\33\37", 77) = 77
[pid 25590] 10:12:39.354365 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25604] 10:12:39.354491 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25600] 10:12:39.354523 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25600] 10:12:39.354544 read(9,  <unfinished ...>
[pid 25604] 10:12:39.354563 <... write resumed> ) = 4
[pid 25604] 10:12:39.354585 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25600] 10:12:39.354615 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25600] 10:12:39.354634 read(9,  <unfinished ...>
[pid 25604] 10:12:39.354724 <... write resumed> ) = 4
[pid 25604] 10:12:39.354748 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25600] 10:12:39.354770 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25600] 10:12:39.354789 read(9,  <unfinished ...>
[pid 25604] 10:12:39.354808 <... write resumed> ) = 4
[pid 25604] 10:12:39.354825 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25600] 10:12:39.354846 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25600] 10:12:39.354865 read(9,  <unfinished ...>
[pid 25604] 10:12:39.354888 <... write resumed> ) = 4
[pid 25604] 10:12:39.354910 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25600] 10:12:39.354932 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25600] 10:12:39.354950 read(9,  <unfinished ...>
[pid 25604] 10:12:39.354969 <... write resumed> ) = 4
[pid 25604] 10:12:39.354986 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25600] 10:12:39.355010 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25600] 10:12:39.355030 read(9,  <unfinished ...>
[pid 25604] 10:12:39.355049 <... write resumed> ) = 40
[pid 25604] 10:12:39.355066 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25600] 10:12:39.355087 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25600] 10:12:39.355109 wait4(-1,  <unfinished ...>
[pid 25604] 10:12:39.355128 <... write resumed> ) = 4
[pid 25604] 10:12:39.355151 close(10)   = 0
[pid 25604] 10:12:39.355193 exit_group(0) = ?
[pid 25604] 10:12:39.355410 +++ exited with 0 +++
[pid 25600] 10:12:39.355436 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25604
[pid 25600] 10:12:39.355458 close(9)    = 0
[pid 25600] 10:12:39.355496 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, 8) = 0
[pid 25600] 10:12:39.355550 brk(0xa80000) = 0xa80000
[pid 25600] 10:12:39.355602 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25600] 10:12:39.355714 alarm(60)   = 0
[pid 25600] 10:12:39.355753 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25600] 10:12:39.355790 alarm(0)    = 60
[pid 25600] 10:12:39.355859 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.355913 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25600] 10:12:39.355955 read(10, "cpu  123108 1342517 395342 67343124 2509 0 0 0\ncpu0 123108 1342517 395342 67343124 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58699547\nbtime 1450798266\nprocesses 893082\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25600] 10:12:39.356010 close(10)   = 0
[pid 25600] 10:12:39.356086 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25600] 10:12:39.356145 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25600] 10:12:39.356184 fcntl(10, F_GETFD) = 0
[pid 25600] 10:12:39.356215 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.356250 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25600] 10:12:39.356297 close(10)   = 0
[pid 25600] 10:12:39.356344 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.356388 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25600] 10:12:39.356480 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d27000
[pid 25600] 10:12:39.356623 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25600] 10:12:39.356736 fcntl(10, F_GETFD) = 0
[pid 25600] 10:12:39.356769 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.356803 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25600] 10:12:39.356878 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25600] 10:12:39.356958 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25600] 10:12:39.357025 close(10)   = 0
[pid 25600] 10:12:39.357089 munmap(0x7fcc46d27000, 200704) = 0
[pid 25600] 10:12:39.357152 close(9)    = 0
[pid 25600] 10:12:39.357205 open("/etc/localdomains", O_RDONLY) = 9
[pid 25600] 10:12:39.357248 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.357299 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.357344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.357380 lseek(9, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.357412 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25600] 10:12:39.357474 stat("/jail_owner", 0x7fff0d1c6840) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.357520 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25600] 10:12:39.357582 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.357639 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25600] 10:12:39.357783 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.357827 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.357890 open("/etc/demouids", O_RDONLY) = 10
[pid 25600] 10:12:39.357930 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.357982 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.358025 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6d000
[pid 25600] 10:12:39.358060 lseek(10, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.358091 read(10, "", 4096) = 0
[pid 25600] 10:12:39.358130 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25600] 10:12:39.358224 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.358280 open("/etc/userdomains", O_RDONLY) = 11
[pid 25600] 10:12:39.358318 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.358364 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.358407 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6c000
[pid 25600] 10:12:39.358446 lseek(11, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.358484 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25600] 10:12:39.358547 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25600] 10:12:39.358591 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.358636 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6b000
[pid 25600] 10:12:39.358770 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.358819 close(12)   = 0
[pid 25600] 10:12:39.358852 munmap(0x7fcc46d6b000, 4096) = 0
[pid 25600] 10:12:39.358913 stat("//etc/fin.finestweddingsites.com", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.358960 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.359021 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.359080 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.359143 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.359199 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.359258 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.359321 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.359363 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.359415 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25600] 10:12:39.359454 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.359510 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.359552 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6b000
[pid 25600] 10:12:39.359592 lseek(12, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.359629 read(12, "", 4096) = 0
[pid 25600] 10:12:39.359770 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25600] 10:12:39.359814 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25600] 10:12:39.359859 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6a000
[pid 25600] 10:12:39.359893 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25600] 10:12:39.359937 close(13)   = 0
[pid 25600] 10:12:39.359970 munmap(0x7fcc46d6a000, 4096) = 0
[pid 25600] 10:12:39.360019 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.360082 stat("//.spamassassinboxenable", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.360188 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.360243 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25600] 10:12:39.360300 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.360344 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.360399 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff0d1c9630) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.360446 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.360498 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.360616 getuid()    = 0
[pid 25600] 10:12:39.360720 geteuid()   = 0
[pid 25600] 10:12:39.360759 getgid()    = 12
[pid 25600] 10:12:39.360791 getegid()   = 12
[pid 25600] 10:12:39.360879 open("/dev/urandom", O_RDONLY) = 13
[pid 25600] 10:12:39.360923 read(13, "%?\273\264", 4) = 4
[pid 25600] 10:12:39.360960 close(13)   = 0
[pid 25600] 10:12:39.361077 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25600] 10:12:39.361233 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c6490) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.361276 lseek(0, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.361311 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c6490) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.361347 lseek(1, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.361379 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c64a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.361412 lseek(2, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.361446 open("/dev/null", O_RDONLY) = 13
[pid 25600] 10:12:39.361486 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c6570) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.361518 lseek(13, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.361550 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.361587 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, 8) = 0
[pid 25600] 10:12:39.361917 brk(0xaa2000) = 0xaa2000
[pid 25600] 10:12:39.361970 read(13, "", 8192) = 0
[pid 25600] 10:12:39.362009 close(13)   = 0
[pid 25600] 10:12:39.362274 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.362336 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25600] 10:12:39.362376 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c63a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.362411 lseek(13, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.362463 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25600] 10:12:39.363353 brk(0xac3000) = 0xac3000
[pid 25600] 10:12:39.363726 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25600] 10:12:39.364480 brk(0xae4000) = 0xae4000
[pid 25600] 10:12:39.365001 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25600] 10:12:39.365703 brk(0xb05000) = 0xb05000
[pid 25600] 10:12:39.366165 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25600] 10:12:39.366467 read(13, "", 8192) = 0
[pid 25600] 10:12:39.366516 close(13)   = 0
[pid 25600] 10:12:39.366568 stat("/usr/share/amavis/amavis-filter", 0x7fcc4540c880) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.366614 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.366733 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25600] 10:12:39.366784 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25600] 10:12:39.366823 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c63a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.366859 lseek(13, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.366909 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25600] 10:12:39.367214 brk(0xb26000) = 0xb26000
[pid 25600] 10:12:39.367415 stat("/etc/exim/perl/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367475 stat("/etc/exim/perl/warnings.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367514 stat("/usr/local/cpanel/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367551 stat("/usr/local/cpanel/warnings.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367589 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367631 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367748 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367789 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367836 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367876 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367915 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.367952 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.368007 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25600] 10:12:39.368037 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25600] 10:12:39.368748 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c5db0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.368800 lseek(14, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.368855 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25600] 10:12:39.369176 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25599] 10:12:39.369785 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25599] 10:12:39.370082 brk(0x15cf000 <unfinished ...>
[pid 25600] 10:12:39.370251 brk(0xb47000 <unfinished ...>
[pid 25599] 10:12:39.370282 <... brk resumed> ) = 0x15cf000
[pid 25600] 10:12:39.370715 <... brk resumed> ) = 0xb47000
[pid 25600] 10:12:39.370923 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25600] 10:12:39.371315 read(14,  <unfinished ...>
[pid 25599] 10:12:39.371522 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25600] 10:12:39.371555 <... read resumed> "", 8192) = 0
[pid 25599] 10:12:39.371579 <... stat resumed> 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.371602 close(14 <unfinished ...>
[pid 25599] 10:12:39.371621 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25600] 10:12:39.371643 <... close resumed> ) = 0
[pid 25599] 10:12:39.371719 <... stat resumed> 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.372419 read(13,  <unfinished ...>
[pid 25599] 10:12:39.372459 stat("/etc/exim/perl/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372503 stat("/etc/exim/perl/strict.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372541 stat("/usr/local/cpanel/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372579 stat("/usr/local/cpanel/strict.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372624 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372669 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372710 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372749 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372788 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372826 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372866 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.372912 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.372966 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25599] 10:12:39.373010 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.373045 lseek(14, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.373098 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25599] 10:12:39.373322 lseek(14, 878, SEEK_SET) = 878
[pid 25599] 10:12:39.373364 lseek(14, 0, SEEK_CUR) = 878
[pid 25599] 10:12:39.373401 close(14)   = 0
[pid 25599] 10:12:39.373641 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25599] 10:12:39.374153 brk(0x15f0000 <unfinished ...>
[pid 25600] 10:12:39.374306 <... read resumed> "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25600] 10:12:39.375042 read(13,  <unfinished ...>
[pid 25599] 10:12:39.375078 <... brk resumed> ) = 0x15f0000
[pid 25599] 10:12:39.375192 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25599] 10:12:39.376303 brk(0x1611000 <unfinished ...>
[pid 25600] 10:12:39.376340 <... read resumed> "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25600] 10:12:39.377037 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25599] 10:12:39.377449 <... brk resumed> ) = 0x1611000
[pid 25599] 10:12:39.377575 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25573] 10:12:39.378470 <... select resumed> ) = 1 (in [11], left {599, 331881})
[pid 25573] 10:12:39.378519 read(11, "\27\3\3\0O", 5) = 5
[pid 25573] 10:12:39.378561 read(11, "7\26\202\32D\2623\305\270\5\3714w\373T\240\211\304\233\263\23G\261\335b\33Mc\315\37U(m\233W\236+\316Y\264\25V\330\266S\305\350\212$v\205dY\0007}\301\353\203\16R\357\304{\252\362\303\242\213y\20\3\335\315\200\3720B>", 79) = 79
[pid 25573] 10:12:39.378629 write(9, "aepperson@ncghotels.com\n", 24) = 24
[pid 25573] 10:12:39.378694 fsync(9 <unfinished ...>
[pid 25600] 10:12:39.378819 brk(0xb68000) = 0xb68000
[pid 25600] 10:12:39.379000 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25573] 10:12:39.379142 <... fsync resumed> ) = 0
[pid 25573] 10:12:39.379177 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25573] 10:12:39.379229 alarm(60)   = 0
[pid 25573] 10:12:39.379264 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25573] 10:12:39.379301 alarm(0)    = 60
[pid 25573] 10:12:39.379353 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:39.379476 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25573] 10:12:39.379524 read(15, "cpu  123108 1342518 395343 67343124 2509 0 0 0\ncpu0 123108 1342518 395343 67343124 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58700739\nbtime 1450798266\nprocesses 893082\nprocs_running 3\nprocs_blocked 0\n", 8192) = 191
[pid 25573] 10:12:39.379589 close(15)   = 0
[pid 25573] 10:12:39.379649 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25573] 10:12:39.379713 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25573] 10:12:39.379756 fcntl(15, F_GETFD) = 0
[pid 25573] 10:12:39.379788 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25573] 10:12:39.379821 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25573] 10:12:39.379864 close(15)   = 0
[pid 25573] 10:12:39.379904 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25573] 10:12:39.379944 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25573] 10:12:39.380011 brk(0x194c000) = 0x194c000
[pid 25573] 10:12:39.380149 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25573] 10:12:39.380194 fcntl(15, F_GETFD) = 0
[pid 25573] 10:12:39.380226 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25573] 10:12:39.380258 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25573] 10:12:39.380313 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25573] 10:12:39.380369 pread(15, "\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\333\17\262\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 4096) = 4096
[pid 25573] 10:12:39.380526 close(15)   = 0
[pid 25573] 10:12:39.380586 close(14)   = 0
[pid 25573] 10:12:39.380642 write(11, "\27\3\3\0\36K\221h\235\34\260\330\0362\336\273\265&\22;\2169\364\331\245?8\344\371\236\211M\262\"\254", 35) = 35
[pid 25573] 10:12:39.380717 write(11, "\25\3\3\0\32K\221h\235\34\260\330\0378\5qP/y\177\213\374\3369\341\"\201/\204\222o", 31) = 31
[pid 25573] 10:12:39.380834 close(11)   = 0
[pid 25573] 10:12:39.380912 close(13)   = 0
[pid 25573] 10:12:39.380954 munmap(0x7f33164f9000, 4096) = 0
[pid 25573] 10:12:39.380993 close(10)   = 0
[pid 25573] 10:12:39.381026 munmap(0x7f33164fa000, 4096) = 0
[pid 25573] 10:12:39.381070 write(12, "S000004S\f\0\0", 11) = 11
[pid 25491] 10:12:39.381108 <... select resumed> ) = 1 (in [10], left {58, 725376})
[pid 25491] 10:12:39.381134 read(10, "S000004S\f\0\0", 16384) = 11
[pid 25491] 10:12:39.381176 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:39.381211 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.381244 write(12, "X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU=PlatinumSSL Wildcard/CN=*.mxlogic.net\0", 225) = 225
[pid 25491] 10:12:39.381275 <... select resumed> ) = 1 (in [10], left {59, 999957})
[pid 25491] 10:12:39.381297 read(10, "X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU=PlatinumSSL Wildcard/CN=*.mxlogic.net\0", 16384) = 225
[pid 25491] 10:12:39.381339 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:39.381375 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.381517 write(12, "X202021-----BEGIN CERTIFICATE-----\\nMIIFkDCCBHigAwIBAgIRAIrvyWaFPkYqWsaYZ1pF94cwDQYJKoZIhvcNAQELBQAw\\nZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQHEwtTYW50YSBDbGFy\\nYTEVMBMGA1UEChMMTWNBZmVlLCBJbmMuMRswGQYDVQQDExJNY0FmZWUgT1YgU1NM\\nIENBIDIwHhcNMTUwMTA5MD"..., 2028) = 2028
[pid 25491] 10:12:39.381559 <... select resumed> ) = 1 (in [10], left {59, 999903})
[pid 25491] 10:12:39.381585 read(10, "X202021-----BEGIN CERTIFICATE-----\\nMIIFkDCCBHigAwIBAgIRAIrvyWaFPkYqWsaYZ1pF94cwDQYJKoZIhvcNAQELBQAw\\nZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQHEwtTYW50YSBDbGFy\\nYTEVMBMGA1UEChMMTWNBZmVlLCBJbmMuMRswGQYDVQQDExJNY0FmZWUgT1YgU1NM\\nIENBIDIwHhcNMTUwMTA5MD"..., 16384) = 2028
[pid 25491] 10:12:39.381913 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:39.381951 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.381981 write(12, "X4000021\0", 9) = 9
[pid 25491] 10:12:39.382009 <... select resumed> ) = 1 (in [10], left {59, 999962})
[pid 25491] 10:12:39.382031 read(10, "X4000021\0", 16384) = 9
[pid 25491] 10:12:39.382065 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:39.382098 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.382124 write(12, "D000004\2\0\0\0", 11) = 11
[pid 25491] 10:12:39.382153 <... select resumed> ) = 1 (in [10], left {59, 999964})
[pid 25491] 10:12:39.382174 read(10, "D000004\2\0\0\0", 16384) = 11
[pid 25491] 10:12:39.382208 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25573] 10:12:39.382247 write(12, "A000121\0=\0\0\1\0\0\0\0\0\0\000250 Message Queued (Timeout Verifying RCPTs): 1 RCPTS\0\0ncghotels.com.inbound10.mxlogic.net\000208.65.145.3\0\31\0\0\0000", 128 <unfinished ...>
[pid 25491] 10:12:39.382256 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.382286 <... write resumed> ) = 128
[pid 25491] 10:12:39.382291 <... select resumed> ) = 1 (in [10], left {59, 999986})
[pid 25573] 10:12:39.382325 write(12, "I00002050.116.78.207\00055995\0", 27 <unfinished ...>
[pid 25491] 10:12:39.382334 read(10,  <unfinished ...>
[pid 25573] 10:12:39.382357 <... write resumed> ) = 27
[pid 25491] 10:12:39.382362 <... read resumed> "A000121\0=\0\0\1\0\0\0\0\0\0\000250 Message Queued (Timeout Verifying RCPTs): 1 RCPTS\0\0ncghotels.com.inbound10.mxlogic.net\000208.65.145.3\0\31\0\0\0000", 16384) = 128
[pid 25573] 10:12:39.382395 write(12, "Z0000010", 8 <unfinished ...>
[pid 25491] 10:12:39.382403 wait4(-1,  <unfinished ...>
[pid 25573] 10:12:39.382426 <... write resumed> ) = 8
[pid 25491] 10:12:39.382431 <... wait4 resumed> 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25573] 10:12:39.382453 close(12 <unfinished ...>
[pid 25491] 10:12:39.382460 select(12, [10 11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25573] 10:12:39.382486 <... close resumed> ) = 0
[pid 25491] 10:12:39.382493 <... select resumed> ) = 1 (in [10], left {59, 999999})
[pid 25491] 10:12:39.382643 read(10, "I00002050.116.78.207\00055995\0Z0000010", 16384) = 35
[pid 25491] 10:12:39.382691 close(10)   = 0
[pid 25491] 10:12:39.382729 wait4(25573,  <unfinished ...>
[pid 25573] 10:12:39.382979 exit_group(0) = ?
[pid 25573] 10:12:39.383723 +++ exited with 0 +++
[pid 25491] 10:12:39.383760 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25573
[pid 25491] 10:12:39.383799 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:39.383869 write(8, "2015-12-30 10:12:39 aepperson@ncghotels.com: remote_smtp transport succeeded\n", 77) = 77
[pid 25491] 10:12:39.383939 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:39.384000 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:39.384051 close(7)    = 0
[pid 25491] 10:12:39.384087 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:39.384130 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:39.384162 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:39.384193 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5395397, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25491] 10:12:39.384237 write(7, "2015-12-30 10:12:39 [25491] 1aEJMZ-0006cs-RM => aepperson@ncghotels.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3155 H=ncghotels.com.inbound10.mxlogic.net [208.65.145.3]"..., 561) = 561
[pid 25491] 10:12:39.384304 wait4(-1, 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25491] 10:12:39.384340 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25600] 10:12:39.385093 read(13,  <unfinished ...>
[pid 25599] 10:12:39.385582 brk(0x1632000 <unfinished ...>
[pid 25600] 10:12:39.385636 <... read resumed> " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25600] 10:12:39.386122 brk(0xb89000 <unfinished ...>
[pid 25599] 10:12:39.386156 <... brk resumed> ) = 0x1632000
[pid 25599] 10:12:39.386374 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25600] 10:12:39.386776 <... brk resumed> ) = 0xb89000
[pid 25600] 10:12:39.387235 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25600] 10:12:39.388166 read(13,  <unfinished ...>
[pid 25599] 10:12:39.388538 stat("/usr/local/cpanel/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388599 stat("/usr/local/cpanel/Errno.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388649 stat("/etc/exim/perl/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388694 stat("/etc/exim/perl/Errno.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388741 stat("/usr/local/cpanel/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388778 stat("/usr/local/cpanel/Errno.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388815 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388857 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388897 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388937 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.388977 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.389034 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.389090 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25599] 10:12:39.389134 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.389170 lseek(14, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.389223 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25599] 10:12:39.389347 brk(0x1653000 <unfinished ...>
[pid 25600] 10:12:39.389376 <... read resumed> "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25599] 10:12:39.389680 <... brk resumed> ) = 0x1653000
[pid 25599] 10:12:39.390249 lseek(14, 4868, SEEK_SET <unfinished ...>
[pid 25600] 10:12:39.390476 brk(0xbaa000) = 0xbaa000
[pid 25599] 10:12:39.390764 <... lseek resumed> ) = 4868
[pid 25599] 10:12:39.390800 lseek(14, 0, SEEK_CUR) = 4868
[pid 25599] 10:12:39.390835 close(14)   = 0
[pid 25599] 10:12:39.390884 stat("/usr/local/cpanel/Exporter.pmc",  <unfinished ...>
[pid 25600] 10:12:39.390972 read(13,  <unfinished ...>
[pid 25599] 10:12:39.391000 <... stat resumed> 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391027 stat("/usr/local/cpanel/Exporter.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391068 stat("/etc/exim/perl/Exporter.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391103 stat("/etc/exim/perl/Exporter.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391141 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391177 stat("/usr/local/cpanel/Exporter.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391214 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391254 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff159f6670) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391294 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc",  <unfinished ...>
[pid 25600] 10:12:39.391317 <... read resumed> "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25599] 10:12:39.391346 <... stat resumed> 0x7fff159f6710) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.391457 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25599] 10:12:39.391522 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25599] 10:12:39.391697 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff159f6460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.391751 lseek(14, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.391804 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25599] 10:12:39.392237 lseek(14, 2366, SEEK_SET) = 2366
[pid 25599] 10:12:39.392723 lseek(14, 0, SEEK_CUR) = 2366
[pid 25599] 10:12:39.392769 close(14)   = 0
[pid 25599] 10:12:39.393099 read(13,  <unfinished ...>
[pid 25600] 10:12:39.393220 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25599] 10:12:39.393459 <... read resumed> "", 8192) = 0
[pid 25599] 10:12:39.393490 close(13)   = 0
[pid 25600] 10:12:39.393847 brk(0xbcb000 <unfinished ...>
[pid 25599] 10:12:39.393878 lseek(12, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.393915 read(12, "", 4096) = 0
[pid 25600] 10:12:39.393950 <... brk resumed> ) = 0xbcb000
[pid 25599] 10:12:39.393995 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.394500 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25599] 10:12:39.394548 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.394603 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.394648 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ae000
[pid 25599] 10:12:39.394695 lseek(13, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.394738 read(13, "", 4096) = 0
[pid 25599] 10:12:39.394786 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25599] 10:12:39.394855 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25599] 10:12:39.394897 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25599] 10:12:39.394948 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ad000
[pid 25599] 10:12:39.394987 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25599] 10:12:39.395034 close(14)   = 0
[pid 25599] 10:12:39.395068 munmap(0x7fc0da9ad000, 4096) = 0
[pid 25599] 10:12:39.395120 open("/etc/aliases", O_RDONLY) = 14
[pid 25599] 10:12:39.395161 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25599] 10:12:39.395208 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25599] 10:12:39.395252 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ad000
[pid 25599] 10:12:39.395289 lseek(14, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.395322 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25599] 10:12:39.395374 read(14, "", 4096) = 0
[pid 25599] 10:12:39.395513 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25599] 10:12:39.395566 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25599] 10:12:39.395611 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ac000
[pid 25599] 10:12:39.395646 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25599] 10:12:39.395704 close(15)   = 0
[pid 25599] 10:12:39.395745 munmap(0x7fc0da9ac000, 4096) = 0
[pid 25599] 10:12:39.395799 open("/etc/localaliases", O_RDONLY) = 15
[pid 25599] 10:12:39.395841 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25599] 10:12:39.395900 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25599] 10:12:39.395945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9ac000
[pid 25599] 10:12:39.395980 lseek(15, 0, SEEK_SET) = 0
[pid 25599] 10:12:39.396012 read(15, "", 4096) = 0
[pid 25599] 10:12:39.396056 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.396116 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.396170 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.396224 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25599] 10:12:39.396484 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.396563 write(8, "2015-12-30 10:12:39 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25599] 10:12:39.396608 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.396664 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.396725 close(7)    = 0
[pid 25599] 10:12:39.396764 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25599] 10:12:39.396871 fcntl(7, F_GETFD) = 0
[pid 25599] 10:12:39.396905 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.396937 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5395958, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.396981 write(7, "2015-12-30 10:12:39 [25599] 1aEJMd-0006ep-5X ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25599] 10:12:39.397021 close(14)   = 0
[pid 25599] 10:12:39.397054 munmap(0x7fc0da9ad000, 4096) = 0
[pid 25600] 10:12:39.397131 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25599] 10:12:39.397159 close(15)   = 0
[pid 25599] 10:12:39.397193 munmap(0x7fc0da9ac000, 4096) = 0
[pid 25599] 10:12:39.397237 close(10)   = 0
[pid 25599] 10:12:39.397272 munmap(0x7fc0da9b1000, 4096) = 0
[pid 25599] 10:12:39.397306 close(11)   = 0
[pid 25600] 10:12:39.397341 <... stat resumed> 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.397361 munmap(0x7fc0da9b0000, 4096) = 0
[pid 25600] 10:12:39.397407 stat("/usr/local/cpanel/strict.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.397449 stat("/etc/exim/perl/strict.pmc",  <unfinished ...>
[pid 25599] 10:12:39.397470 close(9 <unfinished ...>
[pid 25600] 10:12:39.397491 <... stat resumed> 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.397511 <... close resumed> ) = 0
[pid 25600] 10:12:39.397529 stat("/etc/exim/perl/strict.pm",  <unfinished ...>
[pid 25599] 10:12:39.397550 munmap(0x7fc0da9b2000, 4096 <unfinished ...>
[pid 25600] 10:12:39.397570 <... stat resumed> 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.397591 <... munmap resumed> ) = 0
[pid 25600] 10:12:39.397611 stat("/usr/local/cpanel/strict.pmc",  <unfinished ...>
[pid 25599] 10:12:39.397632 close(13 <unfinished ...>
[pid 25600] 10:12:39.397653 <... stat resumed> 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.397674 <... close resumed> ) = 0
[pid 25600] 10:12:39.397696 stat("/usr/local/cpanel/strict.pm",  <unfinished ...>
[pid 25599] 10:12:39.397722 munmap(0x7fc0da9ae000, 4096) = 0
[pid 25600] 10:12:39.397764 <... stat resumed> 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.397789 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25599] 10:12:39.397812 close(12)   = 0
[pid 25600] 10:12:39.397850 <... stat resumed> 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.397869 munmap(0x7fc0da9af000, 4096) = 0
[pid 25599] 10:12:39.397918 geteuid( <unfinished ...>
[pid 25600] 10:12:39.397939 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.397982 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.398020 <... geteuid resumed> ) = 0
[pid 25600] 10:12:39.398038 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm",  <unfinished ...>
[pid 25599] 10:12:39.398058 getegid( <unfinished ...>
[pid 25600] 10:12:39.398080 <... stat resumed> 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.398099 <... getegid resumed> ) = 12
[pid 25599] 10:12:39.398120 setgid(12 <unfinished ...>
[pid 25600] 10:12:39.398141 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc",  <unfinished ...>
[pid 25599] 10:12:39.398163 <... setgid resumed> ) = 0
[pid 25600] 10:12:39.398185 <... stat resumed> 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.398205 setuid(47)  = 0
[pid 25599] 10:12:39.398241 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fc0d85b26a0},  <unfinished ...>
[pid 25600] 10:12:39.398266 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.398306 <... rt_sigaction resumed> {SIG_DFL, [], 0}, 8) = 0
[pid 25599] 10:12:39.398335 write(8, "*** Frozen (delivery error message)\n", 36 <unfinished ...>
[pid 25600] 10:12:39.398360 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.398517 <... write resumed> ) = 36
[pid 25600] 10:12:39.398537 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25599] 10:12:39.398594 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.398648 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY <unfinished ...>
[pid 25599] 10:12:39.398679 stat("/etc/localtime",  <unfinished ...>
[pid 25600] 10:12:39.398712 <... open resumed> ) = 14
[pid 25599] 10:12:39.398734 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25599] 10:12:39.398773 close(7 <unfinished ...>
[pid 25600] 10:12:39.398796 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c5db0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25599] 10:12:39.398833 <... close resumed> ) = 0
[pid 25600] 10:12:39.398851 lseek(14, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.398886 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND <unfinished ...>
[pid 25600] 10:12:39.398930 read(14,  <unfinished ...>
[pid 25599] 10:12:39.398958 <... open resumed> ) = 7
[pid 25599] 10:12:39.398977 fcntl(7, F_GETFD) = 0
[pid 25599] 10:12:39.399009 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25599] 10:12:39.399040 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5396068, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.399084 write(7, "2015-12-30 10:12:39 [25599] 1aEJMd-0006ep-5X Frozen (delivery error message)\n", 77 <unfinished ...>
[pid 25600] 10:12:39.399106 <... read resumed> "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25599] 10:12:39.399132 <... write resumed> ) = 77
[pid 25600] 10:12:39.399331 lseek(14, 878, SEEK_SET <unfinished ...>
[pid 25599] 10:12:39.399362 open("/var/spool/exim/input/d/hdr.25599", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25599] 10:12:39.399540 fchown(9, 47, 12) = 0
[pid 25599] 10:12:39.399579 fchmod(9, 0640) = 0
[pid 25599] 10:12:39.399614 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25599] 10:12:39.399647 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.399697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0da9b2000
[pid 25599] 10:12:39.399741 lseek(9, 0, SEEK_CUR) = 0
[pid 25599] 10:12:39.399800 write(9, "1aEJMd-0006ep-5X-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491959\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25599] 10:12:39.399848 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.399898 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMd-0006ep-5X\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:39 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25599] 10:12:39.399940 fsync(9 <unfinished ...>
[pid 25600] 10:12:39.399992 <... lseek resumed> ) = 878
[pid 25600] 10:12:39.400015 lseek(14, 0, SEEK_CUR) = 878
[pid 25600] 10:12:39.400046 close(14)   = 0
[pid 25599] 10:12:39.400460 <... fsync resumed> ) = 0
[pid 25599] 10:12:39.400488 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064858, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25599] 10:12:39.400543 close(9)    = 0
[pid 25599] 10:12:39.400577 munmap(0x7fc0da9b2000, 4096) = 0
[pid 25599] 10:12:39.400619 rename("/var/spool/exim/input/d/hdr.25599", "/var/spool/exim/input/d/1aEJMd-0006ep-5X-H") = 0
[pid 25599] 10:12:39.400718 open("/var/spool/exim/input/d/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25599] 10:12:39.400767 fsync(9)    = 0
[pid 25599] 10:12:39.400805 close(9)    = 0
[pid 25599] 10:12:39.400838 close(8)    = 0
[pid 25599] 10:12:39.400870 munmap(0x7fc0da9b3000, 4096) = 0
[pid 25599] 10:12:39.400912 unlink("/var/spool/exim/input/d/1aEJMd-0006ep-5X-J") = -1 ENOENT (No such file or directory)
[pid 25599] 10:12:39.400954 close(6)    = 0
[pid 25599] 10:12:39.401124 exit_group(0) = ?
[pid 25600] 10:12:39.401212 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25600] 10:12:39.402079 brk(0xbec000 <unfinished ...>
[pid 25599] 10:12:39.402348 +++ exited with 0 +++
[pid 25600] 10:12:39.402422 <... brk resumed> ) = 0xbec000
[pid 25600] 10:12:39.402529 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25600] 10:12:39.403643 brk(0xc0d000) = 0xc0d000
[pid 25600] 10:12:39.403796 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25600] 10:12:39.404952 brk(0xc2e000) = 0xc2e000
[pid 25600] 10:12:39.405180 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25600] 10:12:39.406082 stat("/usr/local/cpanel/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406139 stat("/usr/local/cpanel/Errno.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406180 stat("/etc/exim/perl/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406215 stat("/etc/exim/perl/Errno.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406250 stat("/usr/local/cpanel/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406285 stat("/usr/local/cpanel/Errno.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406322 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406361 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406463 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406509 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406549 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.406587 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25600] 10:12:39.406647 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25600] 10:12:39.406701 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c5db0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.406744 lseek(14, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.406805 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25600] 10:12:39.406930 brk(0xc4f000) = 0xc4f000
[pid 25600] 10:12:39.407504 lseek(14, 4868, SEEK_SET) = 4868
[pid 25600] 10:12:39.407551 lseek(14, 0, SEEK_CUR) = 4868
[pid 25600] 10:12:39.407584 close(14)   = 0
[pid 25600] 10:12:39.407632 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407679 stat("/usr/local/cpanel/Exporter.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407726 stat("/etc/exim/perl/Exporter.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407766 stat("/etc/exim/perl/Exporter.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407808 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407844 stat("/usr/local/cpanel/Exporter.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407882 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407921 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff0d1c5fc0) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407961 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fff0d1c6060) = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.407998 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25600] 10:12:39.408051 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25600] 10:12:39.408092 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff0d1c5db0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25600] 10:12:39.408127 lseek(14, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.408171 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25600] 10:12:39.408597 lseek(14, 2366, SEEK_SET) = 2366
[pid 25600] 10:12:39.408643 lseek(14, 0, SEEK_CUR) = 2366
[pid 25600] 10:12:39.408675 close(14)   = 0
[pid 25600] 10:12:39.409000 read(13, "", 8192) = 0
[pid 25600] 10:12:39.409047 close(13)   = 0
[pid 25600] 10:12:39.409221 lseek(12, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.409261 read(12, "", 4096) = 0
[pid 25600] 10:12:39.409314 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.409473 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25600] 10:12:39.409521 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.409569 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.409612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6a000
[pid 25600] 10:12:39.409653 lseek(13, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.409691 read(13, "", 4096) = 0
[pid 25600] 10:12:39.409737 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25600] 10:12:39.409802 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25600] 10:12:39.409843 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25600] 10:12:39.409890 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d69000
[pid 25600] 10:12:39.409929 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25600] 10:12:39.409976 close(14)   = 0
[pid 25600] 10:12:39.410009 munmap(0x7fcc46d69000, 4096) = 0
[pid 25600] 10:12:39.410058 open("/etc/aliases", O_RDONLY) = 14
[pid 25600] 10:12:39.410098 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25600] 10:12:39.410144 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25600] 10:12:39.410187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d69000
[pid 25600] 10:12:39.410221 lseek(14, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.410259 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25600] 10:12:39.410311 read(14, "", 4096) = 0
[pid 25600] 10:12:39.410353 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25600] 10:12:39.410490 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25600] 10:12:39.410549 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d68000
[pid 25600] 10:12:39.410585 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25600] 10:12:39.410641 close(15)   = 0
[pid 25600] 10:12:39.410675 munmap(0x7fcc46d68000, 4096) = 0
[pid 25600] 10:12:39.410720 open("/etc/localaliases", O_RDONLY) = 15
[pid 25600] 10:12:39.410760 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25600] 10:12:39.410806 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25600] 10:12:39.410850 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d68000
[pid 25600] 10:12:39.410884 lseek(15, 0, SEEK_SET) = 0
[pid 25600] 10:12:39.410915 read(15, "", 4096) = 0
[pid 25600] 10:12:39.410957 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.411015 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.411069 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.411122 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25600] 10:12:39.411178 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.411242 write(8, "2015-12-30 10:12:39 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25600] 10:12:39.411285 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.411339 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.411391 close(7)    = 0
[pid 25600] 10:12:39.411427 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25600] 10:12:39.411467 fcntl(7, F_GETFD) = 0
[pid 25600] 10:12:39.411498 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.411530 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5396145, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.411576 write(7, "2015-12-30 10:12:39 [25600] 1aEJMd-0006eq-6O ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25600] 10:12:39.411616 close(14)   = 0
[pid 25600] 10:12:39.411648 munmap(0x7fcc46d69000, 4096) = 0
[pid 25600] 10:12:39.411688 close(15)   = 0
[pid 25600] 10:12:39.411728 munmap(0x7fcc46d68000, 4096) = 0
[pid 25600] 10:12:39.411768 close(10)   = 0
[pid 25600] 10:12:39.411807 munmap(0x7fcc46d6d000, 4096) = 0
[pid 25600] 10:12:39.411842 close(11)   = 0
[pid 25600] 10:12:39.411874 munmap(0x7fcc46d6c000, 4096) = 0
[pid 25600] 10:12:39.411908 close(9)    = 0
[pid 25600] 10:12:39.411939 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.411972 close(13)   = 0
[pid 25600] 10:12:39.412003 munmap(0x7fcc46d6a000, 4096) = 0
[pid 25600] 10:12:39.412036 close(12)   = 0
[pid 25600] 10:12:39.412067 munmap(0x7fcc46d6b000, 4096) = 0
[pid 25600] 10:12:39.412109 geteuid()   = 0
[pid 25600] 10:12:39.412129 getegid()   = 12
[pid 25600] 10:12:39.412148 setgid(12)  = 0
[pid 25600] 10:12:39.412167 setuid(47)  = 0
[pid 25600] 10:12:39.412188 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fcc4496e6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25600] 10:12:39.412222 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25600] 10:12:39.412250 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.412287 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25600] 10:12:39.412319 close(7)    = 0
[pid 25600] 10:12:39.412340 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25600] 10:12:39.412364 fcntl(7, F_GETFD) = 0
[pid 25600] 10:12:39.412542 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25600] 10:12:39.412583 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5396255, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.412627 write(7, "2015-12-30 10:12:39 [25600] 1aEJMd-0006eq-6O Frozen (delivery error message)\n", 77) = 77
[pid 25600] 10:12:39.412676 open("/var/spool/exim/input/d/hdr.25600", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25600] 10:12:39.412751 fchown(9, 47, 12) = 0
[pid 25600] 10:12:39.412793 fchmod(9, 0640) = 0
[pid 25600] 10:12:39.412827 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25600] 10:12:39.412860 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.412903 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc46d6e000
[pid 25600] 10:12:39.412939 lseek(9, 0, SEEK_CUR) = 0
[pid 25600] 10:12:39.412987 write(9, "1aEJMd-0006eq-6O-H\nmailnull 47 12\n<>\n1451491959 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491959\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25600] 10:12:39.413032 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.413080 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMd-0006eq-6O\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:39 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 691) = 691
[pid 25600] 10:12:39.413120 fsync(9)    = 0
[pid 25600] 10:12:39.413550 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064862, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=959, st_atime=2015/12/30-10:12:39, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25600] 10:12:39.413601 close(9)    = 0
[pid 25600] 10:12:39.413634 munmap(0x7fcc46d6e000, 4096) = 0
[pid 25600] 10:12:39.413674 rename("/var/spool/exim/input/d/hdr.25600", "/var/spool/exim/input/d/1aEJMd-0006eq-6O-H") = 0
[pid 25600] 10:12:39.413767 open("/var/spool/exim/input/d/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25600] 10:12:39.413807 fsync(9)    = 0
[pid 25600] 10:12:39.413838 close(9)    = 0
[pid 25600] 10:12:39.413870 close(8)    = 0
[pid 25600] 10:12:39.413901 munmap(0x7fcc46d6f000, 4096) = 0
[pid 25600] 10:12:39.413942 unlink("/var/spool/exim/input/d/1aEJMd-0006eq-6O-J") = -1 ENOENT (No such file or directory)
[pid 25600] 10:12:39.413983 close(6)    = 0
[pid 25600] 10:12:39.414145 exit_group(0) = ?
[pid 25600] 10:12:39.414666 +++ exited with 0 +++
[pid 25590] 10:12:39.677372 <... select resumed> ) = 1 (in [11], left {299, 677041})
[pid 25590] 10:12:39.677445 read(11, "\27\3\3\0N", 5) = 5
[pid 25590] 10:12:39.677488 read(11, "\334M\266m\335\366\2\324~\fF\0370\347\272\345\313\33\n\2110\224\305\372\354}-A\266G\220\305\253\331\214\2\201\7\371~i\2\303O\37\270\37\22\303\334BVa\244\362C\24X\233\253\20T[2\5\324\314N\325P}\363\17\224\0362!b", 78) = 78
[pid 25590] 10:12:39.677540 select(12, [11], NULL, NULL, {300, 0}) = 1 (in [11], left {299, 946319})
[pid 25590] 10:12:39.731357 read(11, "\27\3\3\0F", 5) = 5
[pid 25590] 10:12:39.731444 read(11, "\334M\266m\335\366\2\325\247\247\222\16\321]3\272\366zm\352\220\244\3621\3\3746\310\\\243\364Z\236\23n[;\333\"\331\22\37\25~W\22m\37\304\321`G\275\303sW iq\17`(\242y\10\316\230\235!c", 70) = 70
[pid 25590] 10:12:39.731613 lseek(6, 19, SEEK_SET) = 19
[pid 25590] 10:12:39.731683 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25590] 10:12:39.731776 read(6, "", 8192) = 0
[pid 25590] 10:12:39.731839 alarm(300)  = 0
[pid 25590] 10:12:39.731915 write(11, "\27\3\3\fO\312+\243\215{\253MgU\2420\277\344\27F\230h\226\307q\236\207n\250'\346\251\26\327/\330D\357\344\350\365L\257\262\367\220\305\245\206i\215\362\24+\3460\311\362\307\350|\200\16\310\2669\177\20\230\30\367(-\223\262\340\f\212\r\344\16}\\\317\1\331\374\305\355/\334\35x\1\221\323\4c\312\2715d\307z(\353t\333\366^\0066g\224\347\333\347\337<\207\f\31\354g\317\5\202\275O\362\331\303\364\304\367\216\245\31T\277\0327Ss\367\26\322q/uK\325FSFM\6\6\225\10\340\255\240\213\2324h\306\221\370\340\f\201u>\276@FVX>\303\3405\213R\204\242\322\277\214\374X\231x\374%a\26\306\224LIx\312i_u,qp3\213n/\314\306\0\v#\34L\246kKT\221H\314\362~\2\247\201&'Pu\301--<\261h\221@z\357\246q\273(\350%\276A"..., 3156) = 3156
[pid 25590] 10:12:39.732055 alarm(0)    = 300
[pid 25590] 10:12:39.732113 select(12, [11], NULL, NULL, {600, 0} <unfinished ...>
[pid 25572] 10:12:40.038288 <... select resumed> ) = 1 (in [11], left {598, 682725})
[pid 25572] 10:12:40.038367 read(11, "\27\3\3\0\221", 5) = 5
[pid 25572] 10:12:40.038410 read(11, "\0358\355\344\247\267G\216\223\34fN/\226\205(\367\2\202\351\37h\t\6D\37\33Y\36\204\265\26\254\273\177\273\24\233>\31S\346\34-\233\316\200\271\276\364\261\251\t\362\274\345\375\264gik\232\203[w\227KC\244^S\311@1'}\373\231p\34\337V\25\237\202\20\273\327e\331Si\300T\215\321t\251 \222\265\257\370\365\177\220\234C\204<\247\274\357~\356'U\10\275\200A\37\362\373s\307\347\225v\342\372\27\216\375\336\7^=\327T\343N\2\317&", 145) = 145
[pid 25572] 10:12:40.038470 write(9, "VHuerta@ncghotels.com\n", 22) = 22
[pid 25572] 10:12:40.038518 write(9, "SCarroll@ncghotels.com\n", 23) = 23
[pid 25572] 10:12:40.038555 fsync(9)    = 0
[pid 25572] 10:12:40.039021 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25572] 10:12:40.039078 alarm(60)   = 0
[pid 25572] 10:12:40.039111 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25572] 10:12:40.039151 alarm(0)    = 60
[pid 25572] 10:12:40.039201 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:40.039259 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25572] 10:12:40.039307 read(15, "cpu  123109 1342520 395344 67343185 2509 0 0 0\ncpu0 123109 1342520 395344 67343185 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58703279\nbtime 1450798266\nprocesses 893083\nprocs_running 2\nprocs_blocked 0\n", 8192) = 191
[pid 25572] 10:12:40.039366 close(15)   = 0
[pid 25572] 10:12:40.039418 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25572] 10:12:40.039484 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25572] 10:12:40.039529 fcntl(15, F_GETFD) = 0
[pid 25572] 10:12:40.039561 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25572] 10:12:40.039593 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25572] 10:12:40.039636 close(15)   = 0
[pid 25572] 10:12:40.039675 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25572] 10:12:40.039714 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25572] 10:12:40.039803 brk(0x194c000) = 0x194c000
[pid 25572] 10:12:40.039937 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25572] 10:12:40.039981 fcntl(15, F_GETFD) = 0
[pid 25572] 10:12:40.040013 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25572] 10:12:40.040044 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25572] 10:12:40.040101 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25572] 10:12:40.040155 pread(15, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25572] 10:12:40.040213 close(15)   = 0
[pid 25572] 10:12:40.040264 close(14)   = 0
[pid 25572] 10:12:40.040308 write(11, "\27\3\3\0\36B\321\5\374\316Y\v\352\3a\250Z\215\356\230\222=0\234\355=\304\372\340\370j\336$.\236", 35) = 35
[pid 25572] 10:12:40.040377 write(11, "\25\3\3\0\32B\321\5\374\316Y\v\353\372\207n\251[j\213\253\341V\307\234\350\220\233V\355x", 31) = 31
[pid 25572] 10:12:40.040483 close(11)   = 0
[pid 25572] 10:12:40.040562 close(13)   = 0
[pid 25572] 10:12:40.040604 munmap(0x7f33164f9000, 4096) = 0
[pid 25572] 10:12:40.040643 close(10)   = 0
[pid 25572] 10:12:40.040677 munmap(0x7f33164fa000, 4096) = 0
[pid 25572] 10:12:40.040718 write(12, "S000004S\f\0\0", 11) = 11
[pid 25491] 10:12:40.040760 <... select resumed> ) = 1 (in [11], left {59, 343609})
[pid 25572] 10:12:40.040796 write(12, "X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU=PlatinumSSL Wildcard/CN=*.mxlogic.net\0", 225 <unfinished ...>
[pid 25491] 10:12:40.040806 read(11,  <unfinished ...>
[pid 25572] 10:12:40.040831 <... write resumed> ) = 225
[pid 25491] 10:12:40.040836 <... read resumed> "S000004S\f\0\0", 16384) = 11
[pid 25572] 10:12:40.040904 write(12, "X202021-----BEGIN CERTIFICATE-----\\nMIIFkDCCBHigAwIBAgIRAIrvyWaFPkYqWsaYZ1pF94cwDQYJKoZIhvcNAQELBQAw\\nZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQHEwtTYW50YSBDbGFy\\nYTEVMBMGA1UEChMMTWNBZmVlLCBJbmMuMRswGQYDVQQDExJNY0FmZWUgT1YgU1NM\\nIENBIDIwHhcNMTUwMTA5MD"..., 2028 <unfinished ...>
[pid 25491] 10:12:40.040915 wait4(-1,  <unfinished ...>
[pid 25572] 10:12:40.040941 <... write resumed> ) = 2028
[pid 25491] 10:12:40.040947 <... wait4 resumed> 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25572] 10:12:40.040974 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25491] 10:12:40.040982 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25572] 10:12:40.041010 <... write resumed> ) = 9
[pid 25491] 10:12:40.041015 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25572] 10:12:40.041042 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25491] 10:12:40.041050 read(11,  <unfinished ...>
[pid 25572] 10:12:40.041072 <... write resumed> ) = 11
[pid 25491] 10:12:40.041078 <... read resumed> "X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU=PlatinumSSL Wildcard/CN=*.mxlogic.net\0X202021-----BEGIN CERTIFICATE--"..., 16384) = 2262
[pid 25572] 10:12:40.041258 write(12, "A000189\0=\0\0\2\0\0\0\0\0\0\000250 Backend Replied [67204865.0.143038.00-2343.304128.s12p02m011.mxlogic.net]:  2.6.0 <E1aEJMZ-0006cs-RM@fin.finestwedd\0\0ncghotels.com.inbound10.mxlogicmx.net\000208.65.145.3\0\31\0\0\0000", 196 <unfinished ...>
[pid 25491] 10:12:40.041271 wait4(-1,  <unfinished ...>
[pid 25572] 10:12:40.041301 <... write resumed> ) = 196
[pid 25491] 10:12:40.041308 <... wait4 resumed> 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25572] 10:12:40.041343 write(12, "X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postalCode=97006/ST=OR/L=BEAVERTON/street=SUITE 100/street=20460 NW VON NEUMANN DRIVE/O=McAfee, Inc./OU=Engineering/OU=Hosted by McAfee Inc./OU=PlatinumSSL Wildcard/CN=*.mxlogic.net\0", 225 <unfinished ...>
[pid 25491] 10:12:40.041353 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25572] 10:12:40.041384 <... write resumed> ) = 225
[pid 25491] 10:12:40.041390 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25572] 10:12:40.041443 write(12, "X202021-----BEGIN CERTIFICATE-----\\nMIIFkDCCBHigAwIBAgIRAIrvyWaFPkYqWsaYZ1pF94cwDQYJKoZIhvcNAQELBQAw\\nZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQHEwtTYW50YSBDbGFy\\nYTEVMBMGA1UEChMMTWNBZmVlLCBJbmMuMRswGQYDVQQDExJNY0FmZWUgT1YgU1NM\\nIENBIDIwHhcNMTUwMTA5MD"..., 2028 <unfinished ...>
[pid 25491] 10:12:40.041453 read(11,  <unfinished ...>
[pid 25572] 10:12:40.041479 <... write resumed> ) = 2028
[pid 25491] 10:12:40.041484 <... read resumed> "D000004\2\0\0\0A000189\0=\0\0\2\0\0\0\0\0\0\000250 Backend Replied [67204865.0.143038.00-2343.304128.s12p02m011.mxlogic.net]:  2.6.0 <E1aEJMZ-0006cs-RM@fin.finestwedd\0\0ncghotels.com.inbound10.mxlogicmx.net\000208.65.145.3\0\31\0\0\0000X100218TLSv1.2:AES256-GCM-SHA384:256\0/C=US/postal"..., 16384) = 432
[pid 25572] 10:12:40.041521 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25491] 10:12:40.041530 wait4(-1,  <unfinished ...>
[pid 25572] 10:12:40.041553 <... write resumed> ) = 9
[pid 25491] 10:12:40.041558 <... wait4 resumed> 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25572] 10:12:40.041588 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25491] 10:12:40.041597 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25572] 10:12:40.041623 <... write resumed> ) = 11
[pid 25491] 10:12:40.041629 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25572] 10:12:40.041657 write(12, "A000189\0-\0\0\2\0\0\0\0\0\0\000250 Backend Replied [67204865.0.143038.00-2343.304128.s12p02m011.mxlogic.net]:  2.6.0 <E1aEJMZ-0006cs-RM@fin.finestwedd\0\0ncghotels.com.inbound10.mxlogicmx.net\000208.65.145.3\0\31\0\0\0000", 196 <unfinished ...>
[pid 25491] 10:12:40.041666 read(11,  <unfinished ...>
[pid 25572] 10:12:40.041690 <... write resumed> ) = 196
[pid 25491] 10:12:40.041695 <... read resumed> "X202021-----BEGIN CERTIFICATE-----\\nMIIFkDCCBHigAwIBAgIRAIrvyWaFPkYqWsaYZ1pF94cwDQYJKoZIhvcNAQELBQAw\\nZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQHEwtTYW50YSBDbGFy\\nYTEVMBMGA1UEChMMTWNBZmVlLCBJbmMuMRswGQYDVQQDExJNY0FmZWUgT1YgU1NM\\nIENBIDIwHhcNMTUwMTA5MD"..., 16384) = 2048
[pid 25572] 10:12:40.041841 write(12, "I00002050.116.78.207\00055994\0", 27 <unfinished ...>
[pid 25491] 10:12:40.041852 wait4(-1,  <unfinished ...>
[pid 25572] 10:12:40.041875 <... write resumed> ) = 27
[pid 25491] 10:12:40.041881 <... wait4 resumed> 0x7ffc8615bc40, WNOHANG, NULL) = 0
[pid 25572] 10:12:40.041912 write(12, "Z0000010", 8 <unfinished ...>
[pid 25491] 10:12:40.041920 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25572] 10:12:40.041945 <... write resumed> ) = 8
[pid 25491] 10:12:40.041951 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25572] 10:12:40.041972 close(12 <unfinished ...>
[pid 25491] 10:12:40.041981 read(11,  <unfinished ...>
[pid 25572] 10:12:40.041997 <... close resumed> ) = 0
[pid 25491] 10:12:40.042002 <... read resumed> "A000189\0-\0\0\2\0\0\0\0\0\0\000250 Backend Replied [67204865.0.143038.00-2343.304128.s12p02m011.mxlogic.net]:  2.6.0 <E1aEJMZ-0006cs-RM@fin.finestwedd\0\0ncghotels.com.inbound10.mxlogicmx.net\000208.65.145.3\0\31\0\0\0000I00002050.116.78.207\00055994\0Z0000010", 16384) = 231
[pid 25572] 10:12:40.042319 exit_group(0) = ?
[pid 25491] 10:12:40.042327 close(11 <unfinished ...>
[pid 25572] 10:12:40.043071 +++ exited with 0 +++
[pid 25491] 10:12:40.043080 <... close resumed> ) = 0
[pid 25491] 10:12:40.043102 wait4(25572, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25572
[pid 25491] 10:12:40.043155 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043217 write(8, "2015-12-30 10:12:40 VHuerta@ncghotels.com: remote_smtp transport succeeded\n", 75) = 75
[pid 25491] 10:12:40.043277 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043336 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043387 close(7)    = 0
[pid 25491] 10:12:40.043427 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:40.043470 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:40.043505 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:40.043538 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5396732, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:39, st_ctime=2015/12/30-10:12:39}) = 0
[pid 25491] 10:12:40.043583 write(7, "2015-12-30 10:12:40 [25491] 1aEJMZ-0006cs-RM => vhuerta@ncghotels.com <VHuerta@ncghotels.com> I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3155 H=ncghotels.com.inbound10.mxlo"..., 651) = 651
[pid 25491] 10:12:40.043644 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043699 write(8, "2015-12-30 10:12:40 SCarroll@ncghotels.com: remote_smtp transport succeeded\n", 76) = 76
[pid 25491] 10:12:40.043839 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043913 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.043963 close(7)    = 0
[pid 25491] 10:12:40.043999 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:40.044038 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:40.044069 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:40.044101 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5397383, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.044145 write(7, "2015-12-30 10:12:40 [25491] 1aEJMZ-0006cs-RM -> scarroll@ncghotels.com <SCarroll@ncghotels.com> I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3155 H=ncghotels.com.inbound10.mx"..., 653) = 653
[pid 25491] 10:12:40.044198 geteuid()   = 0
[pid 25491] 10:12:40.044231 getegid()   = 12
[pid 25491] 10:12:40.044265 setgid(12)  = 0
[pid 25491] 10:12:40.044297 setuid(47)  = 0
[pid 25491] 10:12:40.044333 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25491] 10:12:40.044382 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.044436 pipe([10, 11]) = 0
[pid 25491] 10:12:40.044475 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25491] 10:12:40.044517 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f33164e4a90) = 25606
[pid 25491] 10:12:40.044816 close(10)   = 0
[pid 25491] 10:12:40.044862 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25491] 10:12:40.044909 fstat(11, {st_dev=makedev(0, 8), st_ino=2130172164, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.045000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:40.045039 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25491] 10:12:40.045139 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:35, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25491] 10:12:40.045189 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1056) = 1056
[pid 25491] 10:12:40.045248 lseek(6, 19, SEEK_SET) = 19
[pid 25491] 10:12:40.045284 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25491] 10:12:40.045334 read(6, "", 8192) = 0
[pid 25491] 10:12:40.045367 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006cs-RM; Wed, 30 Dec 2015 10:12:35 -0600\nTo:  VHuerta@ncghot"..., 2471) = 2471
[pid 25491] 10:12:40.045406 write(11, "\n--1451491960-eximdsn-1312232142--\n", 35) = 35
[pid 25491] 10:12:40.045440 close(11)   = 0
[pid 25491] 10:12:40.045473 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:40.045516 wait4(25606, Process 25606 attached
 <unfinished ...>
[pid 25606] 10:12:40.045568 set_robust_list(0x7f33164e4aa0, 24) = 0
[pid 25606] 10:12:40.045620 close(0)    = 0
[pid 25606] 10:12:40.045698 dup2(10, 0) = 0
[pid 25606] 10:12:40.045732 close(10)   = 0
[pid 25606] 10:12:40.045818 close(11)   = 0
[pid 25606] 10:12:40.045872 fstat(0, {st_dev=makedev(0, 8), st_ino=2130172164, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.045922 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25606] 10:12:40.045966 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25606] 10:12:40.046013 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMZ-0006cs-RM"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25606] 10:12:40.046357 brk(0)      = 0x1601000
[pid 25606] 10:12:40.046397 fcntl(0, F_GETFD) = 0
[pid 25606] 10:12:40.046429 fcntl(1, F_GETFD) = 0
[pid 25606] 10:12:40.046460 fcntl(2, F_GETFD) = 0
[pid 25606] 10:12:40.046496 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046550 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f27000
[pid 25606] 10:12:40.046599 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046648 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046692 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046730 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046832 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046871 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046919 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046956 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.046993 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25606] 10:12:40.047041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047125 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047163 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047242 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047280 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047320 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.047369 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047408 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047444 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047494 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047532 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047570 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffe52fd17c0) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047606 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.047644 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.047696 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25606] 10:12:40.047733 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25606] 10:12:40.047838 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7fe661f1d000
[pid 25606] 10:12:40.047883 close(6)    = 0
[pid 25606] 10:12:40.047928 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.047970 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.048011 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.048057 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe661aef000
[pid 25606] 10:12:40.048093 mprotect(0x7fe661b05000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.048129 mmap(0x7fe661d05000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7fe661d05000
[pid 25606] 10:12:40.048173 mmap(0x7fe661d07000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe661d07000
[pid 25606] 10:12:40.048216 close(6)    = 0
[pid 25606] 10:12:40.048254 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048296 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048337 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048378 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.048419 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.048457 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.048507 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f1c000
[pid 25606] 10:12:40.048546 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe6618d6000
[pid 25606] 10:12:40.048581 mprotect(0x7fe6618ec000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.048615 mmap(0x7fe661aeb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7fe661aeb000
[pid 25606] 10:12:40.048656 mmap(0x7fe661aed000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe661aed000
[pid 25606] 10:12:40.048696 close(6)    = 0
[pid 25606] 10:12:40.048734 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048837 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048884 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.048928 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.048968 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.049006 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.049094 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe66169f000
[pid 25606] 10:12:40.049140 mprotect(0x7fe6616a6000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.049212 mmap(0x7fe6618a6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7fe6618a6000
[pid 25606] 10:12:40.049256 mmap(0x7fe6618a8000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe6618a8000
[pid 25606] 10:12:40.049297 close(6)    = 0
[pid 25606] 10:12:40.049334 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.049376 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.049488 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.049530 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25606] 10:12:40.049569 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.049608 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.049656 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe66141b000
[pid 25606] 10:12:40.049789 mprotect(0x7fe66149e000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.049837 mmap(0x7fe66169d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7fe66169d000
[pid 25606] 10:12:40.049884 close(6)    = 0
[pid 25606] 10:12:40.049956 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050003 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050044 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050093 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25606] 10:12:40.050136 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.050175 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25606] 10:12:40.050221 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f1b000
[pid 25606] 10:12:40.050258 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe66120d000
[pid 25606] 10:12:40.050294 mprotect(0x7fe661219000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.050328 mmap(0x7fe661419000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7fe661419000
[pid 25606] 10:12:40.050371 close(6)    = 0
[pid 25606] 10:12:40.050410 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.050452 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.050492 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25606] 10:12:40.050537 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe660fea000
[pid 25606] 10:12:40.050572 mprotect(0x7fe66100b000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.050606 mmap(0x7fe66120b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7fe66120b000
[pid 25606] 10:12:40.050645 close(6)    = 0
[pid 25606] 10:12:40.050692 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050736 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050868 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.050911 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25606] 10:12:40.050956 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.050995 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.051040 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe660dcd000
[pid 25606] 10:12:40.051076 mprotect(0x7fe660de4000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.051145 mmap(0x7fe660fe4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fe660fe4000
[pid 25606] 10:12:40.051193 mmap(0x7fe660fe6000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe660fe6000
[pid 25606] 10:12:40.051234 close(6)    = 0
[pid 25606] 10:12:40.051281 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051324 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051365 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051404 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25606] 10:12:40.051441 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.051481 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.051533 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f1a000
[pid 25606] 10:12:40.051570 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe660a59000
[pid 25606] 10:12:40.051606 mprotect(0x7fe660bc8000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.051641 mmap(0x7fe660dc7000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7fe660dc7000
[pid 25606] 10:12:40.051684 close(6)    = 0
[pid 25606] 10:12:40.051723 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051905 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.051949 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25606] 10:12:40.051991 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.052035 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25606] 10:12:40.052082 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe6607ca000
[pid 25606] 10:12:40.052118 mprotect(0x7fe660855000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.052157 mmap(0x7fe660a55000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7fe660a55000
[pid 25606] 10:12:40.052199 mmap(0x7fe660a58000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe660a58000
[pid 25606] 10:12:40.052243 close(6)    = 0
[pid 25606] 10:12:40.052282 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.052323 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.052363 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.052403 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.052442 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.052484 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25606] 10:12:40.052533 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe6605c4000
[pid 25606] 10:12:40.052569 mprotect(0x7fe6605ca000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.052604 mmap(0x7fe6607c9000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7fe6607c9000
[pid 25606] 10:12:40.052644 close(6)    = 0
[pid 25606] 10:12:40.052680 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.052720 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25606] 10:12:40.052821 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.052868 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.052915 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f19000
[pid 25606] 10:12:40.052959 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe66028e000
[pid 25606] 10:12:40.052996 mprotect(0x7fe6603ba000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.053031 mmap(0x7fe6605ba000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7fe6605ba000
[pid 25606] 10:12:40.053072 mmap(0x7fe6605c3000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe6605c3000
[pid 25606] 10:12:40.053113 close(6)    = 0
[pid 25606] 10:12:40.053151 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053192 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053233 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053272 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.053312 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.053353 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.053401 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe66008a000
[pid 25606] 10:12:40.053437 mprotect(0x7fe66008c000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.053472 mmap(0x7fe66028c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fe66028c000
[pid 25606] 10:12:40.053519 close(6)    = 0
[pid 25606] 10:12:40.053558 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053640 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.053679 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.053721 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.053814 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.053871 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65fe87000
[pid 25606] 10:12:40.053912 mprotect(0x7fe65fe89000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.053947 mmap(0x7fe660088000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fe660088000
[pid 25606] 10:12:40.053990 close(6)    = 0
[pid 25606] 10:12:40.054034 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054075 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054116 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054155 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25606] 10:12:40.054194 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.054232 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.054276 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f18000
[pid 25606] 10:12:40.054316 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65faf3000
[pid 25606] 10:12:40.054354 mprotect(0x7fe65fc7d000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.054388 mmap(0x7fe65fe7d000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7fe65fe7d000
[pid 25606] 10:12:40.054430 mmap(0x7fe65fe82000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe65fe82000
[pid 25606] 10:12:40.054471 close(6)    = 0
[pid 25606] 10:12:40.054517 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054559 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.054639 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25606] 10:12:40.054678 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.054716 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25606] 10:12:40.054836 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65f887000
[pid 25606] 10:12:40.054878 mprotect(0x7fe65f8e9000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.054912 mmap(0x7fe65fae8000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7fe65fae8000
[pid 25606] 10:12:40.054956 close(6)    = 0
[pid 25606] 10:12:40.054998 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055040 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055086 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055126 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25606] 10:12:40.055165 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.055204 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25606] 10:12:40.055306 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65f4a4000
[pid 25606] 10:12:40.055344 mprotect(0x7fe65f65d000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.055377 mmap(0x7fe65f85c000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7fe65f85c000
[pid 25606] 10:12:40.055458 mmap(0x7fe65f883000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe65f883000
[pid 25606] 10:12:40.055508 close(6)    = 0
[pid 25606] 10:12:40.055583 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055630 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055671 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.055711 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25606] 10:12:40.055807 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.055851 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25606] 10:12:40.055908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f17000
[pid 25606] 10:12:40.055948 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65f277000
[pid 25606] 10:12:40.055985 mprotect(0x7fe65f2a3000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.056020 mmap(0x7fe65f4a3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7fe65f4a3000
[pid 25606] 10:12:40.056069 close(6)    = 0
[pid 25606] 10:12:40.056108 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.056151 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.056238 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25606] 10:12:40.056290 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65f072000
[pid 25606] 10:12:40.056327 mprotect(0x7fe65f077000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.056362 mmap(0x7fe65f276000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7fe65f276000
[pid 25606] 10:12:40.056403 close(6)    = 0
[pid 25606] 10:12:40.056443 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.056497 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.056540 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.056581 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25606] 10:12:40.056618 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.056656 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25606] 10:12:40.056704 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65ee6f000
[pid 25606] 10:12:40.056858 mprotect(0x7fe65ee71000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.056903 mmap(0x7fe65f070000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fe65f070000
[pid 25606] 10:12:40.056948 close(6)    = 0
[pid 25606] 10:12:40.056988 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057030 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057070 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057114 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.057155 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.057193 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25606] 10:12:40.057241 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f16000
[pid 25606] 10:12:40.057279 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65ec4c000
[pid 25606] 10:12:40.057322 mprotect(0x7fe65ec63000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.057357 mmap(0x7fe65ee63000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7fe65ee63000
[pid 25606] 10:12:40.057402 close(6)    = 0
[pid 25606] 10:12:40.057454 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057499 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057542 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057583 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.057622 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.057661 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.057710 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65ea08000
[pid 25606] 10:12:40.057793 mprotect(0x7fe65ea49000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.057831 mmap(0x7fe65ec49000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7fe65ec49000
[pid 25606] 10:12:40.057875 close(6)    = 0
[pid 25606] 10:12:40.057916 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.057957 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058084 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25606] 10:12:40.058124 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.058162 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.058208 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f15000
[pid 25606] 10:12:40.058245 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65e721000
[pid 25606] 10:12:40.058282 mprotect(0x7fe65e7fc000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.058326 mmap(0x7fe65e9fc000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7fe65e9fc000
[pid 25606] 10:12:40.058371 close(6)    = 0
[pid 25606] 10:12:40.058413 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058461 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058506 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058547 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25606] 10:12:40.058586 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.058624 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.058670 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65e51d000
[pid 25606] 10:12:40.058708 mprotect(0x7fe65e520000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.058788 mmap(0x7fe65e71f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7fe65e71f000
[pid 25606] 10:12:40.058839 close(6)    = 0
[pid 25606] 10:12:40.058925 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.058971 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059012 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059052 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25606] 10:12:40.059092 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.059131 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.059177 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65e2f1000
[pid 25606] 10:12:40.059215 mprotect(0x7fe65e31a000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.059249 mmap(0x7fe65e51a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7fe65e51a000
[pid 25606] 10:12:40.059291 mmap(0x7fe65e51c000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe65e51c000
[pid 25606] 10:12:40.059333 close(6)    = 0
[pid 25606] 10:12:40.059376 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059417 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059458 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059500 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.059555 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.059594 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25606] 10:12:40.059640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f14000
[pid 25606] 10:12:40.059677 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65e0db000
[pid 25606] 10:12:40.059715 mprotect(0x7fe65e0f0000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.059797 mmap(0x7fe65e2ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7fe65e2ef000
[pid 25606] 10:12:40.059888 close(6)    = 0
[pid 25606] 10:12:40.059941 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.059984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060024 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060064 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25606] 10:12:40.060103 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.060151 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25606] 10:12:40.060198 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65ded0000
[pid 25606] 10:12:40.060238 mprotect(0x7fe65deda000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.060273 mmap(0x7fe65e0d9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7fe65e0d9000
[pid 25606] 10:12:40.060317 close(6)    = 0
[pid 25606] 10:12:40.060362 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060406 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060458 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060501 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.060542 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.060588 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25606] 10:12:40.060635 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65dccd000
[pid 25606] 10:12:40.060674 mprotect(0x7fe65dccf000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.060708 mmap(0x7fe65dece000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7fe65dece000
[pid 25606] 10:12:40.060798 close(6)    = 0
[pid 25606] 10:12:40.060842 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f13000
[pid 25606] 10:12:40.060895 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060937 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.060978 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.061018 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25606] 10:12:40.061055 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.061093 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25606] 10:12:40.061139 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7fe65daae000
[pid 25606] 10:12:40.061176 mprotect(0x7fe65dacb000, 2093056, PROT_NONE) = 0
[pid 25606] 10:12:40.061211 mmap(0x7fe65dcca000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7fe65dcca000
[pid 25606] 10:12:40.061252 mmap(0x7fe65dccc000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fe65dccc000
[pid 25606] 10:12:40.061293 close(6)    = 0
[pid 25606] 10:12:40.061357 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f12000
[pid 25606] 10:12:40.061481 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f11000
[pid 25606] 10:12:40.061532 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f0f000
[pid 25606] 10:12:40.061571 arch_prctl(ARCH_SET_FS, 0x7fe661f0f7c0) = 0
[pid 25606] 10:12:40.061645 mprotect(0x7fe65dcca000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.061688 mprotect(0x7fe65dece000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.061738 mprotect(0x7fe65e0d9000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.061838 mprotect(0x7fe65e2ef000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.061891 mprotect(0x7fe65e51a000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.061934 mprotect(0x7fe65e71f000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.062105 mprotect(0x7fe65e9fc000, 40960, PROT_READ) = 0
[pid 25606] 10:12:40.062231 mprotect(0x7fe65ec49000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.062280 mprotect(0x7fe65ee63000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.062319 mprotect(0x7fe65f070000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.062546 mprotect(0x7fe65f85c000, 110592, PROT_READ) = 0
[pid 25606] 10:12:40.062658 mprotect(0x7fe65fae8000, 16384, PROT_READ) = 0
[pid 25606] 10:12:40.062841 mprotect(0x7fe65fe7d000, 16384, PROT_READ) = 0
[pid 25606] 10:12:40.062889 mprotect(0x7fe660088000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.062932 mprotect(0x7fe66028c000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063613 mprotect(0x7fe660fe4000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063677 mprotect(0x7fe661419000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063717 mprotect(0x7fe66169d000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063842 mprotect(0x7fe6618a6000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063899 mprotect(0x7fe661aeb000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.063949 mprotect(0x7fe661d05000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.064010 mprotect(0x7fe661f28000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.064047 munmap(0x7fe661f1d000, 39387) = 0
[pid 25606] 10:12:40.064085 set_tid_address(0x7fe661f0fa90) = 25606
[pid 25606] 10:12:40.064116 set_robust_list(0x7fe661f0faa0, 24) = 0
[pid 25606] 10:12:40.064147 futex(0x7ffe52fd20bc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25606] 10:12:40.064179 futex(0x7ffe52fd20bc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fe661f0f7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25606] 10:12:40.064219 rt_sigaction(SIGRTMIN, {0x7fe660dd2c60, [], SA_RESTORER|SA_SIGINFO, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.064258 rt_sigaction(SIGRT_1, {0x7fe660dd2cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.064294 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25606] 10:12:40.064336 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25606] 10:12:40.064427 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350311, f_bavail=6350311, f_files=1000000, f_ffree=691066, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25606] 10:12:40.064525 brk(0)      = 0x1601000
[pid 25606] 10:12:40.064569 brk(0x1622000) = 0x1622000
[pid 25606] 10:12:40.064613 open("/proc/filesystems", O_RDONLY) = 6
[pid 25606] 10:12:40.064671 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.064720 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f26000
[pid 25606] 10:12:40.064829 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25606] 10:12:40.064961 read(6, "", 1024) = 0
[pid 25606] 10:12:40.065001 close(6)    = 0
[pid 25606] 10:12:40.065038 munmap(0x7fe661f26000, 4096) = 0
[pid 25606] 10:12:40.065119 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.065225 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.065273 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25606] 10:12:40.065355 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.065397 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25606] 10:12:40.065435 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25606] 10:12:40.065473 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.065519 umask(0)    = 0
[pid 25606] 10:12:40.065599 geteuid()   = 0
[pid 25606] 10:12:40.065635 getuid()    = 47
[pid 25606] 10:12:40.065691 getgid()    = 12
[pid 25606] 10:12:40.065856 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25606] 10:12:40.065901 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25606] 10:12:40.065937 getgroups(65536, []) = 0
[pid 25606] 10:12:40.065973 setgroups(0, []) = 0
[pid 25606] 10:12:40.066008 getegid()   = 12
[pid 25606] 10:12:40.066039 geteuid()   = 0
[pid 25606] 10:12:40.066074 geteuid()   = 0
[pid 25606] 10:12:40.066104 getegid()   = 12
[pid 25606] 10:12:40.066145 setgid(12)  = 0
[pid 25606] 10:12:40.066181 setuid(0)   = 0
[pid 25606] 10:12:40.066239 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25606] 10:12:40.066290 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25606] 10:12:40.066361 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25606] 10:12:40.066428 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f26000
[pid 25606] 10:12:40.066501 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25606] 10:12:40.066712 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25606] 10:12:40.066894 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.066969 close(7)    = 0
[pid 25606] 10:12:40.067023 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25606] 10:12:40.067076 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.067144 close(7)    = 0
[pid 25606] 10:12:40.067204 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25606] 10:12:40.067268 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25606] 10:12:40.067343 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.067397 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25606] 10:12:40.067481 read(7, "", 4096) = 0
[pid 25606] 10:12:40.067541 close(7)    = 0
[pid 25606] 10:12:40.067622 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.067695 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.067874 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.067943 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.067985 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25606] 10:12:40.068024 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25606] 10:12:40.068073 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7fe661f05000
[pid 25606] 10:12:40.068110 close(7)    = 0
[pid 25606] 10:12:40.068158 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25606] 10:12:40.068210 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25606] 10:12:40.068253 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25606] 10:12:40.068303 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7fe65d8a0000
[pid 25606] 10:12:40.068345 mprotect(0x7fe65d8ac000, 2097152, PROT_NONE) = 0
[pid 25606] 10:12:40.068381 mmap(0x7fe65daac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7fe65daac000
[pid 25606] 10:12:40.068431 close(7)    = 0
[pid 25606] 10:12:40.068485 mprotect(0x7fe65daac000, 4096, PROT_READ) = 0
[pid 25606] 10:12:40.068528 munmap(0x7fe661f05000, 39387) = 0
[pid 25606] 10:12:40.068578 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25606] 10:12:40.068623 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25606] 10:12:40.068660 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.068705 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.068740 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.068812 close(7)    = 0
[pid 25606] 10:12:40.068847 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.068904 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25606] 10:12:40.068945 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.068989 close(7)    = 0
[pid 25606] 10:12:40.069024 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25606] 10:12:40.069059 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.069106 close(7)    = 0
[pid 25606] 10:12:40.069144 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25606] 10:12:40.069185 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25606] 10:12:40.069230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.069265 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25606] 10:12:40.069317 close(7)    = 0
[pid 25606] 10:12:40.069351 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.069410 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25606] 10:12:40.069489 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25606] 10:12:40.069535 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.069584 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.069620 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.069663 close(7)    = 0
[pid 25606] 10:12:40.069696 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.069739 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25606] 10:12:40.069800 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25606] 10:12:40.069865 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, 8) = 0
[pid 25606] 10:12:40.069912 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe661f0fa90) = 25607
[pid 25606] 10:12:40.070137 wait4(25607, Process 25607 attached
 <unfinished ...>
[pid 25607] 10:12:40.070174 set_robust_list(0x7fe661f0faa0, 24) = 0
[pid 25607] 10:12:40.070212 geteuid()   = 0
[pid 25607] 10:12:40.070245 geteuid()   = 0
[pid 25607] 10:12:40.070445 getegid()   = 12
[pid 25607] 10:12:40.070482 setgid(12)  = 0
[pid 25607] 10:12:40.070515 setuid(47)  = 0
[pid 25607] 10:12:40.072153 brk(0x1643000) = 0x1643000
[pid 25607] 10:12:40.072559 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25607] 10:12:40.072632 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25607] 10:12:40.072686 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25607] 10:12:40.072729 read(7, "\233\336\307\356\203R6\225R\1\nh\32\314\221U\17\265N!\326\371v\n\322\233NO\273\270\356\203oh\226\250G\353\273\214\305\224\rq\"\r\214\31", 48) = 48
[pid 25607] 10:12:40.072772 close(7)    = 0
[pid 25607] 10:12:40.072873 getuid()    = 47
[pid 25607] 10:12:40.073042 exit_group(0) = ?
[pid 25607] 10:12:40.073238 +++ exited with 0 +++
[pid 25606] 10:12:40.073276 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25607
[pid 25606] 10:12:40.073301 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, 8) = 0
[pid 25606] 10:12:40.073361 getcwd("/var/spool/exim", 16380) = 16
[pid 25606] 10:12:40.073435 open("/etc/localtime", O_RDONLY) = 7
[pid 25606] 10:12:40.073477 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.073523 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.073579 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.073622 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25606] 10:12:40.073670 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25606] 10:12:40.073703 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25606] 10:12:40.073750 close(7)    = 0
[pid 25606] 10:12:40.073784 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.073848 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25606] 10:12:40.073897 fcntl(7, F_GETFD) = 0
[pid 25606] 10:12:40.073929 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25606] 10:12:40.073961 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5398036, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.074008 write(7, "2015-12-30 10:12:40 [25606] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMZ-0006cs-RM\n", 108) = 108
[pid 25606] 10:12:40.074050 chdir("/var/spool/exim") = 0
[pid 25606] 10:12:40.074091 geteuid()   = 0
[pid 25606] 10:12:40.074123 getegid()   = 12
[pid 25606] 10:12:40.074163 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.074204 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.074249 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.074284 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.074330 close(8)    = 0
[pid 25606] 10:12:40.074364 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.074403 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25606] 10:12:40.074446 read(8, "65536\n", 31) = 6
[pid 25606] 10:12:40.074482 close(8)    = 0
[pid 25606] 10:12:40.074522 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.074571 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25606] 10:12:40.074616 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.074658 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.074693 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25606] 10:12:40.074743 read(8, "", 4096) = 0
[pid 25606] 10:12:40.074778 close(8)    = 0
[pid 25606] 10:12:40.074816 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.074855 setgroups(1, [12]) = 0
[pid 25606] 10:12:40.074891 setgid(12)  = 0
[pid 25606] 10:12:40.074924 setuid(47)  = 0
[pid 25606] 10:12:40.075107 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25606] 10:12:40.075199 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25606] 10:12:40.075283 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25606] 10:12:40.075357 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25606] 10:12:40.075432 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25606] 10:12:40.075530 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25606] 10:12:40.075722 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25606] 10:12:40.075798 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.075842 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.075889 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.075925 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.075971 close(8)    = 0
[pid 25606] 10:12:40.076005 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.076100 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25606] 10:12:40.076202 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25606] 10:12:40.076322 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25606] 10:12:40.076444 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25606] 10:12:40.076646 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25606] 10:12:40.076710 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.076753 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.076803 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.076839 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.076889 close(8)    = 0
[pid 25606] 10:12:40.076922 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.076970 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.077011 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25606] 10:12:40.077056 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.077091 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25606] 10:12:40.077138 close(8)    = 0
[pid 25606] 10:12:40.077172 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.077228 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.077269 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25606] 10:12:40.077313 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.077347 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25606] 10:12:40.077393 close(8)    = 0
[pid 25606] 10:12:40.077426 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.077532 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25606] 10:12:40.077767 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25606] 10:12:40.077874 read(6, "", 4096) = 0
[pid 25606] 10:12:40.077913 read(6, "", 4096) = 0
[pid 25606] 10:12:40.077948 close(6)    = 0
[pid 25606] 10:12:40.077982 munmap(0x7fe661f26000, 4096) = 0
[pid 25606] 10:12:40.078022 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25606] 10:12:40.078063 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.078108 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f26000
[pid 25606] 10:12:40.078144 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.078189 close(6)    = 0
[pid 25606] 10:12:40.078222 munmap(0x7fe661f26000, 4096) = 0
[pid 25606] 10:12:40.078266 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25606] 10:12:40.078325 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.078379 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25606] 10:12:40.078420 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25606] 10:12:40.078459 fstat(0, {st_dev=makedev(0, 8), st_ino=2130172164, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.078504 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f26000
[pid 25606] 10:12:40.078614 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3562
[pid 25606] 10:12:40.078717 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.078787 open("/var/spool/exim/input/e/1aEJMe-0006f0-2W-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25606] 10:12:40.078877 fchown(6, 47, 12) = 0
[pid 25606] 10:12:40.078917 fchmod(6, 0640) = 0
[pid 25606] 10:12:40.078954 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25606] 10:12:40.078988 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.079033 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f25000
[pid 25606] 10:12:40.079068 lseek(6, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.079106 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25606] 10:12:40.079225 read(0, "", 4096) = 0
[pid 25606] 10:12:40.079260 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.079296 write(6, "1aEJMe-0006f0-2W-D\n--1451491960-eximdsn-1312232142\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3207) = 3207
[pid 25606] 10:12:40.079342 fsync(6)    = 0
[pid 25606] 10:12:40.079782 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.079878 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3207, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.080006 brk(0x1643000) = 0x1643000
[pid 25606] 10:12:40.080068 getuid()    = 47
[pid 25606] 10:12:40.080104 geteuid()   = 47
[pid 25606] 10:12:40.080138 getgid()    = 12
[pid 25606] 10:12:40.080171 getegid()   = 12
[pid 25606] 10:12:40.080261 open("/dev/urandom", O_RDONLY) = 8
[pid 25606] 10:12:40.080307 read(8, "\227W\246'", 4) = 4
[pid 25606] 10:12:40.080344 close(8)    = 0
[pid 25606] 10:12:40.080454 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25606] 10:12:40.080633 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d350) = -1 EINVAL (Invalid argument)
[pid 25606] 10:12:40.080681 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25606] 10:12:40.080719 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.080754 lseek(1, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.080787 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.080824 lseek(2, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.080859 open("/dev/null", O_RDONLY) = 8
[pid 25606] 10:12:40.080902 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d430) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.080936 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.080968 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25606] 10:12:40.081002 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe660ddc790}, 8) = 0
[pid 25606] 10:12:40.081042 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7fe660ddc790}, 8) = 0
[pid 25606] 10:12:40.081317 read(8, "", 8192) = 0
[pid 25606] 10:12:40.081363 close(8)    = 0
[pid 25606] 10:12:40.081646 brk(0x1664000) = 0x1664000
[pid 25606] 10:12:40.081800 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25606] 10:12:40.081863 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25606] 10:12:40.081905 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.081942 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.081995 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25606] 10:12:40.083036 brk(0x1685000) = 0x1685000
[pid 25606] 10:12:40.083265 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25606] 10:12:40.084242 brk(0x16a6000) = 0x16a6000
[pid 25606] 10:12:40.084661 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25606] 10:12:40.085568 brk(0x16c7000) = 0x16c7000
[pid 25606] 10:12:40.085856 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25606] 10:12:40.086159 read(8, "", 8192) = 0
[pid 25606] 10:12:40.086207 close(8)    = 0
[pid 25606] 10:12:40.086259 stat("/usr/share/amavis/amavis-filter", 0x7fe6605c3880) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.086307 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25606] 10:12:40.086360 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25606] 10:12:40.086408 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25606] 10:12:40.086448 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8d260) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.086487 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.086613 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25606] 10:12:40.087058 stat("/etc/exim/perl/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087112 stat("/etc/exim/perl/warnings.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087153 stat("/usr/local/cpanel/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087192 stat("/usr/local/cpanel/warnings.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087231 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087275 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087317 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087356 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087397 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087437 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087480 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.087527 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.087678 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25606] 10:12:40.087722 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8cc70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.087759 lseek(9, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.087802 brk(0x16e8000) = 0x16e8000
[pid 25606] 10:12:40.087855 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25606] 10:12:40.088184 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25606] 10:12:40.088981 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25606] 10:12:40.089107 brk(0x1709000) = 0x1709000
[pid 25606] 10:12:40.089443 read(9, "", 8192) = 0
[pid 25606] 10:12:40.089493 close(9)    = 0
[pid 25606] 10:12:40.090214 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25606] 10:12:40.091021 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25606] 10:12:40.091791 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25606] 10:12:40.092382 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25606] 10:12:40.092678 brk(0x172a000) = 0x172a000
[pid 25606] 10:12:40.093127 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25606] 10:12:40.093954 brk(0x174b000) = 0x174b000
[pid 25606] 10:12:40.094134 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25606] 10:12:40.094727 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25606] 10:12:40.095230 brk(0x176c000) = 0x176c000
[pid 25606] 10:12:40.095394 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25606] 10:12:40.096075 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25606] 10:12:40.096536 brk(0x178d000) = 0x178d000
[pid 25606] 10:12:40.096922 stat("/usr/local/cpanel/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.096977 stat("/usr/local/cpanel/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097019 stat("/etc/exim/perl/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097055 stat("/etc/exim/perl/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097093 stat("/usr/local/cpanel/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097129 stat("/usr/local/cpanel/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097168 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097210 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097252 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097292 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097335 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097375 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097416 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.097456 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.097511 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25606] 10:12:40.097629 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8cc70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.097668 lseek(9, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.097722 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25606] 10:12:40.097952 lseek(9, 878, SEEK_SET) = 878
[pid 25606] 10:12:40.097996 lseek(9, 0, SEEK_CUR) = 878
[pid 25606] 10:12:40.098028 close(9)    = 0
[pid 25606] 10:12:40.098260 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25606] 10:12:40.098920 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25606] 10:12:40.099083 brk(0x17ae000) = 0x17ae000
[pid 25606] 10:12:40.100153 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25606] 10:12:40.100388 brk(0x17cf000) = 0x17cf000
[pid 25606] 10:12:40.101544 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25606] 10:12:40.101714 brk(0x17f0000) = 0x17f0000
[pid 25606] 10:12:40.102470 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102533 stat("/usr/local/cpanel/Errno.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102645 stat("/etc/exim/perl/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102689 stat("/etc/exim/perl/Errno.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102728 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102765 stat("/usr/local/cpanel/Errno.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102803 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102844 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102886 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102926 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.102967 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.103007 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25606] 10:12:40.103062 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25606] 10:12:40.103106 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8cc70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.103143 lseek(9, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.103198 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25606] 10:12:40.103396 brk(0x1811000) = 0x1811000
[pid 25606] 10:12:40.103925 lseek(9, 4868, SEEK_SET) = 4868
[pid 25606] 10:12:40.103974 lseek(9, 0, SEEK_CUR) = 4868
[pid 25606] 10:12:40.104009 close(9)    = 0
[pid 25606] 10:12:40.104057 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104101 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104141 stat("/etc/exim/perl/Exporter.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104177 stat("/etc/exim/perl/Exporter.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104214 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104251 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104289 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104329 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffe52f8ce80) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104371 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffe52f8cf20) = -1 ENOENT (No such file or directory)
[pid 25606] 10:12:40.104410 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25606] 10:12:40.104464 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25606] 10:12:40.104508 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe52f8cc70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25606] 10:12:40.104659 lseek(9, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.104714 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25606] 10:12:40.105144 lseek(9, 2366, SEEK_SET) = 2366
[pid 25606] 10:12:40.105191 lseek(9, 0, SEEK_CUR) = 2366
[pid 25606] 10:12:40.105225 close(9)    = 0
[pid 25606] 10:12:40.105588 read(8, "", 8192) = 0
[pid 25606] 10:12:40.105647 close(8)    = 0
[pid 25606] 10:12:40.105847 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25606] 10:12:40.105896 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25606] 10:12:40.105944 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f24000
[pid 25606] 10:12:40.105981 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25606] 10:12:40.106029 close(8)    = 0
[pid 25606] 10:12:40.106063 munmap(0x7fe661f24000, 4096) = 0
[pid 25606] 10:12:40.106141 lseek(6, 19, SEEK_SET) = 19
[pid 25606] 10:12:40.106179 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106218 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106252 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106286 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106320 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106363 alarm(300)  = 0
[pid 25606] 10:12:40.106398 alarm(0)    = 300
[pid 25606] 10:12:40.106429 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106463 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106500 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106609 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106658 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7fe660ddc790}, NULL, 8) = 0
[pid 25606] 10:12:40.106695 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, 8) = 0
[pid 25606] 10:12:40.106733 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, 8) = 0
[pid 25606] 10:12:40.106775 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.106837 open("/var/spool/exim/input/e/hdr.25606", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25606] 10:12:40.106919 fchown(8, 47, 12) = 0
[pid 25606] 10:12:40.106958 fchmod(8, 0640) = 0
[pid 25606] 10:12:40.106993 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25606] 10:12:40.107029 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.107075 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f24000
[pid 25606] 10:12:40.107110 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.107157 write(8, "1aEJMe-0006f0-2W-H\nmailnull 47 12\n<>\n1451491960 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25606] 10:12:40.107204 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.107254 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMe-0006f0-2W\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:40 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25606] 10:12:40.107293 fsync(8)    = 0
[pid 25606] 10:12:40.107719 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.107769 close(8)    = 0
[pid 25606] 10:12:40.107803 munmap(0x7fe661f24000, 4096) = 0
[pid 25606] 10:12:40.107845 rename("/var/spool/exim/input/e/hdr.25606", "/var/spool/exim/input/e/1aEJMe-0006f0-2W-H") = 0
[pid 25606] 10:12:40.107908 open("/var/spool/exim/input/e/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25606] 10:12:40.107949 fsync(8)    = 0
[pid 25606] 10:12:40.107982 close(8)    = 0
[pid 25606] 10:12:40.108017 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3207, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.108074 open("/var/spool/exim/msglog/e/1aEJMe-0006f0-2W", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25606] 10:12:40.108149 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25606] 10:12:40.108184 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064870, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.108229 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe661f24000
[pid 25606] 10:12:40.108265 lseek(8, 0, SEEK_CUR) = 0
[pid 25606] 10:12:40.108298 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.108354 write(8, "2015-12-30 10:12:40 Received from <> R=1aEJMZ-0006cs-RM U=mailnull P=local S=3831 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25606] 10:12:40.108398 close(8)    = 0
[pid 25606] 10:12:40.108431 munmap(0x7fe661f24000, 4096) = 0
[pid 25606] 10:12:40.108474 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.108534 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25606] 10:12:40.108671 close(7)    = 0
[pid 25606] 10:12:40.108709 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25606] 10:12:40.108752 fcntl(7, F_GETFD) = 0
[pid 25606] 10:12:40.108783 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25606] 10:12:40.108815 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5398144, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25606] 10:12:40.108859 write(7, "2015-12-30 10:12:40 [25606] 1aEJMe-0006f0-2W <= <> R=1aEJMZ-0006cs-RM U=mailnull P=local S=3831 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25606] 10:12:40.108900 close(6)    = 0
[pid 25606] 10:12:40.108934 munmap(0x7fe661f25000, 4096) = 0
[pid 25606] 10:12:40.108970 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, 8) = 0
[pid 25606] 10:12:40.109009 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7fe65fb256a0}, 8) = 0
[pid 25606] 10:12:40.109046 open("/proc/loadavg", O_RDONLY) = 6
[pid 25606] 10:12:40.109094 read(6, "0.41 0.13 0.03 1/248 25607\n", 40) = 27
[pid 25606] 10:12:40.109133 close(6)    = 0
[pid 25606] 10:12:40.109181 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe661f0fa90) = 25608
[pid 25606] 10:12:40.109776 exit_group(0) = ?
[pid 25606] 10:12:40.110055 +++ exited with 0 +++
[pid 25491] 10:12:40.110089 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25606
[pid 25491] 10:12:40.110114 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f33140fa6a0}, 8) = 0
[pid 25491] 10:12:40.110169 write(8, "2015-12-30 10:12:40 courtyardavondale@finestweddingsites.com: children all complete\n", 84) = 84
[pid 25491] 10:12:40.110214 open("/var/spool/exim/input/Z/hdr.25491", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25491] 10:12:40.110282 fchown(10, 47, 12) = 0
[pid 25491] 10:12:40.110320 fchmod(10, 0640) = 0
[pid 25491] 10:12:40.110354 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25491] 10:12:40.110390 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.110444 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f33164fa000
[pid 25491] 10:12:40.110482 lseek(10, 0, SEEK_CUR) = 0
[pid 25491] 10:12:40.110529 write(10, "1aEJMZ-0006cs-RM-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491955 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 818) = 818
[pid 25491] 10:12:40.110631 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=818, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.110685 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMZ-0006cs-RM; Wed, 30 Dec 2015 10:12:35 -0600\n118T To:  VHuerta@ncghotels.com, aepperson@ncghotels.com, SCarrol"..., 601) = 601
[pid 25491] 10:12:40.110729 fsync(10Process 25608 attached
 <unfinished ...>
[pid 25608] 10:12:40.110809 set_robust_list(0x7fe661f0faa0, 24) = 0
[pid 25608] 10:12:40.110910 close(0)    = 0
[pid 25608] 10:12:40.110948 close(1)    = 0
[pid 25608] 10:12:40.110980 close(2)    = 0
[pid 25491] 10:12:40.111023 <... fsync resumed> ) = 0
[pid 25491] 10:12:40.111044 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1419, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.111090 close(10)   = 0
[pid 25491] 10:12:40.111124 munmap(0x7f33164fa000, 4096) = 0
[pid 25491] 10:12:40.111167 rename("/var/spool/exim/input/Z/hdr.25491", "/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-H") = 0
[pid 25491] 10:12:40.111254 open("/var/spool/exim/input/Z/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25491] 10:12:40.111296 fsync(10)   = 0
[pid 25491] 10:12:40.111329 close(10)   = 0
[pid 25491] 10:12:40.111366 unlink("/var/spool/exim/msglog/Z/1aEJMZ-0006cs-RM") = 0
[pid 25491] 10:12:40.111418 unlink("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-D") = 0
[pid 25491] 10:12:40.111464 unlink("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-H") = 0
[pid 25491] 10:12:40.111531 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.111675 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25491] 10:12:40.111729 close(7)    = 0
[pid 25491] 10:12:40.111766 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25491] 10:12:40.111806 fcntl(7, F_GETFD) = 0
[pid 25491] 10:12:40.111838 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25491] 10:12:40.111871 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5398348, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25491] 10:12:40.111915 write(7, "2015-12-30 10:12:40 [25491] 1aEJMZ-0006cs-RM Completed QT=5s\n", 61) = 61
[pid 25491] 10:12:40.111957 close(8)    = 0
[pid 25491] 10:12:40.112005 munmap(0x7f33164fb000, 4096) = 0
[pid 25491] 10:12:40.112043 close(9)    = 0
[pid 25491] 10:12:40.112078 unlink("/var/spool/exim/input/Z/1aEJMZ-0006cs-RM-J") = 0
[pid 25491] 10:12:40.112140 close(6)    = 0
[pid 25491] 10:12:40.112322 exit_group(0) = ?
[pid 25491] 10:12:40.112924 +++ exited with 0 +++
[pid 25608] 10:12:40.113037 setsid()    = 25608
[pid 25608] 10:12:40.113079 fstat(0, 0x7ffe52f917a0) = -1 EBADF (Bad file descriptor)
[pid 25608] 10:12:40.113116 open("/dev/null", O_RDWR) = 0
[pid 25608] 10:12:40.113161 fstat(1, 0x7ffe52f917a0) = -1 EBADF (Bad file descriptor)
[pid 25608] 10:12:40.113199 dup2(0, 1)  = 1
[pid 25608] 10:12:40.113232 fstat(2, 0x7ffe52f917a0) = -1 EBADF (Bad file descriptor)
[pid 25608] 10:12:40.113263 dup2(0, 2)  = 2
[pid 25608] 10:12:40.113294 geteuid()   = 47
[pid 25608] 10:12:40.113331 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25608] 10:12:40.113378 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25608] 10:12:40.113421 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25608] 10:12:40.113469 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMe-0006f0-2W"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25608] 10:12:40.114110 brk(0)      = 0x2493000
[pid 25608] 10:12:40.114148 fcntl(0, F_GETFD) = 0
[pid 25608] 10:12:40.114179 fcntl(1, F_GETFD) = 0
[pid 25608] 10:12:40.114208 fcntl(2, F_GETFD) = 0
[pid 25608] 10:12:40.114242 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114294 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ed000
[pid 25608] 10:12:40.114344 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114400 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114443 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114481 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114518 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114635 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114678 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114714 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114752 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25608] 10:12:40.114801 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114846 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114886 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114927 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.114966 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115007 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115047 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115087 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.115138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115177 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115253 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115333 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7fff184200e0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115371 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.115410 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.115466 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25608] 10:12:40.115503 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25608] 10:12:40.115645 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f52599e3000
[pid 25608] 10:12:40.115683 close(6)    = 0
[pid 25608] 10:12:40.115723 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.115764 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.115804 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.115849 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f52595b5000
[pid 25608] 10:12:40.115884 mprotect(0x7f52595cb000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.115920 mmap(0x7f52597cb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f52597cb000
[pid 25608] 10:12:40.115963 mmap(0x7f52597cd000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f52597cd000
[pid 25608] 10:12:40.116004 close(6)    = 0
[pid 25608] 10:12:40.116042 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116083 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116124 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116165 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.116204 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.116242 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.116285 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e2000
[pid 25608] 10:12:40.116324 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f525939c000
[pid 25608] 10:12:40.116359 mprotect(0x7f52593b2000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.116395 mmap(0x7f52595b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f52595b1000
[pid 25608] 10:12:40.116460 mmap(0x7f52595b3000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f52595b3000
[pid 25608] 10:12:40.116528 close(6)    = 0
[pid 25608] 10:12:40.116688 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116751 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116817 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.116884 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.116943 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.117002 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.117074 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5259165000
[pid 25608] 10:12:40.117129 mprotect(0x7f525916c000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.117183 mmap(0x7f525936c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f525936c000
[pid 25608] 10:12:40.117247 mmap(0x7f525936e000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f525936e000
[pid 25608] 10:12:40.117308 close(6)    = 0
[pid 25608] 10:12:40.117363 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.117423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.117487 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.117612 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25608] 10:12:40.117663 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.117702 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.117750 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5258ee1000
[pid 25608] 10:12:40.117786 mprotect(0x7f5258f64000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.117820 mmap(0x7f5259163000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f5259163000
[pid 25608] 10:12:40.117864 close(6)    = 0
[pid 25608] 10:12:40.117902 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.117943 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.117983 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.118028 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25608] 10:12:40.118067 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.118105 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25608] 10:12:40.118149 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e1000
[pid 25608] 10:12:40.118186 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5258cd3000
[pid 25608] 10:12:40.118222 mprotect(0x7f5258cdf000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.118256 mmap(0x7f5258edf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f5258edf000
[pid 25608] 10:12:40.118299 close(6)    = 0
[pid 25608] 10:12:40.118337 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.118379 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.118417 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25608] 10:12:40.118463 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5258ab0000
[pid 25608] 10:12:40.118500 mprotect(0x7f5258ad1000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.118533 mmap(0x7f5258cd1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f5258cd1000
[pid 25608] 10:12:40.118694 close(6)    = 0
[pid 25608] 10:12:40.118733 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.118775 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.118816 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.118855 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25608] 10:12:40.118893 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.118932 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.118982 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5258893000
[pid 25608] 10:12:40.119018 mprotect(0x7f52588aa000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.119052 mmap(0x7f5258aaa000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f5258aaa000
[pid 25608] 10:12:40.119093 mmap(0x7f5258aac000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5258aac000
[pid 25608] 10:12:40.119134 close(6)    = 0
[pid 25608] 10:12:40.119173 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119214 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119255 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119296 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25608] 10:12:40.119335 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.119374 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.119418 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e0000
[pid 25608] 10:12:40.119455 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f525851f000
[pid 25608] 10:12:40.119490 mprotect(0x7f525868e000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.119523 mmap(0x7f525888d000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f525888d000
[pid 25608] 10:12:40.119661 close(6)    = 0
[pid 25608] 10:12:40.119702 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119784 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.119823 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25608] 10:12:40.119863 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.119900 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25608] 10:12:40.119945 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5258290000
[pid 25608] 10:12:40.119980 mprotect(0x7f525831b000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.120019 mmap(0x7f525851b000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f525851b000
[pid 25608] 10:12:40.120060 mmap(0x7f525851e000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f525851e000
[pid 25608] 10:12:40.120247 close(6)    = 0
[pid 25608] 10:12:40.120294 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.120338 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.120382 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.120724 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.120787 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.120848 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25608] 10:12:40.120918 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f525808a000
[pid 25608] 10:12:40.120972 mprotect(0x7f5258090000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.121022 mmap(0x7f525828f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f525828f000
[pid 25608] 10:12:40.121084 close(6)    = 0
[pid 25608] 10:12:40.121139 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.121199 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25608] 10:12:40.121261 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.121319 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.121386 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599df000
[pid 25608] 10:12:40.121442 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5257d54000
[pid 25608] 10:12:40.121496 mprotect(0x7f5257e80000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.121598 mmap(0x7f5258080000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f5258080000
[pid 25608] 10:12:40.121659 mmap(0x7f5258089000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5258089000
[pid 25608] 10:12:40.121704 close(6)    = 0
[pid 25608] 10:12:40.121746 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.121791 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.121840 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.121881 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.121921 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.121962 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.122010 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5257b50000
[pid 25608] 10:12:40.122050 mprotect(0x7f5257b52000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.122086 mmap(0x7f5257d52000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f5257d52000
[pid 25608] 10:12:40.122140 close(6)    = 0
[pid 25608] 10:12:40.122181 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.122223 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.122264 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.122303 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.122342 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.122382 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.122428 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f525794d000
[pid 25608] 10:12:40.122466 mprotect(0x7f525794f000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.122591 mmap(0x7f5257b4e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f5257b4e000
[pid 25608] 10:12:40.122674 close(6)    = 0
[pid 25608] 10:12:40.122778 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.122849 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.122916 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.123038 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25608] 10:12:40.123107 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.123186 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.123268 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599de000
[pid 25608] 10:12:40.123336 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f52575b9000
[pid 25608] 10:12:40.123402 mprotect(0x7f5257743000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.123469 mmap(0x7f5257943000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f5257943000
[pid 25608] 10:12:40.123549 mmap(0x7f5257948000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5257948000
[pid 25608] 10:12:40.123620 close(6)    = 0
[pid 25608] 10:12:40.123700 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.123781 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.123858 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.123935 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25608] 10:12:40.124003 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.124270 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25608] 10:12:40.124340 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f525734d000
[pid 25608] 10:12:40.124393 mprotect(0x7f52573af000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.124454 mmap(0x7f52575ae000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f52575ae000
[pid 25608] 10:12:40.124518 close(6)    = 0
[pid 25608] 10:12:40.124577 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.124642 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.124783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.124841 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25608] 10:12:40.124895 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.124957 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25608] 10:12:40.125024 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5256f6a000
[pid 25608] 10:12:40.125075 mprotect(0x7f5257123000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.125122 mmap(0x7f5257322000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f5257322000
[pid 25608] 10:12:40.125179 mmap(0x7f5257349000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5257349000
[pid 25608] 10:12:40.125236 close(6)    = 0
[pid 25608] 10:12:40.125291 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.125350 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.125409 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.125467 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25608] 10:12:40.125520 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.125584 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25608] 10:12:40.125667 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599dd000
[pid 25608] 10:12:40.125857 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5256d3d000
[pid 25608] 10:12:40.125930 mprotect(0x7f5256d69000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.125997 mmap(0x7f5256f69000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f5256f69000
[pid 25608] 10:12:40.126069 close(6)    = 0
[pid 25608] 10:12:40.126136 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.126214 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.126284 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25608] 10:12:40.126366 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5256b38000
[pid 25608] 10:12:40.126432 mprotect(0x7f5256b3d000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.126501 mmap(0x7f5256d3c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f5256d3c000
[pid 25608] 10:12:40.126578 close(6)    = 0
[pid 25608] 10:12:40.126654 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.126824 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.126899 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.127019 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25608] 10:12:40.127090 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.127153 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25608] 10:12:40.127233 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5256935000
[pid 25608] 10:12:40.127292 mprotect(0x7f5256937000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.127346 mmap(0x7f5256b36000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f5256b36000
[pid 25608] 10:12:40.127412 close(6)    = 0
[pid 25608] 10:12:40.127475 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.127546 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.127614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.127675 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.127838 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.127903 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25608] 10:12:40.127980 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599dc000
[pid 25608] 10:12:40.128044 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5256712000
[pid 25608] 10:12:40.128105 mprotect(0x7f5256729000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.128164 mmap(0x7f5256929000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f5256929000
[pid 25608] 10:12:40.128239 close(6)    = 0
[pid 25608] 10:12:40.128324 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.128395 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.128466 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.128553 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.128636 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.128810 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.128904 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f52564ce000
[pid 25608] 10:12:40.128975 mprotect(0x7f525650f000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.129037 mmap(0x7f525670f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f525670f000
[pid 25608] 10:12:40.129110 close(6)    = 0
[pid 25608] 10:12:40.129179 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.129252 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.129330 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.129408 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25608] 10:12:40.129484 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.129565 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.129653 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599db000
[pid 25608] 10:12:40.129842 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f52561e7000
[pid 25608] 10:12:40.129916 mprotect(0x7f52562c2000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.129985 mmap(0x7f52564c2000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f52564c2000
[pid 25608] 10:12:40.130071 close(6)    = 0
[pid 25608] 10:12:40.130149 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.130225 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.130304 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.130380 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25608] 10:12:40.130458 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.130549 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.130647 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255fe3000
[pid 25608] 10:12:40.130829 mprotect(0x7f5255fe6000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.130901 mmap(0x7f52561e5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f52561e5000
[pid 25608] 10:12:40.130983 close(6)    = 0
[pid 25608] 10:12:40.131058 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131136 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131292 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25608] 10:12:40.131366 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.131441 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.131535 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255db7000
[pid 25608] 10:12:40.131615 mprotect(0x7f5255de0000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.131664 mmap(0x7f5255fe0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f5255fe0000
[pid 25608] 10:12:40.131777 mmap(0x7f5255fe2000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5255fe2000
[pid 25608] 10:12:40.131825 close(6)    = 0
[pid 25608] 10:12:40.131871 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131916 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131958 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.131999 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.132040 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.132080 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25608] 10:12:40.132134 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599da000
[pid 25608] 10:12:40.132175 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255ba1000
[pid 25608] 10:12:40.132214 mprotect(0x7f5255bb6000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.132251 mmap(0x7f5255db5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f5255db5000
[pid 25608] 10:12:40.132297 close(6)    = 0
[pid 25608] 10:12:40.132350 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.132393 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.132435 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.132477 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25608] 10:12:40.132606 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.132655 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25608] 10:12:40.132703 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255996000
[pid 25608] 10:12:40.132742 mprotect(0x7f52559a0000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.132787 mmap(0x7f5255b9f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f5255b9f000
[pid 25608] 10:12:40.132836 close(6)    = 0
[pid 25608] 10:12:40.132879 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.132920 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.132961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.133001 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.133041 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.133080 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25608] 10:12:40.133126 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255793000
[pid 25608] 10:12:40.133165 mprotect(0x7f5255795000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.133200 mmap(0x7f5255994000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f5255994000
[pid 25608] 10:12:40.133250 close(6)    = 0
[pid 25608] 10:12:40.133289 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599d9000
[pid 25608] 10:12:40.133340 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.133382 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.133423 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.133463 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25608] 10:12:40.133503 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.133636 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25608] 10:12:40.133702 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f5255574000
[pid 25608] 10:12:40.133742 mprotect(0x7f5255591000, 2093056, PROT_NONE) = 0
[pid 25608] 10:12:40.133778 mmap(0x7f5255790000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f5255790000
[pid 25608] 10:12:40.133819 mmap(0x7f5255792000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5255792000
[pid 25608] 10:12:40.133861 close(6)    = 0
[pid 25608] 10:12:40.133930 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599d8000
[pid 25608] 10:12:40.134002 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599d7000
[pid 25608] 10:12:40.134045 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599d5000
[pid 25608] 10:12:40.134084 arch_prctl(ARCH_SET_FS, 0x7f52599d57c0) = 0
[pid 25608] 10:12:40.134153 mprotect(0x7f5255790000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134192 mprotect(0x7f5255994000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134242 mprotect(0x7f5255b9f000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134284 mprotect(0x7f5255db5000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134330 mprotect(0x7f5255fe0000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134373 mprotect(0x7f52561e5000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134514 mprotect(0x7f52564c2000, 40960, PROT_READ) = 0
[pid 25608] 10:12:40.134717 mprotect(0x7f525670f000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134765 mprotect(0x7f5256929000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.134804 mprotect(0x7f5256b36000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.135028 mprotect(0x7f5257322000, 110592, PROT_READ) = 0
[pid 25608] 10:12:40.135131 mprotect(0x7f52575ae000, 16384, PROT_READ) = 0
[pid 25608] 10:12:40.135251 mprotect(0x7f5257943000, 16384, PROT_READ) = 0
[pid 25608] 10:12:40.135293 mprotect(0x7f5257b4e000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.135335 mprotect(0x7f5257d52000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136059 mprotect(0x7f5258aaa000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136127 mprotect(0x7f5258edf000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136169 mprotect(0x7f5259163000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136209 mprotect(0x7f525936c000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136258 mprotect(0x7f52595b1000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136301 mprotect(0x7f52597cb000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136397 mprotect(0x7f52599ee000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.136441 munmap(0x7f52599e3000, 39387) = 0
[pid 25608] 10:12:40.136485 set_tid_address(0x7f52599d5a90) = 25608
[pid 25608] 10:12:40.136571 set_robust_list(0x7f52599d5aa0, 24) = 0
[pid 25608] 10:12:40.136610 futex(0x7fff184209dc, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25608] 10:12:40.136644 futex(0x7fff184209dc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f52599d57c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25608] 10:12:40.136684 rt_sigaction(SIGRTMIN, {0x7f5258898c60, [], SA_RESTORER|SA_SIGINFO, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.136725 rt_sigaction(SIGRT_1, {0x7f5258898cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.136761 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25608] 10:12:40.136805 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25608] 10:12:40.136873 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350312, f_bavail=6350312, f_files=1000000, f_ffree=691067, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25608] 10:12:40.136966 brk(0)      = 0x2493000
[pid 25608] 10:12:40.137001 brk(0x24b4000) = 0x24b4000
[pid 25608] 10:12:40.137048 open("/proc/filesystems", O_RDONLY) = 6
[pid 25608] 10:12:40.137106 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.137155 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ec000
[pid 25608] 10:12:40.137191 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25608] 10:12:40.137273 read(6, "", 1024) = 0
[pid 25608] 10:12:40.137312 close(6)    = 0
[pid 25608] 10:12:40.137348 munmap(0x7f52599ec000, 4096) = 0
[pid 25608] 10:12:40.137431 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.137633 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.137687 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25608] 10:12:40.137765 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.137818 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25608] 10:12:40.137862 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25608] 10:12:40.137904 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.137948 umask(0)    = 0
[pid 25608] 10:12:40.138019 geteuid()   = 0
[pid 25608] 10:12:40.138055 getuid()    = 47
[pid 25608] 10:12:40.138087 getgid()    = 12
[pid 25608] 10:12:40.138143 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25608] 10:12:40.138179 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25608] 10:12:40.138213 getgroups(65536, [12]) = 1
[pid 25608] 10:12:40.138250 setgroups(0, []) = 0
[pid 25608] 10:12:40.138284 getegid()   = 12
[pid 25608] 10:12:40.138315 geteuid()   = 0
[pid 25608] 10:12:40.138350 geteuid()   = 0
[pid 25608] 10:12:40.138380 getegid()   = 12
[pid 25608] 10:12:40.138414 setgid(12)  = 0
[pid 25608] 10:12:40.138447 setuid(0)   = 0
[pid 25608] 10:12:40.138510 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25608] 10:12:40.138640 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.138704 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.138750 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ec000
[pid 25608] 10:12:40.138791 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25608] 10:12:40.138948 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25608] 10:12:40.138995 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.139045 close(7)    = 0
[pid 25608] 10:12:40.139080 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25608] 10:12:40.139115 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.139154 close(7)    = 0
[pid 25608] 10:12:40.139194 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25608] 10:12:40.139236 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25608] 10:12:40.139283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.139318 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25608] 10:12:40.139374 read(7, "", 4096) = 0
[pid 25608] 10:12:40.139408 close(7)    = 0
[pid 25608] 10:12:40.139441 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.139490 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.139610 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.139661 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.139700 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25608] 10:12:40.139737 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25608] 10:12:40.139785 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f52599cb000
[pid 25608] 10:12:40.139827 close(7)    = 0
[pid 25608] 10:12:40.139876 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25608] 10:12:40.139919 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25608] 10:12:40.139958 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25608] 10:12:40.140012 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f5255366000
[pid 25608] 10:12:40.140054 mprotect(0x7f5255372000, 2097152, PROT_NONE) = 0
[pid 25608] 10:12:40.140090 mmap(0x7f5255572000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f5255572000
[pid 25608] 10:12:40.140136 close(7)    = 0
[pid 25608] 10:12:40.140189 mprotect(0x7f5255572000, 4096, PROT_READ) = 0
[pid 25608] 10:12:40.140229 munmap(0x7f52599cb000, 39387) = 0
[pid 25608] 10:12:40.140274 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25608] 10:12:40.140319 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25608] 10:12:40.140355 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.140400 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.140440 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.140498 close(7)    = 0
[pid 25608] 10:12:40.140610 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.140669 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25608] 10:12:40.140708 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.140752 close(7)    = 0
[pid 25608] 10:12:40.140791 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25608] 10:12:40.140832 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.140872 close(7)    = 0
[pid 25608] 10:12:40.140911 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25608] 10:12:40.140951 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25608] 10:12:40.140996 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.141031 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25608] 10:12:40.141083 close(7)    = 0
[pid 25608] 10:12:40.141117 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.141168 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25608] 10:12:40.141242 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25608] 10:12:40.141284 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.141329 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.141364 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.141412 close(7)    = 0
[pid 25608] 10:12:40.141446 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.141489 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25608] 10:12:40.141620 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25608] 10:12:40.141686 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_DFL, [], SA_RESTORER, 0x7f52588a2790}, 8) = 0
[pid 25608] 10:12:40.141736 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f52599d5a90) = 25609
[pid 25608] 10:12:40.141992 wait4(25609, Process 25609 attached
 <unfinished ...>
[pid 25609] 10:12:40.142047 set_robust_list(0x7f52599d5aa0, 24) = 0
[pid 25609] 10:12:40.142100 geteuid()   = 0
[pid 25609] 10:12:40.142137 geteuid()   = 0
[pid 25609] 10:12:40.142170 getegid()   = 12
[pid 25609] 10:12:40.142203 setgid(12)  = 0
[pid 25609] 10:12:40.142235 setuid(47)  = 0
[pid 25609] 10:12:40.143876 brk(0x24d5000) = 0x24d5000
[pid 25609] 10:12:40.144274 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25609] 10:12:40.144333 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25609] 10:12:40.144388 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25609] 10:12:40.144431 read(7, "\207%\257\371E\264\v\334|D\271\263\321Y<U\200\303\302 \306;\242\273\360t\300\357\t\3\3|co\234\315K.~\232N\261\214d\21E\200\324", 48) = 48
[pid 25609] 10:12:40.144474 close(7)    = 0
[pid 25609] 10:12:40.144573 getuid()    = 47
[pid 25609] 10:12:40.144754 exit_group(0) = ?
[pid 25609] 10:12:40.144949 +++ exited with 0 +++
[pid 25608] 10:12:40.144987 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25609
[pid 25608] 10:12:40.145012 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, 8) = 0
[pid 25608] 10:12:40.145074 getcwd("/var/spool/exim", 16380) = 16
[pid 25608] 10:12:40.145144 open("/etc/localtime", O_RDONLY) = 7
[pid 25608] 10:12:40.145186 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.145232 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.145275 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.145310 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25608] 10:12:40.145364 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25608] 10:12:40.145397 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25608] 10:12:40.145445 close(7)    = 0
[pid 25608] 10:12:40.145493 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.145620 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25608] 10:12:40.145676 fcntl(7, F_GETFD) = 0
[pid 25608] 10:12:40.145709 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.145741 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5398409, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.145793 write(7, "2015-12-30 10:12:40 [25608] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMe-0006f0-2W\n", 92) = 92
[pid 25608] 10:12:40.145836 chdir("/var/spool/exim") = 0
[pid 25608] 10:12:40.145878 setgid(12)  = 0
[pid 25608] 10:12:40.145938 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25608] 10:12:40.146019 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25608] 10:12:40.146101 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25608] 10:12:40.146174 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25608] 10:12:40.146248 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25608] 10:12:40.146340 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25608] 10:12:40.146452 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25608] 10:12:40.146530 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25608] 10:12:40.146586 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.146634 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.146669 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.146718 close(8)    = 0
[pid 25608] 10:12:40.146754 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.146856 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25608] 10:12:40.146954 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25608] 10:12:40.147075 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25608] 10:12:40.147195 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25608] 10:12:40.147295 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25608] 10:12:40.147332 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25608] 10:12:40.147357 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.147388 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.147410 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.147443 close(8)    = 0
[pid 25608] 10:12:40.147463 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.147494 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25608] 10:12:40.147519 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25608] 10:12:40.147552 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.147574 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25608] 10:12:40.147606 close(8)    = 0
[pid 25608] 10:12:40.147626 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.147668 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25608] 10:12:40.147694 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25608] 10:12:40.147722 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.147743 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25608] 10:12:40.147778 close(8)    = 0
[pid 25608] 10:12:40.147798 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.147888 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25608] 10:12:40.147998 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25608] 10:12:40.148079 read(6, "", 4096) = 0
[pid 25608] 10:12:40.148102 read(6, "", 4096) = 0
[pid 25608] 10:12:40.148123 close(6)    = 0
[pid 25608] 10:12:40.148143 munmap(0x7f52599ec000, 4096) = 0
[pid 25608] 10:12:40.148180 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f52588a2790}, NULL, 8) = 0
[pid 25608] 10:12:40.148213 open("/var/spool/exim/input/e/1aEJMe-0006f0-2W-D", O_RDWR|O_APPEND) = 6
[pid 25608] 10:12:40.148245 fcntl(6, F_GETFD) = 0
[pid 25608] 10:12:40.148263 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.148281 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25608] 10:12:40.148306 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064848, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3207, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.148343 open("/var/spool/exim/input/e/1aEJMe-0006f0-2W-H", O_RDONLY) = 8
[pid 25608] 10:12:40.148370 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.148398 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ec000
[pid 25608] 10:12:40.148419 read(8, "1aEJMe-0006f0-2W-H\nmailnull 47 12\n<>\n1451491960 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25608] 10:12:40.148476 read(8, "", 4096) = 0
[pid 25608] 10:12:40.148497 close(8)    = 0
[pid 25608] 10:12:40.148517 munmap(0x7f52599ec000, 4096) = 0
[pid 25608] 10:12:40.148544 open("/var/spool/exim/input/e/1aEJMe-0006f0-2W-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.148583 open("/var/spool/exim/msglog/e/1aEJMe-0006f0-2W", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25608] 10:12:40.148613 fcntl(8, F_GETFD) = 0
[pid 25608] 10:12:40.148631 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.148653 fchown(8, 47, 12) = 0
[pid 25608] 10:12:40.148682 fchmod(8, 0640) = 0
[pid 25608] 10:12:40.148708 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25608] 10:12:40.148730 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064870, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.148759 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ec000
[pid 25608] 10:12:40.148784 lseek(8, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.148809 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.148846 pipe([9, 10]) = 0
[pid 25608] 10:12:40.148869 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_DFL, [], SA_RESTORER, 0x7f52588a2790}, 8) = 0
[pid 25608] 10:12:40.149064 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f52599d5a90) = 25610
[pid 25608] 10:12:40.149290 close(10)   = 0
[pid 25608] 10:12:40.149312 read(9, Process 25610 attached
 <unfinished ...>
[pid 25610] 10:12:40.149349 set_robust_list(0x7f52599d5aa0, 24) = 0
[pid 25610] 10:12:40.149411 close(9)    = 0
[pid 25610] 10:12:40.149437 geteuid()   = 0
[pid 25610] 10:12:40.149455 getegid()   = 12
[pid 25610] 10:12:40.149476 setgid(494) = 0
[pid 25610] 10:12:40.149495 setuid(495) = 0
[pid 25610] 10:12:40.149536 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25610] 10:12:40.149567 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25610] 10:12:40.149632 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25610] 10:12:40.149663 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25610] 10:12:40.149685 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25610] 10:12:40.149713 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25610] 10:12:40.149739 close(9)    = 0
[pid 25610] 10:12:40.149759 munmap(0x7f52599eb000, 4096) = 0
[pid 25610] 10:12:40.150056 brk(0x24d6000) = 0x24d6000
[pid 25610] 10:12:40.150194 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25608] 10:12:40.150224 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25608] 10:12:40.150245 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150265 <... write resumed> ) = 4
[pid 25610] 10:12:40.150283 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25608] 10:12:40.150304 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25608] 10:12:40.150323 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150342 <... write resumed> ) = 4
[pid 25610] 10:12:40.150359 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25608] 10:12:40.150380 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25608] 10:12:40.150398 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150417 <... write resumed> ) = 4
[pid 25610] 10:12:40.150434 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25608] 10:12:40.150455 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25608] 10:12:40.150477 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150498 <... write resumed> ) = 4
[pid 25610] 10:12:40.150516 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25608] 10:12:40.150547 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25608] 10:12:40.150567 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150586 <... write resumed> ) = 4
[pid 25610] 10:12:40.150603 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25608] 10:12:40.150627 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25608] 10:12:40.150648 read(9,  <unfinished ...>
[pid 25610] 10:12:40.150672 <... write resumed> ) = 40
[pid 25610] 10:12:40.150695 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25608] 10:12:40.150717 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25608] 10:12:40.150738 wait4(-1,  <unfinished ...>
[pid 25610] 10:12:40.150758 <... write resumed> ) = 4
[pid 25610] 10:12:40.150785 close(10)   = 0
[pid 25610] 10:12:40.150881 exit_group(0) = ?
[pid 25610] 10:12:40.151055 +++ exited with 0 +++
[pid 25608] 10:12:40.151089 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25610
[pid 25608] 10:12:40.151113 close(9)    = 0
[pid 25608] 10:12:40.151149 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, 8) = 0
[pid 25608] 10:12:40.151205 brk(0x24d5000) = 0x24d5000
[pid 25608] 10:12:40.151248 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25608] 10:12:40.151295 alarm(60)   = 0
[pid 25608] 10:12:40.151329 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25608] 10:12:40.151365 alarm(0)    = 60
[pid 25608] 10:12:40.151440 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.151491 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25608] 10:12:40.151543 read(10, "cpu  123110 1342524 395350 67343186 2509 0 0 0\ncpu0 123110 1342524 395350 67343186 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58712665\nbtime 1450798266\nprocesses 893088\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25608] 10:12:40.151602 close(10)   = 0
[pid 25608] 10:12:40.151691 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25608] 10:12:40.151753 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25608] 10:12:40.151858 fcntl(10, F_GETFD) = 0
[pid 25608] 10:12:40.151894 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.151930 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25608] 10:12:40.151985 close(10)   = 0
[pid 25608] 10:12:40.152036 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.152080 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25608] 10:12:40.152181 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599a4000
[pid 25608] 10:12:40.152331 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25608] 10:12:40.152375 fcntl(10, F_GETFD) = 0
[pid 25608] 10:12:40.152407 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.152442 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25608] 10:12:40.152592 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25608] 10:12:40.152686 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25608] 10:12:40.152753 close(10)   = 0
[pid 25608] 10:12:40.152827 munmap(0x7f52599a4000, 200704) = 0
[pid 25608] 10:12:40.152897 close(9)    = 0
[pid 25608] 10:12:40.152953 open("/etc/localdomains", O_RDONLY) = 9
[pid 25608] 10:12:40.152999 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.153051 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.153096 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.153132 lseek(9, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.153165 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25608] 10:12:40.153231 stat("/jail_owner", 0x7fff183dc800) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.153279 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25608] 10:12:40.153375 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.153425 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25608] 10:12:40.153479 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.153601 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.153677 open("/etc/demouids", O_RDONLY) = 10
[pid 25608] 10:12:40.153718 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.153771 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.153829 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599ea000
[pid 25608] 10:12:40.153864 lseek(10, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.153897 read(10, "", 4096) = 0
[pid 25608] 10:12:40.153937 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25608] 10:12:40.154028 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.154085 open("/etc/userdomains", O_RDONLY) = 11
[pid 25608] 10:12:40.154124 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.154170 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.154214 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e9000
[pid 25608] 10:12:40.154249 lseek(11, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.154281 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25608] 10:12:40.154343 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25608] 10:12:40.154388 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.154433 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e8000
[pid 25608] 10:12:40.154470 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.154515 close(12)   = 0
[pid 25608] 10:12:40.154642 munmap(0x7f52599e8000, 4096) = 0
[pid 25608] 10:12:40.154702 stat("//etc/fin.finestweddingsites.com", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.154749 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.154815 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.154875 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.154946 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.155004 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.155058 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.155121 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.155163 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.155220 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25608] 10:12:40.155260 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.155307 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.155351 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e8000
[pid 25608] 10:12:40.155389 lseek(12, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.155421 read(12, "", 4096) = 0
[pid 25608] 10:12:40.155468 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25608] 10:12:40.155510 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25608] 10:12:40.155657 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e7000
[pid 25608] 10:12:40.155693 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25608] 10:12:40.155738 close(13)   = 0
[pid 25608] 10:12:40.155773 munmap(0x7f52599e7000, 4096) = 0
[pid 25608] 10:12:40.155833 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.155899 stat("//.spamassassinboxenable", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.155942 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.155994 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25608] 10:12:40.156058 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.156100 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.156157 stat("//etc/fin.finestweddingsites.com/passwd", 0x7fff183df5f0) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.156198 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.156250 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.156382 getuid()    = 0
[pid 25608] 10:12:40.156426 geteuid()   = 0
[pid 25608] 10:12:40.156463 getgid()    = 12
[pid 25608] 10:12:40.156497 getegid()   = 12
[pid 25608] 10:12:40.156673 open("/dev/urandom", O_RDONLY) = 13
[pid 25608] 10:12:40.156724 read(13, "\275\235\315\17", 4) = 4
[pid 25608] 10:12:40.156762 close(13)   = 0
[pid 25608] 10:12:40.156885 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25608] 10:12:40.156994 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.157046 lseek(0, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.157084 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc450) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.157119 lseek(1, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.157153 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc460) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.157187 lseek(2, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.157222 open("/dev/null", O_RDONLY) = 13
[pid 25608] 10:12:40.157264 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc530) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.157298 lseek(13, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.157332 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.157366 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, 8) = 0
[pid 25608] 10:12:40.157698 brk(0x24f7000) = 0x24f7000
[pid 25608] 10:12:40.157757 read(13, "", 8192) = 0
[pid 25608] 10:12:40.157802 close(13)   = 0
[pid 25608] 10:12:40.158102 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.158166 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25608] 10:12:40.158206 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.158244 lseek(13, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.158298 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25608] 10:12:40.159213 brk(0x2518000) = 0x2518000
[pid 25608] 10:12:40.159653 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25608] 10:12:40.160434 brk(0x2539000) = 0x2539000
[pid 25608] 10:12:40.161018 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25608] 10:12:40.161755 brk(0x255a000) = 0x255a000
[pid 25608] 10:12:40.162205 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25608] 10:12:40.162501 read(13, "", 8192) = 0
[pid 25608] 10:12:40.162606 close(13)   = 0
[pid 25608] 10:12:40.162662 stat("/usr/share/amavis/amavis-filter", 0x7f5258089880) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.162709 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.162762 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25608] 10:12:40.162817 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25608] 10:12:40.162857 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dc360) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.162893 lseek(13, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.163002 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25608] 10:12:40.163320 brk(0x257b000) = 0x257b000
[pid 25608] 10:12:40.163511 stat("/etc/exim/perl/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163626 stat("/etc/exim/perl/warnings.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163669 stat("/usr/local/cpanel/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163724 stat("/usr/local/cpanel/warnings.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163766 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163816 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163857 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163897 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163938 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.163979 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.164026 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.164067 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.164122 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25608] 10:12:40.164167 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dbd70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.164203 lseek(14, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.164255 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25608] 10:12:40.164665 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25608] 10:12:40.165250 brk(0x259c000) = 0x259c000
[pid 25608] 10:12:40.165453 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25608] 10:12:40.165928 read(14, "", 8192) = 0
[pid 25608] 10:12:40.165978 close(14)   = 0
[pid 25608] 10:12:40.166708 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25608] 10:12:40.167445 read(13, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25608] 10:12:40.168217 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25608] 10:12:40.168863 brk(0x25bd000) = 0x25bd000
[pid 25608] 10:12:40.168951 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25608] 10:12:40.169520 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25608] 10:12:40.170071 brk(0x25de000) = 0x25de000
[pid 25608] 10:12:40.170518 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25608] 10:12:40.171107 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25608] 10:12:40.171494 brk(0x25ff000) = 0x25ff000
[pid 25608] 10:12:40.171868 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25608] 10:12:40.172486 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25608] 10:12:40.172845 brk(0x2620000) = 0x2620000
[pid 25608] 10:12:40.173371 stat("/usr/local/cpanel/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173429 stat("/usr/local/cpanel/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173473 stat("/etc/exim/perl/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173511 stat("/etc/exim/perl/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173610 stat("/usr/local/cpanel/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173650 stat("/usr/local/cpanel/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173688 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173731 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173774 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173817 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173859 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173900 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173941 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.173980 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.174042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25608] 10:12:40.174086 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dbd70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.174122 lseek(14, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.174175 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25608] 10:12:40.174392 lseek(14, 878, SEEK_SET) = 878
[pid 25608] 10:12:40.174436 lseek(14, 0, SEEK_CUR) = 878
[pid 25608] 10:12:40.174690 close(14)   = 0
[pid 25608] 10:12:40.174946 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25608] 10:12:40.175447 brk(0x2641000) = 0x2641000
[pid 25608] 10:12:40.175638 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25608] 10:12:40.176763 brk(0x2662000) = 0x2662000
[pid 25608] 10:12:40.176896 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25608] 10:12:40.178039 brk(0x2683000) = 0x2683000
[pid 25608] 10:12:40.178271 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25608] 10:12:40.179210 stat("/usr/local/cpanel/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179268 stat("/usr/local/cpanel/Errno.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179310 stat("/etc/exim/perl/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179347 stat("/etc/exim/perl/Errno.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179385 stat("/usr/local/cpanel/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179423 stat("/usr/local/cpanel/Errno.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179461 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179504 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179612 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179655 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179696 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.179736 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25608] 10:12:40.179795 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25608] 10:12:40.179839 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dbd70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.179876 lseek(14, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.179929 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25608] 10:12:40.180061 brk(0x26a4000) = 0x26a4000
[pid 25608] 10:12:40.180649 lseek(14, 4868, SEEK_SET) = 4868
[pid 25608] 10:12:40.180707 lseek(14, 0, SEEK_CUR) = 4868
[pid 25608] 10:12:40.180741 close(14)   = 0
[pid 25608] 10:12:40.180791 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.180836 stat("/usr/local/cpanel/Exporter.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.180876 stat("/etc/exim/perl/Exporter.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.180912 stat("/etc/exim/perl/Exporter.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.180949 stat("/usr/local/cpanel/Exporter.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.180985 stat("/usr/local/cpanel/Exporter.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.181024 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.181065 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7fff183dbf80) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.181106 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7fff183dc020) = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.181146 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25608] 10:12:40.181201 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25608] 10:12:40.181244 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fff183dbd70) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25608] 10:12:40.181280 lseek(14, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.181333 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25608] 10:12:40.181849 lseek(14, 2366, SEEK_SET) = 2366
[pid 25608] 10:12:40.181903 lseek(14, 0, SEEK_CUR) = 2366
[pid 25608] 10:12:40.181938 close(14)   = 0
[pid 25608] 10:12:40.182248 read(13, "", 8192) = 0
[pid 25608] 10:12:40.182294 close(13)   = 0
[pid 25608] 10:12:40.182476 lseek(12, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.182578 read(12, "", 4096) = 0
[pid 25608] 10:12:40.182644 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.182716 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25608] 10:12:40.182758 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.182811 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.182855 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e7000
[pid 25608] 10:12:40.182892 lseek(13, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.182924 read(13, "", 4096) = 0
[pid 25608] 10:12:40.182962 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25608] 10:12:40.183036 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25608] 10:12:40.183077 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25608] 10:12:40.183128 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e6000
[pid 25608] 10:12:40.183163 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25608] 10:12:40.183209 close(14)   = 0
[pid 25608] 10:12:40.183243 munmap(0x7f52599e6000, 4096) = 0
[pid 25608] 10:12:40.183296 open("/etc/aliases", O_RDONLY) = 14
[pid 25608] 10:12:40.183340 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25608] 10:12:40.183388 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25608] 10:12:40.183431 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e6000
[pid 25608] 10:12:40.183466 lseek(14, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.183498 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25608] 10:12:40.183638 read(14, "", 4096) = 0
[pid 25608] 10:12:40.183685 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25608] 10:12:40.183735 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25608] 10:12:40.183783 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e5000
[pid 25608] 10:12:40.183819 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25608] 10:12:40.183870 close(15)   = 0
[pid 25608] 10:12:40.183904 munmap(0x7f52599e5000, 4096) = 0
[pid 25608] 10:12:40.183950 open("/etc/localaliases", O_RDONLY) = 15
[pid 25608] 10:12:40.183991 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25608] 10:12:40.184038 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25608] 10:12:40.184081 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599e5000
[pid 25608] 10:12:40.184115 lseek(15, 0, SEEK_SET) = 0
[pid 25608] 10:12:40.184147 read(15, "", 4096) = 0
[pid 25608] 10:12:40.184190 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.184257 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.184320 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.184379 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25608] 10:12:40.184447 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.184519 write(8, "2015-12-30 10:12:40 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25608] 10:12:40.184656 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.184715 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.184767 close(7)    = 0
[pid 25608] 10:12:40.184808 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25608] 10:12:40.184852 fcntl(7, F_GETFD) = 0
[pid 25608] 10:12:40.184884 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.184916 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10552, st_size=5398501, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.184968 write(7, "2015-12-30 10:12:40 [25608] 1aEJMe-0006f0-2W ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25608] 10:12:40.185015 close(14)   = 0
[pid 25608] 10:12:40.185049 munmap(0x7f52599e6000, 4096) = 0
[pid 25608] 10:12:40.185087 close(15)   = 0
[pid 25608] 10:12:40.185119 munmap(0x7f52599e5000, 4096) = 0
[pid 25608] 10:12:40.185153 close(10)   = 0
[pid 25608] 10:12:40.185185 munmap(0x7f52599ea000, 4096) = 0
[pid 25608] 10:12:40.185218 close(11)   = 0
[pid 25608] 10:12:40.185251 munmap(0x7f52599e9000, 4096) = 0
[pid 25608] 10:12:40.185284 close(9)    = 0
[pid 25608] 10:12:40.185317 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.185351 close(13)   = 0
[pid 25608] 10:12:40.185382 munmap(0x7f52599e7000, 4096) = 0
[pid 25608] 10:12:40.185415 close(12)   = 0
[pid 25608] 10:12:40.185447 munmap(0x7f52599e8000, 4096) = 0
[pid 25608] 10:12:40.185499 geteuid()   = 0
[pid 25608] 10:12:40.185604 getegid()   = 12
[pid 25608] 10:12:40.185641 setgid(12)  = 0
[pid 25608] 10:12:40.185674 setuid(47)  = 0
[pid 25608] 10:12:40.185715 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f52575eb6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25608] 10:12:40.185776 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25608] 10:12:40.185818 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.185879 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25608] 10:12:40.185930 close(7)    = 0
[pid 25608] 10:12:40.185966 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25608] 10:12:40.186005 fcntl(7, F_GETFD) = 0
[pid 25608] 10:12:40.186037 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25608] 10:12:40.186068 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5398611, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.186112 write(7, "2015-12-30 10:12:40 [25608] 1aEJMe-0006f0-2W Frozen (delivery error message)\n", 77) = 77
[pid 25608] 10:12:40.186153 open("/var/spool/exim/input/e/hdr.25608", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25608] 10:12:40.186232 fchown(9, 47, 12) = 0
[pid 25608] 10:12:40.186270 fchmod(9, 0640) = 0
[pid 25608] 10:12:40.186305 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25608] 10:12:40.186339 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.186385 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f52599eb000
[pid 25608] 10:12:40.186421 lseek(9, 0, SEEK_CUR) = 0
[pid 25608] 10:12:40.186485 write(9, "1aEJMe-0006f0-2W-H\nmailnull 47 12\n<>\n1451491960 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491960\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25608] 10:12:40.186606 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.186661 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMe-0006f0-2W\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:40 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25608] 10:12:40.186704 fsync(9)    = 0
[pid 25608] 10:12:40.187191 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064850, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:40, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25608] 10:12:40.187239 close(9)    = 0
[pid 25608] 10:12:40.187273 munmap(0x7f52599eb000, 4096) = 0
[pid 25608] 10:12:40.187315 rename("/var/spool/exim/input/e/hdr.25608", "/var/spool/exim/input/e/1aEJMe-0006f0-2W-H") = 0
[pid 25608] 10:12:40.187411 open("/var/spool/exim/input/e/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25608] 10:12:40.187453 fsync(9)    = 0
[pid 25608] 10:12:40.187484 close(9)    = 0
[pid 25608] 10:12:40.187517 close(8)    = 0
[pid 25608] 10:12:40.187610 munmap(0x7f52599ec000, 4096) = 0
[pid 25608] 10:12:40.187656 unlink("/var/spool/exim/input/e/1aEJMe-0006f0-2W-J") = -1 ENOENT (No such file or directory)
[pid 25608] 10:12:40.187700 close(6)    = 0
[pid 25608] 10:12:40.187868 exit_group(0) = ?
[pid 25608] 10:12:40.188414 +++ exited with 0 +++
[pid 25590] 10:12:41.323776 <... select resumed> ) = 1 (in [11], left {598, 408401})
[pid 25590] 10:12:41.323875 read(11, "\27\3\3\0\233", 5) = 5
[pid 25590] 10:12:41.323948 read(11, "\334M\266m\335\366\2\326v\202\207z\10\2\26\213p\241C\375\271H\340\253\322\255\275\0\364XYC\323\243\271\337\236\265\303\360\263&+k\257\340\333D\347vvF\270\207F\353g\t^f\300Z$\326\201\365B\254\v\333\211\227\225\214\350\337\264\277\253\312\26*\340T\7S\vA\1\304.S?\226\347\32\220F\321\1Q\340\n\237\n\362,ax\327\255)'\362QDu\225A\25W?d\255\201\376\26X}\212a\276\231\371\362b\373+\\\311\254\20\351c\0)\357C\37FH&2f8", 155) = 155
[pid 25590] 10:12:41.324060 write(9, "kgallagher@mcdowellmountaingc.com\n", 34) = 34
[pid 25590] 10:12:41.324139 fsync(9)    = 0
[pid 25590] 10:12:41.324575 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25590] 10:12:41.324670 alarm(60)   = 0
[pid 25590] 10:12:41.324733 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25590] 10:12:41.324802 alarm(0)    = 60
[pid 25590] 10:12:41.324886 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:41.324970 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25590] 10:12:41.325046 read(15, "cpu  123110 1342525 395352 67343298 2509 0 0 0\ncpu0 123110 1342525 395352 67343298 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58714833\nbtime 1450798266\nprocesses 893088\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25590] 10:12:41.325143 close(15)   = 0
[pid 25590] 10:12:41.325223 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25590] 10:12:41.325325 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25590] 10:12:41.325403 fcntl(15, F_GETFD) = 0
[pid 25590] 10:12:41.325463 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25590] 10:12:41.325520 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25590] 10:12:41.325594 close(15)   = 0
[pid 25590] 10:12:41.325664 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25590] 10:12:41.325736 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25590] 10:12:41.325849 brk(0xd3e000) = 0xd3e000
[pid 25590] 10:12:41.326038 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25590] 10:12:41.326117 fcntl(15, F_GETFD) = 0
[pid 25590] 10:12:41.326174 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25590] 10:12:41.326233 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25590] 10:12:41.326331 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25590] 10:12:41.326434 pread(15, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25590] 10:12:41.326542 close(15)   = 0
[pid 25590] 10:12:41.326628 close(14)   = 0
[pid 25590] 10:12:41.326706 write(11, "\27\3\3\0\36\312+\243\215{\253Mh\213w,\230\203\32\2\37X\2671~/\241k>i:w\35\207\310", 35) = 35
[pid 25590] 10:12:41.326817 write(11, "\25\3\3\0\32\312+\243\215{\253MiB]\v\27:\ny\230@\27\214\265\375\210\231E\375\274", 31) = 31
[pid 25590] 10:12:41.326959 close(11)   = 0
[pid 25590] 10:12:41.327079 close(13)   = 0
[pid 25590] 10:12:41.327138 munmap(0x7ff9b2d40000, 4096) = 0
[pid 25590] 10:12:41.327206 close(10)   = 0
[pid 25590] 10:12:41.327264 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25590] 10:12:41.327341 write(12, "S0000047\f\0\0", 11) = 11
[pid 25559] 10:12:41.327411 <... select resumed> ) = 1 (in [11], left {57, 391521})
[pid 25559] 10:12:41.327460 read(11, "S0000047\f\0\0", 16384) = 11
[pid 25559] 10:12:41.327534 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.327597 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.327654 write(12, "X100121TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256\0/C=US/ST=California/L=Campbell/O=Barracuda Networks, Inc./CN=*.ess.barracuda.com\0", 128) = 128
[pid 25559] 10:12:41.327708 <... select resumed> ) = 1 (in [11], left {59, 999926})
[pid 25559] 10:12:41.327748 read(11, "X100121TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256\0/C=US/ST=California/L=Campbell/O=Barracuda Networks, Inc./CN=*.ess.barracuda.com\0", 16384) = 128
[pid 25559] 10:12:41.327827 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.327887 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.328187 write(12, "X202059-----BEGIN CERTIFICATE-----\\nMIIFqTCCBJGgAwIBAgIQCRoP0clNeZPVANpWX+2BKTANBgkqhkiG9w0BAQsFADBw\\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\\nd3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz\\ndXJhbmNlIFNlcnZlciBDQT"..., 2066) = 2066
[pid 25559] 10:12:41.328249 <... select resumed> ) = 1 (in [11], left {59, 999674})
[pid 25559] 10:12:41.328292 read(11, "X202059-----BEGIN CERTIFICATE-----\\nMIIFqTCCBJGgAwIBAgIQCRoP0clNeZPVANpWX+2BKTANBgkqhkiG9w0BAQsFADBw\\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\\nd3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz\\ndXJhbmNlIFNlcnZlciBDQT"..., 16384) = 2066
[pid 25559] 10:12:41.328730 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.328800 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.328854 write(12, "X4000021\0", 9) = 9
[pid 25559] 10:12:41.328905 <... select resumed> ) = 1 (in [11], left {59, 999933})
[pid 25559] 10:12:41.328947 read(11, "X4000021\0", 16384) = 9
[pid 25559] 10:12:41.329011 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.329071 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.329122 write(12, "D000004\2\0\0\0", 11) = 11
[pid 25559] 10:12:41.329170 <... select resumed> ) = 1 (in [11], left {59, 999937})
[pid 25559] 10:12:41.329212 read(11, "D000004\2\0\0\0", 16384) = 11
[pid 25559] 10:12:41.329276 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.329335 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.329521 write(12, "A000197\0=\0\0\3\0\0\0\0\0\0\001250 OK (kgallagher@mcdowellmountaingc.com:250 2.6.0 <E1aEJMb-0006e1-MY@fin.finestweddingsites.com> [InternalId=1612474] Queue...)\0\0d61171a.ess.barracudanetworks.com\00064.235.154.105\0\31\0\0\0000", 204) = 204
[pid 25559] 10:12:41.329582 <... select resumed> ) = 1 (in [11], left {59, 999788})
[pid 25559] 10:12:41.329624 read(11, "A000197\0=\0\0\3\0\0\0\0\0\0\001250 OK (kgallagher@mcdowellmountaingc.com:250 2.6.0 <E1aEJMb-0006e1-MY@fin.finestweddingsites.com> [InternalId=1612474] Queue...)\0\0d61171a.ess.barracudanetworks.com\00064.235.154.105\0\31\0\0\0000", 16384) = 204
[pid 25559] 10:12:41.329702 wait4(-1, 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25559] 10:12:41.329763 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25590] 10:12:41.329814 write(12, "I00002050.116.78.207\00036090\0", 27) = 27
[pid 25559] 10:12:41.329865 <... select resumed> ) = 1 (in [11], left {59, 999935})
[pid 25590] 10:12:41.329913 write(12, "Z0000010", 8 <unfinished ...>
[pid 25559] 10:12:41.329929 read(11,  <unfinished ...>
[pid 25590] 10:12:41.329969 <... write resumed> ) = 8
[pid 25559] 10:12:41.329980 <... read resumed> "I00002050.116.78.207\00036090\0", 16384) = 27
[pid 25590] 10:12:41.330024 close(12 <unfinished ...>
[pid 25559] 10:12:41.330038 wait4(-1,  <unfinished ...>
[pid 25590] 10:12:41.330077 <... close resumed> ) = 0
[pid 25559] 10:12:41.330088 <... wait4 resumed> 0x7fffca4b7340, WNOHANG, NULL) = 0
[pid 25590] 10:12:41.330555 exit_group(0) = ?
[pid 25559] 10:12:41.330573 select(12, [11], NULL, NULL, {60, 0}) = 1 (in [11], left {59, 999998})
[pid 25559] 10:12:41.330655 read(11, "Z0000010", 16384) = 8
[pid 25559] 10:12:41.330721 close(11)   = 0
[pid 25559] 10:12:41.330787 wait4(25590,  <unfinished ...>
[pid 25590] 10:12:41.331849 +++ exited with 0 +++
[pid 25559] 10:12:41.331903 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25590
[pid 25559] 10:12:41.331966 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.332083 write(8, "2015-12-30 10:12:41 kgallagher@mcdowellmountaingc.com: remote_smtp transport succeeded\n", 87) = 87
[pid 25559] 10:12:41.332188 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.332297 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.332395 close(7)    = 0
[pid 25559] 10:12:41.332464 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25559] 10:12:41.332540 fcntl(7, F_GETFD) = 0
[pid 25559] 10:12:41.332597 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:41.332655 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5398902, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:40, st_ctime=2015/12/30-10:12:40}) = 0
[pid 25559] 10:12:41.332737 write(7, "2015-12-30 10:12:41 [25559] 1aEJMb-0006e1-MY => kgallagher@mcdowellmountaingc.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3127 H=d61171a.ess.barracudanetworks.com [64.23"..., 551) = 551
[pid 25559] 10:12:41.332854 geteuid()   = 0
[pid 25559] 10:12:41.332912 getegid()   = 12
[pid 25559] 10:12:41.332969 setgid(12)  = 0
[pid 25559] 10:12:41.333024 setuid(47)  = 0
[pid 25559] 10:12:41.333090 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25559] 10:12:41.333174 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.333268 pipe([10, 11]) = 0
[pid 25559] 10:12:41.333333 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:41.333507 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9b2d2ba90) = 25611
[pid 25559] 10:12:41.333925 close(10)   = 0
[pid 25559] 10:12:41.333990 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25559] 10:12:41.334058 fstat(11, {st_dev=makedev(0, 8), st_ino=2130173570, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25559] 10:12:41.334141 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:41.334201 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25559] 10:12:41.334359 fstat(6, {st_dev=makedev(144, 4215), st_ino=125080158, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:37, st_mtime=2015/12/30-10:12:37, st_ctime=2015/12/30-10:12:37}) = 0
[pid 25559] 10:12:41.334460 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1056) = 1056
[pid 25559] 10:12:41.334551 lseek(6, 19, SEEK_SET) = 19
[pid 25559] 10:12:41.334614 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25559] 10:12:41.334701 read(6, "", 8192) = 0
[pid 25559] 10:12:41.334763 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006e1-MY; Wed, 30 Dec 2015 10:12:37 -0600\nTo:  kgallagher@mcd"..., 2434) = 2434
[pid 25559] 10:12:41.334833 write(11, "\n--1451491961-eximdsn-1793859352--\n", 35) = 35
[pid 25559] 10:12:41.334892 close(11)   = 0
[pid 25559] 10:12:41.334944 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:41.335006 wait4(25611, Process 25611 attached
 <unfinished ...>
[pid 25611] 10:12:41.335082 set_robust_list(0x7ff9b2d2baa0, 24) = 0
[pid 25611] 10:12:41.335157 close(0)    = 0
[pid 25611] 10:12:41.335258 dup2(10, 0) = 0
[pid 25611] 10:12:41.335308 close(10)   = 0
[pid 25611] 10:12:41.335356 close(11)   = 0
[pid 25611] 10:12:41.335545 fstat(0, {st_dev=makedev(0, 8), st_ino=2130173570, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.335603 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25611] 10:12:41.335647 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25611] 10:12:41.335699 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMb-0006e1-MY"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25611] 10:12:41.336085 brk(0)      = 0x2493000
[pid 25611] 10:12:41.336123 fcntl(0, F_GETFD) = 0
[pid 25611] 10:12:41.336154 fcntl(1, F_GETFD) = 0
[pid 25611] 10:12:41.336183 fcntl(2, F_GETFD) = 0
[pid 25611] 10:12:41.336218 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336271 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00592000
[pid 25611] 10:12:41.336356 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336425 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336471 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336508 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336544 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336580 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336617 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336652 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336689 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25611] 10:12:41.336737 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336780 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336818 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336856 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336899 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336939 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.336977 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337016 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.337082 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337122 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337158 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337332 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337371 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337413 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffd57a87d50) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337452 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.337489 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.337539 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25611] 10:12:41.337576 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25611] 10:12:41.337619 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f9b00588000
[pid 25611] 10:12:41.337654 close(6)    = 0
[pid 25611] 10:12:41.337693 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.337732 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.337772 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.337817 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9b0015a000
[pid 25611] 10:12:41.337852 mprotect(0x7f9b00170000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.337887 mmap(0x7f9b00370000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f9b00370000
[pid 25611] 10:12:41.337936 mmap(0x7f9b00372000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9b00372000
[pid 25611] 10:12:41.337985 close(6)    = 0
[pid 25611] 10:12:41.338023 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338064 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338103 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338144 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.338182 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.338220 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.338264 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00587000
[pid 25611] 10:12:41.338302 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afff41000
[pid 25611] 10:12:41.338337 mprotect(0x7f9afff57000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.338373 mmap(0x7f9b00156000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f9b00156000
[pid 25611] 10:12:41.338534 mmap(0x7f9b00158000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9b00158000
[pid 25611] 10:12:41.338580 close(6)    = 0
[pid 25611] 10:12:41.338619 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338660 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338700 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.338743 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.338781 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.338819 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.338864 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9affd0a000
[pid 25611] 10:12:41.338898 mprotect(0x7f9affd11000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.338932 mmap(0x7f9afff11000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f9afff11000
[pid 25611] 10:12:41.338972 mmap(0x7f9afff13000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afff13000
[pid 25611] 10:12:41.339014 close(6)    = 0
[pid 25611] 10:12:41.339050 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339095 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339143 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339183 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25611] 10:12:41.339220 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.339258 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.339302 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9affa86000
[pid 25611] 10:12:41.339337 mprotect(0x7f9affb09000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.339371 mmap(0x7f9affd08000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f9affd08000
[pid 25611] 10:12:41.339419 close(6)    = 0
[pid 25611] 10:12:41.339474 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339516 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339556 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.339594 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25611] 10:12:41.339633 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.339670 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25611] 10:12:41.339714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00586000
[pid 25611] 10:12:41.339757 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9aff878000
[pid 25611] 10:12:41.339793 mprotect(0x7f9aff884000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.339831 mmap(0x7f9affa84000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f9affa84000
[pid 25611] 10:12:41.339879 close(6)    = 0
[pid 25611] 10:12:41.339918 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.339960 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.339994 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25611] 10:12:41.340024 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9aff655000
[pid 25611] 10:12:41.340045 mprotect(0x7f9aff676000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.340065 mmap(0x7f9aff876000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f9aff876000
[pid 25611] 10:12:41.340091 close(6)    = 0
[pid 25611] 10:12:41.340113 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340138 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340164 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340188 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25611] 10:12:41.340212 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.340234 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.340263 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9aff438000
[pid 25611] 10:12:41.340284 mprotect(0x7f9aff44f000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.340304 mmap(0x7f9aff64f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f9aff64f000
[pid 25611] 10:12:41.340345 mmap(0x7f9aff651000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9aff651000
[pid 25611] 10:12:41.340374 close(6)    = 0
[pid 25611] 10:12:41.340578 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340627 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.340706 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25611] 10:12:41.340743 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.340781 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.340826 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00585000
[pid 25611] 10:12:41.340870 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9aff0c4000
[pid 25611] 10:12:41.340909 mprotect(0x7f9aff233000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.340943 mmap(0x7f9aff432000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f9aff432000
[pid 25611] 10:12:41.340988 close(6)    = 0
[pid 25611] 10:12:41.341028 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341080 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341122 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341161 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25611] 10:12:41.341200 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.341241 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25611] 10:12:41.341286 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afee35000
[pid 25611] 10:12:41.341323 mprotect(0x7f9afeec0000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.341357 mmap(0x7f9aff0c0000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f9aff0c0000
[pid 25611] 10:12:41.341446 mmap(0x7f9aff0c3000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9aff0c3000
[pid 25611] 10:12:41.341492 close(6)    = 0
[pid 25611] 10:12:41.341531 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341572 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341611 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.341650 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.341688 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.341725 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25611] 10:12:41.341769 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afec2f000
[pid 25611] 10:12:41.341848 mprotect(0x7f9afec35000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.341882 mmap(0x7f9afee34000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f9afee34000
[pid 25611] 10:12:41.341931 close(6)    = 0
[pid 25611] 10:12:41.341967 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342007 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25611] 10:12:41.342047 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.342087 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.342135 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00584000
[pid 25611] 10:12:41.342178 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afe8f9000
[pid 25611] 10:12:41.342214 mprotect(0x7f9afea25000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.342247 mmap(0x7f9afec25000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f9afec25000
[pid 25611] 10:12:41.342288 mmap(0x7f9afec2e000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afec2e000
[pid 25611] 10:12:41.342329 close(6)    = 0
[pid 25611] 10:12:41.342366 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342410 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342452 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342491 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.342528 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.342566 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.342609 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afe6f5000
[pid 25611] 10:12:41.342645 mprotect(0x7f9afe6f7000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.342678 mmap(0x7f9afe8f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f9afe8f7000
[pid 25611] 10:12:41.342722 close(6)    = 0
[pid 25611] 10:12:41.342760 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342800 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342839 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.342877 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.342921 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.342958 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.343002 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afe4f2000
[pid 25611] 10:12:41.343037 mprotect(0x7f9afe4f4000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.343070 mmap(0x7f9afe6f3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f9afe6f3000
[pid 25611] 10:12:41.343114 close(6)    = 0
[pid 25611] 10:12:41.343151 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343191 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343231 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343265 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25611] 10:12:41.343290 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.343319 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.343358 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00583000
[pid 25611] 10:12:41.343385 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afe15e000
[pid 25611] 10:12:41.343570 mprotect(0x7f9afe2e8000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.343608 mmap(0x7f9afe4e8000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f9afe4e8000
[pid 25611] 10:12:41.343650 mmap(0x7f9afe4ed000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afe4ed000
[pid 25611] 10:12:41.343692 close(6)    = 0
[pid 25611] 10:12:41.343731 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343772 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343812 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.343850 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25611] 10:12:41.343890 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.343933 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25611] 10:12:41.343978 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afdef2000
[pid 25611] 10:12:41.344014 mprotect(0x7f9afdf54000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.344049 mmap(0x7f9afe153000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f9afe153000
[pid 25611] 10:12:41.344094 close(6)    = 0
[pid 25611] 10:12:41.344135 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344175 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344215 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344253 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25611] 10:12:41.344292 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.344332 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25611] 10:12:41.344382 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afdb0f000
[pid 25611] 10:12:41.344472 mprotect(0x7f9afdcc8000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.344513 mmap(0x7f9afdec7000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f9afdec7000
[pid 25611] 10:12:41.344556 mmap(0x7f9afdeee000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afdeee000
[pid 25611] 10:12:41.344597 close(6)    = 0
[pid 25611] 10:12:41.344637 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344677 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344716 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.344755 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25611] 10:12:41.344793 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.344830 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25611] 10:12:41.344879 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00582000
[pid 25611] 10:12:41.344917 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afd8e2000
[pid 25611] 10:12:41.344953 mprotect(0x7f9afd90e000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.344987 mmap(0x7f9afdb0e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f9afdb0e000
[pid 25611] 10:12:41.345027 close(6)    = 0
[pid 25611] 10:12:41.345064 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.345105 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.345143 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25611] 10:12:41.345187 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afd6dd000
[pid 25611] 10:12:41.345223 mprotect(0x7f9afd6e2000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.345257 mmap(0x7f9afd8e1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f9afd8e1000
[pid 25611] 10:12:41.345296 close(6)    = 0
[pid 25611] 10:12:41.345338 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345384 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345485 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345532 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25611] 10:12:41.345568 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.345606 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25611] 10:12:41.345651 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afd4da000
[pid 25611] 10:12:41.345687 mprotect(0x7f9afd4dc000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.345722 mmap(0x7f9afd6db000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f9afd6db000
[pid 25611] 10:12:41.345765 close(6)    = 0
[pid 25611] 10:12:41.345805 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345845 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345890 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.345929 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.345967 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.346003 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25611] 10:12:41.346047 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00581000
[pid 25611] 10:12:41.346084 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afd2b7000
[pid 25611] 10:12:41.346120 mprotect(0x7f9afd2ce000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.346153 mmap(0x7f9afd4ce000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f9afd4ce000
[pid 25611] 10:12:41.346198 close(6)    = 0
[pid 25611] 10:12:41.346251 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346291 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346330 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346369 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.346412 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.346451 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.346494 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afd073000
[pid 25611] 10:12:41.346530 mprotect(0x7f9afd0b4000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.346564 mmap(0x7f9afd2b4000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f9afd2b4000
[pid 25611] 10:12:41.346609 close(6)    = 0
[pid 25611] 10:12:41.346648 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346688 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346727 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.346766 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25611] 10:12:41.346804 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.346838 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.346868 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00580000
[pid 25611] 10:12:41.346892 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afcd8c000
[pid 25611] 10:12:41.346914 mprotect(0x7f9afce67000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.346934 mmap(0x7f9afd067000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f9afd067000
[pid 25611] 10:12:41.346965 close(6)    = 0
[pid 25611] 10:12:41.346990 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347015 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347041 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347065 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25611] 10:12:41.347089 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.347111 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.347141 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afcb88000
[pid 25611] 10:12:41.347164 mprotect(0x7f9afcb8b000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.347185 mmap(0x7f9afcd8a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f9afcd8a000
[pid 25611] 10:12:41.347215 close(6)    = 0
[pid 25611] 10:12:41.347239 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347264 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347314 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25611] 10:12:41.347338 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.347361 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.347394 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afc95c000
[pid 25611] 10:12:41.347617 mprotect(0x7f9afc985000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.347657 mmap(0x7f9afcb85000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f9afcb85000
[pid 25611] 10:12:41.347701 mmap(0x7f9afcb87000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afcb87000
[pid 25611] 10:12:41.347742 close(6)    = 0
[pid 25611] 10:12:41.347783 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347825 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.347903 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.347943 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.347980 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25611] 10:12:41.348024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0057f000
[pid 25611] 10:12:41.348061 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afc746000
[pid 25611] 10:12:41.348098 mprotect(0x7f9afc75b000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.348132 mmap(0x7f9afc95a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f9afc95a000
[pid 25611] 10:12:41.348175 close(6)    = 0
[pid 25611] 10:12:41.348223 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348302 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348345 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25611] 10:12:41.348386 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.348468 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25611] 10:12:41.348514 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afc53b000
[pid 25611] 10:12:41.348558 mprotect(0x7f9afc545000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.348593 mmap(0x7f9afc744000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f9afc744000
[pid 25611] 10:12:41.348638 close(6)    = 0
[pid 25611] 10:12:41.348701 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348744 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348784 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.348822 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.348860 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.348897 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25611] 10:12:41.348942 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afc338000
[pid 25611] 10:12:41.348979 mprotect(0x7f9afc33a000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.349014 mmap(0x7f9afc539000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f9afc539000
[pid 25611] 10:12:41.349057 close(6)    = 0
[pid 25611] 10:12:41.349095 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0057e000
[pid 25611] 10:12:41.349146 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.349186 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.349226 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.349264 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25611] 10:12:41.349300 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.349337 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25611] 10:12:41.349385 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f9afc119000
[pid 25611] 10:12:41.349503 mprotect(0x7f9afc136000, 2093056, PROT_NONE) = 0
[pid 25611] 10:12:41.349540 mmap(0x7f9afc335000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f9afc335000
[pid 25611] 10:12:41.349582 mmap(0x7f9afc337000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9afc337000
[pid 25611] 10:12:41.349629 close(6)    = 0
[pid 25611] 10:12:41.349697 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0057d000
[pid 25611] 10:12:41.349770 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0057c000
[pid 25611] 10:12:41.349813 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0057a000
[pid 25611] 10:12:41.349851 arch_prctl(ARCH_SET_FS, 0x7f9b0057a7c0) = 0
[pid 25611] 10:12:41.349925 mprotect(0x7f9afc335000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.349964 mprotect(0x7f9afc539000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350015 mprotect(0x7f9afc744000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350057 mprotect(0x7f9afc95a000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350105 mprotect(0x7f9afcb85000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350148 mprotect(0x7f9afcd8a000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350308 mprotect(0x7f9afd067000, 40960, PROT_READ) = 0
[pid 25611] 10:12:41.350488 mprotect(0x7f9afd2b4000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350542 mprotect(0x7f9afd4ce000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350580 mprotect(0x7f9afd6db000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.350840 mprotect(0x7f9afdec7000, 110592, PROT_READ) = 0
[pid 25611] 10:12:41.350954 mprotect(0x7f9afe153000, 16384, PROT_READ) = 0
[pid 25611] 10:12:41.351121 mprotect(0x7f9afe4e8000, 16384, PROT_READ) = 0
[pid 25611] 10:12:41.351165 mprotect(0x7f9afe6f3000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.351206 mprotect(0x7f9afe8f7000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.351947 mprotect(0x7f9aff64f000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352013 mprotect(0x7f9affa84000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352058 mprotect(0x7f9affd08000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352097 mprotect(0x7f9afff11000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352148 mprotect(0x7f9b00156000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352190 mprotect(0x7f9b00370000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352251 mprotect(0x7f9b00593000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.352286 munmap(0x7f9b00588000, 39387) = 0
[pid 25611] 10:12:41.352325 set_tid_address(0x7f9b0057aa90) = 25611
[pid 25611] 10:12:41.352358 set_robust_list(0x7f9b0057aaa0, 24) = 0
[pid 25611] 10:12:41.352387 futex(0x7ffd57a8864c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25611] 10:12:41.352475 futex(0x7ffd57a8864c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f9b0057a7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25611] 10:12:41.352517 rt_sigaction(SIGRTMIN, {0x7f9aff43dc60, [], SA_RESTORER|SA_SIGINFO, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.352556 rt_sigaction(SIGRT_1, {0x7f9aff43dcf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.352591 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25611] 10:12:41.352640 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25611] 10:12:41.352713 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350312, f_bavail=6350312, f_files=1000000, f_ffree=691067, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25611] 10:12:41.352810 brk(0)      = 0x2493000
[pid 25611] 10:12:41.352844 brk(0x24b4000) = 0x24b4000
[pid 25611] 10:12:41.352887 open("/proc/filesystems", O_RDONLY) = 6
[pid 25611] 10:12:41.352943 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.352991 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00591000
[pid 25611] 10:12:41.353026 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25611] 10:12:41.353115 read(6, "", 1024) = 0
[pid 25611] 10:12:41.353154 close(6)    = 0
[pid 25611] 10:12:41.353195 munmap(0x7f9b00591000, 4096) = 0
[pid 25611] 10:12:41.353288 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.353419 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.353471 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25611] 10:12:41.353549 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.353590 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25611] 10:12:41.353627 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25611] 10:12:41.353665 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.353711 umask(0)    = 0
[pid 25611] 10:12:41.353781 geteuid()   = 0
[pid 25611] 10:12:41.353815 getuid()    = 47
[pid 25611] 10:12:41.353852 getgid()    = 12
[pid 25611] 10:12:41.353936 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25611] 10:12:41.353974 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25611] 10:12:41.354007 getgroups(65536, []) = 0
[pid 25611] 10:12:41.354043 setgroups(0, []) = 0
[pid 25611] 10:12:41.354076 getegid()   = 12
[pid 25611] 10:12:41.354107 geteuid()   = 0
[pid 25611] 10:12:41.354140 geteuid()   = 0
[pid 25611] 10:12:41.354170 getegid()   = 12
[pid 25611] 10:12:41.354201 setgid(12)  = 0
[pid 25611] 10:12:41.354234 setuid(0)   = 0
[pid 25611] 10:12:41.354291 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25611] 10:12:41.354341 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25611] 10:12:41.354392 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25611] 10:12:41.354536 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00591000
[pid 25611] 10:12:41.354572 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25611] 10:12:41.354718 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25611] 10:12:41.354762 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.354809 close(7)    = 0
[pid 25611] 10:12:41.354843 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25611] 10:12:41.354876 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.354915 close(7)    = 0
[pid 25611] 10:12:41.354954 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25611] 10:12:41.354995 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25611] 10:12:41.355040 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.355082 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25611] 10:12:41.355145 read(7, "", 4096) = 0
[pid 25611] 10:12:41.355179 close(7)    = 0
[pid 25611] 10:12:41.355210 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.355259 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.355301 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.355342 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.355380 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25611] 10:12:41.355420 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25611] 10:12:41.355466 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f9b00570000
[pid 25611] 10:12:41.355501 close(7)    = 0
[pid 25611] 10:12:41.355541 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25611] 10:12:41.355580 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25611] 10:12:41.355618 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25611] 10:12:41.355669 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f9afbf0b000
[pid 25611] 10:12:41.355722 mprotect(0x7f9afbf17000, 2097152, PROT_NONE) = 0
[pid 25611] 10:12:41.355758 mmap(0x7f9afc117000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f9afc117000
[pid 25611] 10:12:41.355807 close(7)    = 0
[pid 25611] 10:12:41.355858 mprotect(0x7f9afc117000, 4096, PROT_READ) = 0
[pid 25611] 10:12:41.355898 munmap(0x7f9b00570000, 39387) = 0
[pid 25611] 10:12:41.355942 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25611] 10:12:41.355985 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25611] 10:12:41.356020 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.356063 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.356097 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.356154 close(7)    = 0
[pid 25611] 10:12:41.356187 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.356241 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25611] 10:12:41.356279 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.356322 close(7)    = 0
[pid 25611] 10:12:41.356355 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25611] 10:12:41.356388 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.356562 close(7)    = 0
[pid 25611] 10:12:41.356603 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25611] 10:12:41.356645 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25611] 10:12:41.356688 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.356723 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25611] 10:12:41.356775 close(7)    = 0
[pid 25611] 10:12:41.356808 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.356865 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25611] 10:12:41.356938 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25611] 10:12:41.356978 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.357021 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.357054 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.357095 close(7)    = 0
[pid 25611] 10:12:41.357126 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.357167 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25611] 10:12:41.357220 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25611] 10:12:41.357280 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, 8) = 0
[pid 25611] 10:12:41.357329 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f9b0057aa90) = 25612
[pid 25611] 10:12:41.357701 wait4(25612, Process 25612 attached
 <unfinished ...>
[pid 25612] 10:12:41.357757 set_robust_list(0x7f9b0057aaa0, 24) = 0
[pid 25612] 10:12:41.357812 geteuid()   = 0
[pid 25612] 10:12:41.357848 geteuid()   = 0
[pid 25612] 10:12:41.357879 getegid()   = 12
[pid 25612] 10:12:41.357912 setgid(12)  = 0
[pid 25612] 10:12:41.357943 setuid(47)  = 0
[pid 25612] 10:12:41.359565 brk(0x24d5000) = 0x24d5000
[pid 25612] 10:12:41.359992 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25612] 10:12:41.360050 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25612] 10:12:41.360104 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25612] 10:12:41.360151 read(7, "\31\342|\307\364\331\352\243{0\212@E>`L\250/Q9\5\376\301\335\374\305=\260(\353\225\301w-2\341u(\213\323\337\261`R#L\347\274", 48) = 48
[pid 25612] 10:12:41.360207 close(7)    = 0
[pid 25612] 10:12:41.360261 getuid()    = 47
[pid 25612] 10:12:41.360436 exit_group(0) = ?
[pid 25612] 10:12:41.360621 +++ exited with 0 +++
[pid 25611] 10:12:41.360663 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25612
[pid 25611] 10:12:41.360689 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, 8) = 0
[pid 25611] 10:12:41.360753 getcwd("/var/spool/exim", 16380) = 16
[pid 25611] 10:12:41.360826 open("/etc/localtime", O_RDONLY) = 7
[pid 25611] 10:12:41.360867 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.360914 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.360956 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.360991 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25611] 10:12:41.361038 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25611] 10:12:41.361070 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25611] 10:12:41.361117 close(7)    = 0
[pid 25611] 10:12:41.361149 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.361201 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25611] 10:12:41.361248 fcntl(7, F_GETFD) = 0
[pid 25611] 10:12:41.361280 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25611] 10:12:41.361310 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5399453, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.361358 write(7, "2015-12-30 10:12:41 [25611] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMb-0006e1-MY\n", 108) = 108
[pid 25611] 10:12:41.361404 chdir("/var/spool/exim") = 0
[pid 25611] 10:12:41.361460 geteuid()   = 0
[pid 25611] 10:12:41.361492 getegid()   = 12
[pid 25611] 10:12:41.361532 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.361574 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.361623 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.361663 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.361710 close(8)    = 0
[pid 25611] 10:12:41.361743 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.361782 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25611] 10:12:41.361824 read(8, "65536\n", 31) = 6
[pid 25611] 10:12:41.361858 close(8)    = 0
[pid 25611] 10:12:41.361894 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.361933 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25611] 10:12:41.361976 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.362009 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.362042 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25611] 10:12:41.362091 read(8, "", 4096) = 0
[pid 25611] 10:12:41.362126 close(8)    = 0
[pid 25611] 10:12:41.362157 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.362194 setgroups(1, [12]) = 0
[pid 25611] 10:12:41.362229 setgid(12)  = 0
[pid 25611] 10:12:41.362260 setuid(47)  = 0
[pid 25611] 10:12:41.362318 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25611] 10:12:41.362400 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25611] 10:12:41.362486 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25611] 10:12:41.362558 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25611] 10:12:41.362632 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25611] 10:12:41.362875 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25611] 10:12:41.362995 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25611] 10:12:41.363070 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.363112 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.363158 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.363193 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.363238 close(8)    = 0
[pid 25611] 10:12:41.363270 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.363366 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25611] 10:12:41.363462 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25611] 10:12:41.363582 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25611] 10:12:41.363777 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25611] 10:12:41.363895 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25611] 10:12:41.363958 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.364000 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.364045 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.364081 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.364129 close(8)    = 0
[pid 25611] 10:12:41.364162 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.364207 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.364246 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25611] 10:12:41.364289 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.364323 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25611] 10:12:41.364376 close(8)    = 0
[pid 25611] 10:12:41.364416 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.364481 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.364528 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25611] 10:12:41.364573 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.364607 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25611] 10:12:41.364728 close(8)    = 0
[pid 25611] 10:12:41.364767 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.364871 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25611] 10:12:41.364998 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25611] 10:12:41.365104 read(6, "", 4096) = 0
[pid 25611] 10:12:41.365142 read(6, "", 4096) = 0
[pid 25611] 10:12:41.365177 close(6)    = 0
[pid 25611] 10:12:41.365209 munmap(0x7f9b00591000, 4096) = 0
[pid 25611] 10:12:41.365248 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25611] 10:12:41.365287 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.365332 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00591000
[pid 25611] 10:12:41.365366 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.365413 close(6)    = 0
[pid 25611] 10:12:41.365448 munmap(0x7f9b00591000, 4096) = 0
[pid 25611] 10:12:41.365491 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25611] 10:12:41.365550 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.365601 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25611] 10:12:41.365640 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25611] 10:12:41.365755 fstat(0, {st_dev=makedev(0, 8), st_ino=2130173570, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.365802 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00591000
[pid 25611] 10:12:41.365836 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3525
[pid 25611] 10:12:41.365927 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.365994 open("/var/spool/exim/input/f/1aEJMf-0006f5-Bn-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25611] 10:12:41.366074 fchown(6, 47, 12) = 0
[pid 25611] 10:12:41.366113 fchmod(6, 0640) = 0
[pid 25611] 10:12:41.366149 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25611] 10:12:41.366182 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.366228 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b00590000
[pid 25611] 10:12:41.366261 lseek(6, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.366292 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25611] 10:12:41.366423 read(0, "", 4096) = 0
[pid 25611] 10:12:41.366460 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.366498 write(6, "1aEJMf-0006f5-Bn-D\n--1451491961-eximdsn-1793859352\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3170) = 3170
[pid 25611] 10:12:41.366549 fsync(6)    = 0
[pid 25611] 10:12:41.367096 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.367188 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3170, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.367333 brk(0x24d5000) = 0x24d5000
[pid 25611] 10:12:41.367400 getuid()    = 47
[pid 25611] 10:12:41.367438 geteuid()   = 47
[pid 25611] 10:12:41.367472 getgid()    = 12
[pid 25611] 10:12:41.367504 getegid()   = 12
[pid 25611] 10:12:41.367609 open("/dev/urandom", O_RDONLY) = 8
[pid 25611] 10:12:41.367708 read(8, "\211]\33\1", 4) = 4
[pid 25611] 10:12:41.367752 close(8)    = 0
[pid 25611] 10:12:41.367881 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25611] 10:12:41.367996 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a438e0) = -1 EINVAL (Invalid argument)
[pid 25611] 10:12:41.368047 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25611] 10:12:41.368084 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a438e0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.368117 lseek(1, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.368150 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a438f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.368184 lseek(2, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.368218 open("/dev/null", O_RDONLY) = 8
[pid 25611] 10:12:41.368258 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a439c0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.368291 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.368323 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25611] 10:12:41.368357 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f9aff447790}, 8) = 0
[pid 25611] 10:12:41.368398 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f9aff447790}, 8) = 0
[pid 25611] 10:12:41.368794 read(8, "", 8192) = 0
[pid 25611] 10:12:41.368845 close(8)    = 0
[pid 25611] 10:12:41.369084 brk(0x24f6000) = 0x24f6000
[pid 25611] 10:12:41.369238 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25611] 10:12:41.369299 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25611] 10:12:41.369339 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a437f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.369374 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.369429 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25611] 10:12:41.370500 brk(0x2517000) = 0x2517000
[pid 25611] 10:12:41.370744 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25611] 10:12:41.371834 brk(0x2538000) = 0x2538000
[pid 25611] 10:12:41.372304 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25611] 10:12:41.373535 brk(0x2559000) = 0x2559000
[pid 25611] 10:12:41.373814 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25611] 10:12:41.374109 read(8, "", 8192) = 0
[pid 25611] 10:12:41.374155 close(8)    = 0
[pid 25611] 10:12:41.374209 stat("/usr/share/amavis/amavis-filter", 0x7f9afec2e880) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.374257 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25611] 10:12:41.374309 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25611] 10:12:41.374357 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25611] 10:12:41.374396 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a437f0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.374437 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.374490 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25611] 10:12:41.375007 stat("/etc/exim/perl/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375060 stat("/etc/exim/perl/warnings.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375100 stat("/usr/local/cpanel/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375144 stat("/usr/local/cpanel/warnings.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375184 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375228 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375269 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375307 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375347 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375387 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375432 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.375473 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.375527 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25611] 10:12:41.375568 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a43200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.375603 lseek(9, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.375645 brk(0x257a000) = 0x257a000
[pid 25611] 10:12:41.375767 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25611] 10:12:41.376085 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25611] 10:12:41.376920 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25611] 10:12:41.377106 brk(0x259b000) = 0x259b000
[pid 25611] 10:12:41.377611 read(9, "", 8192) = 0
[pid 25611] 10:12:41.377717 close(9)    = 0
[pid 25611] 10:12:41.378413 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25611] 10:12:41.379206 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25611] 10:12:41.379987 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25611] 10:12:41.380602 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25611] 10:12:41.380876 brk(0x25bc000) = 0x25bc000
[pid 25611] 10:12:41.381325 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25611] 10:12:41.382179 brk(0x25dd000) = 0x25dd000
[pid 25611] 10:12:41.382357 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25611] 10:12:41.382968 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25611] 10:12:41.383462 brk(0x25fe000) = 0x25fe000
[pid 25611] 10:12:41.383624 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25611] 10:12:41.384324 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25611] 10:12:41.384860 brk(0x261f000) = 0x261f000
[pid 25611] 10:12:41.385207 stat("/usr/local/cpanel/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385262 stat("/usr/local/cpanel/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385303 stat("/etc/exim/perl/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385340 stat("/etc/exim/perl/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385377 stat("/usr/local/cpanel/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385416 stat("/usr/local/cpanel/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385456 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385500 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385541 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385580 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385621 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385734 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385780 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.385826 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.385882 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25611] 10:12:41.385926 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a43200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.385962 lseek(9, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.386015 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25611] 10:12:41.386236 lseek(9, 878, SEEK_SET) = 878
[pid 25611] 10:12:41.386277 lseek(9, 0, SEEK_CUR) = 878
[pid 25611] 10:12:41.386308 close(9)    = 0
[pid 25611] 10:12:41.386573 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25611] 10:12:41.387219 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25611] 10:12:41.387375 brk(0x2640000) = 0x2640000
[pid 25611] 10:12:41.388459 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25611] 10:12:41.388708 brk(0x2661000) = 0x2661000
[pid 25611] 10:12:41.389851 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25611] 10:12:41.389986 brk(0x2682000) = 0x2682000
[pid 25611] 10:12:41.390834 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.390891 stat("/usr/local/cpanel/Errno.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.390933 stat("/etc/exim/perl/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.390970 stat("/etc/exim/perl/Errno.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391006 stat("/usr/local/cpanel/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391041 stat("/usr/local/cpanel/Errno.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391078 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391120 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391161 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391199 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391245 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.391286 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25611] 10:12:41.391344 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25611] 10:12:41.391387 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a43200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.391428 lseek(9, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.391490 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25611] 10:12:41.391773 brk(0x26a3000) = 0x26a3000
[pid 25611] 10:12:41.392214 lseek(9, 4868, SEEK_SET) = 4868
[pid 25611] 10:12:41.392259 lseek(9, 0, SEEK_CUR) = 4868
[pid 25611] 10:12:41.392291 close(9)    = 0
[pid 25611] 10:12:41.392338 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392380 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392424 stat("/etc/exim/perl/Exporter.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392462 stat("/etc/exim/perl/Exporter.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392497 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392535 stat("/usr/local/cpanel/Exporter.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392577 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392626 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffd57a43410) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392728 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffd57a434b0) = -1 ENOENT (No such file or directory)
[pid 25611] 10:12:41.392770 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25611] 10:12:41.392824 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25611] 10:12:41.392868 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffd57a43200) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25611] 10:12:41.392903 lseek(9, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.392949 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25611] 10:12:41.393379 lseek(9, 2366, SEEK_SET) = 2366
[pid 25611] 10:12:41.393428 lseek(9, 0, SEEK_CUR) = 2366
[pid 25611] 10:12:41.393461 close(9)    = 0
[pid 25611] 10:12:41.393854 read(8, "", 8192) = 0
[pid 25611] 10:12:41.393900 close(8)    = 0
[pid 25611] 10:12:41.394128 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25611] 10:12:41.394179 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25611] 10:12:41.394233 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0058f000
[pid 25611] 10:12:41.394271 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25611] 10:12:41.394319 close(8)    = 0
[pid 25611] 10:12:41.394355 munmap(0x7f9b0058f000, 4096) = 0
[pid 25611] 10:12:41.394443 lseek(6, 19, SEEK_SET) = 19
[pid 25611] 10:12:41.394482 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394519 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394553 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394586 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394618 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394718 alarm(300)  = 0
[pid 25611] 10:12:41.394765 alarm(0)    = 300
[pid 25611] 10:12:41.394797 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394833 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394866 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394898 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394931 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f9aff447790}, NULL, 8) = 0
[pid 25611] 10:12:41.394966 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, 8) = 0
[pid 25611] 10:12:41.395003 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, 8) = 0
[pid 25611] 10:12:41.395044 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.395105 open("/var/spool/exim/input/f/hdr.25611", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25611] 10:12:41.395180 fchown(8, 47, 12) = 0
[pid 25611] 10:12:41.395217 fchmod(8, 0640) = 0
[pid 25611] 10:12:41.395250 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25611] 10:12:41.395286 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.395333 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0058f000
[pid 25611] 10:12:41.395369 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.395420 write(8, "1aEJMf-0006f5-Bn-H\nmailnull 47 12\n<>\n1451491961 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25611] 10:12:41.395468 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.395518 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMf-0006f5-Bn\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:41 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25611] 10:12:41.395559 fsync(8)    = 0
[pid 25611] 10:12:41.396082 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.396138 close(8)    = 0
[pid 25611] 10:12:41.396172 munmap(0x7f9b0058f000, 4096) = 0
[pid 25611] 10:12:41.396214 rename("/var/spool/exim/input/f/hdr.25611", "/var/spool/exim/input/f/1aEJMf-0006f5-Bn-H") = 0
[pid 25611] 10:12:41.396278 open("/var/spool/exim/input/f/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25611] 10:12:41.396318 fsync(8)    = 0
[pid 25611] 10:12:41.396351 close(8)    = 0
[pid 25611] 10:12:41.396384 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3170, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.396450 open("/var/spool/exim/msglog/f/1aEJMf-0006f5-Bn", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25611] 10:12:41.396524 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25611] 10:12:41.396559 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.396603 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b0058f000
[pid 25611] 10:12:41.396639 lseek(8, 0, SEEK_CUR) = 0
[pid 25611] 10:12:41.396746 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.396805 write(8, "2015-12-30 10:12:41 Received from <> R=1aEJMb-0006e1-MY U=mailnull P=local S=3794 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25611] 10:12:41.396849 close(8)    = 0
[pid 25611] 10:12:41.396881 munmap(0x7f9b0058f000, 4096) = 0
[pid 25611] 10:12:41.396920 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.396975 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25611] 10:12:41.397023 close(7)    = 0
[pid 25611] 10:12:41.397058 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25611] 10:12:41.397100 fcntl(7, F_GETFD) = 0
[pid 25611] 10:12:41.397131 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25611] 10:12:41.397161 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5399561, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25611] 10:12:41.397205 write(7, "2015-12-30 10:12:41 [25611] 1aEJMf-0006f5-Bn <= <> R=1aEJMb-0006e1-MY U=mailnull P=local S=3794 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25611] 10:12:41.397246 close(6)    = 0
[pid 25611] 10:12:41.397279 munmap(0x7f9b00590000, 4096) = 0
[pid 25611] 10:12:41.397314 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, 8) = 0
[pid 25611] 10:12:41.397355 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f9afe1906a0}, 8) = 0
[pid 25611] 10:12:41.397400 open("/proc/loadavg", O_RDONLY) = 6
[pid 25611] 10:12:41.397468 read(6, "0.41 0.13 0.03 1/245 25612\n", 40) = 27
[pid 25611] 10:12:41.397527 close(6)    = 0
[pid 25611] 10:12:41.397577 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f9b0057aa90) = 25613
[pid 25611] 10:12:41.398204 exit_group(0) = ?
[pid 25611] 10:12:41.398501 +++ exited with 0 +++
[pid 25559] 10:12:41.398536 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25611
[pid 25559] 10:12:41.398563 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7ff9b09416a0}, 8) = 0
[pid 25559] 10:12:41.398618 write(8, "2015-12-30 10:12:41 mcdowell-mountain@finestweddingsites.com: children all complete\n", 84) = 84
[pid 25559] 10:12:41.398721 open("/var/spool/exim/input/b/hdr.25559", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25559] 10:12:41.398791 fchown(10, 47, 12) = 0
[pid 25559] 10:12:41.398828 fchmod(10, 0640) = 0
[pid 25559] 10:12:41.398861 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25559] 10:12:41.398897 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25559] 10:12:41.398945 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff9b2d41000
[pid 25559] 10:12:41.398980 lseek(10, 0, SEEK_CUR) = 0
[pid 25559] 10:12:41.399026 write(10, "1aEJMb-0006e1-MY-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491957 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 742) = 742
[pid 25559] 10:12:41.399072 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=742, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25559] 10:12:41.399122 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMb-0006e1-MY; Wed, 30 Dec 2015 10:12:37 -0600\n081T To:  kgallagher@mcdowellmountaingc.com, mcdowell-mountain@fi"..., 564) = 564
[pid 25559] 10:12:41.399370 fsync(10Process 25613 attached
 <unfinished ...>
[pid 25613] 10:12:41.399470 set_robust_list(0x7f9b0057aaa0, 24) = 0
[pid 25613] 10:12:41.399601 close(0)    = 0
[pid 25613] 10:12:41.399638 close(1)    = 0
[pid 25613] 10:12:41.399737 close(2)    = 0
[pid 25559] 10:12:41.399770 <... fsync resumed> ) = 0
[pid 25559] 10:12:41.399782 fstat(10, {st_dev=makedev(144, 4215), st_ino=125080170, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1306, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25559] 10:12:41.399824 close(10)   = 0
[pid 25559] 10:12:41.399857 munmap(0x7ff9b2d41000, 4096) = 0
[pid 25559] 10:12:41.399900 rename("/var/spool/exim/input/b/hdr.25559", "/var/spool/exim/input/b/1aEJMb-0006e1-MY-H") = 0
[pid 25559] 10:12:41.399988 open("/var/spool/exim/input/b/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25559] 10:12:41.400028 fsync(10)   = 0
[pid 25559] 10:12:41.400060 close(10)   = 0
[pid 25559] 10:12:41.400097 unlink("/var/spool/exim/msglog/b/1aEJMb-0006e1-MY") = 0
[pid 25559] 10:12:41.400147 unlink("/var/spool/exim/input/b/1aEJMb-0006e1-MY-D") = 0
[pid 25559] 10:12:41.400193 unlink("/var/spool/exim/input/b/1aEJMb-0006e1-MY-H") = 0
[pid 25559] 10:12:41.400259 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.400325 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25559] 10:12:41.400379 close(7)    = 0
[pid 25559] 10:12:41.400419 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25559] 10:12:41.400459 fcntl(7, F_GETFD) = 0
[pid 25559] 10:12:41.400490 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25559] 10:12:41.400522 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5399765, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25559] 10:12:41.400565 write(7, "2015-12-30 10:12:41 [25559] 1aEJMb-0006e1-MY Completed QT=4s\n", 61) = 61
[pid 25559] 10:12:41.400605 close(8)    = 0
[pid 25559] 10:12:41.400718 munmap(0x7ff9b2d42000, 4096) = 0
[pid 25559] 10:12:41.400761 close(9)    = 0
[pid 25559] 10:12:41.400797 unlink("/var/spool/exim/input/b/1aEJMb-0006e1-MY-J") = 0
[pid 25559] 10:12:41.400866 close(6)    = 0
[pid 25559] 10:12:41.401062 exit_group(0) = ?
[pid 25559] 10:12:41.401769 +++ exited with 0 +++
[pid 25613] 10:12:41.401891 setsid()    = 25613
[pid 25613] 10:12:41.401933 fstat(0, 0x7ffd57a47d30) = -1 EBADF (Bad file descriptor)
[pid 25613] 10:12:41.401971 open("/dev/null", O_RDWR) = 0
[pid 25613] 10:12:41.402015 fstat(1, 0x7ffd57a47d30) = -1 EBADF (Bad file descriptor)
[pid 25613] 10:12:41.402054 dup2(0, 1)  = 1
[pid 25613] 10:12:41.402085 fstat(2, 0x7ffd57a47d30) = -1 EBADF (Bad file descriptor)
[pid 25613] 10:12:41.402116 dup2(0, 2)  = 2
[pid 25613] 10:12:41.402146 geteuid()   = 47
[pid 25613] 10:12:41.402182 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25613] 10:12:41.402229 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25613] 10:12:41.402271 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25613] 10:12:41.402318 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMf-0006f5-Bn"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25613] 10:12:41.403043 brk(0)      = 0xa69000
[pid 25613] 10:12:41.403082 fcntl(0, F_GETFD) = 0
[pid 25613] 10:12:41.403113 fcntl(1, F_GETFD) = 0
[pid 25613] 10:12:41.403142 fcntl(2, F_GETFD) = 0
[pid 25613] 10:12:41.403175 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403230 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde99000
[pid 25613] 10:12:41.403283 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403333 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403376 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403416 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403452 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403487 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403523 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403558 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403594 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25613] 10:12:41.403641 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403752 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403792 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403830 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403905 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403942 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.403980 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.404035 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404073 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404108 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404144 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404217 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffe3010ff30) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404252 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.404290 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.404338 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25613] 10:12:41.404375 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25613] 10:12:41.404422 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f74bde8f000
[pid 25613] 10:12:41.404458 close(6)    = 0
[pid 25613] 10:12:41.404496 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.404535 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.404588 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.404767 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bda61000
[pid 25613] 10:12:41.404808 mprotect(0x7f74bda77000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.404860 mmap(0x7f74bdc77000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f74bdc77000
[pid 25613] 10:12:41.404931 mmap(0x7f74bdc79000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bdc79000
[pid 25613] 10:12:41.404999 close(6)    = 0
[pid 25613] 10:12:41.405056 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.405118 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.405180 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.405246 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.405309 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.405379 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.405449 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde8e000
[pid 25613] 10:12:41.405508 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bd848000
[pid 25613] 10:12:41.405568 mprotect(0x7f74bd85e000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.405622 mmap(0x7f74bda5d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f74bda5d000
[pid 25613] 10:12:41.405787 mmap(0x7f74bda5f000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bda5f000
[pid 25613] 10:12:41.405856 close(6)    = 0
[pid 25613] 10:12:41.405917 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.405982 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.406049 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.406116 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.406181 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.406245 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.406327 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bd611000
[pid 25613] 10:12:41.406387 mprotect(0x7f74bd618000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.406440 mmap(0x7f74bd818000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f74bd818000
[pid 25613] 10:12:41.406507 mmap(0x7f74bd81a000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bd81a000
[pid 25613] 10:12:41.406576 close(6)    = 0
[pid 25613] 10:12:41.406637 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.406797 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.406867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.406937 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25613] 10:12:41.407002 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.407076 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.407155 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bd38d000
[pid 25613] 10:12:41.407215 mprotect(0x7f74bd410000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.407272 mmap(0x7f74bd60f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f74bd60f000
[pid 25613] 10:12:41.407346 close(6)    = 0
[pid 25613] 10:12:41.407410 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.407478 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.407548 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.407613 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25613] 10:12:41.407780 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.407848 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25613] 10:12:41.407924 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde8d000
[pid 25613] 10:12:41.407987 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bd17f000
[pid 25613] 10:12:41.408044 mprotect(0x7f74bd18b000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.408104 mmap(0x7f74bd38b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f74bd38b000
[pid 25613] 10:12:41.408175 close(6)    = 0
[pid 25613] 10:12:41.408241 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.408307 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.408377 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25613] 10:12:41.408454 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bcf5c000
[pid 25613] 10:12:41.408514 mprotect(0x7f74bcf7d000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.408571 mmap(0x7f74bd17d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f74bd17d000
[pid 25613] 10:12:41.408640 close(6)    = 0
[pid 25613] 10:12:41.408794 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.408870 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.408936 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.409003 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25613] 10:12:41.409065 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.409130 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.409207 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bcd3f000
[pid 25613] 10:12:41.409267 mprotect(0x7f74bcd56000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.409324 mmap(0x7f74bcf56000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f74bcf56000
[pid 25613] 10:12:41.409393 mmap(0x7f74bcf58000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bcf58000
[pid 25613] 10:12:41.409466 close(6)    = 0
[pid 25613] 10:12:41.409528 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.409595 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.409754 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.409831 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25613] 10:12:41.409890 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.409956 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.410031 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde8c000
[pid 25613] 10:12:41.410094 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bc9cb000
[pid 25613] 10:12:41.410151 mprotect(0x7f74bcb3a000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.410211 mmap(0x7f74bcd39000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f74bcd39000
[pid 25613] 10:12:41.410282 close(6)    = 0
[pid 25613] 10:12:41.410346 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.410409 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.410489 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.410556 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25613] 10:12:41.410630 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.410793 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25613] 10:12:41.410872 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bc73c000
[pid 25613] 10:12:41.410929 mprotect(0x7f74bc7c7000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.410988 mmap(0x7f74bc9c7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f74bc9c7000
[pid 25613] 10:12:41.411056 mmap(0x7f74bc9ca000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bc9ca000
[pid 25613] 10:12:41.411122 close(6)    = 0
[pid 25613] 10:12:41.411186 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.411249 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.411311 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.411374 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.411439 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.411501 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25613] 10:12:41.411572 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bc536000
[pid 25613] 10:12:41.411628 mprotect(0x7f74bc53c000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.411786 mmap(0x7f74bc73b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f74bc73b000
[pid 25613] 10:12:41.411854 close(6)    = 0
[pid 25613] 10:12:41.411913 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.411972 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25613] 10:12:41.412031 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.412096 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.412165 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde8b000
[pid 25613] 10:12:41.412225 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bc200000
[pid 25613] 10:12:41.412284 mprotect(0x7f74bc32c000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.412343 mmap(0x7f74bc52c000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f74bc52c000
[pid 25613] 10:12:41.412403 mmap(0x7f74bc535000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bc535000
[pid 25613] 10:12:41.412465 close(6)    = 0
[pid 25613] 10:12:41.412522 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.412581 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.412640 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.412909 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.412969 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.413028 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.413097 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bbffc000
[pid 25613] 10:12:41.413152 mprotect(0x7f74bbffe000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.413203 mmap(0x7f74bc1fe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f74bc1fe000
[pid 25613] 10:12:41.413271 close(6)    = 0
[pid 25613] 10:12:41.413331 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.413398 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.413456 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.413516 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.413572 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.413627 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.413790 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bbdf9000
[pid 25613] 10:12:41.413847 mprotect(0x7f74bbdfb000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.413900 mmap(0x7f74bbffa000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f74bbffa000
[pid 25613] 10:12:41.413968 close(6)    = 0
[pid 25613] 10:12:41.414031 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.414091 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.414151 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.414212 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25613] 10:12:41.414273 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.414333 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.414400 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde8a000
[pid 25613] 10:12:41.414457 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bba65000
[pid 25613] 10:12:41.414509 mprotect(0x7f74bbbef000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.414561 mmap(0x7f74bbdef000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f74bbdef000
[pid 25613] 10:12:41.414621 mmap(0x7f74bbdf4000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bbdf4000
[pid 25613] 10:12:41.414806 close(6)    = 0
[pid 25613] 10:12:41.414866 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.414927 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.414986 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.415043 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25613] 10:12:41.415100 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.415158 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25613] 10:12:41.415227 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bb7f9000
[pid 25613] 10:12:41.415281 mprotect(0x7f74bb85b000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.415343 mmap(0x7f74bba5a000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f74bba5a000
[pid 25613] 10:12:41.415412 close(6)    = 0
[pid 25613] 10:12:41.415477 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.415538 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.415599 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.415749 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25613] 10:12:41.415818 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.415887 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25613] 10:12:41.415968 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bb416000
[pid 25613] 10:12:41.416030 mprotect(0x7f74bb5cf000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.416161 mmap(0x7f74bb7ce000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f74bb7ce000
[pid 25613] 10:12:41.416230 mmap(0x7f74bb7f5000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74bb7f5000
[pid 25613] 10:12:41.416297 close(6)    = 0
[pid 25613] 10:12:41.416360 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.416430 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.416491 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.416550 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25613] 10:12:41.416613 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.416750 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25613] 10:12:41.416830 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde89000
[pid 25613] 10:12:41.416892 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bb1e9000
[pid 25613] 10:12:41.416954 mprotect(0x7f74bb215000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.417010 mmap(0x7f74bb415000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f74bb415000
[pid 25613] 10:12:41.417075 close(6)    = 0
[pid 25613] 10:12:41.417135 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.417208 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.417275 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25613] 10:12:41.417352 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bafe4000
[pid 25613] 10:12:41.417419 mprotect(0x7f74bafe9000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.417478 mmap(0x7f74bb1e8000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f74bb1e8000
[pid 25613] 10:12:41.417544 close(6)    = 0
[pid 25613] 10:12:41.417609 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.417777 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.417847 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.417915 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25613] 10:12:41.417978 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.418044 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25613] 10:12:41.418121 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74bade1000
[pid 25613] 10:12:41.418184 mprotect(0x7f74bade3000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.418245 mmap(0x7f74bafe2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f74bafe2000
[pid 25613] 10:12:41.418315 close(6)    = 0
[pid 25613] 10:12:41.418382 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.418442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.418497 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.418559 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.418621 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.418777 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25613] 10:12:41.418849 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde88000
[pid 25613] 10:12:41.418907 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74babbe000
[pid 25613] 10:12:41.418963 mprotect(0x7f74babd5000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.419018 mmap(0x7f74badd5000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f74badd5000
[pid 25613] 10:12:41.419081 close(6)    = 0
[pid 25613] 10:12:41.419158 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.419222 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.419285 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.419351 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.419414 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.419484 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.419559 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74ba97a000
[pid 25613] 10:12:41.419618 mprotect(0x7f74ba9bb000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.419777 mmap(0x7f74babbb000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f74babbb000
[pid 25613] 10:12:41.419844 close(6)    = 0
[pid 25613] 10:12:41.419902 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.419960 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.420019 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.420076 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25613] 10:12:41.420130 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.420186 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.420252 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde87000
[pid 25613] 10:12:41.420314 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74ba693000
[pid 25613] 10:12:41.420370 mprotect(0x7f74ba76e000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.420428 mmap(0x7f74ba96e000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f74ba96e000
[pid 25613] 10:12:41.420499 close(6)    = 0
[pid 25613] 10:12:41.420556 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.420618 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.420783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.420853 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25613] 10:12:41.420919 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.420983 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.421063 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74ba48f000
[pid 25613] 10:12:41.421127 mprotect(0x7f74ba492000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.421185 mmap(0x7f74ba691000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f74ba691000
[pid 25613] 10:12:41.421259 close(6)    = 0
[pid 25613] 10:12:41.421322 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.421394 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.421467 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.421533 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25613] 10:12:41.421601 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.421758 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.421841 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74ba263000
[pid 25613] 10:12:41.421905 mprotect(0x7f74ba28c000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.421965 mmap(0x7f74ba48c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f74ba48c000
[pid 25613] 10:12:41.422034 mmap(0x7f74ba48e000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74ba48e000
[pid 25613] 10:12:41.422104 close(6)    = 0
[pid 25613] 10:12:41.422180 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.422259 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.422328 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.422400 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.422471 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.422540 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25613] 10:12:41.422621 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde86000
[pid 25613] 10:12:41.422780 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74ba04d000
[pid 25613] 10:12:41.422850 mprotect(0x7f74ba062000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.422911 mmap(0x7f74ba261000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f74ba261000
[pid 25613] 10:12:41.422991 close(6)    = 0
[pid 25613] 10:12:41.423075 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.423148 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.423218 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.423290 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25613] 10:12:41.423354 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.423414 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25613] 10:12:41.423489 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74b9e42000
[pid 25613] 10:12:41.423549 mprotect(0x7f74b9e4c000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.423599 mmap(0x7f74ba04b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f74ba04b000
[pid 25613] 10:12:41.423771 close(6)    = 0
[pid 25613] 10:12:41.423837 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.423901 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.423970 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.424043 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.424106 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.424176 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25613] 10:12:41.424255 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74b9c3f000
[pid 25613] 10:12:41.424318 mprotect(0x7f74b9c41000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.424375 mmap(0x7f74b9e40000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f74b9e40000
[pid 25613] 10:12:41.424444 close(6)    = 0
[pid 25613] 10:12:41.424507 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde85000
[pid 25613] 10:12:41.424594 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.424759 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.424833 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.424899 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25613] 10:12:41.424963 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.425026 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25613] 10:12:41.425105 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f74b9a20000
[pid 25613] 10:12:41.425165 mprotect(0x7f74b9a3d000, 2093056, PROT_NONE) = 0
[pid 25613] 10:12:41.425219 mmap(0x7f74b9c3c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f74b9c3c000
[pid 25613] 10:12:41.425283 mmap(0x7f74b9c3e000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f74b9c3e000
[pid 25613] 10:12:41.425349 close(6)    = 0
[pid 25613] 10:12:41.425450 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde84000
[pid 25613] 10:12:41.425560 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde83000
[pid 25613] 10:12:41.425628 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde81000
[pid 25613] 10:12:41.425788 arch_prctl(ARCH_SET_FS, 0x7f74bde817c0) = 0
[pid 25613] 10:12:41.425914 mprotect(0x7f74b9c3c000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.425986 mprotect(0x7f74b9e40000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426074 mprotect(0x7f74ba04b000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426151 mprotect(0x7f74ba261000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426242 mprotect(0x7f74ba48c000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426320 mprotect(0x7f74ba691000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426551 mprotect(0x7f74ba96e000, 40960, PROT_READ) = 0
[pid 25613] 10:12:41.426838 mprotect(0x7f74babbb000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426924 mprotect(0x7f74badd5000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.426989 mprotect(0x7f74bafe2000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.427304 mprotect(0x7f74bb7ce000, 110592, PROT_READ) = 0
[pid 25613] 10:12:41.427466 mprotect(0x7f74bba5a000, 16384, PROT_READ) = 0
[pid 25613] 10:12:41.427716 mprotect(0x7f74bbdef000, 16384, PROT_READ) = 0
[pid 25613] 10:12:41.427786 mprotect(0x7f74bbffa000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.427861 mprotect(0x7f74bc1fe000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.428807 mprotect(0x7f74bcf56000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.428876 mprotect(0x7f74bd38b000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.428917 mprotect(0x7f74bd60f000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.428956 mprotect(0x7f74bd818000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.429006 mprotect(0x7f74bda5d000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.429049 mprotect(0x7f74bdc77000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.429107 mprotect(0x7f74bde9a000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.429142 munmap(0x7f74bde8f000, 39387) = 0
[pid 25613] 10:12:41.429181 set_tid_address(0x7f74bde81a90) = 25613
[pid 25613] 10:12:41.429211 set_robust_list(0x7f74bde81aa0, 24) = 0
[pid 25613] 10:12:41.429240 futex(0x7ffe3011082c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25613] 10:12:41.429271 futex(0x7ffe3011082c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f74bde817c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25613] 10:12:41.429311 rt_sigaction(SIGRTMIN, {0x7f74bcd44c60, [], SA_RESTORER|SA_SIGINFO, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.429349 rt_sigaction(SIGRT_1, {0x7f74bcd44cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.429384 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25613] 10:12:41.429429 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25613] 10:12:41.429504 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350313, f_bavail=6350313, f_files=1000000, f_ffree=691068, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25613] 10:12:41.429603 brk(0)      = 0xa69000
[pid 25613] 10:12:41.429637 brk(0xa8a000) = 0xa8a000
[pid 25613] 10:12:41.429749 open("/proc/filesystems", O_RDONLY) = 6
[pid 25613] 10:12:41.429809 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.429857 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde98000
[pid 25613] 10:12:41.429892 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25613] 10:12:41.430001 read(6, "", 1024) = 0
[pid 25613] 10:12:41.430039 close(6)    = 0
[pid 25613] 10:12:41.430074 munmap(0x7f74bde98000, 4096) = 0
[pid 25613] 10:12:41.430160 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.430277 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.430324 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25613] 10:12:41.430422 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.430482 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25613] 10:12:41.430526 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25613] 10:12:41.430565 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.430608 umask(0)    = 0
[pid 25613] 10:12:41.430759 geteuid()   = 0
[pid 25613] 10:12:41.430799 getuid()    = 47
[pid 25613] 10:12:41.430831 getgid()    = 12
[pid 25613] 10:12:41.430887 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25613] 10:12:41.430922 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25613] 10:12:41.430955 getgroups(65536, [12]) = 1
[pid 25613] 10:12:41.430991 setgroups(0, []) = 0
[pid 25613] 10:12:41.431024 getegid()   = 12
[pid 25613] 10:12:41.431054 geteuid()   = 0
[pid 25613] 10:12:41.431087 geteuid()   = 0
[pid 25613] 10:12:41.431117 getegid()   = 12
[pid 25613] 10:12:41.431148 setgid(12)  = 0
[pid 25613] 10:12:41.431180 setuid(0)   = 0
[pid 25613] 10:12:41.431242 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25613] 10:12:41.431300 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.431352 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.431395 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde98000
[pid 25613] 10:12:41.431445 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25613] 10:12:41.431611 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25613] 10:12:41.431725 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.431775 close(7)    = 0
[pid 25613] 10:12:41.431816 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25613] 10:12:41.431850 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.431889 close(7)    = 0
[pid 25613] 10:12:41.431928 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25613] 10:12:41.431969 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25613] 10:12:41.432013 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.432047 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25613] 10:12:41.432102 read(7, "", 4096) = 0
[pid 25613] 10:12:41.432134 close(7)    = 0
[pid 25613] 10:12:41.432165 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.432214 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.432256 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.432298 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.432336 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25613] 10:12:41.432378 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25613] 10:12:41.432446 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f74bde77000
[pid 25613] 10:12:41.432502 close(7)    = 0
[pid 25613] 10:12:41.432561 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25613] 10:12:41.432609 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25613] 10:12:41.432726 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25613] 10:12:41.432794 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f74b9812000
[pid 25613] 10:12:41.432835 mprotect(0x7f74b981e000, 2097152, PROT_NONE) = 0
[pid 25613] 10:12:41.432870 mmap(0x7f74b9a1e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f74b9a1e000
[pid 25613] 10:12:41.432916 close(7)    = 0
[pid 25613] 10:12:41.432967 mprotect(0x7f74b9a1e000, 4096, PROT_READ) = 0
[pid 25613] 10:12:41.433008 munmap(0x7f74bde77000, 39387) = 0
[pid 25613] 10:12:41.433054 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25613] 10:12:41.433098 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25613] 10:12:41.433133 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.433176 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.433210 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.433267 close(7)    = 0
[pid 25613] 10:12:41.433299 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.433352 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25613] 10:12:41.433390 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.433436 close(7)    = 0
[pid 25613] 10:12:41.433470 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25613] 10:12:41.433502 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.433540 close(7)    = 0
[pid 25613] 10:12:41.433576 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25613] 10:12:41.433614 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25613] 10:12:41.433726 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.433765 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25613] 10:12:41.433822 close(7)    = 0
[pid 25613] 10:12:41.433856 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.433907 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25613] 10:12:41.433980 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25613] 10:12:41.434020 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.434063 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.434096 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.434136 close(7)    = 0
[pid 25613] 10:12:41.434168 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.434208 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25613] 10:12:41.434268 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25613] 10:12:41.434326 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_DFL, [], SA_RESTORER, 0x7f74bcd4e790}, 8) = 0
[pid 25613] 10:12:41.434375 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f74bde81a90) = 25614
[pid 25613] 10:12:41.434772 wait4(25614, Process 25614 attached
 <unfinished ...>
[pid 25614] 10:12:41.434830 set_robust_list(0x7f74bde81aa0, 24) = 0
[pid 25614] 10:12:41.434883 geteuid()   = 0
[pid 25614] 10:12:41.434919 geteuid()   = 0
[pid 25614] 10:12:41.434949 getegid()   = 12
[pid 25614] 10:12:41.434981 setgid(12)  = 0
[pid 25614] 10:12:41.435012 setuid(47)  = 0
[pid 25614] 10:12:41.436757 brk(0xaab000) = 0xaab000
[pid 25614] 10:12:41.437198 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25614] 10:12:41.437257 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25614] 10:12:41.437311 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25614] 10:12:41.437353 read(7, "\316\342\374\226)\305\325O\253\342\217\303\201\203\347\310\7\341&Uq]Q\260\326\206\306\2v-\357\244%\331\234LD\313\226\243<\324\233\21\271\334<\246", 48) = 48
[pid 25614] 10:12:41.437394 close(7)    = 0
[pid 25614] 10:12:41.437449 getuid()    = 47
[pid 25614] 10:12:41.437619 exit_group(0) = ?
[pid 25614] 10:12:41.437863 +++ exited with 0 +++
[pid 25613] 10:12:41.437900 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25614
[pid 25613] 10:12:41.437925 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, 8) = 0
[pid 25613] 10:12:41.437988 getcwd("/var/spool/exim", 16380) = 16
[pid 25613] 10:12:41.438061 open("/etc/localtime", O_RDONLY) = 7
[pid 25613] 10:12:41.438103 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.438156 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.438199 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.438234 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25613] 10:12:41.438283 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25613] 10:12:41.438315 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25613] 10:12:41.438363 close(7)    = 0
[pid 25613] 10:12:41.438401 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.438456 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25613] 10:12:41.438506 fcntl(7, F_GETFD) = 0
[pid 25613] 10:12:41.438537 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.438567 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5399826, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.438613 write(7, "2015-12-30 10:12:41 [25613] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMf-0006f5-Bn\n", 92) = 92
[pid 25613] 10:12:41.438659 chdir("/var/spool/exim") = 0
[pid 25613] 10:12:41.438703 setgid(12)  = 0
[pid 25613] 10:12:41.438763 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25613] 10:12:41.438844 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25613] 10:12:41.438925 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25613] 10:12:41.438997 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25613] 10:12:41.439075 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25613] 10:12:41.439168 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25613] 10:12:41.439282 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25613] 10:12:41.439374 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25613] 10:12:41.439423 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.439471 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.439506 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.439552 close(8)    = 0
[pid 25613] 10:12:41.439585 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.439683 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25613] 10:12:41.439780 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25613] 10:12:41.440031 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25613] 10:12:41.440158 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25613] 10:12:41.440332 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25613] 10:12:41.440388 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25613] 10:12:41.440487 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.440535 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.440576 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.440626 close(8)    = 0
[pid 25613] 10:12:41.440664 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.440711 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25613] 10:12:41.440752 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25613] 10:12:41.440804 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.440838 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25613] 10:12:41.440885 close(8)    = 0
[pid 25613] 10:12:41.440918 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.440975 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25613] 10:12:41.441015 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25613] 10:12:41.441057 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.441090 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25613] 10:12:41.441135 close(8)    = 0
[pid 25613] 10:12:41.441167 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.441270 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25613] 10:12:41.441468 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25613] 10:12:41.441584 read(6, "", 4096) = 0
[pid 25613] 10:12:41.441627 read(6, "", 4096) = 0
[pid 25613] 10:12:41.441667 close(6)    = 0
[pid 25613] 10:12:41.441704 munmap(0x7f74bde98000, 4096) = 0
[pid 25613] 10:12:41.441757 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f74bcd4e790}, NULL, 8) = 0
[pid 25613] 10:12:41.441805 open("/var/spool/exim/input/f/1aEJMf-0006f5-Bn-D", O_RDWR|O_APPEND) = 6
[pid 25613] 10:12:41.441852 fcntl(6, F_GETFD) = 0
[pid 25613] 10:12:41.441882 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.441912 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25613] 10:12:41.441948 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064854, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3170, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.441998 open("/var/spool/exim/input/f/1aEJMf-0006f5-Bn-H", O_RDONLY) = 8
[pid 25613] 10:12:41.442040 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.442089 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde98000
[pid 25613] 10:12:41.442124 read(8, "1aEJMf-0006f5-Bn-H\nmailnull 47 12\n<>\n1451491961 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25613] 10:12:41.442198 read(8, "", 4096) = 0
[pid 25613] 10:12:41.442232 close(8)    = 0
[pid 25613] 10:12:41.442263 munmap(0x7f74bde98000, 4096) = 0
[pid 25613] 10:12:41.442300 open("/var/spool/exim/input/f/1aEJMf-0006f5-Bn-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.442352 open("/var/spool/exim/msglog/f/1aEJMf-0006f5-Bn", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25613] 10:12:41.442400 fcntl(8, F_GETFD) = 0
[pid 25613] 10:12:41.442433 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.442469 fchown(8, 47, 12) = 0
[pid 25613] 10:12:41.442508 fchmod(8, 0640) = 0
[pid 25613] 10:12:41.442545 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25613] 10:12:41.442582 fstat(8, {st_dev=makedev(144, 4215), st_ino=125064874, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.442631 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde98000
[pid 25613] 10:12:41.442670 lseek(8, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.442710 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.442765 pipe([9, 10]) = 0
[pid 25613] 10:12:41.442805 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_DFL, [], SA_RESTORER, 0x7f74bcd4e790}, 8) = 0
[pid 25613] 10:12:41.442846 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f74bde81a90) = 25615
[pid 25613] 10:12:41.443104 close(10)   = 0
[pid 25613] 10:12:41.443140 read(9, Process 25615 attached
 <unfinished ...>
[pid 25615] 10:12:41.443189 set_robust_list(0x7f74bde81aa0, 24) = 0
[pid 25615] 10:12:41.443271 close(9)    = 0
[pid 25615] 10:12:41.443311 geteuid()   = 0
[pid 25615] 10:12:41.443344 getegid()   = 12
[pid 25615] 10:12:41.443377 setgid(494) = 0
[pid 25615] 10:12:41.443528 setuid(495) = 0
[pid 25615] 10:12:41.443594 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25615] 10:12:41.443645 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25615] 10:12:41.443741 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25615] 10:12:41.443789 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25615] 10:12:41.443824 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25615] 10:12:41.443866 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25615] 10:12:41.443913 close(9)    = 0
[pid 25615] 10:12:41.443954 munmap(0x7f74bde97000, 4096) = 0
[pid 25615] 10:12:41.444031 brk(0xaac000) = 0xaac000
[pid 25615] 10:12:41.444165 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25613] 10:12:41.444195 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25613] 10:12:41.444216 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444235 <... write resumed> ) = 4
[pid 25615] 10:12:41.444252 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25613] 10:12:41.444273 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25613] 10:12:41.444292 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444310 <... write resumed> ) = 4
[pid 25615] 10:12:41.444327 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25613] 10:12:41.444348 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25613] 10:12:41.444367 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444386 <... write resumed> ) = 4
[pid 25615] 10:12:41.444472 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25613] 10:12:41.444500 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25613] 10:12:41.444520 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444540 <... write resumed> ) = 4
[pid 25615] 10:12:41.444557 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25613] 10:12:41.444578 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25613] 10:12:41.444607 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444630 <... write resumed> ) = 4
[pid 25615] 10:12:41.444648 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25613] 10:12:41.444680 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25613] 10:12:41.444706 read(9,  <unfinished ...>
[pid 25615] 10:12:41.444725 <... write resumed> ) = 40
[pid 25615] 10:12:41.444743 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25613] 10:12:41.444765 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25613] 10:12:41.444786 wait4(-1,  <unfinished ...>
[pid 25615] 10:12:41.444805 <... write resumed> ) = 4
[pid 25615] 10:12:41.444822 close(10)   = 0
[pid 25615] 10:12:41.444862 exit_group(0) = ?
[pid 25615] 10:12:41.445039 +++ exited with 0 +++
[pid 25613] 10:12:41.445074 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25615
[pid 25613] 10:12:41.445097 close(9)    = 0
[pid 25613] 10:12:41.445132 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, 8) = 0
[pid 25613] 10:12:41.445187 brk(0xaab000) = 0xaab000
[pid 25613] 10:12:41.445231 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25613] 10:12:41.445279 alarm(60)   = 0
[pid 25613] 10:12:41.445312 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25613] 10:12:41.445347 alarm(0)    = 60
[pid 25613] 10:12:41.445427 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.445478 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25613] 10:12:41.445522 read(10, "cpu  123112 1342528 395359 67343299 2509 0 0 0\ncpu0 123112 1342528 395359 67343299 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58724384\nbtime 1450798266\nprocesses 893093\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25613] 10:12:41.445583 close(10)   = 0
[pid 25613] 10:12:41.445688 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25613] 10:12:41.445752 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25613] 10:12:41.445792 fcntl(10, F_GETFD) = 0
[pid 25613] 10:12:41.445822 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.445858 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25613] 10:12:41.445917 close(10)   = 0
[pid 25613] 10:12:41.445965 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.446006 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25613] 10:12:41.446106 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde50000
[pid 25613] 10:12:41.446263 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25613] 10:12:41.446306 fcntl(10, F_GETFD) = 0
[pid 25613] 10:12:41.446336 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.446370 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25613] 10:12:41.446559 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25613] 10:12:41.446669 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25613] 10:12:41.446742 close(10)   = 0
[pid 25613] 10:12:41.446803 munmap(0x7f74bde50000, 200704) = 0
[pid 25613] 10:12:41.446871 close(9)    = 0
[pid 25613] 10:12:41.446926 open("/etc/localdomains", O_RDONLY) = 9
[pid 25613] 10:12:41.446970 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.447024 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.447069 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.447105 lseek(9, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.447136 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25613] 10:12:41.447203 stat("/jail_owner", 0x7ffe300cc650) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.447250 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25613] 10:12:41.447322 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.447371 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25613] 10:12:41.447440 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.447492 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.447557 open("/etc/demouids", O_RDONLY) = 10
[pid 25613] 10:12:41.447596 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.447643 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.447845 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde96000
[pid 25613] 10:12:41.447880 lseek(10, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.447912 read(10, "", 4096) = 0
[pid 25613] 10:12:41.447951 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25613] 10:12:41.448043 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.448100 open("/etc/userdomains", O_RDONLY) = 11
[pid 25613] 10:12:41.448138 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.448183 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.448224 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde95000
[pid 25613] 10:12:41.448258 lseek(11, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.448288 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25613] 10:12:41.448350 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25613] 10:12:41.448396 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.448445 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde94000
[pid 25613] 10:12:41.448484 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.448529 close(12)   = 0
[pid 25613] 10:12:41.448562 munmap(0x7f74bde94000, 4096) = 0
[pid 25613] 10:12:41.448626 stat("//etc/fin.finestweddingsites.com", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.448760 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.448825 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.448884 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.448949 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.449005 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.449059 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.449121 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.449162 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.449217 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25613] 10:12:41.449255 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.449300 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.449344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde94000
[pid 25613] 10:12:41.449379 lseek(12, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.449413 read(12, "", 4096) = 0
[pid 25613] 10:12:41.449460 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25613] 10:12:41.449502 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25613] 10:12:41.449546 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde93000
[pid 25613] 10:12:41.449590 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25613] 10:12:41.449640 close(13)   = 0
[pid 25613] 10:12:41.449765 munmap(0x7f74bde93000, 4096) = 0
[pid 25613] 10:12:41.449819 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.449882 stat("//.spamassassinboxenable", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.449925 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.449976 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25613] 10:12:41.450032 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.450073 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.450128 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffe300cf440) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.450168 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.450219 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.450367 getuid()    = 0
[pid 25613] 10:12:41.450408 geteuid()   = 0
[pid 25613] 10:12:41.450445 getgid()    = 12
[pid 25613] 10:12:41.450477 getegid()   = 12
[pid 25613] 10:12:41.450586 open("/dev/urandom", O_RDONLY) = 13
[pid 25613] 10:12:41.450638 read(13, "\233ru\374", 4) = 4
[pid 25613] 10:12:41.450753 close(13)   = 0
[pid 25613] 10:12:41.450886 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25613] 10:12:41.451003 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.451047 lseek(0, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.451082 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc2a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.451116 lseek(1, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.451148 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc2b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.451180 lseek(2, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.451214 open("/dev/null", O_RDONLY) = 13
[pid 25613] 10:12:41.451254 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc380) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.451287 lseek(13, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.451318 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.451360 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, 8) = 0
[pid 25613] 10:12:41.451704 brk(0xacd000) = 0xacd000
[pid 25613] 10:12:41.451761 read(13, "", 8192) = 0
[pid 25613] 10:12:41.451803 close(13)   = 0
[pid 25613] 10:12:41.452132 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.452194 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25613] 10:12:41.452233 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc1b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.452269 lseek(13, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.452322 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25613] 10:12:41.453234 brk(0xaee000) = 0xaee000
[pid 25613] 10:12:41.453596 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25613] 10:12:41.454413 brk(0xb0f000) = 0xb0f000
[pid 25613] 10:12:41.454864 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25613] 10:12:41.455538 brk(0xb30000) = 0xb30000
[pid 25613] 10:12:41.456068 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25613] 10:12:41.456368 read(13, "", 8192) = 0
[pid 25613] 10:12:41.456418 close(13)   = 0
[pid 25613] 10:12:41.456474 stat("/usr/share/amavis/amavis-filter", 0x7f74bc535880) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.456521 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.456573 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25613] 10:12:41.456631 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25613] 10:12:41.456737 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cc1b0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.456776 lseek(13, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.456826 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25613] 10:12:41.457133 brk(0xb51000) = 0xb51000
[pid 25613] 10:12:41.457318 stat("/etc/exim/perl/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457366 stat("/etc/exim/perl/warnings.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457407 stat("/usr/local/cpanel/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457454 stat("/usr/local/cpanel/warnings.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457492 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457535 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457576 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457623 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457741 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457786 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457825 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.457863 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.457915 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25613] 10:12:41.457957 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cbbc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.457992 lseek(14, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.458043 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25613] 10:12:41.458364 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25613] 10:12:41.459029 brk(0xb72000) = 0xb72000
[pid 25613] 10:12:41.459234 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25613] 10:12:41.459644 read(14, "", 8192) = 0
[pid 25613] 10:12:41.459751 close(14)   = 0
[pid 25613] 10:12:41.460447 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25613] 10:12:41.461240 read(13, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25613] 10:12:41.462022 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25613] 10:12:41.462591 brk(0xb93000) = 0xb93000
[pid 25613] 10:12:41.462740 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25613] 10:12:41.463321 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25613] 10:12:41.463870 brk(0xbb4000) = 0xbb4000
[pid 25613] 10:12:41.464321 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25613] 10:12:41.464924 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25613] 10:12:41.465294 brk(0xbd5000) = 0xbd5000
[pid 25613] 10:12:41.465582 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25613] 10:12:41.466260 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25613] 10:12:41.466542 brk(0xbf6000) = 0xbf6000
[pid 25613] 10:12:41.467128 stat("/usr/local/cpanel/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467187 stat("/usr/local/cpanel/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467227 stat("/etc/exim/perl/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467263 stat("/etc/exim/perl/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467299 stat("/usr/local/cpanel/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467335 stat("/usr/local/cpanel/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467372 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467419 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467461 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467499 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467538 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467577 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467616 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.467731 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.467790 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25613] 10:12:41.467833 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cbbc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.467869 lseek(14, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.467922 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25613] 10:12:41.468141 lseek(14, 878, SEEK_SET) = 878
[pid 25613] 10:12:41.468181 lseek(14, 0, SEEK_CUR) = 878
[pid 25613] 10:12:41.468212 close(14)   = 0
[pid 25613] 10:12:41.468462 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25613] 10:12:41.469115 brk(0xc17000) = 0xc17000
[pid 25613] 10:12:41.469245 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25613] 10:12:41.470350 brk(0xc38000) = 0xc38000
[pid 25613] 10:12:41.470482 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25613] 10:12:41.471636 brk(0xc59000) = 0xc59000
[pid 25613] 10:12:41.471875 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25613] 10:12:41.472765 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.472822 stat("/usr/local/cpanel/Errno.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.472863 stat("/etc/exim/perl/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.472899 stat("/etc/exim/perl/Errno.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.472935 stat("/usr/local/cpanel/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.472970 stat("/usr/local/cpanel/Errno.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473007 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473048 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473088 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473126 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473172 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.473213 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25613] 10:12:41.473268 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25613] 10:12:41.473311 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cbbc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.473347 lseek(14, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.473401 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25613] 10:12:41.473528 brk(0xc7a000) = 0xc7a000
[pid 25613] 10:12:41.474109 lseek(14, 4868, SEEK_SET) = 4868
[pid 25613] 10:12:41.474156 lseek(14, 0, SEEK_CUR) = 4868
[pid 25613] 10:12:41.474188 close(14)   = 0
[pid 25613] 10:12:41.474234 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474276 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474314 stat("/etc/exim/perl/Exporter.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474349 stat("/etc/exim/perl/Exporter.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474384 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474429 stat("/usr/local/cpanel/Exporter.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474466 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474505 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffe300cbdd0) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474545 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffe300cbe70) = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.474583 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25613] 10:12:41.474635 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25613] 10:12:41.474749 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffe300cbbc0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25613] 10:12:41.474786 lseek(14, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.474832 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25613] 10:12:41.475324 lseek(14, 2366, SEEK_SET) = 2366
[pid 25613] 10:12:41.475373 lseek(14, 0, SEEK_CUR) = 2366
[pid 25613] 10:12:41.475410 close(14)   = 0
[pid 25613] 10:12:41.475850 read(13, "", 8192) = 0
[pid 25613] 10:12:41.475897 close(13)   = 0
[pid 25613] 10:12:41.476114 lseek(12, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.476156 read(12, "", 4096) = 0
[pid 25613] 10:12:41.476214 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.476291 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25613] 10:12:41.476335 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.476384 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.476444 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde93000
[pid 25613] 10:12:41.476503 lseek(13, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.476551 read(13, "", 4096) = 0
[pid 25613] 10:12:41.476600 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25613] 10:12:41.476735 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25613] 10:12:41.476783 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25613] 10:12:41.476827 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde92000
[pid 25613] 10:12:41.476862 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25613] 10:12:41.476909 close(14)   = 0
[pid 25613] 10:12:41.476942 munmap(0x7f74bde92000, 4096) = 0
[pid 25613] 10:12:41.476994 open("/etc/aliases", O_RDONLY) = 14
[pid 25613] 10:12:41.477035 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25613] 10:12:41.477081 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25613] 10:12:41.477123 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde92000
[pid 25613] 10:12:41.477157 lseek(14, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.477188 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25613] 10:12:41.477239 read(14, "", 4096) = 0
[pid 25613] 10:12:41.477281 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25613] 10:12:41.477320 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25613] 10:12:41.477362 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde91000
[pid 25613] 10:12:41.477395 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25613] 10:12:41.477456 close(15)   = 0
[pid 25613] 10:12:41.477490 munmap(0x7f74bde91000, 4096) = 0
[pid 25613] 10:12:41.477535 open("/etc/localaliases", O_RDONLY) = 15
[pid 25613] 10:12:41.477575 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25613] 10:12:41.477620 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25613] 10:12:41.477744 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde91000
[pid 25613] 10:12:41.477781 lseek(15, 0, SEEK_SET) = 0
[pid 25613] 10:12:41.477812 read(15, "", 4096) = 0
[pid 25613] 10:12:41.477857 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.477917 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.477972 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.478025 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25613] 10:12:41.478082 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.478150 write(8, "2015-12-30 10:12:41 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25613] 10:12:41.478195 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.478250 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.478300 close(7)    = 0
[pid 25613] 10:12:41.478336 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25613] 10:12:41.478379 fcntl(7, F_GETFD) = 0
[pid 25613] 10:12:41.478417 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.478469 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5399918, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.478540 write(7, "2015-12-30 10:12:41 [25613] 1aEJMf-0006f5-Bn ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25613] 10:12:41.478590 close(14)   = 0
[pid 25613] 10:12:41.478629 munmap(0x7f74bde92000, 4096) = 0
[pid 25613] 10:12:41.478749 close(15)   = 0
[pid 25613] 10:12:41.478784 munmap(0x7f74bde91000, 4096) = 0
[pid 25613] 10:12:41.478817 close(10)   = 0
[pid 25613] 10:12:41.478849 munmap(0x7f74bde96000, 4096) = 0
[pid 25613] 10:12:41.478882 close(11)   = 0
[pid 25613] 10:12:41.478913 munmap(0x7f74bde95000, 4096) = 0
[pid 25613] 10:12:41.478946 close(9)    = 0
[pid 25613] 10:12:41.478978 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.479010 close(13)   = 0
[pid 25613] 10:12:41.479041 munmap(0x7f74bde93000, 4096) = 0
[pid 25613] 10:12:41.479074 close(12)   = 0
[pid 25613] 10:12:41.479105 munmap(0x7f74bde94000, 4096) = 0
[pid 25613] 10:12:41.479152 geteuid()   = 0
[pid 25613] 10:12:41.479185 getegid()   = 12
[pid 25613] 10:12:41.479217 setgid(12)  = 0
[pid 25613] 10:12:41.479249 setuid(47)  = 0
[pid 25613] 10:12:41.479284 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f74bba976a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25613] 10:12:41.479334 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25613] 10:12:41.479373 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.479432 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25613] 10:12:41.479482 close(7)    = 0
[pid 25613] 10:12:41.479517 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25613] 10:12:41.479555 fcntl(7, F_GETFD) = 0
[pid 25613] 10:12:41.479585 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25613] 10:12:41.479615 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400028, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.479721 write(7, "2015-12-30 10:12:41 [25613] 1aEJMf-0006f5-Bn Frozen (delivery error message)\n", 77) = 77
[pid 25613] 10:12:41.479764 open("/var/spool/exim/input/f/hdr.25613", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25613] 10:12:41.479837 fchown(9, 47, 12) = 0
[pid 25613] 10:12:41.479873 fchmod(9, 0640) = 0
[pid 25613] 10:12:41.479906 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25613] 10:12:41.479939 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064876, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.479982 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f74bde97000
[pid 25613] 10:12:41.480017 lseek(9, 0, SEEK_CUR) = 0
[pid 25613] 10:12:41.480068 write(9, "1aEJMf-0006f5-Bn-H\nmailnull 47 12\n<>\n1451491961 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491961\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25613] 10:12:41.480113 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064876, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.480161 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMf-0006f5-Bn\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:41 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25613] 10:12:41.480203 fsync(9)    = 0
[pid 25613] 10:12:41.480741 fstat(9, {st_dev=makedev(144, 4215), st_ino=125064876, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:41, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25613] 10:12:41.480794 close(9)    = 0
[pid 25613] 10:12:41.480827 munmap(0x7f74bde97000, 4096) = 0
[pid 25613] 10:12:41.480869 rename("/var/spool/exim/input/f/hdr.25613", "/var/spool/exim/input/f/1aEJMf-0006f5-Bn-H") = 0
[pid 25613] 10:12:41.480952 open("/var/spool/exim/input/f/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25613] 10:12:41.480992 fsync(9)    = 0
[pid 25613] 10:12:41.481023 close(9)    = 0
[pid 25613] 10:12:41.481054 close(8)    = 0
[pid 25613] 10:12:41.481085 munmap(0x7f74bde98000, 4096) = 0
[pid 25613] 10:12:41.481127 unlink("/var/spool/exim/input/f/1aEJMf-0006f5-Bn-J") = -1 ENOENT (No such file or directory)
[pid 25613] 10:12:41.481169 close(6)    = 0
[pid 25613] 10:12:41.481347 exit_group(0) = ?
[pid 25613] 10:12:41.481929 +++ exited with 0 +++
[pid 25537] 10:12:46.361663 <... select resumed> ) = 1 (in [11], left {591, 467011})
[pid 25537] 10:12:46.361769 read(11, "\27\3\1\0 ", 5) = 5
[pid 25537] 10:12:46.361839 read(11, "|o\353\320\33D3\333\v\25}\310\343e\325\374Q\226\4\337\260Jg>\360e\27\365Q\3162\253", 32) = 32
[pid 25537] 10:12:46.361914 read(11, "\27\3\1\0@", 5) = 5
[pid 25537] 10:12:46.361976 read(11, "\235x\204\372\373'\313A\351\302e\7\222\310\4JhBk\3119Y\221\351KK+\0033\7\250/\272\2321'uw\5\241S\216\226\222\331\254>Y\226t\17x\257\7<\27Ma\3\211\335\265\225\246", 64) = 64
[pid 25537] 10:12:46.362054 write(9, "ljacques@westernskiesgolf.com\n", 30) = 30
[pid 25537] 10:12:46.362125 fsync(9)    = 0
[pid 25537] 10:12:46.362647 open("/var/spool/exim/db/wait-remote_smtp.lockfile", O_RDWR) = 14
[pid 25537] 10:12:46.362736 alarm(60)   = 0
[pid 25537] 10:12:46.362795 fcntl(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25537] 10:12:46.362860 alarm(0)    = 60
[pid 25537] 10:12:46.362936 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:46.363016 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 15
[pid 25537] 10:12:46.363090 read(15, "cpu  123112 1342533 395361 67343778 2509 0 0 0\ncpu0 123112 1342533 395361 67343778 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58726810\nbtime 1450798266\nprocesses 893094\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25537] 10:12:46.363186 close(15)   = 0
[pid 25537] 10:12:46.363265 stat("/var/spool/exim/db/wait-remote_smtp", {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25537] 10:12:46.363364 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR) = 15
[pid 25537] 10:12:46.363439 fcntl(15, F_GETFD) = 0
[pid 25537] 10:12:46.363495 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25537] 10:12:46.363551 read(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25537] 10:12:46.363625 close(15)   = 0
[pid 25537] 10:12:46.363691 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25537] 10:12:46.363760 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25537] 10:12:46.363868 brk(0x140f000) = 0x140f000
[pid 25537] 10:12:46.364055 open("/var/spool/exim/db/wait-remote_smtp", O_RDWR|O_CREAT, 0) = 15
[pid 25537] 10:12:46.364139 fcntl(15, F_GETFD) = 0
[pid 25537] 10:12:46.364194 fcntl(15, F_SETFD, FD_CLOEXEC) = 0
[pid 25537] 10:12:46.364249 fstat(15, {st_dev=makedev(144, 4215), st_ino=109336280, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-02:06:07, st_ctime=2015/12/30-02:06:07}) = 0
[pid 25537] 10:12:46.364344 pread(15, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25537] 10:12:46.364442 pread(15, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\r\347\17\276\17\215\17d\17?\17\26\17\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330V\204\6w\220\0\1\"3\353\242\"\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25537] 10:12:46.364538 close(15)   = 0
[pid 25537] 10:12:46.364619 close(14)   = 0
[pid 25537] 10:12:46.364694 write(11, "\27\3\1\0 \263\225\263\347G\320\251\327\241\303\332\217\2777\230\371&\223\365\277\217\234\35[\f}m\0301:\265\374\27\3\1\0 \271\265\326\347\277X\333\22h\243\256'U\253\0\245\274\210\341i\250\365q\301\306\276\211\271%[*u", 74) = 74
[pid 25537] 10:12:46.364803 write(11, "\25\3\1\0 P\30\306H\345\323\232\"\330\372X\rUh[\252\376(\20\330\265\21\211{\335\215(b\304\3145\31", 37) = 37
[pid 25537] 10:12:46.364954 close(11)   = 0
[pid 25537] 10:12:46.365065 close(13)   = 0
[pid 25537] 10:12:46.365330 munmap(0x7f3c0be4b000, 4096) = 0
[pid 25537] 10:12:46.365403 close(10)   = 0
[pid 25537] 10:12:46.365467 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25537] 10:12:46.365539 write(12, "S000004*\f\0\0", 11) = 11
[pid 25502] 10:12:46.365597 <... select resumed> ) = 1 (in [11], left {50, 849333})
[pid 25502] 10:12:46.365640 read(11, "S000004*\f\0\0", 16384) = 11
[pid 25502] 10:12:46.365709 wait4(-1, 0x7ffced97dcc0, WNOHANG, NULL) = 0
[pid 25502] 10:12:46.365769 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25537] 10:12:46.365822 write(12, "X100083TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=mail.coursetrends.com\0", 90) = 90
[pid 25502] 10:12:46.365873 <... select resumed> ) = 1 (in [11], left {59, 999934})
[pid 25502] 10:12:46.365912 read(11, "X100083TLSv1:DHE-RSA-AES256-SHA:256\0/OU=Domain Control Validated/CN=mail.coursetrends.com\0", 16384) = 90
[pid 25502] 10:12:46.365981 wait4(-1,  <unfinished ...>
[pid 25537] 10:12:46.366083 write(12, "X201943-----BEGIN CERTIFICATE-----\\nMIIFVzCCBD+gAwIBAgIJAOhEY7/baXHYMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 1950 <unfinished ...>
[pid 25502] 10:12:46.366100 <... wait4 resumed> 0x7ffced97dcc0, WNOHANG, NULL) = 0
[pid 25502] 10:12:46.366138 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25537] 10:12:46.366190 <... write resumed> ) = 1950
[pid 25502] 10:12:46.366202 <... select resumed> ) = 1 (in [11], left {59, 999978})
[pid 25502] 10:12:46.366238 read(11,  <unfinished ...>
[pid 25537] 10:12:46.366280 write(12, "X4000021\0", 9 <unfinished ...>
[pid 25502] 10:12:46.366293 <... read resumed> "X201943-----BEGIN CERTIFICATE-----\\nMIIFVzCCBD+gAwIBAgIJAOhEY7/baXHYMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD\\nVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa\\nMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0\\ncy5nb2RhZGR5LmNvbS9yZX"..., 16384) = 1950
[pid 25537] 10:12:46.366766 <... write resumed> ) = 9
[pid 25502] 10:12:46.366782 wait4(-1,  <unfinished ...>
[pid 25537] 10:12:46.366826 write(12, "D000004\2\0\0\0", 11 <unfinished ...>
[pid 25502] 10:12:46.366842 <... wait4 resumed> 0x7ffced97dcc0, WNOHANG, NULL) = 0
[pid 25537] 10:12:46.366882 <... write resumed> ) = 11
[pid 25502] 10:12:46.366894 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25537] 10:12:46.366947 write(12, "A000086\0=\0\0\t\0\0\0\0\0\0\000250 ok 1451491966 qp 26180\0\0mail.westernskiesgolf.com\000108.168.168.75\0\31\0\0\0000", 93 <unfinished ...>
[pid 25502] 10:12:46.366963 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25537] 10:12:46.367007 <... write resumed> ) = 93
[pid 25502] 10:12:46.367020 read(11,  <unfinished ...>
[pid 25537] 10:12:46.367064 write(12, "I00002050.116.78.207\00051220\0", 27 <unfinished ...>
[pid 25502] 10:12:46.367079 <... read resumed> "X4000021\0D000004\2\0\0\0A000086\0=\0\0\t\0\0\0\0\0\0\000250 ok 1451491966 qp 26180\0\0mail.westernskiesgolf.com\000108.168.168.75\0\31\0\0\0000", 16384) = 113
[pid 25537] 10:12:46.367127 <... write resumed> ) = 27
[pid 25502] 10:12:46.367139 wait4(-1,  <unfinished ...>
[pid 25537] 10:12:46.367178 write(12, "Z0000010", 8 <unfinished ...>
[pid 25502] 10:12:46.367192 <... wait4 resumed> 0x7ffced97dcc0, WNOHANG, NULL) = 0
[pid 25537] 10:12:46.367230 <... write resumed> ) = 8
[pid 25502] 10:12:46.367242 select(12, [11], NULL, NULL, {60, 0} <unfinished ...>
[pid 25537] 10:12:46.367286 close(12 <unfinished ...>
[pid 25502] 10:12:46.367297 <... select resumed> ) = 1 (in [11], left {59, 999998})
[pid 25537] 10:12:46.367342 <... close resumed> ) = 0
[pid 25502] 10:12:46.367354 read(11, "I00002050.116.78.207\00051220\0Z0000010", 16384) = 35
[pid 25537] 10:12:46.367924 exit_group(0) = ?
[pid 25502] 10:12:46.367940 close(11)   = 0
[pid 25502] 10:12:46.368004 wait4(25537,  <unfinished ...>
[pid 25537] 10:12:46.368792 +++ exited with 0 +++
[pid 25502] 10:12:46.368847 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25537
[pid 25502] 10:12:46.368906 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.369016 write(8, "2015-12-30 10:12:46 ljacques@westernskiesgolf.com: remote_smtp transport succeeded\n", 83) = 83
[pid 25502] 10:12:46.369114 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.369217 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.369309 close(7)    = 0
[pid 25502] 10:12:46.369380 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25502] 10:12:46.369538 fcntl(7, F_GETFD) = 0
[pid 25502] 10:12:46.369595 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:46.369652 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400105, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:41, st_ctime=2015/12/30-10:12:41}) = 0
[pid 25502] 10:12:46.369734 write(7, "2015-12-30 10:12:46 [25502] 1aEJMa-0006dB-67 => ljacques@westernskiesgolf.com I=[50.116.78.207] F=<finest09@fin.finestweddingsites.com> P=<finest09@fin.finestweddingsites.com> R=lookuphost T=remote_smtp S=3114 H=mail.westernskiesgolf.com [108.168.168.75]:2"..., 398) = 398
[pid 25502] 10:12:46.369844 geteuid()   = 0
[pid 25502] 10:12:46.369899 getegid()   = 12
[pid 25502] 10:12:46.369965 setgid(12)  = 0
[pid 25502] 10:12:46.370020 setuid(47)  = 0
[pid 25502] 10:12:46.370082 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25502] 10:12:46.370163 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.370262 pipe([10, 11]) = 0
[pid 25502] 10:12:46.370327 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:46.370405 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f3c0be36a90) = 25617
[pid 25502] 10:12:46.370823 close(10)   = 0
[pid 25502] 10:12:46.370887 fcntl(11, F_GETFL) = 0x1 (flags O_WRONLY)
[pid 25502] 10:12:46.370954 fstat(11, {st_dev=makedev(0, 8), st_ino=2130179691, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25502] 10:12:46.371036 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4c000
[pid 25502] 10:12:46.371102 lseek(11, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25502] 10:12:46.371245 fstat(6, {st_dev=makedev(144, 4215), st_ino=125064882, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1877, st_atime=2015/12/30-10:12:36, st_mtime=2015/12/30-10:12:36, st_ctime=2015/12/30-10:12:36}) = 0
[pid 25502] 10:12:46.371336 write(11, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 1049) = 1049
[pid 25502] 10:12:46.371507 lseek(6, 19, SEEK_SET) = 19
[pid 25502] 10:12:46.371576 read(6, "<html><head><style type=\"text/css\">.style3 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; }.style4 {font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; }</style></head><body><table width=\"100%\" border=\"0\" cellpaddin"..., 8192) = 1858
[pid 25502] 10:12:46.371660 read(6, "", 8192) = 0
[pid 25502] 10:12:46.371719 write(11, "Return-path: <finest09@fin.finestweddingsites.com>\nReceived: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dB-67; Wed, 30 Dec 2015 10:12:36 -0600\nTo:  ljacques@weste"..., 2423) = 2423
[pid 25502] 10:12:46.371786 write(11, "\n--1451491966-eximdsn-2049216250--\n", 35) = 35
[pid 25502] 10:12:46.371845 close(11)   = 0
[pid 25502] 10:12:46.371898 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:46.371965 wait4(25617, Process 25617 attached
 <unfinished ...>
[pid 25617] 10:12:46.372047 set_robust_list(0x7f3c0be36aa0, 24) = 0
[pid 25617] 10:12:46.372127 close(0)    = 0
[pid 25617] 10:12:46.372234 dup2(10, 0) = 0
[pid 25617] 10:12:46.372291 close(10)   = 0
[pid 25617] 10:12:46.372346 close(11)   = 0
[pid 25617] 10:12:46.372506 fstat(0, {st_dev=makedev(0, 8), st_ino=2130179691, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.372597 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25617] 10:12:46.372673 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25617] 10:12:46.372765 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-t", "-oem", "-oi", "-f", "<>", "-E1aEJMa-0006dB-67"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25617] 10:12:46.373291 brk(0)      = 0x14ab000
[pid 25617] 10:12:46.373356 fcntl(0, F_GETFD) = 0
[pid 25617] 10:12:46.373528 fcntl(1, F_GETFD) = 0
[pid 25617] 10:12:46.373618 fcntl(2, F_GETFD) = 0
[pid 25617] 10:12:46.373665 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373722 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf865000
[pid 25617] 10:12:46.373777 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373834 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373879 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373916 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373953 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.373989 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374026 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374061 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374099 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25617] 10:12:46.374155 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374202 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374240 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374279 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374319 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374359 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374407 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374459 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.374509 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374547 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374583 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374620 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374656 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374693 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffc0fcf5ea0) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374729 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.374766 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.374824 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25617] 10:12:46.374861 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25617] 10:12:46.374904 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f07bf85b000
[pid 25617] 10:12:46.374939 close(6)    = 0
[pid 25617] 10:12:46.374978 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.375018 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.375065 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.375110 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bf42d000
[pid 25617] 10:12:46.375146 mprotect(0x7f07bf443000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.375181 mmap(0x7f07bf643000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f07bf643000
[pid 25617] 10:12:46.375225 mmap(0x7f07bf645000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bf645000
[pid 25617] 10:12:46.375267 close(6)    = 0
[pid 25617] 10:12:46.375306 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375348 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375388 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375429 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.375468 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.375506 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.375550 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf85a000
[pid 25617] 10:12:46.375588 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bf214000
[pid 25617] 10:12:46.375623 mprotect(0x7f07bf22a000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.375657 mmap(0x7f07bf429000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f07bf429000
[pid 25617] 10:12:46.375698 mmap(0x7f07bf42b000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bf42b000
[pid 25617] 10:12:46.375738 close(6)    = 0
[pid 25617] 10:12:46.375776 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375823 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375864 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.375904 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.375929 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.375952 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.375981 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07befdd000
[pid 25617] 10:12:46.376003 mprotect(0x7f07befe4000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.376242 mmap(0x7f07bf1e4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f07bf1e4000
[pid 25617] 10:12:46.376290 mmap(0x7f07bf1e6000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bf1e6000
[pid 25617] 10:12:46.376334 close(6)    = 0
[pid 25617] 10:12:46.376384 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376431 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376480 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376519 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25617] 10:12:46.376559 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.376598 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.376643 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bed59000
[pid 25617] 10:12:46.376678 mprotect(0x7f07beddc000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.376713 mmap(0x7f07befdb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f07befdb000
[pid 25617] 10:12:46.376757 close(6)    = 0
[pid 25617] 10:12:46.376834 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376878 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376919 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.376958 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25617] 10:12:46.376997 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.377035 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25617] 10:12:46.377079 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf859000
[pid 25617] 10:12:46.377116 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07beb4b000
[pid 25617] 10:12:46.377151 mprotect(0x7f07beb57000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.377186 mmap(0x7f07bed57000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f07bed57000
[pid 25617] 10:12:46.377239 close(6)    = 0
[pid 25617] 10:12:46.377277 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.377321 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.377360 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25617] 10:12:46.377418 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07be928000
[pid 25617] 10:12:46.377453 mprotect(0x7f07be949000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.377487 mmap(0x7f07beb49000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f07beb49000
[pid 25617] 10:12:46.377526 close(6)    = 0
[pid 25617] 10:12:46.377567 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.377614 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.377655 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.377694 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25617] 10:12:46.377733 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.377770 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.377880 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07be70b000
[pid 25617] 10:12:46.377916 mprotect(0x7f07be722000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.377949 mmap(0x7f07be922000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f07be922000
[pid 25617] 10:12:46.377989 mmap(0x7f07be924000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07be924000
[pid 25617] 10:12:46.378030 close(6)    = 0
[pid 25617] 10:12:46.378069 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378109 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378149 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378188 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25617] 10:12:46.378224 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.378267 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.378314 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf858000
[pid 25617] 10:12:46.378351 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07be397000
[pid 25617] 10:12:46.378399 mprotect(0x7f07be506000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.378439 mmap(0x7f07be705000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f07be705000
[pid 25617] 10:12:46.378489 close(6)    = 0
[pid 25617] 10:12:46.378528 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378568 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378608 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.378646 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25617] 10:12:46.378686 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.378724 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25617] 10:12:46.378768 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07be108000
[pid 25617] 10:12:46.378864 mprotect(0x7f07be193000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.378900 mmap(0x7f07be393000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f07be393000
[pid 25617] 10:12:46.378942 mmap(0x7f07be396000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07be396000
[pid 25617] 10:12:46.378982 close(6)    = 0
[pid 25617] 10:12:46.379021 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379061 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379100 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379139 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.379178 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.379221 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25617] 10:12:46.379265 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bdf02000
[pid 25617] 10:12:46.379300 mprotect(0x7f07bdf08000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.379335 mmap(0x7f07be107000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f07be107000
[pid 25617] 10:12:46.379385 close(6)    = 0
[pid 25617] 10:12:46.379427 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379474 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25617] 10:12:46.379514 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.379552 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.379595 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf857000
[pid 25617] 10:12:46.379631 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bdbcc000
[pid 25617] 10:12:46.379666 mprotect(0x7f07bdcf8000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.379700 mmap(0x7f07bdef8000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f07bdef8000
[pid 25617] 10:12:46.379740 mmap(0x7f07bdf01000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bdf01000
[pid 25617] 10:12:46.379780 close(6)    = 0
[pid 25617] 10:12:46.379868 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379910 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379949 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.379988 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.380026 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.380064 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.380108 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bd9c8000
[pid 25617] 10:12:46.380143 mprotect(0x7f07bd9ca000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.380183 mmap(0x7f07bdbca000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f07bdbca000
[pid 25617] 10:12:46.380227 close(6)    = 0
[pid 25617] 10:12:46.380266 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380306 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380347 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380396 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.380441 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.380486 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.380531 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bd7c5000
[pid 25617] 10:12:46.380567 mprotect(0x7f07bd7c7000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.380601 mmap(0x7f07bd9c6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f07bd9c6000
[pid 25617] 10:12:46.380643 close(6)    = 0
[pid 25617] 10:12:46.380682 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380722 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380761 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.380850 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25617] 10:12:46.380894 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.380933 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.380976 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf856000
[pid 25617] 10:12:46.381014 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bd431000
[pid 25617] 10:12:46.381049 mprotect(0x7f07bd5bb000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.381084 mmap(0x7f07bd7bb000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f07bd7bb000
[pid 25617] 10:12:46.381125 mmap(0x7f07bd7c0000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bd7c0000
[pid 25617] 10:12:46.381165 close(6)    = 0
[pid 25617] 10:12:46.381205 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381250 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381290 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381331 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25617] 10:12:46.381375 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.381428 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25617] 10:12:46.381479 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bd1c5000
[pid 25617] 10:12:46.381515 mprotect(0x7f07bd227000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.381548 mmap(0x7f07bd426000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f07bd426000
[pid 25617] 10:12:46.381594 close(6)    = 0
[pid 25617] 10:12:46.381637 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381678 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381718 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.381758 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25617] 10:12:46.381843 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.381884 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25617] 10:12:46.381928 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bcde2000
[pid 25617] 10:12:46.381965 mprotect(0x7f07bcf9b000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.381999 mmap(0x7f07bd19a000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f07bd19a000
[pid 25617] 10:12:46.382041 mmap(0x7f07bd1c1000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bd1c1000
[pid 25617] 10:12:46.382081 close(6)    = 0
[pid 25617] 10:12:46.382121 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.382162 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.382202 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.382240 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25617] 10:12:46.382285 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.382324 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25617] 10:12:46.382373 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf855000
[pid 25617] 10:12:46.382420 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bcbb5000
[pid 25617] 10:12:46.382456 mprotect(0x7f07bcbe1000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.382500 mmap(0x7f07bcde1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f07bcde1000
[pid 25617] 10:12:46.382541 close(6)    = 0
[pid 25617] 10:12:46.382579 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.382670 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.382710 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25617] 10:12:46.382755 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bc9b0000
[pid 25617] 10:12:46.382795 mprotect(0x7f07bc9b5000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.382830 mmap(0x7f07bcbb4000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f07bcbb4000
[pid 25617] 10:12:46.382871 close(6)    = 0
[pid 25617] 10:12:46.382911 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.382951 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.382990 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383030 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25617] 10:12:46.383066 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.383104 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25617] 10:12:46.383153 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bc7ad000
[pid 25617] 10:12:46.383190 mprotect(0x7f07bc7af000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.383224 mmap(0x7f07bc9ae000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f07bc9ae000
[pid 25617] 10:12:46.383267 close(6)    = 0
[pid 25617] 10:12:46.383307 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383348 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383401 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383451 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.383492 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.383530 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25617] 10:12:46.383574 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf854000
[pid 25617] 10:12:46.383612 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bc58a000
[pid 25617] 10:12:46.383648 mprotect(0x7f07bc5a1000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.383682 mmap(0x7f07bc7a1000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f07bc7a1000
[pid 25617] 10:12:46.383726 close(6)    = 0
[pid 25617] 10:12:46.383779 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383912 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383955 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.383995 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.384034 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.384072 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.384116 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bc346000
[pid 25617] 10:12:46.384153 mprotect(0x7f07bc387000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.384187 mmap(0x7f07bc587000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f07bc587000
[pid 25617] 10:12:46.384231 close(6)    = 0
[pid 25617] 10:12:46.384277 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384320 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384360 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384420 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25617] 10:12:46.384474 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.384513 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.384558 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf853000
[pid 25617] 10:12:46.384599 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bc05f000
[pid 25617] 10:12:46.384637 mprotect(0x7f07bc13a000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.384671 mmap(0x7f07bc33a000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f07bc33a000
[pid 25617] 10:12:46.384714 close(6)    = 0
[pid 25617] 10:12:46.384755 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384867 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384913 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.384952 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25617] 10:12:46.384990 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.385028 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.385072 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bbe5b000
[pid 25617] 10:12:46.385110 mprotect(0x7f07bbe5e000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.385144 mmap(0x7f07bc05d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f07bc05d000
[pid 25617] 10:12:46.385188 close(6)    = 0
[pid 25617] 10:12:46.385234 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385275 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385315 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385360 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25617] 10:12:46.385412 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.385464 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.385509 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bbc2f000
[pid 25617] 10:12:46.385546 mprotect(0x7f07bbc58000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.385579 mmap(0x7f07bbe58000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f07bbe58000
[pid 25617] 10:12:46.385619 mmap(0x7f07bbe5a000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bbe5a000
[pid 25617] 10:12:46.385659 close(6)    = 0
[pid 25617] 10:12:46.385700 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385741 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385780 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.385900 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.385941 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.385980 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25617] 10:12:46.386024 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf852000
[pid 25617] 10:12:46.386062 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bba19000
[pid 25617] 10:12:46.386099 mprotect(0x7f07bba2e000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.386133 mmap(0x7f07bbc2d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f07bbc2d000
[pid 25617] 10:12:46.386177 close(6)    = 0
[pid 25617] 10:12:46.386224 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386265 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386305 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386345 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25617] 10:12:46.386393 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.386454 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25617] 10:12:46.386503 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bb80e000
[pid 25617] 10:12:46.386540 mprotect(0x7f07bb818000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.386574 mmap(0x7f07bba17000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f07bba17000
[pid 25617] 10:12:46.386619 close(6)    = 0
[pid 25617] 10:12:46.386661 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386701 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386740 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.386778 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.386870 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.386909 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25617] 10:12:46.386954 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bb60b000
[pid 25617] 10:12:46.386991 mprotect(0x7f07bb60d000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.387025 mmap(0x7f07bb80c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f07bb80c000
[pid 25617] 10:12:46.387067 close(6)    = 0
[pid 25617] 10:12:46.387106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf851000
[pid 25617] 10:12:46.387157 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.387198 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.387240 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.387279 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25617] 10:12:46.387318 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.387355 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25617] 10:12:46.387429 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f07bb3ec000
[pid 25617] 10:12:46.387477 mprotect(0x7f07bb409000, 2093056, PROT_NONE) = 0
[pid 25617] 10:12:46.387511 mmap(0x7f07bb608000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f07bb608000
[pid 25617] 10:12:46.387551 mmap(0x7f07bb60a000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f07bb60a000
[pid 25617] 10:12:46.387592 close(6)    = 0
[pid 25617] 10:12:46.387658 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf850000
[pid 25617] 10:12:46.387728 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf84f000
[pid 25617] 10:12:46.387770 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf84d000
[pid 25617] 10:12:46.387856 arch_prctl(ARCH_SET_FS, 0x7f07bf84d7c0) = 0
[pid 25617] 10:12:46.387925 mprotect(0x7f07bb608000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.387964 mprotect(0x7f07bb80c000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388019 mprotect(0x7f07bba17000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388063 mprotect(0x7f07bbc2d000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388108 mprotect(0x7f07bbe58000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388150 mprotect(0x7f07bc05d000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388285 mprotect(0x7f07bc33a000, 40960, PROT_READ) = 0
[pid 25617] 10:12:46.388414 mprotect(0x7f07bc587000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388465 mprotect(0x7f07bc7a1000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388509 mprotect(0x7f07bc9ae000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.388723 mprotect(0x7f07bd19a000, 110592, PROT_READ) = 0
[pid 25617] 10:12:46.388869 mprotect(0x7f07bd426000, 16384, PROT_READ) = 0
[pid 25617] 10:12:46.388992 mprotect(0x7f07bd7bb000, 16384, PROT_READ) = 0
[pid 25617] 10:12:46.389041 mprotect(0x7f07bd9c6000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389083 mprotect(0x7f07bdbca000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389736 mprotect(0x7f07be922000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389844 mprotect(0x7f07bed57000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389890 mprotect(0x7f07befdb000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389928 mprotect(0x7f07bf1e4000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.389977 mprotect(0x7f07bf429000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.390020 mprotect(0x7f07bf643000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.390077 mprotect(0x7f07bf866000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.390112 munmap(0x7f07bf85b000, 39387) = 0
[pid 25617] 10:12:46.390152 set_tid_address(0x7f07bf84da90) = 25617
[pid 25617] 10:12:46.390183 set_robust_list(0x7f07bf84daa0, 24) = 0
[pid 25617] 10:12:46.390213 futex(0x7ffc0fcf679c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25617] 10:12:46.390246 futex(0x7ffc0fcf679c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f07bf84d7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25617] 10:12:46.390285 rt_sigaction(SIGRTMIN, {0x7f07be710c60, [], SA_RESTORER|SA_SIGINFO, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.390326 rt_sigaction(SIGRT_1, {0x7f07be710cf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.390361 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25617] 10:12:46.390416 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25617] 10:12:46.390499 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350295, f_bavail=6350295, f_files=1000000, f_ffree=691068, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25617] 10:12:46.390606 brk(0)      = 0x14ab000
[pid 25617] 10:12:46.390640 brk(0x14cc000) = 0x14cc000
[pid 25617] 10:12:46.390682 open("/proc/filesystems", O_RDONLY) = 6
[pid 25617] 10:12:46.390747 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.390863 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf864000
[pid 25617] 10:12:46.390904 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25617] 10:12:46.391016 read(6, "", 1024) = 0
[pid 25617] 10:12:46.391055 close(6)    = 0
[pid 25617] 10:12:46.391091 munmap(0x7f07bf864000, 4096) = 0
[pid 25617] 10:12:46.391171 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.391281 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.391330 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25617] 10:12:46.391420 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.391470 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25617] 10:12:46.391512 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25617] 10:12:46.391558 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.391601 umask(0)    = 0
[pid 25617] 10:12:46.391671 geteuid()   = 0
[pid 25617] 10:12:46.391706 getuid()    = 47
[pid 25617] 10:12:46.391737 getgid()    = 12
[pid 25617] 10:12:46.391878 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25617] 10:12:46.391920 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25617] 10:12:46.391954 getgroups(65536, []) = 0
[pid 25617] 10:12:46.391989 setgroups(0, []) = 0
[pid 25617] 10:12:46.392024 getegid()   = 12
[pid 25617] 10:12:46.392060 geteuid()   = 0
[pid 25617] 10:12:46.392096 geteuid()   = 0
[pid 25617] 10:12:46.392126 getegid()   = 12
[pid 25617] 10:12:46.392158 setgid(12)  = 0
[pid 25617] 10:12:46.392191 setuid(0)   = 0
[pid 25617] 10:12:46.392258 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25617] 10:12:46.392312 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25617] 10:12:46.392364 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25617] 10:12:46.392407 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf864000
[pid 25617] 10:12:46.392442 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25617] 10:12:46.392579 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25617] 10:12:46.392626 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.392701 close(7)    = 0
[pid 25617] 10:12:46.392736 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25617] 10:12:46.392770 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.392892 close(7)    = 0
[pid 25617] 10:12:46.392935 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25617] 10:12:46.392976 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25617] 10:12:46.393022 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.393057 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25617] 10:12:46.393113 read(7, "", 4096) = 0
[pid 25617] 10:12:46.393147 close(7)    = 0
[pid 25617] 10:12:46.393179 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.393226 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.393275 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.393322 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.393361 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25617] 10:12:46.393396 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25617] 10:12:46.393440 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f07bf843000
[pid 25617] 10:12:46.393475 close(7)    = 0
[pid 25617] 10:12:46.393515 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25617] 10:12:46.393554 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25617] 10:12:46.393593 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25617] 10:12:46.393640 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f07bb1de000
[pid 25617] 10:12:46.393680 mprotect(0x7f07bb1ea000, 2097152, PROT_NONE) = 0
[pid 25617] 10:12:46.393724 mmap(0x7f07bb3ea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f07bb3ea000
[pid 25617] 10:12:46.393769 close(7)    = 0
[pid 25617] 10:12:46.393898 mprotect(0x7f07bb3ea000, 4096, PROT_READ) = 0
[pid 25617] 10:12:46.393941 munmap(0x7f07bf843000, 39387) = 0
[pid 25617] 10:12:46.393985 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25617] 10:12:46.394029 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25617] 10:12:46.394065 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.394109 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.394143 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.394205 close(7)    = 0
[pid 25617] 10:12:46.394240 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.394300 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25617] 10:12:46.394341 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.394383 close(7)    = 0
[pid 25617] 10:12:46.394417 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25617] 10:12:46.394450 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.394488 close(7)    = 0
[pid 25617] 10:12:46.394525 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25617] 10:12:46.394563 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25617] 10:12:46.394613 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.394648 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25617] 10:12:46.394699 close(7)    = 0
[pid 25617] 10:12:46.394733 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.394783 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25617] 10:12:46.394924 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25617] 10:12:46.394967 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.395011 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.395046 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.395087 close(7)    = 0
[pid 25617] 10:12:46.395119 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.395160 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25617] 10:12:46.395223 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25617] 10:12:46.395284 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, 8) = 0
[pid 25617] 10:12:46.395340 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f07bf84da90) = 25618
[pid 25617] 10:12:46.395581 wait4(25618, Process 25618 attached
 <unfinished ...>
[pid 25618] 10:12:46.395646 set_robust_list(0x7f07bf84daa0, 24) = 0
[pid 25618] 10:12:46.395698 geteuid()   = 0
[pid 25618] 10:12:46.395735 geteuid()   = 0
[pid 25618] 10:12:46.395767 getegid()   = 12
[pid 25618] 10:12:46.395868 setgid(12)  = 0
[pid 25618] 10:12:46.395913 setuid(47)  = 0
[pid 25618] 10:12:46.397515 brk(0x14ed000) = 0x14ed000
[pid 25618] 10:12:46.397928 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25618] 10:12:46.397988 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25618] 10:12:46.398041 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25618] 10:12:46.398084 read(7, "]\371\27\26`O\210\323\327\207\365\256B\200\223\212\351~\3416)\336E\313\274\333o\363VV\263v\177\361\250Uf\321g\5\256{\363\233J\325\26\232", 48) = 48
[pid 25618] 10:12:46.398125 close(7)    = 0
[pid 25618] 10:12:46.398174 getuid()    = 47
[pid 25618] 10:12:46.398347 exit_group(0) = ?
[pid 25618] 10:12:46.398536 +++ exited with 0 +++
[pid 25617] 10:12:46.398578 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25618
[pid 25617] 10:12:46.398603 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, 8) = 0
[pid 25617] 10:12:46.398663 getcwd("/var/spool/exim", 16380) = 16
[pid 25617] 10:12:46.398735 open("/etc/localtime", O_RDONLY) = 7
[pid 25617] 10:12:46.398775 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.398883 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.398932 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.398968 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25617] 10:12:46.399016 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25617] 10:12:46.399049 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25617] 10:12:46.399097 close(7)    = 0
[pid 25617] 10:12:46.399131 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.399180 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25617] 10:12:46.399227 fcntl(7, F_GETFD) = 0
[pid 25617] 10:12:46.399259 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25617] 10:12:46.399290 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400503, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.399342 write(7, "2015-12-30 10:12:46 [25617] cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1aEJMa-0006dB-67\n", 108) = 108
[pid 25617] 10:12:46.399390 chdir("/var/spool/exim") = 0
[pid 25617] 10:12:46.399447 geteuid()   = 0
[pid 25617] 10:12:46.399479 getegid()   = 12
[pid 25617] 10:12:46.399519 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.399566 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.399611 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.399646 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.399692 close(8)    = 0
[pid 25617] 10:12:46.399725 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.399764 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 8
[pid 25617] 10:12:46.399816 read(8, "65536\n", 31) = 6
[pid 25617] 10:12:46.399852 close(8)    = 0
[pid 25617] 10:12:46.399888 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.399928 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25617] 10:12:46.399972 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.400006 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.400047 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25617] 10:12:46.400097 read(8, "", 4096) = 0
[pid 25617] 10:12:46.400132 close(8)    = 0
[pid 25617] 10:12:46.400165 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.400201 setgroups(1, [12]) = 0
[pid 25617] 10:12:46.400237 setgid(12)  = 0
[pid 25617] 10:12:46.400268 setuid(47)  = 0
[pid 25617] 10:12:46.400326 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25617] 10:12:46.400408 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25617] 10:12:46.400490 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25617] 10:12:46.400590 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25617] 10:12:46.400673 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25617] 10:12:46.400769 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25617] 10:12:46.400888 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25617] 10:12:46.400959 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.401001 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.401047 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.401082 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.401128 close(8)    = 0
[pid 25617] 10:12:46.401313 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.401419 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25617] 10:12:46.401516 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25617] 10:12:46.401643 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25617] 10:12:46.401765 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25617] 10:12:46.401889 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25617] 10:12:46.401949 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.401991 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.402037 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.402073 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.402127 close(8)    = 0
[pid 25617] 10:12:46.402161 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.402207 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.402246 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25617] 10:12:46.402291 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.402327 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25617] 10:12:46.402376 close(8)    = 0
[pid 25617] 10:12:46.402410 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.402466 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.402506 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25617] 10:12:46.402631 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.402670 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25617] 10:12:46.402718 close(8)    = 0
[pid 25617] 10:12:46.402750 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.402857 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25617] 10:12:46.402986 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25617] 10:12:46.403095 read(6, "", 4096) = 0
[pid 25617] 10:12:46.403133 read(6, "", 4096) = 0
[pid 25617] 10:12:46.403167 close(6)    = 0
[pid 25617] 10:12:46.403200 munmap(0x7f07bf864000, 4096) = 0
[pid 25617] 10:12:46.403239 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6
[pid 25617] 10:12:46.403278 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.403324 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf864000
[pid 25617] 10:12:46.403359 read(6, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.403403 close(6)    = 0
[pid 25617] 10:12:46.403436 munmap(0x7f07bf864000, 4096) = 0
[pid 25617] 10:12:46.403479 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25617] 10:12:46.403612 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.403676 rt_sigaction(SIGTERM, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25617] 10:12:46.403717 rt_sigaction(SIGINT, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25617] 10:12:46.403756 fstat(0, {st_dev=makedev(0, 8), st_ino=2130179691, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.403806 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf864000
[pid 25617] 10:12:46.403842 read(0, "X-Failed-Recipients: finest09@fin.finestweddingsites.com\nAuto-Submitted: auto-replied\nFrom: Mail Delivery System <Mailer-Daemon@fin.finestweddingsites.com>\nTo: finest09@fin.finestweddingsites.com\nContent-Type: multipart/report; report-type=delivery-status;"..., 4096) = 3507
[pid 25617] 10:12:46.403928 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.403994 open("/var/spool/exim/input/k/1aEJMk-0006fB-D1-D", O_RDWR|O_CREAT|O_EXCL, 0640) = 6
[pid 25617] 10:12:46.404092 fchown(6, 47, 12) = 0
[pid 25617] 10:12:46.404181 fchmod(6, 0640) = 0
[pid 25617] 10:12:46.404242 fcntl(6, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25617] 10:12:46.404277 fstat(6, {st_dev=makedev(144, 4215), st_ino=116657784, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.404323 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf863000
[pid 25617] 10:12:46.404358 lseek(6, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.404390 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25617] 10:12:46.404508 read(0, "", 4096) = 0
[pid 25617] 10:12:46.404613 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.404662 write(6, "1aEJMk-0006fB-D1-D\n--1451491966-eximdsn-2049216250\nContent-type: text/plain; charset=us-ascii\n\nThis message was created automatically by mail delivery software.\n\nA message that you sent could not be delivered to one or more of its\nrecipients. This is a per"..., 3152) = 3152
[pid 25617] 10:12:46.404711 fsync(6)    = 0
[pid 25617] 10:12:46.405213 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.405305 fstat(6, {st_dev=makedev(144, 4215), st_ino=116657784, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3152, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.405447 brk(0x14ed000) = 0x14ed000
[pid 25617] 10:12:46.405512 getuid()    = 47
[pid 25617] 10:12:46.405609 geteuid()   = 47
[pid 25617] 10:12:46.405646 getgid()    = 12
[pid 25617] 10:12:46.405685 getegid()   = 12
[pid 25617] 10:12:46.405783 open("/dev/urandom", O_RDONLY) = 8
[pid 25617] 10:12:46.405834 read(8, "\341a\37\275", 4) = 4
[pid 25617] 10:12:46.405871 close(8)    = 0
[pid 25617] 10:12:46.405988 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25617] 10:12:46.406106 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1a30) = -1 EINVAL (Invalid argument)
[pid 25617] 10:12:46.406151 lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
[pid 25617] 10:12:46.406187 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1a30) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.406228 lseek(1, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.406261 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1a40) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.406296 lseek(2, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.406333 open("/dev/null", O_RDONLY) = 8
[pid 25617] 10:12:46.406374 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1b10) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.406408 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.406441 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25617] 10:12:46.406475 rt_sigaction(SIGCHLD, NULL, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f07be71a790}, 8) = 0
[pid 25617] 10:12:46.406514 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, {SIG_IGN, [], SA_RESTORER|SA_NOCLDWAIT, 0x7f07be71a790}, 8) = 0
[pid 25617] 10:12:46.406862 read(8, "", 8192) = 0
[pid 25617] 10:12:46.406910 close(8)    = 0
[pid 25617] 10:12:46.407127 brk(0x150e000) = 0x150e000
[pid 25617] 10:12:46.407269 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25617] 10:12:46.407332 open("/etc/exim.pl", O_RDONLY) = 8
[pid 25617] 10:12:46.407371 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.407407 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.407458 read(8, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25617] 10:12:46.408513 brk(0x152f000) = 0x152f000
[pid 25617] 10:12:46.408751 read(8, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25617] 10:12:46.409728 brk(0x1550000) = 0x1550000
[pid 25617] 10:12:46.410067 read(8, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25617] 10:12:46.410979 brk(0x1571000) = 0x1571000
[pid 25617] 10:12:46.411253 read(8, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25617] 10:12:46.411611 read(8, "", 8192) = 0
[pid 25617] 10:12:46.411661 close(8)    = 0
[pid 25617] 10:12:46.411714 stat("/usr/share/amavis/amavis-filter", 0x7f07bdf01880) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.411761 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25617] 10:12:46.411819 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25617] 10:12:46.411867 open("/etc/exim.pl.local", O_RDONLY) = 8
[pid 25617] 10:12:46.411906 ioctl(8, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1940) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.411948 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.411997 read(8, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25617] 10:12:46.412420 stat("/etc/exim/perl/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412472 stat("/etc/exim/perl/warnings.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412511 stat("/usr/local/cpanel/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412630 stat("/usr/local/cpanel/warnings.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412675 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412723 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412764 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412806 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412848 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412889 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412929 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.412968 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.413021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 9
[pid 25617] 10:12:46.413064 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.413099 lseek(9, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.413141 brk(0x1592000) = 0x1592000
[pid 25617] 10:12:46.413188 read(9, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25617] 10:12:46.413510 read(9, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25617] 10:12:46.414288 read(9, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25617] 10:12:46.414423 brk(0x15b3000) = 0x15b3000
[pid 25617] 10:12:46.414848 read(9, "", 8192) = 0
[pid 25617] 10:12:46.414897 close(9)    = 0
[pid 25617] 10:12:46.415640 read(8, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25617] 10:12:46.416377 read(8, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25617] 10:12:46.417148 read(8, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25617] 10:12:46.417828 read(8, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25617] 10:12:46.418035 brk(0x15d4000) = 0x15d4000
[pid 25617] 10:12:46.418498 read(8, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25617] 10:12:46.419314 brk(0x15f5000) = 0x15f5000
[pid 25617] 10:12:46.419506 read(8, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25617] 10:12:46.420109 read(8, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25617] 10:12:46.420683 brk(0x1616000) = 0x1616000
[pid 25617] 10:12:46.420853 read(8, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25617] 10:12:46.421489 read(8, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25617] 10:12:46.422011 brk(0x1637000) = 0x1637000
[pid 25617] 10:12:46.422340 stat("/usr/local/cpanel/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422403 stat("/usr/local/cpanel/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422452 stat("/etc/exim/perl/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422499 stat("/etc/exim/perl/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422585 stat("/usr/local/cpanel/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422632 stat("/usr/local/cpanel/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422670 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422713 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422754 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422806 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422849 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422889 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422929 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.422967 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.423021 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 9
[pid 25617] 10:12:46.423064 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.423100 lseek(9, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.423152 read(9, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25617] 10:12:46.423368 lseek(9, 878, SEEK_SET) = 878
[pid 25617] 10:12:46.423425 lseek(9, 0, SEEK_CUR) = 878
[pid 25617] 10:12:46.423467 close(9)    = 0
[pid 25617] 10:12:46.423783 read(8, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25617] 10:12:46.424353 read(8, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25617] 10:12:46.424525 brk(0x1658000) = 0x1658000
[pid 25617] 10:12:46.425660 read(8, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25617] 10:12:46.425904 brk(0x1679000) = 0x1679000
[pid 25617] 10:12:46.427061 read(8, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25617] 10:12:46.427196 brk(0x169a000) = 0x169a000
[pid 25617] 10:12:46.428034 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428094 stat("/usr/local/cpanel/Errno.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428136 stat("/etc/exim/perl/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428173 stat("/etc/exim/perl/Errno.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428210 stat("/usr/local/cpanel/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428246 stat("/usr/local/cpanel/Errno.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428291 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428335 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428376 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428415 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428454 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.428494 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25617] 10:12:46.428617 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 9
[pid 25617] 10:12:46.428665 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.428701 lseek(9, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.428755 read(9, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25617] 10:12:46.428955 brk(0x16bb000) = 0x16bb000
[pid 25617] 10:12:46.429382 lseek(9, 4868, SEEK_SET) = 4868
[pid 25617] 10:12:46.429429 lseek(9, 0, SEEK_CUR) = 4868
[pid 25617] 10:12:46.429461 close(9)    = 0
[pid 25617] 10:12:46.429508 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429609 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429656 stat("/etc/exim/perl/Exporter.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429692 stat("/etc/exim/perl/Exporter.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429728 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429763 stat("/usr/local/cpanel/Exporter.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429800 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429839 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffc0fcb1560) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429880 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffc0fcb1600) = -1 ENOENT (No such file or directory)
[pid 25617] 10:12:46.429918 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25617] 10:12:46.429972 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 9
[pid 25617] 10:12:46.430014 ioctl(9, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffc0fcb1350) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25617] 10:12:46.430049 lseek(9, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.430100 read(9, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25617] 10:12:46.430608 lseek(9, 2366, SEEK_SET) = 2366
[pid 25617] 10:12:46.430658 lseek(9, 0, SEEK_CUR) = 2366
[pid 25617] 10:12:46.430691 close(9)    = 0
[pid 25617] 10:12:46.431052 read(8, "", 8192) = 0
[pid 25617] 10:12:46.431100 close(8)    = 0
[pid 25617] 10:12:46.431304 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25617] 10:12:46.431356 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25617] 10:12:46.431403 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf862000
[pid 25617] 10:12:46.431440 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25617] 10:12:46.431487 close(8)    = 0
[pid 25617] 10:12:46.431521 munmap(0x7f07bf862000, 4096) = 0
[pid 25617] 10:12:46.431662 lseek(6, 19, SEEK_SET) = 19
[pid 25617] 10:12:46.431701 rt_sigaction(SIGSEGV, {0x475d35, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431740 rt_sigaction(SIGFPE, {0x475d35, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431774 rt_sigaction(SIGILL, {0x475d35, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431807 rt_sigaction(SIGBUS, {0x475d35, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431841 rt_sigaction(SIGALRM, {0x475cf2, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431876 alarm(300)  = 0
[pid 25617] 10:12:46.431910 alarm(0)    = 300
[pid 25617] 10:12:46.431940 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.431974 rt_sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.432007 rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.432040 rt_sigaction(SIGILL, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.432073 rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f07be71a790}, NULL, 8) = 0
[pid 25617] 10:12:46.432107 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {0x475d7e, [TERM], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, 8) = 0
[pid 25617] 10:12:46.432144 rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {0x475d7e, [INT], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, 8) = 0
[pid 25617] 10:12:46.432186 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.432245 open("/var/spool/exim/input/k/hdr.25617", O_RDWR|O_CREAT|O_EXCL, 0640) = 8
[pid 25617] 10:12:46.432326 fchown(8, 47, 12) = 0
[pid 25617] 10:12:46.432363 fchmod(8, 0640) = 0
[pid 25617] 10:12:46.432400 fcntl(8, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25617] 10:12:46.432438 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662260, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.432489 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf862000
[pid 25617] 10:12:46.432533 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.432652 write(8, "1aEJMk-0006fB-D1-H\nmailnull 47 12\n<>\n1451491966 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25617] 10:12:46.432706 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662260, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.432756 write(8, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMk-0006fB-D1\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:46 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25617] 10:12:46.432794 fsync(8)    = 0
[pid 25617] 10:12:46.433271 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662260, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.433321 close(8)    = 0
[pid 25617] 10:12:46.433355 munmap(0x7f07bf862000, 4096) = 0
[pid 25617] 10:12:46.433404 rename("/var/spool/exim/input/k/hdr.25617", "/var/spool/exim/input/k/1aEJMk-0006fB-D1-H") = 0
[pid 25617] 10:12:46.433473 open("/var/spool/exim/input/k/.", O_RDONLY|O_DIRECTORY) = 8
[pid 25617] 10:12:46.433513 fsync(8)    = 0
[pid 25617] 10:12:46.433610 close(8)    = 0
[pid 25617] 10:12:46.433649 fstat(6, {st_dev=makedev(144, 4215), st_ino=116657784, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3152, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.433707 open("/var/spool/exim/msglog/k/1aEJMk-0006fB-D1", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25617] 10:12:46.433782 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25617] 10:12:46.433817 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662262, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.433861 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f07bf862000
[pid 25617] 10:12:46.433896 lseek(8, 0, SEEK_CUR) = 0
[pid 25617] 10:12:46.433929 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.433983 write(8, "2015-12-30 10:12:46 Received from <> R=1aEJMa-0006dB-67 U=mailnull P=local S=3776 M8S=0 T=\"Mail delivery failed: returning message to sender\"\n", 142) = 142
[pid 25617] 10:12:46.434026 close(8)    = 0
[pid 25617] 10:12:46.434059 munmap(0x7f07bf862000, 4096) = 0
[pid 25617] 10:12:46.434096 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.434151 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25617] 10:12:46.434199 close(7)    = 0
[pid 25617] 10:12:46.434235 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25617] 10:12:46.434276 fcntl(7, F_GETFD) = 0
[pid 25617] 10:12:46.434307 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25617] 10:12:46.434339 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400611, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25617] 10:12:46.434387 write(7, "2015-12-30 10:12:46 [25617] 1aEJMk-0006fB-D1 <= <> R=1aEJMa-0006dB-67 U=mailnull P=local S=3776 M8S=0 T=\"Mail delivery failed: returning message to sender\" from <> for finest09@fin.finestweddingsites.com\n", 204) = 204
[pid 25617] 10:12:46.434429 close(6)    = 0
[pid 25617] 10:12:46.434464 munmap(0x7f07bf863000, 4096) = 0
[pid 25617] 10:12:46.434499 rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, 8) = 0
[pid 25617] 10:12:46.434617 rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f07bd4636a0}, 8) = 0
[pid 25617] 10:12:46.434664 open("/proc/loadavg", O_RDONLY) = 6
[pid 25617] 10:12:46.434713 read(6, "0.37 0.13 0.03 1/243 25618\n", 40) = 27
[pid 25617] 10:12:46.434752 close(6)    = 0
[pid 25617] 10:12:46.434798 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f07bf84da90) = 25619
[pid 25617] 10:12:46.435331 exit_group(0) = ?
[pid 25617] 10:12:46.435655 +++ exited with 0 +++
[pid 25502] 10:12:46.435693 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25617
[pid 25502] 10:12:46.435719 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f3c09a4c6a0}, 8) = 0
[pid 25502] 10:12:46.435772 write(8, "2015-12-30 10:12:46 westernsky@finestweddingsites.com: children all complete\n", 77) = 77
[pid 25502] 10:12:46.435819 open("/var/spool/exim/input/a/hdr.25502", O_RDWR|O_CREAT|O_EXCL, 0640) = 10
[pid 25502] 10:12:46.435890 fchown(10, 47, 12) = 0
[pid 25502] 10:12:46.435927 fchmod(10, 0640) = 0
[pid 25502] 10:12:46.435962 fcntl(10, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25502] 10:12:46.435999 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25502] 10:12:46.436046 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c0be4c000
[pid 25502] 10:12:46.436082 lseek(10, 0, SEEK_CUR) = 0
[pid 25502] 10:12:46.436128 write(10, "1aEJMa-0006dB-67-H\nfinest09 503 499\n<finest09@fin.finestweddingsites.com>\n1451491956 0\n-ident finest09\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 1857\n-auth_id finest09\n-auth_sender finest09@fin.finestweddingsites.com\n-allow_unqual"..., 720) = 720
[pid 25502] 10:12:46.436175 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=720, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25502] 10:12:46.436224 write(10, "186P Received: from finest09 by fin.finestweddingsites.com with local (Exim 4.86)\n\t(envelope-from <finest09@fin.finestweddingsites.com>)\n\tid 1aEJMa-0006dB-67; Wed, 30 Dec 2015 10:12:36 -0600\n070T To:  ljacques@westernskiesgolf.com, westernsky@finestwedding"..., 553) = 553
[pid 25502] 10:12:46.436268 fsync(10Process 25619 attached
 <unfinished ...>
[pid 25619] 10:12:46.436412 set_robust_list(0x7f07bf84daa0, 24) = 0
[pid 25619] 10:12:46.436521 close(0)    = 0
[pid 25619] 10:12:46.436630 close(1)    = 0
[pid 25502] 10:12:46.436662 <... fsync resumed> ) = 0
[pid 25502] 10:12:46.436681 fstat(10, {st_dev=makedev(144, 4215), st_ino=125064864, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=1273, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25502] 10:12:46.436728 close(10)   = 0
[pid 25502] 10:12:46.436762 munmap(0x7f3c0be4c000, 4096) = 0
[pid 25502] 10:12:46.436804 rename("/var/spool/exim/input/a/hdr.25502", "/var/spool/exim/input/a/1aEJMa-0006dB-67-H") = 0
[pid 25502] 10:12:46.436897 open("/var/spool/exim/input/a/.", O_RDONLY|O_DIRECTORY) = 10
[pid 25502] 10:12:46.436940 fsync(10)   = 0
[pid 25502] 10:12:46.436973 close(10)   = 0
[pid 25502] 10:12:46.437011 unlink("/var/spool/exim/msglog/a/1aEJMa-0006dB-67") = 0
[pid 25502] 10:12:46.437062 unlink("/var/spool/exim/input/a/1aEJMa-0006dB-67-D") = 0
[pid 25502] 10:12:46.437108 unlink("/var/spool/exim/input/a/1aEJMa-0006dB-67-H") = 0
[pid 25502] 10:12:46.437175 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.437236 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25502] 10:12:46.437288 close(7)    = 0
[pid 25502] 10:12:46.437326 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25502] 10:12:46.437368 fcntl(7, F_GETFD) = 0
[pid 25502] 10:12:46.437406 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25502] 10:12:46.437447 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400815, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25502] 10:12:46.437493 write(7, "2015-12-30 10:12:46 [25502] 1aEJMa-0006dB-67 Completed QT=10s\n", 62) = 62
[pid 25502] 10:12:46.437536 close(8)    = 0
[pid 25502] 10:12:46.437657 munmap(0x7f3c0be4d000, 4096) = 0
[pid 25502] 10:12:46.437694 close(9)    = 0
[pid 25502] 10:12:46.437731 unlink("/var/spool/exim/input/a/1aEJMa-0006dB-67-J") = 0
[pid 25502] 10:12:46.437796 close(6)    = 0
[pid 25502] 10:12:46.437969 exit_group(0) = ?
[pid 25502] 10:12:46.438591 +++ exited with 0 +++
[pid 25619] 10:12:46.438668 close(2)    = 0
[pid 25619] 10:12:46.438751 setsid()    = 25619
[pid 25619] 10:12:46.438789 fstat(0, 0x7ffc0fcb5e80) = -1 EBADF (Bad file descriptor)
[pid 25619] 10:12:46.438826 open("/dev/null", O_RDWR) = 0
[pid 25619] 10:12:46.438872 fstat(1, 0x7ffc0fcb5e80) = -1 EBADF (Bad file descriptor)
[pid 25619] 10:12:46.438911 dup2(0, 1)  = 1
[pid 25619] 10:12:46.438944 fstat(2, 0x7ffc0fcb5e80) = -1 EBADF (Bad file descriptor)
[pid 25619] 10:12:46.438975 dup2(0, 2)  = 2
[pid 25619] 10:12:46.439006 geteuid()   = 47
[pid 25619] 10:12:46.439044 fstat(0, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25619] 10:12:46.439091 fstat(1, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25619] 10:12:46.439133 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25619] 10:12:46.439181 execve("/usr/sbin/exim", ["/usr/sbin/exim", "-Mc", "1aEJMk-0006fB-D1"], ["SERVER_SIGNATURE=", "UNIQUE_ID=VoQCcTJ0Ts8AAEtYlI8AAAEK", "HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/537.86.3", "SERVER_PORT=80", "HTTP_ORIGIN=http://www.finestweddingsites.com", "HTTP_HOST=www.finestweddingsites.com", "DOCUMENT_ROOT=/home/finest09/public_html", "SCRIPT_FILENAME=/home/finest09/public_html/includes/contactmeactionsubmitemail.php", "REQUEST_URI=/includes/contactmeactionsubmitemail.php?nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question="..., "SCRIPT_NAME=/includes/contactmeactionsubmitemail.php", "HTTP_CONNECTION=keep-alive", "REMOTE_PORT=61266", "PATH=/bin:/usr/bin", "CONTEXT_PREFIX=", "PWD=/home/finest09/public_html/includes", "SERVER_ADMIN=webmaster@finestweddingsites.com", "REQUEST_SCHEME=http", "REDIRECT_STATUS=200", "HTTP_ACCEPT_LANGUAGE=en-us", "HTTP_REFERER=http://www.finestweddingsites.com/reception/style_moderately_priced_teri.php", "HTTP_ACCEPT=*/*", "REMOTE_ADDR=68.109.176.77", "SHLVL=1", "SERVER_NAME=www.finestweddingsites.com", "CONTENT_LENGTH=0", "SERVER_SOFTWARE=Apache/2.4.16 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4", "QUERY_STRING=nocache%20=%200.6358920990023762&first_name=Tyler%20rutt&email=Tylerrutt9@yahoo.com&wedding_date=March%2013%202016&dropvalue=email&phone_number=480-586-0868&guest_count=150-200&timetocall=&your_question=Your%20Question", "SERVER_ADDR=50.116.78.207", "GATEWAY_INTERFACE=CGI/1.1", "SERVER_PROTOCOL=HTTP/1.1", "HTTP_ACCEPT_ENCODING=gzip, deflate", "REQUEST_METHOD=POST", "HTTP_COOKIE=PHPSESSID=812e4c0ad5f0b22833796148c954da73; timezone=America/Phoenix; _ga=GA1.2.1648803037.1435099766; _gat=1", "CONTEXT_DOCUMENT_ROOT=/home/finest09/public_html", "_=/usr/sbin/sendmail", "X-SOURCE=/opt/php52/bin/php-cgi", "X-SOURCE-DIR=/home/finest09/public_html/includes", "X-SOURCE-ARGS=/opt/php52/bin/php-cgi /home/finest09/public_html/includes/contactmeactionsubmitemail.php "]) = 0
[pid 25619] 10:12:46.439838 brk(0)      = 0x205b000
[pid 25619] 10:12:46.439882 fcntl(0, F_GETFD) = 0
[pid 25619] 10:12:46.439914 fcntl(1, F_GETFD) = 0
[pid 25619] 10:12:46.439944 fcntl(2, F_GETFD) = 0
[pid 25619] 10:12:46.439979 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440032 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5223000
[pid 25619] 10:12:46.440081 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440129 open("/usr/local/cpanel/3rdparty/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440172 stat("/usr/local/cpanel/3rdparty/lib64/tls/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440209 open("/usr/local/cpanel/3rdparty/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440244 stat("/usr/local/cpanel/3rdparty/lib64/tls", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440280 open("/usr/local/cpanel/3rdparty/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440319 stat("/usr/local/cpanel/3rdparty/lib64/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440355 open("/usr/local/cpanel/3rdparty/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440392 stat("/usr/local/cpanel/3rdparty/lib64", {st_dev=makedev(144, 4215), st_ino=110110122, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:37, st_mtime=2015/12/22-09:42:00, st_ctime=2015/12/22-09:42:00}) = 0
[pid 25619] 10:12:46.440440 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440482 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440520 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440628 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/tls", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440668 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440714 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440752 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440790 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE", {st_dev=makedev(144, 4215), st_ino=110103448, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.440839 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440876 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440912 open("/usr/local/cpanel/3rdparty/perl/514/lib64/tls/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440948 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/tls", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.440984 open("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441021 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/x86_64", 0x7ffcd82ad810) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441057 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libresolv.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441094 stat("/usr/local/cpanel/3rdparty/perl/514/lib64", {st_dev=makedev(144, 4215), st_ino=110103172, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:38:36, st_mtime=2015/12/22-09:38:36, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.441143 open("/etc/ld.so.cache", O_RDONLY) = 6
[pid 25619] 10:12:46.441179 fstat(6, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25619] 10:12:46.441222 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f1fd5219000
[pid 25619] 10:12:46.441256 close(6)    = 0
[pid 25619] 10:12:46.441296 open("/lib64/libresolv.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.441338 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00009\0\0\0\0\0\0@\0\0\0\0\0\0\0\360\250\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\3608\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0dZ\1\0\0\0\0\0dZ\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300d\1\0\0\0\0\0\300d!\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.441378 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276864, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=110960, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.441426 mmap(NULL, 2202248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd4deb000
[pid 25619] 10:12:46.441462 mprotect(0x7f1fd4e01000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.441496 mmap(0x7f1fd5001000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16000) = 0x7f1fd5001000
[pid 25619] 10:12:46.441650 mmap(0x7f1fd5003000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5003000
[pid 25619] 10:12:46.441702 close(6)    = 0
[pid 25619] 10:12:46.441747 open("/usr/local/cpanel/3rdparty/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441789 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.441872 open("/lib64/libnsl.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.441911 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p@\0\0\0\0\0\0@\0\0\0\0\0\0\0\330\262\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\340.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\\\1\0\0\0\0\0\354\\\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0x]\1\0\0\0\0\0x]!\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.441949 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277190, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=113432, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.441994 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5218000
[pid 25619] 10:12:46.442031 mmap(NULL, 2198192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd4bd2000
[pid 25619] 10:12:46.442067 mprotect(0x7f1fd4be8000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.442102 mmap(0x7f1fd4de7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f1fd4de7000
[pid 25619] 10:12:46.442144 mmap(0x7f1fd4de9000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd4de9000
[pid 25619] 10:12:46.442185 close(6)    = 0
[pid 25619] 10:12:46.442223 open("/usr/local/cpanel/3rdparty/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442263 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442303 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypt.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442348 open("/lib64/libcrypt.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.442387 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\f\0\0\0\0\0\0@\0\0\0\0\0\0\0\220\225\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\340i\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|o\0\0\0\0\0\0|o\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270}\0\0\0\0\0\0\270} \0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.442424 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277066, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40400, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.442469 mmap(NULL, 2318816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd499b000
[pid 25619] 10:12:46.442504 mprotect(0x7f1fd49a2000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.442613 mmap(0x7f1fd4ba2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f1fd4ba2000
[pid 25619] 10:12:46.442663 mmap(0x7f1fd4ba4000, 184800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd4ba4000
[pid 25619] 10:12:46.442704 close(6)    = 0
[pid 25619] 10:12:46.442742 open("/usr/local/cpanel/3rdparty/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442783 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442830 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.442870 open("/lib64/libm.so.6", O_RDONLY) = 6
[pid 25619] 10:12:46.442908 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p>\0\0\0\0\0\0@\0\0\0\0\0\0\0000\20\t\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\260\304\7\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350&\10\0\0\0\0\0\350&\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310-\10\0\0\0\0\0\310-(\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.442947 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276826, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1168, st_size=596272, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.442991 mmap(NULL, 2633912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd4717000
[pid 25619] 10:12:46.443026 mprotect(0x7f1fd479a000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.443061 mmap(0x7f1fd4999000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x82000) = 0x7f1fd4999000
[pid 25619] 10:12:46.443104 close(6)    = 0
[pid 25619] 10:12:46.443142 open("/usr/local/cpanel/3rdparty/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.443183 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.443222 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpam.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.443262 open("/lib64/libpam.so.0", O_RDONLY) = 6
[pid 25619] 10:12:46.443299 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320#\0\0\0\0\0\0@\0\0\0\0\0\0\0(\323\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\275\0\0\0\0\0\0\204\275\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\314\0\0\0\0\0\0P\314 \0\0\0\0\0P\314 \0\0\0\0\0\274\5\0\0\0\0\0\0\320\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\320\315\0\0\0\0\0\0\320\315 \0\0\0\0\0\320\315 \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.443339 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277196, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=55848, st_atime=2015/08/18-09:26:42, st_mtime=2015/08/18-09:26:42, st_ctime=2015/12/22-09:33:13}) = 0
[pid 25619] 10:12:46.443383 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5217000
[pid 25619] 10:12:46.443430 mmap(NULL, 2150944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd4509000
[pid 25619] 10:12:46.443470 mprotect(0x7f1fd4515000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.443505 mmap(0x7f1fd4715000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f1fd4715000
[pid 25619] 10:12:46.443636 close(6)    = 0
[pid 25619] 10:12:46.443680 open("/usr/local/cpanel/3rdparty/lib64/libspf2.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.443723 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\\\0\0\0\0\0\0@\0\0\0\0\0\0\0()\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\t\2\0\0\0\0\0\f\t\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\20\2\0\0\0\0\0\0\20\"\0\0\0\0\0\0\20\"\0\0\0\0\0\0\30\0\0\0\0\0\0\30\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20!\2\0\0\0\0\0\20!\"\0\0\0\0\0\20!\"\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.443767 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=312, st_size=159210, st_atime=2015/09/16-09:03:26, st_mtime=2015/09/16-09:03:26, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25619] 10:12:46.443813 mmap(NULL, 2238488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd42e6000
[pid 25619] 10:12:46.443850 mprotect(0x7f1fd4307000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.443884 mmap(0x7f1fd4507000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x21000) = 0x7f1fd4507000
[pid 25619] 10:12:46.443924 close(6)    = 0
[pid 25619] 10:12:46.443961 open("/usr/local/cpanel/3rdparty/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444042 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444082 open("/lib64/libpthread.so.0", O_RDONLY) = 6
[pid 25619] 10:12:46.444120 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0@\0\0\0\0\0\0\0\260#\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0&\0%\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\260\30\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0pn\1\0\0\0\0\0pn\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220{\1\0\0\0\0\0\220{!\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.444158 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277194, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=142640, st_atime=2015/09/22-12:33:57, st_mtime=2015/09/22-12:33:57, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.444202 mmap(NULL, 2212848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd40c9000
[pid 25619] 10:12:46.444237 mprotect(0x7f1fd40e0000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.444270 mmap(0x7f1fd42e0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f1fd42e0000
[pid 25619] 10:12:46.444311 mmap(0x7f1fd42e2000, 13296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd42e2000
[pid 25619] 10:12:46.444353 close(6)    = 0
[pid 25619] 10:12:46.444397 open("/usr/local/cpanel/3rdparty/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444445 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444486 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdb-4.7.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444525 open("/lib64/libdb-4.7.so", O_RDONLY) = 6
[pid 25619] 10:12:46.444644 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\2\0\0\0\0\0@\0\0\0\0\0\0\0\2706\27\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\346\26\0\0\0\0\0L\346\26\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\346\26\0\0\0\0\0P\3466\0\0\0\0\0P\3466\0\0\0\0\0`O\0\0\0\0\0\0000S\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220\370\26\0\0\0\0\0\220\3706\0\0\0\0\0\220\3706\0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.444684 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280404, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2976, st_size=1523064, st_atime=2015/09/22-10:18:59, st_mtime=2015/09/22-10:18:59, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.444729 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5216000
[pid 25619] 10:12:46.444773 mmap(NULL, 3619200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd3d55000
[pid 25619] 10:12:46.444809 mprotect(0x7f1fd3ec4000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.444844 mmap(0x7f1fd40c3000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x16e000) = 0x7f1fd40c3000
[pid 25619] 10:12:46.444887 close(6)    = 0
[pid 25619] 10:12:46.444927 open("/usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.444968 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445008 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libsqlite3.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445047 open("/usr/lib64/libsqlite3.so.0", O_RDONLY) = 6
[pid 25619] 10:12:46.445087 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\212\0\0\0\0\0\0@\0\0\0\0\0\0\0\240\335\10\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\257\10\0\0\0\0\0\354\257\10\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\260\10\0\0\0\0\0\0\260(\0\0\0\0\0\0\260(\0\0\0\0\0\220,\0\0\0\0\0\0p2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\301\10\0\0\0\0\0x\301(\0\0\0\0\0x\301(\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.445124 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281784, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1144, st_size=582752, st_atime=2015/08/17-05:23:58, st_mtime=2015/08/17-05:23:58, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25619] 10:12:46.445169 mmap(NULL, 2679408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd3ac6000
[pid 25619] 10:12:46.445204 mprotect(0x7f1fd3b51000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.445239 mmap(0x7f1fd3d51000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8b000) = 0x7f1fd3d51000
[pid 25619] 10:12:46.445279 mmap(0x7f1fd3d54000, 624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd3d54000
[pid 25619] 10:12:46.445321 close(6)    = 0
[pid 25619] 10:12:46.445359 open("/usr/local/cpanel/3rdparty/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445399 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445440 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgdbm.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445494 open("/usr/lib64/libgdbm.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.445535 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\30\0\0\0\0\0\0@\0\0\0\0\0\0\0\340]\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234X\0\0\0\0\0\0\234X\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240X\0\0\0\0\0\0\240X \0\0\0\0\0\240X \0\0\0\0\0008\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220Y\0\0\0\0\0\0\220Y \0\0\0\0\0\220Y \0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.445655 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280502, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=25760, st_atime=2015/01/27-09:22:05, st_mtime=2015/01/27-09:22:05, st_ctime=2015/12/22-09:33:09}) = 0
[pid 25619] 10:12:46.445702 mmap(NULL, 2120992, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd38c0000
[pid 25619] 10:12:46.445738 mprotect(0x7f1fd38c6000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.445772 mmap(0x7f1fd3ac5000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f1fd3ac5000
[pid 25619] 10:12:46.445812 close(6)    = 0
[pid 25619] 10:12:46.445855 open("/usr/local/cpanel/3rdparty/lib64/libperl.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.445897 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libperl.so", O_RDONLY) = 6
[pid 25619] 10:12:46.445937 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240D\3\0\0\0\0\0@\0\0\0\0\0\0\0\30P\23\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\304\271\22\0\0\0\0\0\304\271\22\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\22\0\0\0\0\0\0\3002\0\0\0\0\0\0\3002\0\0\0\0\0\360\216\0\0\0\0\0\0\250\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`\361\22\0\0\0\0\0`\3612\0\0\0\0\0`\3612\0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.445975 fstat(6, {st_dev=makedev(144, 4215), st_ino=110107922, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1371869, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.446018 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5215000
[pid 25619] 10:12:46.446056 mmap(NULL, 3365800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd358a000
[pid 25619] 10:12:46.446091 mprotect(0x7f1fd36b6000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.446125 mmap(0x7f1fd38b6000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x12c000) = 0x7f1fd38b6000
[pid 25619] 10:12:46.446166 mmap(0x7f1fd38bf000, 2984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd38bf000
[pid 25619] 10:12:46.446207 close(6)    = 0
[pid 25619] 10:12:46.446244 open("/usr/local/cpanel/3rdparty/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446285 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446326 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446366 open("/lib64/libdl.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.446405 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\320C\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0P\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\37\0\0\0\0\0\0\360\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.446443 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277202, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19536, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.446495 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd3386000
[pid 25619] 10:12:46.446637 mprotect(0x7f1fd3388000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.446681 mmap(0x7f1fd3588000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f1fd3588000
[pid 25619] 10:12:46.446726 close(6)    = 0
[pid 25619] 10:12:46.446765 open("/usr/local/cpanel/3rdparty/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446806 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446846 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libutil.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.446885 open("/lib64/libutil.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.446929 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\2700\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\300\26\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\32\0\0\0\0\0\0\210\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.446967 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277058, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14584, st_atime=2015/09/22-12:33:55, st_mtime=2015/09/22-12:33:55, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.447013 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd3183000
[pid 25619] 10:12:46.447049 mprotect(0x7f1fd3185000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.447084 mmap(0x7f1fd3384000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f1fd3384000
[pid 25619] 10:12:46.447127 close(6)    = 0
[pid 25619] 10:12:46.447165 open("/usr/local/cpanel/3rdparty/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447206 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447245 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447284 open("/lib64/libc.so.6", O_RDONLY) = 6
[pid 25619] 10:12:46.447323 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0@\0\0\0\0\0\0\0(=\35\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0J\0I\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0p\247\25\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\233\30\0\0\0\0\0<\233\30\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\247\30\0\0\0\0\0\10\2478\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.447362 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276910, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3752, st_size=1920936, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.447412 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5214000
[pid 25619] 10:12:46.447461 mmap(NULL, 3750152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd2def000
[pid 25619] 10:12:46.447504 mprotect(0x7f1fd2f79000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.447613 mmap(0x7f1fd3179000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x18a000) = 0x7f1fd3179000
[pid 25619] 10:12:46.447663 mmap(0x7f1fd317e000, 18696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd317e000
[pid 25619] 10:12:46.447705 close(6)    = 0
[pid 25619] 10:12:46.447746 open("/usr/local/cpanel/3rdparty/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447788 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447828 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libssl.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.447867 open("/usr/lib64/libssl.so.10", O_RDONLY) = 6
[pid 25619] 10:12:46.447906 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203\1\0\0\0\0\0@\0\0\0\0\0\0\0\250\264\6\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\32\6\0\0\0\0\0L\32\6\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\33\6\0\0\0\0\0\330\33&\0\0\0\0\0\330\33&\0\0\0\0\0\270\227\0\0\0\0\0\0\360\230\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\350L\6\0\0\0\0\0\350L&\0\0\0\0\0\350L&\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.447950 fstat(6, {st_dev=makedev(144, 4215), st_ino=108280374, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=864, st_size=441256, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25619] 10:12:46.447995 mmap(NULL, 2536648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd2b83000
[pid 25619] 10:12:46.448031 mprotect(0x7f1fd2be5000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.448065 mmap(0x7f1fd2de4000, 45056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x61000) = 0x7f1fd2de4000
[pid 25619] 10:12:46.448108 close(6)    = 0
[pid 25619] 10:12:46.448149 open("/usr/local/cpanel/3rdparty/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448190 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448230 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcrypto.so.10", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448269 open("/usr/lib64/libcrypto.so.10", O_RDONLY) = 6
[pid 25619] 10:12:46.448308 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\234\6\0\0\0\0\0@\0\0\0\0\0\0\0 \356\35\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\207\33\0\0\0\0\0\f\207\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\210\33\0\0\0\0\0P\210;\0\0\0\0\0P\210;\0\0\0\0\0\260d\2\0\0\0\0\0(\247\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\260#\35\0\0\0\0\0\260#=\0\0\0\0\0\260#=\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.448347 fstat(6, {st_dev=makedev(144, 4215), st_ino=108281840, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3840, st_size=1963296, st_atime=2015/12/13-23:16:18, st_mtime=2015/12/13-23:16:18, st_ctime=2015/12/22-09:33:14}) = 0
[pid 25619] 10:12:46.448396 mmap(NULL, 4075384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd27a0000
[pid 25619] 10:12:46.448439 mprotect(0x7f1fd2959000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.448485 mmap(0x7f1fd2b58000, 159744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1b8000) = 0x7f1fd2b58000
[pid 25619] 10:12:46.448528 mmap(0x7f1fd2b7f000, 16248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd2b7f000
[pid 25619] 10:12:46.448664 close(6)    = 0
[pid 25619] 10:12:46.448706 open("/usr/local/cpanel/3rdparty/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448748 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448788 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libpcre.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.448828 open("/lib64/libpcre.so.0", O_RDONLY) = 6
[pid 25619] 10:12:46.448867 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\25\0\0\0\0\0\0@\0\0\0\0\0\0\0h\304\2\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\275\2\0\0\0\0\0,\275\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0\300\2\0\0\0\0\0\0\300\"\0\0\0\0\0\0\300\"\0\0\0\0\0`\3\0\0\0\0\0\0x\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0000\300\2\0\0\0\0\0000\300\"\0\0\0\0\0000\300\"\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.448905 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277166, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=360, st_size=183080, st_atime=2015/07/23-17:46:06, st_mtime=2015/07/23-17:46:06, st_ctime=2015/12/22-09:33:10}) = 0
[pid 25619] 10:12:46.448956 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5213000
[pid 25619] 10:12:46.448994 mmap(NULL, 2278264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd2573000
[pid 25619] 10:12:46.449031 mprotect(0x7f1fd259f000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.449066 mmap(0x7f1fd279f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2c000) = 0x7f1fd279f000
[pid 25619] 10:12:46.449107 close(6)    = 0
[pid 25619] 10:12:46.449143 open("/usr/local/cpanel/3rdparty/lib64/libsrs_alt.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.449186 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0@\0\0\0\0\0\0\0 Q\0\0\0\0\0\0\0\0\0\0@\0008\0\6\0@\0\35\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004K\0\0\0\0\0\0004K\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008K\0\0\0\0\0\0008K \0\0\0\0\0008K \0\0\0\0\0\230\4\0\0\0\0\0\0\250\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0hK\0\0\0\0\0\0hK \0\0\0\0\0hK \0\0\0\0\0\240\1\0\0\0\0\0\0\240\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.449224 fstat(6, {st_dev=makedev(144, 4215), st_ino=110117008, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26267, st_atime=2013/10/04-17:40:35, st_mtime=2013/10/04-17:40:35, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25619] 10:12:46.449269 mmap(NULL, 2117600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd236e000
[pid 25619] 10:12:46.449307 mprotect(0x7f1fd2373000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.449342 mmap(0x7f1fd2572000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f1fd2572000
[pid 25619] 10:12:46.449382 close(6)    = 0
[pid 25619] 10:12:46.449434 open("/usr/local/cpanel/3rdparty/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.449488 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.449530 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libfreebl3.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.449651 open("/lib64/libfreebl3.so", O_RDONLY) = 6
[pid 25619] 10:12:46.449691 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\n\0\0\0\0\0\0@\0\0\0\0\0\0\0\210!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\24\0\0\0\0\0\0L\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\260\2\0\0\0\0\0\0\350\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\0\36\0\0\0\0\0\0\0\36 \0\0\0\0\0\0\36 \0\0\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.449730 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10312, st_atime=2015/09/01-00:54:27, st_mtime=2015/09/01-00:54:27, st_ctime=2015/12/22-09:32:56}) = 0
[pid 25619] 10:12:46.449778 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd216b000
[pid 25619] 10:12:46.449817 mprotect(0x7f1fd216d000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.449851 mmap(0x7f1fd236c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f1fd236c000
[pid 25619] 10:12:46.449895 close(6)    = 0
[pid 25619] 10:12:46.449935 open("/usr/local/cpanel/3rdparty/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.449977 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450017 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libaudit.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450062 open("/lib64/libaudit.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.450101 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20(\0\0\0\0\0\0@\0\0\0\0\0\0\0\10#\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<m\1\0\0\0\0\0<m\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260{\1\0\0\0\0\0\260{!\0\0\0\0\0\260{!\0\0\0\0\0P\246\0\0\0\0\0\0\200\246\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10~\1\0\0\0\0\0\10~!\0\0\0\0\0\10~!\0\0\0\0\0\220\1\0\0\0\0\0\0\220\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.450139 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277156, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=141768, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-07:54:13, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25619] 10:12:46.450183 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5212000
[pid 25619] 10:12:46.450221 mmap(NULL, 2236976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd1f48000
[pid 25619] 10:12:46.450257 mprotect(0x7f1fd1f5f000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.450292 mmap(0x7f1fd215f000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f1fd215f000
[pid 25619] 10:12:46.450337 close(6)    = 0
[pid 25619] 10:12:46.450394 open("/usr/local/cpanel/3rdparty/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450442 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450496 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libgssapi_krb5.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450610 open("/lib64/libgssapi_krb5.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.450660 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\254\0\0\0\0\0\0@\0\0\0\0\0\0\0\3105\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\10\4\0\0\0\0\0\234\10\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\260\21\4\0\0\0\0\0\260\21$\0\0\0\0\0\260\21$\0\0\0\0\0\370\"\0\0\0\0\0\0000&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\32\4\0\0\0\0\0H\32$\0\0\0\0\0H\32$\0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.450698 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=544, st_size=277704, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.450743 mmap(NULL, 2373600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd1d04000
[pid 25619] 10:12:46.450780 mprotect(0x7f1fd1d45000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.450814 mmap(0x7f1fd1f45000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x41000) = 0x7f1fd1f45000
[pid 25619] 10:12:46.450858 close(6)    = 0
[pid 25619] 10:12:46.450898 open("/usr/local/cpanel/3rdparty/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450939 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.450978 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.451017 open("/lib64/libkrb5.so.3", O_RDONLY) = 6
[pid 25619] 10:12:46.451057 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\264\1\0\0\0\0\0@\0\0\0\0\0\0\0\200h\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\256\r\0\0\0\0\0\344\256\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0008\272\r\0\0\0\0\0008\272-\0\0\0\0\0008\272-\0\0\0\0\0000\255\0\0\0\0\0\0\210\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@J\16\0\0\0\0\0@J.\0\0\0\0\0@J.\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.451100 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276832, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1848, st_size=946048, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.451144 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5211000
[pid 25619] 10:12:46.451181 mmap(NULL, 3041984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd1a1d000
[pid 25619] 10:12:46.451217 mprotect(0x7f1fd1af8000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.451251 mmap(0x7f1fd1cf8000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xdb000) = 0x7f1fd1cf8000
[pid 25619] 10:12:46.451295 close(6)    = 0
[pid 25619] 10:12:46.451337 open("/usr/local/cpanel/3rdparty/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.451385 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.451431 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libcom_err.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.451471 open("/lib64/libcom_err.so.2", O_RDONLY) = 6
[pid 25619] 10:12:46.451509 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\23\0\0\0\0\0\0@\0\0\0\0\0\0\0H2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214$\0\0\0\0\0\0\214$\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\254-\0\0\0\0\0\0\254- \0\0\0\0\0\254- \0\0\0\0\0\214\3\0\0\0\0\0\0\4\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\360-\0\0\0\0\0\0\360- \0\0\0\0\0\360- \0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.451715 fstat(6, {st_dev=makedev(144, 4215), st_ino=108276830, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14664, st_atime=2015/07/24-05:33:24, st_mtime=2015/07/24-05:33:24, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.451765 mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd1819000
[pid 25619] 10:12:46.451803 mprotect(0x7f1fd181c000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.451837 mmap(0x7f1fd1a1b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f1fd1a1b000
[pid 25619] 10:12:46.451881 close(6)    = 0
[pid 25619] 10:12:46.451920 open("/usr/local/cpanel/3rdparty/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.451961 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452001 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libk5crypto.so.3", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452040 open("/lib64/libk5crypto.so.3", O_RDONLY) = 6
[pid 25619] 10:12:46.452078 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320C\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\243\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\206\2\0\0\0\0\0\324\206\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\221\2\0\0\0\0\0@\221\"\0\0\0\0\0@\221\"\0\0\0\0\0\230\21\0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\235\2\0\0\0\0\0H\235\"\0\0\0\0\0H\235\"\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.452116 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277074, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=344, st_size=174840, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.452166 mmap(NULL, 2273704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd15ed000
[pid 25619] 10:12:46.452204 mprotect(0x7f1fd1616000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.452238 mmap(0x7f1fd1816000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x29000) = 0x7f1fd1816000
[pid 25619] 10:12:46.452278 mmap(0x7f1fd1818000, 424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd1818000
[pid 25619] 10:12:46.452321 close(6)    = 0
[pid 25619] 10:12:46.452362 open("/usr/local/cpanel/3rdparty/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452414 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452465 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libz.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452510 open("/lib64/libz.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.452629 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 !\0\0\0\0\0\0@\0\0\0\0\0\0\0\30S\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0tD\1\0\0\0\0\0tD\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330L\1\0\0\0\0\0\330L!\0\0\0\0\0\330L!\0\0\0\0\0(\5\0\0\0\0\0\0008\5\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\370M\1\0\0\0\0\0\370M!\0\0\0\0\0\370M!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.452674 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277094, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=176, st_size=88600, st_atime=2015/12/22-09:30:28, st_mtime=2013/02/21-17:02:16, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25619] 10:12:46.452720 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5210000
[pid 25619] 10:12:46.452758 mmap(NULL, 2183696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd13d7000
[pid 25619] 10:12:46.452795 mprotect(0x7f1fd13ec000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.452830 mmap(0x7f1fd15eb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f1fd15eb000
[pid 25619] 10:12:46.452875 close(6)    = 0
[pid 25619] 10:12:46.452926 open("/usr/local/cpanel/3rdparty/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.452968 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453072 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkrb5support.so.0", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453114 open("/lib64/libkrb5support.so.0", O_RDONLY) = 6
[pid 25619] 10:12:46.453154 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\0\0\0\0\0\0@\0\0\0\0\0\0\0\320\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\233\0\0\0\0\0\0\f\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\234\0\0\0\0\0\0\360\234 \0\0\0\0\0\360\234 \0\0\0\0\0\300\5\0\0\0\0\0\0`\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\235\0\0\0\0\0\0P\235 \0\0\0\0\0P\235 \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.453192 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277092, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=88, st_size=43728, st_atime=2015/07/23-22:28:26, st_mtime=2015/07/23-22:28:26, st_ctime=2015/12/22-09:33:08}) = 0
[pid 25619] 10:12:46.453238 mmap(NULL, 2139216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd11cc000
[pid 25619] 10:12:46.453282 mprotect(0x7f1fd11d6000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.453319 mmap(0x7f1fd13d5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f1fd13d5000
[pid 25619] 10:12:46.453364 close(6)    = 0
[pid 25619] 10:12:46.453416 open("/usr/local/cpanel/3rdparty/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453464 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453509 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libkeyutils.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453612 open("/lib64/libkeyutils.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.453656 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\v\0\0\0\0\0\0@\0\0\0\0\0\0\0P!\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\25\0\0\0\0\0\0l\25\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\340\35\0\0\0\0\0\0\340\35 \0\0\0\0\0\340\35 \0\0\0\0\0`\2\0\0\0\0\0\0p\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\36\0\0\0\0\0\0\20\36 \0\0\0\0\0\20\36 \0\0\0\0\0\300\1\0\0\0\0\0\0\300\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.453695 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277216, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=10192, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:08:05, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25619] 10:12:46.453742 mmap(NULL, 2105424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd0fc9000
[pid 25619] 10:12:46.453781 mprotect(0x7f1fd0fcb000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.453816 mmap(0x7f1fd11ca000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f1fd11ca000
[pid 25619] 10:12:46.453861 close(6)    = 0
[pid 25619] 10:12:46.453900 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd520f000
[pid 25619] 10:12:46.453950 open("/usr/local/cpanel/3rdparty/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.453991 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.454032 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libselinux.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.454071 open("/lib64/libselinux.so.1", O_RDONLY) = 6
[pid 25619] 10:12:46.454107 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320X\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\325\1\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\307\1\0\0\0\0\0\224\307\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\315\1\0\0\0\0\0\10\315!\0\0\0\0\0\10\315!\0\0\0\0\0\234\7\0\0\0\0\0\0P\32\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\315\1\0\0\0\0\0\240\315!\0\0\0\0\0\240\315!\0\0\0\0\0\260\1\0\0\0\0\0\0\260\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.454145 fstat(6, {st_dev=makedev(144, 4215), st_ino=108277224, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240, st_size=122040, st_atime=2015/12/22-09:30:28, st_mtime=2014/10/15-06:42:33, st_ctime=2015/12/22-09:30:28}) = 0
[pid 25619] 10:12:46.454190 mmap(NULL, 2221912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f1fd0daa000
[pid 25619] 10:12:46.454227 mprotect(0x7f1fd0dc7000, 2093056, PROT_NONE) = 0
[pid 25619] 10:12:46.454262 mmap(0x7f1fd0fc6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1c000) = 0x7f1fd0fc6000
[pid 25619] 10:12:46.454302 mmap(0x7f1fd0fc8000, 1880, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1fd0fc8000
[pid 25619] 10:12:46.454345 close(6)    = 0
[pid 25619] 10:12:46.454424 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd520e000
[pid 25619] 10:12:46.454505 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd520d000
[pid 25619] 10:12:46.454628 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd520b000
[pid 25619] 10:12:46.454673 arch_prctl(ARCH_SET_FS, 0x7f1fd520b7c0) = 0
[pid 25619] 10:12:46.454744 mprotect(0x7f1fd0fc6000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.454785 mprotect(0x7f1fd11ca000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.454833 mprotect(0x7f1fd13d5000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.454875 mprotect(0x7f1fd15eb000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.454922 mprotect(0x7f1fd1816000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.454965 mprotect(0x7f1fd1a1b000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.455104 mprotect(0x7f1fd1cf8000, 40960, PROT_READ) = 0
[pid 25619] 10:12:46.455220 mprotect(0x7f1fd1f45000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.455266 mprotect(0x7f1fd215f000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.455304 mprotect(0x7f1fd236c000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.455593 mprotect(0x7f1fd2b58000, 110592, PROT_READ) = 0
[pid 25619] 10:12:46.455701 mprotect(0x7f1fd2de4000, 16384, PROT_READ) = 0
[pid 25619] 10:12:46.455817 mprotect(0x7f1fd3179000, 16384, PROT_READ) = 0
[pid 25619] 10:12:46.455859 mprotect(0x7f1fd3384000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.455900 mprotect(0x7f1fd3588000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456589 mprotect(0x7f1fd42e0000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456654 mprotect(0x7f1fd4715000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456696 mprotect(0x7f1fd4999000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456735 mprotect(0x7f1fd4ba2000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456785 mprotect(0x7f1fd4de7000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456828 mprotect(0x7f1fd5001000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456885 mprotect(0x7f1fd5224000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.456921 munmap(0x7f1fd5219000, 39387) = 0
[pid 25619] 10:12:46.456960 set_tid_address(0x7f1fd520ba90) = 25619
[pid 25619] 10:12:46.456991 set_robust_list(0x7f1fd520baa0, 24) = 0
[pid 25619] 10:12:46.457022 futex(0x7ffcd82ae10c, FUTEX_WAKE_PRIVATE, 1) = 0
[pid 25619] 10:12:46.457057 futex(0x7ffcd82ae10c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f1fd520b7c0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 25619] 10:12:46.457097 rt_sigaction(SIGRTMIN, {0x7f1fd40cec60, [], SA_RESTORER|SA_SIGINFO, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.457135 rt_sigaction(SIGRT_1, {0x7f1fd40cecf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.457170 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid 25619] 10:12:46.457213 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid 25619] 10:12:46.457281 statfs("/selinux", {f_type=0x565a4653, f_bsize=4096, f_blocks=15728640, f_bfree=6350296, f_bavail=6350296, f_files=1000000, f_ffree=691069, f_fsid={-1995925712, 1948706178}, f_namelen=255, f_frsize=4096}) = 0
[pid 25619] 10:12:46.457377 brk(0)      = 0x205b000
[pid 25619] 10:12:46.457422 brk(0x207c000) = 0x207c000
[pid 25619] 10:12:46.457467 open("/proc/filesystems", O_RDONLY) = 6
[pid 25619] 10:12:46.457526 fstat(6, {st_dev=makedev(144, 4282), st_ino=4026532084, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.457642 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5222000
[pid 25619] 10:12:46.457678 read(6, "nodev\tcgroup\nnodev\tdevpts\nnodev\tmqueue\n\text4\nnodev\tnfs\nnodev\tnfs4\nnodev\tdelayfs\nnodev\tdevtmpfs\nnodev\tsysfs\nnodev\tproc\nnodev\ttmpfs\nnodev\tbinfmt_misc\n", 1024) = 148
[pid 25619] 10:12:46.457789 read(6, "", 1024) = 0
[pid 25619] 10:12:46.457827 close(6)    = 0
[pid 25619] 10:12:46.457868 munmap(0x7f1fd5222000, 4096) = 0
[pid 25619] 10:12:46.457953 access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.458061 rt_sigaction(SIGALRM, {0x438ee0, [], SA_RESTORER, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.458109 fstat(2, {st_dev=makedev(144, 4277), st_ino=1289713374, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/29-10:32:04}) = 0
[pid 25619] 10:12:46.458187 rt_sigaction(SIGUSR1, {0x438e18, [], SA_RESTORER|SA_RESTART, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.458228 rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25619] 10:12:46.458266 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_IGN, [], 0}, 8) = 0
[pid 25619] 10:12:46.458302 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.458346 umask(0)    = 0
[pid 25619] 10:12:46.458413 geteuid()   = 0
[pid 25619] 10:12:46.458448 getuid()    = 47
[pid 25619] 10:12:46.458480 getgid()    = 12
[pid 25619] 10:12:46.458597 getrlimit(RLIMIT_NOFILE, {rlim_cur=16*1024, rlim_max=16*1024}) = 0
[pid 25619] 10:12:46.458639 getrlimit(RLIMIT_NPROC, {rlim_cur=1029388, rlim_max=1029388}) = 0
[pid 25619] 10:12:46.458675 getgroups(65536, [12]) = 1
[pid 25619] 10:12:46.458712 setgroups(0, []) = 0
[pid 25619] 10:12:46.458747 getegid()   = 12
[pid 25619] 10:12:46.458777 geteuid()   = 0
[pid 25619] 10:12:46.458812 geteuid()   = 0
[pid 25619] 10:12:46.458842 getegid()   = 12
[pid 25619] 10:12:46.458874 setgid(12)  = 0
[pid 25619] 10:12:46.458907 setuid(0)   = 0
[pid 25619] 10:12:46.458966 open("/etc/exim.conf", O_RDONLY) = 6
[pid 25619] 10:12:46.459026 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.459079 fstat(6, {st_dev=makedev(144, 4215), st_ino=108284250, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=68267, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.459122 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5222000
[pid 25619] 10:12:46.459158 read(6, "#!!# cPanel Exim 4 Config\n\n# +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.\n# -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.\nlog_selector = +all\ntls_require_cipher"..., 4096) = 4096
[pid 25619] 10:12:46.459299 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25619] 10:12:46.459345 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.459395 close(7)    = 0
[pid 25619] 10:12:46.459430 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25619] 10:12:46.459464 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.459502 close(7)    = 0
[pid 25619] 10:12:46.459615 open("/etc/nsswitch.conf", O_RDONLY) = 7
[pid 25619] 10:12:46.459663 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281930, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1688, st_atime=2010/05/04-14:22:21, st_mtime=2010/05/04-14:22:21, st_ctime=2015/12/22-09:33:23}) = 0
[pid 25619] 10:12:46.459709 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.459744 read(7, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previo"..., 4096) = 1688
[pid 25619] 10:12:46.459805 read(7, "", 4096) = 0
[pid 25619] 10:12:46.459839 close(7)    = 0
[pid 25619] 10:12:46.459872 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.459920 open("/usr/local/cpanel/3rdparty/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.459963 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/CORE/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.460006 open("/usr/local/cpanel/3rdparty/perl/514/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.460044 open("/etc/ld.so.cache", O_RDONLY) = 7
[pid 25619] 10:12:46.460080 fstat(7, {st_dev=makedev(144, 4215), st_ino=108287664, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=39387, st_atime=2015/12/22-10:31:09, st_mtime=2015/12/22-10:31:09, st_ctime=2015/12/22-10:31:09}) = 0
[pid 25619] 10:12:46.460124 mmap(NULL, 39387, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f1fd5201000
[pid 25619] 10:12:46.460159 close(7)    = 0
[pid 25619] 10:12:46.460201 open("/lib64/libnss_files.so.2", O_RDONLY) = 7
[pid 25619] 10:12:46.460242 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\371\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0!\0 \0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\20\247\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\277\0\0\0\0\0\0t\277\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\310\315\0\0\0\0\0\0\310\315 \0\0\0\0\0"..., 832) = 832
[pid 25619] 10:12:46.460280 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276858, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=136, st_size=65928, st_atime=2015/09/22-12:33:56, st_mtime=2015/09/22-12:33:56, st_ctime=2015/12/22-09:33:03}) = 0
[pid 25619] 10:12:46.460329 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f1fd0b9c000
[pid 25619] 10:12:46.460369 mprotect(0x7f1fd0ba8000, 2097152, PROT_NONE) = 0
[pid 25619] 10:12:46.460406 mmap(0x7f1fd0da8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xc000) = 0x7f1fd0da8000
[pid 25619] 10:12:46.460451 close(7)    = 0
[pid 25619] 10:12:46.460501 mprotect(0x7f1fd0da8000, 4096, PROT_READ) = 0
[pid 25619] 10:12:46.460615 munmap(0x7f1fd5201000, 39387) = 0
[pid 25619] 10:12:46.460668 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25619] 10:12:46.460713 fcntl(7, F_GETFD) = 0x1 (flags FD_CLOEXEC)
[pid 25619] 10:12:46.460749 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.460793 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.460828 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.460884 close(7)    = 0
[pid 25619] 10:12:46.460918 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.460971 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25619] 10:12:46.461009 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.461052 close(7)    = 0
[pid 25619] 10:12:46.461086 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
[pid 25619] 10:12:46.461119 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.461163 close(7)    = 0
[pid 25619] 10:12:46.461201 open("/etc/group", O_RDONLY|O_CLOEXEC) = 7
[pid 25619] 10:12:46.461239 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25619] 10:12:46.461283 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.461319 read(7, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25619] 10:12:46.461371 close(7)    = 0
[pid 25619] 10:12:46.461405 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.461467 read(6, "ining the word \"end\". The parts must appear\n# in the correct order, and all must be present (even if some of them are\n# in fact empty). Blank lines, and lines starting with # are ignored.\n\n\n\n#################################################################"..., 4096) = 4096
[pid 25619] 10:12:46.461562 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
[pid 25619] 10:12:46.461667 fstat(7, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.461714 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.461749 read(7, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.461792 close(7)    = 0
[pid 25619] 10:12:46.461825 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.461867 read(6, "ed \"Control of relaying\" for more\n# information.\n\n# The setting below causes Exim to do a reverse DNS lookup on all incoming\n# IP calls, in order to get the true host name. If you feel this is too\n# expensive, you can specify the networks for which a looku"..., 4096) = 4096
[pid 25619] 10:12:46.461922 uname({sysname="Linux", nodename="fin.finestweddingsites.com", release="2.6.32-042stab108.7", version="#1 SMP Wed Jul 15 15:49:08 MSK 2015", machine="x86_64", domainname="(none)"}) = 0
[pid 25619] 10:12:46.461985 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_DFL, [], SA_RESTORER, 0x7f1fd40d8790}, 8) = 0
[pid 25619] 10:12:46.462034 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f1fd520ba90) = 25620
[pid 25619] 10:12:46.462291 wait4(25620, Process 25620 attached
 <unfinished ...>
[pid 25620] 10:12:46.462349 set_robust_list(0x7f1fd520baa0, 24) = 0
[pid 25620] 10:12:46.462425 geteuid()   = 0
[pid 25620] 10:12:46.462478 geteuid()   = 0
[pid 25620] 10:12:46.462524 getegid()   = 12
[pid 25620] 10:12:46.462658 setgid(12)  = 0
[pid 25620] 10:12:46.462707 setuid(47)  = 0
[pid 25620] 10:12:46.464830 brk(0x209d000) = 0x209d000
[pid 25620] 10:12:46.465245 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 7
[pid 25620] 10:12:46.465307 fstat(7, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25620] 10:12:46.465363 poll([{fd=7, events=POLLIN}], 1, 10) = 1 ([{fd=7, revents=POLLIN}])
[pid 25620] 10:12:46.465406 read(7, "&\254\2\265\340\217\333\320Z\0366\3028\306\340\t\\\3031\257\321\375\260O\340\326\271\340\326\24\373\211f\331\320~z\v\263\313\353\3\0%0\34\325\344", 48) = 48
[pid 25620] 10:12:46.465455 close(7)    = 0
[pid 25620] 10:12:46.465505 getuid()    = 47
[pid 25620] 10:12:46.465721 exit_group(0) = ?
[pid 25620] 10:12:46.465929 +++ exited with 0 +++
[pid 25619] 10:12:46.465967 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25620
[pid 25619] 10:12:46.465992 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, 8) = 0
[pid 25619] 10:12:46.466054 getcwd("/var/spool/exim", 16380) = 16
[pid 25619] 10:12:46.466125 open("/etc/localtime", O_RDONLY) = 7
[pid 25619] 10:12:46.466169 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.466216 fstat(7, {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.466259 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.466295 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\353\0\0\0\5\0\0\0\24\236\246,\200\237\272\371p\240\206\16\200\241\232\333p\242\313t\0\243\203\367\360\244E\322\200\245c\331\360\246S\331\0\247\25\227p\2503\273\0\250\376\263\360\252\23\235\0\252\336\225\360\253\363\177\0\254\276w\360\255\323a\0\256\236Y\360\257\263C\0\260~;\360\261\234_\200\262gXp\263|A\200\264G:p\265\\#\200\266'\34p\267<\5\200\270\6\376p\271\33\347\200\271\346\340p\273\5\4\0\273\306\302p\274\344\346\0\275\257\336\360\276\304\310\0\277\217\300\360\300Z\326\0\301\260<p\302\204\214\0\303O\204\360\304dn\0\305/f\360\306M\212\200\307\17H\360\310-l\200\310\370ep\312\rN\200\312\330Gp\313\210\376\200\322#\364p\322a\t\360\323u\363\0\324@\353\360"..., 4096) = 3543
[pid 25619] 10:12:46.466344 lseek(7, -2264, SEEK_CUR) = 1279
[pid 25619] 10:12:46.466377 read(7, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0\0\0\0\354\0\0\0\6\0\0\0\30\377\377\377\377^\3\376\240\377\377\377\377\236\246,\200\377\377\377\377\237\272\371p\377\377\377\377\240\206\16\200\377\377\377\377\241\232\333p\377\377\377\377\242\313t\0\377\377\377\377\243\203\367\360\377\377\377\377\244E\322\200\377\377\377\377\245c\331\360\377\377\377\377\246S\331\0\377\377\377\377\247\25\227p\377\377\377\377\2503\273\0\377\377\377\377\250\376\263\360\377\377\377\377\252\23\235\0\377\377\377\377\252\336\225\360\377\377\377\377\253\363\177\0\377\377\377\377\254\276w\360\377\377\377\377\255\323a\0\377\377\377\377\256\236Y\360\377\377\377\377\257\263C\0\377\377\377\377\260~;\360\377\377\377\377\261\234_\200\377\377\377\377\262gXp\377\377\377\377\263|A\200\377\377\377\377\264G:p\377\377\377\377\265\\#\200\377\377\377\377"..., 4096) = 2264
[pid 25619] 10:12:46.466435 close(7)    = 0
[pid 25619] 10:12:46.466471 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.466521 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25619] 10:12:46.466652 fcntl(7, F_GETFD) = 0
[pid 25619] 10:12:46.466687 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.466718 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400877, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.466766 write(7, "2015-12-30 10:12:46 [25619] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1aEJMk-0006fB-D1\n", 92) = 92
[pid 25619] 10:12:46.466815 chdir("/var/spool/exim") = 0
[pid 25619] 10:12:46.466858 setgid(12)  = 0
[pid 25619] 10:12:46.466918 read(6, "tedmailhosts\n\n    accept\n        condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}\n\n    accept\n        hosts = : +recent_authed_mail_ips : +loopback : +backupmx_hosts\n\n    defer\n        #only rate limit port 25\n       "..., 4096) = 4096
[pid 25619] 10:12:46.467007 read(6, "BLOCK\n\n#END ACL_RATELIMIT_SPAM_BLOCK\n\n#BEGIN ACL_SPAM_BLOCK\n\n#END ACL_SPAM_BLOCK\n\n#BEGIN ACL_CHECK_MESSAGE_POST_BLOCK\n# BEGIN INSERT default_check_message_post\n\n accept\n\n# END INSERT default_check_message_post\n\n#END ACL_CHECK_MESSAGE_POST_BLOCK\n\nacl_smtp_e"..., 4096) = 4096
[pid 25619] 10:12:46.467091 read(6, "/ 1h / strict / per_conn / slow_fail_block_$sender_host_address \n    log_message = \"Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed\"\n\n  warn\n    ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_a"..., 4096) = 4096
[pid 25619] 10:12:46.467164 read(6, "\n  # if they used \"pop before smtp\" then we just accept\n  accept\n    condition = ${if exists{/etc/popbeforesmtp}{1}{0}}\n    hosts = +recent_authed_mail_ips\n\n  # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled\n  w"..., 4096) = 4096
[pid 25619] 10:12:46.467237 read(6, "nslist_text\"\n\n warn\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}\n     ratelimit = 0 / 1h / strict / per_conn\n     log_message = \"Increment Connection Ratelimit - $sender_fullhost because of RBL match\"\n\n drop\n     condition = ${if eq {${acl_m8}}{1}{1}{0}}"..., 4096) = 4096
[pid 25619] 10:12:46.467328 read(6, "       REWRITE CONFIGURATION                         #\n######################################################################\n\n# There are no rewriting specifications in this default configuration file.\n\nbegin rewrite\n\n\n\n\n#!!###############################"..., 4096) = 4096
[pid 25619] 10:12:46.467442 read(6, "dy and webspam and mail trap checks \n# in check_mail_permissions and notifies if we are defering a message\n#\n\n\nboxtrapper_autowhitelist:\n  driver = accept\n  condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if"..., 4096) = 4096
[pid 25619] 10:12:46.467514 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25619] 10:12:46.467565 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.467612 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.467647 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.467693 close(8)    = 0
[pid 25619] 10:12:46.467727 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.467912 read(6, "routes to remote hosts over SMTP by explicit IP address,\n# given as a \"domain literal\" in the form [nnn.nnn.nnn.nnn]. The RFCs\n# require this facility, which is why it is enabled by default in Exim.\n# If you want to lock it out, set forbid_domain_literals "..., 4096) = 4096
[pid 25619] 10:12:46.468015 read(6, "dress_directory\n    domains = +user_domains\n    pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}"..., 4096) = 4096
[pid 25619] 10:12:46.468135 read(6, " match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}\n    reply_transport = address_reply\n    user = \"${lookup{$domain}lsearch* {/e"..., 4096) = 4096
[pid 25619] 10:12:46.468258 read(6, "{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}{$value}}}}}{\\N(jail|no)shell\\N}{jailed_virtual_address_pipe}{virtual_addres"..., 4096) = 4096
[pid 25619] 10:12:46.468378 read(6, "r/local/cpanel/3rdparty/mailman/mail/mailman \\\n              '${if def:local_part_suffix \\\n                    {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} \\\n                    {post}}' \\\n              ${lc:$local_part}_${lc:$domain}\n    current_dire"..., 4096) = 4096
[pid 25619] 10:12:46.468444 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 8
[pid 25619] 10:12:46.468488 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.468534 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.468573 read(8, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.468623 close(8)    = 0
[pid 25619] 10:12:46.468656 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.468701 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25619] 10:12:46.468742 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25619] 10:12:46.468852 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.468897 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25619] 10:12:46.468947 close(8)    = 0
[pid 25619] 10:12:46.468980 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.469039 open("/etc/group", O_RDONLY|O_CLOEXEC) = 8
[pid 25619] 10:12:46.469081 fstat(8, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25619] 10:12:46.469125 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.469160 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25619] 10:12:46.469206 close(8)    = 0
[pid 25619] 10:12:46.469239 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.469345 read(6, "e pipe generates any standard output, it is returned\n# to the sender of the message as a delivery error. Set return_fail_output\n# instead of return_output if you want this to happen only when the pipe fails\n# to complete normally. You can set different tra"..., 4096) = 4096
[pid 25619] 10:12:46.469475 read(6, "lookup{$domain}lsearch* {/etc/userdomains}{$value}}}{$value}}}}\n  log_output = true\n  current_directory = \"/tmp\"\n  return_fail_output = true\n  return_path_add = false\n\nvirtual_userdelivery:\n  driver = appendfile\n  delivery_date_add\n  envelope_to_add\n  dire"..., 4096) = 2731
[pid 25619] 10:12:46.469580 read(6, "", 4096) = 0
[pid 25619] 10:12:46.469619 read(6, "", 4096) = 0
[pid 25619] 10:12:46.469654 close(6)    = 0
[pid 25619] 10:12:46.469687 munmap(0x7f1fd5222000, 4096) = 0
[pid 25619] 10:12:46.469739 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f1fd40d8790}, NULL, 8) = 0
[pid 25619] 10:12:46.469852 open("/var/spool/exim/input/k/1aEJMk-0006fB-D1-D", O_RDWR|O_APPEND) = 6
[pid 25619] 10:12:46.469912 fcntl(6, F_GETFD) = 0
[pid 25619] 10:12:46.469944 fcntl(6, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.469976 fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=19}) = 0
[pid 25619] 10:12:46.470012 fstat(6, {st_dev=makedev(144, 4215), st_ino=116657784, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=3152, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.470065 open("/var/spool/exim/input/k/1aEJMk-0006fB-D1-H", O_RDONLY) = 8
[pid 25619] 10:12:46.470108 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662260, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.470152 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5222000
[pid 25619] 10:12:46.470186 read(8, "1aEJMk-0006fB-D1-H\nmailnull 47 12\n<>\n1451491966 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 4096) = 960
[pid 25619] 10:12:46.470260 read(8, "", 4096) = 0
[pid 25619] 10:12:46.470295 close(8)    = 0
[pid 25619] 10:12:46.470330 munmap(0x7f1fd5222000, 4096) = 0
[pid 25619] 10:12:46.470369 open("/var/spool/exim/input/k/1aEJMk-0006fB-D1-J", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.470432 open("/var/spool/exim/msglog/k/1aEJMk-0006fB-D1", O_WRONLY|O_CREAT|O_APPEND, 0640) = 8
[pid 25619] 10:12:46.470479 fcntl(8, F_GETFD) = 0
[pid 25619] 10:12:46.470510 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.470547 fchown(8, 47, 12) = 0
[pid 25619] 10:12:46.470589 fchmod(8, 0640) = 0
[pid 25619] 10:12:46.470627 fcntl(8, F_GETFL) = 0x8401 (flags O_WRONLY|O_APPEND|O_LARGEFILE)
[pid 25619] 10:12:46.470661 fstat(8, {st_dev=makedev(144, 4215), st_ino=116662262, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=142, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.470706 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5222000
[pid 25619] 10:12:46.470741 lseek(8, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.470778 stat("/etc/cpanel_exim_system_filter", {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.470905 pipe([9, 10]) = 0
[pid 25619] 10:12:46.470944 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_DFL, [], SA_RESTORER, 0x7f1fd40d8790}, 8) = 0
[pid 25619] 10:12:46.470985 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f1fd520ba90) = 25621
[pid 25619] 10:12:46.471225 close(10)   = 0
[pid 25619] 10:12:46.471261 read(9, Process 25621 attached
 <unfinished ...>
[pid 25621] 10:12:46.471313 set_robust_list(0x7f1fd520baa0, 24) = 0
[pid 25621] 10:12:46.471394 close(9)    = 0
[pid 25621] 10:12:46.471447 geteuid()   = 0
[pid 25621] 10:12:46.471481 getegid()   = 12
[pid 25621] 10:12:46.471514 setgid(494) = 0
[pid 25621] 10:12:46.471549 setuid(495) = 0
[pid 25621] 10:12:46.471600 open("/etc/cpanel_exim_system_filter", O_RDONLY) = 9
[pid 25621] 10:12:46.471646 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25621] 10:12:46.471727 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284114, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=12133, st_atime=2015/12/22-09:40:21, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25621] 10:12:46.471780 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25621] 10:12:46.471883 read(9, "# Exim filter\n# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #\n#  cPanel System Filter for EXIM                                                                                #\n#  VERSION = 2"..., 8192) = 8192
[pid 25621] 10:12:46.471931 read(9, "umber at top of file :-(\n# 0.12 10 May, 2001\n#\tAdded HTA extension\n# 0.13 22 May, 2001\n#\tReformatted regexps and code to build them so that they are\n#\tshorter than the limits on pre exim 3.20 filters.  This will\n#\tmake them significantly less efficient, bu"..., 4096) = 3941
[pid 25621] 10:12:46.471974 close(9)    = 0
[pid 25621] 10:12:46.472007 munmap(0x7f1fd5221000, 4096) = 0
[pid 25621] 10:12:46.472083 brk(0x209e000) = 0x209e000
[pid 25621] 10:12:46.472215 write(10, "\2\0\0\0", 4 <unfinished ...>
[pid 25619] 10:12:46.472244 <... read resumed> "\2\0\0\0", 4) = 4
[pid 25619] 10:12:46.472266 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472286 <... write resumed> ) = 4
[pid 25621] 10:12:46.472303 write(10, "\1\0\0\0", 4 <unfinished ...>
[pid 25619] 10:12:46.472327 <... read resumed> "\1\0\0\0", 4) = 4
[pid 25619] 10:12:46.472346 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472365 <... write resumed> ) = 4
[pid 25621] 10:12:46.472383 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25619] 10:12:46.472414 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25619] 10:12:46.472434 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472457 <... write resumed> ) = 4
[pid 25621] 10:12:46.472487 write(10, "\377\377\377\377", 4 <unfinished ...>
[pid 25619] 10:12:46.472508 <... read resumed> "\377\377\377\377", 4) = 4
[pid 25619] 10:12:46.472527 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472552 <... write resumed> ) = 4
[pid 25621] 10:12:46.472573 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25619] 10:12:46.472595 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25619] 10:12:46.472614 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472633 <... write resumed> ) = 4
[pid 25621] 10:12:46.472650 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40 <unfinished ...>
[pid 25619] 10:12:46.472674 <... read resumed> "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 40) = 40
[pid 25619] 10:12:46.472695 read(9,  <unfinished ...>
[pid 25621] 10:12:46.472714 <... write resumed> ) = 40
[pid 25621] 10:12:46.472732 write(10, "\0\0\0\0", 4 <unfinished ...>
[pid 25619] 10:12:46.472753 <... read resumed> "\0\0\0\0", 4) = 4
[pid 25619] 10:12:46.472774 wait4(-1,  <unfinished ...>
[pid 25621] 10:12:46.472861 <... write resumed> ) = 4
[pid 25621] 10:12:46.472884 close(10)   = 0
[pid 25621] 10:12:46.472925 exit_group(0) = ?
[pid 25621] 10:12:46.473084 +++ exited with 0 +++
[pid 25619] 10:12:46.473118 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25621
[pid 25619] 10:12:46.473142 close(9)    = 0
[pid 25619] 10:12:46.473178 rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, 8) = 0
[pid 25619] 10:12:46.473287 brk(0x209d000) = 0x209d000
[pid 25619] 10:12:46.473334 open("/var/spool/exim/db/retry.lockfile", O_RDWR) = 9
[pid 25619] 10:12:46.473382 alarm(60)   = 0
[pid 25619] 10:12:46.473427 fcntl(9, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
[pid 25619] 10:12:46.473472 alarm(0)    = 60
[pid 25619] 10:12:46.473596 open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.473652 open("/proc/stat", O_RDONLY|O_CLOEXEC) = 10
[pid 25619] 10:12:46.473699 read(10, "cpu  123114 1342536 395367 67343779 2509 0 0 0\ncpu0 123114 1342536 395367 67343779 2509 0 0 0\nintr 0\nswap 0 0\n\nctxt 58736256\nbtime 1450798266\nprocesses 893099\nprocs_running 1\nprocs_blocked 0\n", 8192) = 191
[pid 25619] 10:12:46.473767 close(10)   = 0
[pid 25619] 10:12:46.473862 stat("/var/spool/exim/db/retry", {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25619] 10:12:46.473924 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25619] 10:12:46.473965 fcntl(10, F_GETFD) = 0
[pid 25619] 10:12:46.473997 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.474033 read(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 512) = 512
[pid 25619] 10:12:46.474085 close(10)   = 0
[pid 25619] 10:12:46.474133 open("DB_CONFIG", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.474174 stat("/var/tmp", {st_dev=makedev(144, 4215), st_ino=109320738, st_mode=S_IFDIR|S_ISVTX|0777, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=2015/12/22-09:30:28, st_mtime=2015/12/30-09:12:23, st_ctime=2015/12/30-09:12:23}) = 0
[pid 25619] 10:12:46.474272 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd51da000
[pid 25619] 10:12:46.474435 open("/var/spool/exim/db/retry", O_RDONLY) = 10
[pid 25619] 10:12:46.474491 fcntl(10, F_GETFD) = 0
[pid 25619] 10:12:46.474522 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.474626 fstat(10, {st_dev=makedev(144, 4215), st_ino=109318946, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=24, st_size=12288, st_atime=2015/12/22-09:40:26, st_mtime=2015/12/30-10:12:35, st_ctime=2015/12/30-10:12:35}) = 0
[pid 25619] 10:12:46.474708 pread(10, "\0\0\0\0\1\0\0\0\0\0\0\0a\25\6\0\t\0\0\0\0\20\0\0\0\10\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\23\204\6w\220\0\1\207<\334\224!\r\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 0) = 4096
[pid 25619] 10:12:46.474796 pread(10, "\0\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\6\0\374\r\0\r\306\17\22\17\357\16|\16A\16\374\rO\r\n\ru\f0\f\216\vI\v~\n9\n{\t6\t\375\0106\10\375\0076\7\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\321\215h^\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096, 8192) = 4096
[pid 25619] 10:12:46.474864 close(10)   = 0
[pid 25619] 10:12:46.474923 munmap(0x7f1fd51da000, 200704) = 0
[pid 25619] 10:12:46.474990 close(9)    = 0
[pid 25619] 10:12:46.475045 open("/etc/localdomains", O_RDONLY) = 9
[pid 25619] 10:12:46.475090 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.475142 fstat(9, {st_dev=makedev(144, 4215), st_ino=108284088, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=265, st_atime=1998/01/01-10:10:00, st_mtime=2015/12/22-14:14:13, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.475187 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.475227 lseek(9, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.475260 read(9, "fin.finestweddingsites.com\nfinestweddingsites.com\nweddingvenuesinphoenix.finestweddingsites.com\nweddingvenuesinphoenix.com\narizonasfinestweddings.finestweddingsites.com\narizonasfinestweddings.com\ntucsonreceptionsites.finestweddingsites.com\ntucsonreceptions"..., 4096) = 265
[pid 25619] 10:12:46.475326 stat("/jail_owner", 0x7ffcd8269f30) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.475376 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25619] 10:12:46.475462 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09_fin.finestweddingsites.com/config.pck", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.475513 stat("/usr/local/cpanel/3rdparty/mailman/mail/mailman", {st_dev=makedev(144, 4215), st_ino=115626718, st_mode=S_IFREG|0700, st_nlink=1, st_uid=206, st_gid=206, st_blksize=4096, st_blocks=48, st_size=22510, st_atime=2015/12/22-10:13:36, st_mtime=2015/12/22-10:13:36, st_ctime=2015/12/22-10:13:39}) = 0
[pid 25619] 10:12:46.475659 stat("/usr/local/cpanel/3rdparty/mailman/lists/finest09/config.pck", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.475704 stat("/etc/demouids", {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.475772 open("/etc/demouids", O_RDONLY) = 10
[pid 25619] 10:12:46.475818 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.475865 fstat(10, {st_dev=makedev(144, 4215), st_ino=108270448, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.475908 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5220000
[pid 25619] 10:12:46.475943 lseek(10, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.475976 read(10, "", 4096) = 0
[pid 25619] 10:12:46.476015 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25619] 10:12:46.476105 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.476163 open("/etc/userdomains", O_RDONLY) = 11
[pid 25619] 10:12:46.476200 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.476246 fstat(11, {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.476289 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521f000
[pid 25619] 10:12:46.476325 lseek(11, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.476363 read(11, "weddingvenuesinphoenix.finestweddingsites.com: finest09\nweddingvenuesinphoenix.com: finest09\narizonasfinestweddings.finestweddingsites.com: finest09\narizonasfinestweddings.com: finest09\nfinestweddingsites.com: finest09\nfin.finestweddingsites.com: nobody\ntu"..., 4096) = 353
[pid 25619] 10:12:46.476437 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 12
[pid 25619] 10:12:46.476490 fstat(12, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.476615 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521e000
[pid 25619] 10:12:46.476659 read(12, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.476706 close(12)   = 0
[pid 25619] 10:12:46.476740 munmap(0x7f1fd521e000, 4096) = 0
[pid 25619] 10:12:46.476799 stat("//etc/fin.finestweddingsites.com", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.476848 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.476911 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.476971 stat("/etc/vfilters/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109093036, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.477036 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.477093 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.477147 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.477210 stat("//etc/fin.finestweddingsites.com/finest09/filter", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.477252 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.477307 open("/etc/valiases/fin.finestweddingsites.com", O_RDONLY) = 12
[pid 25619] 10:12:46.477348 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.477399 fstat(12, {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.477458 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521e000
[pid 25619] 10:12:46.477500 lseek(12, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.477534 read(12, "", 4096) = 0
[pid 25619] 10:12:46.477678 open("/etc/group", O_RDONLY|O_CLOEXEC) = 13
[pid 25619] 10:12:46.477724 fstat(13, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25619] 10:12:46.477770 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521d000
[pid 25619] 10:12:46.477807 read(13, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25619] 10:12:46.477853 close(13)   = 0
[pid 25619] 10:12:46.477887 munmap(0x7f1fd521d000, 4096) = 0
[pid 25619] 10:12:46.477937 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.478000 stat("//.spamassassinboxenable", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.478045 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.478096 stat("/usr/local/cpanel/bin/boxtrapper", {st_dev=makedev(144, 4215), st_ino=109614234, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=13648, st_size=6984505, st_atime=2015/12/22-09:36:58, st_mtime=2015/12/22-09:36:58, st_ctime=2015/12/22-09:38:33}) = 0
[pid 25619] 10:12:46.478154 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.478195 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.478251 stat("//etc/fin.finestweddingsites.com/passwd", 0x7ffcd826cd20) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.478295 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.478349 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.478495 getuid()    = 0
[pid 25619] 10:12:46.478535 geteuid()   = 0
[pid 25619] 10:12:46.478655 getgid()    = 12
[pid 25619] 10:12:46.478689 getegid()   = 12
[pid 25619] 10:12:46.478785 open("/dev/urandom", O_RDONLY) = 13
[pid 25619] 10:12:46.478836 read(13, " \314\vr", 4) = 4
[pid 25619] 10:12:46.478874 close(13)   = 0
[pid 25619] 10:12:46.478990 readlink("/proc/self/exe", "/usr/sbin/exim", 4095) = 14
[pid 25619] 10:12:46.479102 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269b80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.479146 lseek(0, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.479181 ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269b80) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.479222 lseek(1, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.479254 ioctl(2, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269b90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.479287 lseek(2, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.479324 open("/dev/null", O_RDONLY) = 13
[pid 25619] 10:12:46.479365 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269c60) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.479409 lseek(13, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.479452 fcntl(13, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.479492 rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, 8) = 0
[pid 25619] 10:12:46.479830 brk(0x20bf000) = 0x20bf000
[pid 25619] 10:12:46.479885 read(13, "", 8192) = 0
[pid 25619] 10:12:46.479925 close(13)   = 0
[pid 25619] 10:12:46.480226 stat("/etc/exim.pl", {st_dev=makedev(144, 4215), st_ino=108284082, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=56, st_size=26257, st_atime=2015/10/21-08:42:14, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.480290 open("/etc/exim.pl", O_RDONLY) = 13
[pid 25619] 10:12:46.480332 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269a90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.480368 lseek(13, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.480430 read(13, "\nBEGIN {\n    unshift @INC, '/etc/exim/perl';\n}\n\nmy $hasmd5;\n\nsub loadmd5 {\n    if ( defined $hasmd5 ) { return; }\n    eval {\n#require Digest::Perl::MD5;\n        $hasmd5 = 1;\n    };\n}\n\nsub checkrelayhost {\n    my ($hostaddress) = @_;\n\n    if ( $hostaddress "..., 8192) = 8192
[pid 25619] 10:12:46.481343 brk(0x20e0000) = 0x20e0000
[pid 25619] 10:12:46.481727 read(13, "homedir) = gethomedir($owner);\n    my ($isspam)  = 0;\n\n    my $headers = Exim::expand_string('$message_headers');\n    if ( $headers =~ /^X-Spam-Status: Yes/m ) {\n        $isspam = 1;\n    }\n\n    if ( -e $homedir . \"/.spamassassinboxenable\" && $isspam ) {\n  "..., 8192) = 8192
[pid 25619] 10:12:46.482503 brk(0x2101000) = 0x2101000
[pid 25619] 10:12:46.483016 read(13, "uid($uid);\n    }\n    open( DEMOUSERS, \"<\", \"/etc/demousers\" );\n    my @DEMOUSERS = <DEMOUSERS>;\n    close(DEMOUSERS);\n\n    if ( grep( /^\\Q${user}\\E$/, @DEMOUSERS ) ) {\n        return (1);\n    }\n\n    return (0);\n}\n\nsub readbacktodate {\n    my ($filename) = "..., 8192) = 8192
[pid 25619] 10:12:46.483745 brk(0x2122000) = 0x2122000
[pid 25619] 10:12:46.484197 read(13, "$ctx1->digest;\n    }\n\n    # Final xform\n\n    $passwd = '';\n    $passwd .= to64( int( unpack( \"C\", ( substr( $final, 0, 1 ) ) ) << 16 ) | int( unpack( \"C\", ( substr( $final, 6,  1 ) ) ) << 8 ) | int( unpack( \"C\", ( substr( $final, 12, 1 ) ) ) ), 4 );\n    $p"..., 8192) = 1681
[pid 25619] 10:12:46.484495 read(13, "", 8192) = 0
[pid 25619] 10:12:46.484610 close(13)   = 0
[pid 25619] 10:12:46.484672 stat("/usr/share/amavis/amavis-filter", 0x7f1fd38bf880) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.484719 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.484771 stat("/etc/exim.pl.local", {st_dev=makedev(144, 4215), st_ino=108284068, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=224, st_size=112343, st_atime=2015/12/22-10:20:10, st_mtime=2015/12/22-10:20:10, st_ctime=2015/12/22-10:20:10}) = 0
[pid 25619] 10:12:46.484824 open("/etc/exim.pl.local", O_RDONLY) = 13
[pid 25619] 10:12:46.484864 ioctl(13, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd8269a90) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.484908 lseek(13, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.484958 read(13, "my $VALIASES_DIR       = '/etc/valiases';\nmy $VDOMAINALIASES_DIR = '/etc/vdomainaliases';\n\nmy $outgoing_sender;\nmy $outgoing_sender_domain;\nmy $outgoing_sender_counted_domain;\nmy $outgoing_sender_sysuser;\nmy $outgoing_sender_is_mailman;\nmy $outgoing_sender"..., 8192) = 8192
[pid 25619] 10:12:46.485272 brk(0x2143000) = 0x2143000
[pid 25619] 10:12:46.485476 stat("/etc/exim/perl/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485527 stat("/etc/exim/perl/warnings.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485640 stat("/usr/local/cpanel/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485681 stat("/usr/local/cpanel/warnings.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485720 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485766 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/warnings.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485810 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485850 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/warnings.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485890 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485930 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/warnings.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.485971 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.486010 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", {st_dev=makedev(144, 4215), st_ino=110107864, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18672, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.486063 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/warnings.pm", O_RDONLY) = 14
[pid 25619] 10:12:46.486106 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd82694a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.486141 lseek(14, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.486203 read(14, "# -*- buffer-read-only: t -*-\n# !!!!!!!   DO NOT EDIT THIS FILE   !!!!!!!\n# This file is built by regen/warnings.pl.\n# Any changes made here will be lost!\n\npackage warnings;\n\nour $VERSION = '1.12';\n\n# Verify that we're called correctly so that warnings wil"..., 8192) = 8192
[pid 25619] 10:12:46.486610 read(14, "0\\x00\\x00\\x00\\x00\\x00\", # [19]\n    'regexp'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", # [20]\n    'reserved'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\", # [37]\n    'semicolon'\t\t=> \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x"..., 8192) = 8192
[pid 25619] 10:12:46.487206 brk(0x2164000) = 0x2164000
[pid 25619] 10:12:46.487415 read(14, "$offset;\n    }\n    else {\n        $category = (caller(1))[0] ;\n        $offset = $Offsets{$category};\n        Croaker(\"package '$category' not registered for warnings\")\n\t    unless defined $offset ;\n    }\n\n    my $i;\n\n    if ($isobj) {\n        my $pkg;\n   "..., 8192) = 2288
[pid 25619] 10:12:46.487912 read(14, "", 8192) = 0
[pid 25619] 10:12:46.487961 close(14)   = 0
[pid 25619] 10:12:46.488731 read(13, "ing('$domain');\n    if ( $domain ne $parent_domain ) {\n        return 0;\n    }\n\n    my $parent_local_part = Exim::expand_string('$parent_local_part');\n    my $local_part        = Exim::expand_string('$local_part');\n\n    # case 60975: If any deliveries happ"..., 8192) = 8192
[pid 25619] 10:12:46.489484 read(13, "expand_string('$local_part') . '@' . Exim::expand_string('$domain') );\n\n    if ( open( my $emailt_fh, '>>', \"/var/cpanel/email_send_limits/track/$domain/\" . join( '.', ( gmtime($time) )[ 2, 3, 4, 5 ] ) ) ) {\n\n        print {$emailt_fh} '1';\n        close($"..., 8192) = 8192
[pid 25619] 10:12:46.490233 read(13, "l_ips_users\";\n                }\n                elsif ( grep { tr/@// ? $sender_address eq $_ : $sender_address eq $_ . '@' . $primary_hostname } @possible_users ) {\n                    $sender                                   = $sender_address;\n         "..., 8192) = 8192
[pid 25619] 10:12:46.490870 brk(0x2185000) = 0x2185000
[pid 25619] 10:12:46.490959 read(13, "on_uid;\n\n        # Log this for tailwatchd\n        Exim::log_write(\"SMTP connection identification H=localhost A=$sender_host_address P=$sender_host_port U=$local_connection_user ID=$local_connection_uid S=$local_connection_user B=identify_local_connection"..., 8192) = 8192
[pid 25619] 10:12:46.491518 read(13, " ( $actual_sender_local_part, $actual_sender_domain ) = split( m{@}, $qualified_actual_sender, 2 );\n\n    my $actual_sender_domainowner;\n\n    require Cpanel::Encoder::Exim;\n\n    return ( 0, 'invalid_origin_domain' ) if $origin_domain =~ m{/};\n\n    if ( file"..., 8192) = 8192
[pid 25619] 10:12:46.492062 brk(0x21a6000) = 0x21a6000
[pid 25619] 10:12:46.492503 read(13, " && $sender !~ tr/\\@// ) {\n            ( $sender, $domain, $sender_lookup_method ) = resolve_authenticated_sender( $sender, $domain, $sender_lookup_method );\n        }\n\n        #Exim::log_write(\"!DEBUG! get_message_sender() got domain $domain from authenti"..., 8192) = 8192
[pid 25619] 10:12:46.493094 read(13, "od = 'uid via shell cgi: ' . $username;\n                }\n                $domain = getusersdomain($username) || '-system-';\n                $sender = $username;\n            }\n\n            # If the sender owns the domain they are sending\n            # from"..., 8192) = 8192
[pid 25619] 10:12:46.493459 brk(0x21c7000) = 0x21c7000
[pid 25619] 10:12:46.493821 read(13, "                                                            # this is how we decide to defer or fail the message\n                    my $message             = \"Domain $domain has exceeded the max emails per hour ($currentmail/$maxmails ($percentage\\%)) all"..., 8192) = 8192
[pid 25619] 10:12:46.494446 read(13, "id($current_pid) ) {\n                $httpd_pid        = $current_pid;\n                $http_status_data = $status_data;\n                last;\n            }\n        }\n\n        if ($http_status_data) {\n            my $uri = ( split( /\\s+/, $http_status_data"..., 8192) = 8192
[pid 25619] 10:12:46.494796 brk(0x21e8000) = 0x21e8000
[pid 25619] 10:12:46.495309 stat("/usr/local/cpanel/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495366 stat("/usr/local/cpanel/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495421 stat("/etc/exim/perl/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495469 stat("/etc/exim/perl/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495511 stat("/usr/local/cpanel/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495601 stat("/usr/local/cpanel/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495646 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495690 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495731 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495778 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495822 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495863 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/strict.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495903 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.495942 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", {st_dev=makedev(144, 4215), st_ino=110105452, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3716, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.495997 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/strict.pm", O_RDONLY) = 14
[pid 25619] 10:12:46.496039 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd82694a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.496076 lseek(14, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.496127 read(14, "package strict;\n\n$strict::VERSION = \"1.04\";\n\n# Verify that we're called correctly so that strictures will work.\nunless ( __FILE__ =~ /(^|[\\/\\\\])\\Q${\\__PACKAGE__}\\E\\.pmc?$/ ) {\n    # Can't use Carp, since Carp uses us!\n    my (undef, $f, $l) = caller;\n    d"..., 8192) = 3716
[pid 25619] 10:12:46.496341 lseek(14, 878, SEEK_SET) = 878
[pid 25619] 10:12:46.496385 lseek(14, 0, SEEK_CUR) = 878
[pid 25619] 10:12:46.496430 close(14)   = 0
[pid 25619] 10:12:46.496754 read(13, "GIN Cpanel/Encoder/Exim.pm\npackage Cpanel::Encoder::Exim;\n\n\n\nmy %encodes = (\n    q{\\\\}  => q{\\\\\\\\\\\\\\\\},    #\\ -> \\\\\\\\\n    q{\"}   => q{\\\\\"},         #\" -> \\\"\n    q{$}   => q{\\\\\\\\$},       #$ -> \\\\$\n    \"\\x0a\" => q{\\\\n},         #newline -> \\n\n    \"\\x0d\" => "..., 8192) = 8192
[pid 25619] 10:12:46.497262 brk(0x2209000) = 0x2209000
[pid 25619] 10:12:46.497394 read(13, "d\n\n        ( $idiag_dst_0, $idiag_dst_1, $idiag_dst_2, $idiag_dst_3 ) = unpack( 'N4', pack( 'n8', split /:/, Cpanel::IP::Convert::expand_ip($remote_address) ) );\n        ( $idiag_src_0, $idiag_src_1, $idiag_src_2, $idiag_src_3 ) = unpack( 'N4', pack( 'n8',"..., 8192) = 8192
[pid 25619] 10:12:46.498496 brk(0x222a000) = 0x222a000
[pid 25619] 10:12:46.498629 read(13, "nge_firstip, 6 );\n        $mask_offset = ( 128 - 32 );    # If we convert the range from ipv4 to ipv6 we need to move the mask\n    }\n\n    my $size = 128;\n\n    my $range_firstip_binary_string = ip2binary_string($range_firstip);\n    my $range_lastip_binary_s"..., 8192) = 8192
[pid 25619] 10:12:46.499860 brk(0x224b000) = 0x224b000
[pid 25619] 10:12:46.500106 read(13, "         $uid = $6;\n                last;\n            }\n\n        }\n        return $uid;\n\n    }\n\n    return;\n}\n\nsub _dec_port_to_hex_port {\n    my ($dec_port) = @_;\n\n    return sprintf( '%04X', $dec_port );\n}\n\nsub _ipv4_txt_to_little_endian_hex_address {\n  "..., 8192) = 5847
[pid 25619] 10:12:46.500967 stat("/usr/local/cpanel/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501025 stat("/usr/local/cpanel/Errno.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501068 stat("/etc/exim/perl/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501105 stat("/etc/exim/perl/Errno.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501142 stat("/usr/local/cpanel/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501179 stat("/usr/local/cpanel/Errno.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501225 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501267 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Errno.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501309 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501350 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Errno.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501390 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.501431 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", {st_dev=makedev(144, 4215), st_ino=110108082, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size=6233, st_atime=2014/12/16-16:20:59, st_mtime=2014/12/16-16:20:59, st_ctime=2015/12/22-09:38:36}) = 0
[pid 25619] 10:12:46.501486 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/5.14.4/x86_64-linux-64int/Errno.pm", O_RDONLY) = 14
[pid 25619] 10:12:46.501536 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd82694a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.501574 lseek(14, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.501626 read(14, "# -*- buffer-read-only: t -*-\n#\n# This file is auto-generated. ***ANY*** changes here will be lost\n#\n\npackage Errno;\nrequire Exporter;\nuse strict;\n\nour $VERSION = \"1.13\";\n$VERSION = eval $VERSION;\nour @ISA = 'Exporter';\n\nmy %err;\n\nBEGIN {\n    %err = (\n\tEPE"..., 8192) = 6233
[pid 25619] 10:12:46.501750 brk(0x226c000) = 0x226c000
[pid 25619] 10:12:46.502272 lseek(14, 4868, SEEK_SET) = 4868
[pid 25619] 10:12:46.502391 lseek(14, 0, SEEK_CUR) = 4868
[pid 25619] 10:12:46.502427 close(14)   = 0
[pid 25619] 10:12:46.502476 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502519 stat("/usr/local/cpanel/Exporter.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502565 stat("/etc/exim/perl/Exporter.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502601 stat("/etc/exim/perl/Exporter.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502637 stat("/usr/local/cpanel/Exporter.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502674 stat("/usr/local/cpanel/Exporter.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502711 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502752 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/x86_64-linux-64int/Exporter.pm", 0x7ffcd82696b0) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502796 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pmc", 0x7ffcd8269750) = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.502838 stat("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", {st_dev=makedev(144, 4215), st_ino=110108772, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18752, st_atime=2013/03/27-10:34:20, st_mtime=2013/03/27-10:34:20, st_ctime=2015/12/22-09:38:37}) = 0
[pid 25619] 10:12:46.502892 open("/usr/local/cpanel/3rdparty/perl/514/lib64/perl5/cpanel_lib/Exporter.pm", O_RDONLY) = 14
[pid 25619] 10:12:46.502940 ioctl(14, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7ffcd82694a0) = -1 ENOTTY (Inappropriate ioctl for device)
[pid 25619] 10:12:46.502988 lseek(14, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.503036 read(14, "package Exporter;\n\nrequire 5.006;\n\n# Be lean.\n#use strict;\n#no strict 'refs';\n\nour $Debug = 0;\nour $ExportLevel = 0;\nour $Verbose ||= 0;\nour $VERSION = '5.68';\nour (%Cache);\n\nsub as_heavy {\n  require Exporter::Heavy;\n  # Unfortunately, this does not work i"..., 8192) = 8192
[pid 25619] 10:12:46.503486 lseek(14, 2366, SEEK_SET) = 2366
[pid 25619] 10:12:46.503607 lseek(14, 0, SEEK_CUR) = 2366
[pid 25619] 10:12:46.503645 close(14)   = 0
[pid 25619] 10:12:46.503960 read(13, "", 8192) = 0
[pid 25619] 10:12:46.504007 close(13)   = 0
[pid 25619] 10:12:46.504194 lseek(12, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.504236 read(12, "", 4096) = 0
[pid 25619] 10:12:46.504294 stat("/etc/vdomainaliases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.504368 open("/etc/vdomainaliases/fin.finestweddingsites.com", O_RDONLY) = 13
[pid 25619] 10:12:46.504420 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.504478 fstat(13, {st_dev=makedev(144, 4215), st_ino=109092808, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.504586 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521d000
[pid 25619] 10:12:46.504633 lseek(13, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.504667 read(13, "", 4096) = 0
[pid 25619] 10:12:46.504706 stat("/etc/valiases/fin.finestweddingsites.com", {st_dev=makedev(144, 4215), st_ino=109092804, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/28-15:55:49, st_mtime=2015/12/28-15:55:49, st_ctime=2015/12/28-15:55:49}) = 0
[pid 25619] 10:12:46.504776 open("/etc/group", O_RDONLY|O_CLOEXEC) = 14
[pid 25619] 10:12:46.504821 fstat(14, {st_dev=makedev(144, 4215), st_ino=108276992, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=941, st_atime=2015/12/22-14:13:50, st_mtime=2015/12/22-14:13:50, st_ctime=2015/12/22-14:13:50}) = 0
[pid 25619] 10:12:46.504865 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521c000
[pid 25619] 10:12:46.504901 read(14, "root:x:0:\nbin:x:1:bin,daemon\ndaemon:x:2:bin,daemon\nsys:x:3:bin,adm\nadm:x:4:adm,daemon\ntty:x:5:\ndisk:x:6:\nlp:x:7:daemon\nmem:x:8:\nkmem:x:9:\nwheel:x:10:\nmail:x:12:mail\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\nau"..., 4096) = 941
[pid 25619] 10:12:46.504948 close(14)   = 0
[pid 25619] 10:12:46.504982 munmap(0x7f1fd521c000, 4096) = 0
[pid 25619] 10:12:46.505037 open("/etc/aliases", O_RDONLY) = 14
[pid 25619] 10:12:46.505080 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25619] 10:12:46.505127 fstat(14, {st_dev=makedev(144, 4215), st_ino=108281998, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1512, st_atime=2015/12/22-09:30:28, st_mtime=2015/08/04-13:44:53, st_ctime=2015/12/22-09:40:23}) = 0
[pid 25619] 10:12:46.505171 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521c000
[pid 25619] 10:12:46.505206 lseek(14, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.505238 read(14, "#\n#  Aliases in this file will NOT be expanded in the header from\n#  Mail, but WILL be visible over networks or from /bin/mail.\n#\n#\t>>>>>>>>>>\tThe program \"newaliases\" must be run after\n#\t>> NOTE >>\tthis file is updated for any changes to\n#\t>>>>>>>>>>\tshow"..., 4096) = 1512
[pid 25619] 10:12:46.505297 read(14, "", 4096) = 0
[pid 25619] 10:12:46.505343 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 15
[pid 25619] 10:12:46.505383 fstat(15, {st_dev=makedev(144, 4215), st_ino=108276346, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2429, st_atime=2015/12/22-14:14:14, st_mtime=2015/12/22-14:14:14, st_ctime=2015/12/22-14:14:14}) = 0
[pid 25619] 10:12:46.505492 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521b000
[pid 25619] 10:12:46.505534 read(15, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutd"..., 4096) = 2429
[pid 25619] 10:12:46.505670 close(15)   = 0
[pid 25619] 10:12:46.505707 munmap(0x7f1fd521b000, 4096) = 0
[pid 25619] 10:12:46.505759 open("/etc/localaliases", O_RDONLY) = 15
[pid 25619] 10:12:46.505803 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25619] 10:12:46.505853 fstat(15, {st_dev=makedev(144, 4215), st_ino=108284086, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/10/21-08:42:15, st_mtime=2015/10/21-08:42:15, st_ctime=2015/12/22-09:40:20}) = 0
[pid 25619] 10:12:46.505897 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd521b000
[pid 25619] 10:12:46.505933 lseek(15, 0, SEEK_SET) = 0
[pid 25619] 10:12:46.505974 read(15, "", 4096) = 0
[pid 25619] 10:12:46.506021 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.506083 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.506139 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.506194 stat("/etc/userdomains", {st_dev=makedev(144, 4215), st_ino=108270342, st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=12, st_blksize=4096, st_blocks=8, st_size=353, st_atime=2015/12/30-04:02:37, st_mtime=2015/12/30-04:02:37, st_ctime=2015/12/30-04:02:37}) = 0
[pid 25619] 10:12:46.506251 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.506320 write(8, "2015-12-30 10:12:46 routing failed for finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 101) = 101
[pid 25619] 10:12:46.506370 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.506426 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.506491 close(7)    = 0
[pid 25619] 10:12:46.506530 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25619] 10:12:46.506576 fcntl(7, F_GETFD) = 0
[pid 25619] 10:12:46.506608 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.506640 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5400969, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.506688 write(7, "2015-12-30 10:12:46 [25619] 1aEJMk-0006fB-D1 ** finest09@fin.finestweddingsites.com F=<>: Unrouteable address\n", 110) = 110
[pid 25619] 10:12:46.506729 close(14)   = 0
[pid 25619] 10:12:46.506762 munmap(0x7f1fd521c000, 4096) = 0
[pid 25619] 10:12:46.506801 close(15)   = 0
[pid 25619] 10:12:46.506835 munmap(0x7f1fd521b000, 4096) = 0
[pid 25619] 10:12:46.506869 close(10)   = 0
[pid 25619] 10:12:46.506902 munmap(0x7f1fd5220000, 4096) = 0
[pid 25619] 10:12:46.506936 close(11)   = 0
[pid 25619] 10:12:46.506968 munmap(0x7f1fd521f000, 4096) = 0
[pid 25619] 10:12:46.507003 close(9)    = 0
[pid 25619] 10:12:46.507036 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.507070 close(13)   = 0
[pid 25619] 10:12:46.507102 munmap(0x7f1fd521d000, 4096) = 0
[pid 25619] 10:12:46.507136 close(12)   = 0
[pid 25619] 10:12:46.507169 munmap(0x7f1fd521e000, 4096) = 0
[pid 25619] 10:12:46.507220 geteuid()   = 0
[pid 25619] 10:12:46.507255 getegid()   = 12
[pid 25619] 10:12:46.507288 setgid(12)  = 0
[pid 25619] 10:12:46.507322 setuid(47)  = 0
[pid 25619] 10:12:46.507487 rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f1fd2e216a0}, {SIG_DFL, [], 0}, 8) = 0
[pid 25619] 10:12:46.507543 write(8, "*** Frozen (delivery error message)\n", 36) = 36
[pid 25619] 10:12:46.507585 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.507640 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25619] 10:12:46.507690 close(7)    = 0
[pid 25619] 10:12:46.507726 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25619] 10:12:46.507766 fcntl(7, F_GETFD) = 0
[pid 25619] 10:12:46.507797 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25619] 10:12:46.507828 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5401079, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.507871 write(7, "2015-12-30 10:12:46 [25619] 1aEJMk-0006fB-D1 Frozen (delivery error message)\n", 77) = 77
[pid 25619] 10:12:46.507911 open("/var/spool/exim/input/k/hdr.25619", O_RDWR|O_CREAT|O_EXCL, 0640) = 9
[pid 25619] 10:12:46.507993 fchown(9, 47, 12) = 0
[pid 25619] 10:12:46.508032 fchmod(9, 0640) = 0
[pid 25619] 10:12:46.508066 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
[pid 25619] 10:12:46.508100 fstat(9, {st_dev=makedev(144, 4215), st_ino=116662264, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.508144 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fd5221000
[pid 25619] 10:12:46.508180 lseek(9, 0, SEEK_CUR) = 0
[pid 25619] 10:12:46.508230 write(9, "1aEJMk-0006fB-D1-H\nmailnull 47 12\n<>\n1451491966 0\n-ident mailnull\n-received_protocol local\n-body_linecount 39\n-max_received_linelength 1857\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-frozen 1451491966\n-localerror\nXX\n1\nfinest09@fin.finestweddin"..., 268) = 268
[pid 25619] 10:12:46.508282 fstat(9, {st_dev=makedev(144, 4215), st_ino=116662264, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=268, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.508333 write(9, "172P Received: from mailnull by fin.finestweddingsites.com with local (Exim 4.86)\n\tid 1aEJMk-0006fB-D1\n\tfor finest09@fin.finestweddingsites.com; Wed, 30 Dec 2015 10:12:46 -0600\n057  X-Failed-Recipients: finest09@fin.finestweddingsites.com\n029  Auto-Submitt"..., 692) = 692
[pid 25619] 10:12:46.508376 fsync(9)    = 0
[pid 25619] 10:12:46.515573 fstat(9, {st_dev=makedev(144, 4215), st_ino=116662264, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=8, st_size=960, st_atime=2015/12/30-10:12:46, st_mtime=2015/12/30-10:12:46, st_ctime=2015/12/30-10:12:46}) = 0
[pid 25619] 10:12:46.515632 close(9)    = 0
[pid 25619] 10:12:46.515668 munmap(0x7f1fd5221000, 4096) = 0
[pid 25619] 10:12:46.515713 rename("/var/spool/exim/input/k/hdr.25619", "/var/spool/exim/input/k/1aEJMk-0006fB-D1-H") = 0
[pid 25619] 10:12:46.515812 open("/var/spool/exim/input/k/.", O_RDONLY|O_DIRECTORY) = 9
[pid 25619] 10:12:46.515855 fsync(9)    = 0
[pid 25619] 10:12:46.515887 close(9)    = 0
[pid 25619] 10:12:46.515920 close(8)    = 0
[pid 25619] 10:12:46.515952 munmap(0x7f1fd5222000, 4096) = 0
[pid 25619] 10:12:46.515995 unlink("/var/spool/exim/input/k/1aEJMk-0006fB-D1-J") = -1 ENOENT (No such file or directory)
[pid 25619] 10:12:46.516038 close(6)    = 0
[pid 25619] 10:12:46.516206 exit_group(0) = ?
[pid 25619] 10:12:46.516761 +++ exited with 0 +++
[pid 25513] 10:12:57.399712 <... select resumed> ) = 1 (in [11], left {279, 255410})
[pid 25513] 10:12:57.399835 recvfrom(11, "220-host26.registrar-servers.com ESMTP Exim 4.86 #2 Wed, 30 Dec 2015 11:12:57 -0500 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n", 4096, 0, NULL, NULL) = 186
[pid 25513] 10:12:57.399936 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25513] 10:12:57.400042 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25514] 10:12:57.408383 <... select resumed> ) = 1 (in [11], left {279, 244247})
[pid 25514] 10:12:57.408459 recvfrom(11, "220-host26.registrar-servers.com ESMTP Exim 4.86 #2 Wed, 30 Dec 2015 11:12:57 -0500 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n", 4096, 0, NULL, NULL) = 186
[pid 25514] 10:12:57.408533 sendto(11, "EHLO fin.finestweddingsites.com\r\n", 33, 0, NULL, 0) = 33
[pid 25514] 10:12:57.408608 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25513] 10:12:57.416150 <... select resumed> ) = 1 (in [11], left {299, 983963})
[pid 25513] 10:12:57.416226 recvfrom(11, "250-host26.registrar-servers.com Hello fin.finestweddingsites.com [50.116.78.207]\r\n250-SIZE 52428800\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-AUTH PLAIN LOGIN\r\n250-STARTTLS\r\n250 HELP\r\n", 4096, 0, NULL, NULL) = 178
[pid 25513] 10:12:57.416334 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25513] 10:12:57.416441 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25514] 10:12:57.424357 <... select resumed> ) = 1 (in [11], left {299, 984303})
[pid 25514] 10:12:57.424418 recvfrom(11, "250-host26.registrar-servers.com Hello fin.finestweddingsites.com [50.116.78.207]\r\n250-SIZE 52428800\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-AUTH PLAIN LOGIN\r\n250-STARTTLS\r\n250 HELP\r\n", 4096, 0, NULL, NULL) = 178
[pid 25514] 10:12:57.424496 sendto(11, "STARTTLS\r\n", 10, 0, NULL, 0) = 10
[pid 25514] 10:12:57.424563 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25513] 10:12:57.441697 <... select resumed> ) = 1 (in [11], left {299, 974826})
[pid 25513] 10:12:57.441792 recvfrom(11, "220 TLS go ahead\r\n", 4096, 0, NULL, NULL) = 18
[pid 25513] 10:12:57.444682 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25513] 10:12:57.444797 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25513] 10:12:57.444890 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25513] 10:12:57.444963 read(14, "G$\254\311\26^\1=\222\326W\270\323A\354\324uw\212:\210\343\0351i\312\365&\326\0:\317\34\320Z\362\21\313\362\200\335\341l\221\"o\346\353", 48) = 48
[pid 25513] 10:12:57.445039 close(14)   = 0
[pid 25513] 10:12:57.445115 getuid()    = 47
[pid 25514] 10:12:57.449226 <... select resumed> ) = 1 (in [11], left {299, 975366})
[pid 25514] 10:12:57.449277 recvfrom(11, "220 TLS go ahead\r\n", 4096, 0, NULL, NULL) = 18
[pid 25514] 10:12:57.451299 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
[pid 25514] 10:12:57.451359 fstat(14, {st_dev=makedev(144, 4277), st_ino=1289713435, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 9), st_atime=2015/12/22-09:31:08, st_mtime=2015/12/22-09:31:08, st_ctime=2015/12/22-09:31:08}) = 0
[pid 25514] 10:12:57.451417 poll([{fd=14, events=POLLIN}], 1, 10) = 1 ([{fd=14, revents=POLLIN}])
[pid 25514] 10:12:57.451460 read(14, "\313\6!B\363\336\2271\316\343\215\204\327\371\264c\231\256}:\305\347\263\4\5^\255\t\313\t\266\va\327,`\216\n\263vMc\322^\271#\207\227", 48) = 48
[pid 25514] 10:12:57.451502 close(14)   = 0
[pid 25514] 10:12:57.451550 getuid()    = 47
[pid 25514] 10:12:57.463716 open("/etc/pki/tls/cert.pem", O_RDONLY <unfinished ...>
[pid 25513] 10:12:57.465512 open("/etc/pki/tls/cert.pem", O_RDONLY) = 14
[pid 25513] 10:12:57.465664 fstat(14, {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25513] 10:12:57.465788 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be6000
[pid 25513] 10:12:57.465862 read(14, "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25513] 10:12:57.465950 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25513] 10:12:57.466155 read(14, "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25513] 10:12:57.466236 read(14, "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25513] 10:12:57.466401 read(14, " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25513] 10:12:57.466480 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25513] 10:12:57.466641 read(14, "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25513] 10:12:57.466930 read(14, "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25513] 10:12:57.467093 read(14,  <unfinished ...>
[pid 25514] 10:12:57.467139 <... open resumed> ) = 14
[pid 25513] 10:12:57.467170 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25513] 10:12:57.467219 read(14,  <unfinished ...>
[pid 25514] 10:12:57.467262 fstat(14,  <unfinished ...>
[pid 25513] 10:12:57.467295 <... read resumed> "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25514] 10:12:57.467331 <... fstat resumed> {st_dev=makedev(144, 4215), st_ino=109319978, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1720, st_size=877042, st_atime=2015/12/22-09:30:28, st_mtime=2015/04/23-11:07:09, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25513] 10:12:57.467480 read(14,  <unfinished ...>
[pid 25514] 10:12:57.467515 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be6000
[pid 25514] 10:12:57.467576 read(14, "# This is a bundle of X.509 certificates of public Certificate\n# Authorities.  It was generated from the Mozilla root CA list.\n#\n# Source: nss/lib/ckfw/builtins/certdata.txt\n# Source: nss/lib/ckfw/builtins/nssckbi.h\n#\n# Generated from:\n# NSS_BUILTINS_LIBRA"..., 4096) = 4096
[pid 25514] 10:12:57.467669 read(14, "IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1\nk3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs\n2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD\nVR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC\nA"..., 4096) = 4096
[pid 25514] 10:12:57.467960 read(14,  <unfinished ...>
[pid 25513] 10:12:57.468000 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25513] 10:12:57.468127 read(14,  <unfinished ...>
[pid 25514] 10:12:57.468162 <... read resumed> "                 User Notice:\n                    Explicit Text: \n                  CPS: http://www.accv.es/legislacion_c.htm\n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.accv.es/fileadmin/Archi"..., 4096) = 4096
[pid 25514] 10:12:57.468214 read(14,  <unfinished ...>
[pid 25513] 10:12:57.468247 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25514] 10:12:57.468282 <... read resumed> "jAGMAdgAuAGUA\nczAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu\naHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt\naW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud\nDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXM"..., 4096) = 4096
[pid 25513] 10:12:57.468407 read(14,  <unfinished ...>
[pid 25514] 10:12:57.468545 read(14,  <unfinished ...>
[pid 25513] 10:12:57.468590 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25514] 10:12:57.468783 <... read resumed> " Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A6:B3:E1:2B:2B:49:B6:D7:73:A1:AA:94:F5:01:E7:73:65:4C:AC:50\n            X509v3 Certificate Policies: \n               "..., 4096) = 4096
[pid 25514] 10:12:57.468844 read(14, "CwXEGCSn1WHElkQwg9naRHMTh5+Spqt\nr0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK\nZ05phkOTOPu220+DkdRgfks+KzgHVZhepA==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            57:0a:11:97:4"..., 4096) = 4096
[pid 25514] 10:12:57.469000 read(14,  <unfinished ...>
[pid 25513] 10:12:57.469056 read(14, "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25513] 10:12:57.469191 read(14,  <unfinished ...>
[pid 25514] 10:12:57.469225 <... read resumed> "b9:c0:29:5c:b4:e8:88:f7:3e:36:ae:b7:62:\n         fd:1e:62:de:70:78:10:1c:48:5b:da:bc:a4:38:ba:67:ed:55:\n         3e:5e:57:df:d4:03:40:4c:81:a4:d2:4f:63:a7:09:42:09:14:\n         fc:00:a9:c2:80:73:4f:2e:c0:40:d9:11:7b:48:ea:7a:02:c0:\n         d3:eb:28:01:26:"..., 4096) = 4096
[pid 25514] 10:12:57.469353 read(14,  <unfinished ...>
[pid 25513] 10:12:57.469426 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25513] 10:12:57.469548 read(14, "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25514] 10:12:57.469677 <... read resumed> "d:4a:bc:93:ed:03:1a:e3:8f:\n                    cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db:\n                    2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70:\n                    56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6:\n                    5f:0f:78:9d"..., 4096) = 4096
[pid 25514] 10:12:57.469773 read(14,  <unfinished ...>
[pid 25513] 10:12:57.469830 read(14, "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25513] 10:12:57.469918 read(14,  <unfinished ...>
[pid 25514] 10:12:57.469942 <... read resumed> " 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root\n        Validity\n            Not Before: May 30 10:38:31 2000 GMT\n            N"..., 4096) = 4096
[pid 25514] 10:12:57.469975 read(14, "E\nBTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl\nMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk\nZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB\nIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0Mkh"..., 4096) = 4096
[pid 25514] 10:12:57.470064 read(14,  <unfinished ...>
[pid 25513] 10:12:57.470087 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25513] 10:12:57.470127 read(14, "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25513] 10:12:57.470210 read(14,  <unfinished ...>
[pid 25514] 10:12:57.470233 <... read resumed> "xNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB\nZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV\nBAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV"..., 4096) = 4096
[pid 25514] 10:12:57.470305 read(14,  <unfinished ...>
[pid 25513] 10:12:57.470328 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25513] 10:12:57.470397 read(14,  <unfinished ...>
[pid 25514] 10:12:57.470420 <... read resumed> "3e:aa:f2:b2:85:62:\n         a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07:\n         d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee:\n         c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6:\n         72:5a:77:d2:63:cd:cf:58:89:00:42:63:"..., 4096) = 4096
[pid 25514] 10:12:57.470492 read(14,  <unfinished ...>
[pid 25513] 10:12:57.470517 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25513] 10:12:57.470591 read(14,  <unfinished ...>
[pid 25514] 10:12:57.470615 <... read resumed> "f:27:7d:46:06:5d:43:c6:86:\n         2e:3e:73:b2:26:7d:4f:93:a9:b6:c4:2a:9a:ab:21:97:14:b1:\n         de:8c:d3:ab:89:15:d8:6b:24:d4:f1:16:ae:d8:a4:5c:d4:7f:\n         51:8e:ed:18:01:b1:93:63:bd:bc:f8:61:80:9a:9e:b1:ce:42:\n         70:e2:a9:7d:06:25:7d:27:a1:f"..., 4096) = 4096
[pid 25514] 10:12:57.470702 read(14,  <unfinished ...>
[pid 25513] 10:12:57.470728 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25513] 10:12:57.470900 read(14,  <unfinished ...>
[pid 25514] 10:12:57.470930 <... read resumed> "n\n         89:57:b2:16:7a:a8:c2:fd:d6:d9:9b:9b:34:c2:9c:b4:32:14:\n         4d:a7:a4:df:ec:be:a7:be:f8:43:db:91:37:ce:b4:32:2e:50:\n         55:1a:35:4e:76:43:71:20:ef:93:77:4e:15:70:2e:87:c3:c1:\n         1d:6d:dc:cb:b5:27:d4:2c:56:d1:52:53:3a:44:d2:73:c8:c4"..., 4096) = 4096
[pid 25514] 10:12:57.470996 read(14,  <unfinished ...>
[pid 25513] 10:12:57.471023 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25513] 10:12:57.471054 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25513] 10:12:57.471137 read(14,  <unfinished ...>
[pid 25514] 10:12:57.471160 <... read resumed> "76:e6:e1:8c:bd:\n                    3c:b3:d3:48:4b:e2:c8:f8:7f:92:a8:76:46:9c:42:\n                    65:3e:a4:1e:c1:07:03:5a:46:2d:b8:97:f3:b7:d5:\n                    b2:55:21:ef:ba:dc:4c:00:97:fb:14:95:27:33:bf:\n                    e8:43:47:46:d2:08:99:1"..., 4096) = 4096
[pid 25514] 10:12:57.471197 read(14, "AwEAAaNCMEAwHQYDVR0OBBYE\nFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/\nBAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2\nKI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg\nNt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0"..., 4096) = 4096
[pid 25514] 10:12:57.471308 read(14,  <unfinished ...>
[pid 25513] 10:12:57.471331 <... read resumed> "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25513] 10:12:57.471399 read(14,  <unfinished ...>
[pid 25514] 10:12:57.471422 <... read resumed> "                   08:fd:50:5a:56:e4:68:ac:28:73:a0:7b:e9:7f:18:\n                    92:40:4f:2d:9d:f5:ae:44:48:73:36:06:9e:64:2c:\n                    3b:34:23:db:5c:26:e4:71:79:8f:d4:6e:79:22:b9:\n                    93:c1:ca:cd:c1:56:ed:88:6a:d7:a0:39:21:"..., 4096) = 4096
[pid 25513] 10:12:57.471446 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25514] 10:12:57.471512 read(14,  <unfinished ...>
[pid 25513] 10:12:57.471541 read(14, "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25513] 10:12:57.471638 read(14,  <unfinished ...>
[pid 25514] 10:12:57.471672 <... read resumed> "os TrustedRoot 2011, O=Atos, C=DE\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:95:85:3b:97:6f:2a:3b:2e:3b:cf:a6:f3:29:35:\n           "..., 4096) = 4096
[pid 25514] 10:12:57.471706 read(14, "y/gkRsPCHe6ed\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            53:ec:3b:ee:fb:b2:48:5f\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, CN=Autoridad de Certificacion Firmaprofe"..., 4096) = 4096
[pid 25514] 10:12:57.471836 read(14,  <unfinished ...>
[pid 25513] 10:12:57.471862 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25513] 10:12:57.471935 read(14,  <unfinished ...>
[pid 25514] 10:12:57.471958 <... read resumed> "52:12:4e:97:2c:2a:ac:9d:97:de:48:f2:a3:66:db:c2:\n         d2:83:95:a6:66:a7:9e:25:0f:e9:0b:33:91:65:0a:5a:c3:d9:\n         54:12:dd:af:c3:4e:0e:1f:26:5e:0d:dc:b3:8d:ec:d5:81:70:\n         de:d2:4f:24:05:f3:6c:4e:f5:4c:49:66:8d:d1:ff:d2:0b:25:\n         41:48:"..., 4096) = 4096
[pid 25514] 10:12:57.472029 read(14,  <unfinished ...>
[pid 25513] 10:12:57.472051 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25513] 10:12:57.472082 read(14, "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25513] 10:12:57.472175 read(14,  <unfinished ...>
[pid 25514] 10:12:57.472199 <... read resumed> "               64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2:\n                    62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01:\n                    52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7:\n                    73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a"..., 4096) = 4096
[pid 25514] 10:12:57.472268 read(14,  <unfinished ...>
[pid 25513] 10:12:57.472291 <... read resumed> "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25513] 10:12:57.472361 read(14,  <unfinished ...>
[pid 25514] 10:12:57.472384 <... read resumed> "           Modulus:\n                    00:8b:3c:07:45:d8:f6:df:e6:c7:ca:ba:8d:43:c5:\n                    47:8d:b0:5a:c1:38:db:92:84:1c:af:13:d4:0f:6f:\n                    36:46:20:c4:2e:cc:71:70:34:a2:34:d3:37:2e:d8:\n                    dd:3a:77:2f:c0:eb:"..., 4096) = 4096
[pid 25514] 10:12:57.472449 read(14,  <unfinished ...>
[pid 25513] 10:12:57.472473 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25513] 10:12:57.472505 read(14, "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25513] 10:12:57.472588 read(14,  <unfinished ...>
[pid 25514] 10:12:57.472623 <... read resumed> "ic Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:c7:5e:f7:c1:07:d4:77:fb:43:21:f4:f4:f5:\n                    69:e4:ee:32:01:db:a3:86:1f:e4:59:0d:ba:e7:75:"..., 4096) = 4096
[pid 25514] 10:12:57.472655 read(14, "de:92:9d:7b:09:4d:5a:e7:4b:48:30:5a:\n         18:e6:0a:6d:e6:8f:e0:d2:bb:e6:df:7c:6e:21:82:c1:68:39:\n         4d:b4:98:58:66:62:cc:4a:90:5e:c3:fa:27:04:b1:79:15:74:\n         99:cc:be:ad:20:de:26:60:1c:eb:56:51:a6:a3:ea:e4:a3:3f:\n         a7:ff:61:dc:f1:5a:"..., 4096) = 4096
[pid 25513] 10:12:57.472795 <... read resumed> "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25513] 10:12:57.472869 read(14,  <unfinished ...>
[pid 25514] 10:12:57.472953 read(14, "      f4:8b\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Subject Key Identifier: \n                38:14:E6:C8:F0:A9:A4:03:F4:4E:3E:22:A3:5B:F2"..., 4096) = 4096
[pid 25514] 10:12:57.473037 read(14,  <unfinished ...>
[pid 25513] 10:12:57.473061 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25513] 10:12:57.473148 read(14,  <unfinished ...>
[pid 25514] 10:12:57.473171 <... read resumed> "33:7a:4b:d6:55:f8:05:8d:\n                    4b:69:b0:f5:b3:28:36:5c:14:c4:51:73:4d:6b:0b:\n                    f1:34:07:db:17:39:d7:dc:28:7b:6b:f5:9f:f3:2e:\n                    c1:4f:17:2a:10:f3:cc:ca:e8:eb:fd:6b:ab:2e:9a:\n                    9f:2d:82:6e:0"..., 4096) = 4096
[pid 25514] 10:12:57.473203 read(14, "N44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c\n/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X\nKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY\nzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS\nO1UQRwUVZ2J+GGOmRj8JD"..., 4096) = 4096
[pid 25514] 10:12:57.473294 read(14,  <unfinished ...>
[pid 25513] 10:12:57.473317 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25513] 10:12:57.473396 read(14,  <unfinished ...>
[pid 25514] 10:12:57.473418 <... read resumed> ":4d:5e:f7:e1:53:ff:43:77:fc:9e:4b:67:6c:d7:f3:83:\n         d1:a0:e0:7f:25:df:b8:98:0b:9a:32:38:6c:30:a0:f3:ff:08:\n         15:33:f7:50:4a:7b:3e:a3:3e:20:a9:dc:2f:56:80:0a:ed:41:\n         50:b0:c9:f4:ec:b2:e3:26:44:00:0e:6f:9e:06:bc:22:96:53:\n         70:65"..., 4096) = 4096
[pid 25514] 10:12:57.473489 read(14,  <unfinished ...>
[pid 25513] 10:12:57.473513 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25513] 10:12:57.473544 read(14, "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25514] 10:12:57.473582 <... read resumed> "2a:4d:d2:04:dc:a3:ae:45:f7:\n                    bc:8b:9c:1c:a7:d6:d5:03:dc:08:cb:2e:16:ca:5c:\n                    40:33:e8:67:c3:2e:e7:a6:44:ea:11:45:1c:35:65:\n                    2d:1e:45:61:24:1b:82:2e:a5:9d:33:5d:65:f8:41:\n                    f9:2e:cb:9"..., 4096) = 4096
[pid 25514] 10:12:57.473631 read(14, "wQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud\nDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiQq0OJMa5qvum5EY+fU8PjXQ04IwDQYJKoZI\nhvcNAQEFBQADggIBADKL9p1Kyb4U5YysOMo6CdQbzoaz3evUuii+Eq5FLAR0rBNR\nxVgYZk2C2tXck8An4b58n1KeElb21Zyp9HWc+jcSjxyT7Ff+Bw+r1RL3D65hXlaA\nSfX8MPWbTx9BLxyE04nH4toCdu0"..., 4096) = 4096
[pid 25513] 10:12:57.473830 read(14,  <unfinished ...>
[pid 25514] 10:12:57.473866 read(14, "d9:9c:17:3a:1b:7a:66:b2:\n         01:f6:78:3b:69:5e:2f:ea:ff:4e:f9:28:c3:98:2a:61:4c:b4:\n         24:12:8a:7d:6d:11:14:f7:9c:b5:ca:e6:bc:9e:27:8e:4c:19:\n         c8:a9:bd:7a:c0:d7:36:0e:6d:85:72:6e:a8:c6:a2:6d:f6:fa:\n         73:63:7f:bc:6e:79:08:1c:9d:8a:"..., 4096) = 4096
[pid 25513] 10:12:57.473960 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25514] 10:12:57.474038 read(14,  <unfinished ...>
[pid 25513] 10:12:57.474120 read(14,  <unfinished ...>
[pid 25514] 10:12:57.474145 <... read resumed> "cial Certification Authority, CN=CFCA EV ROOT\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:d7:5d:6b:cd:10:3f:1f:05:59:d5:05:4d:37:b1:"..., 4096) = 4096
[pid 25514] 10:12:57.474176 read(14,  <unfinished ...>
[pid 25513] 10:12:57.474196 <... read resumed> "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25513] 10:12:57.474279 read(14,  <unfinished ...>
[pid 25514] 10:12:57.474302 <... read resumed> "33:ea:9f:e1:32:11:9e:f1:d2:4f:80:f6:1b:\n         40:af:38:9e:11:50:79:73:12:12:cd:e6:6c:9d:2c:88:72:3c:\n         30:81:06:91:22:ea:59:ad:da:19:2e:22:c2:8d:b9:8c:87:e0:\n         66:bc:73:23:5f:21:64:63:80:48:f5:a0:3c:18:3d:94:c8:48:\n         41:1d:40:ba:5e:"..., 4096) = 4096
[pid 25514] 10:12:57.474380 read(14, "d:ef:a9:1d:63:1a:\n                    a0:80:db:03:2f:f9:26:1a:86:d2:8d:bb:a9:be:52:\n                    3a:87:67:48:0d:bf:b4:a0:d8:26:be:23:5f:73:37:\n                    7f:26:e6:92:04:a3:7f:cf:20:a7:b7:f3:3a:ca:cb:\n                    99:cb\n              "..., 4096) = 4096
[pid 25514] 10:12:57.474467 read(14,  <unfinished ...>
[pid 25513] 10:12:57.474490 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25513] 10:12:57.474522 read(14, "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25513] 10:12:57.474608 read(14,  <unfinished ...>
[pid 25514] 10:12:57.474645 <... read resumed> ":b3:52:f0:21:4d:a1:\n                    d8:ba:39:7c:1c:9e:a3:24:9d:f2:83:16:98:aa:16:\n                    7c:43:9b:15:5b:b7:ae:34:91:fe:d4:62:26:18:46:\n                    9a:3f:eb:c1:f9:f1:90:57:eb:ac:7a:0d:8b:db:72:\n                    30:6a:66:d5:e0:46:"..., 4096) = 4096
[pid 25513] 10:12:57.474701 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25513] 10:12:57.474847 read(14,  <unfinished ...>
[pid 25514] 10:12:57.474947 read(14,  <unfinished ...>
[pid 25513] 10:12:57.474974 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25513] 10:12:57.475047 read(14,  <unfinished ...>
[pid 25514] 10:12:57.475070 <... read resumed> " : Jan 18 23:59:59 2038 GMT\n        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority\n        Subject Public Key Info:\n            Public Key Algorithm: id-ecPublicKey\n                Public-Key: (3"..., 4096) = 4096
[pid 25514] 10:12:57.475153 read(14,  <unfinished ...>
[pid 25513] 10:12:57.475176 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25513] 10:12:57.475241 read(14,  <unfinished ...>
[pid 25514] 10:12:57.475264 <... read resumed> ":b4:ab:98:d9:ee:e0:51:83:c3:09:46:4e:6d:\n                    3e:99:fa:95:17:da:7c:33:57:41:3c:8d:51:ed:0b:\n                    b6:5c:af:2c:63:1a:df:57:c8:3f:bc:e9:5d:c4:9b:\n                    af:45:99:e2:a3:5a:24:b4:ba:a9:56:3d:cf:6f:aa:\n                 "..., 4096) = 4096
[pid 25514] 10:12:57.475295 read(14,  <unfinished ...>
[pid 25513] 10:12:57.475315 <... read resumed> " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25513] 10:12:57.475391 read(14,  <unfinished ...>
[pid 25514] 10:12:57.475413 <... read resumed> "v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC\n9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV\n/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf\nZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z\n+pUX2"..., 4096) = 4096
[pid 25514] 10:12:57.475507 read(14,  <unfinished ...>
[pid 25513] 10:12:57.475534 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25513] 10:12:57.475566 read(14, "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25513] 10:12:57.475659 read(14,  <unfinished ...>
[pid 25514] 10:12:57.475682 <... read resumed> "         CPS: http://cps.chambersign.org/cps/chambersroot.html\n\n    Signature Algorithm: sha1WithRSAEncryption\n         0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef:\n         13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90:\n         01:72:93"..., 4096) = 4096
[pid 25513] 10:12:57.475791 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25513] 10:12:57.475892 read(14,  <unfinished ...>
[pid 25514] 10:12:57.475941 read(14, "56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07:\n                    d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d:\n                    04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6:\n                    0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12:\n               "..., 4096) = 4096
[pid 25514] 10:12:57.476041 read(14,  <unfinished ...>
[pid 25513] 10:12:57.476065 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25513] 10:12:57.476138 read(14,  <unfinished ...>
[pid 25514] 10:12:57.476161 <... read resumed> "       fe:dc:e3:01:0f:c9:48:ff\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=FR, O=Dhimyotis, CN=Certigna\n        Validity\n            Not Before: Jun 29 15:13:05 2007 GMT\n            Not After : Jun 29 15:13:05 2027 GMT\n        Subject:"..., 4096) = 4096
[pid 25514] 10:12:57.476193 read(14,  <unfinished ...>
[pid 25513] 10:12:57.476213 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25513] 10:12:57.476289 read(14,  <unfinished ...>
[pid 25514] 10:12:57.476314 <... read resumed> "BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG\n9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h\nbV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc\nfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu\nHWhBp6pX6FOqB9IG"..., 4096) = 4096
[pid 25514] 10:12:57.476396 read(14,  <unfinished ...>
[pid 25513] 10:12:57.476427 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25513] 10:12:57.476522 read(14,  <unfinished ...>
[pid 25514] 10:12:57.476546 <... read resumed> "ee:14:70:00:40:2b:da:47:ab:34:7e:5e:a7:56:30:61:2b:\n         8b:43:ac:fd:b6:88:28:f5:6b:b6:3e:60:4a:ba:42:90:34:67:\n         8d:ea:eb:5f:45:54:3b:17:ac:8b:e4:c6:65:0f:ee:d0:8c:5d:\n         66:39:ce:32:a7:d8:10:97:c0:7e:34:9c:9f:94:f3:f6:86:1f:\n         cf:"..., 4096) = 4096
[pid 25514] 10:12:57.476631 read(14,  <unfinished ...>
[pid 25513] 10:12:57.476655 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25513] 10:12:57.476735 read(14,  <unfinished ...>
[pid 25514] 10:12:57.476818 <... read resumed> "8:78:7a:b6:52:70:\n                    fd:6f:ee:cf:b9:11:cb:5d:77:e1:ec:e9:7e:04:8d:\n                    d6:cc:6f:73:43:57:60:ac:33:0a:44:ec:03:5f:1c:\n                    80:24:91:e5:a8:91:56:12:82:f7:e0:2b:f4:db:ae:\n                    61:2e:89:10:8d:6b:6c"..., 4096) = 4096
[pid 25514] 10:12:57.476905 read(14,  <unfinished ...>
[pid 25513] 10:12:57.476930 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25514] 10:12:57.476955 <... read resumed> "     Validity\n            Not Before: Jun 11 10:46:39 2002 GMT\n            Not After : Jun 11 10:46:39 2027 GMT\n        Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n     "..., 4096) = 4096
[pid 25513] 10:12:57.477039 read(14,  <unfinished ...>
[pid 25514] 10:12:57.477105 read(14, " S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:e3:fb:7d:a3:72:ba"..., 4096) = 4096
[pid 25514] 10:12:57.477198 read(14,  <unfinished ...>
[pid 25513] 10:12:57.477221 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25513] 10:12:57.477290 read(14,  <unfinished ...>
[pid 25514] 10:12:57.477313 <... read resumed> "           a3:da:42:7e:a4:b1:ae:da\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=EU, L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008\n        V"..., 4096) = 4096
[pid 25514] 10:12:57.477344 read(14,  <unfinished ...>
[pid 25513] 10:12:57.477364 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25514] 10:12:57.477387 <... read resumed> "13:a9:23:d0:85:e5:8e:7b:a6:9e:3d:72:13:72:33:f5:aa:7d:\n         c6:63:1f:08:f4:fe:01:7f:24:cf:2b:2c:54:09:de:e2:2b:6d:\n         92:c6:39:4f:16:ea:3c:7e:7a:46:d4:45:6a:46:a8:eb:75:82:\n         56:a7:ab:a0:7c:68:13:33:f6:9d:30:f0:6f:27:39:24:23:2a:\n         "..., 4096) = 4096
[pid 25513] 10:12:57.477418 read(14,  <unfinished ...>
[pid 25514] 10:12:57.477446 read(14,  <unfinished ...>
[pid 25513] 10:12:57.477466 <... read resumed> "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25514] 10:12:57.477490 <... read resumed> "fiDKYGvCYQbTed7N14jHyAxfDZ\nd0jQ\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1218379777 (0x489f0001)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=CN, O=China Internet Network Informati"..., 4096) = 4096
[pid 25514] 10:12:57.477589 read(14,  <unfinished ...>
[pid 25513] 10:12:57.477658 read(14, "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25513] 10:12:57.477766 brk(0x16b5000 <unfinished ...>
[pid 25514] 10:12:57.477861 <... read resumed> "UY78WO5upKv23KzhmBsUs\n4qpnHkWnjQRmQvaPK++IIGmPMowUc9orhpFjIpryp9vOiYurXccUwVswah+xt54u\ngQEC7c+WXmPbqOY4twIDAQABo2MwYTAfBgNVHSMEGDAWgBR8cks5x8DbYqVPm6oY\nNJKiyoOCWTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E\nFgQUfHJLOcfA22KlT5uqGDSSosqDglkwDQYJKoZ"..., 4096) = 4096
[pid 25514] 10:12:57.477944 read(14,  <unfinished ...>
[pid 25513] 10:12:57.477969 <... brk resumed> ) = 0x16b5000
[pid 25513] 10:12:57.478002 read(14, ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25513] 10:12:57.478094 read(14,  <unfinished ...>
[pid 25514] 10:12:57.478117 <... read resumed> "du\nMQswCQYDVQQGEwJJTDAeFw0wNDAzMjQxMTM3MjBaFw0yOTAzMTYxNTA0NTZaMDwx\nGzAZBgNVBAMTEkNvbVNpZ24gU2VjdXJlZCBDQTEQMA4GA1UEChMHQ29tU2lnbjEL\nMAkGA1UEBhMCSUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGtWhf\nHZQVw6QIVS3joFd67+l0Kru5fFdJGhFeTymHDEjWaueP1H5XJLkGieQcPO"..., 4096) = 4096
[pid 25514] 10:12:57.478192 read(14,  <unfinished ...>
[pid 25513] 10:12:57.478216 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25513] 10:12:57.478280 read(14,  <unfinished ...>
[pid 25514] 10:12:57.478303 <... read resumed> "8:30:21:65:03:6c:ec:e9:21:73:ec:9b:03:\n         a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c:\n         d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2:\n         a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2:\n         ae:f2:e3:2b:38:3"..., 4096) = 4096
[pid 25514] 10:12:57.478386 read(14,  <unfinished ...>
[pid 25513] 10:12:57.478410 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25513] 10:12:57.478486 read(14,  <unfinished ...>
[pid 25514] 10:12:57.478510 <... read resumed> "comodoca.com/SecureCertificateServices.crl\n\n                Full Name:\n                  URI:http://crl.comodo.net/SecureCertificateServices.crl\n\n    Signature Algorithm: sha1WithRSAEncryption\n         87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94:"..., 4096) = 4096
[pid 25514] 10:12:57.478595 read(14,  <unfinished ...>
[pid 25513] 10:12:57.478625 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25513] 10:12:57.478711 read(14,  <unfinished ...>
[pid 25514] 10:12:57.478735 <... read resumed> "24:58:24:\n                    ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7:\n                    5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49:\n                    5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06:\n                    9f:d2:5b:5e:11:1b:f4:c7:04:3"..., 4096) = 4096
[pid 25514] 10:12:57.478868 read(14,  <unfinished ...>
[pid 25513] 10:12:57.478894 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25513] 10:12:57.478975 read(14,  <unfinished ...>
[pid 25514] 10:12:57.478999 <... read resumed> "2:65:74:5a:77:3e:51:7d:56:f6:dc:23:b6:d4:ed:\n                    5f:58:b1:37:4d:d5:49:0e:6e:f5:6a:87:d6:d2:8c:\n                    d2:27:c6:e2:ff:36:9f:98:65:a0:13:4e:c6:2a:64:\n                    9b:d5:90:12:cf:14:06:f4:3b:e3:d4:28:be:e8:0e:\n             "..., 4096) = 4096
[pid 25514] 10:12:57.479127 read(14,  <unfinished ...>
[pid 25513] 10:12:57.479154 <... read resumed> "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25513] 10:12:57.479228 read(14, "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25513] 10:12:57.479322 read(14,  <unfinished ...>
[pid 25514] 10:12:57.479346 <... read resumed> "009\n        Validity\n            Not Before: Nov  5 08:35:58 2009 GMT\n            Not After : Nov  5 08:35:58 2029 GMT\n        Subject: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009\n        Subject Public Key Info:\n            Public Key Algorith"..., 4096) = 4096
[pid 25514] 10:12:57.479379 read(14, "IwR21iSCxDPURFP2NlcnRpZmljYXRl\ncmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js\nL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL\nBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni\nacfzcNsgFYbQDfC+rAF1hM5+n02/t2"..., 4096) = 4096
[pid 25513] 10:12:57.479417 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25514] 10:12:57.479486 read(14,  <unfinished ...>
[pid 25513] 10:12:57.479559 read(14,  <unfinished ...>
[pid 25514] 10:12:57.479581 <... read resumed> "0yOTExMDUwODUw\nNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV\nBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn\nljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JU"..., 4096) = 4096
[pid 25513] 10:12:57.479628 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25514] 10:12:57.479735 brk(0x16b5000) = 0x16b5000
[pid 25514] 10:12:57.479838 read(14,  <unfinished ...>
[pid 25513] 10:12:57.479866 read(14, "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25513] 10:12:57.479958 read(14,  <unfinished ...>
[pid 25514] 10:12:57.479982 <... read resumed> ":5e:6a:13:c9:94:95:3d:d2:ee:c8:34:95:d0:80:d4:ad:32:\n         08:80:54:3c:e0:bd:52:53:d7:52:7c:b2:69:3f:7f:7a:cf:6a:\n         74:ca:fa:04:2a:9c:4c:5a:06:a5:e9:20:ad:45:66:0f:69:f1:\n         dd:bf:e9:e3:32:8b:fa:e0:c1:86:4d:72:3c:2e:d8:93:78:0a:\n         2a"..., 4096) = 4096
[pid 25514] 10:12:57.480060 read(14,  <unfinished ...>
[pid 25513] 10:12:57.480084 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25513] 10:12:57.480122 read(14,  <unfinished ...>
[pid 25514] 10:12:57.480144 <... read resumed> "85:89:10\n    Signature Algorithm: sha1WithRSAEncryption\n         a3:1a:2c:9b:17:00:5c:a9:1e:ee:28:66:37:3a:bf:83:c7:3f:\n         4b:c3:09:a0:95:20:5d:e3:d9:59:44:d2:3e:0d:3e:bd:8a:4b:\n         a0:74:1f:ce:10:82:9c:74:1a:1d:7e:98:1a:dd:cb:13:4b:b3:\n        "..., 4096) = 4096
[pid 25514] 10:12:57.480266 read(14,  <unfinished ...>
[pid 25513] 10:12:57.480293 <... read resumed> "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25513] 10:12:57.480375 read(14, "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25513] 10:12:57.480486 read(14,  <unfinished ...>
[pid 25514] 10:12:57.480518 <... read resumed> ":9D:33\n            X509v3 Basic Constraints: \n                CA:TRUE, pathlen:5\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         94:64:59:ad:39:64:e7:29:eb:13:fe:5a:c"..., 4096) = 4096
[pid 25514] 10:12:57.480609 read(14,  <unfinished ...>
[pid 25513] 10:12:57.480635 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25513] 10:12:57.480676 read(14, "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25514] 10:12:57.480791 <... read resumed> "6:b3:bd:b2:97:ed:aa:a7:\n                    f0:b7:c5:a8:3f:95:16:d0:ff:a1:96:eb:08:5f:18:\n                    77:4f\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Digital Signatur"..., 4096) = 4096
[pid 25514] 10:12:57.480883 read(14,  <unfinished ...>
[pid 25513] 10:12:57.480936 read(14, "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25513] 10:12:57.480985 read(14, "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25514] 10:12:57.481022 <... read resumed> "b:11:da:77:70:36:9b:ae:ce:79:87:dc:82:\n                    70:e6:09:74:70:55:69:af:a3:68:9f:bf:dd:b6:79:\n                    b3:f2:9d:70:29:55:f4:ab:ff:95:61:f3:c9:40:6f:\n                    1d:d1:be:93:bb:d3:88:2a:bb:9d:bf:72:5a:56:71:\n                   "..., 4096) = 4096
[pid 25513] 10:12:57.481169 read(14,  <unfinished ...>
[pid 25514] 10:12:57.481247 read(14, "e:8d:\n                    38:4a:8a:49:c6:bc:c6:03:38:07:5f:55:da:7e:09:\n                    6e:e2:7f:5e:d0:45:20:0f:59:76:10:d6:a0:24:f0:\n                    2d:de:36:f2:6c:29:39\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X5"..., 4096) = 4096
[pid 25514] 10:12:57.481343 read(14, "  cb:9c:37:aa:48:13:12:0a:fa:dd:44:9c:4f:52:b0:f4:df:ae:\n         04:f5:79:79:08:a3:24:18:fc:4b:2b:84:c0:2d:b9:d5:c7:fe:\n         f4:c1:1f:58:cb:b8:6d:9c:7a:74:e7:98:29:ab:11:b5:e3:70:\n         a0:a1:cd:4c:88:99:93:8c:91:70:e2:ab:0f:1c:be:93:a9:ff:\n       "..., 4096) = 4096
[pid 25514] 10:12:57.481435 read(14,  <unfinished ...>
[pid 25513] 10:12:57.481467 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25513] 10:12:57.481550 read(14,  <unfinished ...>
[pid 25514] 10:12:57.481573 <... read resumed> " Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:"..., 4096) = 4096
[pid 25514] 10:12:57.481663 read(14,  <unfinished ...>
[pid 25513] 10:12:57.481695 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25513] 10:12:57.481869 read(14,  <unfinished ...>
[pid 25514] 10:12:57.481897 <... read resumed> ":9e:\n         32:de:66:93:0f:f1:cc:b1:09:8f:dd:6c:ab:fa:6b:7f:a0:02:\n         30:39:66:5b:c2:64:8d:b8:9e:50:dc:a8:d5:49:a2:ed:c7:dc:\n         d1:49:7f:17:01:b8:c8:86:8f:4e:8c:88:2b:a8:9a:a9:8a:c5:\n         d1:00:bd:f8:54:e2:9a:e5:5b:7c:b3:27:17\n-----BEGIN "..., 4096) = 4096
[pid 25514] 10:12:57.481974 read(14,  <unfinished ...>
[pid 25513] 10:12:57.481998 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25513] 10:12:57.482089 read(14,  <unfinished ...>
[pid 25514] 10:12:57.482112 <... read resumed> "5d:90:60:\n         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:\n         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:\n         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:\n         77:e8:1f:4a\n-----BEGIN CERTIFICATE-----\nMIIDx"..., 4096) = 4096
[pid 25514] 10:12:57.482192 read(14,  <unfinished ...>
[pid 25513] 10:12:57.482216 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25513] 10:12:57.482298 read(14,  <unfinished ...>
[pid 25514] 10:12:57.482320 <... read resumed> ":52:51:47:74:be:26:ac:\n                    b6:41:75:de:7a:ac:5f:8d:3f:c9:bc:d3:41:11:12:\n                    5b:e5:10:50:eb:31:c5:ca:72:16:22:09:df:7c:4c:\n                    75:3f:63:ec:21:5f:c4:20:51:6b:6f:b1:ab:86:8b:\n                    4f:c2:d6:45:5f:"..., 4096) = 4096
[pid 25514] 10:12:57.482352 read(14, "gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa\nsjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N\ncCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N\n0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie\n4u1Ki7wb/UdKDd9nZ"..., 4096) = 4096
[pid 25514] 10:12:57.482444 read(14,  <unfinished ...>
[pid 25513] 10:12:57.482468 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25513] 10:12:57.482561 read(14,  <unfinished ...>
[pid 25514] 10:12:57.482589 <... read resumed> "4d:b7:45:e2:45:75:24:8f:b6:77:52:e8:1c:d8:\n         10:93:65:f3:f2:59:06:a4:3e:1e:29:ec:5d:d1:d0:ab:7c:e0:\n         0a:90:48:78:ed:4e:98:03:99:fe:28:60:91:1d:30:1d:b8:63:\n         7c:a8:e6:35:b5:fa:d3:61:76:e6:d6:07:4b:ca:69:9a:b2:84:\n         7a:77:93:45:"..., 4096) = 4096
[pid 25514] 10:12:57.482701 read(14,  <unfinished ...>
[pid 25513] 10:12:57.482727 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25513] 10:12:57.482849 read(14,  <unfinished ...>
[pid 25514] 10:12:57.482874 <... read resumed> "        Serial Number:\n            4c:af:73:42:1c:8e:74:02\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: CN=EBG Elektronik Sertifika Hizmet Sa\\xC4\\x9Flay\\xC4\\xB1c\\xC4\\xB1s\\xC4\\xB1, O=EBG Bili\\xC5\\x9Fim Teknolojileri ve Hizmetleri A.\\xC5\\x9"..., 4096) = 4096
[pid 25514] 10:12:57.482906 read(14, "74:de:b8:51:a4:8c:\n         6c:20:3d:a2:fb:b3:d4:09:fd:7b:c2:80:aa:93:6c:29:98:21:\n         a8:bb:16:f3:a9:12:5f:74:b5:87:98:f2:95:26:df:34:ef:8a:\n         53:91:88:5d:1a:94:a3:3f:7c:22:f8:d7:88:ba:a6:8c:96:a8:\n         3d:52:34:62:9f:00:1e:54:55:42:67:c6:"..., 4096) = 4096
[pid 25514] 10:12:57.482998 read(14,  <unfinished ...>
[pid 25513] 10:12:57.483021 <... read resumed> "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25513] 10:12:57.483090 read(14,  <unfinished ...>
[pid 25514] 10:12:57.483112 <... read resumed> "    Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:\n                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:\n                    "..., 4096) = 4096
[pid 25514] 10:12:57.483144 read(14,  <unfinished ...>
[pid 25513] 10:12:57.483165 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25513] 10:12:57.483227 brk(0x16d6000 <unfinished ...>
[pid 25514] 10:12:57.483250 <... read resumed> "AB\no4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4\nopvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo\ndHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAj"..., 4096) = 4096
[pid 25514] 10:12:57.483347 read(14,  <unfinished ...>
[pid 25513] 10:12:57.483371 <... brk resumed> ) = 0x16d6000
[pid 25513] 10:12:57.483401 read(14, "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25513] 10:12:57.483486 read(14,  <unfinished ...>
[pid 25514] 10:12:57.483510 <... read resumed> "B1\nMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1\nczEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG\nCSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy\nMTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aW"..., 4096) = 4096
[pid 25514] 10:12:57.483587 read(14,  <unfinished ...>
[pid 25513] 10:12:57.483616 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25514] 10:12:57.483695 <... read resumed> "  4c:93:3b:65:3c:ed:df:3d:be:a6:e5:95:1a:c3:b5:19:c3:bd:\n         5e:5b:bb:ff:23:ef:68:19:cb:12:93:27:5c:03:2d:6f:30:d0:\n         1e:b6:1a:ac:de:5a:f7:d1:aa:a8:27:a6:fe:79:81:c4:79:99:\n         33:57:ba:12:b0:a9:e0:42:6c:93:ca:56:de:fe:6d:84:0b:08:\n       "..., 4096) = 4096
[pid 25514] 10:12:57.483849 read(14,  <unfinished ...>
[pid 25513] 10:12:57.483885 read(14, ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25513] 10:12:57.483981 read(14,  <unfinished ...>
[pid 25514] 10:12:57.484004 <... read resumed> "eriod: \n                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT\n            X509v3 Authority Key Identifier: \n                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D\n\n            X509v3 Subject Ke"..., 4096) = 4096
[pid 25514] 10:12:57.484091 read(14,  <unfinished ...>
[pid 25513] 10:12:57.484114 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25513] 10:12:57.484145 read(14, "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25513] 10:12:57.484232 read(14,  <unfinished ...>
[pid 25514] 10:12:57.484254 <... read resumed> "fe:63:ec:70:5d:36:ad:67:\n                    77:ae:c9:9d:7c:55:44:3a:a2:63:51:1f:f5:e3:62:\n                    d4:a9:47:07:3e:cc:20\n                ASN1 OID: secp384r1\n        X509v3 extensions:\n            X509v3 Key Usage: critical\n                Certif"..., 4096) = 4096
[pid 25514] 10:12:57.484335 read(14,  <unfinished ...>
[pid 25513] 10:12:57.484360 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25513] 10:12:57.484430 read(14,  <unfinished ...>
[pid 25514] 10:12:57.484453 <... read resumed> "   X509v3 Subject Key Identifier: \n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\n    Signature Algorithm: sha256WithRSAEncryption\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\n         9a:2e:59:89:73:11:ac:43"..., 4096) = 4096
[pid 25514] 10:12:57.484540 read(14,  <unfinished ...>
[pid 25513] 10:12:57.484563 <... read resumed> "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25514] 10:12:57.484641 <... read resumed> "y Usage: \n                Certificate Sign, CRL Sign\n            X509v3 Authority Key Identifier: \n                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4\n\n            X509v3 Subject Key Identifier: \n                48:E6:68:F9:2B"..., 4096) = 4096
[pid 25513] 10:12:57.484705 read(14, "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25513] 10:12:57.484836 read(14,  <unfinished ...>
[pid 25514] 10:12:57.484900 read(14, "FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\n\n    Signature Algorithm: sha1WithRSAEncryption\n         35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f:\n         78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf:\n         dd:41:1a:05:4e:9b:4b:ee:4a:6f"..., 4096) = 4096
[pid 25513] 10:12:57.484943 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25514] 10:12:57.485011 read(14,  <unfinished ...>
[pid 25513] 10:12:57.485084 read(14,  <unfinished ...>
[pid 25514] 10:12:57.485109 <... read resumed> "02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n            X509v3 Authority Key Identifier: \n                keyid:71:38:36:F2:02:31:53:47:2B:6E:BA:65:46:A9:10:15:58:20:05:09\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certi"..., 4096) = 4096
[pid 25514] 10:12:57.485172 brk(0x16d6000 <unfinished ...>
[pid 25513] 10:12:57.485195 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25513] 10:12:57.485265 read(14,  <unfinished ...>
[pid 25514] 10:12:57.485288 <... brk resumed> ) = 0x16d6000
[pid 25514] 10:12:57.485371 read(14,  <unfinished ...>
[pid 25513] 10:12:57.485449 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25514] 10:12:57.485479 <... read resumed> "  fc:d7:0e:da:e0:34:b0:0d:1a:77:e7:e3:08:98:ef:\n                    58:fa:9c:84:b7:36:af:c2:df:ac:d2:f4:10:06:70:\n                    71:35\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n"..., 4096) = 4096
[pid 25513] 10:12:57.485551 read(14,  <unfinished ...>
[pid 25514] 10:12:57.485632 read(14,  <unfinished ...>
[pid 25513] 10:12:57.485667 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25513] 10:12:57.485700 read(14,  <unfinished ...>
[pid 25514] 10:12:57.485730 <... read resumed> "09v3 Subject Key Identifier: \n                15:5F:35:57:51:55:FB:25:B2:AD:03:69:FC:01:A3:FA:BE:11:55:D5\n    Signature Algorithm: ecdsa-with-SHA384\n         30:64:02:30:64:96:59:a6:e8:09:de:8b:ba:fa:5a:88:88:f0:\n         1f:91:d3:46:a8:f2:4a:4c:02:63:fb:6"..., 4096) = 4096
[pid 25514] 10:12:57.485888 read(14,  <unfinished ...>
[pid 25513] 10:12:57.485915 <... read resumed> "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25513] 10:12:57.486011 read(14,  <unfinished ...>
[pid 25514] 10:12:57.486034 <... read resumed> ":0e:44:0d:92:fd:fd:b3:16:36:fa:11:0d:1d:8c:0e:07:89:\n         6a:29:56:f7:72:f4:dd:15:9c:77:35:66:57:ab:13:53:d8:8e:\n         c1:40:c5:d7:13:16:5a:72:c7:b7:69:01:c4:7a:b1:83:01:68:\n         7d:8d:41:a1:94:18:c1:25:5c:fc:f0:fe:83:02:87:7c:0d:0d:\n         cf"..., 4096) = 4096
[pid 25514] 10:12:57.486113 read(14,  <unfinished ...>
[pid 25513] 10:12:57.486136 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25513] 10:12:57.486217 read(14,  <unfinished ...>
[pid 25514] 10:12:57.486241 <... read resumed> "e:0b:e1:f5:28:ae:0b:56:bf:71:8b:\n                    23:29:41:8e:86:c5:4b:52:7b:d8:71:ab:1f:8a:15:\n                    a6:3b:83:5a:d7:58:01:51:c6:4c:41:d9:7f:d8:41:\n                    67:72:a2:28:df:60:83:a9:9e:c8:7b:fc:53:73:72:\n                    59:f5"..., 4096) = 4096
[pid 25514] 10:12:57.486278 read(14, "SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB\n/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY\nMBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG\n9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc\naanQm"..., 4096) = 4096
[pid 25513] 10:12:57.486317 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25514] 10:12:57.486389 read(14,  <unfinished ...>
[pid 25513] 10:12:57.486468 read(14,  <unfinished ...>
[pid 25514] 10:12:57.486498 <... read resumed> ":10:2B\n\n            X509v3 Key Usage: critical\n                Digital Signature, Certificate Sign, CRL Sign\n    Signature Algorithm: sha1WithRSAEncryption\n         66:c1:c6:23:f3:d9:e0:2e:6e:5f:e8:cf:ae:b0:b0:25:4d:2b:\n         f8:3b:58:9b:40:24:37:5a:cb:"..., 4096) = 4096
[pid 25513] 10:12:57.486623 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25513] 10:12:57.486719 read(14, "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25513] 10:12:57.486855 read(14,  <unfinished ...>
[pid 25514] 10:12:57.486882 read(14, "\n        Issuer: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign\n        Validity\n            Not Before: Nov 13 00:00:00 2012 GMT\n            Not After : Jan 19 03:14:07 2038 GMT\n        Subject: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, C"..., 4096) = 4096
[pid 25514] 10:12:57.486965 read(14,  <unfinished ...>
[pid 25513] 10:12:57.486988 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25513] 10:12:57.487076 read(14,  <unfinished ...>
[pid 25514] 10:12:57.487108 <... read resumed> "nbiBFQ0MgUm9vdCBD\nQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc\n8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke\nhOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgN"..., 4096) = 4096
[pid 25514] 10:12:57.487176 read(14,  <unfinished ...>
[pid 25513] 10:12:57.487199 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25514] 10:12:57.487223 <... read resumed> "z8kHp\n1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\nsnUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\nU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgN"..., 4096) = 4096
[pid 25513] 10:12:57.487261 read(14,  <unfinished ...>
[pid 25514] 10:12:57.487333 read(14,  <unfinished ...>
[pid 25513] 10:12:57.487356 <... read resumed> "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25513] 10:12:57.487427 read(14,  <unfinished ...>
[pid 25514] 10:12:57.487450 <... read resumed> "\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1\nMDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJ"..., 4096) = 4096
[pid 25514] 10:12:57.487519 read(14,  <unfinished ...>
[pid 25513] 10:12:57.487584 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25513] 10:12:57.487632 read(14, "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25513] 10:12:57.487783 read(14,  <unfinished ...>
[pid 25514] 10:12:57.487811 <... read resumed> "99:e7:2c:33:1f:3a:3b:25:d2:86:40:ce:3b:2c:\n         86:78:c9:61:2f:14:ba:ee:db:55:6f:df:84:ee:05:09:4d:bd:\n         28:d8:72:ce:d3:62:50:65:1e:eb:92:97:83:31:d9:b3:b5:ca:\n         47:58:3f:5f\n-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIw"..., 4096) = 4096
[pid 25514] 10:12:57.487881 read(14,  <unfinished ...>
[pid 25513] 10:12:57.487905 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25513] 10:12:57.487937 read(14, "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25514] 10:12:57.487975 <... read resumed> "e4:f8:a1:83:e8:3e:12:9b:a8:1e:d4:36:4d:2f:71:\n                    f6:8d:28:f6:83:a9:13:d2:61:c1:91:bb:48:c0:34:\n                    8f:41:8c:4b:4c:db:69:12:ff:50:94:9c:20:83:59:\n                    73:ed:7c:a1:f2:f1:fd:dd:f7:49:d3:43:58:a0:56:\n            "..., 4096) = 4096
[pid 25513] 10:12:57.488046 read(14,  <unfinished ...>
[pid 25514] 10:12:57.488076 read(14, "x9kGbo1106DbDVwo3V\nyJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e\nbeksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r\n6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh\nwZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33Sd"..., 4096) = 4096
[pid 25514] 10:12:57.488183 read(14,  <unfinished ...>
[pid 25513] 10:12:57.488206 <... read resumed> ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25513] 10:12:57.488284 read(14,  <unfinished ...>
[pid 25514] 10:12:57.488315 <... read resumed> "2:02:ad:23:79:69:8d:b8:b6:4d:\n         ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:\n         89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:\n         e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:\n         87:0d:c4:0f:61:8b:ad:ee:8"..., 4096) = 4096
[pid 25514] 10:12:57.488395 read(14,  <unfinished ...>
[pid 25513] 10:12:57.488439 <... read resumed> "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25513] 10:12:57.488473 read(14, "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25513] 10:12:57.488578 read(14,  <unfinished ...>
[pid 25514] 10:12:57.488601 <... read resumed> "ifier: \n                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE\n    Signature Algorithm: sha256WithRSAEncryption\n         99:db:5d:79:d5:f9:97:59:67:03:61:f1:7e:3b:06:31:75:2d:\n         a1:20:8e:4f:65:87:b4:f7:a6:9c:bc:d8:e9:2f:d0:db:5a"..., 4096) = 4096
[pid 25513] 10:12:57.488700 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25514] 10:12:57.488833 read(14,  <unfinished ...>
[pid 25513] 10:12:57.488895 brk(0x16f7000 <unfinished ...>
[pid 25514] 10:12:57.488924 <... read resumed> "      14:40:c7:dc:de:ac:41:64:6c:b4:19:9b:02:63:6d:\n                    24:64:8f:44:b2:25:ea:ce:5d:74:0c:63:32:5c:8d:\n                    87:e5\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: criti"..., 4096) = 4096
[pid 25514] 10:12:57.489009 read(14,  <unfinished ...>
[pid 25513] 10:12:57.489033 <... brk resumed> ) = 0x16f7000
[pid 25513] 10:12:57.489067 read(14, "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25513] 10:12:57.489165 read(14,  <unfinished ...>
[pid 25514] 10:12:57.489188 <... read resumed> "                   22:59:1f:28:df:1f:20:3d:6d:a2:36:be:23:a0:b1:\n                    6e:b5:b1:27:3f:39:53:09:ea:ab:6a:e8:74:b2:c2:\n                    65:5c:8e:bf:7c:c3:78:84:cd:9e:16:fc:f5:2e:4f:\n                    20:2a:08:9f:77:f3:c5:1e:c4:9a:52:66:1e:"..., 4096) = 4096
[pid 25514] 10:12:57.489255 read(14,  <unfinished ...>
[pid 25513] 10:12:57.489278 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25513] 10:12:57.489384 read(14,  <unfinished ...>
[pid 25514] 10:12:57.489424 <... read resumed> "90:\n                    36:c6:d8:2f:da:91:aa:68:c5:72:fe:17:0a:b2:17:\n                    7e:79:b5:32:88:70:ca:70:c0:96:4a:8e:e4:55:cd:\n                    1d:27:94:bf:ce:72:2a:ec:5c:f9:73:20:fe:bd:f7:\n                    2e:89:67:b8:bb:47:73:12:f7:d1:35:6"..., 4096) = 4096
[pid 25514] 10:12:57.489579 read(14,  <unfinished ...>
[pid 25513] 10:12:57.489623 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25513] 10:12:57.489669 read(14, "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25514] 10:12:57.489788 <... read resumed> "st Commercial Root CA 1\n        Validity\n            Not Before: Jan 16 18:12:23 2014 GMT\n            Not After : Jan 16 18:12:23 2034 GMT\n        Subject: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1\n        Subject Public Key Info:\n            Pu"..., 4096) = 4096
[pid 25513] 10:12:57.489850 read(14,  <unfinished ...>
[pid 25514] 10:12:57.489879 read(14, "fa:d7:fe:\n         13:14:a6:ed:3d:94:4a:42:74:d4:c3:77:59:73:cd:8f:46:be:\n         55:38:ef:fa:e8:91:32:ea:97:58:04:22:de:38:c3:cc:bc:6d:\n         c9:33:3a:6a:0a:69:3f:a0:c8:ea:72:8f:8c:63:86:23:bd:6d:\n         3c:96:9e:95:e0:49:4c:aa:a2:b9:2a:1b:9c:36:81:"..., 4096) = 4096
[pid 25514] 10:12:57.489970 read(14,  <unfinished ...>
[pid 25513] 10:12:57.489994 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25513] 10:12:57.490076 read(14,  <unfinished ...>
[pid 25514] 10:12:57.490099 <... read resumed> ":6b:83:72:ef:75:\n                    80:da:06:33:1b:5d:c8:da:63:c6:4d:cd:ac:66:31:\n                    cd:d1:de:3e:87:10:36:e1:b9:a4:7a:ef:60:50:b2:\n                    cb:ca:a6:56:e0:37:af:ab:34:13:39:25:e8:39:66:\n                    e4:98:7a:aa:12:98:9c:"..., 4096) = 4096
[pid 25514] 10:12:57.490172 read(14, "jrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy\nRBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS\nbdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF\n/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R\n3j6HEDbhuaR672BQssvKplbgN6"..., 4096) = 4096
[pid 25514] 10:12:57.490273 read(14,  <unfinished ...>
[pid 25513] 10:12:57.490297 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25513] 10:12:57.490330 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25513] 10:12:57.490453 read(14,  <unfinished ...>
[pid 25514] 10:12:57.490477 <... read resumed> "1:62:e5:82:e5:80:04:a4:03:7e:8d:bf:da:\n                    7f:a2:0f:97:4f:0c:d3:0d:fb:d7:d1:e5:72:7e:1c:\n                    c8:77:ff:5b:9a:0f:b7:ae:05:46:e5:f1:a8:16:ec:\n                    47:a4:17\n                Exponent: 65537 (0x10001)\n        X509v3"..., 4096) = 4096
[pid 25514] 10:12:57.490510 read(14, "Wb\nlaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56\nawmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo\nJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw\nLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6"..., 4096) = 4096
[pid 25514] 10:12:57.490596 read(14, ":03:f4:41:10:7d:39:84:\n         79:96:72:63:b6:96:02:e5:6b:b9:ad:19:4d:bb:c6:44:db:36:\n         cb:2a:9c:8e\n-----BEGIN CERTIFICATE-----\nMIIE5jCCA86gAwIBAgIEO45L/DANBgkqhkiG9w0BAQUFADBdMRgwFgYJKoZIhvcN\nAQkBFglwa2lAc2suZWUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKExlBUyB"..., 4096) = 4096
[pid 25513] 10:12:57.490651 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25513] 10:12:57.490696 read(14, "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25513] 10:12:57.490887 read(14,  <unfinished ...>
[pid 25514] 10:12:57.490945 read(14, "Z/\n                  User Notice:\n                    Explicit Text: \n\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://www.e-szigno.hu/RootCA.crl\n                  URI:ldap://ldap.e-szigno.hu/CN=Microse"..., 4096) = 4096
[pid 25514] 10:12:57.491000 read(14,  <unfinished ...>
[pid 25513] 10:12:57.491020 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25513] 10:12:57.491093 read(14,  <unfinished ...>
[pid 25514] 10:12:57.491116 <... read resumed> "DvTtz3oXakdDByMQswCQYDVQQGEwJI\nVTERMA8GA1UEBxMIQnVkYXBlc3QxFjAUBgNVBAoTDU1pY3Jvc2VjIEx0ZC4xFDAS\nBgNVBAsTC2UtU3ppZ25vIENBMSIwIAYDVQQDExlNaWNyb3NlYyBlLVN6aWdubyBS\nb290IENBghEAzLjnv04pGv2i3GalHCwPETAdBgNVHQ4EFgQUx6BJdRZhhNsxS4TS\n8TdAkO9O3PcwDQYJKoZIhvcNAQEFBQ"..., 4096) = 4096
[pid 25514] 10:12:57.491206 read(14,  <unfinished ...>
[pid 25513] 10:12:57.491271 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25513] 10:12:57.491306 read(14, "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25513] 10:12:57.491401 read(14,  <unfinished ...>
[pid 25514] 10:12:57.491428 <... read resumed> "DU1pY3Jvc2VjIEx0\nZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G\nCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y\nOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx\nFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMM"..., 4096) = 4096
[pid 25514] 10:12:57.491501 brk(0x16f7000 <unfinished ...>
[pid 25513] 10:12:57.491526 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25514] 10:12:57.491551 <... brk resumed> ) = 0x16f7000
[pid 25513] 10:12:57.491578 read(14,  <unfinished ...>
[pid 25514] 10:12:57.491623 read(14,  <unfinished ...>
[pid 25513] 10:12:57.491647 <... read resumed> "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25514] 10:12:57.491688 <... read resumed> "c2:6c:b0:50:59:5d:90:5b:\n         3b:a8:0d:30:cf:bf:7d:7f:ce:f1:9d:83:bd:c9:46:6e:20:a6:\n         f9:61:51:ba:21:2f:7b:be:a5:15:63:a1:d4:95:87:f1:9e:b9:\n         f3:89:f3:3d:85:b8:b8:db:be:b5:b9:29:f9:da:37:05:00:49:\n         94:03:84:44:e7:bf:43:31:cf:75:"..., 4096) = 4096
[pid 25514] 10:12:57.491849 read(14,  <unfinished ...>
[pid 25513] 10:12:57.491889 read(14, "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25513] 10:12:57.491939 read(14,  <unfinished ...>
[pid 25514] 10:12:57.491967 <... read resumed> "CA, S/MIME CA, Object Signing CA\n            Netscape Comment: \n                FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztos"..., 4096) = 4096
[pid 25514] 10:12:57.492111 read(14,  <unfinished ...>
[pid 25513] 10:12:57.492137 <... read resumed> "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25513] 10:12:57.492215 read(14, "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25513] 10:12:57.492305 read(14, "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25514] 10:12:57.492346 <... read resumed> ": sha1WithRSAEncryption\n        Issuer: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority\n        Validity\n            Not Before: Dec  1 00:00:00 2006 GMT\n            Not After : Dec 31 23:59:59 2029 GMT\n        Subject: C=US, O"..., 4096) = 4096
[pid 25514] 10:12:57.492380 read(14,  <unfinished ...>
[pid 25513] 10:12:57.492445 read(14,  <unfinished ...>
[pid 25514] 10:12:57.492467 <... read resumed> "JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8\n6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/\nh1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH\n/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv\nwK"..., 4096) = 4096
[pid 25514] 10:12:57.492539 read(14,  <unfinished ...>
[pid 25513] 10:12:57.492562 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25513] 10:12:57.492604 read(14, "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25513] 10:12:57.492721 read(14,  <unfinished ...>
[pid 25514] 10:12:57.492799 <... read resumed> "dsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\nMIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR\nVVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2\nw93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF\nmQvtRT"..., 4096) = 4096
[pid 25514] 10:12:57.492889 read(14,  <unfinished ...>
[pid 25513] 10:12:57.492912 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25513] 10:12:57.492983 read(14,  <unfinished ...>
[pid 25514] 10:12:57.493006 <... read resumed> " extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE, pathlen:1\n            X509v3 Issuer Alternative Name: \n                DNS:suscerte.gob.ve, othername:<unsupported>\n            X509v3 Subject Key Identifier: \n           "..., 4096) = 4096
[pid 25514] 10:12:57.493042 read(14, "CAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBANW39KOUM6FGqVVhSQ2oh3NekS1wwQYalNo9\n7BVCwfWMrmoX8Yqt/ICV6oNEolt6Vc5Pp6XVurgfoCfAUFM+jbnADrgV3NZs+J74\nBCXfgI8Qhd19L3uA3VcAZCP4bsm+lU/hdezgfl6VzbHvvnpC2Mks0+saGiKLt38G\nieU89RLAu9MLmV+QfI4tL3czkkohRqipCKzx9hEC2ZUWno0"..., 4096) = 4096
[pid 25514] 10:12:57.493174 read(14,  <unfinished ...>
[pid 25513] 10:12:57.493201 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25513] 10:12:57.493320 read(14,  <unfinished ...>
[pid 25514] 10:12:57.493347 <... read resumed> ":66:cb:ea:5d:a6:26:ee:e5:cc:\n                    5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d:\n                    71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36:\n                    cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6:\n                    90:bb\n   "..., 4096) = 4096
[pid 25514] 10:12:57.493382 read(14, "YhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8\n7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R\ncHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y\nmQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW\nxFIY6iHOsfHmhIHluqmGKPJDWl0"..., 4096) = 4096
[pid 25514] 10:12:57.493481 read(14,  <unfinished ...>
[pid 25513] 10:12:57.493506 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25513] 10:12:57.493580 read(14,  <unfinished ...>
[pid 25514] 10:12:57.493627 <... read resumed> "     a9:d0:3b:5f:0b:c0:81:3a:3d:64:e1:bf:a7:2d:4e:bd:4d:c4:\n         d8:29:c6:22:18:d0:c5:ac:72:02:82:3f:aa:3a:a2:3a:22:97:\n         31:dd:08:63:c3:75:14:b9:60:28:2d:5b:68:e0:16:a9:66:82:\n         23:51:f5:eb:53:d8:31:9b:7b:e9:b7:9d:4b:eb:88:16:cf:f9:\n    "..., 4096) = 4096
[pid 25514] 10:12:57.493802 read(14,  <unfinished ...>
[pid 25513] 10:12:57.493843 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25513] 10:12:57.493959 read(14,  <unfinished ...>
[pid 25514] 10:12:57.493998 <... read resumed> "      0b:2d:fd:e9:3e:ef:0a:c6:b3:10:e9:dc:c2:46:17:\n                    f8:5d:fd:a4:da:ff:9e:49:5a:9c:e6:33:e6:24:96:\n                    f7:3f:ba:5b:2b:1c:7a:35:c2:d6:67:fe:ab:66:50:\n                    8b:6d:28:60:2b:ef:d7:60:c3:c7:93:bc:8d:36:91:\n      "..., 4096) = 4096
[pid 25514] 10:12:57.494044 read(14,  <unfinished ...>
[pid 25513] 10:12:57.494075 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25513] 10:12:57.494189 read(14,  <unfinished ...>
[pid 25514] 10:12:57.494230 <... read resumed> "72:e1:a3:93:1d:cc:8a:26:5a:09:38:d0:ce:d7:\n         0d:80:16:b4:78:a5:3a:87:4c:8d:8a:a5:d5:46:97:f2:2c:10:\n         b9:bc:54:22:c0:01:50:69:43:9e:f4:b2:ef:6d:f8:ec:da:f1:\n         e3:b1:ef:df:91:8f:54:2a:0b:25:c1:26:19:c4:52:10:05:65:\n         d5:82:10:ea:"..., 4096) = 4096
[pid 25514] 10:12:57.494351 read(14,  <unfinished ...>
[pid 25513] 10:12:57.494386 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25513] 10:12:57.494489 read(14,  <unfinished ...>
[pid 25514] 10:12:57.494580 <... read resumed> "        8e:c3:d0:6a:13:ed:13:e3:12:2b:80:dc:67:e6:95:\n                    b2:cd:1e:22:6e:2a:f8:41:d4:f2:ca:14:07:8d:8a:\n                    55:12:c6:69:f5:b8:86:68:2f:53:5e:b0:d2:aa:21:\n                    c1:98:e6:30:e3:67:55:c7:9b:6e:ac:19:a8:55:a6:\n    "..., 4096) = 4096
[pid 25514] 10:12:57.494634 read(14, "\nIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz\n8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh\nvNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l\n7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwN"..., 4096) = 4096
[pid 25513] 10:12:57.494799 <... read resumed> ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25513] 10:12:57.494905 read(14,  <unfinished ...>
[pid 25514] 10:12:57.494966 read(14, "           Policy: 1.3.6.1.4.1.8024.0.3\n                  User Notice:\n                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.\n                  "..., 4096) = 4096
[pid 25514] 10:12:57.495034 read(14, "FMQswCQYDVQQGEwJC\nTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg\nUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0\n7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem\nd1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62"..., 4096) = 4096
[pid 25514] 10:12:57.495165 read(14,  <unfinished ...>
[pid 25513] 10:12:57.495196 <... read resumed> "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25513] 10:12:57.495238 read(14, ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25513] 10:12:57.495366 read(14,  <unfinished ...>
[pid 25514] 10:12:57.495405 <... read resumed> "ion\n         34:61:d9:56:b5:12:87:55:4d:dd:a3:35:31:46:bb:a4:07:72:\n         bc:5f:61:62:e8:a5:fb:0b:37:b1:3c:b6:b3:fa:29:9d:7f:02:\n         f5:a4:c9:a8:93:b7:7a:71:28:69:8f:73:e1:52:90:da:d5:be:\n         3a:e5:b7:76:6a:56:80:21:df:5d:e6:e9:3a:9e:e5:3e:f6:"..., 4096) = 4096
[pid 25514] 10:12:57.495541 read(14,  <unfinished ...>
[pid 25513] 10:12:57.495587 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25513] 10:12:57.495637 brk(0x1718000) = 0x1718000
[pid 25514] 10:12:57.495850 <... read resumed> "2026 GMT\n        Subject: O=RSA Security Inc, OU=RSA Security 2048 V3\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:b7:8f:55:71:d2:80:"..., 4096) = 4096
[pid 25514] 10:12:57.495975 read(14,  <unfinished ...>
[pid 25513] 10:12:57.496039 read(14, "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25513] 10:12:57.496114 read(14,  <unfinished ...>
[pid 25514] 10:12:57.496162 <... read resumed> "mber: 994436456 (0x3b45e568)\n    Signature Algorithm: sha1WithRSAEncryption\n        Issuer: C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana\n        Validity\n            Not Before: Jul  6 16:22:47 2001 GMT\n            Not After"..., 4096) = 4096
[pid 25514] 10:12:57.496215 read(14,  <unfinished ...>
[pid 25513] 10:12:57.496247 <... read resumed> "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25513] 10:12:57.496384 read(14,  <unfinished ...>
[pid 25514] 10:12:57.496422 <... read resumed> "GRGmKy3nXiz0+J2ZGQD0EbtFpKd71ng+CT516nDOeB0/RSrFOy\nA8dEJvt55cs0YFAQexvba9dHq198aMpunUEDEO5rmXteJajCq+TA81yc477OMUxk\nHl6AovWDfgzWyoxVjr7gvkkHD6MkQXpYHYTqWBLI4bft75PelAgxAgMBAAGjggM7\nMIIDNzAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBr\naS5ndmEuZX"..., 4096) = 4096
[pid 25514] 10:12:57.496561 read(14,  <unfinished ...>
[pid 25513] 10:12:57.496597 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25513] 10:12:57.496648 read(14,  <unfinished ...>
[pid 25514] 10:12:57.496681 <... read resumed> "1c:34:5c:6c:58:\n         4a:fb:8c:88:50:5f:95:1c:bf:ed:ab:22:b5:65:b3:85:ba:9e:\n         0f:b8:ad:e5:7a:1b:8a:50:3a:1d:bd:0d:bc:7b:54:50:0b:b9:\n         42:af:55:a0:18:81:ad:65:99:ef:be:e4:9c:bf:c4:85:ab:41:\n         b2:54:6f:dc:25:cd:ed:78:e2:8e:0c:8d:09:"..., 4096) = 4096
[pid 25513] 10:12:57.496717 <... read resumed> "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25514] 10:12:57.496959 read(14,  <unfinished ...>
[pid 25513] 10:12:57.497086 read(14, "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25513] 10:12:57.497235 read(14,  <unfinished ...>
[pid 25514] 10:12:57.497270 <... read resumed> "crl.securetrust.com/STCA.crl\n\n            1.3.6.1.4.1.311.21.1: \n                ...\n    Signature Algorithm: sha1WithRSAEncryption\n         30:ed:4f:4a:e1:58:3a:52:72:5b:b5:a6:a3:65:18:a6:bb:51:\n         3b:77:e9:9d:ea:d3:9f:5c:e0:45:65:7b:0d:ca:5b:e2:70:"..., 4096) = 4096
[pid 25514] 10:12:57.497395 read(14,  <unfinished ...>
[pid 25513] 10:12:57.497430 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25513] 10:12:57.497564 read(14,  <unfinished ...>
[pid 25514] 10:12:57.497612 <... read resumed> ":\n                    7a:43\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            1.3.6.1.4.1.311.20.2: \n                ...C.A\n            X509v3 Key Usage: \n                Digital Signature, Certificate Sign, CRL Sign\n        "..., 4096) = 4096
[pid 25514] 10:12:57.497730 read(14,  <unfinished ...>
[pid 25513] 10:12:57.497817 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25513] 10:12:57.497961 read(14,  <unfinished ...>
[pid 25514] 10:12:57.498000 <... read resumed> ":56:36:5d:\n                    d1:9a:1e:51:6b:39:6e:60:76:88:34:0b:f3:b3:d1:\n                    b0:9d:ca:61:e2:64:1d:c1:46:07:b8:63:dd:1e:33:\n                    65:b3:8e:09:55:52:3d:b5:bd:ff:07:eb:ad:61:55:\n                    18:2c:a9:69:98:4a:aa:40:c5:"..., 4096) = 4096
[pid 25514] 10:12:57.498125 read(14,  <unfinished ...>
[pid 25513] 10:12:57.498160 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25513] 10:12:57.498261 read(14,  <unfinished ...>
[pid 25514] 10:12:57.498293 <... read resumed> ":d6:\n                    42:89:c2:bf:f4:38:12:95:4c:54:05:f7:36:e4:45:\n                    83:7b:14:65:d6:dc:0c:4d:d1:de:7e:0c:ab:3b:c4:\n                    15:be:3a:56:a6:5a:6f:76:69:52:a9:7a:b9:c8:eb:\n                    6a:9a:5d:52:d0:2d:0a:6b:35:16:09:"..., 4096) = 4096
[pid 25514] 10:12:57.498416 read(14,  <unfinished ...>
[pid 25513] 10:12:57.498452 <... read resumed> "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25513] 10:12:57.498601 read(14,  <unfinished ...>
[pid 25514] 10:12:57.498639 <... read resumed> "26:dc:d5:1c:6a:71:c6:9a:7d:1e:\n                    9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27:\n                    a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8:\n                    22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21:\n                    68:06:9"..., 4096) = 4096
[pid 25513] 10:12:57.498829 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25513] 10:12:57.498893 read(14, "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25513] 10:12:57.499084 read(14,  <unfinished ...>
[pid 25514] 10:12:57.499116 read(14, ":32:47:d5:41:68:a4:13:04:c1:35:\n                    0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91:\n                    5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed:\n                    e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84:\n                    36:69:"..., 4096) = 4096
[pid 25514] 10:12:57.499214 read(14, "          ba:84:85:c6:85:a4:ca:e6:c9:2e:53:a4:c9:24:1e:\n                    fd:55:66:71:5d:2c:c5:60:68:04:b7:d9:c2:52:26:\n                    38:88:a4:d6:3b:40:a6:c2:cd:3f:cd:98:93:b3:54:\n                    14:58:96:55:d5:50:fe:86:ad:a4:63:7f:5c:87:f6:\n  "..., 4096) = 4096
[pid 25514] 10:12:57.499266 read(14, ":4e:f1:5e:26:25:01:59:23:\n         a0:7e:d2:f6:7e:21:57:d7:27:bc:15:57:4c:a4:46:c1:e0:83:\n         1e:0c:4c:4d:1f:4f:06:19:e2:f9:a8:f4:3a:82:a1:b2:79:43:\n         79:d6:ad:6f:7a:27:90:03:a4:ea:24:87:3f:d9:bd:d9:e9:f2:\n         5f:50:49:1c:ee:ec:d7:2e\n-----"..., 4096) = 4096
[pid 25514] 10:12:57.499357 read(14,  <unfinished ...>
[pid 25513] 10:12:57.499380 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25513] 10:12:57.499448 read(14, "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25513] 10:12:57.499545 read(14,  <unfinished ...>
[pid 25514] 10:12:57.499571 <... read resumed> "Policy: X509v3 Any Policy\n                  CPS: http://www.pkioverheid.nl/policies/root-policy\n\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                A8:7D:EB:BC:63:A4"..., 4096) = 4096
[pid 25514] 10:12:57.499610 brk(0x1718000) = 0x1718000
[pid 25514] 10:12:57.499695 read(14,  <unfinished ...>
[pid 25513] 10:12:57.499718 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25513] 10:12:57.499826 read(14, "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25513] 10:12:57.499924 read(14,  <unfinished ...>
[pid 25514] 10:12:57.499948 <... read resumed> "0f:e8:38:cd:99:\n                    37:21:4f:5d:f5:22:6f:6a:c5:12:16:60:17:55:f2:\n                    65:66:a6:a7:30:91:38:c1:38:1d:86:04:84:ba:1a:\n                    25:78:5e:9d:af:cc:50:60:d6:13:87:52:ed:63:1f:\n                    6d:65:7d:c2:15:18:74:c"..., 4096) = 4096
[pid 25514] 10:12:57.499980 read(14, "Q0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291\nqj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp\nuOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU\nZ5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE\n"..., 4096) = 4096
[pid 25514] 10:12:57.500072 read(14,  <unfinished ...>
[pid 25513] 10:12:57.500095 <... read resumed> "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25513] 10:12:57.500127 read(14, "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25513] 10:12:57.500215 read(14,  <unfinished ...>
[pid 25514] 10:12:57.500239 <... read resumed> ":ab:20:93:b4:e6:82:83:70:36:c5:cd:\n                    a3:8d:ad:8b:ec:a3:c1:43:87:e6:43:e2:34:be:95:\n                    8b:35:ed:07:39:da:a8:1d:7a:9f:36:9e:12:b0:0c:\n                    65:12:90:15:60:d9:26:40:44:e3:56:60:a5:10:d4:\n                    6a:"..., 4096) = 4096
[pid 25514] 10:12:57.500271 read(14, "7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp\ngZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh\n/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw\n0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A\nfsbAddJu+2gw7OyLnflJNZo"..., 4096) = 4096
[pid 25514] 10:12:57.500358 read(14,  <unfinished ...>
[pid 25513] 10:12:57.500381 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25513] 10:12:57.500498 read(14,  <unfinished ...>
[pid 25514] 10:12:57.500528 <... read resumed> "XNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3\nDQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf\n8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN\n+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0\nX9tDk"..., 4096) = 4096
[pid 25514] 10:12:57.500605 read(14,  <unfinished ...>
[pid 25513] 10:12:57.500629 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25513] 10:12:57.500666 read(14, "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25514] 10:12:57.500819 <... read resumed> ":2a:ee:90:59:73:64:\n         f9:36:74:5e:25:a1:f5:66:05:2e:7f:39:15:a9:2a:fb:50:8b:\n         8e:85:69:f4\n-----BEGIN CERTIFICATE-----\nMIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx\nEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBg"..., 4096) = 4096
[pid 25514] 10:12:57.500912 read(14,  <unfinished ...>
[pid 25513] 10:12:57.500954 read(14, ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25514] 10:12:57.500994 <... read resumed> "ab:0b:9b:75:0c:6d:45:b7:8e:94:ac:96:37:b5:a0:d0:8f:\n         15:47:0e:e3:e8:83:dd:8f:fd:ef:41:01:77:cc:27:a9:62:85:\n         33:f2:37:08:ef:71:cf:77:06:de:c8:19:1d:88:40:cf:7d:46:\n         1d:ff:1e:c7:e1:ce:ff:23:db:c6:fa:8d:55:4e:a9:02:e7:47:\n         11:"..., 4096) = 4096
[pid 25514] 10:12:57.501110 read(14,  <unfinished ...>
[pid 25513] 10:12:57.501144 read(14, "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25513] 10:12:57.501242 read(14, "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25513] 10:12:57.501335 read(14,  <unfinished ...>
[pid 25514] 10:12:57.501358 <... read resumed> "  05:4d:58:6e:12:1d:01:ee:12:10:0d:c6:32:7f:18:\n                    ff:fc:f4:fa:cd:6e:91:e8:36:49:be:1a:48:69:8b:\n                    c2:96:4d:1a:12:b2:69:17:c1:0a:90:d6:fa:79:22:\n                    48:bf:ba:7b:69:f8:70:c7:fa:7a:37:d8:d8:0d:d2:\n          "..., 4096) = 4096
[pid 25514] 10:12:57.501391 read(14, "uZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh\ndGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9\nMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi\nU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh\ncnRDb20gQ2VydGlmaWN"..., 4096) = 4096
[pid 25514] 10:12:57.501495 read(14,  <unfinished ...>
[pid 25513] 10:12:57.501521 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25513] 10:12:57.501598 read(14,  <unfinished ...>
[pid 25514] 10:12:57.501621 <... read resumed> ":a9:0e:19:3a:cc:b5:66:a6:\n                    c2:6b:74:07:e4:2b:e1:76:3e:b4:6d:d8:f6:44:e1:\n                    73:62:1f:3b:c4:be:a0:53:56:25:6c:51:09:f7:aa:\n                    ab:ca:bf:76:fd:6d:9b:f3:9d:db:bf:3d:66:bc:0c:\n                    56:aa:af:98:"..., 4096) = 4096
[pid 25514] 10:12:57.501662 read(14,  <unfinished ...>
[pid 25513] 10:12:57.501683 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25514] 10:12:57.501706 <... read resumed> "e0:54:db:ce:ba:a9:32:b5:22:f6:73:41:\n         09:5d:b8:17:5d:0e:0f:99:90:d6:47:da:6f:0a:3a:62:28:14:\n         67:82:d9:f1:d0:80:59:9b:cb:31:d8:9b:0f:8c:77:4e:b5:68:\n         8a:f2:6c:f6:24:0e:2d:6c:70:c5:73:d1:de:14:d0:71:8f:b6:\n         d3:7b:02:f6:e3:b8:"..., 4096) = 4096
[pid 25514] 10:12:57.501877 read(14,  <unfinished ...>
[pid 25513] 10:12:57.501952 read(14, "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25513] 10:12:57.502004 read(14,  <unfinished ...>
[pid 25514] 10:12:57.502024 <... read resumed> "e:7f:27:f7:94:b1:37:3d:b7:c7:91:f7:e2:01:\n                    ec:fd:94:89:e1:cc:6e:d3:36:d6:0a:19:79:ae:d7:\n                    34:82:65:ff:7c:42:bb:b6:dd:0b:a6:34:af:4b:60:\n                    fe:7f:43:49:06:8b:8c:43:b8:56:f2:d9:7f:21:43:\n                "..., 4096) = 4096
[pid 25514] 10:12:57.502054 read(14,  <unfinished ...>
[pid 25513] 10:12:57.502074 <... read resumed> "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25514] 10:12:57.502096 <... read resumed> "WNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1\nOTAxWjBTMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoG\nA1UEAxMjU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwggIiMA0G\nCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2iTZbB7cgNr2Cu+EWIAOVeq8Oo1"..., 4096) = 4096
[pid 25513] 10:12:57.502170 read(14,  <unfinished ...>
[pid 25514] 10:12:57.502246 read(14,  <unfinished ...>
[pid 25513] 10:12:57.502271 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25514] 10:12:57.502295 <... read resumed> "                 38:7a:66:ef:20:83:b5:8c:4a:56:8e:91:00:fc:8e:\n                    5c:82:de:88:a0:c3:e2:68:6e:7d:8d:ef:3c:dd:65:\n                    f4:5d:ac:51:ef:24:80:ae:aa:56:97:6f:f9:ad:7d:\n                    da:61:3f:98:77:3c:a5:91:b6:1c:8c:26:da:65"..., 4096) = 4096
[pid 25513] 10:12:57.502379 read(14,  <unfinished ...>
[pid 25514] 10:12:57.502412 read(14, "HQ4EFgQUWyV7\nlqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn\n8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov\nL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6\n45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD"..., 4096) = 4096
[pid 25513] 10:12:57.502546 <... read resumed> "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25513] 10:12:57.502637 read(14,  <unfinished ...>
[pid 25514] 10:12:57.502665 read(14, "   X509v3 Authority Key Identifier: \n                keyid:17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58\n\n            X509v3 Certificate Policies: \n                Policy: 2.16.756.1.89.1.3.1.1\n                  CPS: http://repository.swisssi"..., 4096) = 4096
[pid 25514] 10:12:57.502716 read(14, "Ej8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36\n    Signature Algorithm: sha1WithRS"..., 4096) = 4096
[pid 25514] 10:12:57.502884 read(14,  <unfinished ...>
[pid 25513] 10:12:57.502911 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25513] 10:12:57.502985 brk(0x1739000) = 0x1739000
[pid 25513] 10:12:57.503044 read(14,  <unfinished ...>
[pid 25514] 10:12:57.503067 <... read resumed> "6:d5:db:0f:c0:49:64:bb:2e:50:19:\n         4b:d2:24:f8:dd:1e:07:56:d0:38:a0:95:70:20:76:8c:d7:dd:\n         1e:de:9f:71:c4:23:ef:83:13:5c:a3:24:15:4d:29:40:3c:6a:\n         c4:a9:d8:b7:a6:44:a5:0d:f4:e0:9d:77:1e:40:70:26:fc:da:\n         d9:36:e4:79:e4:b5:3f:b"..., 4096) = 4096
[pid 25514] 10:12:57.503147 read(14,  <unfinished ...>
[pid 25513] 10:12:57.503169 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25513] 10:12:57.503201 read(14, "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25513] 10:12:57.503291 read(14,  <unfinished ...>
[pid 25514] 10:12:57.503314 <... read resumed> "e6:d3:09:e8:72:5a:23:69:\n                    db:78:70:8e:16:f1:2b:8f:0d:03:ce:93:cc:2e:00:\n                    08:7b:ab:33:8c:f4:e9:40:e6:17:4c:ab:9e:b8:47:\n                    14:32:77:32:dd:28:0c:de:18:4b:5f:76:9f:f8:39:\n                    3b:fc:4e:89:d"..., 4096) = 4096
[pid 25514] 10:12:57.503344 read(14, "61:d3:27:70:d8:37:fe:9f:b9:af:a0:2e:56:b7:a3:65:51:ed:\n         3b:ab:14:bf:4c:51:03:e8:5f:8a:05:9b:ee:8a:6e:9c:ef:bf:\n         68:fa:c8:da:0b:e3:42:c9:d0:17:14:9c:b7:4a:e0:af:93:27:\n         21:55:26:b5:64:2f:8d:f1:ff:a6:40:05:85:05:5c:ca:07:19:\n         "..., 4096) = 4096
[pid 25514] 10:12:57.503444 read(14,  <unfinished ...>
[pid 25513] 10:12:57.503468 <... read resumed> "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25513] 10:12:57.503547 read(14,  <unfinished ...>
[pid 25514] 10:12:57.503601 <... read resumed> ":45:d8:cc:\n                    0d:43:7f:ae:13:d2:6b:2b:3f:a7:c2:e2:a8:6d:76:\n                    5b:43:9f:be:b4:9d:b3:26:86:3b:1f:7f:e5:f2:e8:\n                    66:28:16:25:d0:4b:97:38:a7:e4:cf:09:d1:36:c3:\n                    0b:be:da:3b:44:58:8d:be:f1:"..., 4096) = 4096
[pid 25514] 10:12:57.503650 read(14,  <unfinished ...>
[pid 25513] 10:12:57.503675 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25514] 10:12:57.503705 <... read resumed> "wIwYDVQQLExxEaWdp\ndGFsIENlcnRpZmljYXRlIFNlcnZpY2VzMR4wHAYDVQQDExVTd2lzc2NvbSBSb290\nIEVWIENBIDIwHhcNMTEwNjI0MDk0NTA4WhcNMzEwNjI1MDg0NTA4WjBnMQswCQYD\nVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0YWwgQ2Vy\ndGlmaWNhdGUgU2VydmljZXMxHjAcBgNVBAMTFVN3aXN"..., 4096) = 4096
[pid 25514] 10:12:57.503877 read(14,  <unfinished ...>
[pid 25513] 10:12:57.503933 read(14, "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25513] 10:12:57.503984 read(14, "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25514] 10:12:57.504031 <... read resumed> "hm: sha256WithRSAEncryption\n         31:03:a2:61:0b:1f:74:e8:72:36:c6:6d:f9:4d:9e:fa:22:a8:\n         e1:81:56:cf:cd:bb:9f:ea:ab:91:19:38:af:aa:7c:15:4d:f3:\n         b6:a3:8d:a5:f4:8e:f6:44:a9:a7:e8:21:95:ad:3e:00:62:16:\n         88:f0:02:ba:fc:61:23:e6:33:"..., 4096) = 4096
[pid 25513] 10:12:57.504104 read(14,  <unfinished ...>
[pid 25514] 10:12:57.504180 read(14,  <unfinished ...>
[pid 25513] 10:12:57.504203 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25513] 10:12:57.504271 read(14,  <unfinished ...>
[pid 25514] 10:12:57.504294 <... read resumed> "       Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: "..., 4096) = 4096
[pid 25514] 10:12:57.504370 read(14,  <unfinished ...>
[pid 25513] 10:12:57.504393 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25513] 10:12:57.504426 read(14,  <unfinished ...>
[pid 25514] 10:12:57.504446 <... read resumed> "3:e9:4a:\n                    f1:e7:49:b0:14:e3:f5:62:cb:d5:72:bd:1f:b9:d2:\n                    9f:a0:cd:a8:fa:01:c8:d9:0d:df:da:fc:47:9d:b3:\n                    c8:54:df:49:4a:f1:21:a9:fe:18:4e:ee:48:d4:19:\n                    bb:ef:7d:e4:e2:9d:cb:5b:b6:6e"..., 4096) = 4096
[pid 25514] 10:12:57.504534 read(14,  <unfinished ...>
[pid 25513] 10:12:57.504559 <... read resumed> "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25513] 10:12:57.504711 read(14,  <unfinished ...>
[pid 25514] 10:12:57.504736 <... read resumed> "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                 "..., 4096) = 4096
[pid 25514] 10:12:57.504865 read(14, "G5wALPT\nujdEWBF6AmqI8Dc08BnprNRlc/ZpjGSUOnmFKbAWKwyCPwacx/0QK54PLLae4xW/\n2TYcuiUaUj0a7CIMHOCkoj3w6DnPgcB77V0fb8XQC9eY\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 1 (0x1)\n    Signature Algorithm: sha1With"..., 4096) = 4096
[pid 25514] 10:12:57.505011 read(14,  <unfinished ...>
[pid 25513] 10:12:57.505036 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25513] 10:12:57.505068 read(14, "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25513] 10:12:57.505169 read(14,  <unfinished ...>
[pid 25514] 10:12:57.505193 <... read resumed> "u6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C\nurKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1\nJuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51\nb0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV\n9VX/N5aAWSGk/KEVTCD21F/"..., 4096) = 4096
[pid 25514] 10:12:57.505283 read(14, "tZXQgU2HEn2xhecSxY8Sx\nc8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV4wXAYDVQQKDFVUw5xS\nS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg\nSGl6bWV0bGVyaSBBLsWeLiAoYykgQXJhbMSxayAyMDA3MB4XDTA3MTIyNTE4Mzcx\nOVoXDTE3MTIyMjE4MzcxOVowgb8xPzA9BgNVBAM"..., 4096) = 4096
[pid 25513] 10:12:57.505332 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25514] 10:12:57.505414 read(14,  <unfinished ...>
[pid 25513] 10:12:57.505505 read(14,  <unfinished ...>
[pid 25514] 10:12:57.505530 <... read resumed> ":17:49:ff:d2:29:f1:38:26:5d:ef:a5:aa:3a:f9:71:7b:e6:\n         da:58:1d:d3:74:c2:01:fa:3e:69:58:5f:ad:cb:68:be:14:2e:\n         9b:6c:c0:b6:dc:a0:26:fa:77:1a:e2:24:da:1a:37:e0:67:ad:\n         d1:73:83:0d:a5:1a:1d:6e:12:92:7e:84:62:00:17:bd:bc:25:\n         18"..., 4096) = 4096
[pid 25514] 10:12:57.505595 brk(0x1739000 <unfinished ...>
[pid 25513] 10:12:57.505619 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25513] 10:12:57.505706 read(14,  <unfinished ...>
[pid 25514] 10:12:57.505737 <... brk resumed> ) = 0x1739000
[pid 25514] 10:12:57.505832 read(14,  <unfinished ...>
[pid 25513] 10:12:57.505855 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25514] 10:12:57.505879 <... read resumed> "5:\n                    a2:ce:cf:da:82:e7:07:34:19:96:e9:b8:21:aa:29:\n                    7e:a6:38:be:8e:29:4a:21:66:79:1f:b3:c3:b5:09:\n                    67:de:d6:d4:07:46:f3:2a:da:e6:22:37:60:cb:81:\n                    b6:0f:a0:0f:e9:c8:95:7f:bf:55:91:05"..., 4096) = 4096
[pid 25513] 10:12:57.506008 read(14,  <unfinished ...>
[pid 25514] 10:12:57.506042 read(14, "YwDwYDVR0TAQH/BAUwAwEB\n/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL\n1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn\nLhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF\nH6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34"..., 4096) = 4096
[pid 25514] 10:12:57.506136 read(14, "NBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm\naWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE\nAcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH\nK3XLfJ+utdGdIzdjp9xCoi"..., 4096) = 4096
[pid 25514] 10:12:57.506226 read(14,  <unfinished ...>
[pid 25513] 10:12:57.506249 <... read resumed> ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25513] 10:12:57.506285 read(14,  <unfinished ...>
[pid 25514] 10:12:57.506307 <... read resumed> "0/0-...0...+......0...g*........\"...(6....2.1:.Qe\n    Signature Algorithm: sha1WithRSAEncryption\n         40:80:4a:fa:26:c9:ce:5e:30:dd:4f:86:74:76:58:f5:ae:b3:\n         83:33:78:a4:7a:74:17:19:4e:e9:52:b5:b9:e0:0a:74:62:aa:\n         68:ca:78:a0:4c:9a:8e:2"..., 4096) = 4096
[pid 25513] 10:12:57.506338 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25514] 10:12:57.506409 read(14,  <unfinished ...>
[pid 25513] 10:12:57.506503 read(14,  <unfinished ...>
[pid 25514] 10:12:57.506530 <... read resumed> "ot CA v1\n        Validity\n            Not Before: Oct 18 12:00:50 2007 GMT\n            Not After : Oct 18 12:00:50 2032 GMT\n        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncr"..., 4096) = 4096
[pid 25514] 10:12:57.506562 read(14, "26:c8:eb:0c:d6:26:88:b6:c0:24:cf:bb:\n         bd:5b:eb:75:7d:e9:08:8e:86:33:2c:79:77:09:69:a5:89:fc:\n         b3:70:90:87:76:8f:d3:22:bb:42:ce:bd:73:0b:20:26:2a:d0:\n         9b:3d:70:1e:24:6c:cd:87:76:a9:17:96:b7:cf:0d:92:fb:8e:\n         18:a9:98:49:d1:9e:"..., 4096) = 4096
[pid 25514] 10:12:57.506645 read(14,  <unfinished ...>
[pid 25513] 10:12:57.506668 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25514] 10:12:57.506793 <... read resumed> ":d2:14:35:9a:2e:4e:8c:ea:32:98:28:86:a1:\n                    91:09:41:3a:b4:e1:e3:f2:fa:f0:c9:0a:a2:41:dd:\n                    a9:e3:03:c7:88:15:3b:1c:d4:1a:94:d7:9f:64:59:\n                    12:6d\n                Exponent: 65537 (0x10001)\n        X509v3 "..., 4096) = 4096
[pid 25514] 10:12:57.506868 read(14,  <unfinished ...>
[pid 25513] 10:12:57.506901 read(14, "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25513] 10:12:57.507003 read(14,  <unfinished ...>
[pid 25514] 10:12:57.507026 <... read resumed> "    fa:f3:22:4c:95:a0:90:bc:48:4e:11:ab:fb:b7:b5:\n                    8d:7a:83:28:8c:26:46:d8:4e:95:40:87:61:9f:c5:\n                    9e:6d:81:87:57:6c:8a:3b:b4:66:ea:cc:40:fc:e3:\n                    aa:6c:b2:cb:01:db:32:bf:d2:eb:85:cf:a1:0d:55:\n        "..., 4096) = 4096
[pid 25514] 10:12:57.507059 read(14, "pQjyttgI=\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26\n    Signature Algorithm: ecdsa-with-SHA384\n        Issuer: C=US, ST=New Jersey, L=Jersey "..., 4096) = 4096
[pid 25514] 10:12:57.507252 read(14,  <unfinished ...>
[pid 25513] 10:12:57.507279 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25513] 10:12:57.507363 read(14, ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25513] 10:12:57.507458 read(14, "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25514] 10:12:57.507504 <... read resumed> ":3f:bc:33:\n                    fe:7e:6c:9c:ff:16:9d:18:bd:51:8e:35:a6:a7:66:\n                    c8:72:67:db:21:66:b1:d4:9b:78:03:c0:50:3a:e8:\n                    cc:f0:dc:bc:9e:4c:fe:af:05:96:35:1f:57:5a:b7:\n                    ff:ce:f9:3d:b7:2c:b6:f6:54:"..., 4096) = 4096
[pid 25513] 10:12:57.507592 read(14,  <unfinished ...>
[pid 25514] 10:12:57.507627 read(14, "VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV\nBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw\nMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV\nBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU\naGUgVVNFUlRSVVNUIE5ldHdvcmsx"..., 4096) = 4096
[pid 25514] 10:12:57.507734 read(14,  <unfinished ...>
[pid 25513] 10:12:57.507806 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25513] 10:12:57.507840 read(14, "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25513] 10:12:57.507931 read(14,  <unfinished ...>
[pid 25514] 10:12:57.507954 <... read resumed> "5:1D:B4:4F\n            X509v3 CRL Distribution Points: \n\n                Full Name:\n                  URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl\n\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication, Microsoft Server "..., 4096) = 4096
[pid 25514] 10:12:57.508041 read(14,  <unfinished ...>
[pid 25513] 10:12:57.508064 <... read resumed> ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25513] 10:12:57.508098 read(14,  <unfinished ...>
[pid 25514] 10:12:57.508118 <... read resumed> "5e:23:bc:45:9b:7b:50:c1:c9:\n                    30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98:\n                    17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e:\n                    69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b:\n                    29:0d:46:0"..., 4096) = 4096
[pid 25513] 10:12:57.508141 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25514] 10:12:57.508228 read(14,  <unfinished ...>
[pid 25513] 10:12:57.508298 read(14, "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25513] 10:12:57.508436 read(14,  <unfinished ...>
[pid 25514] 10:12:57.508463 <... read resumed> "N=VeriSign Class 3 Public Primary Certification Authority - G4\n        Validity\n            Not Before: Nov  5 00:00:00 2007 GMT\n            Not After : Jan 18 23:59:59 2038 GMT\n        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 200"..., 4096) = 4096
[pid 25514] 10:12:57.508556 read(14, ":f5:f1:ad:c8:31:89:5d:22:e8:\n                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:\n                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:\n                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:\n                    54:85:26:"..., 4096) = 4096
[pid 25514] 10:12:57.508611 read(14,  <unfinished ...>
[pid 25513] 10:12:57.508633 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25513] 10:12:57.508703 brk(0x175a000 <unfinished ...>
[pid 25514] 10:12:57.508727 <... read resumed> "2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d\n    Signature Algorithm: sha256WithRSAEncryption\n        "..., 4096) = 4096
[pid 25514] 10:12:57.508870 read(14,  <unfinished ...>
[pid 25513] 10:12:57.508899 <... brk resumed> ) = 0x175a000
[pid 25513] 10:12:57.508930 read(14, "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25513] 10:12:57.508978 read(14,  <unfinished ...>
[pid 25514] 10:12:57.508998 <... read resumed> "gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF\n9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH\nH26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H\nLL729fdC4uW/h2KJXwBL38X"..., 4096) = 4096
[pid 25514] 10:12:57.509083 read(14,  <unfinished ...>
[pid 25513] 10:12:57.509106 <... read resumed> "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25513] 10:12:57.509178 read(14, "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25513] 10:12:57.509279 read(14,  <unfinished ...>
[pid 25514] 10:12:57.509310 <... read resumed> "Ib3DQEBBQUAMIHKMQsw\nCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl\ncmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu\nLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT\naWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2Vyd"..., 4096) = 4096
[pid 25514] 10:12:57.509396 read(14,  <unfinished ...>
[pid 25513] 10:12:57.509419 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25513] 10:12:57.509494 read(14,  <unfinished ...>
[pid 25514] 10:12:57.509561 <... read resumed> "\n         46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:\n         a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:\n         21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:\n         a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:"..., 4096) = 4096
[pid 25514] 10:12:57.509649 read(14,  <unfinished ...>
[pid 25513] 10:12:57.509677 <... read resumed> "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25514] 10:12:57.509789 <... read resumed> ":44:6c:71:ae:01:20:6b:03:\n         a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7:\n         8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7:\n         2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2:\n         73:d0:e3:90:22:73:43:cd:f3:ef"..., 4096) = 4096
[pid 25514] 10:12:57.509872 read(14,  <unfinished ...>
[pid 25513] 10:12:57.509921 read(14, "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25513] 10:12:57.510032 read(14,  <unfinished ...>
[pid 25514] 10:12:57.510065 <... read resumed> "l.pki.wellsfargo.com/wsprca.crl\n\n            X509v3 Key Usage: critical\n                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign\n            X509v3 Subject Key Identifier: \n                26:95:19:10:D9:E8:A1:97:91:FF:DC:19:D9:B5:04:"..., 4096) = 4096
[pid 25514] 10:12:57.510185 read(14,  <unfinished ...>
[pid 25513] 10:12:57.510213 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25513] 10:12:57.510323 read(14,  <unfinished ...>
[pid 25514] 10:12:57.510350 <... read resumed> "         a8:85:d7:cc:95:97:4b:74:d8:9e:7e:f0:00:e4:0e:\n                    89:ae:49:28:44:1a:10:99:32:0f:25:88:53:a4:0d:\n                    b3:0f:12:08:16:0b:03:71:27:1c:7f:e1:db:d2:fd:\n                    67:68:c4:05:5d:0a:0e:5d:70:d7:d8:97:a0:bc:53:\n   "..., 4096) = 4096
[pid 25514] 10:12:57.510381 read(14, "db:aa:c6:37:22:a6:\n         fe:cc:20:74:a3:2d:a9:2e:6b:cb:c0:82:11:21:b5:93:79:ee:\n         44:86:be:d7:1e:e4:1e:fb\n-----BEGIN CERTIFICATE-----\nMIIFdjCCA16gAwIBAgIQXmjWEXGUY1BWAGjzPsnFkTANBgkqhkiG9w0BAQUFADBV\nMQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIEx"..., 4096) = 4096
[pid 25514] 10:12:57.510482 read(14, ":74:78:e8:c1:a2:09:63:\n                    9c:ef:a0:db:4f:9d:95:ab:20:4f:b7:b0:f7:87:5c:\n                    a6:a0:e4:37:38:c7:5c:e3:35:0f:2c:ad:a3:80:a2:\n                    ec:2e:5d:c0:cf:ed:8b:05:c2:e6:73:6e:f6:89:d5:\n                    f5:d2:46:8e:ea:"..., 4096) = 4096
[pid 25514] 10:12:57.510539 read(14,  <unfinished ...>
[pid 25513] 10:12:57.510560 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25513] 10:12:57.510631 read(14,  <unfinished ...>
[pid 25514] 10:12:57.510656 <... read resumed> "8+0mBe53oWprfi1tWFxK1I5nuPHa1UaK\nJ/kR8slC/k7e3x9cxKSGhxYzoacXGKUN5AXlK8IrC6KVkLn9YDxOiT7nnO4fuwEC\nAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFOBNv9ybQV0T6GTwp+kVpOGBwboxMA0GCSqGSIb3DQEBCwUAA4ICAQBqinA4\nWbbaixjIvirTthnVZil6Xc1bL3Mc"..., 4096) = 4096
[pid 25513] 10:12:57.510793 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25513] 10:12:57.510893 read(14,  <unfinished ...>
[pid 25514] 10:12:57.510956 read(14, "b1:e4:ef:9a:1a:d0:3d:69:\n         99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7:\n         43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09:\n         84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9:\n         b4:03:25:bc\n-----BEGIN CERTIFI"..., 4096) = 4096
[pid 25514] 10:12:57.511053 read(14,  <unfinished ...>
[pid 25513] 10:12:57.511079 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25513] 10:12:57.511167 read(14,  <unfinished ...>
[pid 25514] 10:12:57.511190 <... read resumed> "\n         d5:55:cf:fa:20:93:02:a2:9b:c3:23:93:4e:16:55:76:a0:70:\n         79:6d:cd:21:1f:cf:2f:2d:bc:19:e3:88:31:f8:59:1a:81:09:\n         c8:97:a6:74:c7:60:c4:5b:cc:57:8e:b2:75:fd:1b:02:09:db:\n         59:6f:72:93:69:f7:31:41:d6:88:38:bf:87:b2:bd:16:79:f9:"..., 4096) = 4096
[pid 25514] 10:12:57.511252 brk(0x175a000 <unfinished ...>
[pid 25513] 10:12:57.511275 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25513] 10:12:57.511407 read(14,  <unfinished ...>
[pid 25514] 10:12:57.511434 <... brk resumed> ) = 0x175a000
[pid 25514] 10:12:57.511465 read(14, "8:15:a5:\n                    10:01:2d:b3:32:76:a8:95:0d:b3:7a:9a:fb:07:10:\n                    78:11:6f:e1:8f:c7:ba:0f:25:1a:74:2a:e5:1c:98:\n                    41:99:df:21:87:e8:95:06:6a:0a:b3:6a:47:76:65:\n                    f6:3a:cf:8f:62:17:19:7b:0a:28"..., 4096) = 4096
[pid 25514] 10:12:57.511519 read(14, "AMAcGBWcqAwAABBRFsMLH\nClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB\nuvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl\nPwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP\nJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrs"..., 4096) = 4096
[pid 25514] 10:12:57.511610 read(14, "MCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf\nQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw\nMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV\nBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw\nNzE2MjM1OT"..., 4096) = 4096
[pid 25514] 10:12:57.511721 read(14,  <unfinished ...>
[pid 25513] 10:12:57.511786 <... read resumed> "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25513] 10:12:57.511932 read(14,  <unfinished ...>
[pid 25514] 10:12:57.511956 <... read resumed> "PzcU9LcnXgWHxUzI1NS41ox\nXZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==\n-----END CERTIFICATE-----\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb\n    Signature Algorithm: sha256Wit"..., 4096) = 4096
[pid 25514] 10:12:57.512031 read(14, "KQlkC+BsUa0Lf\nb1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9\n9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S\nzhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk\nOQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwE"..., 4096) = 4096
[pid 25514] 10:12:57.512133 read(14,  <unfinished ...>
[pid 25513] 10:12:57.512156 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25513] 10:12:57.512249 read(14,  <unfinished ...>
[pid 25514] 10:12:57.512271 <... read resumed> "OzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j\nb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF\nbnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg\nU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA\nA4GLADCBhwKBgQDN"..., 4096) = 4096
[pid 25514] 10:12:57.512388 read(14,  <unfinished ...>
[pid 25513] 10:12:57.512416 <... read resumed> "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25513] 10:12:57.512545 read(14,  <unfinished ...>
[pid 25514] 10:12:57.512580 <... read resumed> "GwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA\nA4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA\nZ70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv\n8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV\n-----END CERT"..., 4096) = 4096
[pid 25514] 10:12:57.512719 read(14,  <unfinished ...>
[pid 25513] 10:12:57.512804 <... read resumed> "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25513] 10:12:57.512922 read(14,  <unfinished ...>
[pid 25514] 10:12:57.512951 <... read resumed> "7:28:\n                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:\n                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:\n                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:\n                    8d:42:aa:24:01:39:e6:9c:3f:01:85"..., 4096) = 4096
[pid 25514] 10:12:57.513024 read(14,  <unfinished ...>
[pid 25513] 10:12:57.513047 <... read resumed> ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25513] 10:12:57.513113 read(14,  <unfinished ...>
[pid 25514] 10:12:57.513135 <... read resumed> "c0:6d:3a:b0:\n         f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96:\n         cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb:\n         22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39:\n         1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:"..., 4096) = 4096
[pid 25514] 10:12:57.513222 read(14,  <unfinished ...>
[pid 25513] 10:12:57.513245 <... read resumed> "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25513] 10:12:57.513319 read(14,  <unfinished ...>
[pid 25514] 10:12:57.513350 <... read resumed> "i. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! T"..., 4096) = 4096
[pid 25513] 10:12:57.513375 <... read resumed> "", 4096) = 0
[pid 25514] 10:12:57.513457 read(14,  <unfinished ...>
[pid 25513] 10:12:57.513496 close(14)   = 0
[pid 25513] 10:12:57.513533 munmap(0x7f03f4be6000, 4096) = 0
[pid 25514] 10:12:57.513800 <... read resumed> "  43:62:61:f3:d3:e2:d0:55:3f\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:\n         f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:\n         d"..., 4096) = 4096
[pid 25514] 10:12:57.513896 read(14, "G\nA1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp\nb24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl\ncnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv\nbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo8"..., 4096) = 4096
[pid 25514] 10:12:57.514065 read(14,  <unfinished ...>
[pid 25513] 10:12:57.514708 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25514] 10:12:57.514827 <... read resumed> "es Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com\n        Validity\n            Not Before: Aug  1 00:00:00 1996 GMT\n            Not After : Dec 31 23:59:59 2020 GMT\n        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consultin"..., 4096) = 4096
[pid 25514] 10:12:57.514937 read(14, "73:55:74:8d:76:\n                    72:a0:1d:9d:1d:c0:dd:3f:71\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sha1WithRSAEncryption\n         50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:\n         71:ad:64:c8:dd:77:d2:ef:59:55:e"..., 4096) = 4096
[pid 25514] 10:12:57.515042 read(14, "3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl\ncnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY\ndA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9\nWlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS\nv4d"..., 4096) = 4096
[pid 25514] 10:12:57.515173 read(14, ":ac:23:\n                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:\n                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:\n                    71:64:4c:65:2e:81:68:45:a7\n                Exponent: 65537 (0x10001)\n    Signature Algorithm: sh"..., 4096) = 4096
[pid 25514] 10:12:57.515264 read(14, "SBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4m"..., 4096) = 498
[pid 25514] 10:12:57.515359 read(14, "", 4096) = 0
[pid 25514] 10:12:57.515423 close(14)   = 0
[pid 25514] 10:12:57.515463 munmap(0x7f03f4be6000, 4096) = 0
[pid 25513] 10:12:57.515828 <... open resumed> ) = 14
[pid 25513] 10:12:57.515863 fstat(14, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:57, st_mtime=2015/12/30-10:12:57, st_ctime=2015/12/30-10:12:57}) = 0
[pid 25513] 10:12:57.515914 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be6000
[pid 25513] 10:12:57.515952 read(14, "MemTotal:        1048576 kB\nMemFree:          268076 kB\nCached:           339856 kB\nBuffers:               0 kB\nActive:           284220 kB\nInactive:         468160 kB\nActive(anon):     142728 kB\nInactive(anon):   277600 kB\nActive(file):     141492 kB\nInac"..., 1024) = 588
[pid 25514] 10:12:57.516547 open("/proc/meminfo", O_RDONLY|O_CLOEXEC <unfinished ...>
[pid 25513] 10:12:57.516590 close(14)   = 0
[pid 25513] 10:12:57.516644 munmap(0x7f03f4be6000, 4096) = 0
[pid 25513] 10:12:57.517433 alarm(300 <unfinished ...>
[pid 25514] 10:12:57.517470 <... open resumed> ) = 14
[pid 25514] 10:12:57.517493 fstat(14, {st_dev=makedev(144, 4282), st_ino=4026532091, st_mode=S_IFREG|0444, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2015/12/30-10:12:57, st_mtime=2015/12/30-10:12:57, st_ctime=2015/12/30-10:12:57}) = 0
[pid 25514] 10:12:57.517571 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03f4be6000
[pid 25514] 10:12:57.517617 read(14, "MemTotal:        1048576 kB\nMemFree:          268068 kB\nCached:           339856 kB\nBuffers:               0 kB\nActive:           284228 kB\nInactive:         468160 kB\nActive(anon):     142736 kB\nInactive(anon):   277600 kB\nActive(file):     141492 kB\nInac"..., 1024) = 588
[pid 25514] 10:12:57.517690 close(14)   = 0
[pid 25514] 10:12:57.517728 munmap(0x7f03f4be6000, 4096) = 0
[pid 25514] 10:12:57.518448 alarm(300 <unfinished ...>
[pid 25513] 10:12:57.518478 <... alarm resumed> ) = 0
[pid 25513] 10:12:57.518521 brk(0x177d000) = 0x177d000
[pid 25513] 10:12:57.518598 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2\211\n\243\266\237\334x\274\"`$\35\350\350\205-\3047\f)cOR\330\207\260\225\227\213\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258) = 258
[pid 25513] 10:12:57.518668 read(11,  <unfinished ...>
[pid 25514] 10:12:57.518693 <... alarm resumed> ) = 0
[pid 25514] 10:12:57.518726 brk(0x177d000) = 0x177d000
[pid 25514] 10:12:57.518867 write(11, "\26\3\1\0\375\1\0\0\371\3\3V\204\2\211\355\314\310\230L\356\1\26v\24\373\273\5]\202\355\376\5B\247\227\177\0331\213=\344T\0\0\204\3000\300,\300(\300$\300\24\300\n\0\243\0\237\0k\0j\0009\0008\0\210\0\207\3002\300.\300*\300&\300\17\300\5\0\235\0=\0005\0\204\300/\300+\300'\300#\300\23\300\t\0\242\0\236\0g\0@\0003\0002\300\22\300\10\0\232\0\231\0E\0D\0\26\0\23\3001\300-\300)\300%\300\16\300\4\300\r\300\3\0\234\0<\0/\0\226\0A\0\n\0\7\300\21\300\7\300\f\300\2\0\5\0\4\0\377\1\0\0L\0\v\0\4\3\0\1\2\0\n\0\10\0\6\0\31\0\30\0\27\0#\0\0\0\r\0\"\0 \6\1\6\2\6\3\5\1\5\2\5\3\4\1\4\2\4\3\3\1\3\2\3\3\2\1\2\2\2\3\1\1\0\5\0\5\1\0\0\0\0\0\17\0"..., 258) = 258
[pid 25514] 10:12:57.518942 read(11,  <unfinished ...>
[pid 25513] 10:12:57.548445 <... read resumed> "\26\3\3\0:\2\0", 7) = 7
[pid 25513] 10:12:57.548559 read(11, "\0006\3\3V\204\2\211\363&p\5\234\366\221Y\25gds\"\213\366\254A\"\23\366[\324gB\1Xi\17\0\0\237\0\0\16\377\1\0\1\0\0#\0\0\0\17\0\1\1", 56) = 56
[pid 25513] 10:12:57.548647 read(11, "\26\3\3\21\4", 5) = 5
[pid 25513] 10:12:57.548694 read(11, "\v\0\21\0\0\20\375\0\5p0\202\5l0\202\4T\240\3\2\1\2\2\20\31z\35\244j\16\6_\6_\347b\212'\261\2540\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2201\v0\t\6\3U\4\6\23\2GB1\0330\31\6\3U\4\10\23\22Greater Manchester1\0200\16\6\3U\4\7\23\7Salford1\0320\30\6\3U\4\n\23\21COMODO CA Limited1604\6\3U\4\3\23-COMODO RSA Domain Validation Secure Server CA0\36\27\r150917000000Z\27\r181203235959Z0d1!0\37\6\3U\4\v\23\30Domain C"..., 4356) = 4028
[pid 25513] 10:12:57.548756 read(11,  <unfinished ...>
[pid 25514] 10:12:57.549937 <... read resumed> "\26\3\3\0:\2\0", 7) = 7
[pid 25514] 10:12:57.549999 read(11, "\0006\3\3V\204\2\211\266\337\261;\304\237\230\2406\231\234\1\244f\313[\352\177\232\25\214\336bM\354WW\260\0\0\237\0\0\16\377\1\0\1\0\0#\0\0\0\17\0\1\1", 56) = 56
[pid 25514] 10:12:57.550056 read(11, "\26\3\3\21\4", 5) = 5
[pid 25514] 10:12:57.550093 read(11, "\v\0\21\0\0\20\375\0\5p0\202\5l0\202\4T\240\3\2\1\2\2\20\31z\35\244j\16\6_\6_\347b\212'\261\2540\r\6\t*\206H\206\367\r\1\1\v\5\0000\201\2201\v0\t\6\3U\4\6\23\2GB1\0330\31\6\3U\4\10\23\22Greater Manchester1\0200\16\6\3U\4\7\23\7Salford1\0320\30\6\3U\4\n\23\21COMODO CA Limited1604\6\3U\4\3\23-COMODO RSA Domain Validation Secure Server CA0\36\27\r150917000000Z\27\r181203235959Z0d1!0\37\6\3U\4\v\23\30Domain C"..., 4356) = 4028
[pid 25514] 10:12:57.550145 read(11, "]G'`\326\3738;lr\242\224\370B\32\337\355o\6\214E\302\6\0\252\344\350\334\331\265\341sx\354\366#\334\321\335l\216\32\217\245\352T|\226\267\303\376U\216\215I^\374d\273\317>\275\226\353i\315\277\340H\361b\202\20\345\fFW\3623\332\320\310c\355\306\37\224\5\226J\32\221\321\367\353\317\217R\256\r\10\331>\250\240Q\351\301\207t\325\311\367t\253.S\373\273z\373\227\342\370\37&\217\263\322\240\3407[(;1\345\16W-Z\270\255y\254^ f\32\245\271\246\2659\301\365\230C\377\356\371\247\247\375\356\312$=\200\26\304\27\217\212\301`\241\f\256[CG\221K\325\232\27_\371\324\207\301\302\214\267\347\342\0170\0317\206\254\340\334B\3\346\224\250\235\256\375\17$Q\224\316\222\10\321\374P\360\3@{\210Y\355\16\335\254\322w\2024\334\6\225\2\330\220\371-\3527\325\32`\320g \327\330B"..., 328) = 328
[pid 25513] 10:12:57.552735 <... read resumed> "]G'`\326\3738;lr\242\224\370B\32\337\355o\6\214E\302\6\0\252\344\350\334\331\265\341sx\354\366#\334\321\335l\216\32\217\245\352T|\226\267\303\376U\216\215I^\374d\273\317>\275\226\353i\315\277\340H\361b\202\20\345\fFW\3623\332\320\310c\355\306\37\224\5\226J\32\221\321\367\353\317\217R\256\r\10\331>\250\240Q\351\301\207t\325\311\367t\253.S\373\273z\373\227\342\370\37&\217\263\322\240\3407[(;1\345\16W-Z\270\255y\254^ f\32\245\271\246\2659\301\365\230C\377\356\371\247\247\375\356\312$=\200\26\304\27\217\212\301`\241\f\256[CG\221K\325\232\27_\371\324\207\301\302\214\267\347\342\0170\0317\206\254\340\334B\3\346\224\250\235\256\375\17$Q\224\316\222\10\321\374P\360\3@{\210Y\355\16\335\254\322w\2024\334\6\225\2\330\220\371-\3527\325\32`\320g \327\330B"..., 328) = 328
[pid 25513] 10:12:57.553870 stat("/etc/localtime",  <unfinished ...>
[pid 25514] 10:12:57.554411 stat("/etc/localtime",  <unfinished ...>
[pid 25513] 10:12:57.554443 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25513] 10:12:57.554500 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25513] 10:12:57.554560 close(7)    = 0
[pid 25513] 10:12:57.554597 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25513] 10:12:57.554667 fcntl(7, F_GETFD) = 0
[pid 25513] 10:12:57.554712 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25513] 10:12:57.554801 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5401762, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:50, st_ctime=2015/12/30-10:12:50}) = 0
[pid 25513] 10:12:57.554855 write(7, "2015-12-30 10:12:57 [25513] 1aEJMY-0006cO-Sq [162.213.251.170] SSL verify error: certificate name mismatch: \"/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.registrar-servers.com\"\n", 190) = 190
[pid 25513] 10:12:57.554925 read(11, "\26\3\3\4\16", 5) = 5
[pid 25513] 10:12:57.554963 read(11, "\f\0\4\n\1\0\255\20~\36\221#\251\320\326`\372\247\225Y\305\37\242\rd\345h;\237\321\265K\25\227\266\35\nu\346\372\24\35\371ZV\333\257\232<@{\241\337\25\353=h\2120\234\30\16\35\346\270Z\22t\240\246m?\201R\255j\302\22\2207\311\355\357\332M\370\331\36\217\357U\2679Kz\325\267\320\266\301\"\7\311\371\215\21\3554\333\366\306\272\v,\213\274'\276j\0\340\240\271\304\227\10\263\277\2121p\221\2106\201(a0\274\211\205\333\26\2\347\24A]\2230'\202s\307\3361\357\334s\20\367\22\37\325\240t\25\230}\232\334\nHm\315\371:\314D2\203\2071]u\341\230\306A\244\200\315\206\241\271\345\207\350\276`\346\234\311(\262\271\305!r\344\23\4.\233#\361\v\16\26\347\227c\311\265=\317K\250\n)\343\373s\301k\216u\271~\363c\342\377\243\37q\317\235\3458Nq\270\34\n\304"..., 1038) = 1038
[pid 25513] 10:12:57.555109 read(11, "\26\3\3\0\4", 5) = 5
[pid 25513] 10:12:57.555149 read(11, "\16\0\0\0", 4) = 4
[pid 25514] 10:12:57.555645 <... stat resumed> {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25514] 10:12:57.555702 stat("/etc/localtime", {st_dev=makedev(144, 4215), st_ino=108281888, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3543, st_atime=2015/12/22-09:30:28, st_mtime=2015/06/18-20:50:28, st_ctime=2015/12/22-09:30:29}) = 0
[pid 25514] 10:12:57.555838 close(7)    = 0
[pid 25514] 10:12:57.555876 open("/var/log/exim_mainlog", O_WRONLY|O_APPEND) = 7
[pid 25514] 10:12:57.555919 fcntl(7, F_GETFD) = 0
[pid 25514] 10:12:57.555951 fcntl(7, F_SETFD, FD_CLOEXEC) = 0
[pid 25514] 10:12:57.555982 fstat(7, {st_dev=makedev(144, 4215), st_ino=109319164, st_mode=S_IFREG|0640, st_nlink=1, st_uid=47, st_gid=12, st_blksize=4096, st_blocks=10560, st_size=5401952, st_atime=2015/12/27-04:06:05, st_mtime=2015/12/30-10:12:57, st_ctime=2015/12/30-10:12:57}) = 0
[pid 25514] 10:12:57.556026 write(7, "2015-12-30 10:12:57 [25514] 1aEJMY-0006cO-Sq [199.188.200.35] SSL verify error: certificate name mismatch: \"/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.registrar-servers.com\"\n", 189) = 189
[pid 25514] 10:12:57.556086 read(11, "\26\3\3\4\16", 5) = 5
[pid 25514] 10:12:57.556124 read(11, "\f\0\4\n\1\0\255\20~\36\221#\251\320\326`\372\247\225Y\305\37\242\rd\345h;\237\321\265K\25\227\266\35\nu\346\372\24\35\371ZV\333\257\232<@{\241\337\25\353=h\2120\234\30\16\35\346\270Z\22t\240\246m?\201R\255j\302\22\2207\311\355\357\332M\370\331\36\217\357U\2679Kz\325\267\320\266\301\"\7\311\371\215\21\3554\333\366\306\272\v,\213\274'\276j\0\340\240\271\304\227\10\263\277\2121p\221\2106\201(a0\274\211\205\333\26\2\347\24A]\2230'\202s\307\3361\357\334s\20\367\22\37\325\240t\25\230}\232\334\nHm\315\371:\314D2\203\2071]u\341\230\306A\244\200\315\206\241\271\345\207\350\276`\346\234\311(\262\271\305!r\344\23\4.\233#\361\v\16\26\347\227c\311\265=\317K\250\n)\343\373s\301k\216u\271~\363c\342\377\243\37q\317\235\3458Nq\270\34\n\304"..., 1038) = 1038
[pid 25514] 10:12:57.556262 read(11, "\26\3\3\0\4", 5) = 5
[pid 25514] 10:12:57.556302 read(11, "\16\0\0\0", 4) = 4
[pid 25513] 10:12:57.578388 write(11, "\26\3\3\1\6\20\0\1\2\1\0\246G\351r\32|\320oOx0T\244uX\200\n\250\362 \312\240:\270\200\"\272|K\nR\310\332\326K\266nM\246\210\331\341+\267E\362g\241fQ\0046\372\270\270\1\214\27a\246&\n\217\26\321\352`\342\352\177\17!=d\36\302\260\272\301v\204\200\343\231>t)\7o\10JB\226\1cm\210\241{\223\212\332\v3XtW\0016\353\251\2\362\215\177\347T\215;\263\212\7\267P\264\313\231\343\v\356\342\272 \206M\6\340\347\312\313d\320\377\324\22\377\3\204\350]\275\204\323\27\311\274\r\233\371)\271\273\351\335-\212t\220iR\217\265\33\300a\366\321\346v\344\310/h\10\217=\263\f\v\340V\205>\272\321[\204lrn^\270\377A\3567\34\24>^I\375W\363eC\326\37\354\217\277c\177yv\211\4\270A\301\312\253\3{\215dj\360z&j1\214d\265"..., 318) = 318
[pid 25513] 10:12:57.578701 read(11,  <unfinished ...>
[pid 25514] 10:12:57.578881 write(11, "\26\3\3\1\6\20\0\1\2\1\0u\30t5\372|\370\242R\36I\31%\4Z\2261\367\351\345G\3671\367\225:\354\34\201\354\337wZ4\v\265\3\274Q\235H\241q\237\255E\306&\2\251\227i\263\35Gg\25\264\17h\210\255N\340\327\361\244|\313\17\ns\234\205\372Q!O\344\262[V\16\213!]\277d\357\373X\205\306\263\264\272\233\361%lJ\322)\364\257\313\0350\366(\321\370\311\177\257\277\5-\355\317\376\334\322\23\366\3515\227\6pY\20\347\fkp\0232\255\310Y\331./\216\2556vn\177\317C\210\316\216\316\30~8\320\"Y\2514\221p<D\27\0333k\310j\212s[V\244\326\307\25\210\252\200\267\330V8\265\3238\377\232\231}\22\25\354Q\224\32\fb\0356\245k\17\361m\200P\326 \324\16\251#\221\337s\250G\276\347\313+\237\263\335\27\16z\356\255p\177\"\234Y\213\364\247\302"..., 318) = 318
[pid 25514] 10:12:57.578959 read(11,  <unfinished ...>
[pid 25513] 10:12:57.602486 <... read resumed> "\26\3\3\0\252", 5) = 5
[pid 25513] 10:12:57.602553 read(11, "\4\0\0\246\0\0\0\310\0\240\211\246~U\366\241\273\24 \374\277\th\30\221m-\367\4\374\375!\0335\263\325\251\267>\334Sir\376\371\207OOw\24\213\16\324S\372|\244\231\305\3775\222\4j\357\1\267\344\324\26/\317\245\223]\212\372\225\240\374\212ca\265\347\343\216\"2U\3376A5?\267\350bfG\210\262T)\317\\\263x\331\261c\212\1\247\253\221}\3340\372\2016Fsb\\\2473\366\0246\211\215\352\10\342\363\306-'&O\356\224R\275\361$\205I\324g\217\277\202p@\213\222{\373W\221\345\221/\366>\245\177", 170) = 170
[pid 25513] 10:12:57.602626 read(11, "\24\3\3\0\1", 5) = 5
[pid 25513] 10:12:57.602664 read(11, "\1", 1) = 1
[pid 25513] 10:12:57.602734 read(11, "\26\3\3\0(", 5) = 5
[pid 25513] 10:12:57.602779 read(11, "j\244%\241\220\221\221@1\244\f\\E\204JJw(\221\35\205\255\205\264\223\374-$\314l\36gi\227sI\370\205\234\7", 40) = 40
[pid 25513] 10:12:57.602851 alarm(0)    = 300
[pid 25513] 10:12:57.602920 write(11, "\27\3\3\0009J\263z+\324\236\246\360\1\231rQ\217\344\362\367\35\257\21\247\25\234X&\203\200\6\225\222\23\310\201J\347A\377\266fI\253B\3i\326/t\27\356\266\330\247\226%\213\242\24p", 62) = 62
[pid 25513] 10:12:57.602997 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25514] 10:12:57.603302 <... read resumed> "\26\3\3\0\252", 5) = 5
[pid 25514] 10:12:57.603329 read(11, "\4\0\0\246\0\0\0\310\0\240)#fh-\267L\27)\226>\f\260{\242G0W\2111\32\344@\235-\237)\224\203\350\222\225\257\222\334\312\213+6[a4\5CJ[C\221h\304m\5`\16\215\307c!\334\265\t\"\370\244\360+\221\347{\23\262\274n.\r\36\0\247\352\347\326\n\240\230\353\301\362v\33\304\24U\254\356\352\212\3444\314\344+#~\35k\2756\246X\216a\337\0\277c\204'\3503\17\1hC+d\201\30\2710\207\r\222\376\35=\203\27\225\205\375\274_3\207\34\250\22t]\325\207\343\215\306s\367+\235.\340", 170) = 170
[pid 25514] 10:12:57.603400 read(11, "\24\3\3\0\1", 5) = 5
[pid 25514] 10:12:57.603437 read(11, "\1", 1) = 1
[pid 25514] 10:12:57.603499 read(11, "\26\3\3\0(", 5) = 5
[pid 25514] 10:12:57.603539 read(11, "\266\266y\3151\351\370\2\177\3\204y\34\226\277ip\313\24\214j\340\17X\276\301\300\371=\245P|\301\302\2023:|\226b", 40) = 40
[pid 25514] 10:12:57.603604 alarm(0)    = 300
[pid 25514] 10:12:57.603668 write(11, "\27\3\3\0009\242LJ\203\31\2n/R\f\274\350LK~o\34\377vB\245ZK\345\336\10\5\227\4\240|\371\211\213\376\304\324\254c+y\f\212\6\324\323\226\320\312L\365$\222\371 \267z", 62) = 62
[pid 25514] 10:12:57.603735 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25513] 10:12:57.619016 <... select resumed> ) = 1 (in [11], left {299, 984039})
[pid 25513] 10:12:57.619100 read(11, "\27\3\3\0\274", 5) = 5
[pid 25513] 10:12:57.619144 read(11, "j\244%\241\220\221\221Ac\303\276\226\320@\220\231\337\207C[\34vY\36\321\346$\215\32\fv\224\260\34\315*B\26\223\255\322\360\354\213\266\f\204{\337\333\2709\322\\\276\262\327\211(\230\300\20\2135\7\4x\26\367-\353\34b\365\332\352\3nn\2548\357\224\302a\255\212\205;s\345*Lg\370\275\307\365)\306\234v\17\360<Zk\24v\314\273RB\211\262\326\215\345\343\304\0218k\256\355\226\317\212\2148\240\224\222\35\361\376\234\236\213\2028\323\223c\345\333>\360\273\307\227\252h7\22\7\207iK\235\324\201\224\210\255\22!\363y\325-f\302\203/\314\255$\253\207\357$\317\210\21\262\231)", 188) = 188
[pid 25513] 10:12:57.619235 write(11, "\27\3\3\0\260J\263z+\324\236\246\361&\277\333\363@\21X\0303\324YOPv\1]!\323\370\371.g\307l\325\235+\360Z\334\3700\22\346\23\317\201\36\343\302\v\274\17*\377-9\210\323\303\336K\5\346T\274\10%\205!\234\371Yk\353\305\205\\\203X\361V\357h8\301=x\377$\361\32\26\252k\n}'\2552\252n\t\256\361\25\nh1^\26w\"\270\1$#;\200\325\10\353\7\271\2147\272\303<=2\33\273\6I&l\301\206\r\5\37\0076\343\225\361/\267x\265~n\37mQ\263\256\334\207\234\240_\240\322\"\f\231\345\307\16\34\t\245$\261i\272", 181) = 181
[pid 25513] 10:12:57.619315 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25514] 10:12:57.620928 <... select resumed> ) = 1 (in [11], left {299, 982943})
[pid 25514] 10:12:57.620971 read(11, "\27\3\3\0\274", 5) = 5
[pid 25514] 10:12:57.621023 read(11, "\266\266y\3151\351\370\3S\204\202P\20\370\337\3\240^\"6F\303\36\323\16v\224GC\242\2022\17\222\356(W8\241\273\325\377\t\244\356\23\21cF\356\342\365\315\r\302\332\360\7f\345\262\345\343\226\366d\237\273\v\375\"l\231\273&\320\252\300L^\\\326#\317\25\236\251\320\242m\256q\366\365\226\304\362\346O\355C\237\246\251\21s\2405\267\327$\1\370\230\362\305\f\326\270\206\344\215/\263j\373\304xAp\2473=\331tu\177\301\374\342\331Gt\f\237\314\315i\1\331G\373u\257J[T\370\331]\234\271\271\37\325\204O\263\204;\350\35\223\17P\371\36\27\313\253g\356fUV1F\254", 188) = 188
[pid 25514] 10:12:57.621125 write(11, "\27\3\3\0}\242LJ\203\31\2n0\273\1\250!xK\3501\35\205\202\360\224i+\352\313\37\356#\220\10\360\306\366\362I\16+\326\257\345E9\337\t\301\37\25\237d\0\0e\312&J\276j]28\273\227\243\241\30\252\306\333\355\347\377B\316z?\307\205\321A8W\224$\356Ab\5\21\264<\30\245\216\17\rD\272(\223=}:\235\10y\220c\321\350\253\227\266\242\4A\234\352\240\245\233\"\236z\313\325", 130) = 130
[pid 25514] 10:12:57.621199 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25513] 10:12:57.635519 <... select resumed> ) = 1 (in [11], left {299, 983848})
[pid 25513] 10:12:57.635579 read(11, "\27\3\3\0 ", 5) = 5
[pid 25513] 10:12:57.635629 read(11, "j\244%\241\220\221\221B\327)Y\331s\\\314\204<\32\205\301\221?2\304\341\377\221\327-\206\356\357", 32) = 32
[pid 25513] 10:12:57.635676 select(12, [11], NULL, NULL, {300, 0} <unfinished ...>
[pid 25514] 10:12:57.637259 <... select resumed> ) = 1 (in [11], left {299, 983976})
[pid 25514] 10:12:57.637294 read(11, "\27\3\3\0 ", 5) = 5
[pid 25514] 10:12:57.637333 read(11, "\266\266y\3151\351\370\4\316\236\323\0\216\360\343\r\277\342\27\355\nvY\345\262\257a\374\240h\0+", 32) = 32
[pid 25514] 10:12:57.637376 select(12, [11], NULL, NULL, {300, 0}